instar 1.3.1221 → 1.3.1223

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "8e6606a6722433c5ffc15b3870402283c5406083a14cdbd0e18e735731e2aae2",
-  "packageVersion": "1.3.1221",
+  "packageVersion": "1.3.1223",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "5fa578c9e59c4db0835d48d02776497a23b3fbc74c2f0048192dd5ad9da9c679",
+  "sha256": "61b875cd1e0246e1a8594066393f7fef2f166b258b2bc88e589814bdb295eb0c",
   "registrySha256": "8e6606a6722433c5ffc15b3870402283c5406083a14cdbd0e18e735731e2aae2",
-  "packageVersion": "1.3.1221"
+  "packageVersion": "1.3.1223"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "8e6606a6722433c5ffc15b3870402283c5406083a14cdbd0e18e735731e2aae2",
   "articleCount": 90,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1221"
+  "packageVersion": "1.3.1223"
 }

package/src/scaffold/templates.ts

@@ -1729,7 +1729,7 @@ instar test-as-self --slack                          # Slack permission demonstr
 
 Progress monitoring must not manufacture user-facing narration. These systems are signals, never gates, and every error path fails toward silence.
 - **Silent-freeze watchdog** (ActiveWorkSilenceSentinel): before claiming a session is stuck, it re-captures the LIVE frame and corroborates — if the frame still shows an active-work indicator (spinner / "esc to interrupt"), a sub-agent is live, or it's a clean idle prompt, it stays SILENT. It speaks only when genuinely wedged, and even then hedges ("…hasn't changed in N min and a nudge didn't wake it — it may be stuck, or on a long task I can't see into. Want me to check?"). Threshold raised 15m→30m; a 90m frozen-indicator backstop still surfaces a real mid-tool hang. Tune/disable: \`monitoring.activeWorkSilenceSentinel.enabled\` (off), \`.silenceThresholdMs\` (default 30m), \`.activeWorkMaxFrozenIndicatorMs\` (default 90m).
-- **Command-watchdog attribution:** \`SessionWatchdog\` never interrupts the Codex framework host or known bounded external waiters (including safe-merge and GitHub watch commands). If it interrupts a genuinely stuck user command, its audit entry names \`principal: session-watchdog\` and \`operatorInitiated: false\`; Codex's generic "aborted by user" text is transport wording, not proof the operator acted. Continuation is owned by the canonical continuation/recovery funnel, never an independent watchdog prompt.
+- **Command-watchdog attribution:** \`SessionWatchdog\` never interrupts the Codex framework host, known bounded external waiters, or pinned long-lived test/compiler services such as Vitest's esbuild service. A selected descendant is signaled directly only after an action-time PID/parent/argv identity check; the watchdog never sends pane-wide Ctrl+C for a descendant helper. If it interrupts a genuinely stuck user command, its audit entry names \`principal: session-watchdog\` and \`operatorInitiated: false\`; Codex's generic "aborted by user" text is transport wording, not proof the operator acted. Continuation is owned by the canonical continuation/recovery funnel, never an independent watchdog prompt.
 - **Crash-safe inbound delivery:** Normal tmux injection and Codex stranded-draft key attempts use FULL-durable armed/started/terminal phases. A crash-open mutation becomes \`effect-unknown\` and is never blindly repeated. Diagnose privacy-safe counts at \`GET /sessions/inbound-delivery-status\`; no message body is exposed.
 - **PromiseBeacon is internal by default:** commitment cadence, detection, revival, and escalation bookkeeping continue, but PromiseBeacon produces no topic/Slack messages, close-outs, escalation statuses, or Attention items. User output requires an explicit deployment opt-in with \`promiseBeacon.userOutputEnabled: true\`; do not enable it merely to retain follow-through. Effectiveness remains measurable in \`logs/sentinel-events.jsonl\` and the per-feature LLM-metrics surface (feature keys \`active-work-silence\`, \`promise-beacon\`).
 

package/upgrades/1.3.1222.md

@@ -0,0 +1,72 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The session watchdog now recognizes Vitest's long-lived esbuild service as
+framework infrastructure and excludes it before stuck-command judgment. If a
+genuine descendant process must be stopped, the watchdog revalidates the exact
+process identity and session incarnation immediately before signaling that
+process, then escalates through bounded targeted signals instead of sending a
+pane-wide interrupt that can collapse the surrounding Codex turn.
+
+Codex session discovery now uses the maintained state cache on asynchronous
+control-plane paths, and quiet Codex panes are not synchronously probed unless
+there is evidence of a stranded draft. This keeps test execution from starving
+health and Telegram handling. Recovery notices also state their actual queue
+reason so operators can distinguish a queued continuation from a delivered
+one.
+
+Inbound deliveries whose physical effect cannot be proven after bounded
+observation now enter an explicit terminal effect-unknown state. They remain
+auditable without occupying live-capacity slots forever, preventing an
+ambiguous historical backlog from blocking new Telegram messages.
+
+The release canary also found a second observer defect under real load: when a
+busy Codex transcript grew by more than one read budget, a read ending partway
+through the next JSONL record discarded the valid complete prefix as unknown.
+The observer now durably advances through the last complete record and re-reads
+the partial tail on its next bounded sweep. Truly oversized single records,
+malformed JSON, schema drift, and identity mismatches still fail closed.
+
+## What to Tell Your User
+
+Long-running Codex test work is protected from false watchdog interruptions,
+and the agent's health and messaging paths remain responsive while those tests
+run. Ambiguous old deliveries remain visible for investigation but no longer
+crowd new messages out of the live queue.
+
+## Summary of New Capabilities
+
+- Automatic protection for the exact Vitest esbuild service process.
+- Process-targeted watchdog remediation with action-time identity checks.
+- Responsive cached session discovery on asynchronous control-plane paths.
+- An explicit terminal state for deliveries whose physical effect is unknown.
+- Multi-pass observation of valid busy-session transcript backlogs without
+  false unknown outcomes at non-aligned byte boundaries.
+- Clear queue-reason wording in Codex recovery notices.
+
+## Evidence
+
+On topic 67366, the watchdog audit and live process tree showed the watchdog
+selecting Vitest's persistent esbuild service and then issuing a pane-wide
+interrupt; the surrounding test run collapsed while the local health endpoint
+also stopped responding and Telegram retried the inbound message. The repaired
+candidate's focused unit, HTTP integration, and production-lifecycle E2E gates
+all pass, including a real long-running Vitest worker whose esbuild service
+survives unchanged while the lifecycle suite completes. A backed-up copy of the
+live inbound ledger contained 496 ambiguous rows consuming capacity; applying
+the new terminal transition reduced the live count to four while retaining the
+rows for audit, and normal inbound dispatch resumed.
+
+The first exact-candidate two-hour/50-delivery canary correctly refused to sign
+after finding three false unknowns on unrelated busy sessions. Their transcript
+records proved the messages and responses existed beyond a non-aligned 256 KiB
+scan boundary. The corrected scanner has unit, integration, and production-wired
+E2E coverage for that exact multi-budget shape. The fresh corrected candidate
+then passed 50/50 deliveries over 7,213,141 ms, all required special cases,
+30/30 responsiveness samples, and zero false-unknown, exhaustion, duplicate
+ownership, lost-input, or stale-owner outcomes. Echo signed the resulting
+evidence and the certified source manifest binds its exact digest and bytes.

package/upgrades/1.3.1223.md

@@ -0,0 +1,50 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+instar gates codex model ids against a closed list — an unknown id is refused so a
+typo can never launch a session that dies at startup. That list did not include
+`gpt-6-astra`, so pinning a topic to it was refused `off-enum` even on machines whose
+codex CLI runs the model perfectly well. Sessions launched with the model passed
+directly were unaffected, which made the gap read as "instar doesn't support this
+model" rather than "instar's list is stale."
+
+The id is added, verified working first: codex CLI 0.153.4 runs it; 0.149.0 returns
+`400 … requires a newer version of Codex`. Only observed-working ids are added — a
+plausible sibling name that was never run is still refused, and a test now asserts
+that refusal so the list cannot drift from "verified" to "seemed likely."
+
+The second half is the durable one. The `/sessions/spawn` route did not read the
+shared list; it carried its own hand-typed copy, "kept in lockstep" by comment with
+nothing enforcing it. Because `KNOWN_MODEL_IDS['codex-cli']` already IS
+`KNOWN_CODEX_MODEL_IDS`, the general arm every other framework uses yields an
+identical list — so the codex special case is deleted rather than kept in sync. A
+test asserts the two surfaces resolve to one list, and it was falsified by
+deliberately re-splitting them before being trusted.
+
+## What to Tell Your User
+
+You can now pin a conversation to codex's gpt-6-astra model the way you pin any
+other model — just say so in the topic. If your machine's codex tool is older than
+version 0.153.4 the model itself will refuse at launch, so update it there first.
+Nothing changes for any model that already worked.
+
+## Summary of New Capabilities
+
+- `gpt-6-astra` is a valid codex model id for topic-profile pins and session spawns.
+- Unverified sibling `gpt-6-*` names still fail closed, now with a test holding that.
+- The spawn route and the pin validator read one codex list instead of two, so a
+  future model can no longer be spawn-accepted while pin-refused.
+
+## Evidence
+
+Unit tests cover the new id against the pin validator and the spawn route, the
+fail-closed refusal of an unverified sibling id, and the single-list parity between
+`KNOWN_MODEL_IDS['codex-cli']` and `KNOWN_CODEX_MODEL_IDS`. Each was falsified before
+being trusted: removing the id fails both acceptance tests for the right reason, and
+pointing the map at a filtered copy fails the parity guard. Typecheck clean; full unit
+suite green. Live verification of the model against both codex CLI versions is
+recorded in the side-effects artifact.

package/upgrades/inbound-delivery-unknown-terminalization.eli16.md

@@ -0,0 +1,36 @@
+# Inbound Delivery Capacity Recovery — Plain-English Overview
+
+> The one-line version: delivery attempts whose observation window ended uncertain must stop occupying the finite live-message queue.
+
+## The problem in one breath
+
+Instar safely refused to guess whether hundreds of older injected messages were consumed, marking them “unknown.” However, it left their transport state as “dispatched,” and the admission counter treats every dispatched row as live. Once 500 such rows accumulated, every new Telegram message was rejected with “Message could not be delivered to the session.”
+
+## What already exists
+
+- **Durable inbound journal** — records each physical terminal injection before it happens so crashes cannot silently replay uncertain effects.
+- **Codex delivery observer** — watches the composer and rollout transcript until it proves consumption/response or reaches a fixed observation deadline.
+- **Admission ceilings** — prevent an unbounded number of live rows or bytes from exhausting the server.
+- **Terminal evidence retention** — keeps consumed, failed, and effect-unknown evidence for audit, then garbage-collects it under bounded age/count rules.
+
+## What this adds
+
+When the observer reaches its deadline without proof, the existing `markObservationUnknown` transition now records `effect-unknown` as the transport state as well as unknown transcript/composer eligibility. This does not claim that the message succeeded or failed. It only makes the already non-replayable uncertainty terminal, allowing the admission counter to release its slot while retaining the evidence for audit.
+
+The status projection now reports these records as `effect-unknown` before considering their eligibility label, so uncertain-effect metrics remain honest. A regression test fills a one-row admission capacity, terminalizes the uncertain observation, verifies capacity returns, and verifies that a subsequent message can be prepared.
+
+## The safeguards
+
+**No automatic replay.** Effect-unknown is explicitly non-replayable, preserving the core no-duplicate guarantee.
+
+**No evidence deletion.** Rows are retained under the existing terminal evidence policy. This change is a state transition, not data erasure.
+
+**Bounded authority.** Only dispatched rows that the observer already selected after its observation deadline can take this transition. Prepared or actively observed rows are untouched.
+
+## What ships when
+
+The transition and status correction ship together. Existing stale rows on this machine are migrated with the identical narrow predicate after a complete SQLite backup; future rows self-terminalize through the observer.
+
+## What you actually need to decide
+
+Should expired, already-uncertain delivery evidence become terminal so it cannot permanently block new Telegram messages?

package/upgrades/side-effects/codex-gpt6-astra-allowlist.md

@@ -0,0 +1,299 @@
+# Side-Effects Review — codex `gpt-6-astra` allowlist + codex spawn-arm de-duplication
+
+**Version / slug:** `codex-gpt6-astra-allowlist`
+**Date:** 2026-09-05
+**Author:** Echo (instar-dev agent)
+**Second-pass reviewer:** required (touches `/sessions/spawn` allow decision — session lifecycle)
+
+## Summary of the change
+
+Two changes, one root cause. (1) `gpt-6-astra` is added to `KNOWN_CODEX_MODEL_IDS`
+(`src/core/ModelTierEscalation.ts`) — the closed enum the topic-profile validator and the
+spawn route both gate codex model ids against. It was absent, so pinning a topic to a model
+that codex CLI ≥ 0.153.4 runs fine was refused `off-enum`, while sessions launched with the
+model passed directly ran it happily — a capability the agent HAD but could not be
+configured to use. (2) The spawn route's codex special-case arm in `src/server/routes.ts` is
+deleted. That arm read `CODEX_MODELS_SUBSCRIPTION`, a hand-maintained literal copy of the
+same list, "kept in lockstep" by comment only with nothing enforcing it. `KNOWN_MODEL_IDS['codex-cli']`
+IS `KNOWN_CODEX_MODEL_IDS`, so the general arm every other framework already uses yields the
+identical list; deleting the special case removes the drift class instead of documenting it.
+
+Files: `src/core/ModelTierEscalation.ts`, `src/server/routes.ts`,
+`tests/unit/topicProfileValidation.test.ts`, `tests/unit/route-validation-edge.test.ts`.
+
+## Decision-point inventory
+
+- `validateModelId` (`src/core/topicProfileValidation.ts`, reads `KNOWN_MODEL_IDS`) — **modify (data only)** — the closed enum it gates topic-profile model pins against gains one live-verified id. The check's logic and fail-closed shape are untouched.
+- `POST /sessions/spawn` model allowlist (`src/server/routes.ts`) — **modify (source of the list, not the decision)** — the codex arm is removed; codex now reads the same canonical per-framework map as every other framework. Accepted set is provably identical to the post-(1) codex list.
+
+---
+
+## 1. Over-block
+
+**What legitimate inputs does this change reject that it shouldn't?**
+
+None newly. The change only ever WIDENS the accepted set, by exactly one id
+(`gpt-6-astra`). Every id accepted before is still accepted: `KNOWN_MODEL_IDS['codex-cli']`
+is a reference to `KNOWN_CODEX_MODEL_IDS`, and `GENERIC_TIERS` is still spread in both arms.
+The residual over-block is pre-existing and deliberate: sibling `gpt-6-*` names that were
+never live-verified are still refused `off-enum`. That is the intended fail-closed posture
+(a typo must not strand a topic on a model the CLI will reject at launch), and it is now
+asserted by a test rather than left implicit.
+
+---
+
+## 2. Under-block
+
+**What failure modes does this still miss?**
+
+- The enum cannot tell whether the LOCAL codex CLI is new enough. `gpt-6-astra` needs codex
+  CLI ≥ 0.153.4; 0.149.0 returns `400 … requires a newer version of Codex`. A pin set on a
+  machine with a current CLI, then resolved on a machine with an older one, still fails at
+  launch. That is unchanged by this PR and is the same shape the 5.6 family already carries
+  (its comment records the ≥ 0.144.0 floor). Naming it rather than fixing it here: a CLI
+  version probe at pin time is a real feature with its own failure modes, not a line in an
+  enum. <!-- tracked: ACT-420 -->
+- The enum is a static list, so a genuinely new codex model is refused until a human adds it.
+  That is the deliberate closed-enum design (`§5.2(c)`), not a miss.
+
+---
+
+## 3. Level-of-abstraction fit
+
+Correct layer, and the change moves it further in the right direction. The list is data
+consumed by two existing validators; this PR adds an entry and deletes a duplicate reader.
+It does not add a new check, a new layer, or a parallel path. The deletion specifically
+removes a lower-quality copy in favour of the canonical primitive that already existed —
+the "does a lower-level primitive already exist that this should USE instead of
+re-implementing?" question, answered by deletion.
+
+---
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] No — this change has no block/allow surface of its own.
+
+The blocking authority (a closed-enum validator) already existed and is unchanged in shape,
+strictness, and failure mode. This PR edits the DATA the authority reads and removes a
+duplicate copy of that data. No brittle logic gains authority; no authority is weakened —
+unknown ids still fail closed.
+
+---
+
+## 4b. Judgment-point check (Judgment Within Floors standard)
+
+No new static heuristic at a competing-signals decision point. The domain is enumerable by
+construction: it is a closed set of model identifiers accepted by a CLI, which is exactly
+the "it's an invariant, name it" case. There are no competing live signals to arbitrate —
+an id is in the vendor's supported set or it is not.
+
+---
+
+## 5. Interactions
+
+- **Shadowing:** none introduced. The codex arm and the general arm were mutually exclusive
+  branches of one ternary; collapsing them removes a branch rather than reordering checks.
+  `GENERIC_TIERS` still precedes the per-framework ids in the spread, unchanged.
+- **Double-fire:** not applicable — validation is a pure function of the request body.
+- **Races:** none. Both constants are module-level frozen-by-convention arrays read
+  synchronously; no shared mutable state.
+- **Feedback loops:** none. The enum is not written by anything at runtime.
+- **Adjacent consumers — full inventory** (the first draft named only the first two; the
+  second-pass reviewer found three more by grepping the tree, so this list is now the result
+  of a sweep rather than recall):
+  - `escalatedModelIds` / `resolveTierModel` (`ModelTierEscalation.ts`) — fail closed on an
+    out-of-enum config value. A `models.tierEscalation.frameworks['codex-cli']` naming
+    `gpt-6-astra` now resolves instead of nulling; the shipped codex default is
+    `{ default: null, escalated: null }`, so nothing changes without a deliberate operator
+    config edit, which is the intended effect.
+  - `ModelSwapService.ts:254` — clamps a topic's pinned baseline against
+    `KNOWN_MODEL_IDS[framework]` before a **live-session** model swap. This is the most
+    material consumer of the three and the first draft missed it: widening the list means a
+    topic pinned to `gpt-6-astra` can now be swapped onto rather than clamped away. That is
+    the intended effect (it is the same authority the pin itself passed), and the swap path
+    keeps its own independent verification — but it deserved naming, not discovery.
+  - `ProfileIntentClassifier.ts:157` (`defaultKnownModelValues`) — the union is the
+    extraction vocabulary for conversational pins, so "use gpt-6-astra here" now resolves to
+    a model value instead of falling through unrecognised. Intended, and the reason the
+    conversational surface works at all.
+  - `CodexCliIntelligenceProvider.ts:496` — reads the list benignly; no behavior change.
+
+---
+
+## 6. External surfaces
+
+- **Other agents on the same machine:** none — no shared state touched.
+- **Install base:** the only user-visible change is that a topic-profile pin naming
+  `gpt-6-astra` now succeeds where it returned `off-enum`. No previously-working
+  configuration changes behavior.
+- **External systems:** none. instar does not call the model vendor here; it validates a
+  string that is later handed to the codex CLI.
+- **Persistent state:** none written or migrated. A topic profile that could not previously
+  store this model id simply had nothing stored.
+- **Timing / runtime conditions:** none introduced. The pre-existing dependence on the local
+  codex CLI version is recorded under §2.
+- **Operator surface (Mobile-Complete Operator Actions):** no new operator-facing action.
+  The existing surface — the operator saying "use gpt-6-astra here" in the topic, which the
+  topic-profile write path already accepts from a verified operator — is phone-complete and
+  unchanged. This PR is what makes that sentence succeed rather than be refused.
+
+---
+
+## 6b. Operator-surface quality
+
+No operator surface — not applicable. No dashboard renderer, approval page, or
+grant/revoke/secret-drop form is touched.
+
+---
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+**Posture: machine-local BY DESIGN — with a replicated consumer, and that split is the
+interesting part.**
+
+The enum itself is compiled-in constant data, so it is machine-local in the same trivial
+sense all code is: each machine runs whatever instar version it has installed. The reason
+this is BY DESIGN rather than an oversight is that the thing it gates — a topic profile
+pin — IS replicated (`multiMachine.stateSync.topicPins`). So the honest posture is: the
+DATA is per-version, the STATE it validates is pool-wide.
+
+That produces one real cross-machine behavior worth stating: a pin set on a machine running
+this version replicates to a peer still on ≤ 1.3.1222, whose validator does not know the id.
+This is not a new failure mode — it is exactly the documented "a pinned model that is no
+longer available falls back to defaults with a once-per-transition notice" path, which is
+already the shipped contract for a version-skewed pool and degrades to a working session
+with a notice rather than a block. A rolling fleet update converges it, and the
+machine-coherence guard already surfaces version skew.
+
+- **User-facing notices:** emits none. The fallback notice above is pre-existing and already
+  one-voice gated.
+- **Durable state on topic transfer:** holds none of its own. The topic pin it validates is
+  already replicated and already survives transfer.
+- **Generated URLs:** none.
+
+---
+
+## 8. Rollback cost
+
+- **Hot-fix release:** revert the commit, ship as the next patch. Pure code change.
+- **Data migration:** none — but one honest caveat. If an operator pins a topic to
+  `gpt-6-astra` and the change is then reverted, that stored pin becomes an unknown id on
+  the next resolve. It does NOT wedge the topic: the shipped behavior is fallback-to-default
+  with a once-per-transition notice. Cost is one notice per affected topic, no repair.
+- **Agent state repair:** none required.
+- **User visibility during rollback:** a topic pinned to the new id falls back to the
+  framework default and says so. No silent behavior change.
+
+---
+
+## Conclusion
+
+The review changed the shape of the fix twice, both times toward less code. The first draft
+edited two lists in lockstep — which reproduced, in the same commit, the exact
+comment-enforced coupling that caused the bug. The second draft made the route read the
+canonical constant. The final version deletes the codex arm entirely, because
+`KNOWN_MODEL_IDS['codex-cli']` already IS that constant and the general arm was provably
+equivalent. Net effect: one id added, one duplicate reader removed, one drift class closed.
+
+Two findings were surfaced rather than silently absorbed. The CLI-version floor (§2) is a
+genuine residual gap and is tracked, not hand-waved. The version-skewed-pool pin (§7) is a
+real cross-machine interaction, and it lands on an existing, correct degradation path.
+
+The second-pass review then rejected the first version of the drift guard, correctly. That
+guard iterated `KNOWN_MODEL_IDS['codex-cli']` and asserted `validateModelId` — but the
+validator reads that same map, so the loop was tautological, and nothing in it read the
+spawn route at all. The reviewer's negative control proved it: re-splitting the route to a
+literal carrying 3 of 9 codex ids left the entire suite green. I had "falsified" that guard
+by breaking the map alias, which it did catch — and mistook that for proof it watched the
+route, which it never did. That is the precise failure mode of a guard that is blind to its
+own subject, reproduced inside the very commit whose purpose is to close a drift class.
+
+The fix is structural rather than another assertion: `spawnModelAllowlist(framework)` is
+exported from `routes.ts`, the handler calls it, and the guard reads THAT — the route's own
+accepted set — in both directions (the route accepts nothing the validator refuses, and
+drops nothing the validator accepts). The reviewer's exact control now fails on
+`gpt-5.2 missing from the spawn route`.
+
+The review also caught that the commit re-planted the instruction it was deleting: three
+comments still told a maintainer to "keep in lockstep with CODEX_MODELS_SUBSCRIPTION",
+including one I newly added, pointing at a constant this change removes. All three are
+rewritten. Clear to ship.
+
+---
+
+## Second-pass review (required — touches the `/sessions/spawn` allow decision)
+
+**Reviewer:** independent reviewer subagent, 2026-09-05
+**Independent read of the artifact: CONCERN — resolved, re-review recommended**
+
+The reviewer verified sections A, B, E, §7 and §8 against the code (including confirming
+that `CODEX_MODELS_SUBSCRIPTION` and `KNOWN_CODEX_MODEL_IDS` were entry-identical and
+same-order on `origin/main`, so the deletion is a provable no-op on the accepted set, and
+that `?? KNOWN_CLAUDE_MODEL_IDS` is unreachable for codex because `KNOWN_MODEL_IDS` is an
+exhaustive `Record` over the framework union). Five findings were raised; all five are
+resolved in this commit:
+
+1. **(blocking) The drift guard was blind to its own subject.** Proven by negative control:
+   re-splitting the route to a literal dropping 6 of 9 codex ids left both test files green,
+   58/58. Resolved — `spawnModelAllowlist` is exported and the guard reads the route's own
+   list bidirectionally; the same control now fails on
+   `codex-cli pinnable id gpt-5.2 missing from the spawn route`.
+2. **The commit re-planted the instruction it deletes.** Three "keep in lockstep with
+   CODEX_MODELS_SUBSCRIPTION" comments survived, one newly added by this change, pointing at
+   the constant it removes. Resolved — all three rewritten; zero references remain in `src/`.
+3. **Consumer inventory incomplete.** `ModelSwapService.ts:254`, `ProfileIntentClassifier.ts:157`
+   and `CodexCliIntelligenceProvider.ts:496` were unlisted. Resolved — §5 now carries the
+   swept inventory, with the live-session swap path called out as the material one.
+4. **Falsification evidence not reproducible.** The quoted output did not correspond to the
+   committed code. Resolved — both controls re-run against the shipped code and quoted
+   verbatim under Evidence.
+5. **Spawn-side coverage reduced under a wrong justification.** Resolved — `gpt-5.6-terra`
+   restored to the HTTP sample, and the comment now points at the route-observing guard
+   rather than claiming the validator test covers the route.
+
+The reviewer's `Concern raised` verdict stands against the version it read. Every finding it
+raised is addressed above; the load-bearing one changed the design.
+
+**Re-review verdict: "Concur with the review"** (same reviewer, against the fixed tree). It
+re-ran both injection controls itself and reproduced the quoted evidence verbatim (2/56 and
+1/57), instrumented the guard's per-framework loop to confirm neither direction runs vacuous
+(codex 9/9, claude 10/10, gemini 3/3 ids after the generic-tier filter), confirmed the
+handler has exactly one list-computation site and that the test import creates no runtime
+cycle (the CapabilityIndex back-reference is type-only). Two non-blocking nits were raised
+and are fixed in this commit: a dangling `CODEX_MODELS_SUBSCRIPTION` reference in the
+model-registry freshness manifest's descriptive note, and `grok-build` added to the guard
+loop (the reviewer verified it passes; it was ROUND-21's original victim framework, so its
+absence from the guard was the omission most worth closing). `pi-cli` stays omitted — its
+enum is closed-empty by design, so both loop directions would be vacuous.
+
+---
+
+## Evidence pointers
+
+- Live verification of the model id, Mac Mini, 2026-09-05: codex CLI 0.149.0 →
+  `400 invalid_request_error: The 'gpt-6-astra' model requires a newer version of Codex.`
+  After upgrading to 0.153.4, the same one-shot prompt returns a normal completion.
+- Refusal that prompted the change: `POST /topic-profile/69507` →
+  `{"failure":"off-enum","reason":"'gpt-6-astra' is not a known codex-cli model id"}`, on an
+  agent whose own Studio machine was concurrently running seven sessions on that model.
+- Falsification runs, re-captured against the COMMITTED code after the second-pass review
+  (the first draft quoted `expected [ …(6) ] to be [ …(7) ]`, which corresponded to an
+  intermediate version of the guard, not to what shipped — the reviewer was right that it
+  was unreproducible):
+  - **Control A — remove the id from the enum:** 2 failed | 56 passed.
+    `accepts codex-cli GPT-5.6 + GPT-6 family model values` → `expected 400 not to be 400`;
+    `accepts the GPT-6 family against codex-cli` → `expected { field: 'model', …(4) } to be null`.
+  - **Control B — re-split the route to a literal dropping 6 of 9 codex ids** (the reviewer's
+    own control, which the FIRST guard passed green): 1 failed | 57 passed.
+    `the spawn ROUTE accepts every id the pin validator does, for every framework` →
+    `codex-cli pinnable id gpt-5.2 missing from the spawn route: expected [ Array(3) ] to include 'gpt-5.2'`.
+
+---
+
+## Class-Closure Declaration (display-only mirror)
+
+No agent-authored-artifact defect — not applicable. This is a defect in hand-maintained
+source data (a duplicated constant), not in an LLM prompt, hook, config, skill, or standards
+text; and it adds no self-triggered controller.

package/upgrades/side-effects/codex-observer-bounded-backlog.md

@@ -0,0 +1,84 @@
+# Side-Effects Review — Codex observer bounded backlog
+
+**Version / slug:** `codex-observer-bounded-backlog`
+**Date:** `2026-09-04`
+**Author:** Codex
+**Second-pass reviewer:** independent Codex reviewer
+
+## Summary of the change
+
+The Codex delivery observer now advances every complete JSONL prefix inside its bounded read even when the byte budget ends partway through the next record. The incomplete tail is left unread and starts the next sweep. A single record with no newline inside the full budget remains typed `unknown`.
+
+This was found by the exact-candidate Stage-B canary: all 50 dedicated rows converged, but three real messages in busy sessions generated more than 256 KiB between sweeps. The old scanner marked the entire valid backlog unknown solely because byte 262,144 was not a newline, even though hundreds of complete record boundaries preceded it. Transcript inspection proved the injected user events and assistant responses were present.
+
+## Decision-point inventory
+
+- `scanSharedRollout` — modify — advances only through the last complete newline in a bounded read.
+- `scanRollout` — modify — applies the same prefix rule to the compatibility scanner.
+
+## 1. Over-block
+
+No new block is introduced. A record larger than the entire per-row budget still has no complete boundary and remains unknown; schema drift and malformed complete JSON remain unknown.
+
+## 2. Under-block
+
+An incomplete tail is not parsed or trusted. It is re-read from its exact first byte on the next sweep. The cursor advances only to a verified newline, so no partial JSON can be skipped or treated as evidence.
+
+## 3. Level-of-abstraction fit
+
+This is byte-framing behavior in the JSONL scanner, the layer that owns cursor advancement. It does not change delivery authority, replay policy, or message interpretation.
+
+## 4. Signal vs authority compliance
+
+Required reference: [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md).
+
+- [x] No — this change has no block/allow judgment surface.
+
+No new judgment is added. A complete newline is structural framing evidence; absence of any boundary at the hard budget remains the conservative uncertainty floor.
+
+## 4b. Judgment-point check
+
+No new static heuristic is added at a competing-signals decision point. This is an enumerable JSONL framing invariant: only bytes through a complete newline may advance the durable cursor.
+
+## 5. Interactions
+
+- **Races:** scans use the stat/read prefix already in place; bytes appended after the read wait for a later sweep.
+- **Budgets:** each sweep still reads at most the configured per-row and aggregate limits.
+- **Retries:** progress is durable in `inbound_rollout_cursor`; restart resumes from the last complete boundary.
+- **Failure posture:** malformed complete JSON, unsupported events, identity mismatch, truncation, and an oversized single record still fail closed.
+
+## 6. External surfaces
+
+Busy Codex sessions no longer show false unknown delivery outcomes or strand valid messages from observability merely because their transcript grew by more than one scan budget. No API shape or user-facing wording changes.
+
+## 6b. Operator-surface quality
+
+No operator surface is changed — not applicable.
+
+## 7. Multi-machine posture
+
+Machine-local by design: each observer reads the local transcript for the delivery effect performed on that machine. Ownership and transfer fencing are unchanged.
+
+## 8. Rollback cost
+
+Pure scanner code; revert is mechanically simple but would restore demonstrated false-unknown outcomes under large valid transcript bursts.
+
+## Conclusion
+
+The first canary correctly refused certification after exposing three false unknowns. The fix preserves every hard bound and uncertainty rule while distinguishing a safely resumable complete prefix from a truly boundary-free oversized record. Unit, integration, and production-wired E2E tests cover the non-aligned multi-budget case. The fresh exact candidate subsequently passed 50/50 deliveries over 7,213,141 ms, the complete case matrix, 30/30 responsiveness samples, and zero forbidden outcomes; its signed evidence is now bound to the certified sources.
+
+## Second-pass review
+
+Concur. Cursor advancement is restricted to complete newline boundaries, partial bytes remain unread, and the next sweep revalidates them from the record start. The change cannot authorize delivery or replay and narrows false uncertainty without weakening malformed-input handling. The reviewer noted that the compatibility scanner needed the same direct regression assertion as the production shared path; that coverage was added before commit.
+
+## Evidence pointers
+
+- `tests/unit/CodexDeliveryObserver.test.ts`
+- `tests/integration/codex-observer-bounded-backlog.test.ts`
+- `tests/e2e/codex-session-lifecycle-reliability.test.ts`
+- First canary ledger: 50/50 dedicated rows responded; three candidate-window false unknowns on busy sessions identified at non-aligned >256 KiB backlogs.
+- Corrected canary ledger: 50/50 rows consumed/cleared/responded; zero false unknown, exhaustion, duplicate ownership, lost inbound, or stale-owner outcomes; signed artifact digest `a2db23a95530681953ffa3002ab14e349ebf53d19be2a54c1f4afacc3aead997`.
+
+## Class-Closure Declaration
+
+No agent-authored-artifact defect and no added or modified self-triggered controller — not applicable. The regression is nevertheless pinned at all three required test tiers by the evidence above.