instar 1.3.1221 → 1.3.1223

package/upgrades/side-effects/codex-test-worker-control-plane.md

@@ -0,0 +1,86 @@
+# Side-Effects Review — Codex test-worker interruption and control-plane resilience
+
+**Version / slug:** `codex-test-worker-control-plane`
+**Date:** `2026-09-04`
+**Author:** `Codex`
+**Second-pass reviewer:** `Codex independent reviewer`
+
+## Summary of the change
+
+This change protects exact esbuild service descendants before watchdog judgment, replaces pane-wide interruption with identity-fenced process signals, removes synchronous tmux probes from selected asynchronous server hot paths, and preserves honest durable lifeline replay reasons. It updates watchdog, session/input monitoring, lifeline, migration, scaffold awareness, and their unit/integration/E2E coverage.
+
+## Decision-point inventory
+
+- `SessionWatchdog.checkSession` — modify — exact service-role evidence prevents a destructive action against infrastructure.
+- `SessionWatchdog.signalIfIdentityMatches` — add — a deterministic safety fence revalidates the selected process before signaling.
+- `SessionManager.listRunningSessions` — modify — asynchronous hot paths trust the state registry/cache rather than blocking on tmux.
+- `StuckInputSentinel.tick` — modify — idle Codex sessions without durable stranded-draft evidence avoid synchronous pane probing.
+- `TelegramLifeline` replay notice — modify — chooses wording from the durable queue cause.
+
+## 1. Over-block
+
+An esbuild process with the exact `--service... --ping` contract is always protected even if that helper itself malfunctions. This is intentional: the owning test command remains observable, and killing its internal compiler helper is not a safe recovery action. One-shot esbuild invocations and shell commands merely mentioning those flags are not exempt.
+
+## 2. Under-block
+
+Other long-lived compiler or language-server protocols are not automatically protected unless already covered by framework ownership/exclusions. The fix is deliberately exact to the observed process contract. A process that preserves PID, parent, and exact argv across an exec-like behavioral change could pass the identity fence; session-level termination still goes through ReapAuthority.
+
+## 3. Level-of-abstraction fit
+
+Service classification is a low-level structural safety floor at the point that selects process targets. The contextual stuck-command authority still judges eligible user commands. Targeted signaling is the lower-level primitive the watchdog should use; final lifecycle authority remains centralized in ReapAuthority. Queue-cause formatting is a pure presentation helper over already-durable facts.
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] No — the service classifier is a safety guard on an irreversible/disruptive action, an explicit exception allowed by the principle.
+
+The exact argv classifier cannot authorize interruption; it can only refuse an unsafe target. Positive stuck judgments remain with the existing contextual authority or hard-ceiling policy, and final session death remains with ReapAuthority.
+
+## 4b. Judgment-point check (Judgment Within Floors standard)
+
+The new heuristic is not a competing-signals judgment point. It is an enumerable process-protocol identity used solely as a no-kill safety floor; it never chooses to act. The existing contextual judge continues to resolve competing evidence for non-infrastructure commands.
+
+## 5. Interactions
+
+- **Shadowing:** service protection runs before exclusions and the stuck judge; this intentionally prevents the judge from acquiring authority over the helper.
+- **Double-fire:** targeted SIGINT replaces, rather than supplements, pane-wide Control-C. StuckInputSentinel remains independent and only submits a durable marked draft.
+- **Races:** every descendant signal rechecks PID, parent, and exact argv; failed identity checks delete escalation state. Escalation also binds session id and start timestamp, then refuses a replacement incarnation even if it reuses the tmux name. ReapAuthority re-resolves that same live session.
+- **Feedback loops:** a protected esbuild helper is reevaluated each poll but produces no intervention. Queue replay keeps stable delivery identity and cause.
+
+## 6. External surfaces
+
+Codex users stop seeing false operator-interruption banners and test runs stop collapsing from killed esbuild services. Telegram users may see corrected wording that distinguishes a server outage from a forwarding failure. Queue records gain an optional cause field compatible with older records. Timing remains machine-load dependent, but the affected event-loop paths no longer execute synchronous tmux probes. No operator-facing action is added.
+
+## 6b. Operator-surface quality (Operator-Surface Quality standard)
+
+No dashboard, approval, grant, revoke, or secret-entry surface is changed; not applicable.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+**Machine-local BY DESIGN:** process trees, tmux sessions, watchdog targets, and local server availability are machine-specific truths. Telegram queue notices use the existing one-voice lifeline path and stable message identity; no new notice producer is introduced. Durable queue state remains in the existing agent state path and this change does not alter topic-transfer ownership. No URLs are generated.
+
+## 8. Rollback cost
+
+Pure code and backward-compatible record metadata: revert and ship a patch. No schema migration or state repair is required; old queue entries without a cause retain compatible fallback wording. Rolling back would re-expose false interruption and event-loop stalls during propagation.
+
+## Conclusion
+
+The first independent pass found missing session-incarnation fencing, incomplete effect-scope audit fields, and mocked-only process evidence. The implementation now binds escalation to session id/start time, records parent/role/scope/incarnation, and includes an integration test that launches the installed esbuild binary and inspects the real host process table. The repair is at the correct layers and narrows destructive authority; it is clear to ship after the confirming second pass.
+
+## Second-pass review (if required)
+
+**Reviewer:** Codex independent reviewer
+**Independent read of the artifact:** concur — the revised implementation closes the session-replacement race, records target/effect attribution, and proves against a live esbuild process tree that service descendants stay outside interruption authority.
+
+## Evidence pointers
+
+- `tests/unit/session-watchdog-attribution.test.ts`
+- `tests/integration/session-watchdog-safe-wait.test.ts`
+- `tests/integration/tmux-resilience-slow-stub.test.ts`
+- `tests/e2e/session-watchdog-continuation-lifecycle.test.ts`
+- `tests/e2e/lifeline-queue-notice-lifecycle.test.ts`
+
+## Class-Closure Declaration (display-only mirror)
+
+`defectClass: unbounded-self-action`; `closure: guard`; `guardEvidence: { enforcementType: ratchet, citation: tests/unit/SessionWatchdog-pipeline.test.ts, howCaught: the tests require exact service descendants to remain outside judgment and require every descendant intervention to use the identity-fenced targeted signal path, preventing repeated pane-wide interruption while bounded escalation and ReapAuthority remain the settling brakes }`.

package/upgrades/side-effects/inbound-delivery-unknown-terminalization.md

@@ -0,0 +1,82 @@
+# Side-Effects Review — Inbound delivery unknown terminalization
+
+**Version / slug:** `inbound-delivery-unknown-terminalization`
+**Date:** `2026-09-04`
+**Author:** `Codex`
+**Second-pass reviewer:** `Codex independent reviewer`
+
+## Summary of the change
+
+`InboundDeliveryStore.markObservationUnknown` and `markRolloutUnknown` now transition uncertain dispatched evidence to terminal `effect-unknown`, and status reporting prioritizes that transport state. This releases finite live-row capacity without replaying or deleting uncertain evidence. Unit regressions cover saturation, single-row and shared-rollout terminalization, metrics, and renewed admission.
+
+## Decision-point inventory
+
+- `InboundDeliveryStore.markObservationUnknown` — modify — completes the observer's existing deadline decision with the correct terminal transport state.
+- `InboundDeliveryStore.markRolloutUnknown` — modify — terminalizes every affected row when shared rollout parsing becomes uncertain.
+- `InboundDeliveryStore.status` — modify — reports effect uncertainty from transport truth rather than shadowing it with eligibility.
+
+## 1. Over-block
+
+No new rejection is introduced. A delivery is terminalized only where the existing observer already chose unknown, either at its fixed deadline or after a rollout-integrity failure. It cannot later be automatically recognized as consumed, but that was already true because unknown eligibility excluded further observation/recovery.
+
+## 2. Under-block
+
+Stale `prepared` rows are not changed; four exist locally but remain well below capacity and may still be eligible for dispatch. Other nonterminal states continue to count as live by design.
+
+## 3. Level-of-abstraction fit
+
+The store owns transport-state transitions and admission accounting, so it is the correct layer. The observer still owns when evidence becomes unknown; the store only makes that existing verdict internally consistent.
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] No — this is mechanical state consistency after an existing authority decision.
+
+No content or intent judgment is added. The deadline and observer already authorize the unknown result; this change ensures all state dimensions encode it consistently.
+
+## 4b. Judgment-point check (Judgment Within Floors standard)
+
+No new heuristic or competing-signals decision point is added. This is an invariant: non-replayable observation-unknown evidence cannot simultaneously remain live for admission accounting.
+
+## 5. Interactions
+
+- **Shadowing:** status now exposes transport uncertainty before eligibility labels, correcting the prior shadow.
+- **Double-fire:** the guarded SQL transition only matches dispatched/open rows, so repeated observer calls are idempotent.
+- **Races:** each SQLite update is atomic; the shared-rollout transition updates all matching rows in one statement, so concurrent admission cannot see a partially terminalized rollout.
+- **Feedback loops:** terminal rows enter existing bounded GC; they cannot be replayed or re-observed.
+
+## 6. External surfaces
+
+New Telegram messages can again enter sessions after prior evidence expires. Diagnostics report a larger honest uncertain-effect count. No message text, operator action, URL, or external API schema changes.
+
+## 6b. Operator-surface quality (Operator-Surface Quality standard)
+
+No operator UI surface is changed; not applicable.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+**Machine-local BY DESIGN:** each machine's journal records physical terminal effects performed on that machine. Ownership transfer already fences/export-imports live rows; terminal unknown rows do not transfer or replay. No user-facing notice, durable topic-transfer obligation, or URL is added.
+
+## 8. Rollback cost
+
+Revert and deploy a patch. The terminal state is safe and retained; no reverse migration is required. The one-time local repair has a complete SQLite backup at `.instar/state/inbound-delivery.pre-terminal-fix-20260904.sqlite`.
+
+## Conclusion
+
+The first independent pass found that shared-rollout uncertainty had the same stranded-live defect. That path now terminalizes all matching rows atomically and has a multi-row capacity regression. The change restores capacity without weakening no-duplicate delivery semantics or deleting audit evidence; it is ready after confirming review.
+
+## Second-pass review (if required)
+
+**Reviewer:** Codex independent reviewer
+**Independent read of the artifact:** concur — both single-delivery and shared-rollout uncertainty now terminalize atomically, preserve no-replay evidence, and release live capacity without adding judgment authority.
+
+## Evidence pointers
+
+- `tests/unit/InboundDeliveryStore.test.ts`
+- Live diagnosis: 500/500 rows expired; 496 were dispatched+unknown but counted live.
+- Local migration: 496 rows moved to effect-unknown; live count reduced from 500 to 4.
+
+## Class-Closure Declaration (display-only mirror)
+
+No agent-authored-artifact defect and no self-triggered action added — not applicable.

package/upgrades/side-effects/stage-b-evidence-code-binding.md

@@ -87,6 +87,7 @@ The review moved the design three times: the digest became canonical (order-stab
 - `tests/unit/stage-b-evidence-code-binding.test.ts` (19 tests)
 - `tests/unit/StageBActivationGate.test.ts`, `StageBStartupReadiness.test.ts`, `MentorStageBForensics.test.ts`, `codex-stage-b-publish-gate.test.ts` (all green)
 - Live: `node scripts/verify-codex-stage-b-release-evidence.mjs` passes on this tree; `verifyBundledStageBReleaseEvidence("9.9.9999")` returns null.
+- Fresh repair evidence: candidate `cfe468dc5` passed 50/50 deliveries over 7,213,141 ms, all required cases, 30/30 responsiveness samples, and zero forbidden outcomes; Echo signature verification and certified-set fingerprint check both pass for artifact digest `a2db23a95530681953ffa3002ab14e349ebf53d19be2a54c1f4afacc3aead997`.
 
 ## Class-Closure Declaration (display-only mirror)