instar 1.3.1249 → 1.3.1250

package/dist/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "890eec3dcf80e4388c396f43001a0bd3fabc80c88f79aa9525885d6402a6dfdf",
-  "packageVersion": "1.3.1249",
+  "packageVersion": "1.3.1250",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/dist/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "da9c464af31b76d291aca99a5c3c89118da1ff2a46d113e7a4af5409206a9f5c",
+  "sha256": "9d8e4e883e348a23f831acecf4ccf189799d1720dfa1b3ece88970908ac35d46",
   "registrySha256": "890eec3dcf80e4388c396f43001a0bd3fabc80c88f79aa9525885d6402a6dfdf",
-  "packageVersion": "1.3.1249"
+  "packageVersion": "1.3.1250"
 }

package/dist/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "890eec3dcf80e4388c396f43001a0bd3fabc80c88f79aa9525885d6402a6dfdf",
   "articleCount": 91,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1249"
+  "packageVersion": "1.3.1250"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.1249",
+  "version": "1.3.1250",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-09-21T17:48:31.257Z",
-  "instarVersion": "1.3.1249",
+  "generatedAt": "2026-09-21T20:47:12.436Z",
+  "instarVersion": "1.3.1250",
   "entryCount": 203,
   "entries": {
     "hook:session-start": {
@@ -11,7 +11,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/session-start.sh",
-      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
+      "contentHash": "1444a86dc90dd560739c7eae26ef90f8d3876e313da6a505b96668a84b105e0a",
       "since": "2025-01-01"
     },
     "hook:dangerous-command-guard": {
@@ -20,7 +20,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/dangerous-command-guard.sh",
-      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
+      "contentHash": "1444a86dc90dd560739c7eae26ef90f8d3876e313da6a505b96668a84b105e0a",
       "since": "2025-01-01"
     },
     "hook:grounding-before-messaging": {
@@ -29,7 +29,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/grounding-before-messaging.sh",
-      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
+      "contentHash": "1444a86dc90dd560739c7eae26ef90f8d3876e313da6a505b96668a84b105e0a",
       "since": "2025-01-01"
     },
     "hook:compaction-recovery": {
@@ -38,7 +38,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/compaction-recovery.sh",
-      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
+      "contentHash": "1444a86dc90dd560739c7eae26ef90f8d3876e313da6a505b96668a84b105e0a",
       "since": "2025-01-01"
     },
     "hook:external-operation-gate": {
@@ -47,7 +47,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-operation-gate.js",
-      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
+      "contentHash": "1444a86dc90dd560739c7eae26ef90f8d3876e313da6a505b96668a84b105e0a",
       "since": "2025-01-01"
     },
     "hook:deferral-detector": {
@@ -56,7 +56,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/deferral-detector.js",
-      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
+      "contentHash": "1444a86dc90dd560739c7eae26ef90f8d3876e313da6a505b96668a84b105e0a",
       "since": "2025-01-01"
     },
     "hook:self-stop-guard": {
@@ -65,7 +65,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/self-stop-guard.js",
-      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
+      "contentHash": "1444a86dc90dd560739c7eae26ef90f8d3876e313da6a505b96668a84b105e0a",
       "since": "2025-01-01"
     },
     "hook:post-action-reflection": {
@@ -74,7 +74,7 @@
       "domain": "evolution",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/post-action-reflection.js",
-      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
+      "contentHash": "1444a86dc90dd560739c7eae26ef90f8d3876e313da6a505b96668a84b105e0a",
       "since": "2025-01-01"
     },
     "hook:external-communication-guard": {
@@ -83,7 +83,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-communication-guard.js",
-      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
+      "contentHash": "1444a86dc90dd560739c7eae26ef90f8d3876e313da6a505b96668a84b105e0a",
       "since": "2025-01-01"
     },
     "hook:telegram-origin-guard": {
@@ -101,7 +101,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-collector.js",
-      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
+      "contentHash": "1444a86dc90dd560739c7eae26ef90f8d3876e313da6a505b96668a84b105e0a",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-checkpoint": {
@@ -110,7 +110,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-checkpoint.js",
-      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
+      "contentHash": "1444a86dc90dd560739c7eae26ef90f8d3876e313da6a505b96668a84b105e0a",
       "since": "2025-01-01"
     },
     "hook:free-text-guard": {
@@ -119,7 +119,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/free-text-guard.sh",
-      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
+      "contentHash": "1444a86dc90dd560739c7eae26ef90f8d3876e313da6a505b96668a84b105e0a",
       "since": "2025-01-01"
     },
     "hook:claim-intercept": {
@@ -128,7 +128,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept.js",
-      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
+      "contentHash": "1444a86dc90dd560739c7eae26ef90f8d3876e313da6a505b96668a84b105e0a",
       "since": "2025-01-01"
     },
     "hook:claim-intercept-response": {
@@ -137,7 +137,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept-response.js",
-      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
+      "contentHash": "1444a86dc90dd560739c7eae26ef90f8d3876e313da6a505b96668a84b105e0a",
       "since": "2025-01-01"
     },
     "hook:stop-gate-router": {
@@ -146,7 +146,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/stop-gate-router.js",
-      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
+      "contentHash": "1444a86dc90dd560739c7eae26ef90f8d3876e313da6a505b96668a84b105e0a",
       "since": "2025-01-01"
     },
     "hook:auto-approve-permissions": {
@@ -155,7 +155,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/auto-approve-permissions.js",
-      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
+      "contentHash": "1444a86dc90dd560739c7eae26ef90f8d3876e313da6a505b96668a84b105e0a",
       "since": "2025-01-01"
     },
     "job:health-check": {
@@ -1571,7 +1571,7 @@
       "type": "subsystem",
       "domain": "updates",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
-      "contentHash": "5f7b43d410a9570065bdb15fd007a5fcbf938ec0c9ba210bf4db698c106bed80",
+      "contentHash": "1444a86dc90dd560739c7eae26ef90f8d3876e313da6a505b96668a84b105e0a",
       "since": "2025-01-01"
     },
     "subsystem:scheduler": {

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "890eec3dcf80e4388c396f43001a0bd3fabc80c88f79aa9525885d6402a6dfdf",
-  "packageVersion": "1.3.1249",
+  "packageVersion": "1.3.1250",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "da9c464af31b76d291aca99a5c3c89118da1ff2a46d113e7a4af5409206a9f5c",
+  "sha256": "9d8e4e883e348a23f831acecf4ccf189799d1720dfa1b3ece88970908ac35d46",
   "registrySha256": "890eec3dcf80e4388c396f43001a0bd3fabc80c88f79aa9525885d6402a6dfdf",
-  "packageVersion": "1.3.1249"
+  "packageVersion": "1.3.1250"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "890eec3dcf80e4388c396f43001a0bd3fabc80c88f79aa9525885d6402a6dfdf",
   "articleCount": 91,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1249"
+  "packageVersion": "1.3.1250"
 }

package/upgrades/{1.3.1249.md → 1.3.1250.md}

@@ -5,6 +5,17 @@
 
 ## What Changed
 
+Autonomous-run setup and its stop hook resolved the local server's bearer token
+by reading `config.json.authToken` inline. On vault-migrated agents that field
+is the SecretMigrator placeholder, so every call from those scripts was refused
+— and on an admission-enforcing install a new run sat `preparing` forever with
+no message. Both scripts now resolve the token vault-aware (config string first,
+else `secret-get.mjs`), a refused registration prints a clear error (fatal only
+where admission is required to arm), and a pre-existing `pipefail`+`grep -c`
+trap that could kill setup silently is fixed. Existing agents receive both
+scripts through PostUpdateMigrator marker bumps (`VAULT_AUTH_RESOLVE`);
+customized copies are skipped, never overwritten.
+
 Codex quota readings are now LIVE. Until now the only source was the session log the codex CLI writes after each completed turn, which has a structural limit: the number is only as fresh as the last time something ran on the account, and a WALLED account — where no turn completes — produces no record at all. That is why an idle account sat on a days-old number and why an exhausted account could show nothing whatsoever.
 
 The codex CLI's app-server protocol exposes `account/rateLimits/read` — the exact call its own `/status` screen makes: a metadata fetch answered by OpenAI's backend without running a model turn. No tokens, no quota, measured at 450–850ms per account. A new reader (`codexLiveRateLimitReader`) speaks the protocol — spawn `codex app-server` against the account's config home, one initialize handshake, one read, kill — and maps the answer into the existing snapshot shape with `source: 'codex-app-server'`.
@@ -66,6 +77,10 @@ This is presentation only. No routing, placement, load-shedding, proactive-swap
 
 ## What to Tell Your User
 
+If you start a long unattended work session and its setup can't actually take
+hold, I now tell you immediately with a plain reason — instead of you
+discovering the next day that nothing ever ran.
+
 Your Codex usage bars are now live. Before, the number could only update when something actually ran on an account, so an idle account showed a days-old reading and an account that had hit its weekly wall showed nothing at all. Now every poll asks Codex directly — the same question its own status screen asks — and that costs nothing: no tokens, no quota. Walled accounts show their true 100% with the real reset time instead of a blank card.
 
 If anything ever goes wrong with the live check, the dashboard quietly falls back to the old log-reading method, so the worst case is a stale number clearly labelled with its age — never a missing or wrong one.
@@ -90,6 +105,11 @@ Your Subscriptions dashboard now shows each account's quota bar in green, amber
 
 ## Summary of New Capabilities
 
+- Autonomous setup + stop hook work on vault-migrated agents (token from the vault).
+- A refused run registration is loud, and stops setup where arming is impossible.
+- A silent shell-trap death in setup's concurrency fallback is fixed.
+- Both fixes reach deployed agents via migration.
+
 - Live, zero-spend Codex quota via `codex app-server`'s `account/rateLimits/read` — the poller and `GET /codex/usage` are live-first with rollout-tail fallback.
 - Walled accounts (which write no rollout records) now report their true utilization and reset time.
 - Provenance on every reading: `source: 'codex-app-server'` (live) vs `'codex-rollout'` (fallback), through the pool, the route, and WS5.2 replication.
@@ -121,6 +141,10 @@ Your Subscriptions dashboard now shows each account's quota bar in green, amber
 
 ## Evidence
 
+- Unit `tests/unit/autonomous-setup-vault-auth.test.ts` (4 passing): runs the REAL script against a real HTTP server — the vault value reaches the server when config holds the placeholder; config string wins; enforcing + 403 aborts loudly with no state file; enforcing + unreachable still starts `preparing` (contract preserved, also covers the pipefail fix).
+- Unit `tests/unit/PostUpdateMigrator-vaultAuthResolve.test.ts` (5 passing): the genuine pre-change blobs (pinned by commit) are re-deployed idempotently; the pinned predecessor SHA matches the real PREPARATION_CARRIER-era hook; customized copies are skipped by name.
+- All 12 existing stop-hook suites (142 tests) and the 6 other setup-consuming suites (40 tests) pass against the modified scripts.
+
 - Live, through the built dist against all five real Codex config homes (2026-09-20): justin@sagemindai.io 100% walled · dawn@sagemindai.io 100% walled (previously structurally unreadable) · headley.justin@gmail.com 100% walled · amrch 86% · adriana 96% — 450–850ms each, all `source=codex-app-server`, zero quota consumed (verified: the walled accounts answered while at 100%).
 - Protocol ground truth captured from `codex app-server generate-json-schema` (codex-cli 0.153.4).
 - Unit `tests/unit/codexLiveRateLimitReader.test.ts` (13 passing): response mapping, the walled-account marker, foreign-limit-family refusal, windowless and malformed windows, handshake order, and every failure shape → null (initialize refused, read error, silent child hitting the deadline, early child exit, spawn throw), plus the composition factory's both sides.

package/upgrades/side-effects/autonomous-auth-vault-resolve.md

@@ -0,0 +1,180 @@
+# Side-Effects Review — Autonomous setup/hook: vault-aware auth + loud registration refusal
+
+**Version / slug:** `autonomous-auth-vault-resolve`
+**Date:** `2026-09-21`
+**Author:** `echo`
+**Second-pass reviewer:** `independent reviewer subagent (see appended section)`
+
+## Summary of the change
+
+`setup-autonomous.sh` and `autonomous-stop-hook.sh` read the server bearer token
+with an inline `python3` read of `config.json.authToken`. On a vault-migrated
+agent that field is the SecretMigrator placeholder (`{"secret": true}`), so every
+server call from both scripts 403'd. On an admission-enforcing install
+(windowRunLiveness enforcing), the refused registration left the run `preparing`
+forever with no message — the 2026-09-19 silent no-start (ACT-030). This change:
+
+- adds `resolve_auth_token()` (marker `VAULT_AUTH_RESOLVE`) to both scripts:
+  config string first, else the vault via `.instar/scripts/secret-get.mjs`;
+  replaces 3 reads in setup + 8 in the hook;
+- makes a REFUSED registration (401/403) loud, and FATAL only on an
+  admission-enforcing install (where an unregistered run structurally cannot
+  arm); unreachable-server behaviour is unchanged (best-effort, preparing);
+- fixes a pre-existing `set -euo pipefail` + `grep -c` trap in the local
+  concurrency fallback that killed the whole setup silently (exit 1, zero
+  output) whenever the server was unreachable/refusing and no other topic had a
+  state file;
+- ships both to existing agents via PostUpdateMigrator: a fingerprint-gated
+  marker bump for the setup (`W32_PREPARING_LIVENESS` → `VAULT_AUTH_RESOLVE`)
+  and an exact-stock-SHA replacement for the hook (predecessor hash pinned as
+  `AUTONOMOUS_STOP_HOOK_PREPARATION_CARRIER_SHA256`). Customized copies are
+  skipped by name, never overwritten.
+
+## Decision-point inventory
+
+- `setup-autonomous.sh` registration branch — **modify** — a 401/403 now aborts
+  setup on enforcing installs only; everywhere else it prints and proceeds
+  exactly as before. No new authority: the server's admission decision already
+  governed whether the run could arm; the script now surfaces it instead of
+  swallowing it.
+- `autonomous-stop-hook.sh` — **no decision change** — same calls, correct
+  token; every fail-open/fail-closed path is untouched.
+- PostUpdateMigrator — **extend** — two more marker-bump migrations in the
+  existing `migrateAutonomousStopHookTopicKeyed` chain.
+
+---
+
+## 1. Over-block
+
+- The new fatal branch triggers only when (a) the install resolved
+  admission-enforcing at setup time AND (b) the server answered 401/403. A
+  wrong-but-reachable server cannot spuriously abort a non-enforcing agent's
+  run (it now prints the two-line ERROR instead of the old "unavailable" line,
+  and proceeds). On the enforcing install, aborting IS the correct behaviour: the
+  alternative was a run that never arms.
+- Config token precedence: a real string in config always wins, so no agent that
+  still keeps a plaintext token changes behaviour. No issue identified.
+
+## 2. Under-block
+
+- An enforcing install whose server is UNREACHABLE (not refusing) still writes a
+  `preparing` run, as designed — the preparation carrier owns that recovery.
+  Deliberately preserved (tested).
+- A vault whose `secret-get.mjs` is missing/failing yields an empty token → the
+  server refuses → now loud. Previously the same state was silent.
+
+## 3. Level-of-abstraction fit
+
+Token resolution belongs in the scripts themselves: they run standalone (hook
+under Claude Code's Stop event, setup from a session) with no TypeScript layer
+in-process. The function mirrors the hardened secret-get contract rather than
+re-implementing vault decryption.
+
+## 4. Signal vs authority compliance
+
+No new brittle authority. The fatal branch consumes the SERVER's authoritative
+admission verdict; the script only stops pretending the verdict was a success.
+
+## 5. Interactions
+
+- `resolve_auth_token()` is called via command substitution, so no memoization:
+  each call spawns python3 (+node only when config holds no string). The hook
+  already spawns python3 at each of those 8 sites, so the added cost is the node
+  startup on vault-migrated agents (~100–200 ms per call, only on paths already
+  making a network call).
+- The migrations run inside the existing `migrateAutonomousStopHookTopicKeyed`
+  chain, AFTER the older bumps: an agent several releases behind is first
+  re-deployed by an earlier bump (whose bundled bytes already include this fix),
+  and the new bumps early-return on the marker. Order-independent.
+- `sign-lockfile`/release hashing consume bundled bytes generically; no test pins
+  the setup/hook SHA outside the migration allowlists (checked: the only exact
+  hash is the new predecessor constant + the historical allowlist, both
+  append-only).
+
+## 6. External surfaces
+
+None. The token still goes only to `localhost:<port>` in an Authorization
+header. The vault value is never echoed (stdout of secret-get feeds the variable
+only; `set -x` is not used in these scripts). Error messages name the HTTP code,
+never the token.
+
+## 7. Multi-machine posture
+
+Machine-local BY DESIGN: each machine's scripts read that machine's config and
+vault; runs are per-machine state. The migrations run on every machine's own
+update pass, so the fleet converges machine by machine. No user-facing notices
+are added beyond the setup's own stderr (read by the session that ran it).
+
+## 8. Rollback cost
+
+Revert the commit and release: the NEXT migration pass does not restore old
+bytes (marker bumps only move forward), but the scripts are self-contained —
+re-deploying the previous bundle via the same exact-hash path would need one
+follow-on migration. Operationally, the fix is strictly additive (correct token,
+louder errors); the plausible regression is the fatal branch, whose blast radius
+is one refused setup with a printed reason, recoverable by re-running setup.
+
+## Second-pass review
+
+**Reviewer:** independent reviewer subagent
+**Verdict:** Concur with the review — no blocking concerns. Two minor notes below (neither warrants a code change).
+
+What was checked:
+
+- **`resolve_auth_token()` leak/hang/wrong-value:** the value only ever reaches the
+  function's stdout (captured by `$(…)` at every call site) and a curl
+  `Authorization` header; neither script uses `set -x`; `secret-get.mjs` writes the
+  value to stdout only (single write, no trailing newline), diagnostics to stderr
+  (redirected to /dev/null here), and reads nothing from stdin — no prompt, no hang
+  path (python3 `-c` likewise cannot prompt). The placeholder is a real JSON object
+  (`SecretMigrator` line 89: `{ secret: true }`), so `isinstance(v,str)` correctly
+  yields empty rather than a printed dict; the vault key path is exactly `authToken`
+  (KNOWN_SECRET_FIELDS), matching the script's argument. Trailing newlines are
+  stripped by command substitution at every caller. Guard placement is safe in both
+  scripts: setup runs `set -euo pipefail` and every failure inside the function is
+  absorbed (`|| echo ""`, `|| true`, and a false `[[ -f … ]]` inside `if` returns 0,
+  so the function always exits 0); the stop hook runs `set -uo pipefail` (no `-e`,
+  confirmed at line 26), where the same guards are harmless.
+- **Registration branch:** empirically verified that a connection-refused curl under
+  `-s … -w '\n%{http_code}' … || echo ""` yields `REG_CODE=000` and an empty body —
+  never 401/403 — so an unreachable server still lands in the unchanged
+  "registration unavailable" path (also covered by the fourth setup test). The fatal
+  branch requires `RUN_STATUS == "preparing"`, which at that point can only come from
+  the pre-existing LOCAL enforcing resolution (a 401/403 body carries no
+  `initialStatus`), so only admission-enforcing installs abort. The whole block is
+  inside `if [[ -n "$REPORT_TOPIC" ]]` — empty-topic behaviour untouched.
+- **COUNT pipefail fix:** empirically verified under `set -euo pipefail` that
+  `COUNT=$(ls … | grep -cv …) || true` captures grep's `0` stdout on zero matches
+  (assignment happens regardless of exit status) and counts correctly (2) when other
+  topics' state files exist; the cap comparison then proceeds normally.
+- **Migrations:** both are idempotent (marker-presence early-return; re-run asserted
+  byte-identical in the tests). Ordering is sound: the earlier hook/setup bumps
+  deploy the CURRENT bundled bytes (which contain `VAULT_AUTH_RESOLVE`), so the new
+  migrations early-return after them; conversely a PREPARATION_CARRIER-era stock hook
+  no-ops through `upgradePreparationCarrier` (marker present) and is caught by the
+  new exact-hash gate. Verified the pinned SHA `72027309…` equals the hook blob at
+  HEAD/origin-main AND at every other carrier-era commit touching the file
+  (bc5453d32, f7ee6efc6, 4272bda3b — all byte-identical), and older stock bytes are
+  in the append-only allowlist, which the new upgrade also accepts — so no
+  legitimately-stock lineage is stranded; only genuinely customized/unknown bytes
+  are skipped, with a named `result.skipped` row (visible, not silent). Executable
+  bit: temp-file written `mode: 0o755` + rename (hook) and `chmodSync 0o755` (setup
+  helper); asserted in the tests. Label and skip strings in the code match the test
+  expectations exactly. Both new test files run green (9/9).
+- **Artifact accuracy:** the replaced-read counts (3 setup + 8 hook) match the diff;
+  the enforcing-only fatality, unreachable-server preservation, no-new-authority,
+  and rollback claims all match the code. Bonus not claimed by the artifact: the
+  hook's verification leak-scrub now greps for the REAL token on vault-migrated
+  agents instead of the placeholder string — a strict improvement.
+
+Minor notes (non-blocking):
+
+1. §1's "everywhere else it prints and proceeds exactly as before" is right about
+   *proceeding*, but the printed text on a non-enforcing 401/403 changes from the
+   "registration unavailable" line to the new two-line ERROR — intended loudness,
+   just not literally "as before".
+2. The new setup comment says the local cap fallback ran "whenever the server was
+   unreachable/refusing"; a *refusing* server that returns JSON (`{"error":…}`)
+   actually parses `allowed` as `None`, which skips the `unknown` fallback branch —
+   pre-existing behaviour, unchanged by this diff; only the comment's wording is
+   slightly broad.