instar 1.3.1600 → 1.3.1602

package/src/data/state-coherence-registry.json

@@ -931,6 +931,43 @@
         "keepSegments": 4
       }
     },
+    {
+      "category": "browser-instance-ledger",
+      "description": "Browser care (docs/specs/machine-self-maintenance.md, Part B): one small file per normal-Chrome instance this agent opened (profile dir, pid + start time, session, purpose, lease). Written by the browser helper scripts and the watch-only sweep; describes live processes on this machine only.",
+      "scope": "machine-local",
+      "freshness": "live",
+      "conflictShape": "single-writer",
+      "transport": "none",
+      "paths": [
+        "state/browser-instances/"
+      ],
+      "grandfathered": false,
+      "retention": {
+        "class": "R",
+        "access": "protocol-reader",
+        "boundedBy": "domain-cardinality",
+        "note": "One file per running owned Chrome instance; BrowserCareSweep removes the file once its process has exited, so the count tracks open browsers, never history."
+      }
+    },
+    {
+      "category": "audit-browser-care",
+      "description": "Browser care audit (docs/specs/machine-self-maintenance.md, Part B): what the watch-only sweep and chrome-close.sh would close or keep, and why. Profile paths relative to the agent home, never page content. Machine-local observability; never authority, never replicated.",
+      "scope": "machine-local",
+      "freshness": "n/a",
+      "conflictShape": "append-only",
+      "transport": "none",
+      "paths": [
+        "logs/browser-care.jsonl"
+      ],
+      "grandfathered": false,
+      "retention": {
+        "class": "A",
+        "access": "streamed",
+        "maxBytes": 2097152,
+        "keepSegments": 1,
+        "note": "BrowserCareSweep.audit() rotates the file to .1 (one kept segment) when it passes 2 MiB before appending; it writes only when an instance's verdict changes."
+      }
+    },
     {
       "category": "audit-machine-drain",
       "description": "Watch-only drain audit (docs/specs/machine-self-maintenance.md): what each nightly rehearsal would have done, phase by phase, with delays, holds and yield times. Machine-local observability of this machine; never authority, never replicated.",

package/src/scaffold/templates.ts

@@ -20,7 +20,7 @@ import { JOB_DECLARED_FAILURE_AWARENESS } from "../scheduler/jobDeclaredFailure.
 // existing-agent migration there) so the two can never drift. Imported as a runtime
 // function call inside generateClaudeMd — no module-init cycle (PostUpdateMigrator
 // never imports templates).
-import { APPRENTICESHIP_STALL_GATE_CLAUDEMD_SECTION, SESSION_LISTING_HYGIENE_CLAUDEMD_SECTION, PLAYWRIGHT_PROFILE_REGISTRY_CLAUDEMD_SECTION, MACHINE_LOAD_ASSESSMENT_CLAUDEMD_SECTION, CODEX_CONNECT_CLAUDEMD_SECTION, FEATURE_SWITCH_CLAUDEMD_SECTION, NORMAL_CHROME_BROWSER_CLAUDEMD_SECTION, SINGLE_MACHINE_FAILOVER_GAP_CLAUDEMD_SECTION, MISSING_LOGIN_SESSION_CLAUDEMD_SECTION, DYNAMIC_MCP_CLAUDEMD_SECTION, ULTRACODE_SPAWN_CLAUDEMD_SECTION, AGENT_SIGNATURE_PROVENANCE_CLAUDEMD_SECTION, SENDER_REJECTION_CLAUDEMD_SECTION, SCOPE_ACCRETION_CLAUDEMD_SECTION, MESH_SELF_HEALING_CLAUDEMD_SECTION, LEASE_MEDIUM_CLAUDEMD_SECTION, WRITE_ADMISSION_CLAUDEMD_SECTION, DOORWAY_REGISTRY_CLAUDEMD_SECTION, EXTERNAL_HOG_CLAUDEMD_SECTION, ROUTING_SPEND_CLAUDEMD_SECTION, MATURATION_BOARD_CLAUDEMD_SECTION, QUEUE_PACE_CLAUDEMD_SECTION, ECOSYSTEM_IDEAS_CLAUDEMD_SECTION, MOBILE_PAIRING_CLAUDEMD_SECTION, MOBILE_CHAT_CLAUDEMD_SECTION, APP_CONVERSATIONS_CLAUDEMD_SECTION, MOBILE_ROUTES_CLAUDEMD_SECTION, MOBILE_PUSH_CLAUDEMD_SECTION, DECISION_QUALITY_CLAUDEMD_SECTION, BENCHMARK_DIVERGENCE_CLAUDEMD_SECTION, DUPLICATE_RECONCILER_CLAUDEMD_SECTION, AUDIT_CONVERGENCE_CLAUDEMD_SECTION, TONE_ADVISORY_MIGRATION_CLAUDEMD_SECTION, DECISION_JOURNAL_CONFIDENCE_CLAUDEMD_GUIDANCE, WINDOW_RUN_LIVENESS_CLAUDEMD_SECTION, SCRIPT_JOBS_CLAUDEMD_SECTION, JOB_RESULT_SUPERVISION_CLAUDEMD_SECTION, DEDICATED_PROFILE_REGISTRY_ROW_ANSWER, CODEX_ARM_SWEEPER_CLAUDEMD_SECTION, MACHINE_MAINTENANCE_CLAUDEMD_SECTION, APP_MEDIA_CLAUDEMD_SECTION } from '../core/PostUpdateMigrator.js';
+import { APPRENTICESHIP_STALL_GATE_CLAUDEMD_SECTION, SESSION_LISTING_HYGIENE_CLAUDEMD_SECTION, PLAYWRIGHT_PROFILE_REGISTRY_CLAUDEMD_SECTION, MACHINE_LOAD_ASSESSMENT_CLAUDEMD_SECTION, CODEX_CONNECT_CLAUDEMD_SECTION, FEATURE_SWITCH_CLAUDEMD_SECTION, NORMAL_CHROME_BROWSER_CLAUDEMD_SECTION, SINGLE_MACHINE_FAILOVER_GAP_CLAUDEMD_SECTION, MISSING_LOGIN_SESSION_CLAUDEMD_SECTION, DYNAMIC_MCP_CLAUDEMD_SECTION, ULTRACODE_SPAWN_CLAUDEMD_SECTION, AGENT_SIGNATURE_PROVENANCE_CLAUDEMD_SECTION, SENDER_REJECTION_CLAUDEMD_SECTION, SCOPE_ACCRETION_CLAUDEMD_SECTION, MESH_SELF_HEALING_CLAUDEMD_SECTION, LEASE_MEDIUM_CLAUDEMD_SECTION, WRITE_ADMISSION_CLAUDEMD_SECTION, DOORWAY_REGISTRY_CLAUDEMD_SECTION, EXTERNAL_HOG_CLAUDEMD_SECTION, ROUTING_SPEND_CLAUDEMD_SECTION, MATURATION_BOARD_CLAUDEMD_SECTION, QUEUE_PACE_CLAUDEMD_SECTION, ECOSYSTEM_IDEAS_CLAUDEMD_SECTION, MOBILE_PAIRING_CLAUDEMD_SECTION, MOBILE_CHAT_CLAUDEMD_SECTION, APP_CONVERSATIONS_CLAUDEMD_SECTION, MOBILE_ROUTES_CLAUDEMD_SECTION, MOBILE_PUSH_CLAUDEMD_SECTION, DECISION_QUALITY_CLAUDEMD_SECTION, BENCHMARK_DIVERGENCE_CLAUDEMD_SECTION, DUPLICATE_RECONCILER_CLAUDEMD_SECTION, AUDIT_CONVERGENCE_CLAUDEMD_SECTION, TONE_ADVISORY_MIGRATION_CLAUDEMD_SECTION, DECISION_JOURNAL_CONFIDENCE_CLAUDEMD_GUIDANCE, WINDOW_RUN_LIVENESS_CLAUDEMD_SECTION, SCRIPT_JOBS_CLAUDEMD_SECTION, JOB_RESULT_SUPERVISION_CLAUDEMD_SECTION, DEDICATED_PROFILE_REGISTRY_ROW_ANSWER, CODEX_ARM_SWEEPER_CLAUDEMD_SECTION, MACHINE_MAINTENANCE_CLAUDEMD_SECTION, APP_MEDIA_CLAUDEMD_SECTION, MACHINE_BROWSER_CARE_CLAUDEMD_SECTION } from '../core/PostUpdateMigrator.js';
 import { MINIMUM_OPERATOR_EFFORT_CLAUDEMD_SECTION } from '../core/PostUpdateMigrator.js';
 import { CODEX_DEVICE_LIMIT_CLAUDEMD_BULLET } from '../core/PostUpdateMigrator.js';
 import { UPDATE_APPLY_VERIFY_HOLD_CLAUDEMD_LINE } from '../core/PostUpdateMigrator.js';
@@ -457,6 +457,7 @@ ${INTERACTIVE_LOGIN_EXPIRED_BULLET}
 ${CODEX_ARM_SWEEPER_CLAUDEMD_SECTION(port)}
 
 ${MACHINE_MAINTENANCE_CLAUDEMD_SECTION(port)}
+${MACHINE_BROWSER_CARE_CLAUDEMD_SECTION(port)}
 
 ### Cold-Start Lifeline Fallback (no silent resource rejection)
 

package/src/templates/scripts/browser/chrome-close.sh

@@ -0,0 +1,97 @@
+#!/bin/bash
+# chrome-close.sh — say you are done with one profile's normal Chrome (machine self-maintenance, Part B).
+# Usage: chrome-close.sh <profile-id|/absolute/user-data-dir> [--when-free]
+# DRY-RUN in this release: it closes nothing. It records that the task is finished (the ledger's
+# completion signal, which is what lets the cleanup sweep close the browser once closing is turned
+# on), runs the same read-only unsaved-input and download checks a real close would, and prints and
+# logs what a close would do. --when-free records the completion signal only, for a browser you
+# cannot close yourself. If it reports unsaved input, submit or clear the form first.
+# macOS only (Apple Events). Installed by instar into .instar/scripts/browser/.
+if [ "$(uname -s)" != "Darwin" ]; then
+  echo "ERR macos-only: the normal-Chrome method uses macOS Apple Events; it does not run on $(uname -s)" >&2
+  exit 2
+fi
+[ -z "$1" ] && { echo "usage: chrome-close.sh <profile-id|/absolute/user-data-dir> [--when-free]" >&2; exit 64; }
+WHENFREE=0; [ "$2" = "--when-free" ] && WHENFREE=1
+# Resolve the profile to a canonical user-data-dir STRICTLY INSIDE this agent's home (the same
+# jail the Playwright profile registry applies). This guards against mistakes, not against a
+# hostile caller with a shell: it keeps an ordinary call from reaching the operator's own Chrome. realpath resolves `..` and symlinks before the check, and the canonical
+# path is what every later step uses (mkdir, Preferences, open, the process match).
+AGENT_HOME="$(cd "$(dirname "$0")/../../.." && pwd -P)"
+case "$AGENT_HOME" in *[[:space:]]*) echo "ERR agent-home-has-spaces: $AGENT_HOME (the exact process match needs a path without spaces; these tools cannot be used from this agent home)" >&2; exit 64 ;; esac
+case "$1" in
+  /*) RAW="$1" ;;
+  */*|.*) echo "ERR bad-profile-id: use a profile id from GET /playwright-profiles or an absolute directory inside this agent's home" >&2; exit 64 ;;
+  *) printf '%s' "$1" | grep -Eq '^[a-z0-9-]{1,64}$' || { echo "ERR bad-profile-id: ids are lowercase letters, digits and dashes (the profile registry's rule)" >&2; exit 64; }
+     RAW="$AGENT_HOME/.instar/state/playwright-profiles/$1" ;;
+esac
+case "$RAW" in *[[:space:]]*) echo "ERR bad-profile-path: no spaces or tabs in a profile path (the process match could pick another profile)" >&2; exit 64 ;; esac
+P="$(/usr/bin/python3 -I -c 'import os, sys; print(os.path.realpath(sys.argv[1]))' "$RAW")" || { echo "ERR profile-resolve-failed: $RAW" >&2; exit 64; }
+case "$P" in
+  "$AGENT_HOME"/?*) ;;
+  *) echo "ERR profile-outside-agent-home: $RAW (browser profiles must live under $AGENT_HOME)" >&2; exit 64 ;;
+esac
+# Inside the home, the agent's own folders are off limits except the profiles folder, and the
+# operator's own Chrome folder is always refused (in case an agent home were ever ~).
+case "$P/" in
+  "$HOME/Library/Application Support/Google/Chrome/"*) echo "ERR profile-reserved-folder: $P is the operator's own Chrome" >&2; exit 64 ;;
+  "$AGENT_HOME/.instar/state/playwright-profiles/"?*) ;;
+  "$AGENT_HOME/.instar/"*|"$AGENT_HOME/.claude/"*) echo "ERR profile-reserved-folder: $P is an agent config folder, not a browser profile" >&2; exit 64 ;;
+esac
+case "$P" in *[[:space:]]*) echo "ERR bad-profile-path: $P resolves to a path with spaces or tabs" >&2; exit 64 ;; esac
+D="$(dirname "$0")"
+"$D/chrome-ledger.sh" complete "$P"
+LOG="$AGENT_HOME/logs/browser-care.jsonl"
+log() { { mkdir -p "$(dirname "$LOG")" && HOMEDIR="$AGENT_HOME" PROFILE="$P" EVENT="$1" REASON="$2" /usr/bin/python3 -I -c '
+import json, os, time
+print(json.dumps({"ts": time.strftime("%Y-%m-%dT%H:%M:%S%z"), "event": os.environ["EVENT"], "dryRun": True,
+  "source": "chrome-close.sh", "profile": os.path.relpath(os.environ["PROFILE"], os.environ["HOMEDIR"]),
+  "reason": os.environ["REASON"] or None}))' >> "$LOG"; } 2>/dev/null || echo "warning: could not write $LOG" >&2; }
+if [ "$WHENFREE" = 1 ]; then
+  log completion-recorded ""
+  echo "recorded: finished with $1 (the cleanup sweep may close it once closing is turned on)"
+  exit 0
+fi
+PID=$(ps -axo pid=,args= | K="--user-data-dir=$P" awk '/Google Chrome\.app\/Contents\/MacOS\/Google Chrome / && index($0" ", ENVIRON["K"]" ") && !/--type=/ && !/--remote-debugging-|--enable-automation|--test-type/ { print $1; exit }')
+[ -z "$PID" ] && { log not-running ""; echo "not running"; exit 0; }
+# A download still growing, then every tab: the checks a real close runs first.
+DL="$(PROFILE="$P" /usr/bin/python3 -I -c '
+import json, os, time
+p = os.environ["PROFILE"]
+d = os.path.join(os.path.expanduser("~"), "Downloads")
+try:
+    with open(os.path.join(p, "Default", "Preferences")) as h:
+        x = json.load(h).get("download", {}).get("default_directory")
+    if isinstance(x, str) and os.path.isabs(x): d = x
+except Exception: pass
+try:
+    names = os.listdir(d)
+except FileNotFoundError:
+    print("no"); raise SystemExit
+except Exception:
+    print("unreadable"); raise SystemExit
+now = time.time()
+for n in names:
+    if n.endswith(".crdownload"):
+        try:
+            if now - os.stat(os.path.join(d, n)).st_mtime < 300: print("yes"); raise SystemExit
+        except OSError:
+            print("unreadable"); raise SystemExit
+print("no")')"
+case "$DL" in
+  yes) log would-keep download-active; echo "DRY-RUN: would KEEP: a download is still growing (nothing closed)"; exit 0 ;;
+  no) ;;
+  *) log would-keep download-unreadable; echo "DRY-RUN: would KEEP: the download folder is unreadable (nothing closed)"; exit 0 ;;
+esac
+TABS="$("$D/chrome-unsaved.sh" "$P")"
+printf '%s\n' "$TABS" | grep -q '^tab ' || TABS="none"
+case "$TABS" in *done) ;; *) log would-keep unreadable-tabs; echo "DRY-RUN: would KEEP: the tabs could not be read (nothing closed)"; exit 0 ;; esac
+if printf '%s\n' "$TABS" | grep -q ' yes$'; then
+  log would-keep unsaved-input; echo "DRY-RUN: would KEEP: a tab holds unsaved input; submit or clear it first (nothing closed)"; exit 0
+fi
+if printf '%s\n' "$TABS" | grep -q ' unreadable$'; then
+  log would-keep unreadable-tabs; echo "DRY-RUN: would KEEP: a tab could not be read (nothing closed)"; exit 0
+fi
+log would-close ""
+echo "DRY-RUN: would close $1 (pid $PID); nothing closed in this release. Completion recorded."
+exit 0

package/src/templates/scripts/browser/chrome-js.sh

@@ -99,6 +99,8 @@ print(json.dumps({"ts": time.strftime("%Y-%m-%dT%H:%M:%S%z"),
   "codeBytes": int(os.environ.get("NC_CALLER_CODE_BYTES") or len(code))}))' >> "$LOG"; } 2>/dev/null \
   || echo "warning: could not write the audit line to $LOG" >&2
 OUT="$(send "$WRAPPED")"
+# Keep the browser ledger current: this browser is in use (renews its lease). Never fails the call.
+"$(dirname "$0")/chrome-ledger.sh" touch "$P" 2>/dev/null
 case "$OUT" in
   "${NONCE}ok:"*) printf '%s\n' "${OUT#"${NONCE}ok:"}"; exit 0 ;;
   "${NONCE}err:"*) echo "ERR page-js-error: ${OUT#"${NONCE}err:"}"; exit 1 ;;

package/src/templates/scripts/browser/chrome-launch.sh

@@ -1,6 +1,10 @@
 #!/bin/bash
 # chrome-launch.sh — open a NORMAL (non-automated) Chrome for one browser profile.
-# Usage: chrome-launch.sh [--new] <profile-id|/absolute/user-data-dir> [url]
+# Usage: chrome-launch.sh [--new] [--purpose <words>] [--ttl-minutes <n>] <profile-id|/absolute/user-data-dir> [url]
+# Every launch is recorded in this agent's browser ledger (.instar/state/browser-instances/) with the
+# session that opened it. --purpose says what it is for; --ttl-minutes declares how long its contents
+# matter (a long scheduled browser action), after which the cleanup sweep may treat it as disposable.
+# Close what you open with chrome-close.sh when the task ends.
 # A profile folder that does not exist is refused (it would open a signed-out browser that
 # looks like a lost login); pass --new to create one on purpose.
 # Launches through LaunchServices (`open -g -na`: in the background, never taking focus from the
@@ -14,8 +18,16 @@ if [ "$(uname -s)" != "Darwin" ]; then
   echo "ERR macos-only: the normal-Chrome method uses macOS Apple Events; it does not run on $(uname -s)" >&2
   exit 2
 fi
-NEWOK=0; [ "$1" = "--new" ] && { NEWOK=1; shift; }
-[ -z "$1" ] && { echo "usage: chrome-launch.sh [--new] <profile-id|/absolute/user-data-dir> [url]" >&2; exit 64; }
+NEWOK=0; PURPOSE=""; TTL=""
+while :; do
+  case "$1" in
+    --new) NEWOK=1; shift ;;
+    --purpose) [ -n "$2" ] || { echo "ERR bad-purpose: --purpose needs a value" >&2; exit 64; }; PURPOSE="$(printf '%s' "$2" | tr -cd 'A-Za-z0-9 ._:-' | cut -c1-80)"; shift 2 ;;
+    --ttl-minutes) printf '%s' "$2" | grep -Eq '^[1-9][0-9]{0,5}$' || { echo "ERR bad-ttl: --ttl-minutes takes a whole number of minutes" >&2; exit 64; }; TTL="$2"; shift 2 ;;
+    *) break ;;
+  esac
+done
+[ -z "$1" ] && { echo "usage: chrome-launch.sh [--new] [--purpose <words>] [--ttl-minutes <n>] <profile-id|/absolute/user-data-dir> [url]" >&2; exit 64; }
 # The url slot is passed to Chrome after --args, so anything that is not a URL would become a Chrome
 # flag. Only a URL with a scheme is accepted; a flag (--remote-debugging-port=..., -flag, /flag) is
 # refused before anything is launched. The same rule the Windows driver enforces with its allowlist.
@@ -87,5 +99,6 @@ os.replace(t, f)  # atomic: Chrome never sees a half-written Preferences file
 # from a job or a tmux session must not take focus from whoever is using the machine (the operator
 # brings the window forward themselves when a page needs their own click).
 open -g -na "Google Chrome" --args --user-data-dir="$P" "$URL" || { echo "ERR launch-failed (is Google Chrome installed?)" >&2; exit 1; }
+"$(dirname "$0")/chrome-ledger.sh" launch "$P" "$PURPOSE" "$TTL"
 [ "$NEW" = 1 ] && echo "note: new profile; Chrome ignores the Apple Events setting on its first run. Quit this Chrome once and run chrome-launch.sh again before chrome-js.sh." >&2
 exit 0

package/src/templates/scripts/browser/chrome-ledger.sh

@@ -0,0 +1,49 @@
+#!/bin/bash
+# chrome-ledger.sh — keep this agent's browser-instance ledger (machine self-maintenance, Part B).
+# Usage: chrome-ledger.sh launch|touch|renew|complete <canonical user-data-dir> [purpose] [ttl-minutes]
+# Called by chrome-launch.sh, chrome-js.sh, chrome-renew.sh and chrome-close.sh with a profile
+# directory they have already resolved inside this agent's profiles folder; it checks that again.
+# One small JSON file per instance in .instar/state/browser-instances/, named by the first 16 hex
+# of SHA-256 of the directory (the server's sweep uses the same name). It records who opened the
+# browser and when it was last used; the sweep reads it to decide what it WOULD close. It closes
+# nothing itself. A failure here never stops the caller: it warns on stderr and exits 0.
+# Installed by instar into .instar/scripts/browser/ — overwritten on every update.
+AGENT_HOME="$(cd "$(dirname "$0")/../../.." && pwd -P)"
+ACTION="$1"; DIR="$2"
+case "$ACTION" in launch|touch|renew|complete) ;; *) echo "usage: chrome-ledger.sh launch|touch|renew|complete <dir> [purpose] [ttl-minutes]" >&2; exit 64 ;; esac
+case "$DIR" in "$AGENT_HOME/.instar/state/playwright-profiles/"?*) ;; *) echo "ERR ledger-dir-outside-profiles: $DIR" >&2; exit 64 ;; esac
+LEDGER="$AGENT_HOME/.instar/state/browser-instances" ACTION="$ACTION" DIR="$DIR" PURPOSE="$3" TTL="$4" \
+  AGENT="${INSTAR_AGENT_ID:-}" SESSION="${INSTAR_SESSION_NAME:-}" TOPIC="${INSTAR_TELEGRAM_TOPIC:-}" /usr/bin/python3 -I -c '
+import hashlib, json, os, time
+e = os.environ
+d, act = e["DIR"], e["ACTION"]
+os.makedirs(e["LEDGER"], exist_ok=True)
+f = os.path.join(e["LEDGER"], hashlib.sha256(d.encode()).hexdigest()[:16] + ".json")
+now = time.time()
+iso = lambda t: time.strftime("%Y-%m-%dT%H:%M:%S.000Z", time.gmtime(t))
+cur = None
+try:
+    with open(f) as h:
+        cur = json.load(h)
+except Exception:
+    cur = None
+if act == "launch":
+    declared = e["TTL"].isdigit() and int(e["TTL"]) > 0
+    ttl = int(e["TTL"]) if declared else 120
+    cur = {"userDataDir": d, "pid": None, "processStartTime": None, "agent": e["AGENT"] or None,
+           "sessionName": e["SESSION"] or None, "topicId": e["TOPIC"] or None, "purpose": e["PURPOSE"] or None,
+           "openedAt": iso(now), "lastUsedAt": iso(now), "ttlMinutes": ttl, "ttlDeclared": declared,
+           "leaseUntil": iso(now + ttl * 60), "completedAt": None}
+elif cur is None:
+    raise SystemExit(0)  # no entry: the sweep adopts a running browser it finds
+elif act in ("touch", "renew"):
+    cur["lastUsedAt"] = iso(now)
+    cur["leaseUntil"] = iso(now + int(cur.get("ttlMinutes") or 120) * 60)
+elif act == "complete":
+    cur["completedAt"] = iso(now)
+t = f + ".tmp"
+with open(t, "w") as h:
+    json.dump(cur, h, indent=2)
+os.replace(t, f)
+' || echo "warning: could not update the browser ledger for $DIR" >&2
+exit 0

package/src/templates/scripts/browser/chrome-renew.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+# chrome-renew.sh — renew the lease on one profile's browser for work the other helpers never see
+# (a long download, a page working by itself). Usage: chrome-renew.sh <profile-id|/absolute/user-data-dir>
+# chrome-js.sh and chrome-mainworld.sh renew it on every call already. macOS only.
+# Installed by instar into .instar/scripts/browser/ — overwritten on every update.
+if [ "$(uname -s)" != "Darwin" ]; then
+  echo "ERR macos-only: the normal-Chrome method uses macOS Apple Events; it does not run on $(uname -s)" >&2
+  exit 2
+fi
+[ -z "$1" ] && { echo "usage: chrome-renew.sh <profile-id|/absolute/user-data-dir>" >&2; exit 64; }
+# Resolve the profile to a canonical user-data-dir STRICTLY INSIDE this agent's home (the same
+# jail the Playwright profile registry applies). This guards against mistakes, not against a
+# hostile caller with a shell: it keeps an ordinary call from reaching the operator's own Chrome. realpath resolves `..` and symlinks before the check, and the canonical
+# path is what every later step uses (mkdir, Preferences, open, the process match).
+AGENT_HOME="$(cd "$(dirname "$0")/../../.." && pwd -P)"
+case "$AGENT_HOME" in *[[:space:]]*) echo "ERR agent-home-has-spaces: $AGENT_HOME (the exact process match needs a path without spaces; these tools cannot be used from this agent home)" >&2; exit 64 ;; esac
+case "$1" in
+  /*) RAW="$1" ;;
+  */*|.*) echo "ERR bad-profile-id: use a profile id from GET /playwright-profiles or an absolute directory inside this agent's home" >&2; exit 64 ;;
+  *) printf '%s' "$1" | grep -Eq '^[a-z0-9-]{1,64}$' || { echo "ERR bad-profile-id: ids are lowercase letters, digits and dashes (the profile registry's rule)" >&2; exit 64; }
+     RAW="$AGENT_HOME/.instar/state/playwright-profiles/$1" ;;
+esac
+case "$RAW" in *[[:space:]]*) echo "ERR bad-profile-path: no spaces or tabs in a profile path (the process match could pick another profile)" >&2; exit 64 ;; esac
+P="$(/usr/bin/python3 -I -c 'import os, sys; print(os.path.realpath(sys.argv[1]))' "$RAW")" || { echo "ERR profile-resolve-failed: $RAW" >&2; exit 64; }
+case "$P" in
+  "$AGENT_HOME"/?*) ;;
+  *) echo "ERR profile-outside-agent-home: $RAW (browser profiles must live under $AGENT_HOME)" >&2; exit 64 ;;
+esac
+# Inside the home, the agent's own folders are off limits except the profiles folder, and the
+# operator's own Chrome folder is always refused (in case an agent home were ever ~).
+case "$P/" in
+  "$HOME/Library/Application Support/Google/Chrome/"*) echo "ERR profile-reserved-folder: $P is the operator's own Chrome" >&2; exit 64 ;;
+  "$AGENT_HOME/.instar/state/playwright-profiles/"?*) ;;
+  "$AGENT_HOME/.instar/"*|"$AGENT_HOME/.claude/"*) echo "ERR profile-reserved-folder: $P is an agent config folder, not a browser profile" >&2; exit 64 ;;
+esac
+case "$P" in *[[:space:]]*) echo "ERR bad-profile-path: $P resolves to a path with spaces or tabs" >&2; exit 64 ;; esac
+"$(dirname "$0")/chrome-ledger.sh" renew "$P"
+echo "renewed"

package/src/templates/scripts/browser/chrome-unsaved.sh

@@ -0,0 +1,83 @@
+#!/bin/bash
+# chrome-unsaved.sh — read, for every tab of one profile's normal Chrome, whether it holds input a
+# person or the agent typed and has not sent (machine self-maintenance, Part B).
+# Usage: chrome-unsaved.sh <profile-id|/absolute/user-data-dir>
+# Prints one line per tab, `tab <window>.<tab> yes|no|unreadable`, then `done`. Never prints a value.
+# yes: an input or textarea whose value differs from its default, a checkbox, radio or select
+# differing from its default, a chosen file, or a contenteditable element with any text (it has no
+# default to compare with, so any text counts). unreadable: the tab did not answer in 5 seconds,
+# the focus is inside a frame, or the page could not be read. Read-only: takes no focus, changes
+# nothing on the page, runs in Chrome's isolated world. Used before any close; uncertainty keeps.
+# macOS only (Apple Events). Installed by instar into .instar/scripts/browser/.
+if [ "$(uname -s)" != "Darwin" ]; then
+  echo "ERR macos-only: the normal-Chrome method uses macOS Apple Events; it does not run on $(uname -s)" >&2
+  exit 2
+fi
+[ -z "$1" ] && { echo "usage: chrome-unsaved.sh <profile-id|/absolute/user-data-dir>" >&2; exit 64; }
+# Resolve the profile to a canonical user-data-dir STRICTLY INSIDE this agent's home (the same
+# jail the Playwright profile registry applies). This guards against mistakes, not against a
+# hostile caller with a shell: it keeps an ordinary call from reaching the operator's own Chrome. realpath resolves `..` and symlinks before the check, and the canonical
+# path is what every later step uses (mkdir, Preferences, open, the process match).
+AGENT_HOME="$(cd "$(dirname "$0")/../../.." && pwd -P)"
+case "$AGENT_HOME" in *[[:space:]]*) echo "ERR agent-home-has-spaces: $AGENT_HOME (the exact process match needs a path without spaces; these tools cannot be used from this agent home)" >&2; exit 64 ;; esac
+case "$1" in
+  /*) RAW="$1" ;;
+  */*|.*) echo "ERR bad-profile-id: use a profile id from GET /playwright-profiles or an absolute directory inside this agent's home" >&2; exit 64 ;;
+  *) printf '%s' "$1" | grep -Eq '^[a-z0-9-]{1,64}$' || { echo "ERR bad-profile-id: ids are lowercase letters, digits and dashes (the profile registry's rule)" >&2; exit 64; }
+     RAW="$AGENT_HOME/.instar/state/playwright-profiles/$1" ;;
+esac
+case "$RAW" in *[[:space:]]*) echo "ERR bad-profile-path: no spaces or tabs in a profile path (the process match could pick another profile)" >&2; exit 64 ;; esac
+P="$(/usr/bin/python3 -I -c 'import os, sys; print(os.path.realpath(sys.argv[1]))' "$RAW")" || { echo "ERR profile-resolve-failed: $RAW" >&2; exit 64; }
+case "$P" in
+  "$AGENT_HOME"/?*) ;;
+  *) echo "ERR profile-outside-agent-home: $RAW (browser profiles must live under $AGENT_HOME)" >&2; exit 64 ;;
+esac
+# Inside the home, the agent's own folders are off limits except the profiles folder, and the
+# operator's own Chrome folder is always refused (in case an agent home were ever ~).
+case "$P/" in
+  "$HOME/Library/Application Support/Google/Chrome/"*) echo "ERR profile-reserved-folder: $P is the operator's own Chrome" >&2; exit 64 ;;
+  "$AGENT_HOME/.instar/state/playwright-profiles/"?*) ;;
+  "$AGENT_HOME/.instar/"*|"$AGENT_HOME/.claude/"*) echo "ERR profile-reserved-folder: $P is an agent config folder, not a browser profile" >&2; exit 64 ;;
+esac
+case "$P" in *[[:space:]]*) echo "ERR bad-profile-path: $P resolves to a path with spaces or tabs" >&2; exit 64 ;; esac
+PID=$(ps -axo pid=,args= | K="--user-data-dir=$P" awk '/Google Chrome\.app\/Contents\/MacOS\/Google Chrome / && index($0" ", ENVIRON["K"]" ") && !/--type=/ && !/--remote-debugging-|--enable-automation|--test-type/ { print $1; exit }')
+[ -z "$PID" ] && { echo "NO_PID"; exit 1; }
+NONCE="nc$(/usr/bin/python3 -I -c 'import secrets; print(secrets.token_hex(8))')" || { echo "ERR nonce-failed" >&2; exit 1; }
+CHECK="(function(){var N='$NONCE';try{var a=document.activeElement;if(a&&(a.tagName==='IFRAME'||a.tagName==='FRAME'))return N+'unreadable';var y=false,els=document.querySelectorAll('input,textarea,select');for(var k=0;k<els.length&&!y;k++){var e=els[k],t=(e.type||'').toLowerCase();if(e.tagName==='SELECT'){for(var o=0;o<e.options.length;o++){if(e.options[o].selected!==e.options[o].defaultSelected)y=true}}else if(t==='checkbox'||t==='radio'){if(e.checked!==e.defaultChecked)y=true}else if(t==='file'){if(e.files&&e.files.length)y=true}else if(['hidden','submit','button','reset','image'].indexOf(t)<0){if(e.value!==e.defaultValue)y=true}}if(!y){var ce=document.querySelectorAll('[contenteditable]:not([contenteditable=false])');for(var c=0;c<ce.length;c++){if((ce[c].textContent||'').trim()){y=true;break}}}return N+(y?'yes':'no')}catch(x){return N+'unreadable'}})()"
+JS="$CHECK" PID=$PID NONCE="$NONCE" osascript -l JavaScript <<'OSA'
+ObjC.import('Foundation');
+var env=$.NSProcessInfo.processInfo.environment;
+var pid=parseInt(ObjC.unwrap(env.objectForKey('PID')));
+var js=ObjC.unwrap(env.objectForKey('JS'));
+var nonce=ObjC.unwrap(env.objectForKey('NONCE'));
+var target=$.NSAppleEventDescriptor.descriptorWithProcessIdentifier(pid);
+function fc(s){var b=s.split('').map(c=>c.charCodeAt(0));return (b[0]<<24)|(b[1]<<16)|(b[2]<<8)|b[3];}
+function spec(cls,from,form,data){var r=$.NSAppleEventDescriptor.recordDescriptor.coerceToDescriptorType(fc('obj '));
+ r.setDescriptorForKeyword($.NSAppleEventDescriptor.descriptorWithTypeCode(fc(cls)),fc('want'));
+ r.setDescriptorForKeyword(from,fc('from'));
+ r.setDescriptorForKeyword($.NSAppleEventDescriptor.descriptorWithEnumCode(fc(form)),fc('form'));
+ r.setDescriptorForKeyword(data,fc('seld'));return r;}
+var out=[], stop=false;
+// errAENoSuchObject (-1728) ends a window's tabs, or the windows; any other failure is unreadable and stops the read.
+for(var i=1;i<=50&&!stop;i++){
+ var w=spec('cwin',$.NSAppleEventDescriptor.nullDescriptor,'indx',$.NSAppleEventDescriptor.descriptorWithInt32(i));
+ for(var j=1;j<=200;j++){
+  var t=spec('ctab',w,'indx',$.NSAppleEventDescriptor.descriptorWithInt32(j));
+  var ev=$.NSAppleEventDescriptor.appleEventWithEventClassEventIDTargetDescriptorReturnIDTransactionID(fc('CrSu'),fc('ExJa'),target,-1,0);
+  ev.setParamDescriptorForKeyword(t,fc('----'));
+  ev.setParamDescriptorForKeyword($.NSAppleEventDescriptor.descriptorWithString(js),fc('JvSc'));
+  var err=Ref();
+  var res=ev.sendEventWithOptionsTimeoutError(0x3,5,err);
+  if(res.isNil()){
+   var code=(err[0]&&!err[0].isNil())?err[0].code:0;
+   if(code==-1728){ if(j==1) stop=true; break; }
+   out.push('tab '+i+'.'+j+' unreadable'); stop=true; break;
+  }
+  var d=res.paramDescriptorForKeyword(fc('----'));
+  var v=d.isNil()?'':ObjC.unwrap(d.stringValue);
+  out.push('tab '+i+'.'+j+' '+(v===nonce+'yes'?'yes':v===nonce+'no'?'no':'unreadable'));
+ }
+}
+out.push('done');
+out.join('\n')
+OSA

package/upgrades/1.3.1601.md

@@ -0,0 +1,68 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+New dev-gated server service (`docs/specs/ecosystem-idea-pipeline.md`). Each week it reviews a
+watchlist of similar projects: trusted code fetches and reads, and AI services return closed-schema
+judgments. Each idea is checked against our source and specs by two blind reads, reviewed against the
+Instar 2.0 purpose, classed by what it would change, and ranked into bands. The default outcome is no
+change. A framework reads outside text only after two must-fail file-read probes through the same call
+path real reviews use; to pass them, `IntelligenceOptions.noLocalTools` and
+`reviewerHardening.noTools` ask Codex and Claude for calls with no local tools. The default path of every
+other caller is unchanged. `scripts/lint-ecosystem-adoption.mjs` joins the lint chain: it fails a default
+change for a tagged spec unless `docs/proofs/<idea>.json` passes, and no spec is tagged yet.
+
+⚗️ Experimental, development agents only: copying runs wherever native app conversations are on (`mobilePairing.native.enabled`, dark on the fleet), even with `mobilePairing.native.media.enabled` off, so switching media off never strands a copy (as the spec requires); the media flag gates only the phone's media routes. Files sent in app conversations now reach every one of the agent's machines. Each machine copies every file that a message it holds refers to, over the existing signed machine-to-machine channel (a new `app-media-pull` verb), at most 1 MiB at a time, and keeps a copy only when its length and SHA-256 match the message. Copying runs in the background at a bounded pace (at most 8 slices every 5 seconds), pauses below the free-disk floor and, for at most an hour at a time, while the machine reports itself overloaded. A partial copy comes from one machine only (so a damaged copy is blamed on the machine that sent it), and a machine re-checks a file whose size or time changed before serving it, setting a damaged one aside. Brakes: a file no machine can provide is retried with a growing wait (30 seconds up to an hour) and given up after 7 days with one notice; a machine whose copies keep failing verification is skipped for 15 minutes, and for the rest of the day after the third time, with one notice. Each machine lists the files it holds every hour; `singleCopyBlobs` counts files only this machine holds, and a file left on one machine raises one notice after the other machines were asked to copy it and still have not. A download of a file still copying answers `202 fetching` when a copy can actually start, and otherwise `404` with the reason (no connection to the other machines, the disk floor, no reachable machine holding it, or given up); a message whose file has not reached the delivering machine within 60 seconds is delivered with `[file still copying: <name>]`, followed by one `[file now available: <path>]` line when it lands. `GET /health?scope=pool` shows every machine's `appMedia`.
+
+- `GET /mobile/conversations` pages app conversations and Telegram topics on one cursor, so no conversation is cut from the list and left unreachable when there are many Telegram topics.
+- `GET /mobile/conversations` and `GET /mobile/chat/app/:key/messages` accept `?scope=pool`: every machine's rows merged, a machine that did not answer listed in `pool.failed`, and a row only another machine holds marked "couldn't check here".
+- With native app conversations on, a message sent from the app into a Telegram topic is no longer refused for a pairing invite, a desktop code or password-like text: the invite or code is removed and the rest delivered, password-like text is delivered with a `credentialShaped` signal, and the 📱 copy posted in the topic hides it.
+- App history rows say how the signing phone was approved (`originApprovedVia`: `telegram-dm` or `dashboard-pin`), so the app can show "approved on dashboard".
+
+- A later loss of an autonomous run's liveness check now gets its own 15-minute at-risk window after an earlier recovery returned the run to active. The old recovery attempt remains spent; it never refreshes the executor twice.
+- A run that never recovers from the first loss still fails on the original deadline.
+
+## What to Tell Your User
+
+If you develop your own project, I can check similar projects each week and show you ranked ideas, each
+checked against your code. It only gives advice: it changes nothing and contacts nobody. It is off unless
+you ask for it.
+
+Nothing yet: this ships dark and needs the next iPhone app build. On a development agent with more than one machine, a file you send in the app is copied to my other machines, so any of them can open it.
+
+If you use the Instar iPhone app with native conversations turned on: your conversation list now always shows every conversation, however many Telegram topics you have, and the app can show conversations from all your machines. A message you send from the app into a Telegram topic is no longer turned away because it contains an invite or something that looks like a password; the invite is removed, and the password-like text is sent as you wrote it (the app asks you first) but hidden in the copy posted to the Telegram topic.
+
+A brief interruption after a previous recovered interruption will no longer stop an otherwise healthy autonomous run immediately. The run still pauses active work while any liveness check is red and fails if that interruption persists for 15 minutes.
+
+## Summary of New Capabilities
+
+- `GET /ecosystem-ideas`, `GET /ecosystem-ideas/:id/evidence`, and PIN-gated decisions through `POST /ecosystem-ideas/plan` and `/commit`.
+- The console's Work group gains an Ideas page.
+
+- Mesh verb `app-media-pull` (slice, inventory, nudge), registered-peer read class.
+- `GET /mobile/media/:sha256?ref=` answers `202 {state: "fetching", retryAfterMs}` while a file is copied here.
+- `GET /app/media-path/:attachmentId` pulls a missing file for up to 30 seconds and says plainly why when it cannot.
+- Authenticated `/health` → `appMedia.singleCopyBlobs` and `unrecoverableBlobs` are measured (null when they cannot be); `?scope=pool` adds `appMediaPool`.
+
+- `?scope=pool` on `GET /mobile/conversations` and `GET /mobile/chat/app/:key/messages`.
+- `originApprovedVia` on app history, sync and the device's Telegram history read.
+
+- Autonomous run liveness tracks each later interruption's observation deadline correctly while keeping one recovery actuation per run.
+
+## Evidence
+
+Live on this machine on 2026-11-01: without the no-tools form the capability probe refused Codex (it read
+the planted file), and Claude's call stopped when it tried a tool. With the form, both frameworks passed
+both probes. Tests: fixture runs on a real clone hold a hostile CLAUDE.md and a marker-writing script;
+the planted idea is found, no marker is written, and the same run with file reads disabled finds nothing.
+
+Unit tests for the serve side, verified pulls, backoff, the 7-day give-up, the peer breaker, the load and disk pauses, inventories and the single-copy alarm ladder; integration tests over a real signed MeshRpc client and dispatcher (202 then the verified bytes, a corrupted slice never kept, "still copying" then exactly one "now available" line, app-media-path pulling on demand, the pool health read); an end-to-end test of two production-booted servers copying a photo between them.
+
+- Unit tests cover the list order and cursor, lossless paging across several sources, duplicate collapse, and hiding credentials in the mirror copy.
+- Integration tests run the real routes: 250 Telegram topics plus 5 app conversations paged to the end with every row exactly once; pool reads with a live peer and an unreachable one; token removal through the Telegram route (stored as `redacted`, token absent from disk); the native-off refusals unchanged; the approval method for Telegram- and dashboard-approved phones.
+
+- Unit tests cover successful and busy recovery, a later loss, healing, the 15-minute ceiling, and the same-millisecond boundary.
+- Authenticated HTTP integration and production-boot E2E tests cover the route and full server path.

package/upgrades/1.3.1602.md

@@ -0,0 +1,24 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+- Honest lock reading: `GET /machine-maintenance/lock-state` reports whether a Mac is really locked. It says `locked` only when the session flag, the lock screen actually drawn and an immediate password requirement all agree. A screensaver a keypress dismisses reads `screensaver-or-display-sleep`; conflicting or unreadable evidence reads `unknown` with the reason. Every input is reported beside the verdict.
+- Browser care, watch-only: `chrome-launch.sh` now records each normal Chrome an agent opens (which session, what for, how long it should live). A sweep every 15 minutes writes down which of this agent's own browsers it WOULD close and why it keeps the rest (unsaved form input, a download still running, someone at the keyboard, the opening session still alive, a sign-in repair). It never touches the operator's own Chrome and closes nothing in this release. New helpers: `chrome-close.sh` (dry-run: records that the task is done and reports what a close would do), `chrome-renew.sh`, `chrome-unsaved.sh`. Results ride `GET /machine-maintenance` as `browserCare`. Dev-gated, dark on the fleet.
+
+## What to Tell Your User
+
+If you ask whether one of your Macs is locked, I can now check properly instead of trusting one flag that also says "locked" during a plain screensaver. I also keep a list of the browser windows I open, so I can tell you which ones I left open; for now I only note which I would close, and close none of them.
+
+## Summary of New Capabilities
+
+- `GET /machine-maintenance/lock-state`: honest lock verdict with its inputs.
+- `browserCare` on `GET /machine-maintenance`: the agent's open browsers and the sweep's would-close / keep verdicts.
+- `chrome-close.sh`, `chrome-renew.sh`, `chrome-unsaved.sh` and `chrome-launch.sh --purpose/--ttl-minutes`.
+
+## Evidence
+
+- Unit tests cover every row of the lock decision table on both sides, the browser sweep's ownership rule, each close reason and each keep reason, and the helper scripts with stubbed system tools; the page check runs in a real DOM. A source test proves the new code has no way to end a process.
+- Integration and end-to-end tests serve both routes through the real server, including the 2026-11-01 case (flag set, no password, screensaver running), which now reads as a screensaver, not locked.

package/upgrades/side-effects/machine-self-maintenance-browser-care-lock-reading.md

@@ -0,0 +1,98 @@
+# Side-Effects Review — Machine self-maintenance, browser care and honest lock reading (watch-only)
+
+**Version / slug:** `machine-self-maintenance-browser-care-lock-reading`
+**Date:** `2026-11-02`
+**Author:** `echo`
+**Second-pass reviewer:** `not run (--second-pass false, as instructed for this build)`
+
+## Summary of the change
+
+Increment 2 of docs/specs/machine-self-maintenance.md: Part B (browser and window care, CMT-1201) in watch-only form, and Part A (honest lock reading, CMT-1204) as a read surface.
+
+- Part A: `lockState.ts` is the spec's five-row decision table, pure. `MachineLockStateReader` (src/core) gathers its inputs on macOS from the packaged desktop helper's existing `probe` (run with the existing lock-input switch, which only adds read-only fields) and `sysadminctl -screenLock status`. `GET /machine-maintenance/lock-state` serves the verdict with every input beside it. Linux reads `not-applicable`, Windows and WSL read `unknown`.
+- Part B: `BrowserCare.ts` holds the instance ledger and a 15-minute sweep that applies the spec's ownership rule, the three close grounds and the keep checks, and records what it WOULD close. It has no close path. New helpers `chrome-ledger.sh`, `chrome-close.sh` (dry-run: records the completion signal and reports), `chrome-renew.sh`, `chrome-unsaved.sh` (read-only per-tab check); `chrome-launch.sh` and `chrome-js.sh` now keep the ledger current. `GET /machine-maintenance` carries a `browserCare` block. An awareness section reaches fresh and updated agents, and the release note is `upgrades/next/machine-self-maintenance-browser-care-lock-reading.md`.
+
+Tier 2 (spec-driven, the operator accepted the spec at the round cap). Size: 4 new source modules (about 650 lines), 4 new shell helpers, small edits to 2 helpers, wiring, 3 new test files and 3 extended ones. Effort: one design pass, no spec rounds in this increment.
+
+Deliberate differences from the spec text, all in the safe direction:
+
+1. `chrome-close.sh` closes nothing in this release (the operator's instruction: anything that quits apps ships dry-run first). It records the completion signal, runs the same checks and logs `would-close` or `would-keep`.
+2. The launch cap does not refuse a launch while dry-run is on. The spec has the launcher refuse at the cap during dry-run; a dry-run that blocks launches is not a dry-run, so this build only reports `overAgentCap` and `overHostCap`. Enforcement arrives with closing.
+3. The host count is read from the process table (every agent's normal-Chrome profiles), not from marker files. Same number, no new host directory.
+4. A sign-in repair episode open on this machine keeps every browser (the spec excludes that episode's profile). Coarser, never wider.
+5. A `keepProfiles` allowlist is added (`machineMaintenance.browserCare.keepProfiles`): those profiles are never picked.
+6. The frontmost-window exclusion is replaced by a stronger rule: any console input in the last 5 minutes keeps every candidate.
+7. Part A's changes to `/desktop/diagnostics` and to the helper's capture admission are not in this increment; the lock reading is a separate read route. <!-- tracked: CMT-1204 -->
+
+## Decision-point inventory
+
+- `lockState` verdict — add — deterministic table, reported only. Nothing in Instar reads it to admit, refuse or act; it answers "is that Mac really locked?" honestly.
+- Browser sweep verdict (`would-close` / `keep` with a reason) — add — recorded evidence only. No code acts on it.
+- `chrome-close.sh` verdict — add — printed and logged; it closes nothing.
+- No admission, block, kill or message decision is added, modified or consulted.
+
+---
+
+## 1. Over-block
+
+No block/allow surface. Nothing is refused or closed. The one behavioural change to an existing tool: `chrome-launch.sh` now also refuses a malformed `--ttl-minutes` or an empty `--purpose` (exit 64); calls without those flags behave as before.
+
+---
+
+## 2. Under-block
+
+As evidence, known gaps, each visible:
+- The per-tab check reads ordinary form fields, ticked boxes, selects, chosen files and contenteditable text. Text held only in a page's own memory or drawn on a canvas reads as no input. Any non-empty contenteditable reads as yes (it has no default to compare), so pages like editors are always kept: over-keeping, the safe side.
+- Tabs are walked by window index; if the window order changed mid-read a tab could be read twice and another missed. The check runs only after 5 minutes with no console input, which makes a reorder unlikely, and in this release nothing closes on its answer.
+- A Chrome with no windows reads as unreadable and is kept.
+- Only the real Chrome app's main process counts (`Google Chrome.app/Contents/MacOS/Google Chrome`). Chrome for Testing, Chromium and any browser started with automation flags (`--remote-debugging-port/pipe`, `--enable-automation`, `--test-type`) are never counted, even inside a profiles folder, so the Playwright MCP browser is never adopted. The same rule applies to the PID lookup in `chrome-unsaved.sh` and `chrome-close.sh`. Added after the independent review of PR 2582.
+- The sweep ignores `relogin-chrome-profile-*` directories and anything outside this agent's profiles folder, so those are never counted as owned.
+- Part A: a lock shield drawn while the flag is set and no password is required is conflicting evidence and reads `unknown` (row 5), not `screensaver-or-display-sleep`; row 3 requires no shield. Added after the independent review.
+- Part A: a stale or missing lock sample, an old helper without lock inputs, or an unreadable policy all read `unknown`. That is honest but means `unknown` may be common until the helper is present everywhere; the live matrix (L1) is still to run.
+
+---
+
+## 3. Level-of-abstraction fit
+
+The decision logic lives in `monitoring/machineMaintenance/` beside the drain rehearsal and under the same source rule (no way to signal a process, OS commands only through the fixed read-only table). The two reads that must run a helper (`chrome-unsaved.sh`) or read a profile's folders live in `src/core/BrowserCareProbes.ts`, injected as dependencies. The lock reader reuses the existing desktop helper and its existing `lockInputs` rather than adding a native verb, and keeps the spec's table separate from the desktop-locked-screen classifier, which answers a different question (whether remote control may proceed).
+
+---
+
+## 4. Signal vs authority compliance
+
+Signal only. `tests/unit/machine-maintenance-watch-only.test.ts` now covers `BrowserCare.ts` and `lockState.ts` too, and separately the two reads kept in src/core (`BrowserCareProbes.ts`, `MachineLockStateReader.ts`): no restart words, no process signal, no file writes, only their named commands with fixed arguments, and an import allowlist. In the maintenance folder: no restart words, no way to signal a process, exec only through the one allowlisted runner (which gained one read: `ps -axo pid=,lstart=,args=`). `chrome-close.sh` is checked by `tests/unit/browser-care-scripts.test.ts` to hold no kill, quit or Apple Event. `chrome-unsaved.sh`'s page code is checked to assign nothing and to send one event type only. Reference: docs/signal-vs-authority.md.
+
+---
+
+## 5. Interactions
+
+- `chrome-launch.sh` and `chrome-js.sh` call `chrome-ledger.sh` after their own work; a ledger failure warns on stderr and never changes their exit code or output.
+- The sweep's per-tab check sends a read-only Apple Event to an agent-owned Chrome. It runs only for close candidates, at most 5 per pass, only after 5 minutes without console input. If macOS has not yet allowed the server's process tree to control Chrome, that first event can show macOS's own permission prompt on the machine. Sessions already drive these same Chromes through the same tmux tree, so the grant normally exists; the bound keeps any prompt rare.
+- The lock reader runs the helper's `probe` with the lock-input switch. On that verb the switch only adds fields; it starts no indicator, takes no lock and grants nothing. Cached 5 s, one read at a time.
+- The drain rehearsal, `DirectDesktopAccess` and `DesktopLockedController` are not touched.
+
+---
+
+## 6. External surfaces
+
+New route `GET /machine-maintenance/lock-state` (Bearer, 503 when dark). New field `browserCare` on `GET /machine-maintenance`. New state `.instar/state/browser-instances/` (one file per open owned browser, removed when it exits) and `logs/browser-care.jsonl` (rotated at 2 MiB), both registered in the state coherence registry. Four new helper scripts in `.instar/scripts/browser/`, installed by the existing always-overwrite installer. One CLAUDE.md section, added to existing agents by `migrateClaudeMd` with a content-sniff guard. Everything runs only where `machineMaintenance` is on (dev-gated; dark on the fleet); the helper scripts install everywhere, and the ledger they write is inert where the sweep is dark.
+
+---
+
+## 7. Multi-machine posture
+
+Machine-local by design (hardware-bound-resource): the ledger and verdicts describe live processes on one machine, and the lock reading is that machine's own console. `?scope=pool` for these fields is part of the later pool increment. <!-- tracked: CMT-1199 -->
+
+---
+
+## 8. Rollback cost
+
+`machineMaintenance.browserCare.enabled: false` stops the sweep (read live). `machineMaintenance.enabled: false` removes both the sweep and the lock route at the next restart. Reverting the release leaves inert ledger files and the extra helper scripts; nothing reads them. No data migration, no state repair.
+
+## Second-pass review
+
+**Reviewer:** independent subagent, second pass, 2026-11-02
+
+**Verdict: concur**, after a confirming pass on 58b722a80. Findings fixed: automation browsers (Chrome for Testing, Playwright) excluded from the sweep and scripts; the cannot-act test covers BrowserCareProbes.ts and MachineLockStateReader.ts; a lock shield with no password reads unknown. Known low items: the scripts exclude --remote-debugging- as a prefix while the parser lists port and pipe; chrome-close.sh records finished before its checks; a missing sign-in repair system reads as no repair open. The two skipIf(!HAS_PY) skips are justified: /usr/bin/python3 is what the scripts themselves require.
+
+**Suite ratchet, 2026-11-02:** no-silent-fallbacks flagged seven new catches. Each turns a failed read into an explicit unknown or unreadable that keeps the browser or makes the lock verdict unknown; they now carry the @silent-fallback-ok annotation. Comments only, no logic change.