instar 1.3.1600 → 1.3.1602

package/upgrades/side-effects/mobile-native-chat-media-cross-machine.md

@@ -0,0 +1,131 @@
+# Side-Effects Review — media in app conversations, increment 1 (copies between machines)
+
+**Version / slug:** `mobile-native-chat-media-cross-machine`
+**Date:** `2026-11-02`
+**Author:** `echo`
+**Second-pass reviewer:** `independent review 2026-11-02: CONCERN, six findings, each fixed below (confirming pass not run; brief: --second-pass false)`
+
+## Summary of the change
+
+Builds the rest of increment 1 of `docs/specs/mobile-native-chat-media.md` (converged, approved), the cross-machine half that PR #2573 left out (its side-effects file, `mobile-native-chat-media-inc1.md`, listed it). New: `AppMediaReplicator` (`src/core/AppMediaReplicator.ts`) with the serve side of a new mesh verb `app-media-pull` (≤ 1 MiB slices of a blob an unpurged local event references, async positional reads through an `O_NOFOLLOW` + inode-checked descriptor, at most 2 served at once; the held-hash inventory, paged or as a diff against a version the asker holds; a nudge), the eager background pull (5 s tick, ≤ 8 slices per tick, disk-floor pause, bounded load pause, per-blob backoff 30 s → 1 h and a 7-day give-up, per-peer breaker 5 failures → 15 min, 3 opens/day → closed until tomorrow), hourly peer inventories, `singleCopyBlobs` and the §4.12 alarm ladder (re-queue on peers by nudge after an hour, then one notice; offline peer > 24 h; unmeasurable > 2 h), `unrecoverableBlobs` with its notice. `AppMediaStore` gains `pulls/`, three tables (`pulls`, `pull_peers`, `pending_deliveries`), `publishPulled` and `heldHashes`. `AppConversationService` builds the replicator, marks it dirty on replicated media/purge events, and implements the owner-side delivery (`sessionLinesFor`: pull for ≤ 60 s, else `[file still copying: <name>]` + a durable row; `resolvePending`: one `[file now available: <path>] (for the message "…")` line into the live session when the blob lands, de-duplicated by attachment; otherwise the line rides the next delivery's context and is removed once delivered; rows older than 7 days become a "could not be copied" line). The download route answers `202 {state: "fetching", retryAfterMs}` and starts a priority pull; `app-media-path` pulls for ≤ 30 s and says why when it cannot; `/health?scope=pool` adds `appMediaPool` through the existing pool read helper. `MeshRpc` gains the verb in the registered-peer read class; `server.ts` registers the handler and attaches the transport (the same `MeshRpcClient` + `peerUrl` every other verb uses, peers from the identity registry, online from the pool registry, load from the work-admission verdict). CLAUDE.md section line refreshed in place for existing agents; CapabilityIndex text; a self-action controller for the copier's notices and nudges. Tier 2.
+
+**What remains of the spec after this PR:** increments 2–5 (server-side transcription, Telegram/Slack continuation, push preview, the iOS app). See "Declared limits" for the one part of §4.12 whose trigger does not exist yet.
+
+## Decision-point inventory
+
+- Serve a slice — add — invariant: hash format, offset range, an unpurged local reference, a held blob opened `O_NOFOLLOW` with a matching inode, ≤ 2 concurrent serves.
+- Keep a pulled copy — add — invariant: slice offset/size equal the request and the reference; whole-file length and SHA-256 equal the reference; nothing else is ever kept.
+- Pause pulls — add — invariant: the existing disk floor (5% / 2 GiB); the existing work-admission load verdict on its two worst values, at most an hour at a time.
+- Give up on a blob / open a peer breaker — add — invariant: fixed backoff, 7-day give-up, 5-failure breaker, 3-opens-per-day latch.
+- Single-copy alarm — add — invariant: counts from inventories younger than 2 h; null (never 0) when unmeasurable; fixed 1 h / 24 h / 2 h thresholds.
+- Dispatch with "still copying" — add — invariant: fixed 60 s deadline; follow-up de-duplicated by attachment id.
+- Download `202 fetching` vs `404 media-unavailable` — modify — `404` only for an unrecoverable blob or a machine with no mesh transport; otherwise `202`.
+
+---
+
+## 1. Over-block
+
+- **A blob only one machine holds while that machine is offline** cannot be downloaded elsewhere: the app sees `202` until it gives up polling (60 s, its own rule), and after 7 days `404`. By design — the bytes are not reachable.
+- **Busy serve side:** a third concurrent slice request is answered `busy`; the asker retries next tick with no backoff penalty.
+- **Load pause:** background copying stops for up to an hour on a machine reporting `saturated`/`impaired`; on-demand pulls (download, app-media-path, dispatch) are not paused by load. Only the disk floor stops them.
+- **A peer whose copies fail verification** is skipped even for files only it holds (15 minutes, or the rest of the day after three opens). Files it holds stay on it; the single-copy and unrecoverable counts make this visible.
+
+## 2. Under-block
+
+- **Admission cap is still soft across machines** (unchanged, spec §4.7). Pulls are never stopped by the cap, only by the disk floor.
+- **A machine lost before its blobs were copied loses them** (spec §4.12 residual risk). Eager pull and the single-copy alarm shorten and expose the window; nothing makes it zero.
+- **Inventories are in memory.** After a restart `singleCopyBlobs` reads null until the next inventory round (at most an hour) — honest, not a fabricated 0 — and the alarm episode clocks restart.
+
+### Declared limits (no code change)
+
+- **"The owner pulls before dispatch" has no cross-machine trigger yet.** The parent spec (mobile-native-conversations.md §4.8) forwards a send accepted on a non-owner to the owner; that forward is not built (a non-owner still answers `503 owner-unavailable` after persisting — `AppConversationService` header). So today the dispatching machine is always the accepting machine, which already holds the blobs it just published. The pull-before-dispatch code (`sessionLinesFor`) is in place on the dispatch path and is exercised by the integration test directly on a machine that lacks the blob; it activates for real when the forward ships. It also covers the case where the dispatching machine's own blob went missing.
+- **The follow-up line is typed into a live session only.** It never spawns a session; with no live session it waits for the next delivery's context. A conversation that never receives another message never sees it (the file is still listed in history and opens with app-media-path).
+- **Nudges are best effort.** A nudge whose send fails is reported as a degradation, not retried in that episode; the notice an hour later is the backstop.
+
+## 3. Level-of-abstraction fit
+
+Byte copying sits in one class beside the media store and below the routes; it rides the existing signed MeshRpc transport (`MeshRpcClient`, the `/mesh/rpc` dispatcher, `peerUrl`) rather than a new channel, and its own verb rather than `working-set-pull` (whose serve side reads and hashes whole files synchronously, spec §3). Hashing runs in the existing media worker. The load signal is the existing work-admission verdict; the pool health read uses the existing `readReaperPoolPeers` helper with its rate limiter, roster accounting and bounded body. The pending "still copying" rows live in the media index beside upload state, so they are recovered with it.
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] No judgment-based block/allow surface: every refusal or pause is a fixed invariant (hash equality, sizes, offsets, references, counts, timers, the existing disk floor and load verdict). The verb adds reach, never authority: a peer can only cause this machine to fetch bytes an event it already holds refers to, and only bytes that hash to that reference are kept.
+
+## 4b. Judgment-point check (Judgment Within Floors standard)
+
+No new static heuristic at a competing-signals decision point; every decision above is an invariant declared in the spec's `## Decision points touched` table (pull give-up, breaker, disk-floor and load pauses, the 60 s dispatch deadline).
+
+---
+
+## 5. Interactions
+
+- **Purge and orphans:** a purged attachment is not `allRefs`, so it is never served, wanted or counted; a pull row and partial file for a hash that stops being wanted are removed on the next wanted refresh. The orphan sweep now also skips a hash named by a pending-delivery row. Pulled blobs referenced only by deleted conversations land in `deleted/`.
+- **Quarantine:** `publishPulled` uses the same `publish` path, so a verified pulled copy also retires a quarantined copy of that hash (renamed aside, never deleted), as a fresh upload does.
+- **Disk floor:** a part already complete when the floor is hit is kept (verified, not published) and published on a later tick without another request.
+- **Dispatch timing:** the send route now awaits `sessionLinesFor`; when the blob is local (always, today) there is no wait. When a pull is needed the phone's request can take up to 60 s before it answers.
+- **Concurrency:** the pull tick is single-flight; `want()` triggers a tick, which returns immediately if one is running. `resolvePending` claims a row (`waiting → ready`) before typing the line, so two landings never type twice.
+
+## 6. External surfaces
+
+- **Other machines of the agent:** a new mesh verb. An older peer answers `no-handler` (501); the puller treats it as a failed attempt for that blob (backoff), never a verification failure. An older peer asking this machine gets a normal answer.
+- **Phones:** `GET /mobile/media/:sha256` can now answer `202 {state: "fetching", retryAfterMs: 2000}`; `404 media-unavailable` now means unrecoverable or no mesh.
+- **Sessions:** new lines `[file still copying: <name>]`, `[app:…] [file now available: <path>] (for the message "…")`, and a "Files from earlier messages" block in the context file. app-media-path's failure line now names why.
+- **Operator:** up to three new attention items per machine (`app-media:single-copy:<machine>`, `app-media:unrecoverable:<machine>`, `app-media:peer-breaker:<peer>`), each raised once per episode and cleared when the condition ends.
+- **Persistent state:** `<stateDir>/app-media/pulls/`, three tables in `app-media/uploads/index.sqlite`.
+
+## 6b. Operator-surface quality
+
+No operator surface added (no dashboard or approval page) — not applicable.
+
+---
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+- Blobs: **unified by full replication** — this PR is that replication (every machine pulls every unpurged blob an event it holds references, verified).
+- `singleCopyBlobs`: **measured from peers' inventories** (pulled hourly over the mesh); null when any registered peer's inventory is missing or older than 2 hours.
+- Pull state, breakers, pending deliveries: **machine-local by design** — each describes what this machine holds and is copying; the pending rows belong to the machine whose session was told "still copying".
+- `/health` `appMedia`: **proxied on read** with `?scope=pool` (`appMediaPool`), unreachable machines in `failed`.
+- Notices: one per condition per machine; the condition keys carry the machine id, so two machines never raise the same item for each other.
+
+## 8. Rollback cost
+
+Revert the PR: the verb disappears (peers on this version see `no-handler` and back off), copying stops, files stay where they are; `pulls/` and the three tables are left unused. Or turn `mobilePairing.native.enabled` off (the media flag gates phone routes only; copying of already stored files continues while native conversations are on, so switching media off never strands a copy). Dark on the fleet.
+
+---
+
+## Conclusion
+
+The remaining increment-1 surface ships with every pull verified before storing and every loop braked (per-tick slice cap, backoff, give-up, breaker, latch, single-flight, serve concurrency cap). Found while building: a part file already complete (left by the disk floor) would have triggered a zero-length slice request and been counted as a verification failure; it is now verified and published without a request. The pull-before-dispatch path has no cross-machine trigger until the parent spec's owner forward ships (declared above). A second-pass review is normally required for dispatch changes; the build brief for this PR set `--second-pass false`, so none was run, and the reviewer of the PR should treat this as the first independent read.
+
+---
+
+## Fix after the first Local Verify
+
+The full Local Verify failed 9 integration tests in `tests/integration/health-stale-job-failures.test.ts` and `tests/integration/lease-medium-health.test.ts`. Cause: the `appMediaPool` branch read `req.query.scope` unguarded, and those tests (like any caller that drives `router.handle` without Express's query parser) send a request with no `query`, so every `/health` call threw `Cannot read properties of undefined (reading 'scope')`. Fixed with `req.query?.scope`; both files pass again, with the media tests and `health-auth-gating`. No test was changed.
+
+## Fixes after the independent review (CONCERN)
+
+1. **Purge during the hash** (medium, confirmed): `finishPart` awaited the worker hash and then published without re-checking the reference, so a purge landing mid-hash let purged bytes reach `blobs/` until the next sweep. Now the reference is re-checked after the hash (the partial copy, pull row and waiters are dropped), and `AppMediaStore.publishPulled` itself discards a file whose hash has no unpurged reference. Test: a purge applied while the last slice is in flight.
+2. **`202 fetching` only when a copy can start** (confirmed): the route now asks `canFetch` and answers `404 media-unavailable` with the reason when there is no mesh, the blob was given up on, the machine is below the disk floor, or no online peer with a closed breaker could hold it (a fresh inventory lacking the hash rules a peer out). `whyNotHere` names the disk floor and the background load pause. **Load is not a refusal for an on-demand copy**: spec §4.12 pauses the eager background pulls under load, and the download's pull is the on-demand latency path, which is not paused, so a `202` under load is true. Tests: unit `canFetch`, integration 404 with the reason.
+3. **Backoff reset on every poll or nudge** (confirmed): `want()` and the nudge set `nextAttemptAt = 0` each time, so an app polling every 2 s retried every 2 s. Now an ask or nudge skips a file's backoff at most once per backoff window (`hurry`); a nudge still re-arms a given-up file once (the peer names itself a holder, §4.12). Test: ten asks + ten nudges in a window → one extra attempt.
+4. **Timed-out waiters stayed in the list** (confirmed): removed on timeout. Test.
+5. **Blame for a failed hash** (confirmed): chose the simpler rule, *one peer per partial copy*. The peer that served offset 0 serves every later slice; if it stops serving (offline, breaker, refusal, no answer) the partial copy is discarded and restarts from another peer. A failed whole-file hash is then blamed on exactly that peer. The pin is in memory: after a restart a partial file with no known source restarts from 0 (cost: re-copying at most one partial file per blob). The serving side re-hashes a blob whose size or mtime changed since its last check before serving it, and quarantines a damaged one locally (`verifyBeforeServe`), so a damaged copy is not sent. Tests: restart-from-another-peer with blame on the bad peer only; serve-side quarantine.
+6. **Gate wording** (confirmed): the spec (Configuration) requires pulls to keep running with the media flag off, so the handler, tick and inventory stay on `mobilePairing.native.enabled`; the upgrade note was corrected to say so.
+
+## Second-pass review (if required)
+
+Not run (brief: `--second-pass false`).
+
+## Evidence pointers
+
+- `tests/unit/app-media-replicator.test.ts` (21 tests), `tests/unit/PostUpdateMigrator-appMedia.test.ts` (copy-line refresh), `src/testing/selfActionRegistry.ts` controller `app-media-replication`
+- `tests/integration/app-media-cross-machine.test.ts` (9 tests), `tests/e2e/app-media-cross-machine-alive.test.ts`
+
+---
+
+## Class-Closure Declaration (display-only mirror)
+
+- **`defectClass`** — `unbounded-self-action` (the copier nudges peers and raises notices on its own; it retries pulls on its own).
+- **`closure`** — `guard`.
+- **`guardEvidence`** — `{enforcementType: ratchet, citation: tests/unit/self-action-convergence.test.ts (controller app-media-replication, src/testing/selfActionRegistry.ts), howCaught: under a file held alone forever with every peer online, the copier nudges once per episode and raises the single-copy notice once (the raised latch keyed by condition and reason), so the action count is 2 at any horizon}`. Per-blob retries are bounded by the backoff and the 7-day give-up (`tests/unit/app-media-replicator.test.ts`, "backs off 30 s → 1 h, gives up after 7 days").

package/upgrades/side-effects/native-conversations-gaps.md

@@ -0,0 +1,129 @@
+# Side-Effects Review — native app conversations: lossless list, pool reads, Telegram token removal, approval method
+
+**Version / slug:** `native-conversations-gaps`
+**Date:** `2026-11-02`
+**Author:** `echo`
+**Second-pass reviewer:** `not run (declared --second-pass false by the brief)`
+
+## Summary of the change
+
+Closes four gaps an app builder found running the iPhone app against a real server with no Telegram, each measured against the converged spec `docs/specs/mobile-native-conversations.md`:
+
+1. `GET /mobile/conversations` used a cursor that tracked only app conversations while the first page also carried up to 200 Telegram topics and was then cut to 200, so app conversations could fall off page one and never come back. The list now has one total order (newest activity, ties by `app:<uuid>` / `telegram:<topicId>`, plain string compare — the same order the store's SQLite keyset uses) and one cursor `<activity>|<sortKey>` (the store's existing cursor shape, so old cursors still parse). Every page merges the store's page with the Telegram topics strictly after the cursor (`mergeConversationPages`, `src/server/mobileConversationRoutes.ts`).
+2. `?scope=pool` on the list and on `GET /mobile/chat/app/:key/messages` (spec §4.5, §4.8) now fans out to every peer's plain read with the agent's Bearer token (`poolPeerFetch`, `isPeerUrlAllowedForCredentials`, as `/telegram/topics/:id/messages?scope=pool` does), merges losslessly on the same cursor (list) or `(at, eventId)` boundary (browse), names dark machines in `pool.failed`, and never trusts a peer's verdict: a row only a peer holds reads `originVerified: "unknown"`. Wired in `AgentServer` with the route context.
+3. `POST /mobile/chat/:topicId` with native conversations on (spec §4.2, §4.9 and the rollout section: the native flag gates every change to this route) no longer refuses invites, desktop codes or credential-shaped text: tokens are removed by exact match (`removeAuthorityTokens`, the same function the app route uses), the redacted text is what is stored (with a signed redaction attestation), ingested and mirrored, and the answer carries `redacted`/`removed`; credential-shaped text is delivered as written with `credentialShaped: true`, and the 📱 mirror shows it as `[credential hidden]` (`hideCredentialSpans`, built on `scrubForStore`). With native off, the route refuses exactly as before.
+5. History rows (browse, sync, the device's Telegram history join) carry `originApprovedVia` (`telegram-dm` / `dashboard-pin`, from this machine's device-key ledger) when the verdict is `verified` or `redacted`, so the app can show "approved on dashboard" (§4.4, §4.6 display).
+
+Gap 4 (the "📱 signed" tag) was verified present for app conversations (`appInboundDispatch.ts` adds it only for `verified`); the spec defines no such tag for Telegram-topic sessions, so none was added there. Slack rows in the list are absent because the Slack-from-the-app routes (spec increment 4) are not built; listing rows the app cannot open would be worse than omitting them.
+
+Agent awareness: one new bullet in the Native app conversations section (pool reads, the single list cursor, `originApprovedVia`), and the Mobile operator chat content bullet rewritten; both reach existing agents through `migrateClaudeMd` (content-sniffed, idempotent).
+
+Size: Tier 2 (spec-driven), 6 source files, about 300 lines plus tests. One review pass; commit attempts recorded in the PR.
+
+## Decision-point inventory
+
+- Telegram send preflight (`POST /mobile/chat/:topicId`) — modify — with native on, the three content refusals become exact-token removal plus a credential signal, as spec §4.2 already does for app conversations. Native off: pass-through (unchanged).
+- Pool read merge — add — invariant: which rows a pool read returns is a deterministic merge; a peer's verdict is never adopted.
+- `originApprovedVia` — add — display data read from the ledger; decides nothing.
+
+---
+
+## 1. Over-block
+
+The Telegram route now blocks less (native on): nothing is refused for its content. The list and browse reads refuse a `scope` value other than `pool` with 400 `invalid-scope` (as the Telegram history route already does); no existing client sends another value.
+
+---
+
+## 2. Under-block
+
+A credential typed into the app is now delivered to the session and kept in the Telegram history row as written (native on). That is the spec's explicit choice (§4.2: credential-shaped text is the operator's call, the app asks first; the server only signals). The mirror copy for people reading the topic hides it. An app build that skips its local check would let a credential through without asking; the server's `credentialShaped: true` and audit signal remain.
+
+---
+
+## 3. Level-of-abstraction fit
+
+Token removal reuses the one function the app route uses, so both routes treat the same text the same way. The pool fan-out reuses `poolPeerFetch` and the peer URL credential guard rather than adding a transport. The list order reuses the store's own keyset order rather than a second sort definition.
+
+---
+
+## 4. Signal vs authority compliance
+
+- [x] No — this change produces a signal consumed by an existing smart gate.
+
+It removes blocking authority from a brittle detector (`detectOutboundCredential` used to refuse the message) and keeps it as a signal (`credentialShaped`), which the spec names as a judgment-candidate whose floor is "never refuses or alters". The only remaining alteration is exact-format token removal, which is structure, not judgment (spec Decision points table).
+
+## 4b. Judgment-point check
+
+No new static heuristic at a competing-signals decision point. The list order and the pool merge are invariants (total order, de-duplication by key).
+
+---
+
+## 5. Interactions
+
+- **Shadowing:** the inbound core (`/internal/telegram-forward` handler, `trust` path) still refuses invite/desktop text with 422 `not-from-the-app`; after removal the text no longer carries either (the core's checks use the same `tlinv1:` regex and a leading `/desktop`, which the line-based removal covers), so the core's refusal stays as a backstop and is not reached for removed text. Tested end to end.
+- **Double-fire:** none; the mirror is still best-effort after delivery.
+- **Races:** pool reads are read-only. The list's duplicate collapse picks the newest copy; a lagging machine's older copy of the same conversation can reappear on a later page (the app already de-duplicates rows by id).
+- **Feedback loops:** a peer's pool read is its plain read (no `scope`), so fan-out never recurses.
+
+---
+
+## 6. External surfaces
+
+- Response shapes gain fields (`pool`, `machine`, `originApprovedVia`, `redacted`, `removed`, `credentialShaped` on the Telegram send); nothing is removed. The list's `nextCursor` is non-null in more cases (now correct).
+- Telegram: the 📱 mirror text changes only when a credential span is present (hidden) or a token was removed.
+- Persistent state: the Telegram send stores the redacted text plus a redaction attestation instead of the original body when a token was removed (the same record shape app conversations use; verified `redacted`).
+- Operator surface: no new operator action.
+
+## 6b. Operator-surface quality
+
+No operator surface (no dashboard or approval page touched) — not applicable.
+
+---
+
+## 7. Multi-machine posture
+
+**proxied-on-read** for the list and browse: `?scope=pool` merges every answering machine's plain read, with `pool.failed` for dark ones; the store itself already replicates (`appConversations` kind). A peer-only row's verdict reads `unknown` because only this machine's ledger is trusted (§4.8). `originApprovedVia` comes from this machine's replicated device-key ledger. No user-facing notices, no new durable state, no URLs.
+
+---
+
+## 8. Rollback cost
+
+Pure code change: revert and ship a patch. The CLAUDE.md lines added by the migration would remain on updated agents (accurate only while this code ships; a revert would need the old lines restored by a later migration). Turning `mobilePairing.native.enabled` off restores the Telegram route's refusals immediately.
+
+---
+
+## Conclusion
+
+The four gaps are closed against the spec with tests at unit and integration level; gap 4 needed no change. The one judgment worth a reader's attention is that credential-shaped text through the Telegram route is now delivered (native on), which is what the spec specifies and what app conversations already do.
+
+---
+
+## Second-pass review (if required)
+
+Not run: the brief for this change declared `--second-pass false`.
+
+---
+
+## Evidence pointers
+
+- `tests/unit/mobileConversationListPaging.test.ts` — order, cursor, lossless multi-source paging, duplicate collapse, mirror hiding.
+- `tests/integration/mobile-native-conversations-gaps.test.ts` — 250 Telegram topics + 5 app conversations paged to completion; interleaved paging; pool list and browse with a live peer and a dark peer; Telegram token removal (`redacted`, token absent from disk), credential signal and hidden mirror, native-off refusals unchanged; `originApprovedVia` for Telegram- and dashboard-approved phones and absent on a failed record.
+- `tests/unit/PostUpdateMigrator-appConversationsGaps.test.ts` — awareness lines for new and existing agents, idempotent.
+
+---
+
+## Review follow-ups (independent review: CONCERN, all five addressed)
+
+1. **Mirror leak through invisible characters.** `hideCredentialSpans` scrubbed the raw text only, while `detectOutboundCredential` also reads it with invisible characters removed, so a key split by a zero-width space was flagged but shown in the 📱 copy. Now the scrubbed copy is re-checked with the same wall; if the wall still sees a credential the whole copy is hidden as `[credential hidden]`. Tested for nine invisible characters (U+200B/C/D, U+2060, U+FEFF, U+00AD, U+034F, U+FE0F, U+202E) and end to end through the Telegram route.
+2. **Desktop codes on a later line.** `DESKTOP_LINE_RE` allowed only space or tab before and after `/desktop`, so `/desktop\u00A0abc 123456` (and other non-ASCII whitespace) on a later line reached the session. Leading space and separator are now `[^\S\n]`, the core check's whitespace class minus newline. This function is shared with the app-conversation send route, so it removes more there too (only exact `/desktop` lines; `/desktops` and mid-line mentions are untouched, tested).
+3. **Peer attachments.** Peer-only browse rows no longer carry the peer's attachment rows at all (their files live on that machine, which this machine cannot serve, and their fields were unchecked); the row says `filesOnOtherMachine: <count>`. `deliveryState` from a peer is restricted to the known values, else `unknown`.
+4. **Peer times.** A peer's `lastActivity` (list) and `at` (browse) must be a strict ISO-8601 instant and are normalised with `toISOString()`; anything else drops the row, so a value like `"0"` can no longer become the cursor that ends paging early. A note: a peer row is sliced to `limit` before validation, so a peer returning invalid rows wastes its own slots, never another source's.
+5. **Pool browse of a conversation not replicated here yet.** Spec 4.8 says the live pool read covers events not yet replicated, so `?scope=pool` now reads a conversation this machine has never seen from the peers (all rows `originVerified: "unknown"`). A conversation this machine knows is deleted stays 404; if no peer has it, 404; if a machine did not answer, 200 with `pool.failed`. Only a valid app conversation key is forwarded, and it is URL-encoded.
+
+---
+
+## Class-Closure Declaration (display-only mirror)
+
+- **Defect class:** `unbounded-self-action`
+- **Closure:** `n/a` (negative declaration)
+- **Reason:** one-shot user-driven action, not a self-triggered loop. The Telegram send route runs once per device request (rate-limited and idempotent through MobileChatRequestStore); this change only replaces its content refusals with token removal, and the pool reads are request-driven, read-only fan-outs.

package/upgrades/side-effects/window-run-liveness-later-loss.md

@@ -0,0 +1,81 @@
+# Side-Effects Review — Later liveness loss after recovered autonomous run
+
+**Version / slug:** `window-run-liveness-later-loss`  
+**Date:** 2026-11-02  
+**Author:** Echo  
+**Second-pass reviewer:** `/root/outage_fallback_review` — concurred after equality-boundary correction
+
+## Summary of the change
+
+Tier 1 narrow, reversible incident fix. One authority branch in `src/core/WindowRunLivenessAuthority.ts` now bounds a later at-risk episode from its own transition after a previously completed recovery; it preserves the original deadline while the first episode is still unresolved and never actuates recovery twice. Unit, authenticated HTTP, and production-boot lifecycle tests cover the boundary. This is a 4-code-file change at draft time, with one review round and no commit attempt yet.
+
+## Decision-point inventory
+
+- `WindowRunLivenessAuthority.evaluateAndMaybeRecover()` — modified — chooses the deadline for an at-risk run with an existing recovery attempt.
+- Recovery actuation, predicate sampling, active promotion, and terminal projection — passed through — unchanged.
+
+## 1. Over-block
+
+A later loss still fails if any predicate remains red for 15 minutes from its new at-risk transition. A transient later loss does not fail immediately only because the old deadline expired. The original unresolved loss still fails on its original ceiling. No additional legitimate input is rejected.
+
+## 2. Under-block
+
+Repeated short outages could re-enter active between episodes without another refresh. This is already possible whenever all five predicates become green; the change allows observation to distinguish distinct episodes, while the one recovery attempt remains spent. There is no new path to active with a red predicate. A later loss with no usable `atRiskSince` or a non-finite deadline fails closed.
+
+## 3. Level-of-abstraction fit
+
+The authority owns its recovery attempt, at-risk transition, and terminal deadline, so it is the right layer. The change uses those persisted fields and adds no competing monitor.
+
+## 4. Signal vs authority compliance
+
+Required reference: [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md).
+
+- [x] No — this change maintains an existing server-owned authority's deterministic timing invariant, with all five independent predicate inputs still required for active.
+
+The exact ordering of one completed attempt and a later transition is recorded by the authority. The new arithmetic cannot fabricate a green predicate or recovery receipt.
+
+## 4b. Judgment-point check
+
+No new static heuristic at a competing-signals decision point. The 15-minute ceiling is the configured existing invariant; this change selects the correct episode start for that invariant.
+
+## 5. Interactions
+
+- **Shadowing:** active promotion still requires all predicates green before the deadline branch.
+- **Double-fire:** the persisted `recoveryAttempt` continues to suppress a second recovery call.
+- **Races:** the authority's existing mutation lock serializes tick and state transitions; `atRiskSince` is written before this branch.
+- **Feedback loops:** a later recovered episode returns to active, clearing `atRiskSince`; a new red sample starts a new bounded interval.
+
+## 6. External surfaces
+
+Users may no longer receive a false terminal failure for a later brief outage; after 15 minutes of continuing failure, the same terminal notice is sent. The durable record shape and HTTP schema are unchanged. No new operator action, URL, credential, or message source is introduced.
+
+## 6b. Operator-surface quality
+
+No operator surface — not applicable.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+**Machine-local by design:** the liveness authority is bound to the run's current executor and uses that executor's transcript heartbeat plus its server-owned window state. The existing ownership/binding path determines which machine samples and projects the result. This change emits the existing failure notice at the later episode's real deadline, holds the same durable state, and generates no URLs. Topic transfer requires the existing rebind proof; this change does not add a new transfer path.
+
+## 8. Rollback cost
+
+Revert the branch and ship a patch. No schema migration or state cleanup is needed. During rollback propagation, a recovered run could again fail immediately on a later brief loss.
+
+## Conclusion
+
+The incident sequence is reproducible from the production authority record: first recovery returned active, then a later red sample was compared with the old ceiling. The patch preserves one recovery actuation and bounds each distinct at-risk interval. Unit tests and TypeScript pass; authenticated HTTP and production-boot tests are queued behind the host suite lane. Do not ship until those tests and the full required gates pass.
+
+## Second-pass review (if required)
+
+**Reviewer:** `/root/outage_fallback_review`  
+**Independent read of the artifact:** concur. The reviewer found the same-millisecond boundary in the first pass; I changed `>` to `>=` and added a test where recovery takes 14 minutes and the later loss is sampled in the completion millisecond. The second pass found no further blocker, subject to pending HTTP/E2E and full gates.
+
+## Evidence pointers
+
+- `.instar/autonomous/130742-evidence.md` — two live terminal incidents and the third run's admission receipt.
+- `tests/unit/window-run-liveness-authority.test.ts` — focused unit receipt, 56 tests passed.
+- `tests/integration/window-run-liveness-routes.test.ts` and `tests/e2e/window-run-liveness-production-wiring.test.ts` — added, queued.
+
+## Class-Closure Declaration (display-only mirror)
+
+No new self-action emit is introduced: the existing recovery attempt remains spent and the changed branch only chooses the at-risk deadline. The targeted unit and production-boot cases are the regression ratchet for the expired-prior-deadline defect. The `unbounded-self-action` class is not newly implicated by this diff; no agent-authored artifact is being corrected.

package/upgrades/1.3.1600.md

@@ -1,34 +0,0 @@
-# Upgrade Guide — vNEXT
-
-<!-- assembled-by: assemble-next-md -->
-<!-- bump: patch -->
-
-## What Changed
-
-New dev-gated server service (`docs/specs/ecosystem-idea-pipeline.md`). Each week it reviews a
-watchlist of similar projects: trusted code fetches and reads, and AI services return closed-schema
-judgments. Each idea is checked against our source and specs by two blind reads, reviewed against the
-Instar 2.0 purpose, classed by what it would change, and ranked into bands. The default outcome is no
-change. A framework reads outside text only after two must-fail file-read probes through the same call
-path real reviews use; to pass them, `IntelligenceOptions.noLocalTools` and
-`reviewerHardening.noTools` ask Codex and Claude for calls with no local tools. The default path of every
-other caller is unchanged. `scripts/lint-ecosystem-adoption.mjs` joins the lint chain: it fails a default
-change for a tagged spec unless `docs/proofs/<idea>.json` passes, and no spec is tagged yet.
-
-## What to Tell Your User
-
-If you develop your own project, I can check similar projects each week and show you ranked ideas, each
-checked against your code. It only gives advice: it changes nothing and contacts nobody. It is off unless
-you ask for it.
-
-## Summary of New Capabilities
-
-- `GET /ecosystem-ideas`, `GET /ecosystem-ideas/:id/evidence`, and PIN-gated decisions through `POST /ecosystem-ideas/plan` and `/commit`.
-- The console's Work group gains an Ideas page.
-
-## Evidence
-
-Live on this machine on 2026-11-01: without the no-tools form the capability probe refused Codex (it read
-the planted file), and Claude's call stopped when it tried a tool. With the form, both frameworks passed
-both probes. Tests: fixture runs on a real clone hold a hostile CLAUDE.md and a marker-writing script;
-the planted idea is found, no marker is written, and the same run with file reads disabled finds nothing.