instar 1.3.1637 → 1.3.1639

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.1637",
+  "version": "1.3.1639",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",
@@ -30,7 +30,7 @@
     "test:contract": "node scripts/run-contract-tests.js",
     "test:contract:raw": "vitest run --config vitest.contract.config.ts",
     "test:all": "vitest run && vitest run --config vitest.integration.config.ts && vitest run --config vitest.e2e.config.ts",
-    "lint": "node node_modules/typescript-native/bin/tsc --noEmit && node scripts/lint-no-direct-destructive.js && node scripts/lint-no-direct-llm-http.js && node scripts/lint-no-direct-url-log.js && node scripts/lint-no-unfunneled-topic-creation.js && node scripts/lint-no-unfunneled-headless-launch.js && node scripts/lint-no-unfunneled-tmux-literal-send.js && node scripts/lint-no-undefined-erasing-default-merge.js && node scripts/lint-no-unbounded-llm-spawn.js && node scripts/lint-no-unregistered-self-action.js && node scripts/lint-no-unfunneled-credential-write.js && node scripts/lint-state-registry.js && node scripts/lint-store-retention-declared.js && node scripts/lint-no-wholefile-sync-read.js && node scripts/lint-cas-emit-placement.js && node scripts/lint-journal-actuation-ban.js && node scripts/lint-no-blocking-process-scans.js && node scripts/lint-sync-subprocess-chokepoint.js && node scripts/lint-dev-agent-dark-gate.js && node scripts/lint-guard-manifest.js && node scripts/lint-llm-attribution.js && node scripts/lint-no-mainthread-cartographer-walk.js && node scripts/lint-scrape-fixture-realness.js && node scripts/check-codex-rule1-drift.js && node scripts/lint-routing-registry-freshness.js && node scripts/lint-no-opus-claude-cli-gating.js && node scripts/lint-model-registry-freshness.mjs && node scripts/lint-no-unreachable-messaging-gate.js && node scripts/lint-telegram-egress-boundary.mjs && node scripts/lint-nature-chains.mjs && node scripts/lint-emit-without-admit.js && node scripts/lint-migration-consumer-completeness.js && node scripts/lint-canonical-pipeline-completeness.mjs && node scripts/lint-expected-capacity-degradations.js && node scripts/lint-rollout-evidence-resolvable.js && node scripts/lint-no-direct-standards-registry-path.mjs && node scripts/lint-blocking-decisions-declared.mjs && node scripts/lint-no-duplicate-definitions.mjs && node scripts/lint-dispatch-withholds-answer.mjs && node scripts/lint-recall-surface-names-match-mechanism.mjs && node scripts/lint-registry-insertion-placement.mjs && node scripts/lint-standard-code-backreference.mjs && node scripts/lint-bounded-judgment-input.mjs && node scripts/lint-registry-tree-parentage.mjs && node scripts/lint-single-governing-obligation.mjs && node scripts/lint-documented-only-countdown.mjs && node scripts/lint-deferral-carrier-resolvable.mjs --staged --enforce && node scripts/generate-standards-hierarchy.mjs --check && node scripts/lint-framework-list-completeness.mjs && node scripts/lint-ecosystem-adoption.mjs",
+    "lint": "node node_modules/typescript-native/bin/tsc --noEmit && node scripts/lint-no-direct-destructive.js && node scripts/lint-no-direct-llm-http.js && node scripts/lint-no-direct-url-log.js && node scripts/lint-no-unfunneled-topic-creation.js && node scripts/lint-no-unfunneled-headless-launch.js && node scripts/lint-no-unfunneled-tmux-literal-send.js && node scripts/lint-no-undefined-erasing-default-merge.js && node scripts/lint-no-unbounded-llm-spawn.js && node scripts/lint-no-unregistered-self-action.js && node scripts/lint-no-unfunneled-credential-write.js && node scripts/lint-state-registry.js && node scripts/lint-store-retention-declared.js && node scripts/lint-no-wholefile-sync-read.js && node scripts/lint-cas-emit-placement.js && node scripts/lint-journal-actuation-ban.js && node scripts/lint-no-blocking-process-scans.js && node scripts/lint-sync-subprocess-chokepoint.js && node scripts/lint-dev-agent-dark-gate.js && node scripts/lint-guard-manifest.js && node scripts/lint-llm-attribution.js && node scripts/lint-no-mainthread-cartographer-walk.js && node scripts/lint-scrape-fixture-realness.js && node scripts/check-codex-rule1-drift.js && node scripts/lint-routing-registry-freshness.js && node scripts/lint-no-opus-claude-cli-gating.js && node scripts/lint-model-registry-freshness.mjs && node scripts/lint-no-unreachable-messaging-gate.js && node scripts/lint-telegram-egress-boundary.mjs && node scripts/lint-nature-chains.mjs && node scripts/lint-emit-without-admit.js && node scripts/lint-migration-consumer-completeness.js && node scripts/lint-canonical-pipeline-completeness.mjs && node scripts/lint-expected-capacity-degradations.js && node scripts/lint-rollout-evidence-resolvable.js && node scripts/lint-no-direct-standards-registry-path.mjs && node scripts/lint-blocking-decisions-declared.mjs && node scripts/lint-no-duplicate-definitions.mjs && node scripts/lint-dispatch-withholds-answer.mjs && node scripts/lint-recall-surface-names-match-mechanism.mjs && node scripts/lint-registry-insertion-placement.mjs && node scripts/lint-standard-code-backreference.mjs && node scripts/lint-bounded-judgment-input.mjs && node scripts/lint-registry-tree-parentage.mjs && node scripts/lint-single-governing-obligation.mjs && node scripts/lint-documented-only-countdown.mjs && node scripts/lint-deferral-carrier-resolvable.mjs --staged --enforce && node scripts/generate-standards-hierarchy.mjs --check && node scripts/lint-framework-list-completeness.mjs && node scripts/lint-ecosystem-adoption.mjs && node scripts/lint-plain-user-notices.mjs",
     "lint:parallel": "node scripts/run-lint-parallel.mjs",
     "lint:canonical-pipeline-completeness": "node scripts/lint-canonical-pipeline-completeness.mjs",
     "test:canonical-pipeline-runtime": "vitest run --config vitest.e2e.config.ts tests/e2e/feedback-factory-drain-lifecycle.test.ts && vitest run tests/unit/canonical-pipeline-completeness-lint.test.ts tests/unit/canonical-pipeline-runtime-evidence.test.ts",
@@ -66,7 +66,8 @@
     "postinstall": "node scripts/fix-better-sqlite3.cjs",
     "prepare": "husky",
     "lint:standards-registry-path": "node scripts/lint-no-direct-standards-registry-path.mjs",
-    "lint:framework-list": "node scripts/lint-framework-list-completeness.mjs"
+    "lint:framework-list": "node scripts/lint-framework-list-completeness.mjs",
+    "lint:plain-user-notices": "node scripts/lint-plain-user-notices.mjs"
   },
   "keywords": [
     "instar",

package/scripts/lint-plain-user-notices.mjs

@@ -0,0 +1,191 @@
+#!/usr/bin/env node
+/**
+ * lint-plain-user-notices.mjs — Plain and Complete (docs/UX-AND-AGENT-AGENCY-STANDARD.md Rule 8).
+ *
+ * Notices the server writes itself (telegram.sendToTopic, slack sendToChannel,
+ * sendDeterministicTelegramNotice, …) go out on deterministic paths that skip
+ * the LLM tone gate on purpose: an alarm must arrive even when the model is
+ * down. That is why their wording has to be held at BUILD time instead. This
+ * lint finds the send call sites in src/ and flags, inside the text argument:
+ *
+ *   RAW_REASON     — an internal value pasted into user text: `${detail}`,
+ *                    `${reason}`, `${err.message}`, `${String(err)}` …
+ *                    (the 2026-11-03 "drain bound (30000ms) reached" notice).
+ *   INTERNAL_TERM  — a word from src/data/plain-notice-terms.json in a string
+ *                    literal of the text argument ("respawned", "final turn" …).
+ *
+ * Ratchet: a frozen per-file baseline (scripts/plain-user-notices-baseline.json)
+ * grandfathers today's hits; a file whose count GROWS fails. Shrinking a count
+ * is reported so the baseline can be lowered (--update rewrites it).
+ * A deliberate exception carries `@plain-notice-ok: <why>` on the call line or
+ * the line above (e.g. a reply that echoes an id the person asked for).
+ *
+ * COVERAGE HONESTY: static and approximate. A notice whose text is built in a
+ * variable away from the send call is not seen here; those belong in the
+ * catalog (src/messaging/userNotices.ts), whose test runs the full check on
+ * rendered text. Exit codes: 0 pass · 1 new violation · 2 cannot-read.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+function argVal(flag) {
+  const i = process.argv.indexOf(flag);
+  return i >= 0 ? process.argv[i + 1] : undefined;
+}
+const ROOT = path.resolve(argVal('--root') ?? path.join(__dirname, '..'));
+const BASELINE = path.resolve(argVal('--baseline') ?? path.join(ROOT, 'scripts', 'plain-user-notices-baseline.json'));
+const TERMS_PATH = path.join(ROOT, 'src', 'data', 'plain-notice-terms.json');
+const UPDATE = process.argv.includes('--update');
+
+const SEND_CALL_RE = /\b(?:sendToTopic|sendToChannel|sendDeterministicTelegramNotice|sendToLifeline|postToChannel)\s*\(/g;
+const WAIVER = '@plain-notice-ok';
+// A bare internal value (identifier / member chain, no call) named like a reason.
+const RAW_EXPR_RE = /^[\w$?.!]*\b(?:detail|details|reason|err|error|cause|stderr|stdout)\b[\w$?.!]*$/;
+// Any expression that reads an error's message or stringifies an error, in any form:
+// `err.message`, `(err as Error).message`, `err instanceof Error ? err.message : String(err)`.
+const RAW_CALL_RE = /(?:\b(?:e|err|error)\b\)?\??\.message\b|\bString\(\s*(?:e|err|error)\s*\)|^JSON\.stringify\()/i;
+
+function readTerms() {
+  const raw = JSON.parse(fs.readFileSync(TERMS_PATH, 'utf-8'));
+  return raw.internalTerms.map((t) => ({
+    term: t,
+    re: new RegExp(`(^|[^A-Za-z0-9_-])${t.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![A-Za-z0-9_-])`,
+      t === t.toUpperCase() && t.length <= 4 ? '' : 'i'),
+  }));
+}
+
+/** From the char after "(", return the index of the matching ")" (strings/templates aware). */
+function argSpanEnd(src, start) {
+  let depth = 1;
+  const stack = []; // template-literal nesting
+  for (let i = start; i < src.length; i++) {
+    const c = src[i];
+    if (c === '"' || c === "'") {
+      for (i++; i < src.length && src[i] !== c; i++) if (src[i] === '\\') i++;
+      continue;
+    }
+    if (c === '`') {
+      // walk the template; recurse on ${ … }
+      for (i++; i < src.length && src[i] !== '`'; i++) {
+        if (src[i] === '\\') { i++; continue; }
+        if (src[i] === '$' && src[i + 1] === '{') {
+          let d = 1; i += 2;
+          for (; i < src.length && d > 0; i++) {
+            if (src[i] === '{') d++;
+            else if (src[i] === '}') d--;
+            else if (src[i] === '`') { for (i++; i < src.length && src[i] !== '`'; i++) if (src[i] === '\\') i++; }
+          }
+          i--;
+        }
+      }
+      continue;
+    }
+    if (c === '/' && src[i + 1] === '/') { while (i < src.length && src[i] !== '\n') i++; continue; }
+    if (c === '/' && src[i + 1] === '*') { i = src.indexOf('*/', i + 2); if (i < 0) return src.length; i++; continue; }
+    if (c === '(') depth++;
+    else if (c === ')') { depth--; if (depth === 0) return i; }
+  }
+  void stack;
+  return src.length;
+}
+
+/** Template interpolation expressions + plain string literal bodies inside a span. */
+function scanSpan(span) {
+  const exprs = [];
+  const literals = [];
+  const tpl = /`((?:\\.|[^`\\])*)`/gs;
+  for (const m of span.matchAll(tpl)) {
+    const body = m[1];
+    let lit = '';
+    for (let i = 0; i < body.length; i++) {
+      if (body[i] === '$' && body[i + 1] === '{') {
+        let d = 1; let j = i + 2;
+        for (; j < body.length && d > 0; j++) { if (body[j] === '{') d++; else if (body[j] === '}') d--; }
+        exprs.push(body.slice(i + 2, j - 1).trim());
+        lit += ' ';
+        i = j - 1;
+      } else lit += body[i];
+    }
+    literals.push(lit);
+  }
+  for (const m of span.matchAll(/'((?:\\.|[^'\\])*)'|"((?:\\.|[^"\\])*)"/g)) literals.push(m[1] ?? m[2] ?? '');
+  return { exprs, literals };
+}
+
+function walk(dir, out = []) {
+  for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+    const p = path.join(dir, e.name);
+    if (e.isDirectory()) { if (e.name !== 'node_modules') walk(p, out); }
+    else if (/\.(ts|js|mjs)$/.test(e.name) && !/\.d\.ts$/.test(e.name)) out.push(p);
+  }
+  return out;
+}
+
+export function lintSource(src, terms) {
+  const hits = [];
+  for (const m of src.matchAll(SEND_CALL_RE)) {
+    const open = m.index + m[0].length;
+    const end = argSpanEnd(src, open);
+    const span = src.slice(open, end);
+    const line = src.slice(0, m.index).split('\n').length;
+    const lines = src.split('\n');
+    const context = `${lines[line - 2] ?? ''}\n${lines[line - 1] ?? ''}`;
+    if (context.includes(WAIVER) || span.includes(WAIVER)) continue;
+    const { exprs, literals } = scanSpan(span);
+    for (const x of exprs) {
+      if (RAW_EXPR_RE.test(x) || RAW_CALL_RE.test(x)) hits.push({ line, code: 'RAW_REASON', match: `\${${x}}` });
+    }
+    for (const lit of literals) {
+      for (const { term, re } of terms) if (re.test(lit)) hits.push({ line, code: 'INTERNAL_TERM', match: term });
+    }
+  }
+  return hits;
+}
+
+function main() {
+  let terms;
+  try { terms = readTerms(); } catch (e) { console.error(`lint-plain-user-notices: cannot read ${TERMS_PATH}: ${e.message}`); process.exit(2); }
+  const files = walk(path.join(ROOT, 'src'));
+  const counts = {};
+  const detail = {};
+  for (const f of files) {
+    const rel = path.relative(ROOT, f).split(path.sep).join('/');
+    const hits = lintSource(fs.readFileSync(f, 'utf-8'), terms);
+    if (hits.length) { counts[rel] = hits.length; detail[rel] = hits; }
+  }
+  if (UPDATE) {
+    fs.writeFileSync(BASELINE, JSON.stringify(Object.fromEntries(Object.entries(counts).sort()), null, 2) + '\n');
+    console.log(`lint-plain-user-notices: baseline written (${Object.keys(counts).length} files).`);
+    return;
+  }
+  let baseline = {};
+  try { baseline = JSON.parse(fs.readFileSync(BASELINE, 'utf-8')); } catch { /* no baseline = zero allowance */ }
+  const failures = [];
+  const lowered = [];
+  for (const [rel, n] of Object.entries(counts)) {
+    const allowed = baseline[rel] ?? 0;
+    if (n > allowed) failures.push({ rel, n, allowed });
+    else if (n < allowed) lowered.push({ rel, n, allowed });
+  }
+  for (const [rel, allowed] of Object.entries(baseline)) if (!(rel in counts) && allowed > 0) lowered.push({ rel, n: 0, allowed });
+  if (lowered.length) {
+    console.log(`lint-plain-user-notices: ${lowered.length} file(s) improved — lower the baseline with --update:`);
+    for (const l of lowered) console.log(`  ${l.rel}: ${l.allowed} → ${l.n}`);
+  }
+  if (failures.length) {
+    console.error('lint-plain-user-notices: new jargon or raw internal detail in a notice sent to the user.');
+    console.error('Standard: docs/UX-AND-AGENT-AGENCY-STANDARD.md Rule 8 (Plain and Complete).');
+    for (const f of failures) {
+      console.error(`\n  ${f.rel}: ${f.n} hit(s), baseline allows ${f.allowed}`);
+      for (const h of detail[f.rel]) console.error(`    line ${h.line}: ${h.code} ${h.match}`);
+    }
+    console.error(`\nFix: say what happened, what it means and what to do, in plain words; keep reasons/ids in logs.`);
+    console.error(`Fixed wording belongs in src/messaging/userNotices.ts (tested). Deliberate exception: "// ${WAIVER}: <why>".`);
+    process.exit(1);
+  }
+  console.log(`lint-plain-user-notices: ok (${files.length} files scanned).`);
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) main();

package/scripts/plain-user-notices-baseline.json

@@ -0,0 +1,6 @@
+{
+  "src/commands/server.ts": 3,
+  "src/lifeline/TelegramLifeline.ts": 1,
+  "src/messaging/TelegramAdapter.ts": 6,
+  "src/messaging/slack/SlackAdapter.ts": 2
+}

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-11-04T00:03:27.412Z",
-  "instarVersion": "1.3.1637",
+  "generatedAt": "2026-11-04T00:37:44.365Z",
+  "instarVersion": "1.3.1639",
   "entryCount": 206,
   "entries": {
     "hook:session-start": {
@@ -1563,7 +1563,7 @@
       "type": "subsystem",
       "domain": "server",
       "sourcePath": "src/server/AgentServer.ts",
-      "contentHash": "bd218bfe17b10c50a145a97ee947592811042e156a5bbbda9484c3918b8dcf1a",
+      "contentHash": "fd8b7c323d5ab1bfcff04c0e32ae0aee9385cda315c174874d1e36d9dabbcd28",
       "since": "2025-01-01"
     },
     "subsystem:session-manager": {

package/src/data/plain-notice-terms.json

@@ -0,0 +1,38 @@
+{
+  "_comment": "Shared by src/messaging/plainNoticeCheck.ts (test-time check of catalogued notices) and scripts/lint-plain-user-notices.mjs (build-time check of send sites). Standard: docs/UX-AND-AGENT-AGENCY-STANDARD.md Rule 8. Internal words the person cannot act on. Matched case-insensitively on word boundaries.",
+  "internalTerms": [
+    "drain bound",
+    "drained",
+    "final turn",
+    "respawn",
+    "respawned",
+    "respawning",
+    "epoch",
+    "CAS",
+    "tmux",
+    "reap-log",
+    "reaper",
+    "payload",
+    "stderr",
+    "stdout",
+    "exit code",
+    "pid",
+    "subprocess",
+    "launchd",
+    "systemd",
+    "pinned profile",
+    "boot sweep",
+    "undefined",
+    "NaN",
+    "null"
+  ],
+  "codePatterns": [
+    { "code": "DURATION_IN_MS", "re": "\\b\\d+\\s?ms\\b", "why": "a millisecond count is a setting, not news; say the time in words if it matters" },
+    { "code": "SNAKE_CASE", "re": "\\b[a-z]+_[a-z0-9_]+\\b", "why": "a snake_case name is a code identifier" },
+    { "code": "CAMEL_CASE", "re": "\\b[a-z]+[A-Z][A-Za-z0-9]*\\b", "why": "a camelCase name is a code identifier" },
+    { "code": "REASON_CODE", "re": "\\(reason: [a-z0-9-]+\\)", "why": "a raw reason code; translate it into what happened" },
+    { "code": "BRACKET_COUNTER", "re": "\\[#\\d+\\]", "why": "an audit counter means nothing to the person" },
+    { "code": "ERRNO", "re": "\\b(ENOENT|ECONNREFUSED|ECONNRESET|ETIMEDOUT|EPIPE|EACCES|EPERM|EADDRINUSE)\\b", "why": "an operating-system error code" }
+  ],
+  "camelCaseAllow": ["iPhone", "iPad", "iMessage", "macOS", "iOS", "iCloud", "eBay", "gMail", "youTube"]
+}

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "db01d9f92c6aa26ca903702896b41be53722982ed07d27633237bb254c214290",
-  "packageVersion": "1.3.1637",
+  "packageVersion": "1.3.1639",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "30133cdb772869d1fd25e4cff1174c742044ea3297758c6b1cf8e26349ed3d60",
+  "sha256": "c31cb53ab5cc37a07500f2de39cc6ec13bade8afb52f76074876e04ca68a2d6b",
   "registrySha256": "db01d9f92c6aa26ca903702896b41be53722982ed07d27633237bb254c214290",
-  "packageVersion": "1.3.1637"
+  "packageVersion": "1.3.1639"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "db01d9f92c6aa26ca903702896b41be53722982ed07d27633237bb254c214290",
   "articleCount": 93,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1637"
+  "packageVersion": "1.3.1639"
 }

package/src/scaffold/templates.ts

@@ -363,6 +363,7 @@ I am the user's interface to the system. They talk to me in natural language; I
 - **DO** suggest /commands that work within our chat (like /restart, /new)
 - **DO** explain what happened in conversational terms, not technical ones
 - When something goes wrong, say what went wrong and what I'm doing about it — not the stack trace
+- **Every message is plain and complete**: what happened, what it means for them, and what they need to do (if anything) — said once, in plain words. Too vague ("The session has stopped.") is useless; too technical (reason codes, timeouts, ids, "drain bound (30000ms)") is useless too. Internal detail stays in logs.
 
 ## Agent Infrastructure
 
@@ -2706,7 +2707,7 @@ export const DASHBOARD_PREVIEW_BULLET = `- **${DASHBOARD_PREVIEW_MARKER}**: \`{t
 export const CONSOLE_BULLET = `- **${CONSOLE_MARKER}**: \`/dashboard/console/\` (same PIN, same tunnel) is the new home screen: one sentence on whether anything needs the operator, then what needs them, held replies, open promises, live sessions on every machine, machine states and safety checks, each saying "Can't tell" with the reason when its source does not answer. It is read-only; every tab still opens in the legacy \`/dashboard\`, which stays the default until the operator calls the console MVP. Proactive: the operator asks "what needs me?" or "is everything OK?" from a phone → send them \`{tunnelUrl}/dashboard/console/\` and the PIN.`;
 
 export const REMOTE_DESKTOP_MARKER = 'Native remote desktop is a separate operator action';
-export const remoteDesktopBullet = (port: number): string => `- **${REMOTE_DESKTOP_MARKER}**: the designated dashboard front's Desktop page shows every registered pool machine by name. The operator enters the existing dashboard PIN once, chooses a ready machine, and can Stop at any time; no Telegram approval is required. Each target stays OFF unless its own \`remoteDesktop.enabled: true\` and \`remoteDesktop.frontMachineId\` name the same designated front and its live host probe passes. Other machine dashboards stay dark for desktop admission. macOS uses a packaged native helper, and macOS checks its permissions against the program it holds responsible: without the helper's own grant that is whatever started this agent's process tree, which can change at any reboot. \`screenGrant\` and \`inputGrant\` in the diagnostics say which applies (\`own\`, \`inherited\` or \`none\`); only \`own\` survives a reboot and updates. When a person is at that Mac, \`curl -X POST -H "Authorization: Bearer $AUTH" -H "X-Instar-Request: 1" http://localhost:${port}/desktop/request-permission\` shows macOS's prompts there (at most once a minute); it grants nothing by itself. A Windows host such as Mama PC requires the separate interactive Windows companion paired with its WSL agent. A native Linux machine shares its own X11 desktop (a desktop login, or a virtual one such as TigerVNC or Xvfb run as the agent's user) through the standard X tools ImageMagick and xdotool; no VNC or other port is exposed, and \`remoteDesktop.linuxDisplay\` (e.g. \`\":1\"\`) picks the display when there are several. A Linux server with no X display, or on Wayland, reports not ready with that reason. Registry First: \`curl -H "Authorization: Bearer $AUTH" http://localhost:${port}/desktop/diagnostics\` checks this target's own screen, input, display, and GUI-session signals without granting control. On WSL it also reports a fixed Windows companion boot failure phase and code if installation failed; the agent remains reachable while desktop control stays off. The designated front's \`GET /desktop/availability\` checks its local desktop, and its PIN-scoped \`GET /desktop/targets\` checks the pool. After patching the two config fields, the agent activates them with \`curl -X POST -H "Authorization: Bearer $AUTH" -H "X-Instar-Request: 1" http://localhost:${port}/desktop/activate-config\`, which requests a supervised restart. During a session the viewer lists a machine's screens by name, resolution and main screen from \`GET /desktop/requests/:id/displays\` and switches between them without reconnecting; a three-finger swipe sends the machine's standard shortcuts (Mission Control, App Exposé and Spaces on a Mac, Task View and Ctrl+Win+arrows on Windows). A Mac can have those shortcuts turned off, and the viewer cannot tell; \`supported: false\` means that machine needs an update. The target owns the signed ten-minute grant, controller lock, screen and input permissions, and Stop/revocation. A signed, one-use operator assertion binds the dashboard session to one target and browser key. The front only relays bounded encrypted stream bytes, admitting at most three remote grants plus its own desktop. An unexpected transport loss can resume within the original deadlines when the target authorizes it; Stop cannot resume. The PIN proves possession of the dashboard credential, not a separately verified human identity. Proactive: when the operator asks to control a machine, check live readiness and give the designated front's dashboard entry only for a verified ready target. Never describe source code or a mocked test as a usable desktop, and never claim Mama PC ready before a live Windows screen/input/Stop test. **Guided setup is the first thing to offer:** on the Desktop page, after the PIN, each machine that is not ready shows one next step from its live check (turn it on, restart, wake or unlock, allow a pop-up, open the exact settings page, or the written path), and the app shows the same steps. Send the operator there instead of patching config by hand. Ready means the live check passed, never what the System Settings list shows, which can be empty or show several entries. Registry First for an agent without a PIN session: GET /desktop/diagnostics on that machine; the audit is logs/desktop-setup.jsonl. On a Mac every agent shares one kept helper at \`~/.instar/desktop-helper/instar-desktop-host\`, replaced only when the helper's source changes, so an update with unchanged source keeps its macOS permission. When the source does change, macOS drops the permission and only a person at that Mac can allow it again: diagnostics carry \`helperChange\` and the steps, and one Attention item says so. Say that plainly; never describe it as a readiness flicker. Off switch: \`remoteDesktop.retainedHelper: false\`. Through the ordinary lock: built and off on every machine. No Mac can enable it until its macOS version has recorded passes of the real crash and Stop tests. \`GET http://localhost:${port}/desktop/locked/status\` reads it; a 409 \`unsupported-macos\` from the settings route means that version is not proven yet. The owner types the password live, normally in the Instar app, and no agent ever handles it: asked for one, refuse. The Mac relocks at the end and is watched for 2 minutes; the promise is "relocks, and tells you if it couldn't". Never tell the operator this works until that status says active.`;
+export const remoteDesktopBullet = (port: number): string => `- **${REMOTE_DESKTOP_MARKER}**: the designated dashboard front's Desktop page shows every registered pool machine by name. The operator enters the existing dashboard PIN once, chooses a ready machine, and can Stop at any time; no Telegram approval is required. Each target stays OFF unless its own \`remoteDesktop.enabled: true\` and \`remoteDesktop.frontMachineId\` name the same designated front and its live host probe passes. Other machine dashboards stay dark for desktop admission. macOS uses a packaged native helper, and macOS checks its permissions against the program it holds responsible: without the helper's own grant that is whatever started this agent's process tree, which can change at any reboot. \`screenGrant\` and \`inputGrant\` in the diagnostics say which applies (\`own\`, \`inherited\` or \`none\`); only \`own\` survives a reboot and updates. When a person is at that Mac, \`curl -X POST -H "Authorization: Bearer $AUTH" -H "X-Instar-Request: 1" http://localhost:${port}/desktop/request-permission\` shows macOS's prompts there (at most once a minute); it grants nothing by itself. A Windows host such as Mama PC requires the separate interactive Windows companion paired with its WSL agent. A native Linux machine shares its own X11 desktop (a desktop login, or a virtual one such as TigerVNC or Xvfb run as the agent's user) through the standard X tools ImageMagick and xdotool; no VNC or other port is exposed, and \`remoteDesktop.linuxDisplay\` (e.g. \`\":1\"\`) picks the display when there are several. On a machine running Hyprland (Omarchy's Wayland desktop) it shares that session instead, through grim, hyprctl, wtype and a virtual pointer, and needs someone signed in at the machine or automatic sign-in; Hyprland's own Super-key shortcuts do not work from a viewer, so use the mouse for those. A Linux server with no desktop, or on another Wayland desktop, reports not ready with that reason. Registry First: \`curl -H "Authorization: Bearer $AUTH" http://localhost:${port}/desktop/diagnostics\` checks this target's own screen, input, display, and GUI-session signals without granting control. On WSL it also reports a fixed Windows companion boot failure phase and code if installation failed; the agent remains reachable while desktop control stays off. The designated front's \`GET /desktop/availability\` checks its local desktop, and its PIN-scoped \`GET /desktop/targets\` checks the pool. After patching the two config fields, the agent activates them with \`curl -X POST -H "Authorization: Bearer $AUTH" -H "X-Instar-Request: 1" http://localhost:${port}/desktop/activate-config\`, which requests a supervised restart. During a session the viewer lists a machine's screens by name, resolution and main screen from \`GET /desktop/requests/:id/displays\` and switches between them without reconnecting; a three-finger swipe sends the machine's standard shortcuts (Mission Control, App Exposé and Spaces on a Mac, Task View and Ctrl+Win+arrows on Windows). A Mac can have those shortcuts turned off, and the viewer cannot tell; \`supported: false\` means that machine needs an update. The target owns the signed ten-minute grant, controller lock, screen and input permissions, and Stop/revocation. A signed, one-use operator assertion binds the dashboard session to one target and browser key. The front only relays bounded encrypted stream bytes, admitting at most three remote grants plus its own desktop. An unexpected transport loss can resume within the original deadlines when the target authorizes it; Stop cannot resume. The PIN proves possession of the dashboard credential, not a separately verified human identity. Proactive: when the operator asks to control a machine, check live readiness and give the designated front's dashboard entry only for a verified ready target. Never describe source code or a mocked test as a usable desktop, and never claim Mama PC ready before a live Windows screen/input/Stop test. **Guided setup is the first thing to offer:** on the Desktop page, after the PIN, each machine that is not ready shows one next step from its live check (turn it on, restart, wake or unlock, allow a pop-up, open the exact settings page, or the written path), and the app shows the same steps. Send the operator there instead of patching config by hand. Ready means the live check passed, never what the System Settings list shows, which can be empty or show several entries. Registry First for an agent without a PIN session: GET /desktop/diagnostics on that machine; the audit is logs/desktop-setup.jsonl. On a Mac every agent shares one kept helper at \`~/.instar/desktop-helper/instar-desktop-host\`, replaced only when the helper's source changes, so an update with unchanged source keeps its macOS permission. When the source does change, macOS drops the permission and only a person at that Mac can allow it again: diagnostics carry \`helperChange\` and the steps, and one Attention item says so. Say that plainly; never describe it as a readiness flicker. Off switch: \`remoteDesktop.retainedHelper: false\`. Through the ordinary lock: built and off on every machine. No Mac can enable it until its macOS version has recorded passes of the real crash and Stop tests. \`GET http://localhost:${port}/desktop/locked/status\` reads it; a 409 \`unsupported-macos\` from the settings route means that version is not proven yet. The owner types the password live, normally in the Instar app, and no agent ever handles it: asked for one, refuse. The Mac relocks at the end and is watched for 2 minutes; the promise is "relocks, and tells you if it couldn't". Never tell the operator this works until that status says active.`;
 
 export const STANDING_SESSIONS_MARKER = 'Standing sessions are never closed by cleanup';
 

package/upgrades/1.3.1638.md

@@ -0,0 +1,21 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Remote desktop now works on Hyprland, the Wayland desktop that Omarchy uses. When the agent's user has a Hyprland session, the Desktop page shows and controls it with tools Omarchy already ships, with nothing to install and no root. Other Linux machines keep using X11 as before, and a configured X display always means X11. If nobody is signed in to the desktop, the page now says that instead of suggesting a virtual X server. Hyprland's own Super-key shortcuts do not work from a viewer, so those need the mouse.
+
+## What to Tell Your User
+
+If I run on Omarchy, you can now see and control my desktop from the Desktop page, once someone is signed in there or automatic sign-in is on.
+
+## Summary of New Capabilities
+
+- Remote desktop on Hyprland and Omarchy, with mouse, typing and screen choice.
+- Clear wording when nobody is signed in to the desktop.
+
+## Evidence
+
+On Omarchy 4.0.6 (Hyprland 0.56.2), limited to the size of a Hetzner cx23, through the real Desktop page with the PIN: the live desktop streamed, a click opened Omarchy's menu, typing and Ctrl+L reached a terminal, the wheel scrolled, a drag selected text, Stop ended the session cleanly and reconnect worked, with 0 failed captures out of 1,397. A display turned off before or during a session came back on its own. Typing through this path unlocked the real lock screen. Multiple monitors are covered by unit tests only.

package/upgrades/1.3.1639.md

@@ -0,0 +1,24 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The notices Instar's server writes to you on its own now say, in plain words, what happened, what it means for you and what to do. The worst one, sent when a conversation moved to another machine before the last step finished, used to read "This conversation moved machines mid-task (drain bound (30000ms) reached — final turn may be partial)…". It now reads: "I moved this conversation to the Mac Studio before I'd finished my last step, so that step may be incomplete. The conversation carries on there. If that step matters, ask me to check it." It names the machine and never shows a machine id. The restart notices and the "pinned profile" note were rewritten the same way. The "Session respawned." line no longer follows a restart I have already told you about, because my reply confirms it.
+
+The standard behind this is written down as Rule 8, "Plain and Complete", in the UX and Agent Agency standard. A message fails if it is too vague to act on or too technical to digest. It has to give the most distinct and critical information in plain language. Two checks hold it. The fixed server notices live in one catalog that a test reads for internal words, ids, timeouts and reason codes. A build-time lint refuses any new server notice that pastes a raw internal reason (`${detail}`, `${err.message}`) or an internal word into your message. Neither check runs while a message is being sent, so an alarm is never held up when the model is down.
+
+## What to Tell Your User
+
+When I tell you something on my own (a restart, or a move to another machine), I now say what happened, what it means for you and whether you need to do anything, with no internal codes. If one of my automatic messages ever reads as jargon or too vague to use, tell me. It is now a defect against a written standard.
+
+## Summary of New Capabilities
+
+- Rule 8 "Plain and Complete" in docs/UX-AND-AGENT-AGENCY-STANDARD.md, with real before/after examples.
+- `src/messaging/userNotices.ts`: the tested catalog of fixed server notices.
+- `npm run lint` includes `lint-plain-user-notices`, a ratchet against raw internal detail in server notices (Telegram and Slack send sites).
+
+## Evidence
+
+Measured from the agent's sent-message log before choosing what to rewrite: in the four days to 2026-11-03, "Session respawned." and "Session restarting — message queued." went out 44 times and the pinned-profile note 29 times. The new tests fail on the old code: the drain notice received the raw reason, and the lint flags `${detail}` and "final turn" at that send site. They pass on the new code. Live proof is a real move between two updated machines (see the PR).

package/upgrades/side-effects/hyprland-remote-desktop.eli16.md

@@ -0,0 +1,39 @@
+# Remote desktop on Hyprland (Omarchy) — plain-English overview
+
+> The one-line version: Instar's remote desktop now works on Hyprland, the Wayland desktop Omarchy uses, with nothing to install and no root access.
+
+## The problem in one breath
+
+Instar's Linux remote desktop reads and drives the screen with X11 tools. Omarchy runs Hyprland, which uses Wayland, where those tools see a black or partial screen. So on Omarchy the Desktop page told the person to choose an X11 session at sign-in, which Omarchy does not offer. People had assumed Wayland simply forbids this. On Hyprland it does not: the desktop offers these abilities to its own user's programs.
+
+## What already exists
+
+- The remote desktop itself: the dashboard's Desktop page, the PIN step, the encrypted stream, and the Stop button. None of that changes.
+- The X11 host, which keeps working exactly as before.
+
+## What this adds
+
+A second Linux host for Hyprland, chosen automatically when the agent's user has a Hyprland session running:
+- The picture comes from `grim`, about 60 to 160 milliseconds per frame on a small cloud server.
+- Screens and the cursor position come from `hyprctl`.
+- Typing goes through `wtype`, fed on standard input so a typed password never appears in the list of running programs.
+- The mouse is a small client that speaks Hyprland's virtual-pointer protocol directly over its socket. That avoids ydotool, which would need root setup.
+
+Omarchy already ships all of these tools. A plain Hyprland machine without `grim` or `wtype` is told exactly what to install.
+
+## What I learned from the real machine
+
+- When Omarchy's idle timer turns the display off, `grim` hangs. The host now wakes the screen by nudging the pointer when someone connects and whenever the screen goes off during a session.
+- Omarchy's lock screen does not tell the system it is locked, so Instar cannot detect it. The viewer simply sees the password box and can type into it; I unlocked a real session that way.
+- Hyprland's own Super-key shortcuts (like Super+Return for a terminal) do not fire from `wtype`. Shortcuts inside applications do work. The Omarchy menu icon works by mouse, and it reaches most of the same things. Holding a key while clicking (Ctrl-click) does not carry over either.
+
+## The safeguards
+
+- Nothing changes unless remote desktop is already turned on for this machine, with the same PIN and stream.
+- A configured X display (`remoteDesktop.linuxDisplay`) always means X11.
+- The host opens no network port and needs no root.
+- It does not switch hosts while a viewer is connected, and if Hyprland goes away the viewer's session ends and says so.
+
+## What the reader needs to decide
+
+Nothing. It is off unless remote desktop is enabled, and a revert removes it.

package/upgrades/side-effects/hyprland-remote-desktop.md

@@ -0,0 +1,91 @@
+# Side-Effects Review — remote desktop on Hyprland (Omarchy)
+
+**Version / slug:** `hyprland-remote-desktop`
+**Date:** `2026-11-03`
+**Author:** `Echo`
+**Tier:** `1 declared; the gate's risk floor is 2 for a new capability. Reasoning: off unless remote desktop is enabled, no state, a revert restores everything. Two independent review rounds and live proof took the place of a converged spec. Recorded as belowFloor.`
+**Second-pass reviewer:** `independent subagent, two rounds. First: concern raised (two high, two medium, five low; Stop safety and races), all fixed. Second: the fixes held; concern raised (capitals lost from a physical keyboard, confirmed live; two low restart races; weak tests), all fixed`
+
+## Summary of the change
+
+Topic 136848 asked what Wayland remote desktop would take on Omarchy (Hyprland). This builds it for Hyprland, and proves it on Omarchy 4.0.6 on a Hetzner server.
+
+- `src/core/HyprlandDesktopHost.ts` is a new `DesktopHost`: `grim` for frames, `hyprctl -j` for screens and cursor, `wtype` for keys (text on stdin), and a virtual pointer for the mouse.
+- `src/core/WaylandVirtualPointer.ts` speaks `zwlr_virtual_pointer_v1` directly over the Wayland socket. No package and no root.
+- `LinuxAutoDesktopHost`, in the same file as the Hyprland host, picks Hyprland or the existing X11 host at each probe, stays put while a viewer is connected, and always uses X11 when `remoteDesktop.linuxDisplay` is set.
+- `DesktopProbeReadiness` gains wording for Hyprland with nobody signed in, with tools missing, and not answering. The generic Wayland wording no longer claims Wayland cannot be supported.
+- `LinuxRunner` gains an optional `input` written to the child's stdin.
+- The remote desktop awareness bullet mentions Hyprland. `migrateClaudeMd` already replaces that line in place for existing agents.
+
+## Class-Closure Declaration
+
+- `unbounded-self-action`: closure `n/a`. The only timer is the 2 s heartbeat of an operator-started remote desktop session, the same as the X11 host. It stops on Stop, on a lost desktop, and at the session's ten-minute limit, and it nudges a display only when it has gone off.
+
+## Decision-point inventory
+
+- Which host serves a Linux machine: add; Hyprland when this user has a live session and no X display is configured, otherwise X11, re-decided at each probe unless a viewer is connected.
+- Whether a Hyprland desktop counts as ready: add; tools present, session live, at least one monitor.
+
+## 1. Over-block
+
+A Wayland session on Hyprland used to refuse and now works, unless `grim` or `wtype` is missing, which reports what to install. Other Wayland desktops refuse as before.
+
+## 2. Under-block
+
+Remote desktop reports `screenLocked: false` on Hyprland because Omarchy's lock screen leaves logind's `LockedHint` at no, so the X11 host's locked refusal has no equivalent. A viewer who has passed the dashboard PIN sees the lock screen and can type at it, but still needs the machine's password; the frames show only the lock screen. Measured: typing the password through this path unlocked a real session.
+
+The virtual pointer and `wtype` run as the agent's user, the same trust as `xdotool` on X11.
+
+## 3. Level-of-abstraction fit
+
+The same `DesktopHost` interface as the other hosts, so admission, the PIN, the audit log and the stream are unchanged. Selection sits in a small wrapper instead of inside the X11 host, so the X11 host's code path is untouched apart from the optional stdin field.
+
+## 4. Signal vs authority compliance
+
+No message or action is gated by this. `probe()` already feeds the existing admission decision and this reports the same fields honestly.
+
+## 4b. Judgment-point check
+
+None.
+
+## 5. Interactions
+
+- **X11 host:** still used on every machine without a Hyprland session. A Hyprland login also owns an Xwayland socket, which the X11 host deliberately refuses; the wrapper now selects Hyprland before that arises.
+- **`linuxDisplay` set to `:0` on a Hyprland machine:** still X11, as asked, even though it shows a partial screen.
+- **Display idle:** the heartbeat nudges the pointer when a screen goes off during a session, so the display stays on while something off-screen turned it off. It does not reset idle continuously, so Omarchy can still lock during a long quiet session, and the viewer sees the lock.
+- **Machine with a stale `hypr` folder:** ignored unless its recorded pid is running and its socket exists.
+- **Hyprland restart while connected:** the heartbeat sees the signature change and ends the session through the existing lost-indicator path; the viewer can reconnect.
+- **`hyprctl dispatch`:** deliberately unused; it became Lua in Hyprland 0.56.
+- **Older grim or wtype:** the flags used are long-standing, and `wtype -` for stdin was checked on this machine only.
+- **Page errors on Linux:** the Desktop page's calls to `/desktop/locked/status` and `/desktop/setup` answer 503 on this host, as those belong to the macOS locked-screen and setup features. The page carries on, and they appear in the browser console only. One `cursor` call answered 403 in the moment before the session was admitted.
+
+## 6. External surfaces
+
+A notification on the machine's own screen when a viewer connects, the same as X11. Nothing new leaves the machine and no port opens.
+
+## 7. Multi-machine posture
+
+Machine-local by design: each host describes its own screen, and the existing pool Desktop page lists machines as before.
+
+## 8. Rollback cost
+
+A revert restores the X11-only behaviour. Nothing is stored.
+
+## Known limits
+
+- Hyprland's own Super-key shortcuts do not fire from `wtype`, tried four ways; shortcuts inside applications reach them (Ctrl+L, measured). Queued as an improvement.
+- Modifiers do not reach the mouse: Ctrl-click, Shift-click and Super-drag lose the modifier, because the virtual pointer and `wtype` are separate clients. X11 supports these.
+- A press-and-hold of a non-modifier key sends one key, because `wtype` presses and releases within one run. A modifier tapped alone (Super by itself) sends nothing.
+- Shift plus a key is sent as the character it makes on a US keyboard, because `wtype` chords lose capitals and shifted symbols (measured). Another layout's shifted digits will differ; letters are fine. The viewer's keyboard field, which sends text, is not affected.
+- Stop blocks new input at once but does not kill a `wtype` already running, the same as `xdotool` on X11.
+- A Hyprland restart during a session is covered by unit tests, not live.
+- Single keys sent as key presses appear in the process list briefly (`wtype -k a`), as they do with `xdotool` on X11. Text sent through the viewer's keyboard field and pasted text go over stdin.
+- A crash of the agent while a button is held relies on the compositor to release it, which was not tested. Normal Stop sends the release first and closes gently so it arrives.
+- More than one monitor is covered by unit tests only; the test server has one screen.
+- This has unit tests and live proof, not integration or e2e tier tests. Those tiers need a running Hyprland, and CI has none; the wiring is pinned by a source test, and the existing desktop route tests use the same host interface with a stub.
+
+## Tests
+
+- `tests/unit/hyprland-desktop-host.test.ts` (37 tests): session discovery (live, dead, junk); monitor parsing (scale, sideways, disabled, idled off); probe readiness and its three wordings; capture and screen choice; pointer mapping; clicks, drags, Stop releasing, including in a click's gap; scroll remainders; typing on stdin; modifier chords; waking a display; losing the desktop; Stop during connecting; a late connect; a failed start; nothing reopening the pointer after Stop; shared connection; a stale heartbeat not ending the next session; host selection and its X11 override; and the wire bytes against a fake compositor on a real Unix socket.
+- `tests/unit/linux-desktop-host.test.ts` and `tests/unit/remote-desktop-delivery-parity.test.ts` unchanged and passing.
+- Live, Omarchy 4.0.6, Hyprland 0.56.2, agent limited to 2 vCPUs and 3.9 GB (the size of a cx23), through the real dashboard Desktop page over Tailscale with the PIN: diagnostics `status: ready`; the live desktop streamed; a click opened Omarchy's menu; typing through the viewer's keyboard field and as direct keys both arrived in order, including spaces (Shift keys through the host class on the final build typed `xA!By` as sent); Ctrl+L cleared a terminal; wheel scrolled its history; a held drag selected text; Stop reported stopped and left no pointer socket; reconnect worked. Over 1,397 captures, 0 failed. A display turned off before connecting came back on connect, and one turned off mid-session came back within 4 s. `wtype` on stdin unlocked the real lock screen.

package/upgrades/side-effects/plain-user-notices.eli16.md

@@ -0,0 +1,15 @@
+# Plain and Complete notices — the short version
+
+**What this is.** When Instar's server sends you a message on its own, for example after restarting a session or moving a conversation to another machine, that message is written in code by a developer. It doesn't go through the AI check that reviews messages a session writes. That is deliberate: if the AI is down, an alarm still has to reach you. The side effect is that nothing checked whether those messages made sense to a person. On 2026-11-03 Justin got "This conversation moved machines mid-task (drain bound (30000ms) reached — final turn may be partial). Work resumes on the new machine — the final turn before the move may be partial." It pasted an internal reason straight in, said the same thing twice and didn't name the machine. He asked for a standard: messages must be easy to digest and carry just enough information to be useful.
+
+**What already existed.** The UX standard already said names must never be replaced by ids (Rule 7). The constitution already said routine self-narration ("I restarted") should not be sent at all (Near-Silent Notifications). Session-written messages already pass a tone gate, and scheduled jobs get a jargon and file-path advisory. None of that covered how the server's own fixed notices are worded.
+
+**What is new.**
+1. A written rule, Rule 8 "Plain and Complete", in Justin's words. Every message says what happened, what it means for the person and what they need to do, once and in plain words. It can fail by being too vague or too technical. It comes with real before/after examples.
+2. One catalog file holds the server's fixed notices. A test reads every one for internal words, ids, timeouts, reason codes and file paths, and for messages too short to say anything.
+3. A build check looks at every place the server sends a message (Telegram and Slack) and refuses new code that pastes a raw internal reason, such as an error message or a reason code, into your text. Today's remaining cases are frozen in a list that may only shrink. They are tracked for rewriting as feedback item fb-d1c2f259-243.
+4. Four real notices rewritten: the moved-machines one (now names the machine, says the step may be incomplete, and tells you to ask for a check, since nothing re-checks it automatically), both restart notices, and the pinned-settings note.
+
+**Safeguards.** Nothing here runs when a message is sent, so no message can be delayed or blocked by it. Code that recognises the server's notices by their wording (so they are never mistaken for a real reply) now reads the same catalog, so a reworded notice is still recognised. Old wordings stay recognised because they are still in message history.
+
+**What you need to decide.** Nothing. The standard could not go into the constitution registry itself, because registry changes need a signed approval and no approval key is installed yet. It lives in the UX standard, which the registry already points to. Installing the key is Echo's job.