instar 1.3.1648 → 1.3.1649

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.1648",
+  "version": "1.3.1649",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-11-04T06:51:40.408Z",
-  "instarVersion": "1.3.1648",
+  "generatedAt": "2026-11-04T07:49:43.811Z",
+  "instarVersion": "1.3.1649",
   "entryCount": 206,
   "entries": {
     "hook:session-start": {
@@ -435,7 +435,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -443,7 +443,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -451,7 +451,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -459,7 +459,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -467,7 +467,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -475,7 +475,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -483,7 +483,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -491,7 +491,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -499,7 +499,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -507,7 +507,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -515,7 +515,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -523,7 +523,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -531,7 +531,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -539,7 +539,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -547,7 +547,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -555,7 +555,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -563,7 +563,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -571,7 +571,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -579,7 +579,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -587,7 +587,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -595,7 +595,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -603,7 +603,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -611,7 +611,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -619,7 +619,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -627,7 +627,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -635,7 +635,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -643,7 +643,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -651,7 +651,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -659,7 +659,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -667,7 +667,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -675,7 +675,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -683,7 +683,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -691,7 +691,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -699,7 +699,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -707,7 +707,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -715,7 +715,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -723,7 +723,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -731,7 +731,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -739,7 +739,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -747,7 +747,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -755,7 +755,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -763,7 +763,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -771,7 +771,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -787,7 +787,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "27c51ec8bac7ec17429449841c11129440933126ef98895d28664d3f9f2e36ba",
+      "contentHash": "b26141cc65bcc119c3ff1089c0e4cb8425d24af5460d475d780f5ca485b653f2",
       "since": "2025-01-01"
     },
     "cli:init": {
@@ -1571,7 +1571,7 @@
       "type": "subsystem",
       "domain": "sessions",
       "sourcePath": "src/core/SessionManager.ts",
-      "contentHash": "3c159e55a2e108172ff44b3c3ddb44130ede179787c734e961a5714e49f35c9d",
+      "contentHash": "ae49c6c5bb33ad5e39b1bc0336372f2f4355be2952f4940ecbca3b1faa70bc51",
       "since": "2025-01-01"
     },
     "subsystem:auto-updater": {
@@ -1603,7 +1603,7 @@
       "type": "subsystem",
       "domain": "scheduling",
       "sourcePath": "src/scheduler/JobScheduler.ts",
-      "contentHash": "213763b1e20ac4993ea58dbf39200ef87312e85381affdbd37b0564abf99af49",
+      "contentHash": "a19229a622391310d4b4e768aaa28f396a5a1a6b9eb6cad346af18241115f712",
       "since": "2025-01-01"
     },
     "subsystem:project-mapper": {

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "e9eb5bb7f56ce6f81c5f80210c1ec7999d4b8c7d2ff1ab5cfd97a269172ce2ac",
-  "packageVersion": "1.3.1648",
+  "packageVersion": "1.3.1649",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "48f5b5915efa039f5a51b61e61db89a838f8acaba52528ed1880feb5703151c8",
+  "sha256": "925a6e27d3abc6b957a8e865a9623c9a4a607cc43ddbf9bbe70cc8193b2f0e0e",
   "registrySha256": "e9eb5bb7f56ce6f81c5f80210c1ec7999d4b8c7d2ff1ab5cfd97a269172ce2ac",
-  "packageVersion": "1.3.1648"
+  "packageVersion": "1.3.1649"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "e9eb5bb7f56ce6f81c5f80210c1ec7999d4b8c7d2ff1ab5cfd97a269172ce2ac",
   "articleCount": 93,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1648"
+  "packageVersion": "1.3.1649"
 }

package/upgrades/1.3.1649.md

@@ -0,0 +1,28 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Recovered Telegram session replies now get a topic history row from the confirmed receipt. A before-network connect failure that holds a session reply creates one operator attention item for that destination. Advisory preflight records now state that delivery is not confirmed.
+
+The global session limit now returns a typed capacity refusal. Scheduled jobs wait in the existing priority queue without gaining a failure, and one scheduled job may use a guarded extra session place when conversations fill the ordinary allowance and memory is healthy. Old per-job failure reminders pause during the wait.
+
+## What to Tell Your User
+
+A delayed reply stays in the server's retry queue. Its delivery state is visible, and a recovered message appears in topic history once Telegram accepts it.
+
+Scheduled checks no longer report a failure merely because conversations have filled the Studio's ordinary session allowance. They wait and try again when there is room.
+
+## Summary of New Capabilities
+
+Recovered Telegram replies are recorded in topic history; held session replies raise an operator attention item, and advisory rows clearly distinguish preflight from delivery.
+
+One scheduled job can run beyond the ordinary conversation allowance when memory is healthy, while the hard host limit and the subscription lane limit still protect the machine.
+
+## Evidence
+
+A Mac Studio origin outbox receipt for Echo Bugs topic 10000001534 had Telegram message 1550 after recovery, while the topic history had no row. The focused regression failed before the adapter method and passed after it; the advisory E2E check passed.
+
+Regression tests first failed on the old global-limit behavior, then passed for typed waiting, a single guarded extra slot, simultaneous requests, high memory pressure, and conversations beyond the soft cap. The full repository verifier is required before merge.

package/upgrades/job-alert-global-cap.eli16.md

@@ -0,0 +1,9 @@
+# Scheduled jobs and the global session limit — plain English
+
+The first job-alert fix reached the Mac Studio and exposed a second limit. The Studio had twenty running conversations, which filled its ordinary session allowance. Health Check was refused before it reached the six-slot subscription lane. That refusal still counted as a failed job, so a machine with busy conversations could keep producing alerts and miss checks even after the first fix.
+
+This correction makes a full global session pool a typed waiting condition, just like a full subscription lane. A scheduled job that reaches the limit waits in the existing priority queue. Its failure count does not rise, and it is retried every fifteen seconds when room becomes available. The scheduler pauses any old per-job failure reminder while the job waits; a real failure after the retry starts the normal failure alert again.
+
+People can open conversations beyond the ordinary limit because a conversation is an immediate request. To keep that choice from blocking all scheduled checks, one scheduled job may borrow a single additional session place while the host's memory is healthy. The loan is limited to one running or starting job at a time, even if several jobs trigger together. The hard safety limit of three times the configured session allowance remains in place. High memory pressure closes the loan, and the six-slot subscription lane still has its own cap. This keeps the protection that matters after the June 2026 laptop memory failure.
+
+This is a small, reversible correction to the already shipped capacity episode. It adds no new notification type or destination. A short wait remains silent; a long wait still produces one plain Attention message for the episode. The live Studio check that prompted this change found twenty conversations and Health Check's existing “Max sessions” errors; the new behavior must be verified on the next installed release before it can be called live.

package/upgrades/side-effects/echo-bugs-recovered-reply-history.md

@@ -0,0 +1,67 @@
+# Side-Effects Review — Echo Bugs reply recovery visibility
+
+**Version / slug:** `echo-bugs-recovered-reply-history`  
+**Date:** 2026-11-04  
+**Author:** Echo  
+**Second-pass reviewer:** independent review agent
+
+## Summary of the change
+
+Tier 1, 8 source/test files and about 80 changed lines; one review round and one commit/gate attempt planned. A recovered origin send now mirrors its Telegram receipt into topic history, using the issues chat and real thread to restore the internal topic id. A held session reply caused by a proved connect failure creates a deduplicated hub attention item. The advisory log explicitly marks preflight rows as delivery unconfirmed. The transport's connect error code is logged without credentials. This is built in a fresh worktree based on `JKHeadley/main`, remote `https://github.com/JKHeadley/instar.git`, package version 1.3.1646. Rollback is a revert; the durable origin outbox and retry authority remain unchanged.
+
+## Decision-point inventory
+
+- Origin recovery send gate: pass-through. The existing sealed outbox owns retries; this patch only observes a confirmed receipt.
+- History mirror: add. Only a correlated Bot API acceptance from `sendMessage` produces a history row; adapter dedupe prevents a second row.
+- Held session attention: add signal. The proved before-network connect failure creates an operator observation; it does not grant or deny send permission.
+- Advisory API interpretation: modify presentation. `clean` means preflight only and is labeled `not-confirmed`.
+
+## 1. Over-block
+
+No block/allow surface; no legitimate message is rejected by this patch.
+
+## 2. Under-block
+
+A process crash after the origin store saves a recovered acceptance but before the callback writes history can still leave a log gap. Other hold reasons still rely on existing status and notices. An accepted Telegram receipt does not prove that a human read the message.
+
+## 3. Level-of-abstraction fit
+
+The origin transport confirms platform acceptance, and the Telegram adapter owns topic history. The callback joins those layers only after the existing origin authority has accepted the receipt. The attention observation uses the existing hub item system rather than another sender.
+
+## 4. Signal vs authority compliance
+
+[Signal vs authority](../../docs/signal-vs-authority.md): no new blocking authority. The connect failure is a transport proof and only feeds logging and attention. Retry permission remains with the outbox.
+
+## 4b. Judgment-point check
+
+No static heuristic at a competing-signals decision point. The log mirror requires a concrete receipt, and the alert requires the existing proved-unsent failure class.
+
+## 5. Interactions
+
+Normal sends still log in `sendToTopic`; recovered sends bypass it and use this callback. Adapter message-id dedupe handles a callback repeated by a recovery race. The callback runs after durable outcome recording and cannot trigger a resend. Attention uses a stable per-operation id, so repeated holds of the same reply coalesce. A confirmed recovered receipt closes exactly that operation's item, including when attention lifecycle automation is disabled.
+
+## 6. External surfaces
+
+The advisory endpoint adds `stage` and `deliveryStatus`; existing fields remain. Recovered sends appear in topic history and search. The operator hub shows delayed session replies while Telegram connect attempts fail. No new Bot API request is made.
+
+## 7. Multi-machine posture
+
+Origin operations remain machine-local to their execution owner and are recovered there. A holder logs recovered receipts into its topic history. The hub attention is created on that holder. Forward-to-holder behavior on a standby is unchanged and owned by the separate topic 10000001549 work.
+
+## 8. Rollback cost
+
+Revert the code and restart the server. Already-written message history rows remain true receipt records; existing dedupe prevents duplicates. No migration is required.
+
+## Evidence
+
+On the Mac Studio, operation `4a9ca1dd-56f3-4294-8cab-7fb7d7f80f47` was accepted on a recovery attempt at 05:44:45 UTC with Telegram message 1550, but topic 10000001534 history lacked that row. Operation `1206bc11-c6b0-441a-8d3f-619fcb82b45b` was still admitted after a proved connect failure; its outbox scheduled a retry. The new regression test failed with `logRecoveredOriginMessage is not a function` before the adapter change and passes afterward. The advisory E2E test passes with the new status fields.
+
+## Class-Closure Declaration
+
+`defectClass: unbounded-self-action`, `closure: n/a`. The new notification is a one-shot response to one existing send hold, keyed by that operation id. It installs no timer, retry, or self-triggered loop; the existing origin outbox retains all retry authority. No agent-authored-artifact defect.
+
+## Second-pass review
+
+The independent reviewer confirmed that the callback requires a Telegram receipt and existing adapter dedupe prevents a second history row. Concern raised: the new attention item could remain open after delivery. The callback now closes an operation-scoped item after receipt-confirmed recovery, with a fallback when lifecycle automation is disabled. The reviewer also noted that a recovery-path callback test would strengthen the adapter-only test; the targeted integration and E2E checks cover the added history and advisory behavior.
+
+**Recheck:** The reviewer concurs with the revised fix. Each pending operation has its own attention item, and confirmed recovery closes it with or without attention lifecycle automation. The documented crash window remains.

package/upgrades/side-effects/job-alert-global-cap.md

@@ -0,0 +1,66 @@
+# Side-Effects Review — Global session capacity for scheduled jobs
+
+**Version / slug:** `job-alert-global-cap`  
+**Date:** 2026-11-03  
+**Author:** echo  
+**Second-pass reviewer:** independent Codex reviewer
+
+## Summary of the change
+
+Tier 1, reversible correction after live evidence on Studio: twenty running conversations caused Health Check to fail at the global session limit before the reroute gate. A typed global refusal now enters the capacity episode. The session manager lends one bounded place to a scheduled job when memory is below the high tier; pending admissions are counted so simultaneous jobs cannot both borrow it. The scheduler suspends old failure reminders during that wait. Approximately eight files and 130 changed code and test lines, plus short release artifacts; one design pass, one reviewer pass, and one commit planned.
+
+## Decision-point inventory
+
+- `SessionManager.spawnSession` owns the soft and hard session limits and emits the new typed refusal. Its pending counter closes simultaneous admission races.
+- `SessionManager.confinedRerouteCapacity` reports saturation from the global limit as well as the reroute lane, so the existing job queue waits rather than retrying a known-full host every poll.
+- `JobScheduler` recognizes the typed global refusal and uses the existing durable capacity episode. It suspends a stale per-job failure reminder until a real retry result arrives.
+
+## 1. Over-block
+
+If memory is high, the borrowed place closes even when a critical job is waiting. This is deliberate: the rerouted lane's existing memory gate would refuse the same launch, and adding a session under high pressure would recreate the host risk. When another scheduled job is running, the loan is unavailable until that job finishes. A conversation remains possible under the existing operator path.
+
+## 2. Under-block
+
+The one-job loan does not force a running conversation to end. A host already at the hard absolute limit or above the memory threshold still cannot start a job; the episode's ten-minute critical or thirty-minute other notice remains the alarm. The global refusal class covers this admission point; unrelated real spawn errors continue through the failure path.
+
+## 3. Level-of-abstraction fit
+
+The session manager already owns admission and memory pressure. It makes the bounded loan decision there, while the scheduler owns retry order and notices. A class, rather than the changing error text, tells the scheduler to wait. The queue and alert logic from the preceding release are reused.
+
+## 4. Signal vs authority compliance
+
+Required reference: [Signal vs Authority](../../docs/signal-vs-authority.md). The new refusal is a structural resource signal from the existing admission authority. The scheduler does not infer capacity from a string or create another independent gate. The one-place loan is a bounded resource invariant, conditioned on the existing memory tier and absolute limit, rather than a judgment about a conversation's importance.
+
+## 4b. Judgment-point check
+
+The job's declared scheduler provenance is the only eligibility signal. Job priority remains with the scheduler queue. No semantic text classifier decides whether to stop a session, admit a job, or alert Justin.
+
+## 5. Interactions
+
+Pending headless launches count during admission; this is conservative until each launch settles. One pending or running scheduled job owns the loan. The reroute lane still limits subscription sessions and refuses under high memory pressure. Capacity waits release their machine claim and regain it at retry. A prior failure reminder stops during a capacity wait; if the later spawn really fails, normal alert state starts again.
+
+## 6. External surfaces
+
+Health Check and other scheduled jobs can now wait silently at the global session limit. There is no new topic or message format. The existing episode notice remains in Attention. Direct `/sessions/spawn` calls cannot claim the scheduled loan by merely supplying a job slug; the scheduler trigger marker is required.
+
+## Operator surface
+
+No new control is added. Existing conversation management remains available if Justin chooses to close one.
+
+## 7. Multi-machine posture
+
+Machine-local by design: session count and memory pressure are measured per host. The existing multi-machine job claim and wait-release path determine where a retried job can run. The notice uses the existing one-voice Telegram path; no state is moved between topic owners.
+
+## 8. Rollback cost
+
+Reverting this correction restores the previous global admission rule. The typed error has no persistent format, and the already existing capacity episode state is compatible with the previous release. No migration or cleanup is needed.
+
+## Second-pass review
+
+Concur with the review. The reviewer checked the typed refusal, the simultaneous-loan race, the absolute and high-memory limits, and the old failure reminder behavior. Tests cover direct-spawn refusal, a single scheduled loan, high pressure, simultaneous requests, and typed-versus-text scheduler handling. No concrete regression was found in this diff.
+
+The full verifier exposed one stale end-to-end assertion in `tests/e2e/job-run-history-lifecycle.test.ts`: it required a numeric success rate even when all runs were still pending. The existing API contract returns `null` until a run completes. The assertion now checks both states against that contract; no production stats behavior changed.
+
+## Class-Closure Declaration
+
+`defectClass: unbounded-self-action`, `closure: guard`, `enforcementType: ratchet`, citation: `tests/unit/job-capacity-episode.test.ts`. A global-cap refusal enters the existing durable capacity episode. The tests require silence for individual refused jobs, at most one episode notice, and one queued retry per poll after capacity returns. Pending admission counts allow only one borrowed scheduled slot, so repeated polling cannot create an unbounded launch burst.