instar 1.3.1649 → 1.3.1650

package/src/data/stageBCertifiedSet.ts

@@ -23,6 +23,18 @@ export const STAGE_B_CERTIFIED_SET = {
     "src/core/StageBStartupReadiness.ts"
   ],
   "excluded": [
+    {
+      "file": "src/core/claudeChildAuth.ts",
+      "reason": "Claude-only helper that passes the sign-in key to claude children; a Codex launch never reads it, so it cannot change the behaviour the Stage-B evidence certifies."
+    },
+    {
+      "file": "src/monitoring/FeatureEvidenceLog.ts",
+      "reason": "Write-only evidence log reached through DegradationReporter; its calls never throw, return nothing the caller reads, and do not alter the certified Codex Stage-B delivery path."
+    },
+    {
+      "file": "src/utils/jsonl-rotation.ts",
+      "reason": "Size-based log rotation used only by the evidence log in this closure; it never throws and does not alter the certified Codex Stage-B delivery path."
+    },
     {
       "file": "src/scheduler/jobScriptProtocol.ts",
       "reason": "Shared deterministic script-job output parser reached through scheduler imports; it does not alter the certified Codex Stage-B delivery path and has separate script protocol unit and lifecycle coverage"

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "e9eb5bb7f56ce6f81c5f80210c1ec7999d4b8c7d2ff1ab5cfd97a269172ce2ac",
-  "packageVersion": "1.3.1649",
+  "packageVersion": "1.3.1650",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "925a6e27d3abc6b957a8e865a9623c9a4a607cc43ddbf9bbe70cc8193b2f0e0e",
+  "sha256": "a88c8170fba3168f43e10fed54a788521b7b476fb4af8ba0dea8ab7ae70260c9",
   "registrySha256": "e9eb5bb7f56ce6f81c5f80210c1ec7999d4b8c7d2ff1ab5cfd97a269172ce2ac",
-  "packageVersion": "1.3.1649"
+  "packageVersion": "1.3.1650"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "e9eb5bb7f56ce6f81c5f80210c1ec7999d4b8c7d2ff1ab5cfd97a269172ce2ac",
   "articleCount": 93,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1649"
+  "packageVersion": "1.3.1650"
 }

package/src/data/state-coherence-registry.json

@@ -2155,6 +2155,24 @@
         "note": "Never pruned by design: a message signed by a key must stay checkable after the key is revoked. One activation and at most one revocation row per paired phone key per writing machine, so it grows only with pairings."
       }
     },
+    {
+      "category": "recommended-services",
+      "description": "A person's yes and no choices about recommended outside services (docs/specs/recommended-services.md): an append-only signed ledger that replicates as the recommendedServices store.",
+      "scope": "must-be-coherent",
+      "freshness": "eventual",
+      "conflictShape": "append-only",
+      "transport": "peer-http",
+      "paths": [
+        "state/recommended-services/"
+      ],
+      "grandfathered": false,
+      "retention": {
+        "class": "C",
+        "access": "jsonl",
+        "complianceHold": true,
+        "note": "Never pruned by design: dropping a row could undo a person's no. Volume is tiny: at most a few rows per service per person."
+      }
+    },
     {
       "category": "ecosystem-ideas",
       "description": "The ecosystem idea pipeline (docs/specs/ecosystem-idea-pipeline.md): an append-only event ledger that replicates as the ecosystemIdeas store, a per-machine framework admission record and notice dedupe. Source mirrors and index.db in the same directory are a rebuildable cache.",

package/src/scaffold/templates.ts

@@ -21,6 +21,8 @@ import { JOB_DECLARED_FAILURE_AWARENESS } from "../scheduler/jobDeclaredFailure.
 // function call inside generateClaudeMd — no module-init cycle (PostUpdateMigrator
 // never imports templates).
 import { APPRENTICESHIP_STALL_GATE_CLAUDEMD_SECTION, SESSION_LISTING_HYGIENE_CLAUDEMD_SECTION, PLAYWRIGHT_PROFILE_REGISTRY_CLAUDEMD_SECTION, MACHINE_LOAD_ASSESSMENT_CLAUDEMD_SECTION, CODEX_CONNECT_CLAUDEMD_SECTION, FEATURE_SWITCH_CLAUDEMD_SECTION, NORMAL_CHROME_BROWSER_CLAUDEMD_SECTION, SINGLE_MACHINE_FAILOVER_GAP_CLAUDEMD_SECTION, MISSING_LOGIN_SESSION_CLAUDEMD_SECTION, DYNAMIC_MCP_CLAUDEMD_SECTION, ULTRACODE_SPAWN_CLAUDEMD_SECTION, AGENT_SIGNATURE_PROVENANCE_CLAUDEMD_SECTION, SENDER_REJECTION_CLAUDEMD_SECTION, SCOPE_ACCRETION_CLAUDEMD_SECTION, MESH_SELF_HEALING_CLAUDEMD_SECTION, LEASE_MEDIUM_CLAUDEMD_SECTION, WRITE_ADMISSION_CLAUDEMD_SECTION, DOORWAY_REGISTRY_CLAUDEMD_SECTION, EXTERNAL_HOG_CLAUDEMD_SECTION, ROUTING_SPEND_CLAUDEMD_SECTION, MATURATION_BOARD_CLAUDEMD_SECTION, MATURATION_LADDER_CLAUDEMD_SECTION, QUEUE_PACE_CLAUDEMD_SECTION, ECOSYSTEM_IDEAS_CLAUDEMD_SECTION, MOBILE_PAIRING_CLAUDEMD_SECTION, MOBILE_CHAT_CLAUDEMD_SECTION, APP_CONVERSATIONS_CLAUDEMD_SECTION, MOBILE_ROUTES_CLAUDEMD_SECTION, MOBILE_PUSH_CLAUDEMD_SECTION, MOBILE_PEOPLE_CLAUDEMD_SECTION, DECISION_QUALITY_CLAUDEMD_SECTION, BENCHMARK_DIVERGENCE_CLAUDEMD_SECTION, DUPLICATE_RECONCILER_CLAUDEMD_SECTION, AUDIT_CONVERGENCE_CLAUDEMD_SECTION, TONE_ADVISORY_MIGRATION_CLAUDEMD_SECTION, DECISION_JOURNAL_CONFIDENCE_CLAUDEMD_GUIDANCE, WINDOW_RUN_LIVENESS_CLAUDEMD_SECTION, SCRIPT_JOBS_CLAUDEMD_SECTION, SESSION_HANDOFF_CLAUDEMD_SECTION, JOB_RESULT_SUPERVISION_CLAUDEMD_SECTION, DEDICATED_PROFILE_REGISTRY_ROW_ANSWER, CODEX_ARM_SWEEPER_CLAUDEMD_SECTION, MACHINE_MAINTENANCE_CLAUDEMD_SECTION, APP_MEDIA_CLAUDEMD_SECTION, MACHINE_BROWSER_CARE_CLAUDEMD_SECTION, PAIRING_WITHOUT_TELEGRAM_CLAUDEMD_SECTION, SLACK_FROM_APP_CLAUDEMD_SECTION, MACHINE_MAINTENANCE_POOL_CLAUDEMD_SECTION, MACHINE_WEDGE_CLAUDEMD_SECTION } from '../core/PostUpdateMigrator.js';
+import { SURFACE_REFERRAL_CLAUDEMD_SECTION } from '../core/PostUpdateMigrator.js';
+import { RECOMMENDED_SERVICES_CLAUDEMD_SECTION } from '../core/PostUpdateMigrator.js';
 import { MINIMUM_OPERATOR_EFFORT_CLAUDEMD_SECTION } from '../core/PostUpdateMigrator.js';
 import { CODEX_DEVICE_LIMIT_CLAUDEMD_BULLET } from '../core/PostUpdateMigrator.js';
 import { UPDATE_APPLY_VERIFY_HOLD_CLAUDEMD_LINE } from '../core/PostUpdateMigrator.js';
@@ -439,6 +441,7 @@ ${REAPER_BACKGROUND_WORK_BULLET}
 ${STANDING_SESSIONS_BULLET}
 ${REROUTED_LOGIN_EXPIRED_BULLET}
 ${INTERACTIVE_LOGIN_EXPIRED_BULLET}
+${CLAUDE_KEY_HEALTH_BULLET}
 - **Busy-orphan detection** (\`busyOrphanDetection\`, OBSERVE-ONLY, dark by default; dev agents on): the inverse blind spot. CPU-progress is a proxy for "useful" — but a *useless* process that SPINS (a hot-loop, a wedged job burning CPU) looks "active" and would keep a session pinned. When an idle session (idle prompt + flat transcript) is held only by a child that's *burning* CPU across an extended dwell, the reaper records a \`busy-orphan-suspected\` audit row (and \`busy-orphan-cleared\` on recovery). It NEVER changes the keep/kill decision — it just makes the "useless-but-busy child pins an idle session" case measurable, so safe auto-reclaim can graduate later with data. Read \`logs/reaper-audit.jsonl\` (filter \`busy-orphan-suspected\`).
 - Why it matters: idle sessions pile up across agents until the machine starves (CPU *or* memory) and new sessions get "spawn denied" — silently breaking cross-agent messaging. This sweeps them, but only under real pressure.
 - See current state / why each session is kept or flagged: \`curl -H "Authorization: Bearer $AUTH" http://localhost:${port}/sessions/reaper\` (the \`pressure.inputs\` shows freePct, loadPerCore, \`cpuBusyPct\` — real sampled CPU busy %, the signal that decides \`cpuTier\` since reaper-pressure-signals; the 1-min load average is reported but no longer decisive, because it read 9.4/core at 36-44% idle (its macOS computation is poorly documented; the measured disagreement is the evidence) — plus the compressor OBSERVABLES \`compressorPct\`, \`decompressionsPerSec\` and \`kernelMemoryPressureLevel\` (reported, grading nothing: none of them separated that laptop from a healthy machine when measured) — plus \`cpuSignal\`, \`sampledAt\`, \`windowMs\` and the memTier/cpuTier breakdown. A CPU figure appears only once a full 30 s window has elapsed; shorter is \`null\` (unknown ⇒ memory-only), never a startup spike. Rollback lever: \`monitoring.sessionReaper.cpuSignal: 'load'\` restores the legacy grading exactly; the busy thresholds are \`cpuModerateBusyPct\`/\`cpuCriticalBusyPct\` (75/90), and there are no compressor thresholds because no compressor grade ships). On a machine pool, add \`?scope=pool\` to get every machine's snapshot; the local snapshot stays at the top level and \`pool.machines\` carries peers. A dark, old, unreachable, or malformed peer is a classified \`pool.failed\` row — never a 500 or a silently local-looking answer.
@@ -1043,6 +1046,7 @@ ${ROUTING_SPEND_CLAUDEMD_SECTION(port)}
 ${MATURATION_BOARD_CLAUDEMD_SECTION(port)}
 ${MATURATION_LADDER_CLAUDEMD_SECTION(port)}
 ${QUEUE_PACE_CLAUDEMD_SECTION(port)}
+${RECOMMENDED_SERVICES_CLAUDEMD_SECTION(port)}
 ${ECOSYSTEM_IDEAS_CLAUDEMD_SECTION(port)}
 ${MOBILE_PAIRING_CLAUDEMD_SECTION(port)}
 ${MOBILE_CHAT_CLAUDEMD_SECTION(port)}
@@ -1844,6 +1848,8 @@ Record what I learn. Build infrastructure, not one-offs. Grow to meet the user's
 Your messages to the user pass an always-on LLM gate (the tone gate) before they send. It reviews high-stakes leaks (CLI commands, file paths, config keys, endpoints) AND the self-stop anti-patterns (B15–B19: quitting on yourself for a context/fatigue reason, calling a doable thing impossible, parking your own work on the user). The two families are treated DIFFERENTLY — the leak/representation rules are overridable nudges (see below); the self-stop family stays a hard block, because there the check exists to constrain YOU and your reason for overriding would come from the very reasoning it distrusts. It judges the behavioral rules **by MEANING, not by literal phrases — a paraphrase of the anti-pattern is caught exactly the same as the canonical wording**, so do not assume rewording evades it. The gate FAILS CLOSED (holds the message, queued for retry — never silently delivers) if it can't produce a verdict (provider down, unparseable output, or a slow-review timeout); the operator kill-switch is \`toneGate.failClosedOnExhaustion\`. Constitution: "Intelligent Prompts — An LLM Gate Must Not String-Match".
 
 ${TONE_ADVISORY_MIGRATION_CLAUDEMD_SECTION}
+
+${SURFACE_REFERRAL_CLAUDEMD_SECTION}
 ### Context-Aware Outbound Review (why was my message flagged / would my reply have been blocked?)
 
 Beyond the tone gate, a response-review pipeline (nine specialist reviewers driven by a Stop hook) evaluates each finished conversational turn. On most installs it is OFF BY CONFIG — \`GET /review/history\` returns 501 there; say so honestly rather than guessing. Where it runs, it is usually in WATCH MODE (\`responseReview.observeOnly: true\`): verdicts are recorded, nothing is blocked. The context-aware layer (⚗️ experimental, dev-gated dark: \`responseReview.conversationalContext\`) feeds the opted-in reviewer a bounded, untrusted-data-enveloped slice of recent conversation so "the operator asked for this technical detail" is an input it can actually judge — a one-way carve-out (it can only move a would-block toward PASS, never license credentials/PII, never touch the deterministic policy layer).
@@ -2733,6 +2739,9 @@ export const REROUTED_LOGIN_EXPIRED_MARKER = 'A job session stuck at an expired
 export const REROUTED_LOGIN_EXPIRED_BULLET = `- **${REROUTED_LOGIN_EXPIRED_MARKER}**: a scheduled job (or other one-shot) that runs as an interactive Claude session and lands under a login whose sign-in has expired shows \`Login expired · Please run /login\` and can do nothing. The monitor now ends it about a minute after it first sees that screen (reason \`rerouted-login-expired\`, a \`SessionManager.monitorTick.reroutedLoginExpired\` degradation naming the login folder) instead of letting it hold a job slot for the full 8-hour lifetime; the job runs again on its next trigger. ${REROUTED_LOGIN_EXPIRED_POOL_SENTENCE} If a user asks "why did my scheduled jobs stop running?" or "why did a job end straight away?" — check \`GET /jobs\` for a stale \`nextScheduled\`, then the server log for \`stuck at an expired login\`; the fix is signing that login in again.`;
 
 /** Content-sniff marker for the interactive expired-login bullet (CMT-1008, Migration Parity). */
+export const CLAUDE_KEY_HEALTH_MARKER = 'A rejected sign-in key is told and recovers';
+export const CLAUDE_KEY_HEALTH_BULLET = `- **${CLAUDE_KEY_HEALTH_MARKER}**: an agent signed in with one key (\`sessions.credentials.anthropic\`, the usual cloud install) passes that key to every Claude process on the server, including internal model calls. If Anthropic refuses the key twice, the operator gets one plain notice, each waiting person is told once, and \`GET /health\` (with the auth header) shows \`claudeKey.status: dead\`. The fix is a new key from \`claude setup-token\`, put in place with \`instar set-claude-key\` on the server (reads stdin or a hidden prompt, never an argument; never ask for the key in chat). Within a minute Instar checks it, and conversations stuck at the login screen restart by themselves and answer what they missed. A conversation that ended during the outage is not replayed. **When to use** (PROACTIVE): the user asks "why did you stop replying?" or "why does health say the model is failing?" → read \`claudeKey\` in \`GET /health\`. Off switches: \`sessions.claudeKeyHealth.enabled: false\` and \`sessions.claudeChildAuth.enabled: false\`.`;
+
 export const INTERACTIVE_LOGIN_EXPIRED_MARKER = 'A conversation stuck at an expired login moves to a signed-in account';
 
 /** Interactive expired-login awareness bullet (CMT-1008). Shared by the generated CLAUDE.md and PostUpdateMigrator. */

package/upgrades/1.3.1650.md

@@ -0,0 +1,105 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+An agent signed in with one key (`sessions.credentials.anthropic`, every headless cloud install) passed it to sessions only. `ClaudeCliIntelligenceProvider` ran `claude -p` with the server's own env, so every internal model call answered "Not logged in". Every server-side `claude` child now gets the same key: the provider's default and hardened paths, project rounds, the headless one-shot, Threadline pipe sessions, the lifeline doctor and triage. Direct children take it through their env; shell and tmux launches source a private file that is deleted before `claude` starts, so the key stays out of argv.
+
+New `ClaudeKeyHealth`, active only with an oauth-token configured. A failed call or a session at the login screen asks for a direct probe. Only Anthropic's 401, seen twice, makes a key dead; "Not logged in" is reported as an Instar fault. The operator gets one notice, each waiting person is told once, and authenticated `/health` shows `claudeKey`. `instar set-claude-key` puts a new key in place, a running server finds it within a minute with no restart, and once a probe proves it, conversations at the login screen restart and answer what they missed. `SessionManager.setAnthropicKey` carries the key into its config copy.
+
+Instar's own merge tool now refuses a pull request that changes the constitution registry unless its body names its counterpart in the other rule book, or says why it has none (`scripts/check-constitution-pairing.mjs`, used by `scripts/safe-merge.mjs`). The green-PR watcher treats that refusal as waiting on a body edit. Adds the map of differences between the two books and corrects the direction-guard document. Does nothing outside the two instar repositories.
+
+113 switched-off features now record what they do: when each fires, holds back or fails, with the reason and a few small facts. Rows go to the evidence log on development agents, so the maturation ladder can judge each feature by its own behaviour. No feature's behaviour changes. Decisions taken per message are limited to one row per window, and that row says how many it stood for.
+
+The feedback executor's early capacity check now uses the same limits as its actual confined canary and build spawns. It treats the final rerouted slot and the global overflow slot as reserved for scheduler-proven jobs. A full lane defers the feedback attempt before it claims an item, creates a workspace, or spends a start.
+
+An owner's paired phone (Instar iPhone app) can open the agent's dashboard console without typing the dashboard PIN. After the owner's Face ID or passcode, the app signs a one-time server challenge with a second Secure Enclave key that only signs after that check, receives a one-minute single-use ticket bound to that phone and address, and the console trades it once at `POST /dashboard/console-ticket` for the same token a PIN unlock returns. It never returns the operator session, so actions that need the PIN still ask for it. New device routes: `POST /mobile/device/presence-key`, `POST /mobile/console-ticket/challenge`, `POST /mobile/console-ticket` (owner phones only, TLS or loopback only). Audit: `.instar/state/mobile-console-tickets.jsonl` (metadata only). Off switch: `mobilePairing.consoleTicket.enabled: false`. MSP phones, phones without a passcode, and older app builds keep the PIN box.
+
+The Instar iPhone app can now show a session natively. A paired owner phone may read a session's screen with `GET /sessions/<name>/output` and type plain text into it with `POST /sessions/<name>/input`, both signed by the phone's device key. Two new entries in the device allowlist carry a new `ownerOnly` flag (MSP, unassigned, pending, revoked and unsigned requests are refused) and their own rate buckets. A device-only router mounted before the main routes handles them; Bearer requests to the same paths reach the existing handlers unchanged.
+
+The device path only reaches sessions running on this machine, matched exactly (tmux name, then id, then name). It refuses control characters, so the phone cannot press keys. It redacts this agent's token, the dashboard PIN and view signatures from the screen text. It keeps a durable 3-minute record of accepted inputs, so a captured request can never be typed twice, even across a restart. It logs each typed message (without its text) in `logs/mobile-session-input.jsonl`. A session on another machine is answered with a plain reason naming that machine; nothing is proxied. Typing is limited to 12 a minute per phone and 12 a minute across all phones.
+
+Everything that needs the operator now has one list, `dashboard/console/needs-model.js`, built from each page's own model: merging stopped, pull requests waiting for approval, feedback decisions, sign-ins, agents waiting, permission approvals, plans waiting on them, passwords requested, and spending limits that are on but not enforcing. Home's "What needs you" count and headline include all of it, and say "Nothing needs you that I can see" rather than a confident all-clear when one of those reads failed. Each page leads with its need and the control to act on it. Costs gets a new lead card, Development gets a button that opens Shipping when a pull request waits for approval, and the Agents pairing switch moves above the lists. Page wording no longer says "below". A warning that an invite leaked now offers "Make a new invite".
+
+A new advisory outbound rule, `B22_SURFACE_REFERRAL`, nudges an agent whose message sends the operator to a page without a direct link, the exact on-screen words, or having loaded the page at the operator's screen size first. It is a nudge with a recorded override, never a wall. After loading the page, the agent resends with `--tone-complied B22_SURFACE_REFERRAL`.
+
+Instar now keeps a signed, append-only record of a person's yes or no for each recommended outside service, and it replicates across the agent's machines where machine sync is on: the coherence journal is live, this store is on, and journal replication is enabled. The route's `replicating` field says whether it is. Rows written while it was off go out at the next boot once it's on. A no stands until the person confirms a yes that names it, so clock skew and delayed sync can't undo a refusal. A no needs the dashboard PIN. Old declines of Cloudflare and Git backup carry over as offer suppression only. The old suggestion paths no longer offer those two features. No offers go out yet.
+
+A rerouted one-shot that passes its configured hard lifetime can now finish its timeout cleanup even when the interactive process still appears active. The session manager checks the saved lane and deadline again before relaxing only process-activity vetoes. All other session protections remain. It now logs “Killed” only after termination succeeds.
+
+An end-to-end test now waits for the first resurfacer run instead of checking after a fixed 30 ms.
+
+## What to Tell Your User
+
+If your agent runs on a cloud server with a sign-in key, its background checks now work. Those checks review outgoing messages and sort incoming ones, and until now they failed quietly on these installs. If the key ever stops working, your agent tells you plainly and says how to fix it. Once a new key is in place, open conversations pick up by themselves. A conversation that ended during the outage is not replayed.
+
+Nothing changes for you. This only affects how Instar's own rule book is maintained.
+
+Nothing changes for you. Features still switched off now keep a record of what they did and why, so it's clear when each is ready to turn on.
+
+When background session capacity is full, feedback work waits cleanly for room instead of starting preparation and then failing at its safety check.
+
+Opening the dashboard from the Instar app on your phone no longer asks for the PIN after Face ID. Anything that changes something important still asks for the PIN. If the app ever says to pair the phone again, that restores PIN-free opening.
+
+The session button in a chat now opens the session right in the app: you see what the session is doing, live, and can type to it, with no browser and no PIN. There is also a Sessions list on the agent's page. Only your own phone can do this, and it can only type plain text, not special keys. If the agent hasn't been updated yet, the app offers the dashboard instead.
+
+Anything that needs you now shows on your home page and at the top of its own page, with the button right there. When I send you to a page, my message comes with a direct link and the exact words to look for, and I check the page first.
+
+Your choices about outside services like Tailscale or Bitwarden are now saved in one place. On agents with machine sync switched on, they follow you across your machines. I won't start offering these yet. That comes once setup for each one is proven.
+
+A worker that runs past its time limit no longer holds a subscription slot forever just because its process is still present. Its work is recorded as timed out and can follow the existing retry path. Recent user activity and the other session safety checks still protect live conversations.
+
+Nothing changes for you; this only makes a test reliable on busy machines.
+
+## Summary of New Capabilities
+
+- `instar set-claude-key` puts a new Claude sign-in key in place, from stdin or a hidden prompt.
+- Authenticated `GET /health` shows `claudeKey` on agents signed in with a key.
+- Off switches: `sessions.claudeKeyHealth.enabled: false` and `sessions.claudeChildAuth.enabled: false`.
+
+None for agents outside the Instar repositories. For maintainers: a pairing check for changes to the two rule books.
+
+- 113 more features can be judged from real records instead of reading "no data".
+
+Owner phones open the console signed in, using a single-use ticket backed by a Face ID-gated key the agent verifies itself.
+
+- Watch a session's screen live in the app, refreshed every second and a half.
+- Type to a session from the app (plain text, owner's phone only, logged without the text).
+- A native list of the agent's sessions, with machine and how long each has run.
+- Plain answers when a session has ended or runs on another of your machines.
+
+- One registry of what needs the operator, feeding Home's count and headline.
+- A test that fails the build when a page buries a need, offers no action for it, or points at a place in its wording.
+- `B22_SURFACE_REFERRAL`: an outbound nudge for sending the operator to a page.
+
+- `GET /recommended-services` shows the saved choice for each service.
+- `POST /recommended-services/:id/no` records a no, with the dashboard PIN and an optional reason category.
+
+None. This repairs the rerouted-session lifetime path.
+
+None.
+
+## Evidence
+
+Found on nimbus by the customer proof (fb-03ec0234-b5b, fb-1dc4a0ca-260): PromptGate 463/463 errors, `llmReliability` failing. Real CLI failure output was captured on Claude Code 2.1.316 and is pinned in `tests/unit/ClaudeKeyHealth.test.ts`. `tests/unit/claude-spawn-auth-class.test.ts` fails if a new `claude` launch site neither takes the key nor says why not.
+
+Unit and integration tests cover each outcome, including a failed read refusing as unknown. Run against real history since #2323, the checker reported drift on #2682, #2380, #2194, #2323 and instar-2 #182, none of which has a declaration line.
+
+Reproduction of the gap: 115 of 172 ladder entries read "no data" with nothing recording. After this, 2 remain, and neither can record from inside the server: one is a CI script, one has no decision point. Unit tests of every changed module pass, and the full run is the merge gate. Text is scrubbed and bounded; message text, prompts and credentials are not recorded.
+
+The production session manager's focused tests passed 65/65, covering the boundary where one rerouted slot remains reserved, the global session limit, actual refusal of a feedback canary, and continued admission of a scheduler-proven job. Build passed. Full unit, integration, end-to-end, and live post-deployment checks remain pending.
+
+Unit, integration and end-to-end tests cover single use, expiry, Host binding, revocation between mint and redeem, MSP refusal, replay after restart, the off switch, the throttle and the audit. A real-browser run against a throwaway agent opened the real console signed in with a valid ticket and showed the PIN box for a used, unknown or revoked one; its first run found and fixed a Host-comparison defect for phones paired on an IP address. The app's 158 unit tests pass. The no-second-prompt path on a real Secure Enclave runs first on the operator's phone and falls back to the PIN box if it fails.
+
+- Spec docs/specs/mobile-native-session-screen.md converged at the 6-round cap with GPT-6 Astra and the clean-door reader; review found and fixed control characters acting as keys, replay across a restart (twice), credential text in pane output, wrong-session targeting and event-loop blocking.
+- Unit: allowlist shape, owner-only flag, named buckets, text filter, exact resolution, miss classification, replay record (including after a restart), redaction, audit rotation, CLAUDE.md migration.
+- Integration: both sides of the allowlist through the production authenticator (owner allowed; MSP, unassigned, pending, revoked, notify token, unsigned and credential-less refused; Bearer passes through), session and machine binding, peer lookups, replay, buckets.
+- E2E: production AgentServer, a phone paired through redeem and confirm, reading and typing into a real session record.
+
+Each of the nine states was put on its real page through a proxy that refuses all writes, in a real browser at 1280x728 and 390x844: all 18 runs show the action on the first screen with no scrolling and no sideways scroll, and screenshots were read. Home named "Automatic merging is stopped" with a link to it when that state was on. `tests/unit/console-needs-first-screen.test.ts` renders the shipped pages and carries negative controls. A dashboard opened on another machine sees merging, approvals and password requests only for that machine, as those pages do today.
+
+`tests/unit/recommended-services-ledger.test.ts`, `tests/unit/recommended-services-wiring.test.ts`, `tests/integration/recommended-services-routes.test.ts` and `tests/e2e/recommended-services-alive.test.ts`. The e2e proves a real AgentServer answers 200, enforces the real PIN check, and keeps a no across a restart. Replication between two real machines has not been run live yet.
+
+On Echo, `dashboard-console-default` crossed 480 minutes. The server printed repeated kill attempts, while the durable reap log recorded `skipped:active-process` and the feedback executor stayed blocked at 6/6. A focused test now uses the real `ReapGuard` with active child and main-process signals and verifies the expired reroute ends; another verifies recent user activity still vetoes. The production-shape E2E test also checks the timeout through the HTTP session listing. Focused unit tests, build, lint, and independent review passed. Full three-tier verification remains before merge.

package/upgrades/mobile-console-device-signin.eli16.md

@@ -0,0 +1,5 @@
+# Dashboard without the PIN on your phone — plain English
+
+When you open the dashboard from the Instar iPhone app, the app has already checked your Face ID, but the dashboard still asked for its PIN. Now the phone proves it is you instead. It holds a second key in its secure chip that only works right after Face ID or your passcode. The app uses it to get a pass from the agent that works once, only for one minute, and only at the address it was issued for. The dashboard trades that pass for exactly what the PIN would have given it, and nothing more: approving or changing something important still asks for the PIN.
+
+A phone you have removed gets no pass, and a pass it got just before removal is refused. A copied request is useless because every pass needs a fresh challenge that the agent forgets after one use or a restart. The pass never appears in a web address, and the dashboard on the phone now keeps nothing on disk, which also clears an old sign-in an earlier PIN left there. Helpers' phones and phones without a passcode still see the PIN box, and whenever anything fails the dashboard simply shows the PIN box as before.

package/upgrades/side-effects/cloud-key-internal-calls.md

@@ -0,0 +1,116 @@
+# Side-Effects Review — cloud agents: sign-in key for internal calls, dead-key handling
+
+**Version / slug:** `cloud-key-internal-calls`
+**Date:** `2026-11-03`
+**Author:** `echo`
+**Second-pass reviewer:** `independent general-purpose reviewer agent`
+
+## Summary of the change
+
+Every server-side `claude` child now gets the configured oauth key through one helper (`claudeChildAuth`), reading the value PR #2632 already resolves. New `ClaudeKeyHealth` confirms a dead key with a direct probe, tells the operator and waiting people with fixed text, and restarts sessions stuck at the login screen once a working key is proven. New `instar set-claude-key`.
+
+## Decision-point inventory
+
+- Is the key dead — add — two 401s from Anthropic on direct probes.
+- Notify operator — add — after the self-heal re-read and confirmation.
+- Refresh a session — add — at the login screen, bounded per episode, through the ordinary work gate where it is on.
+- Skip the pool swap on a key agent — add — an env key overrides any pool account.
+- Tone gate, sentinel, external gate — pass-through — failure directions untouched.
+
+---
+
+## 1. Over-block
+
+The new code blocks nothing inbound or outbound. `set-claude-key` refuses a value that doesn't look like a `claude setup-token` key; a valid key of a future shape would be refused until `looksLikeClaudeToken` is updated. The pool swap is skipped on key agents, which is correct because an env key overrides any pool account.
+
+---
+
+## 2. Under-block
+
+A session that ended during an outage has its messages not replayed. A key-only agent with `subscriptionPath` set keeps today's behaviour on the opt-in tmux adapters. An API-key-only agent's internal calls stay failed, by the subscription-by-default rule. The three session lanes still pass the key in tmux `-e` argv.
+
+---
+
+## 3. Level-of-abstraction fit
+
+The key travels through one small module beside the config, not a parameter on eight provider callers, so a new caller can't forget it. A structural test holds that. Recovery reuses `SessionRefresh` and the login-screen classifier, and adds no second restart path.
+
+---
+
+## 4. Signal vs authority compliance
+
+Signals: internal call failures and the login screen. They only request a probe. Authority: Anthropic's own 401 on a real call, twice. A deterministic check is right here, because it reads a status code and judges no meaning. The refresh is further limited. Outside a recovery sweep, a matching launch key never refreshes. During the sweep after a proven outage, screen text is enough, once per session per key. The work gate applies where it is on, which is development agents. Elsewhere login text printed by a working session during that sweep can cost it one restart. That normally resumes the conversation; with no resume entry it starts fresh, and a failure mid-restart leaves no session until the next message. The worst case is one lost in-flight turn.
+
+---
+
+## 4b. Judgment-point check (Judgment Within Floors standard)
+
+All points are invariant: each reads a status code, a hash comparison or a counter. None weighs meaning.
+
+---
+
+## 5. Interactions
+
+- Circuit breaker: the probe bypasses it on purpose; the spawn cap still applies.
+- Pool swap: skipped on key agents through `prependInteractiveLoginExpiredSink`; unchanged elsewhere.
+- Triage lane: previously had no key and hardcoded `credentialSource: 'store'`. It now reports `env` when a key is passed.
+- Tone gate, sentinel and external gate start getting real answers on key agents, so messages that passed the fixed leak floor may now be held by a model verdict. That is the intended behaviour and a visible change for those agents.
+- Agents with a key and a stored login: internal calls move to the key, matching their sessions.
+- Stage-B release evidence: `claudeChildAuth.ts` is reached by import from the certified set, so it is listed as excluded with a reason. A Codex launch never reads it, and no certified file changed.
+
+---
+
+## 6. External surfaces
+
+New CLI command. Authenticated `/health` gains `claudeKey`, and public `/health` may read degraded while dead. Fixed text goes to the Telegram hub, the Slack attention channel and session channels. The probe makes one small authenticated call, and in `ok` state at most one per 5 minutes when signals arrive.
+
+---
+
+## 6b. Operator-surface quality (Operator-Surface Quality standard)
+
+The notice says what happened, what it means and the exact steps, in plain words. Restoring needs a computer, because `claude setup-token` has no phone form. This is stated in the spec's limits.
+
+---
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+Machine-local, a stated limit. The key lives in each machine's `config.json`, and sessions are local processes. Each machine notices and reports its own key and the operator restores each. `state/claude-key-health.json` is not replicated. Key-only installs today are single-machine.
+
+---
+
+## 8. Rollback cost
+
+Revert the PR, or set either off switch; both are read live. Config is not migrated. Leftovers are an unused state file and a CLAUDE.md note.
+
+---
+
+## Conclusion
+
+Safe to ship. The behaviour change for key agents is the fix itself. The live proof on nimbus is still required before calling it done.
+
+---
+
+## Second-pass review (if required)
+
+**Reviewer:** independent general-purpose reviewer agent, four passes over the code diff
+**Concurred:** yes, after the fixes listed below
+
+Independent reviewer, on the code diff. Found no credential leak and nine defects: a replaced key could be paged about, a restored key could go unprobed after a long outage, the refresh loop was not re-entrant, the confirm delay could be bypassed, a removed key was ignored, the off switch and base URL missed three entry points, env files stayed after a failed launch, late-bound Telegram topics were missed, and background promises had no catch. All nine fixed with tests. A second read found three more: the stated restart bound was inaccurate, recovery could still act after the key was removed, and the lifeline read its off switch from a frozen copy. All three fixed. A third read found the Slack respawner renames a session, so the once-per-key record missed it; fixed. The fourth read concurred. After that, the full unit lane found four catches over the no-silent-fallbacks ratchet: a failed session listing now files a degradation report, and three send failures carry an exemption because `delivered` drives the retry and its capped report. That small change was not re-read by the reviewer.
+
+---
+
+## Evidence pointers
+
+`tests/unit/ClaudeKeyHealth.test.ts`, `tests/unit/claudeChildAuth.test.ts`, `tests/unit/ClaudeCliIntelligenceProvider-key.test.ts`, `tests/unit/claude-spawn-auth-class.test.ts`, `tests/integration/claude-key-health-route.test.ts`, `tests/e2e/claude-key-alive.test.ts`.
+
+---
+
+## Class-Closure Declaration (display-only mirror)
+
+- **`defectClass`**: `unbounded-self-action`
+- **`closure`**: `guard`
+- **Citation**: `tests/unit/self-action-convergence.test.ts` (controller `claude-key-session-refresh`)
+- **Enforcement**: `ratchet`
+- **How caught**: `decideKeyRefresh` caps a session at 3 attempts, then it leaves the pending list and is reported. Nothing re-adds it within the episode, and a session already moved onto this key is skipped, so the count settles. Dead-key probes back off to a 1-hour ceiling and stop after 24 hours.
+
+The separate class this change closes, a server-side child that needs a credential but inherits only the server's own env, is held by `tests/unit/claude-spawn-auth-class.test.ts`.

package/upgrades/side-effects/constitution-alignment.eli16.md

@@ -0,0 +1,11 @@
+# Pairing check for the two rule books, in plain words
+
+Instar 1.x and 2.0 each have a written copy of the rules, and changes to one often never reached the other. This adds the first working part of the requirement Justin asked for.
+
+Any pull request that changes the 1.x rule book now has to carry one line: which matching change it pairs with in 2.0, or why it has none. My merge tool checks that the line is there and that the named change really exists and really touches the other book. If not, it refuses and says exactly what to add. Adding the line doesn't cancel an approval.
+
+It only checks that a pair exists. Whether the two say the same thing, or whether "no pair needed" is honest, stays with the independent review.
+
+Nothing here changes the rule books themselves. Those wordings still need Justin's own approval, and come separately. This also adds a map of how the two books differ today, and corrects one document that wrongly said no rule change could land at all.
+
+Other agents are unaffected: the check does nothing outside these two repositories. To undo it, revert this change. No data needs fixing.

package/upgrades/side-effects/constitution-alignment.md

@@ -0,0 +1,69 @@
+# Side-Effects Review — constitution pairing check and merge-tool wiring
+
+**Version / slug:** `constitution-alignment`
+**Date:** `2026-11-03`
+**Author:** `echo`
+**Second-pass reviewer:** `independent subagent, appended below`
+
+## Summary of the change
+
+Step 1 of `docs/specs/constitution-alignment.md`. Adds `scripts/check-constitution-pairing.mjs`: every PR touching a constitution book must name its counterpart in the other repository, or say why it has none. `scripts/safe-merge.mjs` refuses a registry PR that doesn't. `GreenPrAutoMerger` treats that refusal as waiting on a body edit. Also adds the map of existing differences and corrects `docs/STANDARDS-DIRECTION-GUARD.md`. No constitution text changes here. Tier 2; 5 spec review rounds of a cap of 6; about 6 files and 450 lines, most of it tests.
+
+## Decision-point inventory
+
+- safe-merge refusal on a missing or unreal declaration: **add**, invariant. Existence only.
+- `none:` honesty and same-obligation: judgment-candidate, held by the independent review of each change. No code here decides it.
+
+## 1. Over-block
+
+A PR touching the registry with no line is refused until one line is added. That includes a typo fix; the requirement says all updates. Clearing it takes one body edit and dismisses no approval. A failed read of a named counterpart refuses a registry PR with state `unknown`. A failed read of the PR's own file list refuses *any* PR on this repository with state `unread`, because whether it touches a book isn't known; its message says to retry and the watcher re-reads in 15 minutes. safe-merge already stops on any failed `gh` read a moment earlier or later, so this adds no new class of outage, only one more read that can hit it.
+
+## 2. Under-block
+
+- A dishonest `none:`, or a pair that changes something else in the other book. Not visible to a script. The independent review and the operator's review hold it.
+- A merge not going through safe-merge, and every merge in instar-2. Caught by the daily run, within a day.
+- A PR body edited after merge can mislead the daily read. Accepted.
+
+## 3. Level-of-abstraction fit
+
+The merge funnel is the right layer in instar: the base-branch refusal lives at the same point. A GitHub required status check would be stronger but needs the operator's admin action on two repositories, and the daily run backs it up.
+
+## 4. Signal vs authority
+
+Compliant, per `docs/signal-vs-authority.md`: the blocking authority covers a closed existence question, in the shape of the Maturation Path plan gate, over inputs no model is needed to read. All judgment of meaning stays with a mind. The refusal is cheap to clear and says exactly how.
+
+## 5. Interactions
+
+- Sits immediately after `nonMainBaseRefusal`, before every floor. Base refusal still wins for a stacked PR.
+- `GreenPrAutoMerger`: new branch, no ladder attempt, re-read every 15 minutes, since the fix moves no head. Without it, the default ladder would give up. A body edit therefore takes up to 15 minutes to be seen. An approved registry PR with no line waits on audit only, with no attention item: the author is me, and the reader of that item would be the operator, who can't fix it.
+- Adds two `gh` reads per safe-merge run on `JKHeadley/instar`. A registry PR adds a read of the counterpart. Negligible.
+- `scripts/safe-merge.mjs` now imports a sibling file, the same way it imports its existing siblings.
+
+## 6. External surfaces
+
+Instar's own PR process only. `scripts/` ships to the fleet, where this is inert: any repository but the two named no-ops. No user-facing change, no message, no route.
+
+## 7. Multi-machine posture
+
+Unified. No local state: GitHub is the only record. The same script behaves identically on every machine.
+
+## 8. Rollback
+
+Revert. Removes the refusal and the watcher branch. No data migration. The daily job, added at landing on Echo, is disabled in one edit.
+
+## Evidence
+
+- Unit: `tests/unit/check-constitution-pairing.test.ts`. Integration: `tests/integration/safe-merge-constitution-counterpart.test.ts` runs the real script with a fake `gh`, including the refusal path, the unreadable-counterpart path, and a PR touching no book.
+- Live positive control, against real history since #2323: `paired=0 declared-none=0 waiting=0 overdue=0 drift=5 no-pr=0`, naming #2682, #2380, #2194, #2323 and instar-2 #182. All five lack a line, so this proves the no-line class only; fixtures cover the rest. A real TLS failure on an earlier run printed `unknown` and did not read as clean.
+
+## Ladder line
+
+This spec has no flag, so its plan says `ladder: not applicable: no flag.` The ladder's coverage test now accepts that form, with a reason, and still refuses a name that matches no entry.
+
+## Second-pass review
+
+**Reviewer:** independent general-purpose subagent, on claude-opus-5-5
+
+Independent subagent, 2026-11-03. Concern raised: a failed first read refused every PR on the repository, labelled as a constitution change. Verified live with a 404. Resolved: a separate `unread` state with its own message, this artifact and the spec corrected, tests added. It also found that a line naming a nonexistent PR made the whole daily run `unknown`; now one row of drift, tested. Everything else it checked held: standalone run from a temp directory, real page shapes, state mapping, `nextEligibleAt`. Recorded after fixing; the concern is resolved by these changes rather than concurred with as first written.
+
+**Second-pass re-check of the fix:** Concur with the review.

package/upgrades/side-effects/feature-evidence-recording.eli16.md

@@ -0,0 +1,3 @@
+# Recording what switched-off features do, in plain words
+
+To judge a switched-off feature, you need a record of what it actually did. Most of them kept none, so the maturation ladder could only say "no data". This adds one line at the point where each of 113 features makes its decision: it fired, it held back, or it failed, with the reason and a few small facts. It changes nothing about what the feature does, and a failure to record can never break the feature. It never records message text, prompts or credentials. It's off on the fleet for now, like the ladder itself. Two features can't record this way, because they don't run inside the server, and they stay marked as needing it.

package/upgrades/side-effects/feature-evidence-recording.md

@@ -0,0 +1,66 @@
+# Side-Effects Review — Evidence recording in switched-off features
+
+**Version / slug:** `feature-evidence-recording`
+**Date:** `2026-11-03`
+**Author:** `echo`
+**Second-pass reviewer:** `independent subagent, appended below`
+
+## Summary of the change
+
+Adds `featureEvidence.record` (and `recordAtMostEvery` for per-message paths) at the decision points of 113 features across 85 files, and marks them measured in the registry. Spec: `docs/specs/feature-maturation-ladder.md` §4 and §13. Tier 2 by spread; each call is additive and cannot change behaviour.
+
+## Decision-point inventory
+
+No decision point is added or changed. Each call observes a decision that already happened.
+
+---
+
+## 1. Over-block
+
+No block/allow surface — over-block not applicable.
+
+## 2. Under-block
+
+No block/allow surface. Recording misses what a feature cannot see about itself: a wrong decision reads like a right one until graded. Agents flagged double replies, wrongly refused holders and spurious reaps as undetectable from inside; the review's grading covers those.
+
+## 3. Level-of-abstraction fit
+
+One thin call at each feature's decision point, through one log. Hook scripts and CI scripts cannot call it and are listed as not covered.
+
+## 4. Signal vs authority compliance
+
+Signals only; no call's result is read. Reference: `docs/signal-vs-authority.md`.
+
+## 5. Interactions
+
+The call appends synchronously, so it stays off per-tick paths; per-message paths use `recordAtMostEvery`. `catch` blocks that gained a recording call stay non-throwing. The log is wired only when the ladder is on, so on the fleet every call is a no-op, and rows from before the log is wired at boot are lost. A source-order test on `/messages/relay-agent` used a 30 KB window that the added lines outgrew; widened to 40 KB.
+
+## 6. External surfaces
+
+None. Rows stay on the machine; only numbers leave. `context` holds reason codes, counts and non-secret ids, and text passes `scrubForStore`.
+
+## 7. Multi-machine posture
+
+Per-machine facts read through each machine's route and the board, as the spec states.
+
+## 8. Rollback cost
+
+Revert, or set `maturation.ladder.enabled` false, which makes every call a no-op.
+
+## Evidence
+
+`tsc` clean; unit tests of each changed module; `tests/unit/FeatureEvidenceLog.test.ts`; the full run is the merge gate.
+
+## Second-pass review
+
+**Reviewer:** independent general-purpose subagent, on claude-opus-5-5
+
+Independent subagent, first read: "Concern raised". `allPeersPresumedGone()` in a record's arguments could throw on a corrupt registry just before the lease self-suspend, so the self-fence would be skipped; three per-message or per-request paths recorded without the limiter; one `.message.slice` could throw on a non-Error. All fixed: those facts came out of the lease context, the three paths use `recordAtMostEvery`, and the error read is guarded. A wider grep of added arguments found no other call that can throw on a load-bearing path. It found no message text or credentials in the sampled context, and every feature id in the registry. It sampled by risk, not all 85 files. Concur after fixes.
+
+## Class-Closure Declaration
+
+`unbounded-self-action`: closure `n/a`. These calls observe decisions other code already made; none triggers an action or a retry. Row volume is bounded by rotation and, on per-message paths, by `recordAtMostEvery`.
+
+## Stage-B certified set
+
+`src/monitoring/DegradationReporter.ts` sits in the certified Codex delivery closure and gained a recording call, so the evidence log and its rotation helper entered the closure. Both are listed as excluded, with reasons: write-only, never throwing, and off the delivery path. The certified fingerprint is unchanged.

package/upgrades/side-effects/feedback-reroute-admission-parity.md

@@ -0,0 +1,77 @@
+# Side-Effects Review — feedback reroute admission parity
+
+**Version / slug:** `feedback-reroute-admission-parity`  
+**Date:** 2026-11-04  
+**Author:** Echo  
+**Second-pass reviewer:** independent reroute-lifetime reviewer
+
+## Summary of the change
+
+The feedback executor asks `SessionManager.confinedRerouteCapacity()` before claiming a ranked item. Its canary and worker sessions are not scheduler-proven, but the precheck counted a slot reserved for scheduled jobs. At five of six rerouted sessions, a live tick claimed a priority-95 retry and prepared a workspace; the canary was then refused at its actual `5/5` limit. `src/core/SessionManager.ts` now applies the same non-scheduler global cap and shared reroute admission cap at the precheck and spawn gate. Two unit test files cover both sides of the reservation. No new slot is granted.
+
+## Decision-point inventory
+
+- `confinedRerouteCapacity()` — modified — returns saturation before the feedback executor claims work.
+- `evaluateRerouteGate()` — modified to share the cap helper; its existing spawn authority and scheduled-job exception remain.
+- Feedback executor ranked selection and independent review — passed through without change.
+
+## 1. Over-block
+
+At five of six rerouted sessions, a feedback worker now waits even if the sixth slot is idle. That is intended: the sixth slot is reserved for a scheduler-proven job, and the feedback worker's canary would otherwise be refused. A one-slot host retains its full single slot, so it is not blocked by a reservation it cannot spare.
+
+## 2. Under-block
+
+The precheck is a snapshot. Another session can take the last available place before the canary starts; the spawn gate still refuses it. Memory pressure can also change between the two checks. This patch does not add a reservation or a worker queue and cannot guarantee an immediate start.
+
+## 3. Level-of-abstraction fit
+
+The precheck is an early resource-capacity signal for the executor, while the spawn gate remains the final authority. Both use the same `SessionManager` counters and cap helper. A separate executor-side copy of the limits would drift again.
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+This is a deterministic resource safety invariant: the non-scheduler worker cannot spend the scheduler's reserved slot. The early check feeds the executor's admission decision; the existing spawn gate continues to enforce the hard limit. No judgment about a report's meaning, priority, or user intent is added.
+
+## 4b. Judgment-point check
+
+No new static heuristic at a competing-signals decision point. The available slot count and scheduler provenance are enumerable resource facts defined by the approved confined-spawn spec. Triage ranking remains the model-governed decision point.
+
+## 5. Interactions
+
+- **Shadowing:** the precheck runs before the canary and prevents a known futile claim; the canary still runs when the precheck says available.
+- **Double-fire:** no new action fires; both checks read the same session state.
+- **Races:** a concurrent spawn can still take the slot between checks; the spawn gate refuses safely.
+- **Feedback loops:** repeated capacity ticks can stay idle until a slot frees. No retry budget or ranking changes.
+
+## 6. External surfaces
+
+The executor may claim fewer feedback items during capacity pressure and records `admission:reroute-capacity` instead of claiming then stopping at canary. No API shape, secret handling, Telegram delivery, or durable schema changes. A deployed agent receives the code through the ordinary Instar update path. The fix queue continues to grow while all worker slots are occupied.
+
+## 7. Multi-machine behavior
+
+**Machine-local by design:** session slots and memory pressure are facts about the machine that would run the canary; each host must read its own counters. The drain owner still controls the single executor writer. This change emits no new user-facing notice, stores no new state, and generates no URL.
+
+## 8. Rollback cost
+
+Revert this code change and ship a patch. No migration or state cleanup is needed. During rollback, the old false admission can recur under the reserved-slot boundary; the spawn gate still refuses the unsafe start.
+
+## Conclusion
+
+The change aligns the early feedback admission with the final spawn guard and preserves the scheduler reservation. Build, full unit suite, focused real-manager tests, and exact-head three-tier verification at `39400fb38` passed. The live receipt after deployment remains required. The original commit lacked a decision-audit record; this review and a new gated commit will repair that evidence gap before merge.
+
+## Second-pass review
+
+**Reviewer:** independent reroute-lifetime reviewer  
+**Independent read of the artifact:** concur. The reviewer checked the 1-slot and 2-slot boundaries, the scheduler exception, the global overflow test, and the residual race. The existing spawn gate remains authoritative. The reviewer noted that the older precheck already returned `saturated` at the global max before checking mode; this patch preserves that order and aligns it with the final global gate.
+
+## Evidence pointers
+
+- Approved spec: `docs/specs/confined-spawn-subscription-reroute.md`.
+- Focused real-SessionManager tests: 65 passed; executor capacity tests: 7 passed.
+- Exact-head local verification at `39400fb38` against main `7840c5ff`: unit 3,121 files / 57,051 tests, integration 675 / 5,507, E2E 499 / 3,746; zero failures.
+- Live pre-fix refusal: feedback canary at `5/5`, with no worker session launched.
+
+## Class-Closure Declaration (display-only mirror)
+
+No agent-authored-artifact defect. This changes an early capacity query and a shared cap calculation; it does not add or modify a self-triggered controller's action, cadence, or retry edge. The existing executor tick remains bounded by its previous limits.