instar 1.3.1649 → 1.3.1651

package/src/data/stageBCertifiedSet.ts

@@ -23,6 +23,18 @@ export const STAGE_B_CERTIFIED_SET = {
     "src/core/StageBStartupReadiness.ts"
   ],
   "excluded": [
+    {
+      "file": "src/core/claudeChildAuth.ts",
+      "reason": "Claude-only helper that passes the sign-in key to claude children; a Codex launch never reads it, so it cannot change the behaviour the Stage-B evidence certifies."
+    },
+    {
+      "file": "src/monitoring/FeatureEvidenceLog.ts",
+      "reason": "Write-only evidence log reached through DegradationReporter; its calls never throw, return nothing the caller reads, and do not alter the certified Codex Stage-B delivery path."
+    },
+    {
+      "file": "src/utils/jsonl-rotation.ts",
+      "reason": "Size-based log rotation used only by the evidence log in this closure; it never throws and does not alter the certified Codex Stage-B delivery path."
+    },
     {
       "file": "src/scheduler/jobScriptProtocol.ts",
       "reason": "Shared deterministic script-job output parser reached through scheduler imports; it does not alter the certified Codex Stage-B delivery path and has separate script protocol unit and lifecycle coverage"

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "e9eb5bb7f56ce6f81c5f80210c1ec7999d4b8c7d2ff1ab5cfd97a269172ce2ac",
-  "packageVersion": "1.3.1649",
+  "packageVersion": "1.3.1651",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "925a6e27d3abc6b957a8e865a9623c9a4a607cc43ddbf9bbe70cc8193b2f0e0e",
+  "sha256": "eae2d0da679c49a33c433ae8c4a70b386075115535f1bb0785025e914bd65db0",
   "registrySha256": "e9eb5bb7f56ce6f81c5f80210c1ec7999d4b8c7d2ff1ab5cfd97a269172ce2ac",
-  "packageVersion": "1.3.1649"
+  "packageVersion": "1.3.1651"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "e9eb5bb7f56ce6f81c5f80210c1ec7999d4b8c7d2ff1ab5cfd97a269172ce2ac",
   "articleCount": 93,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1649"
+  "packageVersion": "1.3.1651"
 }

package/src/data/state-coherence-registry.json

@@ -2155,6 +2155,24 @@
         "note": "Never pruned by design: a message signed by a key must stay checkable after the key is revoked. One activation and at most one revocation row per paired phone key per writing machine, so it grows only with pairings."
       }
     },
+    {
+      "category": "recommended-services",
+      "description": "A person's yes and no choices about recommended outside services (docs/specs/recommended-services.md): an append-only signed ledger that replicates as the recommendedServices store.",
+      "scope": "must-be-coherent",
+      "freshness": "eventual",
+      "conflictShape": "append-only",
+      "transport": "peer-http",
+      "paths": [
+        "state/recommended-services/"
+      ],
+      "grandfathered": false,
+      "retention": {
+        "class": "C",
+        "access": "jsonl",
+        "complianceHold": true,
+        "note": "Never pruned by design: dropping a row could undo a person's no. Volume is tiny: at most a few rows per service per person."
+      }
+    },
     {
       "category": "ecosystem-ideas",
       "description": "The ecosystem idea pipeline (docs/specs/ecosystem-idea-pipeline.md): an append-only event ledger that replicates as the ecosystemIdeas store, a per-machine framework admission record and notice dedupe. Source mirrors and index.db in the same directory are a rebuildable cache.",

package/src/scaffold/templates.ts

@@ -21,7 +21,10 @@ import { JOB_DECLARED_FAILURE_AWARENESS } from "../scheduler/jobDeclaredFailure.
 // function call inside generateClaudeMd — no module-init cycle (PostUpdateMigrator
 // never imports templates).
 import { APPRENTICESHIP_STALL_GATE_CLAUDEMD_SECTION, SESSION_LISTING_HYGIENE_CLAUDEMD_SECTION, PLAYWRIGHT_PROFILE_REGISTRY_CLAUDEMD_SECTION, MACHINE_LOAD_ASSESSMENT_CLAUDEMD_SECTION, CODEX_CONNECT_CLAUDEMD_SECTION, FEATURE_SWITCH_CLAUDEMD_SECTION, NORMAL_CHROME_BROWSER_CLAUDEMD_SECTION, SINGLE_MACHINE_FAILOVER_GAP_CLAUDEMD_SECTION, MISSING_LOGIN_SESSION_CLAUDEMD_SECTION, DYNAMIC_MCP_CLAUDEMD_SECTION, ULTRACODE_SPAWN_CLAUDEMD_SECTION, AGENT_SIGNATURE_PROVENANCE_CLAUDEMD_SECTION, SENDER_REJECTION_CLAUDEMD_SECTION, SCOPE_ACCRETION_CLAUDEMD_SECTION, MESH_SELF_HEALING_CLAUDEMD_SECTION, LEASE_MEDIUM_CLAUDEMD_SECTION, WRITE_ADMISSION_CLAUDEMD_SECTION, DOORWAY_REGISTRY_CLAUDEMD_SECTION, EXTERNAL_HOG_CLAUDEMD_SECTION, ROUTING_SPEND_CLAUDEMD_SECTION, MATURATION_BOARD_CLAUDEMD_SECTION, MATURATION_LADDER_CLAUDEMD_SECTION, QUEUE_PACE_CLAUDEMD_SECTION, ECOSYSTEM_IDEAS_CLAUDEMD_SECTION, MOBILE_PAIRING_CLAUDEMD_SECTION, MOBILE_CHAT_CLAUDEMD_SECTION, APP_CONVERSATIONS_CLAUDEMD_SECTION, MOBILE_ROUTES_CLAUDEMD_SECTION, MOBILE_PUSH_CLAUDEMD_SECTION, MOBILE_PEOPLE_CLAUDEMD_SECTION, DECISION_QUALITY_CLAUDEMD_SECTION, BENCHMARK_DIVERGENCE_CLAUDEMD_SECTION, DUPLICATE_RECONCILER_CLAUDEMD_SECTION, AUDIT_CONVERGENCE_CLAUDEMD_SECTION, TONE_ADVISORY_MIGRATION_CLAUDEMD_SECTION, DECISION_JOURNAL_CONFIDENCE_CLAUDEMD_GUIDANCE, WINDOW_RUN_LIVENESS_CLAUDEMD_SECTION, SCRIPT_JOBS_CLAUDEMD_SECTION, SESSION_HANDOFF_CLAUDEMD_SECTION, JOB_RESULT_SUPERVISION_CLAUDEMD_SECTION, DEDICATED_PROFILE_REGISTRY_ROW_ANSWER, CODEX_ARM_SWEEPER_CLAUDEMD_SECTION, MACHINE_MAINTENANCE_CLAUDEMD_SECTION, APP_MEDIA_CLAUDEMD_SECTION, MACHINE_BROWSER_CARE_CLAUDEMD_SECTION, PAIRING_WITHOUT_TELEGRAM_CLAUDEMD_SECTION, SLACK_FROM_APP_CLAUDEMD_SECTION, MACHINE_MAINTENANCE_POOL_CLAUDEMD_SECTION, MACHINE_WEDGE_CLAUDEMD_SECTION } from '../core/PostUpdateMigrator.js';
+import { SURFACE_REFERRAL_CLAUDEMD_SECTION } from '../core/PostUpdateMigrator.js';
+import { RECOMMENDED_SERVICES_CLAUDEMD_SECTION } from '../core/PostUpdateMigrator.js';
 import { MINIMUM_OPERATOR_EFFORT_CLAUDEMD_SECTION } from '../core/PostUpdateMigrator.js';
+import { POOL_READINESS_CLAUDE_MD_LINE } from '../core/PostUpdateMigrator.js';
 import { CODEX_DEVICE_LIMIT_CLAUDEMD_BULLET } from '../core/PostUpdateMigrator.js';
 import { UPDATE_APPLY_VERIFY_HOLD_CLAUDEMD_LINE } from '../core/PostUpdateMigrator.js';
 
@@ -439,6 +442,7 @@ ${REAPER_BACKGROUND_WORK_BULLET}
 ${STANDING_SESSIONS_BULLET}
 ${REROUTED_LOGIN_EXPIRED_BULLET}
 ${INTERACTIVE_LOGIN_EXPIRED_BULLET}
+${CLAUDE_KEY_HEALTH_BULLET}
 - **Busy-orphan detection** (\`busyOrphanDetection\`, OBSERVE-ONLY, dark by default; dev agents on): the inverse blind spot. CPU-progress is a proxy for "useful" — but a *useless* process that SPINS (a hot-loop, a wedged job burning CPU) looks "active" and would keep a session pinned. When an idle session (idle prompt + flat transcript) is held only by a child that's *burning* CPU across an extended dwell, the reaper records a \`busy-orphan-suspected\` audit row (and \`busy-orphan-cleared\` on recovery). It NEVER changes the keep/kill decision — it just makes the "useless-but-busy child pins an idle session" case measurable, so safe auto-reclaim can graduate later with data. Read \`logs/reaper-audit.jsonl\` (filter \`busy-orphan-suspected\`).
 - Why it matters: idle sessions pile up across agents until the machine starves (CPU *or* memory) and new sessions get "spawn denied" — silently breaking cross-agent messaging. This sweeps them, but only under real pressure.
 - See current state / why each session is kept or flagged: \`curl -H "Authorization: Bearer $AUTH" http://localhost:${port}/sessions/reaper\` (the \`pressure.inputs\` shows freePct, loadPerCore, \`cpuBusyPct\` — real sampled CPU busy %, the signal that decides \`cpuTier\` since reaper-pressure-signals; the 1-min load average is reported but no longer decisive, because it read 9.4/core at 36-44% idle (its macOS computation is poorly documented; the measured disagreement is the evidence) — plus the compressor OBSERVABLES \`compressorPct\`, \`decompressionsPerSec\` and \`kernelMemoryPressureLevel\` (reported, grading nothing: none of them separated that laptop from a healthy machine when measured) — plus \`cpuSignal\`, \`sampledAt\`, \`windowMs\` and the memTier/cpuTier breakdown. A CPU figure appears only once a full 30 s window has elapsed; shorter is \`null\` (unknown ⇒ memory-only), never a startup spike. Rollback lever: \`monitoring.sessionReaper.cpuSignal: 'load'\` restores the legacy grading exactly; the busy thresholds are \`cpuModerateBusyPct\`/\`cpuCriticalBusyPct\` (75/90), and there are no compressor thresholds because no compressor grade ships). On a machine pool, add \`?scope=pool\` to get every machine's snapshot; the local snapshot stays at the top level and \`pool.machines\` carries peers. A dark, old, unreachable, or malformed peer is a classified \`pool.failed\` row — never a 500 or a silently local-looking answer.
@@ -626,7 +630,8 @@ Two layers keep my machine-to-machine \"ropes\" (Tailscale / LAN / Cloudflare) h
 - **Idle vs broken machine (WS4.2):** the same \`pool.machines[]\` carries an explicit per-machine state so an idle machine never reads as broken. A machine with ZERO sessions gets \`pool.machines[].emptyState\` = \`online — no active sessions\` (heartbeat-fresh, just idle) / \`offline since <t>\` (known offline) / \`unreachable (last seen <t>)\` (was online, now not answering — the \`failed\` case). Honest derivation from the registry online flag + last-seen + the live fan-out — never a fabricated "looks fine". The dashboard sessions view renders these per-machine; a machine WITH sessions gets no empty-state (its tiles already name it). Single-machine install = just the lone self row.
 - **Honest machine state (trustworthy-machine-load, P1):** every \`pool.machines[]\` row now carries \`liveness\` = \`live\` / \`unreachable\` (shape \`struggling\` | \`refusing\` | \`silent\`) / \`stale\` / \`unknown\`, each with the evidence age and source, plus a ready-made \`livenessLine\` (\`<liveness>, last evidence <age> ago from <source>\`) and the freshest other-machine sighting ("Mac Mini reached it 3 min ago"). The last DIRECT contact is saved to disk, so a server restart renders \`stale, last evidence 20 min ago\` instead of "offline". **Never say a machine is "offline" without positive evidence** (a shutdown announcement or the sleep gate): quote the liveness, its age and its source — an overloaded machine looks exactly like a dead one to a plain timeout. Each row also carries a multi-signal \`loadReport\` (cores, CPU idle, available memory, native memory pressure, server event-loop lag, sessions in use) and \`loadVerdict\` = \`ok\` / \`elevated\` / \`saturated\` / \`impaired\` / \`unknown\` — a report older than 60 s reads \`unknown\`, and a peer on older code reads \`unknown\`, never \`ok\`. Reporting only: the \`online\` flag, placement and ownership keep their existing semantics in this phase.
 - **Overload admission (trustworthy-machine-load, P2):** each machine protects its own resources. When its own \`loadVerdict\` is \`saturated\` or \`impaired\` it CLOSES to new automatic work (scheduled jobs, helpers, placement of new conversations): the work waits and is retried, nothing is dropped, and existing conversations keep working. It reopens after five consecutive good samples (about 75 s). One host-wide **recovery slot** (shared by every agent on the machine) stays free so a session the operator asks for can always start and assess the machine. Placement never puts new work on a machine that is refusing it; if every machine refuses, the message stays in the durable inbound queue (\`all-machines-refusing-work\`). Registry First: \`GET /work-admission\` → \`{ enabled, dryRun, enforced, acceptingWork, lastVerdict, recoverySlot, counters }\`; each machine's \`loadReport.acceptingWork\` / \`admissionEnforced\` in \`GET /pool\`; audit \`logs/work-admission.jsonl\`. Ships dev-gated + dry-run (\`monitoring.workAdmission\`: it logs what it WOULD refuse, refuses nothing, and peers keep placing work here until \`dryRun:false\`). When the user asks "why didn't a job run / why is this machine not taking work?" → read \`GET /work-admission\` before guessing.
-- **Overload shed (trustworthy-machine-load, P3):** a machine that has refused new work for 3 minutes moves its EXISTING conversations off, one at a time, to a healthy machine (direct contact under 2 min, \`loadVerdict\` \`ok\`, not refusing work, at least 2 free session slots after what it has already reserved there). The move is an ordinary cooperative ownership transfer through the reconciler, like a pin move but never written as a pin. Pinned conversations, Slack conversations and conversations with a live autonomous run stay. Brakes: at most 2 moves an hour, 2 tries per conversation per overload episode, the same conversation is not moved again for 30 min, and a machine seen refusing work in the last 30 min never receives moved work. A started transfer is driven to claim or cancelled after its deadline even if the plan behind it is gone. Stale-owner notices say "struggling" or "refusing" when that is the evidence. Registry First: \`GET /overload-shed\` → \`{ enabled, dryRun, overloadedSince, isSource, liveMove, reservations, movesLastHour, counters }\`; audit \`logs/overload-shed.jsonl\`. Ships dev-gated + dry-run (\`monitoring.overloadShed\`: it logs what it WOULD move, moves nothing, and also moves nothing while overload admission is in dry-run). When the user asks "why did my conversation move machines?" or "why is this overloaded machine still holding work?" → read \`GET /overload-shed\` before guessing.
+${POOL_READINESS_CLAUDE_MD_LINE}
+- **Overload shed (trustworthy-machine-load, P3):** a machine that has refused new work for 3 minutes AND is at 85% or more of its session limit moves a conversation off, one at a time, to a healthy machine (direct contact under 2 min, \`loadVerdict\` \`ok\`, not refusing work, at least 2 free session slots after what it has already reserved there). Only conversations with a running session that has sat quiet for 10 minutes move, so this frees session slots and memory, not CPU. The move goes through the same drain as a manual transfer: the session here closes and the conversation carries on there at its next message. Pinned conversations, Slack conversations and conversations with a live autonomous run stay. Brakes: at most 2 moves an hour, 2 tries per conversation per overload episode, a moved conversation stays put for 6 hours wherever it landed, and a machine seen refusing work in the last 30 min never receives moved work. Live moves need pool stage \`rebalance\`, a fresh rebalance proof on this machine, and \`dryRun: false\`; otherwise it only logs what it WOULD move. Each machine earns its proof with \`POST /session-pool/rebalance-proof\` \`{ topic, to }\` (202 with a run id; \`GET /session-pool/rebalance-proof/RUN_ID\` for the result), which really moves a topic listed in \`multiMachine.sessionPool.rebalanceProofTopics\` and passes only if the old session is gone and the target answers once. A proof lasts 30 days; without a fresh one the stage steps down to \`live-transfer\`. Stale-owner notices say "struggling" or "refusing" when that is the evidence. Registry First: \`GET /overload-shed\` → \`{ enabled, dryRun, overloadedSince, isSource, liveMove, reservations, movesLastHour, counters }\`; audit \`logs/overload-shed.jsonl\` (\`would-move\` and \`move-outcome\` rows carry the numbers behind each decision). Ships dev-gated + dry-run (\`monitoring.overloadShed\`). When the user asks "why did my conversation move machines?" or "why is this overloaded machine still holding work?" → read \`GET /overload-shed\` before guessing.
 - **Post-transfer closeout (automatic):** when a topic moves to another machine, the OLD machine's session for it is closed automatically (closed by the transfer's drain step when the current machine can drain, otherwise within ~2 reaper ticks) — no duplicate sessions doing duplicate work. The close is recorded in the reap-log with reason "topic moved to <machine>"; protected sessions are never auto-closed.
 - **Quota-aware placement (automatic):** capacity heartbeats carry each machine's LLM-account quota state, and placement avoids machines whose account is currently rate-limited/blocked (no more topics placed onto a silent machine). A hard pin still wins (flagged \`pinned-machine-quota-blocked\`); if EVERY machine is blocked, placement proceeds least-loaded with \`all-machines-quota-blocked\` flagged. \`GET /pool\` shows each machine's \`quotaState\`.
 - **Signed-out machines are skipped (automatic):** the same heartbeat also says whether the machine has any signed-in account for the framework new conversations run on (from its subscription pool). A machine where every such account needs sign-in reports \`quotaState.reason: no-signed-in-account\`, and placement sends new conversations elsewhere instead of to a session that would sit at "Not logged in". A hard pin still wins (flagged \`pinned-machine-not-signed-in\`). Unknown (no pool, or no account for that framework) never blocks. When the user asks "why did my new topic go silent / land on a machine that can't log in?" → read that machine's \`quotaState\` in \`GET /pool\`.
@@ -1043,6 +1048,7 @@ ${ROUTING_SPEND_CLAUDEMD_SECTION(port)}
 ${MATURATION_BOARD_CLAUDEMD_SECTION(port)}
 ${MATURATION_LADDER_CLAUDEMD_SECTION(port)}
 ${QUEUE_PACE_CLAUDEMD_SECTION(port)}
+${RECOMMENDED_SERVICES_CLAUDEMD_SECTION(port)}
 ${ECOSYSTEM_IDEAS_CLAUDEMD_SECTION(port)}
 ${MOBILE_PAIRING_CLAUDEMD_SECTION(port)}
 ${MOBILE_CHAT_CLAUDEMD_SECTION(port)}
@@ -1844,6 +1850,8 @@ Record what I learn. Build infrastructure, not one-offs. Grow to meet the user's
 Your messages to the user pass an always-on LLM gate (the tone gate) before they send. It reviews high-stakes leaks (CLI commands, file paths, config keys, endpoints) AND the self-stop anti-patterns (B15–B19: quitting on yourself for a context/fatigue reason, calling a doable thing impossible, parking your own work on the user). The two families are treated DIFFERENTLY — the leak/representation rules are overridable nudges (see below); the self-stop family stays a hard block, because there the check exists to constrain YOU and your reason for overriding would come from the very reasoning it distrusts. It judges the behavioral rules **by MEANING, not by literal phrases — a paraphrase of the anti-pattern is caught exactly the same as the canonical wording**, so do not assume rewording evades it. The gate FAILS CLOSED (holds the message, queued for retry — never silently delivers) if it can't produce a verdict (provider down, unparseable output, or a slow-review timeout); the operator kill-switch is \`toneGate.failClosedOnExhaustion\`. Constitution: "Intelligent Prompts — An LLM Gate Must Not String-Match".
 
 ${TONE_ADVISORY_MIGRATION_CLAUDEMD_SECTION}
+
+${SURFACE_REFERRAL_CLAUDEMD_SECTION}
 ### Context-Aware Outbound Review (why was my message flagged / would my reply have been blocked?)
 
 Beyond the tone gate, a response-review pipeline (nine specialist reviewers driven by a Stop hook) evaluates each finished conversational turn. On most installs it is OFF BY CONFIG — \`GET /review/history\` returns 501 there; say so honestly rather than guessing. Where it runs, it is usually in WATCH MODE (\`responseReview.observeOnly: true\`): verdicts are recorded, nothing is blocked. The context-aware layer (⚗️ experimental, dev-gated dark: \`responseReview.conversationalContext\`) feeds the opted-in reviewer a bounded, untrusted-data-enveloped slice of recent conversation so "the operator asked for this technical detail" is an input it can actually judge — a one-way carve-out (it can only move a would-block toward PASS, never license credentials/PII, never touch the deterministic policy layer).
@@ -2733,6 +2741,9 @@ export const REROUTED_LOGIN_EXPIRED_MARKER = 'A job session stuck at an expired
 export const REROUTED_LOGIN_EXPIRED_BULLET = `- **${REROUTED_LOGIN_EXPIRED_MARKER}**: a scheduled job (or other one-shot) that runs as an interactive Claude session and lands under a login whose sign-in has expired shows \`Login expired · Please run /login\` and can do nothing. The monitor now ends it about a minute after it first sees that screen (reason \`rerouted-login-expired\`, a \`SessionManager.monitorTick.reroutedLoginExpired\` degradation naming the login folder) instead of letting it hold a job slot for the full 8-hour lifetime; the job runs again on its next trigger. ${REROUTED_LOGIN_EXPIRED_POOL_SENTENCE} If a user asks "why did my scheduled jobs stop running?" or "why did a job end straight away?" — check \`GET /jobs\` for a stale \`nextScheduled\`, then the server log for \`stuck at an expired login\`; the fix is signing that login in again.`;
 
 /** Content-sniff marker for the interactive expired-login bullet (CMT-1008, Migration Parity). */
+export const CLAUDE_KEY_HEALTH_MARKER = 'A rejected sign-in key is told and recovers';
+export const CLAUDE_KEY_HEALTH_BULLET = `- **${CLAUDE_KEY_HEALTH_MARKER}**: an agent signed in with one key (\`sessions.credentials.anthropic\`, the usual cloud install) passes that key to every Claude process on the server, including internal model calls. If Anthropic refuses the key twice, the operator gets one plain notice, each waiting person is told once, and \`GET /health\` (with the auth header) shows \`claudeKey.status: dead\`. The fix is a new key from \`claude setup-token\`, put in place with \`instar set-claude-key\` on the server (reads stdin or a hidden prompt, never an argument; never ask for the key in chat). Within a minute Instar checks it, and conversations stuck at the login screen restart by themselves and answer what they missed. A conversation that ended during the outage is not replayed. **When to use** (PROACTIVE): the user asks "why did you stop replying?" or "why does health say the model is failing?" → read \`claudeKey\` in \`GET /health\`. Off switches: \`sessions.claudeKeyHealth.enabled: false\` and \`sessions.claudeChildAuth.enabled: false\`.`;
+
 export const INTERACTIVE_LOGIN_EXPIRED_MARKER = 'A conversation stuck at an expired login moves to a signed-in account';
 
 /** Interactive expired-login awareness bullet (CMT-1008). Shared by the generated CLAUDE.md and PostUpdateMigrator. */

package/upgrades/1.3.1650.md

@@ -0,0 +1,105 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+An agent signed in with one key (`sessions.credentials.anthropic`, every headless cloud install) passed it to sessions only. `ClaudeCliIntelligenceProvider` ran `claude -p` with the server's own env, so every internal model call answered "Not logged in". Every server-side `claude` child now gets the same key: the provider's default and hardened paths, project rounds, the headless one-shot, Threadline pipe sessions, the lifeline doctor and triage. Direct children take it through their env; shell and tmux launches source a private file that is deleted before `claude` starts, so the key stays out of argv.
+
+New `ClaudeKeyHealth`, active only with an oauth-token configured. A failed call or a session at the login screen asks for a direct probe. Only Anthropic's 401, seen twice, makes a key dead; "Not logged in" is reported as an Instar fault. The operator gets one notice, each waiting person is told once, and authenticated `/health` shows `claudeKey`. `instar set-claude-key` puts a new key in place, a running server finds it within a minute with no restart, and once a probe proves it, conversations at the login screen restart and answer what they missed. `SessionManager.setAnthropicKey` carries the key into its config copy.
+
+Instar's own merge tool now refuses a pull request that changes the constitution registry unless its body names its counterpart in the other rule book, or says why it has none (`scripts/check-constitution-pairing.mjs`, used by `scripts/safe-merge.mjs`). The green-PR watcher treats that refusal as waiting on a body edit. Adds the map of differences between the two books and corrects the direction-guard document. Does nothing outside the two instar repositories.
+
+113 switched-off features now record what they do: when each fires, holds back or fails, with the reason and a few small facts. Rows go to the evidence log on development agents, so the maturation ladder can judge each feature by its own behaviour. No feature's behaviour changes. Decisions taken per message are limited to one row per window, and that row says how many it stood for.
+
+The feedback executor's early capacity check now uses the same limits as its actual confined canary and build spawns. It treats the final rerouted slot and the global overflow slot as reserved for scheduler-proven jobs. A full lane defers the feedback attempt before it claims an item, creates a workspace, or spends a start.
+
+An owner's paired phone (Instar iPhone app) can open the agent's dashboard console without typing the dashboard PIN. After the owner's Face ID or passcode, the app signs a one-time server challenge with a second Secure Enclave key that only signs after that check, receives a one-minute single-use ticket bound to that phone and address, and the console trades it once at `POST /dashboard/console-ticket` for the same token a PIN unlock returns. It never returns the operator session, so actions that need the PIN still ask for it. New device routes: `POST /mobile/device/presence-key`, `POST /mobile/console-ticket/challenge`, `POST /mobile/console-ticket` (owner phones only, TLS or loopback only). Audit: `.instar/state/mobile-console-tickets.jsonl` (metadata only). Off switch: `mobilePairing.consoleTicket.enabled: false`. MSP phones, phones without a passcode, and older app builds keep the PIN box.
+
+The Instar iPhone app can now show a session natively. A paired owner phone may read a session's screen with `GET /sessions/<name>/output` and type plain text into it with `POST /sessions/<name>/input`, both signed by the phone's device key. Two new entries in the device allowlist carry a new `ownerOnly` flag (MSP, unassigned, pending, revoked and unsigned requests are refused) and their own rate buckets. A device-only router mounted before the main routes handles them; Bearer requests to the same paths reach the existing handlers unchanged.
+
+The device path only reaches sessions running on this machine, matched exactly (tmux name, then id, then name). It refuses control characters, so the phone cannot press keys. It redacts this agent's token, the dashboard PIN and view signatures from the screen text. It keeps a durable 3-minute record of accepted inputs, so a captured request can never be typed twice, even across a restart. It logs each typed message (without its text) in `logs/mobile-session-input.jsonl`. A session on another machine is answered with a plain reason naming that machine; nothing is proxied. Typing is limited to 12 a minute per phone and 12 a minute across all phones.
+
+Everything that needs the operator now has one list, `dashboard/console/needs-model.js`, built from each page's own model: merging stopped, pull requests waiting for approval, feedback decisions, sign-ins, agents waiting, permission approvals, plans waiting on them, passwords requested, and spending limits that are on but not enforcing. Home's "What needs you" count and headline include all of it, and say "Nothing needs you that I can see" rather than a confident all-clear when one of those reads failed. Each page leads with its need and the control to act on it. Costs gets a new lead card, Development gets a button that opens Shipping when a pull request waits for approval, and the Agents pairing switch moves above the lists. Page wording no longer says "below". A warning that an invite leaked now offers "Make a new invite".
+
+A new advisory outbound rule, `B22_SURFACE_REFERRAL`, nudges an agent whose message sends the operator to a page without a direct link, the exact on-screen words, or having loaded the page at the operator's screen size first. It is a nudge with a recorded override, never a wall. After loading the page, the agent resends with `--tone-complied B22_SURFACE_REFERRAL`.
+
+Instar now keeps a signed, append-only record of a person's yes or no for each recommended outside service, and it replicates across the agent's machines where machine sync is on: the coherence journal is live, this store is on, and journal replication is enabled. The route's `replicating` field says whether it is. Rows written while it was off go out at the next boot once it's on. A no stands until the person confirms a yes that names it, so clock skew and delayed sync can't undo a refusal. A no needs the dashboard PIN. Old declines of Cloudflare and Git backup carry over as offer suppression only. The old suggestion paths no longer offer those two features. No offers go out yet.
+
+A rerouted one-shot that passes its configured hard lifetime can now finish its timeout cleanup even when the interactive process still appears active. The session manager checks the saved lane and deadline again before relaxing only process-activity vetoes. All other session protections remain. It now logs “Killed” only after termination succeeds.
+
+An end-to-end test now waits for the first resurfacer run instead of checking after a fixed 30 ms.
+
+## What to Tell Your User
+
+If your agent runs on a cloud server with a sign-in key, its background checks now work. Those checks review outgoing messages and sort incoming ones, and until now they failed quietly on these installs. If the key ever stops working, your agent tells you plainly and says how to fix it. Once a new key is in place, open conversations pick up by themselves. A conversation that ended during the outage is not replayed.
+
+Nothing changes for you. This only affects how Instar's own rule book is maintained.
+
+Nothing changes for you. Features still switched off now keep a record of what they did and why, so it's clear when each is ready to turn on.
+
+When background session capacity is full, feedback work waits cleanly for room instead of starting preparation and then failing at its safety check.
+
+Opening the dashboard from the Instar app on your phone no longer asks for the PIN after Face ID. Anything that changes something important still asks for the PIN. If the app ever says to pair the phone again, that restores PIN-free opening.
+
+The session button in a chat now opens the session right in the app: you see what the session is doing, live, and can type to it, with no browser and no PIN. There is also a Sessions list on the agent's page. Only your own phone can do this, and it can only type plain text, not special keys. If the agent hasn't been updated yet, the app offers the dashboard instead.
+
+Anything that needs you now shows on your home page and at the top of its own page, with the button right there. When I send you to a page, my message comes with a direct link and the exact words to look for, and I check the page first.
+
+Your choices about outside services like Tailscale or Bitwarden are now saved in one place. On agents with machine sync switched on, they follow you across your machines. I won't start offering these yet. That comes once setup for each one is proven.
+
+A worker that runs past its time limit no longer holds a subscription slot forever just because its process is still present. Its work is recorded as timed out and can follow the existing retry path. Recent user activity and the other session safety checks still protect live conversations.
+
+Nothing changes for you; this only makes a test reliable on busy machines.
+
+## Summary of New Capabilities
+
+- `instar set-claude-key` puts a new Claude sign-in key in place, from stdin or a hidden prompt.
+- Authenticated `GET /health` shows `claudeKey` on agents signed in with a key.
+- Off switches: `sessions.claudeKeyHealth.enabled: false` and `sessions.claudeChildAuth.enabled: false`.
+
+None for agents outside the Instar repositories. For maintainers: a pairing check for changes to the two rule books.
+
+- 113 more features can be judged from real records instead of reading "no data".
+
+Owner phones open the console signed in, using a single-use ticket backed by a Face ID-gated key the agent verifies itself.
+
+- Watch a session's screen live in the app, refreshed every second and a half.
+- Type to a session from the app (plain text, owner's phone only, logged without the text).
+- A native list of the agent's sessions, with machine and how long each has run.
+- Plain answers when a session has ended or runs on another of your machines.
+
+- One registry of what needs the operator, feeding Home's count and headline.
+- A test that fails the build when a page buries a need, offers no action for it, or points at a place in its wording.
+- `B22_SURFACE_REFERRAL`: an outbound nudge for sending the operator to a page.
+
+- `GET /recommended-services` shows the saved choice for each service.
+- `POST /recommended-services/:id/no` records a no, with the dashboard PIN and an optional reason category.
+
+None. This repairs the rerouted-session lifetime path.
+
+None.
+
+## Evidence
+
+Found on nimbus by the customer proof (fb-03ec0234-b5b, fb-1dc4a0ca-260): PromptGate 463/463 errors, `llmReliability` failing. Real CLI failure output was captured on Claude Code 2.1.316 and is pinned in `tests/unit/ClaudeKeyHealth.test.ts`. `tests/unit/claude-spawn-auth-class.test.ts` fails if a new `claude` launch site neither takes the key nor says why not.
+
+Unit and integration tests cover each outcome, including a failed read refusing as unknown. Run against real history since #2323, the checker reported drift on #2682, #2380, #2194, #2323 and instar-2 #182, none of which has a declaration line.
+
+Reproduction of the gap: 115 of 172 ladder entries read "no data" with nothing recording. After this, 2 remain, and neither can record from inside the server: one is a CI script, one has no decision point. Unit tests of every changed module pass, and the full run is the merge gate. Text is scrubbed and bounded; message text, prompts and credentials are not recorded.
+
+The production session manager's focused tests passed 65/65, covering the boundary where one rerouted slot remains reserved, the global session limit, actual refusal of a feedback canary, and continued admission of a scheduler-proven job. Build passed. Full unit, integration, end-to-end, and live post-deployment checks remain pending.
+
+Unit, integration and end-to-end tests cover single use, expiry, Host binding, revocation between mint and redeem, MSP refusal, replay after restart, the off switch, the throttle and the audit. A real-browser run against a throwaway agent opened the real console signed in with a valid ticket and showed the PIN box for a used, unknown or revoked one; its first run found and fixed a Host-comparison defect for phones paired on an IP address. The app's 158 unit tests pass. The no-second-prompt path on a real Secure Enclave runs first on the operator's phone and falls back to the PIN box if it fails.
+
+- Spec docs/specs/mobile-native-session-screen.md converged at the 6-round cap with GPT-6 Astra and the clean-door reader; review found and fixed control characters acting as keys, replay across a restart (twice), credential text in pane output, wrong-session targeting and event-loop blocking.
+- Unit: allowlist shape, owner-only flag, named buckets, text filter, exact resolution, miss classification, replay record (including after a restart), redaction, audit rotation, CLAUDE.md migration.
+- Integration: both sides of the allowlist through the production authenticator (owner allowed; MSP, unassigned, pending, revoked, notify token, unsigned and credential-less refused; Bearer passes through), session and machine binding, peer lookups, replay, buckets.
+- E2E: production AgentServer, a phone paired through redeem and confirm, reading and typing into a real session record.
+
+Each of the nine states was put on its real page through a proxy that refuses all writes, in a real browser at 1280x728 and 390x844: all 18 runs show the action on the first screen with no scrolling and no sideways scroll, and screenshots were read. Home named "Automatic merging is stopped" with a link to it when that state was on. `tests/unit/console-needs-first-screen.test.ts` renders the shipped pages and carries negative controls. A dashboard opened on another machine sees merging, approvals and password requests only for that machine, as those pages do today.
+
+`tests/unit/recommended-services-ledger.test.ts`, `tests/unit/recommended-services-wiring.test.ts`, `tests/integration/recommended-services-routes.test.ts` and `tests/e2e/recommended-services-alive.test.ts`. The e2e proves a real AgentServer answers 200, enforces the real PIN check, and keeps a no across a restart. Replication between two real machines has not been run live yet.
+
+On Echo, `dashboard-console-default` crossed 480 minutes. The server printed repeated kill attempts, while the durable reap log recorded `skipped:active-process` and the feedback executor stayed blocked at 6/6. A focused test now uses the real `ReapGuard` with active child and main-process signals and verifies the expired reroute ends; another verifies recent user activity still vetoes. The production-shape E2E test also checks the timeout through the HTTP session listing. Focused unit tests, build, lint, and independent review passed. Full three-tier verification remains before merge.

package/upgrades/1.3.1651.md

@@ -0,0 +1,30 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Agents on several machines can now read whether their machines could serve conversations across each other. `GET /session-pool/readiness` reports line by line per peer, and an hourly history goes to `logs/pool-readiness.jsonl`. It only reports: it writes no config, no stage and no signed result. `instar pair` and `instar join` now say so when automatic takeover does not work because the pair has no git remote. The description of the `shadow` stage is corrected: it places conversations for real.
+
+Load-driven moves between machines now work and have a real on-switch. Peers' session limits reach the capacity row, which is what Overload shed checks, so it can find a target at all. It picks only conversations with a running session that has sat quiet for 10 minutes, on a machine at 85% or more of its session limit, and moves them through the same drain as a manual transfer. Pool stage `rebalance` is now the gate: it needs a fresh proof from `POST /session-pool/rebalance-proof`, kept in its own signed store, and steps down if that proof is red or over 30 days old. Failover test runs no longer count toward stage 3.
+
+Peer session numbers also feed placement scoring for new conversations, at every stage.
+
+## What to Tell Your User
+
+If you run me on several machines, I can now tell you plainly what would and wouldn't work if conversations moved between them, or if one machine died. Nothing about how I run has changed.
+
+If you run me on several machines, a machine that runs short of session slots can hand a quiet conversation to another machine by itself. This stays off until each machine has proved it can do it, and it frees slots and memory, not CPU.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|---|---|
+| Pool readiness report | `GET /session-pool/readiness` |
+| Readiness history | `logs/pool-readiness.jsonl` |
+
+| Capability | How to Use |
+|---|---|
+| Rebalance proof | `POST /session-pool/rebalance-proof` with `{ topic, to }`, then `GET /session-pool/rebalance-proof/RUN_ID` |
+| Proof topics | `multiMachine.sessionPool.rebalanceProofTopics` |

package/upgrades/mobile-console-device-signin.eli16.md

@@ -0,0 +1,5 @@
+# Dashboard without the PIN on your phone — plain English
+
+When you open the dashboard from the Instar iPhone app, the app has already checked your Face ID, but the dashboard still asked for its PIN. Now the phone proves it is you instead. It holds a second key in its secure chip that only works right after Face ID or your passcode. The app uses it to get a pass from the agent that works once, only for one minute, and only at the address it was issued for. The dashboard trades that pass for exactly what the PIN would have given it, and nothing more: approving or changing something important still asks for the PIN.
+
+A phone you have removed gets no pass, and a pass it got just before removal is refused. A copied request is useless because every pass needs a fresh challenge that the agent forgets after one use or a restart. The pass never appears in a web address, and the dashboard on the phone now keeps nothing on disk, which also clears an old sign-in an earlier PIN left there. Helpers' phones and phones without a passcode still see the PIN box, and whenever anything fails the dashboard simply shows the PIN box as before.

package/upgrades/side-effects/cloud-key-internal-calls.md

@@ -0,0 +1,116 @@
+# Side-Effects Review — cloud agents: sign-in key for internal calls, dead-key handling
+
+**Version / slug:** `cloud-key-internal-calls`
+**Date:** `2026-11-03`
+**Author:** `echo`
+**Second-pass reviewer:** `independent general-purpose reviewer agent`
+
+## Summary of the change
+
+Every server-side `claude` child now gets the configured oauth key through one helper (`claudeChildAuth`), reading the value PR #2632 already resolves. New `ClaudeKeyHealth` confirms a dead key with a direct probe, tells the operator and waiting people with fixed text, and restarts sessions stuck at the login screen once a working key is proven. New `instar set-claude-key`.
+
+## Decision-point inventory
+
+- Is the key dead — add — two 401s from Anthropic on direct probes.
+- Notify operator — add — after the self-heal re-read and confirmation.
+- Refresh a session — add — at the login screen, bounded per episode, through the ordinary work gate where it is on.
+- Skip the pool swap on a key agent — add — an env key overrides any pool account.
+- Tone gate, sentinel, external gate — pass-through — failure directions untouched.
+
+---
+
+## 1. Over-block
+
+The new code blocks nothing inbound or outbound. `set-claude-key` refuses a value that doesn't look like a `claude setup-token` key; a valid key of a future shape would be refused until `looksLikeClaudeToken` is updated. The pool swap is skipped on key agents, which is correct because an env key overrides any pool account.
+
+---
+
+## 2. Under-block
+
+A session that ended during an outage has its messages not replayed. A key-only agent with `subscriptionPath` set keeps today's behaviour on the opt-in tmux adapters. An API-key-only agent's internal calls stay failed, by the subscription-by-default rule. The three session lanes still pass the key in tmux `-e` argv.
+
+---
+
+## 3. Level-of-abstraction fit
+
+The key travels through one small module beside the config, not a parameter on eight provider callers, so a new caller can't forget it. A structural test holds that. Recovery reuses `SessionRefresh` and the login-screen classifier, and adds no second restart path.
+
+---
+
+## 4. Signal vs authority compliance
+
+Signals: internal call failures and the login screen. They only request a probe. Authority: Anthropic's own 401 on a real call, twice. A deterministic check is right here, because it reads a status code and judges no meaning. The refresh is further limited. Outside a recovery sweep, a matching launch key never refreshes. During the sweep after a proven outage, screen text is enough, once per session per key. The work gate applies where it is on, which is development agents. Elsewhere login text printed by a working session during that sweep can cost it one restart. That normally resumes the conversation; with no resume entry it starts fresh, and a failure mid-restart leaves no session until the next message. The worst case is one lost in-flight turn.
+
+---
+
+## 4b. Judgment-point check (Judgment Within Floors standard)
+
+All points are invariant: each reads a status code, a hash comparison or a counter. None weighs meaning.
+
+---
+
+## 5. Interactions
+
+- Circuit breaker: the probe bypasses it on purpose; the spawn cap still applies.
+- Pool swap: skipped on key agents through `prependInteractiveLoginExpiredSink`; unchanged elsewhere.
+- Triage lane: previously had no key and hardcoded `credentialSource: 'store'`. It now reports `env` when a key is passed.
+- Tone gate, sentinel and external gate start getting real answers on key agents, so messages that passed the fixed leak floor may now be held by a model verdict. That is the intended behaviour and a visible change for those agents.
+- Agents with a key and a stored login: internal calls move to the key, matching their sessions.
+- Stage-B release evidence: `claudeChildAuth.ts` is reached by import from the certified set, so it is listed as excluded with a reason. A Codex launch never reads it, and no certified file changed.
+
+---
+
+## 6. External surfaces
+
+New CLI command. Authenticated `/health` gains `claudeKey`, and public `/health` may read degraded while dead. Fixed text goes to the Telegram hub, the Slack attention channel and session channels. The probe makes one small authenticated call, and in `ok` state at most one per 5 minutes when signals arrive.
+
+---
+
+## 6b. Operator-surface quality (Operator-Surface Quality standard)
+
+The notice says what happened, what it means and the exact steps, in plain words. Restoring needs a computer, because `claude setup-token` has no phone form. This is stated in the spec's limits.
+
+---
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+Machine-local, a stated limit. The key lives in each machine's `config.json`, and sessions are local processes. Each machine notices and reports its own key and the operator restores each. `state/claude-key-health.json` is not replicated. Key-only installs today are single-machine.
+
+---
+
+## 8. Rollback cost
+
+Revert the PR, or set either off switch; both are read live. Config is not migrated. Leftovers are an unused state file and a CLAUDE.md note.
+
+---
+
+## Conclusion
+
+Safe to ship. The behaviour change for key agents is the fix itself. The live proof on nimbus is still required before calling it done.
+
+---
+
+## Second-pass review (if required)
+
+**Reviewer:** independent general-purpose reviewer agent, four passes over the code diff
+**Concurred:** yes, after the fixes listed below
+
+Independent reviewer, on the code diff. Found no credential leak and nine defects: a replaced key could be paged about, a restored key could go unprobed after a long outage, the refresh loop was not re-entrant, the confirm delay could be bypassed, a removed key was ignored, the off switch and base URL missed three entry points, env files stayed after a failed launch, late-bound Telegram topics were missed, and background promises had no catch. All nine fixed with tests. A second read found three more: the stated restart bound was inaccurate, recovery could still act after the key was removed, and the lifeline read its off switch from a frozen copy. All three fixed. A third read found the Slack respawner renames a session, so the once-per-key record missed it; fixed. The fourth read concurred. After that, the full unit lane found four catches over the no-silent-fallbacks ratchet: a failed session listing now files a degradation report, and three send failures carry an exemption because `delivered` drives the retry and its capped report. That small change was not re-read by the reviewer.
+
+---
+
+## Evidence pointers
+
+`tests/unit/ClaudeKeyHealth.test.ts`, `tests/unit/claudeChildAuth.test.ts`, `tests/unit/ClaudeCliIntelligenceProvider-key.test.ts`, `tests/unit/claude-spawn-auth-class.test.ts`, `tests/integration/claude-key-health-route.test.ts`, `tests/e2e/claude-key-alive.test.ts`.
+
+---
+
+## Class-Closure Declaration (display-only mirror)
+
+- **`defectClass`**: `unbounded-self-action`
+- **`closure`**: `guard`
+- **Citation**: `tests/unit/self-action-convergence.test.ts` (controller `claude-key-session-refresh`)
+- **Enforcement**: `ratchet`
+- **How caught**: `decideKeyRefresh` caps a session at 3 attempts, then it leaves the pending list and is reported. Nothing re-adds it within the episode, and a session already moved onto this key is skipped, so the count settles. Dead-key probes back off to a 1-hour ceiling and stop after 24 hours.
+
+The separate class this change closes, a server-side child that needs a credential but inherits only the server's own env, is held by `tests/unit/claude-spawn-auth-class.test.ts`.

package/upgrades/side-effects/constitution-alignment.eli16.md

@@ -0,0 +1,11 @@
+# Pairing check for the two rule books, in plain words
+
+Instar 1.x and 2.0 each have a written copy of the rules, and changes to one often never reached the other. This adds the first working part of the requirement Justin asked for.
+
+Any pull request that changes the 1.x rule book now has to carry one line: which matching change it pairs with in 2.0, or why it has none. My merge tool checks that the line is there and that the named change really exists and really touches the other book. If not, it refuses and says exactly what to add. Adding the line doesn't cancel an approval.
+
+It only checks that a pair exists. Whether the two say the same thing, or whether "no pair needed" is honest, stays with the independent review.
+
+Nothing here changes the rule books themselves. Those wordings still need Justin's own approval, and come separately. This also adds a map of how the two books differ today, and corrects one document that wrongly said no rule change could land at all.
+
+Other agents are unaffected: the check does nothing outside these two repositories. To undo it, revert this change. No data needs fixing.

package/upgrades/side-effects/constitution-alignment.md

@@ -0,0 +1,69 @@
+# Side-Effects Review — constitution pairing check and merge-tool wiring
+
+**Version / slug:** `constitution-alignment`
+**Date:** `2026-11-03`
+**Author:** `echo`
+**Second-pass reviewer:** `independent subagent, appended below`
+
+## Summary of the change
+
+Step 1 of `docs/specs/constitution-alignment.md`. Adds `scripts/check-constitution-pairing.mjs`: every PR touching a constitution book must name its counterpart in the other repository, or say why it has none. `scripts/safe-merge.mjs` refuses a registry PR that doesn't. `GreenPrAutoMerger` treats that refusal as waiting on a body edit. Also adds the map of existing differences and corrects `docs/STANDARDS-DIRECTION-GUARD.md`. No constitution text changes here. Tier 2; 5 spec review rounds of a cap of 6; about 6 files and 450 lines, most of it tests.
+
+## Decision-point inventory
+
+- safe-merge refusal on a missing or unreal declaration: **add**, invariant. Existence only.
+- `none:` honesty and same-obligation: judgment-candidate, held by the independent review of each change. No code here decides it.
+
+## 1. Over-block
+
+A PR touching the registry with no line is refused until one line is added. That includes a typo fix; the requirement says all updates. Clearing it takes one body edit and dismisses no approval. A failed read of a named counterpart refuses a registry PR with state `unknown`. A failed read of the PR's own file list refuses *any* PR on this repository with state `unread`, because whether it touches a book isn't known; its message says to retry and the watcher re-reads in 15 minutes. safe-merge already stops on any failed `gh` read a moment earlier or later, so this adds no new class of outage, only one more read that can hit it.
+
+## 2. Under-block
+
+- A dishonest `none:`, or a pair that changes something else in the other book. Not visible to a script. The independent review and the operator's review hold it.
+- A merge not going through safe-merge, and every merge in instar-2. Caught by the daily run, within a day.
+- A PR body edited after merge can mislead the daily read. Accepted.
+
+## 3. Level-of-abstraction fit
+
+The merge funnel is the right layer in instar: the base-branch refusal lives at the same point. A GitHub required status check would be stronger but needs the operator's admin action on two repositories, and the daily run backs it up.
+
+## 4. Signal vs authority
+
+Compliant, per `docs/signal-vs-authority.md`: the blocking authority covers a closed existence question, in the shape of the Maturation Path plan gate, over inputs no model is needed to read. All judgment of meaning stays with a mind. The refusal is cheap to clear and says exactly how.
+
+## 5. Interactions
+
+- Sits immediately after `nonMainBaseRefusal`, before every floor. Base refusal still wins for a stacked PR.
+- `GreenPrAutoMerger`: new branch, no ladder attempt, re-read every 15 minutes, since the fix moves no head. Without it, the default ladder would give up. A body edit therefore takes up to 15 minutes to be seen. An approved registry PR with no line waits on audit only, with no attention item: the author is me, and the reader of that item would be the operator, who can't fix it.
+- Adds two `gh` reads per safe-merge run on `JKHeadley/instar`. A registry PR adds a read of the counterpart. Negligible.
+- `scripts/safe-merge.mjs` now imports a sibling file, the same way it imports its existing siblings.
+
+## 6. External surfaces
+
+Instar's own PR process only. `scripts/` ships to the fleet, where this is inert: any repository but the two named no-ops. No user-facing change, no message, no route.
+
+## 7. Multi-machine posture
+
+Unified. No local state: GitHub is the only record. The same script behaves identically on every machine.
+
+## 8. Rollback
+
+Revert. Removes the refusal and the watcher branch. No data migration. The daily job, added at landing on Echo, is disabled in one edit.
+
+## Evidence
+
+- Unit: `tests/unit/check-constitution-pairing.test.ts`. Integration: `tests/integration/safe-merge-constitution-counterpart.test.ts` runs the real script with a fake `gh`, including the refusal path, the unreadable-counterpart path, and a PR touching no book.
+- Live positive control, against real history since #2323: `paired=0 declared-none=0 waiting=0 overdue=0 drift=5 no-pr=0`, naming #2682, #2380, #2194, #2323 and instar-2 #182. All five lack a line, so this proves the no-line class only; fixtures cover the rest. A real TLS failure on an earlier run printed `unknown` and did not read as clean.
+
+## Ladder line
+
+This spec has no flag, so its plan says `ladder: not applicable: no flag.` The ladder's coverage test now accepts that form, with a reason, and still refuses a name that matches no entry.
+
+## Second-pass review
+
+**Reviewer:** independent general-purpose subagent, on claude-opus-5-5
+
+Independent subagent, 2026-11-03. Concern raised: a failed first read refused every PR on the repository, labelled as a constitution change. Verified live with a 404. Resolved: a separate `unread` state with its own message, this artifact and the spec corrected, tests added. It also found that a line naming a nonexistent PR made the whole daily run `unknown`; now one row of drift, tested. Everything else it checked held: standalone run from a temp directory, real page shapes, state mapping, `nextEligibleAt`. Recorded after fixing; the concern is resolved by these changes rather than concurred with as first written.
+
+**Second-pass re-check of the fix:** Concur with the review.

package/upgrades/side-effects/feature-evidence-recording.eli16.md

@@ -0,0 +1,3 @@
+# Recording what switched-off features do, in plain words
+
+To judge a switched-off feature, you need a record of what it actually did. Most of them kept none, so the maturation ladder could only say "no data". This adds one line at the point where each of 113 features makes its decision: it fired, it held back, or it failed, with the reason and a few small facts. It changes nothing about what the feature does, and a failure to record can never break the feature. It never records message text, prompts or credentials. It's off on the fleet for now, like the ladder itself. Two features can't record this way, because they don't run inside the server, and they stay marked as needing it.

package/upgrades/side-effects/feature-evidence-recording.md

@@ -0,0 +1,66 @@
+# Side-Effects Review — Evidence recording in switched-off features
+
+**Version / slug:** `feature-evidence-recording`
+**Date:** `2026-11-03`
+**Author:** `echo`
+**Second-pass reviewer:** `independent subagent, appended below`
+
+## Summary of the change
+
+Adds `featureEvidence.record` (and `recordAtMostEvery` for per-message paths) at the decision points of 113 features across 85 files, and marks them measured in the registry. Spec: `docs/specs/feature-maturation-ladder.md` §4 and §13. Tier 2 by spread; each call is additive and cannot change behaviour.
+
+## Decision-point inventory
+
+No decision point is added or changed. Each call observes a decision that already happened.
+
+---
+
+## 1. Over-block
+
+No block/allow surface — over-block not applicable.
+
+## 2. Under-block
+
+No block/allow surface. Recording misses what a feature cannot see about itself: a wrong decision reads like a right one until graded. Agents flagged double replies, wrongly refused holders and spurious reaps as undetectable from inside; the review's grading covers those.
+
+## 3. Level-of-abstraction fit
+
+One thin call at each feature's decision point, through one log. Hook scripts and CI scripts cannot call it and are listed as not covered.
+
+## 4. Signal vs authority compliance
+
+Signals only; no call's result is read. Reference: `docs/signal-vs-authority.md`.
+
+## 5. Interactions
+
+The call appends synchronously, so it stays off per-tick paths; per-message paths use `recordAtMostEvery`. `catch` blocks that gained a recording call stay non-throwing. The log is wired only when the ladder is on, so on the fleet every call is a no-op, and rows from before the log is wired at boot are lost. A source-order test on `/messages/relay-agent` used a 30 KB window that the added lines outgrew; widened to 40 KB.
+
+## 6. External surfaces
+
+None. Rows stay on the machine; only numbers leave. `context` holds reason codes, counts and non-secret ids, and text passes `scrubForStore`.
+
+## 7. Multi-machine posture
+
+Per-machine facts read through each machine's route and the board, as the spec states.
+
+## 8. Rollback cost
+
+Revert, or set `maturation.ladder.enabled` false, which makes every call a no-op.
+
+## Evidence
+
+`tsc` clean; unit tests of each changed module; `tests/unit/FeatureEvidenceLog.test.ts`; the full run is the merge gate.
+
+## Second-pass review
+
+**Reviewer:** independent general-purpose subagent, on claude-opus-5-5
+
+Independent subagent, first read: "Concern raised". `allPeersPresumedGone()` in a record's arguments could throw on a corrupt registry just before the lease self-suspend, so the self-fence would be skipped; three per-message or per-request paths recorded without the limiter; one `.message.slice` could throw on a non-Error. All fixed: those facts came out of the lease context, the three paths use `recordAtMostEvery`, and the error read is guarded. A wider grep of added arguments found no other call that can throw on a load-bearing path. It found no message text or credentials in the sampled context, and every feature id in the registry. It sampled by risk, not all 85 files. Concur after fixes.
+
+## Class-Closure Declaration
+
+`unbounded-self-action`: closure `n/a`. These calls observe decisions other code already made; none triggers an action or a retry. Row volume is bounded by rotation and, on per-message paths, by `recordAtMostEvery`.
+
+## Stage-B certified set
+
+`src/monitoring/DegradationReporter.ts` sits in the certified Codex delivery closure and gained a recording call, so the evidence log and its rotation helper entered the closure. Both are listed as excluded, with reasons: write-only, never throwing, and off the delivery path. The certified fingerprint is unchanged.