instar 1.3.1663 → 1.3.1665

package/upgrades/side-effects/mobile-native-proposals-inside.md

@@ -0,0 +1,57 @@
+# Side-Effects Review — Native Proposals and How I'm doing inside screens
+
+**Version / slug:** `mobile-native-proposals-inside`
+**Date:** `2026-11-04`
+**Author:** `echo`
+**Second-pass reviewer:** `cross-model codex-cli and clean-door claude-code reviewers (see below)`
+
+## Summary of the change
+
+Two read-only routes for the Instar iPhone app, owner phones (device-signed) or the bearer token only: `GET /mobile/proposals` and `GET /mobile/inside`. New module `src/server/mobileProposalsInsideRoutes.ts`, two `DEVICE_ALLOWLIST` entries, `loadAllProposals` exported, a CapabilityIndex entry and a CLAUDE.md bullet with its migration. Tier 2 because it widens device-key read access.
+
+## Decision-point inventory
+
+- `DEVICE_ALLOWLIST` — add — two exact-path GET rules, `ownerOnly`, a shared own bucket.
+- `ownerOrBearer` — reuse.
+- Field allowlists, path replacement, peer rebuild — add — a fixed redaction contract.
+
+## 1. Over-block
+
+An MSP phone cannot read either screen; that is the owner-only default. A peer whose answer fails the shape check is listed as not answering; one with a section missing its numbers still shows, with that section unavailable. Either way the screen under-claims, which is the intended direction.
+
+## 2. Under-block
+
+Free text can hold repo-relative file names, and a path form outside the replaced prefixes; the scrub is best effort, and the owner reads the same text in the console. A stolen owner phone that passes the device check can read these summaries, like the other owner reads.
+
+## 3. Level-of-abstraction fit
+
+Same layer as the merged mobile read modules. The words duplicate `inside-model.js`, because the server cannot import the console's view model into a route without coupling them; a parity test pins the kind, insight-status and verdict tables (the others are not exported by the console model).
+
+## 4. Signal vs authority compliance
+
+No blocking authority is added, no detector, no LLM. The allowlist and owner checks are identity authorization, not judgment. `docs/signal-vs-authority.md` does not apply beyond that.
+
+## 5. Interactions
+
+Shares the `peerSummaries` helper and the 15 s single-flight pattern. Own device bucket, so it does not eat the other screens' budget. A test fixes the named owner-only set. The raw routes are unchanged.
+
+## 6. External surfaces
+
+Two new read paths; the app shows "update the agent" on older servers. Peers receive two extra bearer reads, at most once per 15 s per route while a phone is reading. No LLM spend. No notices.
+
+## 7. Multi-machine posture
+
+Both proxied-on-read through `?scope=local`, each row or group naming its machine; missing machines named. No durable state, no generated URLs.
+
+## 8. Rollback cost
+
+Revert. No data, config or migration to repair; the CLAUDE.md bullet stays harmlessly until the next template refresh.
+
+## Second-pass review (if required)
+
+**Reviewer:** cross-model codex-cli gpt-6-astra (6 rounds) and clean-door claude-code (2 rounds), fresh context, reading the spec and module
+**Independent read of the artifact: minor issues, no blocker**
+
+Each round's findings were applied with tests; see `docs/specs/reports/mobile-native-proposals-inside-convergence.md`. Codex round 6 and the first clean-door read of this artifact raised design points, all fixed. The last clean-door read returned MINOR ISSUES: dismissed and promoted are per-machine sums, the headline ignores overdue and failed-review rows, and peers exchange display words rather than codes. The first two are stated in the spec as deliberate, matching the console. The third fails safe ("can't tell") and is left as it is.
+
+**Test fixture note (2026-11-04):** the integration test used one proposal on both machines, which the later count-once change correctly merges. The peer now has its own proposal. No product code changed.

package/upgrades/side-effects/recommended-services-stop-holds.md

@@ -0,0 +1,64 @@
+# Side-Effects Review — a person's stop holds recommended-service setup
+
+**Tier 2 by risk (session restart behaviour), with second-pass review.** Spec: `docs/specs/recommended-services.md`. Dark: setup only runs on a throwaway or development agent listing a recipe.
+
+## Summary
+
+- New `held` in per-machine setup state. `reconcile` skips a held service, so no restart and no stuck notice.
+- `holdSetupForSession` is called from the Telegram sentinel kill and `DELETE /sessions/:id`, before the kill and matching by session name or topic. `holdAllSetups` is called from the Slack sentinel kill-all and the app's Slack kill-all, and also holds a setup whose session is already dead.
+- Setup state now follows the conversation's current session, found through the topic. A reply brings a session back under a different name. Before this, a repeat yes could start a second session, and a no couldn't stop the renamed one.
+- New `POST /recommended-services/:id/hold`, for a session whose person said not now. Needs the bearer token and `X-Instar-Request`. No PIN, and it refuses without a recipe.
+- A repeat yes lifts a hold, resets its restart count and starts setup. A fresh yes also lifts it. A no and a pass clear it.
+- The Jev offer text says credits are needed before a key. This changes its offer hash, which is harmless because no real agent has a grant.
+- The brief rule covers sign-in codes and pictures. The Jev brief records the credit requirement and a credit code as the route that avoids a card.
+
+## 1. Over-block
+
+A false emergency stop now stays stopped until the person writes again. The second live run was exactly this: "No, don't add credits" was classified as a stop. It recovered before only because of the restart this removes. The person is told "Session terminated. Send a new message", so it isn't silent, and the classifier bug is filed on its own (fb-01131fac-fb1).
+
+An agent's own `DELETE /sessions/:id` with a bearer token also holds, since the route can't always tell operator from agent. A session ended that way stays ended until a yes, a no, a pass, or a reply. An agent ending its own setup session on purpose wants that.
+
+## 2. Under-block
+
+- Kill paths that aren't named still restart: the reaper, the watchdog, crash recovery. They're not a person's stop, so that's intended. A new person-facing stop path added later would miss this. A test pins the four named paths by reading the source, so it shows the calls exist and not that each runs.
+- `/stop-all` style autonomous stops and the route at `routes.ts:28380` are covered only where they go through `onSentinelKillSession`. The route's fallback without Telegram doesn't hold, and setup needs Telegram to talk to the person.
+- A session the person brought back by replying, which then dies, isn't restarted while held. Their next message resumes it. Recorded in the spec's Left behind.
+- The hold rule is prompt text, so a session can fail to call it. It then gets the bounded restarts, as today.
+- The hold is written before the kill. If the kill fails, the session keeps running while held. It can still finish and pass, which clears the hold.
+- Narrow race left in place: a stop during `startSetup`, before any session name is saved, can find nothing to hold or leave the new session running. The window is seconds, one recipe, and only on proving agents.
+
+## 3. Level-of-abstraction fit
+
+The stop decision stays where it is, in the sentinel and the routes. Setup state only records the outcome, and `reconcile` reads it. The two kill-all paths hold every setup that hasn't passed, including one whose session is already dead.
+
+## 4. Signal vs authority compliance
+
+No new judgment. `held` is a recorded fact, and `reconcile` applies a deterministic skip. The hold route only reduces what the system does, and grants nothing. Reference: `docs/signal-vs-authority.md`.
+
+## 5. Interactions
+
+`dormant` and `exhausted` are unaffected, because the hold check sits beside them. `endSetup` clears `held`, and `reconcile`'s no-grant branch runs before the skip, so a no from another machine still ends a held setup. A repeat yes used to return without touching setup. It now restarts a held one, which needs the PIN and a live page token.
+
+## 6. External surfaces
+
+`GET /recommended-services` gains `held`. One new route. The offer text changes only on the confirm page, which real agents can't reach. No change to what a person sees on any real agent.
+
+## 6b. Operator-surface quality
+
+The confirm page shows the new cost line through the existing field. It is one sentence longer, and the page is otherwise unchanged. No new control.
+
+## 7. Multi-machine posture
+
+Machine-local, like the rest of setup state. `machine-local-justification: physical-credential-locality`: setup state tracks a key and session on one disk. A stop on one machine holds the session on that machine. Setup runs only on the granted machine.
+
+## 8. Rollback cost
+
+A revert removes the route and the skip. A leftover `held` field in the state file is ignored. No data migration.
+
+## Second-pass review
+
+First read: concern raised. A stop, a reply and then a yes could start a second live session, because state kept a stale session name. The reviewer also named an unheld stop under a renamed session, a fresh yes leaving a hold, the app's Slack kill-all, a dead session coming back after a kill-all, the gap after the dashboard's kill, a hold overwritten during preflight, a repeat yes keeping its spent restarts, a pass not clearing the hold with no open promise, and an overclaiming test title. All were fixed.
+
+Second read: concurred, nothing blocking, from reading the code without running tests. It raised three smaller items. Re-adopting a session after a no, and a stop during preflight, are fixed after that read and weren't re-read. Left in place: a stop during `startSetup` still ends with a session running while held, and a yes on an open session clears `lastAttemptAt`, so a later idle-out gets one more restart.
+
+Verifier: the first full run failed one integration test, `recommended-services-confirm-wiring`, because that test's Telegram stand-in had no topic lookup, which the no path now calls. The real adapter has it. The stand-in now keeps real topic records, so the no path runs the real lookup. I hadn't run that file locally before pushing. Test-only, so no second read.

package/upgrades/side-effects/safe-git-one-verb-classifier.md

@@ -0,0 +1,117 @@
+# Side-Effects Review — SafeGitExecutor one verb classification
+
+**Version / slug:** `safe-git-one-verb-classifier`
+**Date:** `2026-11-04`
+**Author:** `Echo`
+**Second-pass reviewer:** `independent reviewer subagent (see below)`
+
+## Summary of the change
+
+The git funnel kept two verb lists, one per kind of surface, so a verb in neither list was refused by both and each refusal named the other (EVO-028). `src/core/SafeGitExecutor.ts` now has one table, `GIT_VERB_CLASSES`, and one classifier, `classifyGitInvocation`, which all five entry points use. The two exported sets are derived from the table. `check-ignore` is added as a read and joins `SOURCE_TREE_READ_TIER_VERBS`. An unclassified verb gets one shared refusal on every surface. `reflog` becomes a `shape` verb, so its non-read forms route through `run` to `execSync`. Tests: `tests/unit/SafeGitExecutor-verb-classifier.test.ts` (new), plus one-line updates to `tests/unit/SafeGitExecutor.test.ts` and `tests/unit/SafeGitExecutor-sourceTreeReadOk.test.ts`.
+
+Proportion: Tier 1 declared, because a revert fully undoes it and it adds no new authority, with the full chain run anyway because this is the safety funnel (converged spec, second-pass review). About 170 added source lines, most of them the list becoming a table. Three spec rounds, at the cap. The draft was three weeks stale and the rounds kept finding real errors in what it said about the system.
+
+## Decision-point inventory
+
+- `SafeGitExecutor` verb gate — modify — same gate, one source of truth. No new blocking authority.
+- `SafeGitExecutor.run` routing — modify — routes on the classifier. Only `reflog` routing changes.
+- `SOURCE_TREE_READ_TIER_VERBS` — modify — gains `check-ignore`, opt-in per call.
+
+---
+
+## 1. Over-block
+
+No legitimate call is newly refused. Every verb the classifier calls `unclassified` was refused by both surfaces before. Harmless unclassified verbs (`check-attr`, `show-branch`) stay refused on purpose; EVO-028 approved one verb, and each further one needs its own check. The refusal now tells the caller that adding a verb is a reviewed change.
+
+---
+
+## 2. Under-block
+
+This change does not close existing gaps. Read-classified invocations can still write or run a program: `remote -v add`, `config key --list`, `format-patch`, `hash-object -w`, `write-tree`, `symbolic-ref`, `--output` on `diff`, `log` and `show`, repo-local `core.fsmonitor`, `diff.external`. Echo reproduced the first two. Those are EVO-029 items 4 and 5 <!-- tracked: CMT-1124 -->, and the record was widened in this run. `check-ignore` inherits the `core.fsmonitor` exposure that `status` already has, so it adds no new class. `run` still reads `args[0]`, so a pre-verb flag is routed to `readSync` (EVO-029 item 1 <!-- tracked: CMT-1124 -->).
+
+---
+
+## 3. Level-of-abstraction fit
+
+Right layer. The contradiction lived inside the funnel, and the classification belongs next to the shape checks it calls. Two scripts keep their own verb lists for unrelated jobs and are left alone (EVO-029 item 6 <!-- tracked: CMT-1124 -->).
+
+---
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+**Does this change hold blocking authority with brittle logic?**
+
+- [ ] No — this change produces a signal consumed by an existing smart gate.
+- [ ] No — this change has no block/allow surface.
+- [ ] Yes — but the logic is a smart gate with full conversational context (LLM-backed with recent history or equivalent).
+- [ ] ⚠️ Yes, with brittle logic — STOP. Reshape the design. Brittle detectors must not own block authority. Either promote the logic to smart-gate level (with proper context) or demote it to a signal that feeds an existing smart gate.
+
+None of the four boxes fits exactly, so this is stated directly. The funnel is a deterministic allowlist over git's fixed command grammar. It judges no meaning and it predates this change. `docs/signal-vs-authority.md` names hard-invariant validators as outside the principle and a deterministic policy evaluator as a valid authority where inputs can be enumerated. This change adds no blocking authority: everything it refuses was refused already. The Standards-Conformance Gate flagged this in all three rounds, because the registry article names only the emergency-stop floor as an exception. That disagreement between the two documents is filed as feedback fb-69615365-30f and needs a ruling, because the registry is the constitution.
+
+---
+
+## 4b. Judgment-point check (Judgment Within Floors standard)
+
+No static heuristic is added at a competing-signals point. Whether a verb is in a closed table has no competing signals.
+
+---
+
+## 5. Interactions
+
+- **Source-tree guard:** the unclassified refusal now comes before the guard on `execSync` and `spawn`. That call was refused either way; only the error changes, from `SourceTreeGuardError` to `SafeGitExecutorError`. `leaseMediumSelection.ts:67` treats both alike. Classified verbs keep their order, pinned by a test.
+- **`GitStateManager.ts:345`:** `update-index --refresh` is still refused and swallowed; only the swallowed text changes.
+- **`machine.ts:174`:** unchanged. It still reaches `readSync` and is refused.
+- **Audit log:** one new reason, `unclassified-verb`. Nothing reads audit reasons.
+
+---
+
+## 6. External surfaces
+
+None. No route, config, message, file or agent-installed surface changes. Refusal text changes only for unclassified verbs, and nothing in `src/` or `scripts/` reads refusal text.
+
+---
+
+## 6b. Operator-surface quality (Operator-Surface Quality standard)
+
+No operator surface touched — not applicable.
+
+---
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+No new state, notice or URL. This is in-process classification that ships identically to every machine. The one machine dependence is in git, not here: `check-ignore` reads `.git/info/exclude` and the per-user ignore file (`$XDG_CONFIG_HOME/git/ignore`, by default `~/.config/git/ignore`, unless a repo-local `core.excludesFile` overrides it), so its answer can differ per machine. The spec states this for callers. No status surface changes.
+
+---
+
+## 8. Rollback cost
+
+Revert the commit. No stored state, config or migration. After a revert `check-ignore` is unreachable again and the contradictory messages return.
+
+---
+
+## Conclusion
+
+Three review rounds changed the design in two ways: the unclassified refusal moved ahead of the source-tree guard, and `check-ignore` joined the source-tree read tier, without which the goal was only half met. They also corrected several false statements in the spec and exposed the wider gap now recorded under EVO-029. Clear to ship as a consistency fix. It is not a claim that the read surfaces are safe.
+
+---
+
+## Second-pass review (if required)
+
+**Reviewer:** independent reviewer subagent (claude-opus-5-5), read-only, no shared context beyond this artifact and the diff
+**Independent read of the artifact: concur**
+
+Concur after two wording corrections, both applied: the per-user ignore file description, and "added" not "changed" for the line count. The reviewer ran old and new code side by side with a fake git over every table verb and every `git --list-cmds=main` command on all five surfaces, on plain and source-tree fixtures. Only three groups differ: unclassified verbs, `check-ignore`, and `run` with `reflog`. Table membership matches the old lists plus the two stated additions. Unstated and harmless: `run([''])` now reaches `readSync` and is still refused.
+
+---
+
+## Evidence pointers
+
+Disconfirmation on unchanged source: 14 of 16 tests failed for the expected reasons, including "readSync called with destructive verb 'check-ignore'" and "destructive shape 'reflog expire ...'". Convergence report: `docs/specs/reports/safe-git-one-verb-classifier-convergence.md`.
+
+---
+
+## Class-Closure Declaration (display-only mirror)
+
+No agent-authored-artifact defect — not applicable. This fixes source code, and adds no self-triggered controller.

package/upgrades/side-effects/session-pool-keep-and-recall.md

@@ -0,0 +1,49 @@
+# Side-Effects Review — a live conversation stays put, and a moved one gets its recent messages
+
+**Version / slug:** `session-pool-keep-and-recall`
+**Date:** `2026-11-04`
+**Author:** `echo`
+**Second-pass reviewer:** codex-cli gpt-6-astra, 2 rounds; first round's findings fixed; last round's verdict still serious, its design points stated as accepted limits, see the report
+
+## Summary of the change
+
+`SessionRouter` keeps an unowned key on this machine when a session for it is already running here, subject to every mandatory placement check, and confirms the claim at once. A new read-class mesh verb, `topic-history-pull`, lets a moved session fetch recent messages from the lease holder with no shared bearer token; the bearer call stays as the fallback and gains a deadline.
+
+## Decision-point inventory
+
+- Keep a live local session on a new placement — add — live session, no preferred machine, this machine passes placement alone with no escalation.
+- Serve history to a peer — add — registered peer, read class, capped by the handler.
+
+---
+
+## 1. Over-block
+
+Keep could hold a conversation on a busier machine when a peer is cheaper. That is the point: a running session is not moved for cost. Overload, a lost workspace and a blocked quota all still move it, because placement refuses this machine alone.
+
+## 2. Under-block
+
+Sessions away from the lease holder with no ownership record are not found. A failed confirm is not retried by the router. Both are stated in the spec.
+
+## 3. Level-of-abstraction fit
+
+Keep sits in the router, the one place Telegram, Slack and the drain share, and reuses `decide`, the CAS and `confirmClaim`. Recall follows the existing pull-verb pattern.
+
+## 4. Signal vs authority compliance
+
+No judgment moves into a brittle check. `liveLocalSession` is a fact from the session manager; placement keeps its authority over eligibility, and a pin still wins.
+
+## 5. Interactions
+
+The drain's `forceReplace` uses failover placement, which keep does not touch. The Telegram confirmation after delivery still runs and finds the row already `active`, a no-op. Moves are unaffected: a moved key has an owner, or its old session has closed.
+
+## 6. External surfaces
+
+One new mesh verb. An older peer answers `no-handler` and the bearer fallback carries it. No HTTP route, config or user-visible change. It discloses to this agent's own machines what the bearer route already does.
+
+## 7. Multi-machine posture
+
+This is multi-machine code. It is inert on one machine: no mesh, and no router past dark. History is read-only and holds no replicated state. Ownership changes go through the existing CAS and journal, so no second authority appears.
+
+## 8. Rollback cost
+
+Revert. No stored state. `enabled:false` stops all routing at once.

package/upgrades/side-effects/topic-name-beside-id.md

@@ -0,0 +1,152 @@
+# Side-Effects Review — a topic's name always travels with its id
+
+**Version / slug:** `topic-name-beside-id`
+**Date:** `2026-11-02`
+**Author:** `echo`
+**Second-pass reviewer:** `not required (wording only; no gate, sentinel, lifecycle or dispatch decision touched)`
+
+## Summary of the change
+
+Tier 1 (wording in server-authored text; a revert fully undoes it). Operator rule (Justin,
+2026-11-02, verbatim): "An Instar agent should ALWAYS have access to the topic name if they have
+access to the topic ID. The name and ID should be inseparable." Live case: a peer's session was
+told "topic 11882, the topic for echo" and told its user it could not see the topic name, though
+the registry held "🤝 echo".
+
+- New `src/messaging/shared/topicRef.ts`: `topicRef` / `TopicRef` / `telegramTopicRef` /
+  `topicNameFor` render `topic 11882 "🤝 echo"` or `topic 11882 (name unresolved)`. The name is
+  the caller's, else the registry's (`setTopicNameResolver`, wired at boot in `server.ts` to the
+  live `TelegramAdapter.getTopicName`), accepted only through `verifiedEntityName` and sanitized
+  with the existing `sanitizeTopicName` (≤120 chars).
+- `buildInjectionTag` (`src/types/pipeline.ts`): the `[telegram:N …]` prefix now always carries the
+  name (registry fallback) or ` (name unresolved)`; the long-message reference tag passes the name.
+- Threadline session text: `TopicLinkageHandler` notice lines and `ThreadlineRouter` spawn-prompt
+  topic hint; hub topic candidates (`HubIntentClassifier`, `hubCommands`) fall back to the
+  registry name instead of an invented `topic N`.
+- Notices/attention items and session-facing prompts in `routes.ts`, `server.ts`, `SessionReaper`,
+  `AutonomousLivenessReconciler`, `OwnershipReconciler`, `OriginForwardToHolder`,
+  `OutboundAdvisory`, `MentorAutonomousGuardian`, `StaleOwnerReleaseEngine`, `PrHandLease`,
+  `TelegramSpendTopicChannel`, `ReapNotifier`, `ReapNoticeDrain`, `TopicReachabilityVerifier`,
+  `SeamlessOrchestratorEngine`, `ScopeVerifier`, `ColdStartFallbackReply`, `SessionManager`,
+  `TelegramAdapter` (session list).
+- Ratchet `tests/unit/topic-ref-ratchet.test.ts`: per-file baseline of two remaining bare
+  `topic ${…}` renders; one already carries the name beside the id and one is a lifeline log.
+  A new non-log site fails.
+
+Size: ~25 source files, ~120 changed lines + formatter + 4 test files. Effort: no spec rounds
+(Tier 1), one commit.
+
+## Decision-point inventory
+
+None. Text rendering only; no gate, block, routing or lifecycle decision changes.
+
+---
+
+## 1. Over-block
+
+No block/allow surface.
+
+## 2. Under-block
+
+- Two non-log bare renders remain in the ratchet baseline: the InputGuard prompt already
+  gives the name beside the id, and one lifeline diagnostic is internal. Other log-only
+  renders are outside the ratchet; they are not a proof that every log line carries a name.
+- A topic the registry has never named shows "(name unresolved)" until the adapter learns its name (rename events, startup backfill).
+- Processes with no Telegram adapter (no Telegram configured) render every topic as unresolved.
+- Attention item ids, condition keys and log lines are unchanged (ids, not prose).
+
+## 3. Level-of-abstraction fit
+
+One formatter in `messaging/shared`, beside the existing verified-identity rule it reuses, and one
+late-bound resolver wired once at boot, so no component needs a new dependency.
+
+## 4. Signal vs authority compliance
+
+- [x] No — this change has no block/allow surface.
+
+## 4b. Judgment-point check
+
+No judgment point.
+
+## 5. Interactions
+
+- `[telegram:N` parsers (`InputGuard`, `SessionManager` tag match, `telegram-topic-context.sh`) anchor on `^\[telegram:(\d+)`; the name / marker follows the id, so they are unaffected. `InputGuard` provenance check compares ids only.
+- The long-message reference tag and the bare tag are no longer byte-identical to the old `[telegram:N]` (tests that pinned those bytes were updated).
+- The topic name is peer- or user-influenced text entering session prompts and LLM classifier prompts; it is sanitized exactly like the existing prefix name.
+- Dedup on notice text: identical held-reply/attention bodies still dedupe (the name is stable per topic).
+
+## 6. External surfaces
+
+User-visible wording in attention items and notices gains the topic name. Session prompts gain the
+name. Nothing sent to peers changes. No config switch (wording only; a revert is the rollback).
+
+## 6b. Operator-surface quality
+
+Attention titles become longer by the topic name; they stay one line.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+Machine-local by design: each machine renders from its own adapter's registry, which already
+replicates names through the existing topic-registry paths. A standby that has not yet learned a
+name says "(name unresolved)" rather than guessing.
+
+## 8. Rollback cost
+
+Revert the PR; no persisted state, no migration.
+
+## Conclusion
+
+Wording-only change with a structural ratchet against regression.
+
+## Evidence pointers
+
+- tests/unit/topic-ref.test.ts
+- tests/unit/topic-ref-ratchet.test.ts
+- tests/integration/threadline/topic-name-beside-id.test.ts
+- tests/e2e/topic-name-beside-id-alive.test.ts
+
+## Class-Closure Declaration (display-only mirror)
+
+- **`defectClass`** — `n/a`
+- **`closure`** — `n/a`
+- **reason** — rendering change; no self-triggered action.
+
+## Main-merge review (2026-11-04)
+
+After merging current main, four source files had acquired new bare topic labels: `SessionDrainRunner`, `AgentServer`, `server.ts`, and `WorkYieldRegistry`. They now use the same `topicRef` formatter. `OriginForwardToHolder.heldExpiryItem` also uses it while retaining main's condition key and attention-item shape. This is a Tier 1 wording repair in an existing formatter path. No new gate, block, routing choice, or static judgment heuristic was added; the signal-versus-authority rule in `docs/signal-vs-authority.md` is therefore unchanged.
+
+Over-block: none. Under-block: the two baseline sites described above remain. The formatter is the right layer because all four callers need the same verified local topic name. Interactions: only notice and audit text changes; topic ids, attention condition keys, dedupe keys, transfer decisions, and Telegram delivery remain as before. External surface: an agent or operator may see the topic name beside the id in a transfer reason, held-reply notice, media degradation, or maintenance work label. Multi-machine posture: machine-local registry reads by design, because a serving machine knows the topic names it owns; unresolved names are stated plainly. The changes add no durable state, URL, or new notifier, so they do not create a new one-voice or transfer obligation. Rollback is a revert of this PR; no data migration is needed.
+
+## Scope audit (2026-11-04)
+
+The first baseline included errors, refusal reasons, recovery notices, and command output that
+an agent or operator can read. Those are part of the operator's rule, so they now call
+`topicRef` too. This includes desktop confirmation, profile transfer disclosure, session
+recovery, PromiseBeacon, Telegram sender failures, and API error text. The changed log lines
+use the same formatter for consistency. This widens wording coverage only; no delivery target,
+ownership decision, or durable key changed. The local resolver can still have no verified name,
+in which case the text explicitly says `name unresolved`.
+
+The issues-group refusal text is also read by the legacy relay replay classifier. Its parser
+now accepts the old bare-id form plus the new verified-name and unresolved-name forms; unit
+coverage checks all three so queued replies retain their replay classification across update.
+
+The full unit run exposed three integration points in the merged branch. The watch-only
+maintenance import allowlist now explicitly permits the pure formatter; the held-reply
+assertion expects the unresolved-name wording; and the release note remains under
+`upgrades/next/` so the release assembler consumes it. All three focused tests pass.
+
+The new GitHub run exposed a runner-specific failure in the existing Claude-key E2E test:
+the test's CLI child loaded Config before key handling, and Config required the configured
+framework binary. GitHub's runner has no Claude CLI. Main independently fixed this
+production defect in PR #2719 while this PR was running. The merge retains main's stronger
+test, which runs the CLI with no framework binary on PATH and verifies the key path directly.
+This PR's temporary test stub was dropped during conflict resolution.
+
+The later CI run found one memory-recovery test timing out at the default ten-second
+limit under a loaded Node 20 shard. The same file passed locally in 2.3 seconds; that
+test now allows thirty seconds for the real subprocess checks. The local full integration
+run found this host below the media store's five-percent free-disk floor, so three
+unrelated media-flow fixtures refused uploads. Those fixtures now supply a healthy disk
+reading for their media store instances. Production disk refusal remains unchanged and
+retains its separate tests.