instar 1.3.283 → 1.3.284

package/dist/scheduler/MentorAutonomousGuardian.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MentorAutonomousGuardian.d.ts","sourceRoot":"","sources":["../../src/scheduler/MentorAutonomousGuardian.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,MAAM,WAAW,sBAAsB;IACrC,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,OAAO,EAAE,OAAO,CAAC;IACjB;oFACgF;IAChF,QAAQ,EAAE,OAAO,CAAC;IAClB;8EAC0E;IAC1E,gBAAgB,EAAE,OAAO,CAAC;IAC1B,0EAA0E;IAC1E,kBAAkB,EAAE,OAAO,CAAC;IAC5B,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC;IACd;;qCAEiC;IACjC,SAAS,EAAE,MAAM,MAAM,CAAC;IACxB;0EACsE;IACtE,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpF,8BAA8B;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,wBAAwB,GAChC,UAAU,GACV,QAAQ,GACR,aAAa,GACb,iBAAiB,GACjB,SAAS,GACT,cAAc,CAAC;AAEnB,MAAM,WAAW,wBAAwB;IACvC,GAAG,EAAE,OAAO,CAAC;IACb,MAAM,EAAE,wBAAwB,CAAC;IACjC,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,wBAAwB,CAAC,CAyBnC;AAED,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,eAAe,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,eAAe,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAoB/D"}
+{"version":3,"file":"MentorAutonomousGuardian.d.ts","sourceRoot":"","sources":["../../src/scheduler/MentorAutonomousGuardian.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,MAAM,WAAW,sBAAsB;IACrC,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,OAAO,EAAE,OAAO,CAAC;IACjB;oFACgF;IAChF,QAAQ,EAAE,OAAO,CAAC;IAClB;8EAC0E;IAC1E,gBAAgB,EAAE,OAAO,CAAC;IAC1B,0EAA0E;IAC1E,kBAAkB,EAAE,OAAO,CAAC;IAC5B,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC;IACd;;qCAEiC;IACjC,SAAS,EAAE,MAAM,MAAM,CAAC;IACxB;0EACsE;IACtE,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpF,8BAA8B;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,wBAAwB,GAChC,UAAU,GACV,QAAQ,GACR,aAAa,GACb,iBAAiB,GACjB,SAAS,GACT,cAAc,CAAC;AAEnB,MAAM,WAAW,wBAAwB;IACvC,GAAG,EAAE,OAAO,CAAC;IACb,MAAM,EAAE,wBAAwB,CAAC;IACjC,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,wBAAwB,CAAC,CAyBnC;AAED,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,eAAe,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,eAAe,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAqB/D"}

package/dist/scheduler/MentorAutonomousGuardian.js

@@ -84,6 +84,7 @@ export function buildAutoloopGoal(p) {
         ``,
         `Discipline (non-negotiable): verify before you claim — never write a result or a number before the producing tool has returned it. Never narrate a tool call you did not make. One cycle, then exit cleanly — do NOT spawn another copy of this loop or schedule a follow-up; the guardian starts the next cycle on its own heartbeat.`,
         `Gate compliance (ratchet gates): an intentional best-effort/fail-open catch must either report through DegradationReporter or carry an inline @silent-fallback-ok justification — never bump a ratchet baseline to pass CI. When you author a task brief or spec for another agent, spell these gate notes out explicitly: a spec that says "best-effort, never throws" without them invites the exact ratchet failure it is trying to avoid.`,
+        `Before you build (parallel-claim check): run \`instar dev:claim-check <paths you intend to touch> [--keywords ...]\` FIRST — if an open/recently-merged PR or a spec already owns a layer of the problem, claim a DIFFERENT layer explicitly (division-of-labor; earned 2026-06-05 when two parallel sessions built the same incident fix twice). And every PR DESCRIPTION must include an \`## ELI16\` section (a required CI gate) — write it in from the start, not after the gate goes red.`,
     ].join('\n');
 }
 //# sourceMappingURL=MentorAutonomousGuardian.js.map

package/dist/scheduler/MentorAutonomousGuardian.js.map

@@ -1 +1 @@
-{"version":3,"file":"MentorAutonomousGuardian.js","sourceRoot":"","sources":["../../src/scheduler/MentorAutonomousGuardian.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AA8CH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAA4B;IAE5B,qEAAqE;IACrE,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAE7D,4EAA4E;IAC5E,uEAAuE;IACvE,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAE5D,+EAA+E;IAC/E,sEAAsE;IACtE,mEAAmE;IACnE,IAAI,IAAI,CAAC,gBAAgB;QAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAExE,6EAA6E;IAC7E,2DAA2D;IAC3D,IAAI,CAAC,IAAI,CAAC,kBAAkB;QAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAE/E,8EAA8E;IAC9E,IAAI,CAAC;QACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAClF,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAChE,CAAC;AACH,CAAC;AAaD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAqB;IACrD,MAAM,OAAO,GAAG,CAAC,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5F,MAAM,UAAU,GACd,CAAC,CAAC,aAAa,KAAK,SAAS;QAC3B,CAAC,CAAC,oGAAoG,CAAC,CAAC,aAAa,uCAAuC;QAC5J,CAAC,CAAC,6GAA6G,CAAC;IACpH,OAAO;QACL,iFAAiF,CAAC,CAAC,eAAe,KAAK,CAAC,CAAC,eAAe,4BAA4B;QACpJ,6KAA6K;QAC7K,EAAE;QACF,eAAe;QACf,0BAA0B,CAAC,CAAC,eAAe,+OAA+O;QAC1R,+GAA+G,OAAO,+CAA+C;QACrK,+PAA+P;QAC/P,6BAA6B,CAAC,CAAC,eAAe,4YAA4Y;QAC1b,MAAM,UAAU,EAAE;QAClB,EAAE;QACF,wUAAwU;QACxU,+aAA+a;KAChb,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}
+{"version":3,"file":"MentorAutonomousGuardian.js","sourceRoot":"","sources":["../../src/scheduler/MentorAutonomousGuardian.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AA8CH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAA4B;IAE5B,qEAAqE;IACrE,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAE7D,4EAA4E;IAC5E,uEAAuE;IACvE,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAE5D,+EAA+E;IAC/E,sEAAsE;IACtE,mEAAmE;IACnE,IAAI,IAAI,CAAC,gBAAgB;QAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAExE,6EAA6E;IAC7E,2DAA2D;IAC3D,IAAI,CAAC,IAAI,CAAC,kBAAkB;QAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAE/E,8EAA8E;IAC9E,IAAI,CAAC;QACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAClF,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAChE,CAAC;AACH,CAAC;AAaD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAqB;IACrD,MAAM,OAAO,GAAG,CAAC,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5F,MAAM,UAAU,GACd,CAAC,CAAC,aAAa,KAAK,SAAS;QAC3B,CAAC,CAAC,oGAAoG,CAAC,CAAC,aAAa,uCAAuC;QAC5J,CAAC,CAAC,6GAA6G,CAAC;IACpH,OAAO;QACL,iFAAiF,CAAC,CAAC,eAAe,KAAK,CAAC,CAAC,eAAe,4BAA4B;QACpJ,6KAA6K;QAC7K,EAAE;QACF,eAAe;QACf,0BAA0B,CAAC,CAAC,eAAe,+OAA+O;QAC1R,+GAA+G,OAAO,+CAA+C;QACrK,+PAA+P;QAC/P,6BAA6B,CAAC,CAAC,eAAe,4YAA4Y;QAC1b,MAAM,UAAU,EAAE;QAClB,EAAE;QACF,wUAAwU;QACxU,+aAA+a;QAC/a,ieAAie;KACle,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.283",
+  "version": "1.3.284",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/scripts/check-repo-invariants.mjs

@@ -12,6 +12,15 @@
  *   2. No fixture stowaway files at the repo root. file-0.txt and
  *      seed are signature artifacts of the test-fixture pollution
  *      class; they should never exist on main.
+ *   3. Release-note fragments (upgrades/next/*.md + legacy NEXT.md)
+ *      assemble and validate cleanly — using the SAME assembler +
+ *      validator the pre-push gate and publish workflow use. The
+ *      pre-push gate already catches this locally, but local hooks are
+ *      bypassable (admin/web merges, pre-guard history): a malformed
+ *      fragment that reaches main jams EVERY subsequent fleet release
+ *      at publish-time (lived twice: the v1.3.180 jam and #781 on
+ *      2026-06-05). This server-side check runs on every PR and on
+ *      main, so the jam is loud and attributable instead of silent.
  *
  * Exit 0 = invariants hold. Exit 1 = at least one violated; the
  * specific failures are printed to stderr.
@@ -19,6 +28,8 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
+import { validateGuideContent } from './upgrade-guide-validator.mjs';
+import { assembleNextMd, gatherFragmentInputs } from './assemble-next-md.mjs';
 
 const ROOT = process.cwd();
 const MIN_README_LINES = Number(process.env.INSTAR_README_MIN_LINES || 100);
@@ -55,6 +66,35 @@ for (const name of FIXTURE_STOWAWAYS) {
   }
 }
 
+// ── Release-note fragments assemble + validate ────────────────────
+// Mirrors scripts/pre-push-gate.js §1 exactly (same shared functions), so a
+// fragment that would jam publish.yml can never sit quietly on main. No
+// fragments at all is FINE here — "src changed without a fragment" is the
+// pre-push gate's per-branch concern; this invariant only asserts that
+// whatever fragments DO exist are publishable.
+{
+  const upgradesDir = path.join(ROOT, 'upgrades');
+  if (fs.existsSync(upgradesDir)) {
+    try {
+      const { inputs } = gatherFragmentInputs(upgradesDir);
+      if (inputs.length > 0) {
+        const assembled = assembleNextMd(inputs);
+        for (const issue of validateGuideContent(assembled)) {
+          failures.push(
+            `Release-note fragments (upgrades/next/*.md + NEXT.md) fail validation: ${issue} ` +
+            `— this would jam the publish workflow for EVERY release until fixed.`,
+          );
+        }
+      }
+    } catch (err) {
+      failures.push(
+        `Release-note fragments are malformed (assembly failed): ${err instanceof Error ? err.message : err} ` +
+        `— this would jam the publish workflow for EVERY release until fixed.`,
+      );
+    }
+  }
+}
+
 if (failures.length === 0) {
   console.log('✅ Repository invariants hold.');
   process.exit(0);

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-05T09:56:36.782Z",
-  "instarVersion": "1.3.283",
+  "generatedAt": "2026-06-05T10:00:50.492Z",
+  "instarVersion": "1.3.284",
   "entryCount": 198,
   "entries": {
     "hook:session-start": {

package/upgrades/{1.3.283.md → 1.3.284.md}

@@ -5,17 +5,30 @@
 
 ## What Changed
 
+`scripts/check-repo-invariants.mjs` gains invariant #3 (assemble + validate fragments in-memory; throws and validator issues are failures; zero fragments passes). Reuses `assembleNextMd` + `validateGuideContent` — no duplicated rules, no drift. Tests cover all four boundary states (valid, malformed-assembly, missing-section, empty). Task #42.
+
 One change in `writeDecisionAudit` (auto-stage after append) + a regression test (`tests/unit/instar-dev-precommit-audit-staging.test.ts`) pinning that the line is written AND staged even when the gate blocks. Root cause of the task-#62 "decision-audit didn't fire" mystery: it fired; the line sat uncommitted in the building worktree and was deleted with it.
 
+One discipline line appended in `buildAutoloopGoal` (`src/scheduler/MentorAutonomousGuardian.ts`), pinned by the existing deterministic prompt-assembly unit test (2 new assertions). Earned from the 2026-06-05 double parallel-collision and the live #813 eli16-gate hit.
+
 ## What to Tell Your User
 
+Nothing user-visible. A release-pipeline failure mode is closed: a malformed release-note fragment can no longer sit silently on the main branch and jam every subsequent release — it now turns CI red immediately on the PR that carries it (or on main itself, loudly attributable).
+
 Nothing user-visible. An internal audit-trail leak is closed: the per-commit build-decision record (tier declared vs suggested) used to evaporate with reclaimed worktrees; it now travels inside the commit it describes.
 
+Nothing user-visible. The autonomous mentor-development loop's built-in working instructions now include two recently-earned ship rules, so future cycles don't rediscover them the hard way.
+
 ## Summary of New Capabilities
 
+- The Repo Invariants required CI check now assembles and validates all release-note fragments (`upgrades/next/*.md` + legacy `NEXT.md`) using the same shared validators the publish workflow uses.
+- Admin/web merges can no longer bypass fragment validation (the pre-push hook was local-only).
+
 - `scripts/instar-dev-precommit.js` stages `.instar/instar-dev-decisions.jsonl` right after appending the audit line, so the line lands in the same commit it audits.
 - A gate-blocked commit leaves the line staged; it rides the retry commit (both evaluations were real).
 
+- The mentor autoloop goal prompt instructs each cycle to run `instar dev:claim-check` before starting a build (parallel-claim collision prevention) and to include the `## ELI16` section in every PR description from the start (the required CI gate).
+
 ## Evidence
 
 Reproduced live twice on 2026-06-05 before the fix: two build worktrees (`keychain-per-agent`, then `dev-claim-check`) each held an orphaned, uncommitted `+{"ts":"2026-06-05T08:49:24Z","slug":"keychain-per-agent-master-key",...}` line in the tracked `.instar/instar-dev-decisions.jsonl` after their PR commit — `git status` showed ` M .instar/instar-dev-decisions.jsonl` post-commit, and removing the worktree would have deleted the only copy (one line was hand-rescued before reclaim). After the fix, observed on PR #814's own commit: `git status --short .instar/instar-dev-decisions.jsonl` is CLEAN immediately post-commit and the commit diff contains the gate's own audit line for that very commit — the dogfood proof quoted in the PR body.

package/upgrades/ci-fragment-invariant.eli16.md

@@ -0,0 +1,3 @@
+# Release-note fragments are now checked by CI, not just local hooks
+
+Every release ships with release notes assembled from per-PR fragment files. If one fragment is malformed, the release pipeline jams — and not just for that one change: EVERY release for EVERY agent stops until someone finds and fixes the bad fragment. We had local protection (a check that runs on your machine before you push), but local checks can be bypassed — merging from the GitHub website or with admin rights skips them entirely, which is exactly how a bad fragment reached the main branch twice. Now the same fragment validation also runs on GitHub's servers as part of the required CI checks on every PR and on main itself: a bad fragment turns the checks red immediately, named and attributable, instead of silently waiting to jam the next release.

package/upgrades/mentor-prompt-tonight-gates.eli16.md

@@ -0,0 +1,3 @@
+# The autonomous-mentor loop now teaches two new ship rules
+
+The mentor system can run an autonomous develop-and-fix loop whose working instructions are encoded in code (so every cycle gets the same discipline, not whatever someone remembers to type). Two rules earned the hard way on 2026-06-05 are now part of those durable instructions: (1) before starting any build, run the new claim-check command so two parallel builders never construct the same fix twice — that exact collision happened twice in one night and wasted hours; (2) every PR description must include a plain-English ELI16 section from the start, because a required CI gate now rejects PRs without one — better to write it up front than to discover the red check after pushing.

package/upgrades/side-effects/ci-fragment-invariant.md

@@ -0,0 +1,46 @@
+# Side-Effects Review — CI fragment invariant (server-side publish-jam guard)
+
+**Version / slug:** `ci-fragment-invariant`
+**Date:** `2026-06-05`
+**Author:** `echo`
+**Second-pass reviewer:** `self-review under the Tier-1 lite lane (CI check addition reusing existing shared validators; no runtime surface)`
+
+## Summary of the change
+
+`scripts/check-repo-invariants.mjs` (the Repo Invariants required CI check) gains invariant #3: release-note fragments (`upgrades/next/*.md` + legacy `NEXT.md`) must assemble and validate cleanly, using the SAME `assembleNextMd` + `validateGuideContent` the pre-push gate and publish workflow use. Closes the bypass path of the publish-jam class (task #42): local pre-push hooks are skipped by admin/web merges, so a malformed fragment could reach main and jam every subsequent fleet release at publish-time (lived twice: v1.3.180, #781 on 2026-06-05).
+
+## Decision-point inventory
+
+- `check-repo-invariants.mjs` invariant #3 — add — assemble-in-memory + validate; assembly throw → failure; validator issues → failures; no upgrades dir / zero fragments → pass.
+
+## 1. Over-block
+
+Two considered cases:
+- **Inherited red:** a malformed fragment already on main turns Repo Invariants red on EVERY open PR until fixed (same blast shape as tonight's ratchet debt). Intentional — Zero-Failure treats main breakage as everyone's loudest problem; the alternative (silent until publish) jams the whole fleet's release train invisibly.
+- **Cross-fragment validator coupling:** validation runs on the ASSEMBLED guide, so one PR's red can be caused by another's fragment. This mirrors the pre-push gate's long-standing behavior exactly (same functions), so no NEW over-block class is introduced.
+- "src changed without any fragment" is deliberately NOT asserted here (stays a per-branch pre-push concern); docs-only states and post-release-cut states (no fragments) pass.
+
+## 2. Over-permit
+
+None — purely additive check; nothing previously blocked becomes allowed.
+
+## 3. Drift risk
+
+Validation logic is imported from the shared modules (`assemble-next-md.mjs`, `upgrade-guide-validator.mjs`) — no duplicated rules, so the CI check can never drift from what publish actually enforces.
+
+## 4. Failure modes
+
+- Validator/assembler module missing or broken → the invariants script itself fails to load → Repo Invariants red (loud, correct).
+- Empty `upgrades/next/` dir or absent `upgrades/` dir → pass (post-release-cut normal state; verified on the live tree and pinned by test).
+
+## 5. Migration parity
+
+None needed — repo-internal CI script; ships with the repo.
+
+## 6. Token/cost impact
+
+None. Pure-node in-memory assembly per CI run (milliseconds).
+
+## 7. Rollback
+
+Revert the commit; the invariant disappears, local pre-push remains the only fragment guard (the prior, bypassable state).

package/upgrades/side-effects/mentor-prompt-tonight-gates.md

@@ -0,0 +1,34 @@
+# Side-Effects Review — mentor autoloop prompt: claim-check + ELI16-body rules
+
+**Version / slug:** `mentor-prompt-tonight-gates`
+**Date:** `2026-06-05`
+**Author:** `echo`
+**Second-pass reviewer:** `self-review under the Tier-1 lite lane (one prompt line in a pure, unit-tested string builder; no control-flow change)`
+
+## Summary of the change
+
+`buildAutoloopGoal` (the durable goal prompt for the mentor autonomous-fix loop, `MentorAutonomousGuardian.ts`) gains one discipline line encoding two 2026-06-05 lessons: run `instar dev:claim-check` before starting a build (the double parallel-collision night — #802 vs the keychain spec, #810 vs #808), and write the `## ELI16` section into the PR DESCRIPTION from the start (the new required CI gate, hit live on #813).
+
+## Decision-point inventory
+
+- `buildAutoloopGoal` — modified — one appended prompt line; pure function, no behavioral branch added.
+
+## 1. Over-block / 2. Over-permit
+
+None — prompt text only. The loop's gates (budget, single-instance, dark-by-default `mentor.autonomousFix.enabled`) are untouched. A host overriding via `mentor.autonomousFix.goalTemplate` is unaffected (the override path bypasses the built-in string entirely, unchanged).
+
+## 3. Drift note
+
+The prompt references the `dev:claim-check` CLI (shipped in #813) and the ELI16 PR-body gate (shipped 2026-06-05). If either is ever removed, this line goes stale — both are referenced by name so a grep finds them.
+
+## 4. Migration parity
+
+None — src-internal constant; ships with the package.
+
+## 5. Token/cost impact
+
+~90 extra prompt tokens per autoloop cycle spawn. Negligible.
+
+## 6. Rollback
+
+Revert the commit; the prompt loses the two reminders (structural gates still enforce both server-side — this line just saves the cycle from discovering them red).