instar 1.3.347 → 1.3.349

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.347",
+  "version": "1.3.349",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-06T05:48:21.704Z",
-  "instarVersion": "1.3.347",
+  "generatedAt": "2026-06-06T06:49:15.721Z",
+  "instarVersion": "1.3.349",
   "entryCount": 199,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "014d019d06282359a2d00546243006a86f1fd450663b9f33cdd8235d9d7e0719",
+      "contentHash": "d2905deee33cdc5d932612a152d26c87b57cfe33baf8482c5353ca91dee588a5",
       "since": "2025-01-01"
     },
     "cli:init": {

package/upgrades/1.3.348.md

@@ -0,0 +1,57 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: minor -->
+
+## What Changed
+
+**Coherence Journal mesh transport (P1 closing step)** — the `journal-sync`
+MeshCommand + receive handler + own-stream advert on the `session-status`
+response + `PeerPresencePuller` delta-drive that runs the merged
+`JournalSyncApplier` over the existing 30s machine check-in
+(COHERENCE-JOURNAL-SPEC §3.4 rule 5). Adverts are O(kinds) integers on the
+heartbeat; entry deltas ride separate size-capped requests. Ships DARK
+everywhere (gated on explicit `multiMachine.coherenceJournal.replication.enabled
+=== true`) — merge does not change live mesh traffic; cross-machine sync is
+a deliberate flip (the live two-machine proof).
+
+The MTP red-team harness resolver (`src/redteam/ScenarioPack.ts`) now states its
+governance verdicts honestly. Every `ResolvedExpectation` carries a `method`
+field (`keyword-heuristic`), and the `reason` strings name their keyword-overlap
+basis instead of asserting the verdict as fact — an `ungoverned` result is now
+framed as a candidate to verify semantically, not a proven intent gap. The
+matching logic is unchanged; only the verdict's self-description.
+
+## What to Tell Your User
+
+This is the wire that lets your agent's machines actually exchange their
+diaries — but it ships switched OFF. Turning it on (so the Laptop can answer
+"where did this conversation live on the Mini?") is a deliberate, watched
+step, not something a code update flips silently.
+
+Nothing user-facing changes. This is an internal correctness fix to an
+experimental capability: the red-team harness no longer overstates a crude
+keyword-match result as a definitive finding.
+
+## Summary of New Capabilities
+
+- None user-invocable yet — the transport is dark until the replication
+  switch is turned on. Internal: `journal-sync` mesh verb + advert-driven
+  delta replication.
+
+- `ResolvedExpectation.method` field for provenance of every governance verdict.
+- Honest verdict `reason` strings (keyword-overlap basis named; `ungoverned`
+  framed as candidate-to-verify).
+
+## Evidence
+
+- Integration round-trip (two in-process journal+applier pairs through a
+  real signed MeshRpc envelope; forged-sender rejection) + gated-drive unit
+  test (no-op when off, never throws). tsc + full lint chain clean.
+
+Not a behavior change to classification — a truthfulness fix to the verdict
+text + a provenance field, required by the Truthful Provenance standard (#896).
+The brittleness it makes honest about was observed live: a false-negative
+`ungoverned` verdict on the first boundary map. Verified by 26 unit tests
+(one new, asserting method-provenance and that the as-fact phrasing is gone) and
+a clean `tsc --noEmit`.

package/upgrades/1.3.349.md

@@ -0,0 +1,37 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Fixes #866: `POST /projects/:id/advance` building→merged always failed
+`GH_PR_VIEW_UNAVAILABLE` because `StageTransitionValidator` has no internal
+default for `ghPrView`/`gitMergeBaseIsAncestor` and the route never injected
+them — so no project item could ever reach `merged` through the live API.
+The route now injects both as read-only helpers (`gh pr view` and
+`merge-base --is-ancestor` via SafeGitExecutor.readSync) against the
+project's target repo. A wiring-integrity test asserts the helper-absent
+error can never recur.
+
+## What to Tell Your User
+
+If you drive a multi-spec initiative through the projects pipeline, its
+items can now actually reach the "merged" stage — the system verifies the
+work's pull request really merged (merge state, commit reachable on the
+main branch, CI green) instead of always erroring out. Project status
+finally tracks reality through the whole pipeline.
+
+## Summary of New Capabilities
+
+- `POST /projects/:id/advance` with `targetStage: "merged"` now works end to
+  end (was structurally impossible): it verifies the PR via `gh pr view` and
+  confirms the merge commit is reachable on `origin/main` before recording
+  the item as merged.
+
+## Evidence
+
+- tests/integration/projects-api.test.ts: building→merged now returns
+  GH_PR_VIEW_FAILED (not UNAVAILABLE), deterministic regardless of whether
+  gh is installed/authed. Full projects-api (45) + StageTransitionValidator
+  (26) green; tsc + destructive lint clean.

package/upgrades/coherence-journal-meshwire.eli16.md

@@ -0,0 +1,9 @@
+# The diaries actually sync now (P1 closing step — mesh transport)
+
+P1.1 made each machine keep its diaries, P1.2 made them readable, P1.3 built the engine that safely receives a peer's diary. This is the wire that connects them: machines now actually hand each other their diaries over the secure line they already use.
+
+It's deliberately tiny and cheap. The existing once-every-30-seconds "are you alive?" check between machines now carries one extra scrap of information: a peer's "I'm at line N in each of my diaries." When a machine notices a peer is further along than the copy it holds, it asks for just the missing lines — over a separate, size-capped request, so the fast heartbeat itself never gets heavy. The receiving side runs every defense from P1.3 (a machine can only hand over its OWN diary; every line validated; restores caught; nothing trusted until durably saved).
+
+**The safety choice that matters:** this ships DARK even on me. Merging it does NOT turn on cross-machine syncing. The transport and the drive are gated behind an explicit "replication on" switch that defaults off everywhere — so landing this code changes nothing about live mesh traffic. Turning it on between the Laptop and the Mini is a separate, deliberate, watched step (the live proof you pre-approved). This is on purpose: the mesh is load-bearing for everything, and "merge a PR" should never silently rewire it.
+
+What the live proof will show, once both machines are on this version and I flip the switch: move conversation 13481 from the Laptop to the Mini, then ask the LAPTOP "where did 13481 live and why did it move?" — and it answers correctly from the Mini's synced diary. That's the whole initiative's promise, demonstrated end to end. After the proof, the switch can become the spec's default (live-on-dev); until then it stays off so nothing surprises us.

package/upgrades/projects-advance-ghprview-866.eli16.md

@@ -0,0 +1,11 @@
+# Projects can finally reach the "merged" stage (#866)
+
+The /projects system tracks a multi-spec initiative through stages: outline → spec → approved → building → merged. The last hop, "building → merged," verifies the work's PR actually merged by asking GitHub about it. The problem: the code that does that verification needs a small helper handed to it ("here's how to ask GitHub about a PR"), and the API route that drives the transition never handed it over. So EVERY attempt to move a project item to "merged" failed with "GitHub-PR-view helper not provided" — meaning no project, on any install, could ever record a step as merged through the live API. The project registry silently lagged reality forever.
+
+This is the textbook wiring-integrity failure the project's own testing standard warns about: the verification logic was unit-tested (with a fake helper passed in), so it looked covered — but in production the real helper was never wired, so the feature was dead. I hit it firsthand tonight trying to mark the multi-machine-coherence P0 round "merged" after its PR landed.
+
+The fix injects two small READ-ONLY helpers at the route: one runs `gh pr view <n>` to check the PR's merge state, the other runs `git merge-base --is-ancestor` to confirm the commit is really on the branch — both against the project's own target repo. Nothing destructive; just reads.
+
+The test is the meaningful part: it proves the helper is now actually wired by asserting that a building→merged attempt can NEVER again return "helper not provided" — any real failure (no such PR, gh not installed) now surfaces as "PR-view failed" instead. The only way to get the old error back is to un-wire the helper, which the test would catch. That's the wiring-integrity check the missing piece needed all along.
+
+_Follow-up: the read-only merge-base catch carries an `@silent-fallback-ok` note — a non-zero `--is-ancestor` exit IS the negative answer (not an ancestor), not a degradation._

package/upgrades/side-effects/coherence-journal-meshwire.md

@@ -0,0 +1,49 @@
+# Side-Effects Review — Coherence Journal mesh transport (P1 closing step)
+
+**Version / slug:** `coherence-journal-meshwire`
+**Date:** `2026-06-05`
+**Author:** `echo`
+**Second-pass reviewer:** `not required as a PR-time pass — design converged (§3.4 rule 5); this is the transport that drives the already-merged, already-reviewed JournalSyncApplier`
+
+## Summary of the change
+
+Wires the `journal-sync` mesh transport (COHERENCE-JOURNAL-SPEC §3.4 rule 5) that drives the merged `JournalSyncApplier`: a `journal-sync` MeshCommand (read/observe RBAC class), an always-registered receive handler (serve own-stream batch / apply inbound), the own-stream advert piggybacked on the `session-status` response, and the `PeerPresencePuller` delta-drive (request + apply when a peer is ahead). The SEND/drive path is gated on `multiMachine.coherenceJournal.replication.enabled === true` (explicit true only) — ships DARK on every agent including echo; merge does not alter live mesh traffic.
+
+## Decision-point inventory
+- `journal-sync` RBAC classification — ADD — read/observe class (any registered peer), same as capacity-report/session-status. No new authority: it serves/accepts replica DATA, never an actuation.
+- Replication activation — gated on explicit `replication.enabled===true`; absent in ConfigDefaults → false everywhere. The proof flips it deliberately.
+
+## 1. Over-block
+Receive handler rejects forged/invalid entries via the applier's §3.4 gates (already reviewed) — counted, never silent. No new over-block surface on the live path (drive is dark).
+
+## 2. Under-block
+First-hop-only: a third machine's history relayed by a peer is rejected (accepted P1 limitation; transitive relay is post-P1). The receive handler being always-on is safe because the applier validates every entry and no peer SENDS unless its own replication flag is on.
+
+## 3. Level-of-abstraction fit
+Transport is a thin driver over the pure applier/writer; the puller carries the advert because the puller IS the existing 30s cadence (no new timer — §3.4 rule 5's grounded correction). Right seam.
+
+## 4. Signal vs authority compliance
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+- [x] No — the transport moves signal data (replica streams). The §3.9 actuation-ban lint (merged) keeps consumers signal-only.
+
+## 5. Interactions
+- Heartbeat bloat: the advert is O(kinds) integers on the session-status RESPONSE; entry payloads ride SEPARATE size-capped journal-sync requests, never the heartbeat envelope (the master spec's JSON.stringify-on-hot-path root cause is avoided).
+- Mixed-version: an old peer RBAC-default-denies journal-sync (403) or has no handler (501); the sender treats both as "peer lacks the verb" and backs off — no retry storm (gated drive only runs when replication is on anyway).
+- Backward-compat: the journalAdvert field on session-status is optional; old callers parse permissively and ignore it (verified).
+- guardWrite seam: replica appends go through state.guardJournalWrite (standby-safe, prefix-allowlisted) — same as the writer.
+
+## 6. External surfaces
+- New mesh verb on the wire ONLY when replication.enabled===true on the sender. On merge: dark everywhere → zero new mesh traffic. The receive handler accepts journal-sync if a peer ever sends, but no peer sends while dark.
+- New replica files under state/coherence-journal/peers/ ONLY once the proof flips it on.
+
+## 7. Rollback cost
+Pure code revert + patch; replica files inert plain JSONL. The dark default means rollback before the proof is a no-op in practice.
+
+## Conclusion
+The transport lands dark by explicit gate so merge ≠ live mesh change; the live two-machine proof is a deliberate, monitored flip (pre-approved). The §3.4-rule-5 grounded transport (advert on the real 30s pull, deltas separate + capped) is implemented as specified. After a successful proof, the gate can move to the spec's live-on-dev default in a follow-up. Clear to ship dark.
+
+## Second-pass review (if required)
+**Reviewer:** convergence panel (§3.4 design-time) + the live two-machine proof as the closing functional verification.
+
+## Evidence pointers
+- tests/integration/journal-sync-roundtrip.test.ts (two in-process pairs through a real signed envelope; forged-sender rejection), tests/unit/PeerPresencePuller-journal.test.ts (gated drive; no-op when off; never throws).

package/upgrades/side-effects/projects-advance-ghprview-866.md

@@ -0,0 +1,44 @@
+# Side-Effects Review — projects advance ghPrView wiring (#866)
+
+**Version / slug:** `projects-advance-ghprview-866`
+**Date:** `2026-06-06`
+**Author:** `echo`
+**Second-pass reviewer:** `not required — small read-only wiring fix + a wiring-integrity test`
+
+## Summary of the change
+
+`POST /projects/:id/advance` building→merged always failed `GH_PR_VIEW_UNAVAILABLE`: `StageTransitionValidator` requires `ctx.ghPrView` (and `ctx.gitMergeBaseIsAncestor`) for that edge but provides NO internal default (unlike `readSpecFrontmatter`, which `loadFrontmatter` defaults), and the route built `validationCtx` without them. Fix: inject both as READ-ONLY helpers (`gh pr view --json state,mergeCommit,statusCheckRollup` and `git merge-base --is-ancestor`) against `project.targetRepoPath`. No item could ever reach `merged` through the live API before this — found closing out multimachine-coherence P0.
+
+## Decision-point inventory
+- `building → merged` gate — was UNREACHABLE (always errored before the real check) → now REACHES the real GitHub merge-state check. The gate's logic is unchanged; only its required helpers are now provided.
+
+## 1. Over-block
+Before: 100% over-block (every merged transition rejected regardless of truth). After: the gate rejects only when the PR isn't genuinely merged. Strict improvement.
+
+## 2. Under-block
+The helper trusts `gh`/`git` output for the project's target repo (operator-controlled). A compromised target repo could misreport — but that repo is the operator's own; no new external trust surface.
+
+## 3. Level-of-abstraction fit
+Helpers injected at the route (where targetRepoPath + child-process access live), consumed by the pure validator — the same seam the validator's tests already use with mocks. Right layer.
+
+## 4. Signal vs authority compliance
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+- [x] No — the gate is a smart validator (real GitHub state); the change only supplies its inputs. No brittle detector gains authority.
+
+## 5. Interactions
+- The helpers are read-only (`gh pr view`, `git merge-base --is-ancestor`) — no mutation, no SafeGitExecutor needed (that funnel is for destructive ops).
+- A missing/unauthed `gh` throws inside the helper → validator maps to `GH_PR_VIEW_FAILED` (a clean rejection), never a crash.
+
+## 6. External surfaces
+- Spawns `gh`/`git` against the project's target repo when a merged transition is attempted. No new persistent state, no messaging, no fleet surface. Other advance edges (outline→spec, approved→building, →skipped) unchanged.
+
+## 7. Rollback cost
+Pure code revert + patch. No state.
+
+## Conclusion
+Closes #866: the projects pipeline can record merged steps for the first time. The wiring-integrity test asserts the helper-absent error can never recur. Clear to ship.
+
+## Evidence pointers
+- `tests/integration/projects-api.test.ts` — new building→merged test asserts `code !== GH_PR_VIEW_UNAVAILABLE` (→ `GH_PR_VIEW_FAILED`), deterministic regardless of gh presence; full file 45 tests + StageTransitionValidator 26 green; tsc clean.
+
+_Follow-up: the merge-base catch carries an `@silent-fallback-ok` note (non-zero `--is-ancestor` exit = the negative answer, not a degradation) — holds the no-silent-fallbacks budget._