instar 1.3.367 → 1.3.369

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.367",
+  "version": "1.3.369",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-06T12:27:53.565Z",
-  "instarVersion": "1.3.367",
+  "generatedAt": "2026-06-06T13:31:16.750Z",
+  "instarVersion": "1.3.369",
   "entryCount": 199,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "358319609ea3f5ca32e2ff12cd066712fed92383992c23e0404200a18e853c35",
+      "contentHash": "0549bb1684e7c1b307e542197e8f54d0b012684629ed68141908329fde91d8f2",
       "since": "2025-01-01"
     },
     "cli:init": {
@@ -1506,7 +1506,7 @@
       "type": "subsystem",
       "domain": "server",
       "sourcePath": "src/server/AgentServer.ts",
-      "contentHash": "b8285d9b2ec3707df8dce8d7b1a2fa71e4046a67b31562b711a0b400a57f6cff",
+      "contentHash": "1f69ce038731bab478d16eec75ab741610caa6d98524cbcfbfea7f1645084b10",
       "since": "2025-01-01"
     },
     "subsystem:session-manager": {

package/src/data/state-coherence-registry.json

@@ -54,7 +54,7 @@
     },
     {
       "category": "commitments",
-      "description": "CommitmentTracker single-writer CAS store of user-facing promises and follow-through state.",
+      "description": "CommitmentTracker single-writer CAS store of user-facing promises and follow-through state. P1.5 (COMMITMENTS-COHERENCE-SPEC) fulfills the peer-http transport: owner-routed mutation + first-hop delta replication; the census's earlier 'AO desired' note is resolved-as-won't-do (owner-routing achieves coherence without the append-only conversion).",
       "scope": "must-be-coherent",
       "freshness": "eventual",
       "conflictShape": "single-writer",
@@ -64,6 +64,18 @@
       ],
       "grandfathered": false
     },
+    {
+      "category": "commitment-replicas",
+      "description": "Per-peer read-only replicas of other machines' commitment stores (COMMITMENTS-COHERENCE-SPEC P1.5 \u00a73.2). Derived cache - rebuilt by a full re-pull; written ONLY by the commitments-sync receive path; first-hop sender-bound; incarnation-fenced.",
+      "scope": "derived-cache",
+      "freshness": "eventual",
+      "conflictShape": "single-writer",
+      "transport": "peer-http",
+      "paths": [
+        "state/commitment-replicas/"
+      ],
+      "grandfathered": false
+    },
     {
       "category": "attention-queue",
       "description": "Attention items surfaced to the user, plus the per-source coalescing/suppression ledger.",

package/upgrades/1.3.369.md

@@ -0,0 +1,81 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+First build slice of the Commitments Coherence spec (P1.5 of multi-machine
+coherence): every machine can now SEE every machine's promises. Dark
+everywhere except explicitly replication-enabled pairs.
+
+- Every commitment is stamped with its home machine at creation; the
+  cross-machine identity is (machine, id) together — because the plain ids
+  are per-machine counters that collide by construction (the review
+  round's headline catch: an id-keyed merge would have silently hidden
+  real obligations).
+- Each machine's store replicates to peers as small seq-windowed delta
+  pages on the existing 30s presence cadence — one field change ships one
+  record, not the whole store; a restored-from-backup store re-mints its
+  incarnation so peers re-pull wholesale instead of stranding.
+- Free-text fields are credential-shape-scanned at serve time; a flagged
+  field ships redacted while the record itself still replicates.
+- `GET /commitments?scope=mesh` merges own + replica rows with honest
+  labels (replica + how stale) and flags possible cross-machine duplicate
+  promises. The default scope is byte-identical to before.
+
+NOT yet (P1.5b): closing a promise from the non-home machine (owner-routed
+mutation + the durable offline queue).
+
+The first LIVE run of the P2 working-set proof caught two real bugs; both
+are fixed with regression tests.
+
+1. On release days the server restarts in quick succession — the
+   coherence journal's writer lock could be left held by a dead process,
+   and the new writer sat silently read-only until the NEXT restart (75
+   live minutes of missing placement/run history). The writer now retries
+   on a bounded timer and recovers in place; live holders heartbeat the
+   lock so even a recycled process id can't impersonate one.
+2. A conversation deliberately moved to a machine — but quiet since the
+   move — had no recorded owner, so the "go fetch this topic's workspace"
+   reflex refused to run in exactly the situation it was built for. The
+   deliberate placement (the pin) now counts as ownership until real
+   traffic takes over.
+
+## What to Tell Your User
+
+On machine pairs with sync enabled: ask ANY machine "what are your open
+commitments?" and you get the complete picture — promises made on the
+other machine show up, honestly labeled with where they live and how
+fresh the copy is. Closing one from the "wrong" machine arrives in the
+next slice.
+
+Nothing to do. Your machines' shared history can no longer silently stop
+recording after updates, and fetching a moved conversation's files works
+even before you've sent it a new message.
+
+## Summary of New Capabilities
+
+- `commitments-sync` MeshCommand — paged, incarnation-fenced delta
+  replication of commitment records between same-operator machines.
+- `src/core/CommitmentsSync.ts` — serve/receive/merge engine
+  (CommitmentReplicaStore, mergeCommitmentViews, resolveBareId).
+- `GET /commitments?scope=mesh` — the merged cross-machine view.
+- CommitmentTracker: originMachineId stamping + replicationSeq /
+  storeIncarnation / lastMutatedSeq bookkeeping (additive, legacy-safe).
+
+- CoherenceJournal: lock retry timer + mtime heartbeat + pid-reuse-proof
+  stale reclaim (issue #925).
+- Working-set ownerOf seam: placement-pin fallback for unowned topics
+  (issue #926; WORKING-SET-HANDOFF-SPEC §3.3 delta).
+- Autonomous scanner: runs are not marked seen while the writer is
+  locked out (dropped emits re-emit after recovery).
+
+## Evidence
+
+- 15 unit (CommitmentsSync) + 2 integration (real signed transport
+  round-trip w/ delta-only convergence; mixed-version 501) + 77
+  CommitmentTracker tests unchanged; typecheck/lint/docs-coverage clean.
+
+3 new lock tests (38 total in CoherenceJournal.test.ts); live remediation
+on the echo pair confirmed the analysis end-to-end.

package/upgrades/side-effects/commitments-sync-p15a.md

@@ -0,0 +1,93 @@
+# Side-Effects Review — Commitments Coherence read replication (P1.5a)
+
+**Version / slug:** `commitments-sync-p15a`
+**Date:** `2026-06-06`
+**Author:** `echo`
+**Second-pass reviewer:** `not required (implements §3.1–§3.3 of the 3-round-converged spec; read-only replication, dark behind the explicit replication gate; owner-routed mutation is P1.5b)`
+
+## Summary of the change
+
+P1.5a of COMMITMENTS-COHERENCE-SPEC — promises become VISIBLE from every
+machine:
+
+1. CommitmentTracker bookkeeping (§3.1/§3.2): `originMachineId` stamped at
+   creation (the composite (originMachineId, id) is THE cross-machine
+   identity — ids are per-machine sequential counters and collide by
+   construction); `replicationSeq` + `storeIncarnation` + per-record
+   `lastMutatedSeq` as ADDITIVE store fields (schema `version: 2` literal
+   untouched; loadStore guard unchanged; legacy stores seed
+   replicationSeq=1 + fresh incarnation → full first pull; fresh stores
+   seed at birth). The replication stamp lives at the THREE write funnels
+   (CAS apply, mutateSync, insertNew) as a prev/next diff EXCLUDING beacon
+   bookkeeping (consecutiveUnchanged/lastHeartbeatAt/heartbeatCount) — a
+   quiet agent's heartbeats never re-ship snapshots. Rewind fence: the
+   meta sidecar's high-water re-mints the incarnation on a restored
+   backup.
+2. `src/core/CommitmentsSync.ts`: paged delta serve (lastMutatedSeq >
+   sinceSeq, exclusive cursor, 256KB pages with at-least-one-record,
+   incarnation fencing), serve-time legacy stamping + per-field
+   credential-shape redaction (the record still replicates — closeability
+   never depends on the scan), CommitmentReplicaStore (single-writer
+   receive path, first-hop WITH TEETH: rows claiming another machine's
+   originMachineId rejected + counted; corrupt → quarantine + full
+   re-pull), mergeCommitmentViews (composite key; viewSource + staleness;
+   computed pendingMutation join; heuristic possibleDuplicateOf) +
+   resolveBareId (409-ambiguous semantics).
+3. Three lockstep verb edits (`commitments-sync`: union + RBAC
+   read/observe + dispatcher handler answering 'disabled' while dark);
+   session-status advert (`commitmentsAdvert`, answered from MEMORY);
+   PeerPresencePuller `driveCommitmentsSync` seam riding the existing 30s
+   cadence (bounded pages per tick); GET /commitments?scope=mesh (default
+   scope byte-identical; mesh scope degrades to own-rows, 200 never 503).
+4. Config (`coherenceJournal.commitments` block) + State-Coherence
+   Registry (`commitment-replicas` category; `commitments` description
+   updated per §3.6).
+
+NOT in this slice (P1.5b): owner-routed mutation, verdict wrappers,
+commitment-mutate verb, opKey window, pending-mutations ledger.
+
+## Decision-point inventory
+
+- **State-meaningful vs bookkeeping diff** at the funnels — the spec's
+  write-amplification guard; tested both directions.
+- **Incarnation fence**: stale requester → re-pull from 0; receiver
+  replaces the replica WHOLESALE on incarnation change (never a
+  sinceSeq short-circuit against a restored store).
+- **First-hop teeth**: replica identity = authenticated env.sender;
+  forged rows counted, never applied.
+- **Merged-view honesty**: collision rows NEVER collapse (the round-1
+  headline); bare-id ambiguity is surfaced, not guessed.
+
+## 1. Over-block / 2. Under-block
+
+Over: a record whose only change is beacon bookkeeping never replicates
+until its next real mutation (deliberate). Under: the credential-shape
+scan is leak-reduction, not a boundary (spec §3.2 honesty — boundary =
+same-operator posture); cross-machine deliver (closeability) lands in
+P1.5b — until then the merged view names the owner and the close happens
+there.
+
+## 3. Fit / 4. Blast radius
+
+Engine in core (seam-injected, like JournalSyncApplier); tracker gains
+bookkeeping ONLY (no behavior change — 77 existing tests pass
+unchanged); routes' default scope byte-identical. Dark everywhere except
+explicit replication.enabled pairs; single-machine agents: advert
+omitted, mesh scope = own rows, zero overhead.
+
+## Evidence
+
+- tests/unit/CommitmentsSync.test.ts — 15 passing (paged deltas +
+  multi-page convergence, incarnation fence, serve-time stamping +
+  redaction-with-record-intact, first-hop teeth, wholesale replacement,
+  corrupt quarantine, collision-two-rows + 409-ambiguous + ?origin,
+  staleness + computed pendingMutation + possibleDuplicateOf, tracker
+  bookkeeping incl. beacon-write guard + legacy backfill + rewind
+  re-mint).
+- tests/integration/commitments-sync-roundtrip.test.ts — 2 passing: full
+  paged round-trip over the REAL signed MeshRpc + express path with
+  delta-only convergence after a mutation, and mixed-version 501.
+- tests/unit/CommitmentTracker.test.ts — 77 passing unchanged.
+  peer-presence-wiring + session-pool-activation-wiring +
+  feature-delivery-completeness all green. Typecheck + lint chain (70
+  registry categories) + docs-coverage clean.