instar 1.3.369 → 1.3.371

package/upgrades/side-effects/pool-activity-view-p4.md

@@ -0,0 +1,54 @@
+# Side-Effects Review — Pool-Wide Parallel-Work Awareness build (P4.1)
+
+**Version / slug:** `pool-activity-view-p4`
+**Date:** `2026-06-06`
+**Author:** `echo`
+**Second-pass reviewer:** `not required (implements the 2-round-converged P4 spec; a read-only fold over already-replicated journal streams; zero new stores/verbs/loops)`
+
+## Summary of the change
+
+POOL-WIDE-PARALLEL-WORK-SPEC (converged 2026-06-06; spec + report + eli16
+ride this PR): `GET /parallel-work/activities?scope=pool` answers "what is
+every machine of mine working on, and is anything overlapping?" by
+composing the LOCAL parallel-work index with the journal replicas P1
+already ships.
+
+1. `src/core/PoolActivityView.ts` — NET-NEW fold on the reader's raw
+   query() path (round-1: readOwnAutonomousRuns is own-only; no lifecycle
+   helper exists). Discriminated union rows (`kind: 'local'|'remote'`)
+   with NAMED null absences; remote `running` derived PER INSTANCE
+   (sessionId/runId) then any-active aggregated — a later terminal for
+   session B never masks still-running session A; `lowConfidence` rides
+   the bound-hit flag; `possibleOverlap` pairs EVERY machine combination
+   (local↔remote and remote↔remote) and is annotated `recentMove` from
+   the answer-complete placement stream within the post-transfer closeout
+   window — the settling transient is distinguished, never a wolf-cry.
+2. The route: `?scope=pool` composes local + remote under the
+   `pool: { selfMachineId, replicasRead, boundHit }` honesty header —
+   LOCAL replica files, no peer fan-out (an offline peer's last-replicated
+   streams still answer). Default scope byte-identical; a dark replica
+   layer degrades pool scope to local rows (200); the pre-existing
+   no-index 503 unchanged.
+
+## 1-2. Over/Under-block
+
+Over: none — read-only, never gates. Under: remote intent TEXT
+(focus/tags) is machine-local by design (named absence; the P4.2 deferral
+is registered in the project plan); the gapped-stream qualifier gains
+teeth with the P1.3 reader states (named dependency — lowConfidence is
+today's honest signal).
+
+## 3. Fit / 4. Blast radius
+
+A pure module + a query-param branch on the existing route. Provenance
+asymmetry (live local truth vs replica-derived remote) is structural in
+the row shape. Worst case = a mislabeled advisory row; nothing actuates
+off this view (Signal vs Authority).
+
+## Evidence
+
+- tests/unit/PoolActivityView.test.ts — 5 passing: the union shape +
+  named absences + honesty header; per-instance aggregation
+  (B-terminal-never-masks-A); both kinds feeding one topic +
+  artifactsKnown; overlap pairs incl. remote↔remote + the recentMove
+  annotation; local-only degradation. Typecheck clean.

package/upgrades/side-effects/reflex-placement-fallback.md

@@ -0,0 +1,57 @@
+# Side-Effects Review — reflex journal-placement fallback (#930)
+
+**Version / slug:** `reflex-placement-fallback`
+**Date:** `2026-06-06`
+**Author:** `echo`
+**Second-pass reviewer:** `not required (third live-proof finding; ~20-line fallback with a wiring-shape regression test; admits only a read-only/jailed/verified pull)`
+
+## Summary of the change
+
+#927's quiet-topic pin fallback (#926) is router-local-blind: the pin
+written by a transfer lives on the LEASE HOLDER, so the pinned-TO machine
+still answered not-owner (live, v1.3.369). Second fallback in wsOwnerOf:
+the newest topic-placement JOURNAL entry (own + replica) — `owner ===
+self` ⇒ self-owned at that entry's epoch. The placement entry is emitted
+at the router's CAS chokepoint (the strongest placement evidence
+reachable from the target machine).
+
+## Signal-vs-Authority justification (the load-bearing call)
+
+The journal-actuation ban guards kill/spawn/move decisions. What this
+fallback admits is a working-set PULL: read-only on the source,
+hash-verified, jailed, never-clobber on the destination, idempotent, and
+still guarded by the per-write stillCurrent recheck (any REAL claim
+supersedes the in-flight pull). Nomination has run on replica evidence
+since P2 §3.3 by design — this extends the same trust class to the
+ownership precondition for the same operation, nothing else. The
+coordinator module is deliberately NOT in the actuation-ban set (it
+already imports the reader for nomination).
+
+## 1-2. Over/Under-block
+
+Over: none new — the fallback only ever yields SELF. Under: a topic
+whose placement was never journaled (pre-P1 history) still answers
+not-owner honestly.
+
+## 3. Fit / 4. Blast radius
+
+~20 lines in the existing wsOwnerOf seam (the spec-named home), spec
+§3.3 delta + eli16 amendment ride along. Active only where replication
+is explicitly enabled. Worst case = an unnecessary pull that verifies
+and lands nothing new.
+
+## Evidence
+
+- tests/unit/working-set-ownerof-wiring.test.ts — wiring-shape assertion
+  for BOTH fallback steps + the honest default.
+- Typecheck clean. The live proof completes on the echo pair after this
+  ships (the staged 77901 artifact + recorded hashes).
+
+## Addendum — the dropped commitments advert (same branch)
+
+While verifying P1.5a live, found that fetchPeerCapacity's narrowing
+return discarded the peer's commitmentsAdvert — driveCommitmentsSync
+never fired; zero commitment replicas ever landed in either direction.
+Pass-through (one spread line) + a source-shape regression test. The
+integration suite drove the engine directly and missed this seam — the
+wiring-integrity gap class.

package/upgrades/side-effects/threadline-conversation-kind-p3.md

@@ -0,0 +1,83 @@
+# Side-Effects Review — Threadline Conversation Coherence build (P3.1 + P3.2 surfaces)
+
+**Version / slug:** `threadline-conversation-kind-p3`
+**Date:** `2026-06-06`
+**Author:** `echo`
+**Second-pass reviewer:** `not required (implements the 2-round-converged P3 spec; a 4th journal kind riding P1's proven transport; content-free by typed schema; read-only view)`
+
+## Summary of the change
+
+THREADLINE-CONVERSATION-COHERENCE-SPEC (converged 2026-06-06, merged in
+#924) — every machine can answer "which machine holds each A2A
+conversation, and is it bound to a topic?" from local disk:
+
+1. The 4th journal kind `threadline-conversation` — the spec's honest
+   "compiler-guided multi-site edit" performed in full: JournalKind union,
+   JOURNAL_KINDS, 6 Record literals (nextSeq/highWaterSeq/opKeys/retention
+   merge/rateBuckets/persistMeta), the typed validate() branch
+   (action/conversationId/peerFingerprint/topicId? — free text
+   structurally excluded, 256-char id bounds), the opKeyOf branch
+   ((conversationId, action, topicId?) — conversationId lives in data,
+   the round-1 finding), the emitThreadlineConversation emitter, AND the
+   JournalSyncApplier.validateData mirror branch (without which the
+   receive side suspect-flags the sender). DEFAULT_RETENTION +
+   ConfigDefaults literal (8MiB × keep 8; applyDefaults backfills).
+2. ConversationStore: the lifecycle emission as a prev/next TRANSITION
+   DIFF inside commit() — the store's single write funnel — on `state` +
+   `boundTopicId` ONLY (message appends/lastActivity bumps emit NOTHING);
+   terminal set = resolved/failed/archived (the real enum);
+   setCoherenceJournalSeam + one wiring line at the store's construction
+   (journal in scope; emit drops harmlessly when absent/locked-out).
+3. NEW route GET /threadline/conversations (?scope=mesh) + the
+   ConversationMeshView fold: OWN rows from the LIVE store (the
+   authority — own-stream journal entries ignored), replica rows folded
+   per-stream last-writer on the composite (holderMachineId,
+   conversationId) key under the P1 reader's bounds, with staleness +
+   streamStatus + partial-result honesty. 200 with own rows when
+   replication is dark; 503 only when the store itself is absent.
+4. Agent Awareness on ALL THREE surfaces (template + migrateClaudeMd +
+   shadow markers + featureSections tracking): the holder-view trigger
+   including the relay's REAL offline bound (in-memory ~24h queue) in the
+   honest-answer wording.
+
+## Decision-point inventory
+
+- Transition derivation: first-commit → started (+bound when born
+  bound); boundTopicId change → unbound(old)+bound(new); non-terminal →
+  terminal → closed. No fingerprint → no emission (nothing coherent to
+  record).
+- The fold's `unbound` clears the binding; `closed` keeps the row with
+  status closed (existence stays answerable).
+- Emission failure NEVER reaches the conversation write (observability
+  invariant; try/catch at the seam).
+
+## 1-2. Over/Under-block
+
+Over: conversations without peer fingerprints never journal (deliberate).
+Under: the P1.2 reader reports streamStatus 'current' always — the
+gapped qualifier gains teeth with the P1.3 reader states (the spec's
+named dependency); until then partial-result is the honesty signal.
+
+## 3. Fit / 4. Blast radius
+
+The kind rides P1's transport/trust wholesale (proven by the integration
+test reusing the journal-sync applier verbatim); the store seam is one
+injected callback; the view is read-only. Emission is always-on with the
+journal (like every kind); REPLICATION of it rides the existing explicit
+gate. A bug can only mis-report holder visibility — nothing actuates off
+this view (Signal vs Authority).
+
+## Evidence
+
+- tests/unit/ThreadlineConversationKind.test.ts — 7 passing: schema
+  bounds + op-key dedupe; the commit() diff matrix (started/bound,
+  rebind unbound+bound naming the OLD topic, closed, non-lifecycle
+  emits NOTHING, no-fingerprint emits nothing); the fold (own-live +
+  replica last-writer + unbound clears + closed status + local scope).
+- tests/integration/threadline-conversation-replication.test.ts — 1
+  passing: store lifecycle on A → journal → buildServeBatch → apply on
+  B under A's authenticated identity → B's mesh view names A as holder
+  with the binding → close converges on the next delta.
+- CoherenceJournal (39 incl. the advert test updated for 4 kinds),
+  CoherenceJournalReader, JournalSyncApplier suites green;
+  feature-delivery-completeness (81) green. Typecheck clean.