instar 1.3.382 → 1.3.383

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.382",
+  "version": "1.3.383",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-06T21:57:08.261Z",
-  "instarVersion": "1.3.382",
+  "generatedAt": "2026-06-06T22:01:27.206Z",
+  "instarVersion": "1.3.383",
   "entryCount": 199,
   "entries": {
     "hook:session-start": {

package/upgrades/{1.3.382.md → 1.3.383.md}

@@ -17,6 +17,19 @@ leading *i* to start a word and refuses to match when "promise" continues into
 promised/promises. Real first-person commitments ("I promise to…",
 "I'll make sure…", "you can count on me to…") still trip exactly as before.
 
+The quota collector (which writes quota-state.json) and the QuotaManager that
+drives its adaptive polling were nested inside the server's
+"I own Telegram polling" block. On any agent whose LIFELINE owns polling — the
+normal production topology — that block is skipped, so the collector never ran:
+quota-state.json was never written, the tracker read an absent file, and
+quota-aware placement stayed permanently fail-open (the exact rate-limit-stall
+hazard from the EXO incident it exists to prevent). Turning on quotaTracking
+alone could not fix it; the writer was gated behind an unrelated condition.
+
+The account switcher + collector + QuotaManager pipeline now live at top scope
+(after the scheduler is constructed, so migration wiring is real), gated only on
+the quota tracker — so the collector runs regardless of who polls Telegram.
+
 ## What to Tell Your User
 
 Nothing — fewer spurious "message blocked" interruptions when the agent
@@ -25,6 +38,13 @@ mentions promises as a topic rather than making one.
 - audience: agent-only
 - maturity: stable
 
+If you run a lifeline-driven agent and turned on quota tracking but never saw
+quota data, this is why — now it collects. Quota-aware placement (routing work
+away from a rate-limited machine) actually has data to act on.
+
+- audience: agent-only
+- maturity: stable
+
 ## Summary of New Capabilities
 
 - Word-boundary guards on the commitment_overreach pattern in
@@ -33,6 +53,11 @@ mentions promises as a topic rather than making one.
 - Existing agents receive the fixed script automatically (convergence-check.sh
   is always-overwritten from the template on every migration pass).
 
+- Quota collection + adaptive polling run independent of Telegram-polling
+  ownership (was send-only-server dead).
+- accountSwitcher hoisted to top scope (still consumed by the polling block's
+  wireTelegramCallbacks when that path runs).
+
 ## Evidence
 
 - `tests/unit/convergence-check.test.ts` (+6): the five live false positives
@@ -41,3 +66,11 @@ mentions promises as a topic rather than making one.
 - `tests/unit/convergence-checker-commitment-boundary.test.ts` (new): the same
   both-sides matrix against the TS checker.
 - Pattern verified on macOS (BSD) grep -E with 12 probe strings before patching.
+
+- `tests/unit/quota-collector-polling-independence-wiring.test.ts` (new, 3
+  tests): quotaManager.start() is reached before the !lifelineOwnsPolling
+  block; the pipeline is constructed after the scheduler; no second
+  QuotaManager construction (no double-start).
+- Live: echo logs "Telegram send-only mode (lifeline owns polling)" + "No quota
+  state file found — fail-open" pre-fix; quota-state.json + real GET /quota data
+  post-fix (live re-verify after release).

package/upgrades/side-effects/quota-collector-polling-independence.md

@@ -0,0 +1,62 @@
+# Side-Effects Review — Quota collector polling independence (finding A1)
+
+**Version / slug:** `quota-collector-polling-independence`
+**Date:** `2026-06-06`
+**Author:** `echo`
+**Second-pass reviewer:** `not required`
+
+## Summary of the change
+
+The QuotaManager/collector/accountSwitcher pipeline was hoisted out of the
+`if (telegramConfig && !skipTelegram && !isStandbyTelegram && !lifelineOwnsPolling)`
+block to top scope (after the scheduler exists), gated only on quotaTracker.
+On lifeline-owns-polling agents the collector never started → fail-open
+placement (finding A1).
+
+## Decision-point inventory
+
+One: WHERE the pipeline runs. Now: top scope, after scheduler, gated on
+quotaTracker. Before: inside the server-owns-polling block.
+
+## 1. Over-block
+
+None. The pipeline now runs in MORE cases (send-only servers too), never fewer.
+
+## 2. Under-block
+
+The collector still no-ops for non-claude-code frameworks (unchanged) and when
+quotaTracking is off (unchanged). A missing OAuth credential still degrades to
+JSONL estimation inside QuotaCollector (unchanged).
+
+## 3. Level-of-abstraction fit
+
+Quota collection is independent of Telegram-polling ownership; placing it with
+the other top-scope monitoring setup (after scheduler, beside telemetry
+heartbeat) is the correct layer. accountSwitcher moves with it; its later
+consumer (wireTelegramCallbacks, inside the polling block) resolves it from the
+enclosing scope — verified by tsc.
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+No authority change. quota-aware placement remains fail-open on absent data;
+this fix simply lets the data exist.
+
+## 5. Interactions
+
+- Scheduler: the pipeline now runs after `scheduler` is constructed, so
+  setScheduler() wires a real scheduler (was already conditional on `scheduler`).
+- wireTelegramCallbacks (polling block): consumes the hoisted accountSwitcher
+  from the enclosing scope — only runs in the polling path, harmless otherwise.
+- notify(): defined at outer scope (function decl), called lazily on threshold
+  crossings — safe to construct the notifier earlier.
+- Double-start: the old in-block copy was REMOVED (test asserts a single
+  QuotaManager construction) — no risk of two pollers.
+- guard-posture tripwire: already observed quotaTracking re-enabled; this fix
+  makes that enablement actually produce data.
+
+## 6. External surfaces
+
+No new routes/config/notifications. `GET /quota` now returns real data on
+lifeline-driven agents instead of `no_data`.