instar 1.3.389 → 1.3.391

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.389",
+  "version": "1.3.391",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-07T00:51:44.855Z",
-  "instarVersion": "1.3.389",
+  "generatedAt": "2026-06-07T04:05:00.344Z",
+  "instarVersion": "1.3.391",
   "entryCount": 199,
   "entries": {
     "hook:session-start": {
@@ -11,7 +11,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/session-start.sh",
-      "contentHash": "8d2952d0097dacb8077f2cf4dc3e48ee95de7aacf3517ca1d36aad156a3a4a7b",
+      "contentHash": "3e0828b523c2cece3ea4c3c73e77867c2d6884b7493c93e523318e63f5c09e30",
       "since": "2025-01-01"
     },
     "hook:dangerous-command-guard": {
@@ -20,7 +20,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/dangerous-command-guard.sh",
-      "contentHash": "8d2952d0097dacb8077f2cf4dc3e48ee95de7aacf3517ca1d36aad156a3a4a7b",
+      "contentHash": "3e0828b523c2cece3ea4c3c73e77867c2d6884b7493c93e523318e63f5c09e30",
       "since": "2025-01-01"
     },
     "hook:grounding-before-messaging": {
@@ -29,7 +29,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/grounding-before-messaging.sh",
-      "contentHash": "8d2952d0097dacb8077f2cf4dc3e48ee95de7aacf3517ca1d36aad156a3a4a7b",
+      "contentHash": "3e0828b523c2cece3ea4c3c73e77867c2d6884b7493c93e523318e63f5c09e30",
       "since": "2025-01-01"
     },
     "hook:compaction-recovery": {
@@ -38,7 +38,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/compaction-recovery.sh",
-      "contentHash": "8d2952d0097dacb8077f2cf4dc3e48ee95de7aacf3517ca1d36aad156a3a4a7b",
+      "contentHash": "3e0828b523c2cece3ea4c3c73e77867c2d6884b7493c93e523318e63f5c09e30",
       "since": "2025-01-01"
     },
     "hook:external-operation-gate": {
@@ -47,7 +47,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-operation-gate.js",
-      "contentHash": "8d2952d0097dacb8077f2cf4dc3e48ee95de7aacf3517ca1d36aad156a3a4a7b",
+      "contentHash": "3e0828b523c2cece3ea4c3c73e77867c2d6884b7493c93e523318e63f5c09e30",
       "since": "2025-01-01"
     },
     "hook:deferral-detector": {
@@ -56,7 +56,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/deferral-detector.js",
-      "contentHash": "8d2952d0097dacb8077f2cf4dc3e48ee95de7aacf3517ca1d36aad156a3a4a7b",
+      "contentHash": "3e0828b523c2cece3ea4c3c73e77867c2d6884b7493c93e523318e63f5c09e30",
       "since": "2025-01-01"
     },
     "hook:self-stop-guard": {
@@ -65,7 +65,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/self-stop-guard.js",
-      "contentHash": "8d2952d0097dacb8077f2cf4dc3e48ee95de7aacf3517ca1d36aad156a3a4a7b",
+      "contentHash": "3e0828b523c2cece3ea4c3c73e77867c2d6884b7493c93e523318e63f5c09e30",
       "since": "2025-01-01"
     },
     "hook:post-action-reflection": {
@@ -74,7 +74,7 @@
       "domain": "evolution",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/post-action-reflection.js",
-      "contentHash": "8d2952d0097dacb8077f2cf4dc3e48ee95de7aacf3517ca1d36aad156a3a4a7b",
+      "contentHash": "3e0828b523c2cece3ea4c3c73e77867c2d6884b7493c93e523318e63f5c09e30",
       "since": "2025-01-01"
     },
     "hook:external-communication-guard": {
@@ -83,7 +83,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-communication-guard.js",
-      "contentHash": "8d2952d0097dacb8077f2cf4dc3e48ee95de7aacf3517ca1d36aad156a3a4a7b",
+      "contentHash": "3e0828b523c2cece3ea4c3c73e77867c2d6884b7493c93e523318e63f5c09e30",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-collector": {
@@ -92,7 +92,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-collector.js",
-      "contentHash": "8d2952d0097dacb8077f2cf4dc3e48ee95de7aacf3517ca1d36aad156a3a4a7b",
+      "contentHash": "3e0828b523c2cece3ea4c3c73e77867c2d6884b7493c93e523318e63f5c09e30",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-checkpoint": {
@@ -101,7 +101,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-checkpoint.js",
-      "contentHash": "8d2952d0097dacb8077f2cf4dc3e48ee95de7aacf3517ca1d36aad156a3a4a7b",
+      "contentHash": "3e0828b523c2cece3ea4c3c73e77867c2d6884b7493c93e523318e63f5c09e30",
       "since": "2025-01-01"
     },
     "hook:free-text-guard": {
@@ -110,7 +110,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/free-text-guard.sh",
-      "contentHash": "8d2952d0097dacb8077f2cf4dc3e48ee95de7aacf3517ca1d36aad156a3a4a7b",
+      "contentHash": "3e0828b523c2cece3ea4c3c73e77867c2d6884b7493c93e523318e63f5c09e30",
       "since": "2025-01-01"
     },
     "hook:claim-intercept": {
@@ -119,7 +119,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept.js",
-      "contentHash": "8d2952d0097dacb8077f2cf4dc3e48ee95de7aacf3517ca1d36aad156a3a4a7b",
+      "contentHash": "3e0828b523c2cece3ea4c3c73e77867c2d6884b7493c93e523318e63f5c09e30",
       "since": "2025-01-01"
     },
     "hook:claim-intercept-response": {
@@ -128,7 +128,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept-response.js",
-      "contentHash": "8d2952d0097dacb8077f2cf4dc3e48ee95de7aacf3517ca1d36aad156a3a4a7b",
+      "contentHash": "3e0828b523c2cece3ea4c3c73e77867c2d6884b7493c93e523318e63f5c09e30",
       "since": "2025-01-01"
     },
     "hook:stop-gate-router": {
@@ -137,7 +137,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/stop-gate-router.js",
-      "contentHash": "8d2952d0097dacb8077f2cf4dc3e48ee95de7aacf3517ca1d36aad156a3a4a7b",
+      "contentHash": "3e0828b523c2cece3ea4c3c73e77867c2d6884b7493c93e523318e63f5c09e30",
       "since": "2025-01-01"
     },
     "hook:auto-approve-permissions": {
@@ -146,7 +146,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/auto-approve-permissions.js",
-      "contentHash": "8d2952d0097dacb8077f2cf4dc3e48ee95de7aacf3517ca1d36aad156a3a4a7b",
+      "contentHash": "3e0828b523c2cece3ea4c3c73e77867c2d6884b7493c93e523318e63f5c09e30",
       "since": "2025-01-01"
     },
     "job:health-check": {
@@ -1538,7 +1538,7 @@
       "type": "subsystem",
       "domain": "updates",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
-      "contentHash": "8d2952d0097dacb8077f2cf4dc3e48ee95de7aacf3517ca1d36aad156a3a4a7b",
+      "contentHash": "3e0828b523c2cece3ea4c3c73e77867c2d6884b7493c93e523318e63f5c09e30",
       "since": "2025-01-01"
     },
     "subsystem:scheduler": {

package/upgrades/1.3.390.md

@@ -0,0 +1,50 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+macOS `mediaanalysisd` (~72-78% of a core) and Spotlight `mds_stores` (~28-48%)
+were top constant CPU consumers on a busy fleet box — pinning it at load average
+30 — because the agent's OWN runtime data dir (`<agentHome>/.instar/`) was never
+excluded from indexing. It holds `telegram-images/` (every user photo, vision-
+analyzed by mediaanalysisd), `server-data/` (SQLite DBs rewritten continuously),
+`logs/`, and `state/`. Instar already excluded `.worktrees/` (#588),
+`node_modules/` (#606), and Claude transcripts (#903); this closes the last gap.
+
+New `ensureAgentDataSpotlightExclusion()` helper drops the standard
+`.metadata_never_index` marker in each high-churn subdir + a `PostUpdateMigrator`
+backfill so existing agents get the relief on their next update.
+`.instar/telegram-images/` and `.instar/server-data/` are also gitignored.
+
+## What to Tell Your User
+
+Nothing required — silent OS-level resource hygiene. If their Mac was running
+hot, part of the cause was macOS endlessly indexing and photo-analyzing the
+agent's own chat images and databases; this stops that going forward.
+
+## Summary of New Capabilities
+
+- `ensureAgentDataSpotlightExclusion(stateDir)` — drops `.metadata_never_index`
+  in the agent's `.instar/{telegram-images,server-data,logs,state}` so macOS
+  Spotlight + mediaanalysisd stop indexing the agent's own churning runtime data.
+- `PostUpdateMigrator` backfill — existing agents get the exclusion on their next
+  update. Internal OS hygiene; no agent-facing API or config surface.
+
+## Evidence
+
+Unit + migration tests (both sides of every boundary: marker dropped in each
+existing subdir, only-existing subdirs marked, `[]` for a new agent, idempotent;
+migration backfills/skips/idempotent). 22/22 green in the spotlight-exclusion
+suite. `tsc --noEmit` clean. Mirrors the existing node_modules/worktree/transcript
+exclusion pattern exactly.
+
+## Scope (honest)
+
+This prevents FUTURE indexing/analysis. It does not instantly drop
+`mediaanalysisd`/`mds_stores` — macOS releases already-indexed content on its own
+schedule; forcing immediate eviction needs a one-time `sudo mdutil -E` the
+operator runs. One of several resource-efficiency fixes (2026-06-06). Does not
+address the ~300 accumulated worktrees (~100GB) — that is the AgentWorktreeReaper,
+gated separately on operator approval.

package/upgrades/1.3.391.md

@@ -0,0 +1,49 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The idle-session reaper's "never reap a session with an open commitment" safety
+guard is now activity-aware. An open commitment protects a session only while a
+user message arrived within a staleness window (default 24h); past that the
+commitment is treated as abandoned and no longer blocks reaping. Found 2026-06-06
+during a load-avg-30 overload: a reaper dry-run would have reaped NOTHING because
+19 of 26 sessions were pinned by `open-commitment`, many on sessions untouched for
+26h. The unconditional veto was the dominant blocker to idle-session cleanup.
+
+New `staleCommitmentWindowMs` on `ReapGuard` (default 24h; `Infinity` = old
+always-protect) + `monitoring.sessionReaper.staleCommitmentWindowMinutes`
+(default 1440), threaded through to the terminate-time authority guard too.
+
+## What to Tell Your User
+
+Nothing required — internal reaper policy, and the reaper itself remains opt-in.
+For operators turning the reaper on: idle sessions that have an open commitment
+but no user message for 24h+ will now become reap-eligible (they previously stayed
+alive forever). Active sessions and recently-touched sessions are unaffected.
+
+## Summary of New Capabilities
+
+- `ReapGuard.staleCommitmentWindowMs` — bounds the open-commitment KEEP-guard so a
+  stale commitment stops pinning an inactive session. Default 24h; `Infinity`
+  restores always-protect.
+- `sessionReaper.staleCommitmentWindowMinutes` config (default 1440). Internal
+  reaper policy; no agent-facing API/CLI surface.
+
+## Evidence
+
+`tests/unit/reap-guard.test.ts` + `tests/unit/session-reaper.test.ts`: both sides
+of the boundary (stale commitment ⇒ falls through to reap-eligible; fresh
+commitment within window ⇒ still keeps; custom window honored; `Infinity` restores
+always-protect; existing open-commitment cases updated to window-aware mocks).
+49/49 green. `tsc --noEmit` clean.
+
+## Scope (honest)
+
+UNBLOCKS the reaper — it changes which sessions are eligible, it does not by itself
+kill anything (the reaper is opt-in + dry-run-first). Pairs with enabling
+sessionReaper + mcpProcessReaper + SleepController (which ship opt-in and were off
+fleet-wide). Does NOT auto-expire the commitments themselves (separate follow-up);
+it only stops a stale commitment from vetoing a reap.

package/upgrades/side-effects/agent-data-spotlight-exclusion.md

@@ -0,0 +1,46 @@
+# Side-Effects Review - Agent runtime-data Spotlight exclusion
+
+**Version / slug:** `agent-data-spotlight-exclusion`
+**Date:** `2026-06-06`
+**Author:** `echo`
+**Second-pass reviewer:** `not required (Tier 1)`
+
+## Summary of the change
+
+Extends Instar's existing macOS Spotlight exclusion (currently covers `.worktrees/` #588, `node_modules/` #606, and Claude transcripts #903) to the agent's OWN runtime data dir (`<agentHome>/.instar/`). On a box pinned at load average 30 (2026-06-06, Justin's resource investigation), grounding showed the top CPU consumers were `mediaanalysisd` (~72-78% — analyzing the agent's `telegram-images/`) and `mds_stores`/Spotlight (~28-48% — re-indexing the constantly-rewritten `server-data/` SQLite dbs, `logs/`, `state/`). These were the remaining unexcluded churn source. Adds `ensureAgentDataSpotlightExclusion()` (reuses the generic marker-dropper) + a `PostUpdateMigrator` backfill, and gitignores the two runtime dirs that weren't already ignored.
+
+## Decision-point inventory
+
+- `ensureAgentDataSpotlightExclusion(stateDir)` (new, exported) — drops `.metadata_never_index` in each existing high-churn subdir (`telegram-images`, `server-data`, `logs`, `state`); returns the list created. Reuses `ensureWorktreeSpotlightExclusion` (the dir-agnostic dropper).
+- `PostUpdateMigrator.migrateAgentDataSpotlightExclusion` (new, private) — runs the helper on every update, pushes an `upgraded`/`errors` entry.
+- Wired into the migrate() sequence right after `migrateClaudeTranscriptSpotlightExclusion`.
+- `.gitignore` — adds `.instar/telegram-images/` and `.instar/server-data/` (per-machine runtime data; `logs/`, `state/`, `telegram-inbound/` were already ignored).
+
+## 1. Behavior change / gating
+
+NONE that affects message flow, sessions, or any gate. The only effect is writing empty marker files into the agent's own `.instar/` data subdirs, telling macOS Spotlight + mediaanalysisd to stop indexing them. No runtime behavior of the agent changes; instar's own reads of these dirs (TokenLedger, server-data DBs, log tailing) are filesystem reads, unaffected by Spotlight indexing.
+
+## 2. Over/under-signal
+
+N/A — not a signal/gate. The only "decision" is whether each subdir exists (drop the marker) or not (skip). Both branches are covered by tests.
+
+## 3. Blast radius
+
+Filesystem only, additive, and scoped ENTIRELY INSIDE the agent's own `<agentHome>/.instar/` — unlike #903 it never reaches outside the agent home. Writes up to four empty marker files. No state mutation, no data migration, no config change. On a non-macOS host the markers are inert. The `.gitignore` additions only prevent committing per-machine runtime data (which was never intended to be committed).
+
+## 4. Failure modes
+
+The underlying `ensureWorktreeSpotlightExclusion` swallows write errors (`@silent-fallback-ok`) and returns false — a failed marker write just means Spotlight keeps indexing (status quo), and can never block the migration or an update. `existsSync` guards each absent subdir (brand-new agent with no data yet → returns `[]`). No throw path.
+
+## 5. Migration parity
+
+Covered: the `PostUpdateMigrator` backfill means existing agents get the markers on their next update (fast release cadence drops them within minutes). New agents get them once the subdirs exist. No agent-installed config/hooks/skills/CLAUDE.md change — this is internal OS hygiene with no agent-facing surface, consistent with the precedent (#588/#606/#903 also have no CLAUDE.md template line; they are not capabilities the agent surfaces to a user). No init-path call is needed because the data subdirs don't exist at init time — it would no-op; the migration is the correct single mechanism.
+
+## 6. Scope honesty (what this is NOT)
+
+- One fix in the resource-efficiency initiative (Justin, 2026-06-06). The marker prevents FUTURE indexing/analysis; it does NOT instantly drop `mediaanalysisd`/`mds_stores` — macOS releases already-indexed content on its own schedule, and an immediate purge needs a one-time `sudo mdutil -E` the operator runs (instar cannot run sudo). The durable guarantee is that no agent keeps feeding the churn.
+- Does NOT address the ~300 accumulated worktrees (~100GB) — that is the AgentWorktreeReaper's job, gated separately on operator approval because it deletes checkouts.
+
+## 7. Causal autopsy
+
+Origin: **latent** (not a prior-PR regression). The agent's `.instar/` runtime data (images, DBs, logs, state) has been indexed by macOS since agents began writing it. The prior Spotlight-exclusion PRs (#588 worktrees, #606 node_modules, #903 transcripts) progressively closed the largest known trees but never extended to the agent's own data dir — which 2026-06-06 grounding (`ps`/`uptime` census during the load-30 incident) showed was the live `mediaanalysisd` + `mds_stores` fuel via `telegram-images/` and `server-data/`. This PR closes that latent gap by reusing the same marker mechanism. No behavior was broken by a prior change; an existing cost was simply never excluded.

package/upgrades/side-effects/reaper-stale-commitment-override.md

@@ -0,0 +1,46 @@
+# Side-Effects Review - Reaper stale-commitment override
+
+**Version / slug:** `reaper-stale-commitment-override`
+**Date:** `2026-06-06`
+**Author:** `echo`
+**Second-pass reviewer:** `not required (Tier 1)`
+
+## Summary of the change
+
+The `ReapGuard` open-commitment KEEP-guard now protects a session only while a user message arrived within a staleness window (`staleCommitmentWindowMs`, default 24h). Past that window the open commitment is treated as abandoned and no longer vetoes reaping. Surfaced because a 2026-06-06 dry-run (during a load-avg-30 overload investigation) showed the idle-session reaper would reap NOTHING — 19 of 26 sessions were pinned by `open-commitment`, many on sessions the user hadn't touched in 26h. Adds `staleCommitmentWindowMs` to `ReapGuardOptions` (+ `DEFAULT_REAP_GUARD_OPTIONS`), `staleCommitmentWindowMinutes` to `SessionReaperConfig` + `ConfigDefaults` + the `InstarConfig` type, threaded `SessionReaper`→`ReapGuard`.
+
+## Decision-point inventory
+
+- `ReapGuard.evaluate()` guard J (open-commitment): now gated on `recentUserMessage(topicId, staleCommitmentWindowMs)`. Fresh ⇒ keep('open-commitment'); stale ⇒ fall through to the activeness guards (unchanged).
+- `ReapGuardOptions.staleCommitmentWindowMs` (new; default 24h; `Infinity` = old always-protect).
+- `SessionReaperConfig.staleCommitmentWindowMinutes` (new; default 1440) → mapped to ms in the `SessionReaper` constructor's `new ReapGuard(...)`.
+- `ConfigDefaults` + `types.ts` `sessionReaper` block gain `staleCommitmentWindowMinutes`.
+
+## 1. Behavior change / gating
+
+This is a guard-loosening, in ONE direction only: it makes MORE sessions reap-ELIGIBLE, and only those that are BOTH commitment-pinned AND have had no user message for ≥24h. It never makes a session that was reapable into kept. Every other KEEP-guard (protected, spawn-grace, recovery, pending-injection, relay-lease, recent-user-message, active-subagent, structural-long-work, active-process, main-process) is unchanged and still fires in the same order. A session must STILL clear all remaining activeness guards (and, in the reaper, transcript-growth + positive-idle + confirmObservations) before it is actually reaped — this only removes the stale-commitment veto.
+
+## 2. Over/under-signal
+
+The risk direction is OVER-reaping a session whose commitment is genuinely active but whose user simply hasn't messaged in 24h. Mitigations: (a) 24h is a long, conservative horizon — Justin's explicit "no message today" intent; (b) the session must additionally have NO active processes, NO active subagent, NO recent transcript growth, and be positively idle to actually reap; (c) `Infinity` disables entirely; (d) the terminate-time authority guard uses the same default so a single chokepoint enforces it. UNDER-signal (failing to reap) is the prior behavior being fixed.
+
+## 3. Blast radius
+
+Pure in-memory guard logic; no I/O, no new deps (reuses the existing `recentUserMessage` dep with a longer window). Affects only the reap-eligibility decision for commitment-pinned, 24h-silent sessions. Ships behind the sessionReaper (which is itself opt-in + dry-run-first). No API route, no persistent state, no migration of data.
+
+## 4. Failure modes
+
+`recentUserMessage` throwing is already caught by `blockedReason()`'s try/catch → KEEP ('guard-error'), so a signal failure fails SAFE (never reaps). `staleCommitmentWindowMs` defaults are always present (DEFAULT_REAP_GUARD_OPTIONS / DEFAULT_SESSION_REAPER_CONFIG), so an old config missing the field gets 24h, not 0. `Infinity` is honored (any finite withinMs < Infinity ⇒ a correct mock keeps).
+
+## 5. Migration parity
+
+`staleCommitmentWindowMinutes` is an OPTIONAL config field with a code default (1440) in both `DEFAULT_SESSION_REAPER_CONFIG` and `ConfigDefaults`, so existing agents whose config omits it get the 24h behavior automatically — no `PostUpdateMigrator` entry needed (absence ⇒ default, the established pattern for sessionReaper sub-fields). No agent-installed file (hooks/skills/CLAUDE.md) changes; this is internal reaper policy with no agent-facing surface. The reaper remains opt-in (enabled:false default), so this changes nothing until an operator enables it.
+
+## 6. Scope honesty (what this is NOT)
+
+- This UNBLOCKS the reaper; it does not by itself reduce a live process count. It changes which sessions are eligible; the reaper (dry-run first, then live) acts on them. It's paired with enabling sessionReaper + mcpProcessReaper + SleepController (which ship opt-in and were off fleet-wide — the 2026-06-06 finding).
+- It does NOT touch the commitments themselves (no auto-expiry of stale commitments — that's a separate follow-up). It only stops a stale commitment from VETOING a reap.
+
+## 7. Causal autopsy
+
+Origin: **latent**. The open-commitment guard has unconditionally protected commitment-bearing sessions since it was added; that was correct when sessions were short-lived and commitments closed promptly. As the fleet grew to dozens of multi-day sessions with commitments left open, the unconditional veto became the dominant blocker to idle-session reaping (grounded 2026-06-06: 19/26 keeps were open-commitment, many 26h-idle). No prior PR regressed it; an always-on protection simply never had a staleness bound. This adds the bound.