instar 1.3.416 → 1.3.418

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-07T23:08:24.008Z",
-  "instarVersion": "1.3.416",
+  "generatedAt": "2026-06-07T23:51:53.400Z",
+  "instarVersion": "1.3.418",
   "entryCount": 199,
   "entries": {
     "hook:session-start": {
@@ -11,7 +11,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/session-start.sh",
-      "contentHash": "b086e0a128b4785908844ebb86e015403fa5bbc4063b30f46f3dffd8333695bb",
+      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
       "since": "2025-01-01"
     },
     "hook:dangerous-command-guard": {
@@ -20,7 +20,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/dangerous-command-guard.sh",
-      "contentHash": "b086e0a128b4785908844ebb86e015403fa5bbc4063b30f46f3dffd8333695bb",
+      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
       "since": "2025-01-01"
     },
     "hook:grounding-before-messaging": {
@@ -29,7 +29,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/grounding-before-messaging.sh",
-      "contentHash": "b086e0a128b4785908844ebb86e015403fa5bbc4063b30f46f3dffd8333695bb",
+      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
       "since": "2025-01-01"
     },
     "hook:compaction-recovery": {
@@ -38,7 +38,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/compaction-recovery.sh",
-      "contentHash": "b086e0a128b4785908844ebb86e015403fa5bbc4063b30f46f3dffd8333695bb",
+      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
       "since": "2025-01-01"
     },
     "hook:external-operation-gate": {
@@ -47,7 +47,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-operation-gate.js",
-      "contentHash": "b086e0a128b4785908844ebb86e015403fa5bbc4063b30f46f3dffd8333695bb",
+      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
       "since": "2025-01-01"
     },
     "hook:deferral-detector": {
@@ -56,7 +56,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/deferral-detector.js",
-      "contentHash": "b086e0a128b4785908844ebb86e015403fa5bbc4063b30f46f3dffd8333695bb",
+      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
       "since": "2025-01-01"
     },
     "hook:self-stop-guard": {
@@ -65,7 +65,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/self-stop-guard.js",
-      "contentHash": "b086e0a128b4785908844ebb86e015403fa5bbc4063b30f46f3dffd8333695bb",
+      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
       "since": "2025-01-01"
     },
     "hook:post-action-reflection": {
@@ -74,7 +74,7 @@
       "domain": "evolution",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/post-action-reflection.js",
-      "contentHash": "b086e0a128b4785908844ebb86e015403fa5bbc4063b30f46f3dffd8333695bb",
+      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
       "since": "2025-01-01"
     },
     "hook:external-communication-guard": {
@@ -83,7 +83,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-communication-guard.js",
-      "contentHash": "b086e0a128b4785908844ebb86e015403fa5bbc4063b30f46f3dffd8333695bb",
+      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-collector": {
@@ -92,7 +92,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-collector.js",
-      "contentHash": "b086e0a128b4785908844ebb86e015403fa5bbc4063b30f46f3dffd8333695bb",
+      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-checkpoint": {
@@ -101,7 +101,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-checkpoint.js",
-      "contentHash": "b086e0a128b4785908844ebb86e015403fa5bbc4063b30f46f3dffd8333695bb",
+      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
       "since": "2025-01-01"
     },
     "hook:free-text-guard": {
@@ -110,7 +110,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/free-text-guard.sh",
-      "contentHash": "b086e0a128b4785908844ebb86e015403fa5bbc4063b30f46f3dffd8333695bb",
+      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
       "since": "2025-01-01"
     },
     "hook:claim-intercept": {
@@ -119,7 +119,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept.js",
-      "contentHash": "b086e0a128b4785908844ebb86e015403fa5bbc4063b30f46f3dffd8333695bb",
+      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
       "since": "2025-01-01"
     },
     "hook:claim-intercept-response": {
@@ -128,7 +128,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept-response.js",
-      "contentHash": "b086e0a128b4785908844ebb86e015403fa5bbc4063b30f46f3dffd8333695bb",
+      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
       "since": "2025-01-01"
     },
     "hook:stop-gate-router": {
@@ -137,7 +137,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/stop-gate-router.js",
-      "contentHash": "b086e0a128b4785908844ebb86e015403fa5bbc4063b30f46f3dffd8333695bb",
+      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
       "since": "2025-01-01"
     },
     "hook:auto-approve-permissions": {
@@ -146,7 +146,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/auto-approve-permissions.js",
-      "contentHash": "b086e0a128b4785908844ebb86e015403fa5bbc4063b30f46f3dffd8333695bb",
+      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
       "since": "2025-01-01"
     },
     "job:health-check": {
@@ -1538,7 +1538,7 @@
       "type": "subsystem",
       "domain": "updates",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
-      "contentHash": "b086e0a128b4785908844ebb86e015403fa5bbc4063b30f46f3dffd8333695bb",
+      "contentHash": "d268663ca7bf97eeb12783de48762c8cd6b98f922cfc25d1c3bc5b3e6ac1cdd7",
       "since": "2025-01-01"
     },
     "subsystem:scheduler": {

package/src/scaffold/templates.ts

@@ -519,7 +519,7 @@ This routes feedback to the Instar maintainers automatically. Valid types: \`bug
 - Cancel: \`curl -X DELETE -H "Authorization: Bearer $AUTH" http://localhost:${port}/secrets/pending/TOKEN\`
 - **Security**: One-time link, expires after 15 minutes, CSRF-protected. The moment a secret is SUBMITTED it is also persisted store-first to the durable AES-256-GCM encrypted SecretStore — so it survives session restarts, compaction, and cross-machine handoff instead of evaporating with the in-memory copy. Retrieval transparently falls back to the durable copy, and a successful consume deletes both. (Opt out with \`secrets.persistDrops: false\` in \`.instar/config.json\`.)
 - **Multi-field support**: Request multiple values at once by passing a \`fields\` array (e.g., username + password).
-- **When to use** (PROACTIVE — this is the trigger): the moment a user offers to give you a credential (API key, password, token) or you realize you need one, use Secret Drop. It is the ONLY correct way to collect a secret. NEVER accept it pasted into Telegram or chat, and NEVER create a local file (e.g. \`.instar/secrets/foo.env\`) and ask the user to edit/paste into it — that defeats the one-time, in-memory, never-on-disk guarantee and asks the user to edit files (which you must never do). Always issue a Secret Drop one-time link instead.
+- **When to use — AGENT-RETRIEVES-FIRST; Secret Drop is the LAST resort** (PROACTIVE): When you need a credential, FIRST try to fetch it yourself from an account or service you already have access to — your encrypted vault (\`secret-get.mjs\`), a Vercel project you can read (\`vercel env pull\`), GitHub (\`gh\`), a cloud console, etc. You have full account access and standing operator approval; a secret already sitting in one of your own accounts is yours to fetch — do NOT make the user produce it. Use Secret Drop ONLY when you genuinely cannot reach the secret yourself (an operator-only credential the user actually holds). Even then, never assume the user has it on hand: either mint the one-time Secret Drop link, OR walk them through obtaining it in a mobile-friendly, step-by-step way. When a user proactively OFFERS a credential, Secret Drop is the correct way to collect it — NEVER accept it pasted into Telegram or chat, and NEVER create a local file (e.g. \`.instar/secrets/foo.env\`) and ask the user to edit/paste into it (that defeats the one-time, in-memory, never-on-disk guarantee and asks the user to edit files, which you must never do). The anti-pattern this corrects (2026-06-07 UX violation): issuing a Secret Drop for a webhook secret that was readable from the operator's OWN Vercel project — the agent should have pulled it itself instead of asking.
 
 **Session Boot Self-Knowledge** — Your session-start context includes an auto-injected \`<session-self-knowledge>\` block: the NAMES of secrets in your encrypted vault (never values) + self-asserted operational facts about this agent/machine. (Rides the developmentAgent gate until the fleet flip.)
 - **The rule**: a secret named in your boot block is ALREADY in your vault — retrieve it with \`node .instar/scripts/secret-get.mjs <name>\` (pipe stdout straight into the consuming command, e.g. \`... github_token | gh auth login --with-token\` — NEVER echo the value into chat/transcripts) instead of asking the user to re-send it. Only re-ask if you have evidence it is invalid (expired/revoked/decrypt-failed).

package/upgrades/1.3.417.md

@@ -0,0 +1,24 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The CLAUDE.md Secret Drop guidance now defaults to **agent-retrieves-first**: when an agent needs a credential, it first tries to fetch it itself from an account/service it already has access to (the encrypted vault, a Vercel project via `vercel env pull`, GitHub via `gh`, a cloud console). Secret Drop — or asking the user — is now the **last resort**, used only when the secret genuinely lives somewhere the agent cannot reach, and even then mobile-friendly and step-by-step. The prior wording told agents Secret Drop was "the ONLY correct way to collect a secret … the moment you realize you need one," which threw avoidable work at the user for secrets the agent could fetch itself. When a user proactively *offers* a credential, Secret Drop remains the correct collection mechanism.
+
+Applied to all three Migration-Parity surfaces — the template (new inits), the migrator inject-block (agents missing the section), and a new idempotent content-sniff patch that rewrites the old harmful trigger for already-deployed agents.
+
+## What to Tell Your User
+
+Nothing you need to do. Behind the scenes, your agent now fetches secrets it can already reach on its own instead of asking you for them — so you should get fewer "please submit this secret" prompts for credentials that live in accounts the agent can access. It will still ask you (securely) only when a secret genuinely isn't reachable any other way.
+
+## Summary of New Capabilities
+
+No new endpoint, command, or config. A standards/guidance correction: agents default to retrieving secrets themselves; Secret Drop is the documented last resort.
+
+## Evidence
+
+- 21/21 unit tests green in `tests/unit/PostUpdateMigrator-secretDropHardenedRetrieve.test.ts` (3 new: trigger-rewrite, idempotent, fresh-inject-carries-new-wording; 18 pre-existing unchanged). `npx tsc --noEmit` clean.
+- Origin (causal autopsy): **process-gap** — the wrong default was baked into the template/standard, so every agent inherited it. Live trigger: a Secret Drop issued for `INSTAR_WEBHOOK_SECRET` that was readable from the operator's own Vercel project (`the-portal`), flagged by the operator as a UX violation (2026-06-07, topic 12476).
+- Migration Parity verified across template + inject-block + existing-agent content-sniff patch.

package/upgrades/1.3.418.md

@@ -0,0 +1,47 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Adds a **boot health beacon** — the durable cure for the 2026-06-07 "server
+temporarily down" restart loop (topic 21816 root cause #1, "Liveness Before Load").
+The server boot loads large TopicMemory/SemanticMemory + reconciles sessions BEFORE
+AgentServer binds its port, so for minutes nothing answers `/health` and the
+supervisor can mistake a slow boot for a dead process → restart-before-boot loop.
+
+`BootHealthBeacon` (`src/server/BootHealthBeacon.ts`) is a minimal HTTP listener
+that answers `/health` from the very start of boot and is closed at the handoff
+just before the real server binds (force-closing sockets so there's no EADDRINUSE).
+Wired in `commands/server.ts`, gated by `monitoring.bootHealthBeacon.enabled`
+(default OFF). The startupGrace bump (#979) covers the window until this is enabled.
+
+## What to Tell Your User
+
+If an agent ever sat in a restart loop right after an update on a busy machine,
+showing "server temporarily down" — this is the deeper, permanent fix: the server
+now (when enabled) reports it's alive from the first second of boot, so a slow
+startup can't be mistaken for a crash. Ships off; rolled out carefully.
+
+## Summary of New Capabilities
+
+- `monitoring.bootHealthBeacon.enabled` (default false): when true, a minimal
+  `/health` responder answers during boot and hands the port to the real server at
+  listen time. Off ⇒ no behavior change.
+
+## Evidence
+
+`tests/unit/BootHealthBeacon.test.ts` (4 tests, all passing — incl. the port
+handoff). `tsc --noEmit` clean. Boot wiring placed in the universal foreground boot
+path (daemon re-execs into `--foreground`, verified). causalAutopsy: latent — the
+health-bound-after-heavy-load boot order was always present, harmful only once
+memory/session volume on a loaded box pushed boot past the supervisor's window.
+
+## Scope (honest)
+
+Ships DARK (default off) — zero behavior change until enabled. Additive: a new
+isolated module + an import + two guarded blocks in the boot + an optional config
+field. NOT a risky whole-boot reorder. The interim grace bump (#979) already
+stopped the live loop; this is the durable belt-and-suspenders. Live canary
+verification (flag on, watch /health during a real boot) is the rollout step.

package/upgrades/side-effects/health-first-boot.md

@@ -0,0 +1,79 @@
+# Side-Effects Review — health-first boot (boot health beacon)
+
+**Version / slug:** `health-first-boot`
+**Date:** `2026-06-07`
+**Author:** `Echo`
+**Tier:** 1 (ships DARK behind `monitoring.bootHealthBeacon.enabled`, default OFF — zero behavior change until enabled; additive; both-sides tested)
+**Second-pass reviewer:** `Echo (self) — Tier-1; dark/off-by-default, additive, isolated module; the boot-wiring placement was carefully traced (foreground/daemon fork resolved)`
+
+## Summary of the change
+
+The durable cure for the 2026-06-07 "server temporarily down" restart loop (topic
+21816, root cause #1 — "Liveness Before Load"). The server boot loads large
+TopicMemory/SemanticMemory + reconciles dozens of sessions BEFORE AgentServer
+binds its port, so for ~5-6 min under load nothing answers `/health` and the
+supervisor can mistake a slow boot for a dead process → restart-before-boot loop.
+
+Adds `BootHealthBeacon` (`src/server/BootHealthBeacon.ts`): a minimal HTTP listener
+that answers `/health` 200 (and 503 `warming` to everything else) from the very
+start of boot. Wired in `commands/server.ts`: started right after `setupServerLog`
+(early, common/universal boot path — daemon mode re-execs into `--foreground`,
+verified at server.ts:12463), and **closed at the handoff immediately before**
+`server.start()` (AgentServer's listen). `stop()` force-closes lingering sockets +
+awaits the socket close, so the real `listen` cannot hit EADDRINUSE and the gap is
+sub-second. Config flag `monitoring.bootHealthBeacon.enabled` (default OFF) +
+type + ConfigDefaults. The startupGrace bump (#979) covers the window until this is
+turned on.
+
+## Decision-point inventory
+
+- Enabled? `monitoring.bootHealthBeacon.enabled` — default OFF; absent ⇒ off (read
+  via optional chaining). The only gate.
+- Where to start/stop the beacon (boot-order placement) — the load-bearing
+  decision; see Blast radius.
+
+## 1. Beacon fails to start
+
+Wrapped in try/catch — non-fatal. Boot proceeds without the beacon (the grace bump
+still covers the window). The server is never blocked from booting by a beacon
+problem. Both guards (start + stop) log the error and are marked
+`@silent-fallback-ok` (intentional best-effort fallback, not a silent swallow) so
+the no-silent-fallbacks ratchet stays at its baseline.
+
+## 2. Handoff race (EADDRINUSE on the real listen)
+
+`stop()` calls `server.close()` AND `closeAllConnections()` and awaits the `close`
+event, so the port is released before `server.start()` binds it. `keepAliveTimeout=1`
+prevents an idle keep-alive socket from holding the port. The unit test asserts a
+real server can bind the same port immediately after `stop()`. The `stop()` call is
+also try/caught so a stop failure still lets the real server attempt to bind.
+
+## 3. Wrong boot-order placement (silent no-op)
+
+The start is placed in the **common** boot path: the `if (options.foreground)`
+block is the universal server boot — daemon mode spawns the server with
+`--foreground` (server.ts:12463), so every real server runs it. `bootBeacon` is
+declared at the foreground-block body scope (indent-4), in scope at both the start
+(after setupServerLog) and the stop (before server.start at the same scope). Started
+before the heavy memory/session loads, so it covers the whole window.
+
+## 4. Blast radius
+
+DARK (default off) ⇒ zero behavior change for every existing and new agent until the
+flag is explicitly set. When enabled: one extra short-lived HTTP listener during
+boot that is closed before the real server binds. It only ever *adds* a liveness
+answer during boot; it cannot make a healthy server look unhealthy. Rollout:
+dark → canary on Echo (flip flag, watch one boot) → fleet.
+
+## 5. Rollback
+
+Set the flag off (or absent) ⇒ fully inert. Code revert is clean (new module + an
+import + two guarded blocks + an optional config field). No state/format change.
+
+## 6. Tests
+
+`tests/unit/BootHealthBeacon.test.ts` (4): /health→200 ok while booting; everything
+else→503 warming; **stop() releases the port so a real server binds it immediately**
+(the handoff); start/stop idempotent. tsc clean. The boot wiring is exercised by the
+existing server e2e on the default (off) path (no behavior change); live canary
+verification (flag on, observe /health during a real boot) is the rollout step.

package/upgrades/side-effects/secret-retrieval-first-standard.md

@@ -0,0 +1,24 @@
+# Side-Effects Review — Secret-Retrieval-First Standard
+
+**Version / slug:** `secret-retrieval-first-standard`
+**Date:** `2026-06-07`
+**Author:** `echo`
+**Tier:** `1` (docs/template + idempotent migration; no runtime behavior, no deps/routes/stores)
+**Second-pass reviewer:** `not-required (Tier-1 guidance/template change; correctness self-owned + covered by 3 unit tests)`
+
+## Summary of the change
+Inverts the CLAUDE.md Secret Drop "When to use" guidance from "use Secret Drop the moment you need a credential — the ONLY correct way" to **agent-retrieves-first; Secret Drop is the last resort**. Applied across all three Migration-Parity surfaces: the template (`generateClaudeMd`), the migrator inject-block (agents missing the section), and a new content-sniff patch in `migrateClaudeMd` that rewrites the harmful trigger for already-deployed agents.
+
+Files: `src/scaffold/templates.ts` (template guidance), `src/core/PostUpdateMigrator.ts` (inject-block text + new content-sniff patch), `tests/unit/PostUpdateMigrator-secretDropHardenedRetrieve.test.ts` (+3 tests), `docs/specs/secret-retrieval-first-standard.md` (+ .eli16).
+
+## Decision-point inventory
+- **Runtime behavior change?** None. This is agent-facing guidance text only — no code path, route, store, config, or scheduler is touched. Secret Drop itself (endpoints, retrieve script, durability) is unchanged.
+- **New dependency / state / route / config?** None → trips none of the SqliteRegistry-wiring / feature-delivery-completeness / docs-coverage(new-class) guard classes.
+- **Migration parity?** Satisfied on all three surfaces (template for new inits; inject-block for agents lacking the section; content-sniff patch for agents with the old section). The content-sniff patch is **idempotent** — it anchors on the stable old phrase `It is the ONLY correct way to collect a secret.` and skips once `AGENT-RETRIEVES-FIRST` / the new wording is present. Unit-tested (rewrite / idempotent / fresh-inject).
+- **Silent fallbacks?** None added. No new `try/catch`; pure string edits + one guarded `content.replace`.
+- **Shadow-capability slicer (AGENTS.md for Codex/Gemini)?** Inherits the corrected CLAUDE.md text automatically (the slicer copies sections from CLAUDE.md) — no separate edit needed; this is a positive side-effect (shadows stop carrying the wrong default too).
+- **Secret-handling safety baked into the new guidance:** explicitly tells agents to extract only the needed var, never print the value, and delete multi-secret temp files immediately — codifying the safe-retrieval discipline I followed pulling the value from `the-portal` env.
+- **Rollback?** Trivial — revert the three edits; guidance returns to prior wording, no state to unwind.
+
+## Why ship
+A wrong default in the template propagates to every agent (and every shadow). Justin flagged it as a UX violation (2026-06-07) and directed the standards amendment. Fixing it in the artifact agents read — not by per-agent willpower — is the Structure > Willpower path.