instar 1.3.428 → 1.3.430

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.428",
+  "version": "1.3.430",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-08T06:00:17.512Z",
-  "instarVersion": "1.3.428",
+  "generatedAt": "2026-06-08T08:01:57.520Z",
+  "instarVersion": "1.3.430",
   "entryCount": 199,
   "entries": {
     "hook:session-start": {
@@ -11,7 +11,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/session-start.sh",
-      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
+      "contentHash": "58ca88e808087ef78a28a17ac93387acfa661a4e66a152197bb043218465f85f",
       "since": "2025-01-01"
     },
     "hook:dangerous-command-guard": {
@@ -20,7 +20,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/dangerous-command-guard.sh",
-      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
+      "contentHash": "58ca88e808087ef78a28a17ac93387acfa661a4e66a152197bb043218465f85f",
       "since": "2025-01-01"
     },
     "hook:grounding-before-messaging": {
@@ -29,7 +29,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/grounding-before-messaging.sh",
-      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
+      "contentHash": "58ca88e808087ef78a28a17ac93387acfa661a4e66a152197bb043218465f85f",
       "since": "2025-01-01"
     },
     "hook:compaction-recovery": {
@@ -38,7 +38,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/compaction-recovery.sh",
-      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
+      "contentHash": "58ca88e808087ef78a28a17ac93387acfa661a4e66a152197bb043218465f85f",
       "since": "2025-01-01"
     },
     "hook:external-operation-gate": {
@@ -47,7 +47,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-operation-gate.js",
-      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
+      "contentHash": "58ca88e808087ef78a28a17ac93387acfa661a4e66a152197bb043218465f85f",
       "since": "2025-01-01"
     },
     "hook:deferral-detector": {
@@ -56,7 +56,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/deferral-detector.js",
-      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
+      "contentHash": "58ca88e808087ef78a28a17ac93387acfa661a4e66a152197bb043218465f85f",
       "since": "2025-01-01"
     },
     "hook:self-stop-guard": {
@@ -65,7 +65,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/self-stop-guard.js",
-      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
+      "contentHash": "58ca88e808087ef78a28a17ac93387acfa661a4e66a152197bb043218465f85f",
       "since": "2025-01-01"
     },
     "hook:post-action-reflection": {
@@ -74,7 +74,7 @@
       "domain": "evolution",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/post-action-reflection.js",
-      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
+      "contentHash": "58ca88e808087ef78a28a17ac93387acfa661a4e66a152197bb043218465f85f",
       "since": "2025-01-01"
     },
     "hook:external-communication-guard": {
@@ -83,7 +83,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-communication-guard.js",
-      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
+      "contentHash": "58ca88e808087ef78a28a17ac93387acfa661a4e66a152197bb043218465f85f",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-collector": {
@@ -92,7 +92,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-collector.js",
-      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
+      "contentHash": "58ca88e808087ef78a28a17ac93387acfa661a4e66a152197bb043218465f85f",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-checkpoint": {
@@ -101,7 +101,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-checkpoint.js",
-      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
+      "contentHash": "58ca88e808087ef78a28a17ac93387acfa661a4e66a152197bb043218465f85f",
       "since": "2025-01-01"
     },
     "hook:free-text-guard": {
@@ -110,7 +110,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/free-text-guard.sh",
-      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
+      "contentHash": "58ca88e808087ef78a28a17ac93387acfa661a4e66a152197bb043218465f85f",
       "since": "2025-01-01"
     },
     "hook:claim-intercept": {
@@ -119,7 +119,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept.js",
-      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
+      "contentHash": "58ca88e808087ef78a28a17ac93387acfa661a4e66a152197bb043218465f85f",
       "since": "2025-01-01"
     },
     "hook:claim-intercept-response": {
@@ -128,7 +128,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept-response.js",
-      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
+      "contentHash": "58ca88e808087ef78a28a17ac93387acfa661a4e66a152197bb043218465f85f",
       "since": "2025-01-01"
     },
     "hook:stop-gate-router": {
@@ -137,7 +137,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/stop-gate-router.js",
-      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
+      "contentHash": "58ca88e808087ef78a28a17ac93387acfa661a4e66a152197bb043218465f85f",
       "since": "2025-01-01"
     },
     "hook:auto-approve-permissions": {
@@ -146,7 +146,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/auto-approve-permissions.js",
-      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
+      "contentHash": "58ca88e808087ef78a28a17ac93387acfa661a4e66a152197bb043218465f85f",
       "since": "2025-01-01"
     },
     "job:health-check": {
@@ -1122,7 +1122,7 @@
       "type": "template",
       "domain": "operations",
       "sourcePath": "src/templates/scripts/convergence-check.sh",
-      "contentHash": "0908e2775c497fe526b817563b6f8e29ec4d6bedaf5521a87e625857afc367c3",
+      "contentHash": "4c67cf4d7dc23ac21a1b658e8acf3d3f925c1610afab9291d2cff8d48920fc33",
       "since": "2025-01-01"
     },
     "template:emit-session-clock.sh": {
@@ -1538,7 +1538,7 @@
       "type": "subsystem",
       "domain": "updates",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
-      "contentHash": "02ef1d845e3c49eba88d81c593bc621105d7e3c2f943cccaafcb9194ab5eb4c9",
+      "contentHash": "58ca88e808087ef78a28a17ac93387acfa661a4e66a152197bb043218465f85f",
       "since": "2025-01-01"
     },
     "subsystem:scheduler": {

package/src/templates/scripts/convergence-check.sh

@@ -132,7 +132,7 @@ PY
       continue
     fi
     # Skip well-known service domains + common agent tunnel domains.
-    if echo "$url" | grep -qE '(github\.com|vercel\.app|vercel\.com|netlify\.app|netlify\.com|npmjs\.com|npmjs\.org|cloudflare\.com|google\.com|twitter\.com|x\.com|youtube\.com|reddit\.com|discord\.com|discord\.gg|telegram\.org|t\.me|localhost|127\.0\.0\.1|stackoverflow\.com|developer\.mozilla\.org|docs\.anthropic\.com|anthropic\.com|openai\.com|claude\.ai|notion\.so|linear\.app|fly\.io|render\.com|railway\.app|heroku\.com|amazonaws\.com|azure\.com|gitlab\.com|bitbucket\.org|docker\.com|hub\.docker\.com|pypi\.org|crates\.io|rubygems\.org|pkg\.go\.dev|wikipedia\.org|medium\.com|substack\.com|circle\.so|ghost\.io|telegraph\.ph)'; then
+    if echo "$url" | grep -qE '(github\.com|vercel\.app|vercel\.com|netlify\.app|netlify\.com|npmjs\.com|npmjs\.org|cloudflare\.com|google\.com|twitter\.com|x\.com|youtube\.com|reddit\.com|discord\.com|discord\.gg|telegram\.org|t\.me|localhost|127\.0\.0\.1|stackoverflow\.com|developer\.mozilla\.org|docs\.anthropic\.com|anthropic\.com|openai\.com|claude\.ai|claude\.com|notion\.so|linear\.app|fly\.io|render\.com|railway\.app|heroku\.com|amazonaws\.com|azure\.com|gitlab\.com|bitbucket\.org|docker\.com|hub\.docker\.com|pypi\.org|crates\.io|rubygems\.org|pkg\.go\.dev|wikipedia\.org|medium\.com|substack\.com|circle\.so|ghost\.io|telegraph\.ph)'; then
       continue
     fi
     UNFAMILIAR_URLS="$UNFAMILIAR_URLS  $url\n"

package/upgrades/1.3.429.md

@@ -0,0 +1,81 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The pre-messaging convergence check's `url_provenance` allowlist now trusts
+`claude.com` alongside the already-listed `claude.ai`, `anthropic.com`, and
+`docs.anthropic.com`. The same domain was added to both copies that must agree:
+the primary script (`src/templates/scripts/convergence-check.sh`) and the
+can't-find-template fallback in `PostUpdateMigrator.getConvergenceCheckInline()`.
+This stops the grounding-before-messaging hook from false-flagging Claude
+subscription OAuth login links (which live on `claude.com`) as possibly-fabricated.
+
+The enrollment wizard now attaches an operator-facing heads-up to a pending Claude
+login, warning that a brand-new Claude account login asks for TWO codes in sequence
+— an email-verification code first, then the sign-in code. `PendingLogin` gains an
+optional `notice` field; `EnrollmentWizard.flowNotice(kind)` produces the warning
+for the `url-code-paste` (Claude) flow and nothing for `device-code` (Codex); the
+dashboard's Pending Logins panel renders it above the code. Codex enrollment is
+unchanged.
+
+## What to Tell Your User
+
+When I send you a Claude sign-in link to enroll a subscription account, it now goes
+to you directly. Before, my own link-safety check mistook the official claude.com
+sign-in page for a possibly-made-up address and made me wrap it in a private page
+first — that false alarm is gone.
+
+When I set up a new Claude account for you, the login card now warns you up front
+that Claude will ask for two codes in a row — the email-verification code first,
+then the sign-in code. No more being surprised by the second prompt.
+
+## Summary of New Capabilities
+
+- **claude.com is a trusted domain** in the pre-messaging link-safety check — Claude
+  OAuth login links deliver directly instead of being flagged as unfamiliar.
+- Existing agents get it automatically (the updater re-writes the deployed script
+  from the template on every update); no separate migration.
+
+- **Two-code heads-up on Claude enrollment** — the pending-login card explains the
+  email-code-then-sign-in-code sequence before you start.
+- **`PendingLogin.notice`** — an optional, sanitized, operator-facing flow heads-up
+  (extensible to other flow quirks later); Codex/device-code flows carry none.
+- Ships with the normal instar update (server + dashboard); no migration needed.
+
+## Evidence
+
+Found during live subscription enrollment (topic 20905): driving a fresh Claude
+login produces a sign-in URL on `claude.com`, and delivering it tripped the
+`URL_PROVENANCE` gate because `claude.com` was absent from the allowlist while its
+sibling `claude.ai` was present.
+
+Reproduction — pipe an outbound message containing a `claude.com` link through the
+gate:
+- **Before:** `echo 'Sign in: https://claude.com/oauth/authorize?code=abc' | bash
+  .instar/scripts/convergence-check.sh` → exit 1, output contains `URL_PROVENANCE`
+  (so the link had to be wrapped in a private view to be sent).
+- **After:** same input → exit 0, no `URL_PROVENANCE` flag.
+
+A sibling test still proves a genuinely fabricated domain (`fabricated-domain.xyz`)
+is flagged, so only this one first-party domain was loosened. Locked in by a new
+`convergence-check.test.ts` case.
+
+Found during live enrollment (topic 20905): enrolling a fresh Claude account, the
+operator was asked for an email-verification code first and then a separate sign-in
+code, with nothing explaining the second prompt — reported as confusing.
+
+Reproduction / before-after:
+- **Before:** starting a `url-code-paste` enrollment produced a pending login with
+  only a code + URL; the two-code sequence was undocumented, so the operator hit an
+  unexplained second code prompt.
+- **After:** the same enrollment produces a pending login whose `notice` reads
+  "a brand-new Claude login often asks for TWO codes in order — first an
+  email-verification code … then the sign-in code …", shown on the dashboard card.
+  A `device-code` (Codex) enrollment still carries no notice.
+
+Locked in by new `enrollment-wizard.test.ts`, `pending-login-store.test.ts`, and
+`subscriptions-render.test.ts` cases (notice present for Claude / absent for Codex;
+rendered when present / element omitted when not).

package/upgrades/1.3.430.md

@@ -0,0 +1,21 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Added a new built-in skill, `/iterative-converging-audit`, and the constitution standard it operationalizes ("Iterative Audit to Convergence"), plus its paired safety standard ("No Silent Degradation to Brittle Fallback") in `docs/STANDARDS-REGISTRY.md`. The skill turns any "find all instances of X" task — security audit, safety audit, code review, research sweep, compliance check — into a structured loop that does not stop at one pass: frame the target, sweep, fix-or-classify each finding, then RE-sweep the full surface, repeating until a clean pass returns zero new discoveries. It ships to every agent via `installBuiltinSkills`, so any agent can invoke it.
+
+## What to Tell Your User
+
+I now have a reusable "audit until it's actually done" skill. Instead of looking once and saying "looks clean," it runs a proper loop — sweep, fix what it finds, then sweep again — until a fresh pass turns up nothing new. It works for security reviews, safety audits, research, any "did we get everything?" job, and it's honest: if it has to stop early it says "incomplete," it never dresses up a half-finished sweep as thorough. I also wrote the principle behind it into my constitution so it's a standard I hold myself to, not just a tool.
+
+## Summary of New Capabilities
+
+- `/iterative-converging-audit` — a built-in, user-invocable skill that runs any find-all sweep as an audit → fix → re-audit loop to convergence, with a written findings ledger and a "leave a standing ratchet" step so the converged state cannot silently regress.
+- Two new constitution standards in the registry: "Iterative Audit to Convergence" (thorough means converged, not one-pass) and "No Silent Degradation to Brittle Fallback" (a gating LLM call must swap-provider or fail-closed, never silently drop to a heuristic).
+
+## Evidence
+
+The skill's own worked example is the proof that one-pass audits miss things: the LLM-fallback safety audit reported "~20 sites" on its first sweep, but a re-sweep of the full surface after the fixes landed found **44** call sites — more than double. That gap between round 1 and round 2 is exactly what the convergence loop exists to catch. Verified in dev: `installBuiltinSkills` writes `iterative-converging-audit/SKILL.md` (install + idempotency test green), `pnpm build` is clean, and the skill content documents the audit→fix→re-audit loop, the honest-incompleteness rule, and the standing-ratchet step.

package/upgrades/iterative-converging-audit-skill.eli16.md

@@ -0,0 +1,36 @@
+# Iterative Converging Audit — skill + standard — Plain-English Overview
+
+> The one-line version: a reusable "audit until a fresh look finds nothing new" skill, plus the constitution standard that makes "thorough" mean "converged."
+
+## The problem in one breath
+
+When you ask an agent to "find all the places we do X" — a security hole, an unsafe pattern, a missing check — it tends to sweep once, fix what it sees, and declare victory. But a single pass always has blind spots, and the fixes themselves move things around or reveal new instances. "I looked once and stopped finding things" usually means "I got tired," not "there is nothing left." So audits silently miss things, and nobody can tell a thorough audit from a lazy one after the fact.
+
+## What already exists
+
+- **Lots of one-off audits.** Agents already run sweeps when asked, but each is ad-hoc — no defined loop, no convergence test, no honest "I stopped early" signal.
+- **The `no-*` ratchet pattern.** The codebase already uses CI tests that fail when a banned pattern reappears (for example the new `no-silent-llm-fallback` test). Those are the "standing guard" that keeps an audit from silently regressing — but there was no general method that told you to leave one.
+- **The constitution registry** (`docs/STANDARDS-REGISTRY.md`) — the place where earned standards live. It did not yet name the iterative-audit principle, even though the operator had asked for it more than once.
+
+## What this adds
+
+A new built-in skill, `/iterative-converging-audit`, that any agent can invoke for any find-all task. It encodes the loop explicitly: FRAME the target and search surface; AUDIT (round 1) recording every finding; FIX or classify each finding with a written reason; RE-AUDIT the whole surface again — because your search surface grew and the fixes moved things; and repeat until a clean pass returns zero new discoveries. Only then may you call it converged, and you state how many rounds it took. If you stop for time or budget, you must say "incomplete" — never dress up an exhausted audit as a thorough one. The last step says: where the pattern can be expressed in CI, leave a ratchet so the converged state cannot silently un-converge on the next commit.
+
+Alongside the skill, two constitution standards are added to the registry: "Iterative Audit to Convergence" (the principle above) and its paired "No Silent Degradation to Brittle Fallback" (a gating LLM call must swap provider or fail closed, never silently drop to a brittle heuristic) — the safety standard whose own audit is the skill's first worked example.
+
+## The new pieces
+
+- **The skill** — a methodology document installed to every agent's skill set. It is process, not code: it does not call any API; it tells the agent how to run an honest, converging audit and how to leave a standing guard behind.
+- **The standards** — durable entries in the constitution, each with the "earned from" story so future agents know why the rule exists.
+
+## The safeguards
+
+**Prevents fake thoroughness.** The honesty rule — say "incomplete" when you stopped early — is the core guard. It makes a half-done audit legible instead of indistinguishable from a complete one.
+
+**Prevents silent regression.** The standing-guard step turns a converged audit into a CI ratchet wherever possible, so the next commit can't quietly undo it.
+
+**Prevents accepted findings from rotting.** An accepted (won't-fix) finding must carry a written reason, so a later reader can tell "reviewed and fine" from "missed."
+
+## What ships when
+
+One PR. The skill ships to every agent through the normal built-in-skill install path; existing agents pick it up on their next update. Nothing is enabled or disabled — it is a new capability plus two documented standards.

package/upgrades/side-effects/claude-com-url-allowlist.md

@@ -0,0 +1,41 @@
+# Side-effects review — claude.com in the URL-provenance allowlist
+
+## Change
+
+Adds `claude.com` to the `url_provenance` allowlist of the pre-messaging
+convergence check, in BOTH copies that must stay in sync:
+- `src/templates/scripts/convergence-check.sh` (the primary script, read at runtime)
+- `src/core/PostUpdateMigrator.ts` → `getConvergenceCheckInline()` (the fallback
+  emitted only when the template file can't be found)
+
+It sits next to the already-present `claude.ai` and `anthropic.com` entries.
+
+## Why
+
+The Claude subscription OAuth login link lives on `claude.com` (Anthropic
+consolidated the sign-in surface there; `claude.ai` is the sibling already on the
+list). During live enrollment testing (topic 20905) the grounding-before-messaging
+hook false-flagged the login link as `URL_PROVENANCE` (a possibly-fabricated
+domain), which forced wrapping every OAuth link in a private view before it could
+be sent to the operator. Allowlisting `claude.com` lets enrollment links be
+delivered directly.
+
+## Side effects considered
+
+- **Weakens the provenance gate for claude.com?** Marginally and acceptably:
+  `claude.com` is Anthropic's official first-party domain (same trust class as the
+  already-listed `claude.ai`, `anthropic.com`, `docs.anthropic.com`). The allowlist
+  exists precisely to stop second-guessing well-known service domains. The gate
+  still flags every genuinely unfamiliar/fabricated domain — the regression test
+  keeps `fabricated-domain.xyz` flagged.
+- **Drift between the two copies.** Both are edited identically in this change. The
+  template is authoritative; the inline is a can't-find-template fallback. No new
+  divergence introduced.
+- **Migration parity.** Existing agents receive the updated allowlist because
+  `PostUpdateMigrator` re-writes `.instar/scripts/convergence-check.sh` from the
+  template on every update run (built-in script, always overwritten) — no separate
+  migration needed; the edit to the template IS the migration path.
+- **No API, config, schema, or route surface touched.** Behavior-only change to a
+  heuristic gate. No new dependencies. Idempotent.
+- **Blast radius:** one extra alternation in one regex, in two places. Reversible
+  by removing the `claude\.com` token.

package/upgrades/side-effects/enroll-two-code-warning.md

@@ -0,0 +1,42 @@
+# Side-effects review — enrollment two-code heads-up
+
+## Change
+
+Surfaces an operator-facing heads-up on a pending login about the Claude
+url-code-paste flow's two-code sequence (email-verification code first, then the
+sign-in code). Three pieces:
+- `PendingLoginStore`: new optional `notice?: string` on `PendingLogin` +
+  `IssueLoginInput`; `issue()` persists it when present (omitted otherwise).
+- `EnrollmentWizard`: new `static flowNotice(kind)` returns the two-code warning
+  for `url-code-paste` and `undefined` for `device-code`; `start()` attaches it.
+- `dashboard/subscriptions.js`: `renderPendingLogins` shows a `sub-pending-notice`
+  row (sanitized text) when a notice is present.
+
+## Why
+
+Live enrollment testing (topic 20905): enrolling a fresh Claude account makes
+Anthropic ask for TWO codes in sequence — an email-verification code, then the
+sign-in code — and the operator found the unexplained second prompt confusing. The
+wizard now tells them what to expect up front.
+
+## Side effects considered
+
+- **Backward compatibility / persistence.** `notice` is optional and omitted when
+  absent, so existing pending-login JSON records (written before this change) load
+  unchanged — no migration. `issue()` only adds the key when a non-empty notice is
+  passed, matching the file's existing `...(x ? {x} : {})` style.
+- **Not a secret.** The notice is static guidance text — never a credential, code,
+  or URL. It passes the store's `assertNoCredentialFields` (it's a fixed string set
+  by the wizard, not derived from login input).
+- **XSS / display safety.** Rendered through the existing `sanitizeForDisplay`
+  (NFKC + control/bidi strip + grapheme cap) as inert text in a `div` — never an
+  href or innerHTML. Covered by the render tests (notice present → shown; absent →
+  element omitted) alongside the existing javascript:-URL inertness test.
+- **device-code (Codex) flows are unchanged** — `flowNotice('device-code')` is
+  undefined, so no notice is attached and the row renders exactly as before.
+- **Reach to existing agents.** Server code (PendingLoginStore/EnrollmentWizard)
+  and the dashboard asset ship with the instar package, so agents get this on the
+  normal package update — no `.instar/`-copied file and no PostUpdateMigrator entry
+  required.
+- **Blast radius:** one optional field + one pure static method + one conditional
+  render row. Reversible by dropping the field.

package/upgrades/side-effects/iterative-converging-audit-skill.md

@@ -0,0 +1,39 @@
+# Side-Effects Review — iterative-converging-audit skill + two constitution standards
+
+**Version / slug:** `iterative-converging-audit-skill`
+**Date:** `2026-06-08`
+**Author:** `echo`
+**Second-pass reviewer:** `self-review under the Tier-1 lite lane`
+
+## Summary of the change
+
+Adds a new built-in skill `iterative-converging-audit` (registered inline in `installBuiltinSkills` in `src/commands/init.ts`, with a source copy at `skills/iterative-converging-audit/SKILL.md`), an install unit test, and two entries in `docs/STANDARDS-REGISTRY.md` ("Iterative Audit to Convergence" and "No Silent Degradation to Brittle Fallback"). The skill is pure methodology — it calls no API and gates nothing; it tells an agent how to run a find-all sweep as an audit→fix→re-audit loop to convergence.
+
+## Decision-point inventory
+
+- New skill registration — added — first entry in the `installBuiltinSkills` `skills` object; `installBuiltinSkills` is install-if-missing, so existing agents receive it on the next update without a migration (per Migration Parity Standard's "adding a new skill" case).
+- Constitution registry — added — two `###` standard entries in the Substrate section, in the house format (Rule / In practice / Earned from / Traces to the goal).
+- Test — added — `tests/unit/init-iterativeConvergingAuditSkill.test.ts` mirrors the verify-claim skill test (install + frontmatter + content assertions + idempotency).
+
+## 1. Direction-of-failure analysis
+
+- **No runtime gate touched.** The skill is content installed to `.claude/skills/`; it does not run in any request path, does not classify, does not block. There is no fail-open/fail-closed surface to get wrong.
+- **Install path:** `installBuiltinSkills` is non-destructive (install-if-missing) — verified by the idempotency test: a user-customized copy is NOT overwritten on re-run. So shipping this cannot clobber a customized skill.
+- **No behavior change for existing flows.** Adding a key to the `skills` object cannot affect the other skills' installation; the build + the feature-delivery-completeness suite (83 tests) confirm parity is intact.
+
+## 2. Over-permit
+
+None. No new capability is granted to anything — the skill is advisory text. No new route, no config, no permission.
+
+## 3. Scope deliberately NOT taken
+
+- A CLI/API surface for "run an audit" — out of scope; the skill is a methodology an agent applies, not an endpoint.
+- Auto-applying the iterative loop to existing audit jobs — out of scope; this PR ships the reusable skill + standards; wiring specific jobs to it is follow-up.
+
+## 4. Migration parity
+
+Covered. Adding a new built-in skill needs no migration — `installBuiltinSkills` runs on every update and writes missing skill files. Existing agents get `/iterative-converging-audit` on their next update; new agents get it at init. The `skills/<name>/SKILL.md` source copy follows the established #791 (agent-readiness) pattern.
+
+## 5. Token/cost impact
+
+None at rest. When invoked, the skill shapes the agent's own audit work; it adds no background LLM calls.