instar 1.3.43 → 1.3.45

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.43",
+  "version": "1.3.45",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-05-28T01:24:38.781Z",
-  "instarVersion": "1.3.43",
+  "generatedAt": "2026-05-28T02:17:30.185Z",
+  "instarVersion": "1.3.45",
   "entryCount": 193,
   "entries": {
     "hook:session-start": {
@@ -409,7 +409,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -417,7 +417,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -425,7 +425,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -433,7 +433,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -441,7 +441,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -449,7 +449,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -457,7 +457,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -465,7 +465,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -473,7 +473,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -481,7 +481,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -489,7 +489,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -497,7 +497,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -505,7 +505,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -513,7 +513,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -521,7 +521,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -529,7 +529,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -537,7 +537,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -545,7 +545,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -553,7 +553,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -561,7 +561,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -569,7 +569,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -577,7 +577,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -585,7 +585,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -593,7 +593,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -601,7 +601,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -609,7 +609,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -617,7 +617,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -625,7 +625,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -633,7 +633,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -641,7 +641,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -649,7 +649,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -657,7 +657,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -665,7 +665,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -673,7 +673,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -681,7 +681,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -689,7 +689,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -697,7 +697,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -705,7 +705,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -713,7 +713,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -721,7 +721,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -729,7 +729,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -737,7 +737,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -745,7 +745,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -753,7 +753,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/machineRoutes.ts",
-      "contentHash": "5bd048aabb524e50a9f2808e4e0400ae728f5e36797e5850eff4ff7aae7921f9",
+      "contentHash": "b8a789fea855d5e45cffc3ffaea6fcf3c04d4cbb39b3097a1590ee76ccc5378b",
       "since": "2025-01-01"
     },
     "route-group:secret-drop": {
@@ -761,7 +761,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d6cc32ccd33508137b7c33451cea0c9f0d29eda5fd13456743133c0c50a955ed",
+      "contentHash": "8c1ca53475ef9ebe286fcdc8a4bbf5a46e0503b242dfa1040685e15ea0eea830",
       "since": "2025-01-01"
     },
     "cli:init": {
@@ -1457,7 +1457,7 @@
       "type": "subsystem",
       "domain": "server",
       "sourcePath": "src/server/AgentServer.ts",
-      "contentHash": "d97b98638cccf4bd66b46d2d49615a5f5a416eebddf6bcae7ab3473800f02990",
+      "contentHash": "678de8d250b39e3b7bf4470d1e8b7d6290791d0595fea7686f4bd8347b2b92bd",
       "since": "2025-01-01"
     },
     "subsystem:session-manager": {
@@ -1545,7 +1545,7 @@
       "type": "subsystem",
       "domain": "coordination",
       "sourcePath": "src/core/MultiMachineCoordinator.ts",
-      "contentHash": "48c59a44dc01c3f3e5f7e4579b623515f95b8751649e51b8f840eea5b45e1869",
+      "contentHash": "f0ad105ab4996bb6d14d2c836430fb6f7c8b7adab512c6a21c03bd5f029d8d3b",
       "since": "2025-01-01"
     },
     "subsystem:backup-manager": {

package/upgrades/1.3.44.md

@@ -0,0 +1,72 @@
+# Instar Upgrade Guide — NEXT
+
+<!-- bump: patch -->
+
+## What Changed
+
+**Cross-machine seamlessness — full wiring landed (mostly dark).** The integration
+follow-on to PR #419. #419 shipped the seamlessness *components* (G1 fenced lease,
+G2 auto-sync, G3 ledger/outbox/live-tail/HandoffSentinel logic) unit-tested but
+not wired into the live path. PR #428 wires them in — the machine-to-machine
+"phone line", the handoff conductor, and the exactly-once message guarantee — and
+proves each end-to-end. Single-machine agents are completely unaffected: every new
+component is gated on a multi-machine mesh + lease holder + (where flagged) an
+explicit opt-in config flag.
+
+What's now LIVE on every install (not flag-gated, but no-op on a solo agent):
+
+- **Lease wire transport** — `HttpLeaseTransport` + `POST /api/lease` route, into
+  `LeaseCoordinator`. Single-machine no-op (no peers).
+- **Live-tail streaming** — holder pushes the encrypted conversation tail to the
+  standby on a cadence (`LiveTailSource` → `HttpLiveTailTransport` → receiver
+  `LiveTailBuffer`); redaction-before-encryption; only the lease holder streams.
+- **Handoff conductor** — `HandoffSentinel` (outgoing) + `HandoffReceiver`
+  (incoming) bolted into server boot; `POST /api/handoff/{begin,ack,yield}`
+  (signed) + `POST /handoff/initiate` (operator trigger). The lease is **never
+  yielded** unless the incoming machine's echo verifies AND validation passes —
+  proven over two real booted servers (caught-up → handed-off; divergent → aborts
+  and stays awake = no two-captains).
+
+What's DARK (behind `multiMachine.exactlyOnceIngress`, off by default until a live
+two-machine test-as-self confirms no false-drops on the most critical path):
+
+- **Exactly-once ingress ledger** — `MessageProcessingLedger` for inbound dedup +
+  outbound `FencedOutbox` for reply commit, plus `ReplyMarkerTransport` propagating
+  the `reply_committed` marker to standby peers so a post-handoff redelivery can't
+  re-send a reply the old holder already committed.
+
+Architecture documentation added: `site/src/content/docs/features/multi-machine.md`
+gains a "Seamlessness Architecture (Components)" section grouping the 14 new classes
+by role (coordination, planned handoff, live-tail streaming, exactly-once delivery,
+update coordination).
+
+## What to Tell Your User
+
+- The seamlessness wiring you've been hearing about is now landed — your laptop and a
+  second machine (when you have one) can take turns being the awake agent without
+  losing the conversation. On a solo setup nothing changes; this is groundwork.
+- The trickiest part — making sure a reply never goes out twice during a hand-off —
+  is wired but turned off by default until I've live-tested it on two real machines.
+- A new architecture doc page explains the components in plain English if you ever
+  want a tour: Multi-Machine → Seamlessness Architecture.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| `POST /api/lease` | Low-latency lease transport between mesh peers (server-to-server, signed). Solo agents see no traffic. |
+| `POST /api/handoff/{begin,ack,yield}` | Planned-handoff protocol endpoints (signed, machine-to-machine). |
+| `POST /handoff/initiate` | Operator trigger: gracefully hand the awake role to a specific peer. |
+| `multiMachine.exactlyOnceIngress` (config flag, default off) | Enables the inbound-dedup + reply-commit guarantee. Flip on only after a two-machine live test confirms no false-drops. |
+| Multi-Machine doc: Seamlessness Architecture | New section in `site/src/content/docs/features/multi-machine.md` — names each component, groups by role. |
+
+## Evidence
+
+**Integration follow-on, mostly wiring + boot glue.** All component logic was
+unit-tested in #419; this PR adds the live-path wiring with paired wiring-integrity
+tests for each bolt-in. Two real booted servers exercised the handoff protocol
+(caught-up → handed-off; divergent → aborts and stays awake). Single-conflict merge
+of main into the branch (only `src/commands/server.ts`, in the AgentServer
+constructor call — both sides added new components; resolution kept all and merged
+the field list). `tsc --noEmit` clean post-merge. Docs-coverage class floor cleared
+(54% → 56%, > 55% floor).

package/upgrades/1.3.45.md

@@ -0,0 +1,28 @@
+# Upgrade Guide — vNEXT
+
+<!-- bump: patch -->
+
+## What Changed
+
+UX refinement of the Process Health dashboard tab shipped in v1.3.27. Eight rounds of user-driven copy + structure iteration landed on the design that became the **Dashboard Standard** — the bar all future dashboard features now start from. Pure dashboard-only change (`dashboard/process-health.js` + `dashboard/index.html` + tests); no `src/` / `scripts/` / `.husky/` / `skills/` changes.
+
+What the page looks like now: a one-sentence intro grounds the subject so "it" later in the page has a referent; each section title carries a one-line subtitle that distinguishes it from the others (with explicit cross-references — "When the same kind keeps repeating, it shows up as a pattern above"); each captured problem and pattern card is a `<details>` element with a status color dot on the left (amber/blue/green/gray — never alarm reds) and a chevron on the right; the expanded body is a labeled fact-sheet using a fixed vocabulary (Status / Where / Times seen / First noticed / Cause) used identically across both lists. All action-implying language ("Suggested next step", "verify before acting", "Fix worked") is gone — the page informs, it doesn't direct. Internal codenames (`capture-only`, `failure-learning-loop`, `config-parse`) never reach the DOM; they pass through renderer-owned plain-English maps.
+
+The reference implementation now backs a durable agent memory (`feedback_dashboard_copy_eli16.md`) that codifies the seven rules + eight default substitutions + four status-color tokens so future dashboard work starts from this bar.
+
+## What to Tell Your User
+
+- The Process Health tab on your dashboard reads a lot more clearly now: a calm intro tells you what the page is showing in one sentence, every problem and pattern collapses to one plain line with a small color dot (amber = still being looked into, blue = cause known, green = worked out, gray = closed), and tapping any row opens up the same set of labeled details — Status, Where, Times seen, First noticed, Cause — every time. The bar this set for "what a calm, informative dashboard reads like" is now the standard for everything I build next.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Process Health tab — ELI16 + structure pass | Open the Process Health tab in your dashboard (no action needed; it’s just clearer now) |
+| Dashboard Standard (durable, applies to future dashboard work) | Reference: `feedback_dashboard_copy_eli16.md` (in agent memory) — 7 rules + 8 substitutions + 4 status-color tokens |
+
+## Evidence
+
+- 46 tests green: 30 unit + 12 integration + 4 e2e — includes structural assertions for the unified label order, status-dot CSS classes, and that the dropped framing line is genuinely absent.
+- Safety contract unchanged: XSS negative fixture still fires zero live elements + no canary; `detail.full` redaction is verified end-to-end.
+- Show-don't-tell iteration: eight rounds, each rendered to a real browser and screenshotted for user thumbs-up before committing — no merge-and-iterate churn. The harness pattern is captured in the standard.

package/upgrades/side-effects/cross-machine-seamlessness-consent-acquire.md

@@ -0,0 +1,52 @@
+# Side-Effects Review — Cross-Machine Seamlessness: consented lease acquire (planned handoff)
+
+**Spec:** docs/specs/CROSS-MACHINE-SEAMLESSNESS-SPEC.md §8 G3e (converged, approved)
+
+The lease primitive a PLANNED handoff needs: the incoming machine takes the lease
+while the outgoing is still alive, which the liveness-gated `acquireIfEligible()`
+correctly refuses. Added as an ADDITIVE consent path — the split-brain-critical
+`canAcquire()` gate (hardware-verified for G1) is deliberately left untouched.
+
+## What changed
+- `src/core/LeaseCoordinator.ts` — NEW `acquireOnConsent(yieldFromMachineId)`.
+  Bypasses the liveness `canAcquire()` gate (because the holder explicitly consented
+  via a verified yield), CAS-advances to epoch+1, broadcasts, emits the new epoch.
+  **Security guard:** if there is a current holder and it is NOT the yielding machine,
+  the acquire is REFUSED — a yield from any non-holder cannot trigger a takeover.
+  Already-ours → true (idempotent); empty lease → acquire.
+- `src/core/MultiMachineCoordinator.ts` — NEW `acquireLeaseOnConsent(yieldFromMachineId)`:
+  the onYield entry point — delegates to the guarded consent path, then reconciles
+  role → awake on success.
+
+## Over-block / under-block
+- The guard is the security boundary: only the CURRENT holder's yield grants the
+  takeover. Combined with the route's machineAuth (the yield came from an
+  authenticated machine), a forged or misdirected yield is doubly defeated.
+- If the CAS is lost (someone already advanced), the consent acquire adopts the
+  observed epoch and stands down — no double-advance, no split-brain.
+- The existing `acquireIfEligible()` / `canAcquire()` / `renew()` paths are byte-for-byte
+  UNCHANGED, so the hardware-verified G1 split-brain guarantee is preserved exactly. This
+  is purely additive surface reachable only from the handoff yield handler.
+
+## Signal vs authority
+- This IS an authority mutation (it advances the lease epoch) — and it is correctly
+  gated: reachable only from the authenticated /api/handoff/yield handler, and only
+  when the yielding machine is the observed holder. The decision to yield (verified
+  ack + validation) lives upstream in HandoffSentinel.
+
+## Interactions
+- Consumed (next integrating commit) by the /api/handoff/yield route's onYield handler:
+  `coordinator.acquireLeaseOnConsent(fromMachineId)`. The outgoing machine's HandoffSentinel
+  sends the yield only after a verified ack + passing validation, so by the time consent
+  reaches the incoming, the outgoing has committed to standing down.
+- Mirrors the success path of acquireIfEligible (effectiveView → buildAcquisition → casWrite
+  → broadcast → emitEpoch), so behavior is consistent with the proven acquisition flow.
+
+## Rollback cost
+- Minimal — two additive methods, no change to existing paths. Reverting removes them.
+
+## Tests
+- `tests/unit/LeaseCoordinator.test.ts` (+4, 12 total): consent takes a LIVE peer-held
+  lease (the bypass) while the normal path refuses it; **SECURITY — a yield from a
+  non-holder is refused (no takeover)**; idempotent when already held; acquires from empty.
+  tsc clean.