instar 1.3.431 → 1.3.433

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.431",
+  "version": "1.3.433",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-08T08:31:50.678Z",
-  "instarVersion": "1.3.431",
+  "generatedAt": "2026-06-08T22:16:09.710Z",
+  "instarVersion": "1.3.433",
   "entryCount": 199,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "cli:init": {

package/upgrades/1.3.432.md

@@ -0,0 +1,27 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The subscription-pool quota poller now auto-refreshes an expired OAuth access token from its stored refresh token before declaring an account `needs-reauth`. Previously any 401/403 from the usage endpoint was treated as a dead login — but a Claude Code access token expires routinely (~8–12h) while its refresh token stays valid for weeks, so the poller was wrongly flagging healthy accounts as needing re-authentication every time the short-lived token lapsed.
+
+New `OAuthRefresher` performs the `refresh_token` grant against the public Claude Code OAuth token endpoint and writes the rotated credential back corruption-safely (validated-200 only, read-merge-write preserving all fields, fail-closed on any error). `QuotaPoller` calls it on a 401 and retries once; only a genuinely dead refresh token now yields `needs-reauth`. A new optional `lastRefreshAt` field plus a dashboard "Token auto-refreshed" line make the silent refresh visible.
+
+## What to Tell Your User
+
+Your accounts no longer ask you to sign in again just because a day went by. A Claude login actually holds two keys — a short-lived one that turns over every several hours, and a long-lived one that lasts weeks. I now renew the short-lived key automatically using the long-lived one, exactly the way the Claude app does, so a routine daily expiry is invisible to you. I'll only ask you to sign in again when the real login is genuinely gone — a password change, a sign-out, or a new login elsewhere. The dashboard also shows a small "token auto-refreshed" note so you can see I'm handling it.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Auto-refresh of expired access tokens | automatic (subscription-pool quota poller) |
+| Token-health visibility | Subscriptions dashboard tab — "Token auto-refreshed" line |
+
+## Evidence
+
+Reproduction (live, 2026-06-08, echo's two enrolled max accounts): both showed `status: needs-reauth` and a fresh `POST /subscription-pool/poll` failed 2/2. Inspecting the macOS keychain entries (`Claude Code-credentials-5939f6c8` / `-63465191`) showed `hasRefreshToken: true` with the access token `expiresAt` ~11–12h in the past — i.e. only the short-lived token had lapsed; the login was intact. The old code path mapped that 401 straight to `needs-reauth`.
+
+After the fix: the unit/integration/e2e suites reproduce the exact sequence (usage read 401 → refresh-token exchange → retry 200) and assert the account stays `active` with a `lastRefreshAt` stamp rather than flipping to `needs-reauth`; the dead-refresh-token case still flips to `needs-reauth`. All three tiers green (`tests/unit/oauth-refresher.test.ts`, `tests/unit/quota-poller.test.ts`, `tests/integration/subscription-quota-routes.test.ts`, `tests/e2e/subscription-quota-lifecycle.test.ts`), tsc + repo lint clean.

package/upgrades/1.3.433.md

@@ -0,0 +1,52 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The outbound messaging quality gate (`MessagingToneGate.review`, reached via
+`checkOutboundMessage`) is now bounded by a route-budget timeout that fails OPEN.
+Previously the gate ran inside a single un-raced `await`; under rate-limit pressure
+`review()` waits up to `RATE_LIMIT_WAIT_MS` (120s) for a window plus the call, which
+exceeds the 120s outbound route budget (`OUTBOUND_MESSAGING_TIMEOUT_MS`). The route
+then returns 408 and the calling session falls back to posting the message into
+whatever topic it is active in — which is how update notes ended up in working topics.
+
+A new helper `reviewWithinBudget` (`src/server/outboundGateBudget.ts`) races the
+review against `OUTBOUND_GATE_REVIEW_BUDGET_MS` (20s, defined in `middleware.ts`,
+asserted to be strictly below the route timeout). On time → the real verdict (pass or
+block, unchanged). On budget elapse → a `budgetExceeded` fail-open (delivered,
+logged). This is a structural guarantee at the route seam, covering every outbound
+path that shares the chokepoint (`/telegram/reply`, `/telegram/post-update`,
+`/slack/reply`, `/attention`, …). An optional per-agent override
+`outboundGateReviewBudgetMs` exists; the default lives in code, so existing agents get
+the fix on update with no config change (no migration).
+
+## What to Tell Your User
+
+- **Messages no longer get stuck behind the quality check**: "If you ever saw my
+  updates land in the wrong chat, or replies feel stuck for a minute or two when
+  things are busy — that's fixed. The check that reviews my messages now has a short
+  deadline, so a slow moment can't strand a message anymore."
+
+## Summary of New Capabilities
+
+A behind-the-scenes reliability fix to outbound messaging — no new user-facing
+surface. The message-review gate can no longer outlast its delivery deadline, so
+outbound messages (replies and update posts) can't hang or get misrouted under load.
+
+## Evidence
+
+- Root cause verified in this agent's live `[tone-gate]` decision log: reviews
+  finishing at 121s / 135s / 157s / 170s / 185s, all `failedOpen`, alongside repeated
+  `429` rate-limit events — all past the 120s route budget.
+- `tests/unit/outbound-gate-budget.test.ts` — `reviewWithinBudget` semantics
+  (pass-through, block-through, hang → `budgetExceeded` fail-open, latency, rejection
+  propagation) + the budget-below-route-timeout invariant.
+- `tests/unit/post-update-gate-budget-route.test.ts` — route-level: a hanging gate
+  delivers (200, fast) instead of 408; a fast block still blocks (422, no delivery);
+  a fast pass delivers.
+- Full lint clean; 71 existing related tone-gate/outbound/route tests green.
+- Spec + side-effects review: `docs/specs/outbound-gate-budget.md`,
+  `upgrades/side-effects/outbound-gate-budget.md`.

package/upgrades/side-effects/outbound-gate-budget.md

@@ -0,0 +1,109 @@
+# Side-Effects Review — Outbound tone-gate budget (fail-open within the route budget)
+
+**Version / slug:** `outbound-gate-budget`
+**Date:** `2026-06-08`
+**Author:** `echo`
+**Second-pass reviewer:** `not required (Tier-1, additive + localized)`
+
+## Summary of the change
+
+Every outbound message (telegram/slack reply, attention item, `/telegram/post-update`)
+passes through `checkOutboundMessage` in `src/server/routes.ts`, which calls
+`MessagingToneGate.review` — an LLM call. The gate is fail-open by design, but under
+rate-limit pressure `review()` waits up to `RATE_LIMIT_WAIT_MS` (120s) for a window
+plus the call, all inside one un-raced `await`, exceeding the 120s outbound route
+budget (`OUTBOUND_MESSAGING_TIMEOUT_MS`). The route then 408s and the calling session
+dumps the note into its active topic. This change wraps the review call in
+`reviewWithinBudget` (new file `src/server/outboundGateBudget.ts`), racing it against
+`OUTBOUND_GATE_REVIEW_BUDGET_MS` (20s, new const in `middleware.ts`) and failing OPEN
+past it. Touches: `routes.ts` (one call wrapped + one log field), `MessagingToneGate.ts`
+(+1 optional result field), `types.ts` (+1 optional config field), `middleware.ts`
+(+1 const), new helper + 2 tests + spec.
+
+## Decision-point inventory
+
+- `checkOutboundMessage → tone-gate verdict` — **modify** — the gate verdict is now
+  bounded by a route-budget timeout that fails OPEN; the pass/block decision itself is
+  unchanged when the gate answers in time.
+- `OUTBOUND_GATE_REVIEW_BUDGET_MS vs OUTBOUND_MESSAGING_TIMEOUT_MS` — **add** — a budget
+  invariant (gate budget < route timeout) asserted in tests.
+
+## 1. Over-block
+
+**What legitimate inputs does this change reject that it shouldn't?**
+
+None — the change can only move the gate from "block/hold" toward "deliver". A real
+block returned within budget is passed through unchanged (covered by the route test:
+a fast B3 block still returns 422). The only new outcome is a budget-exceeded
+fail-open, which DELIVERS (pass=true). So over-block strictly decreases; it never
+increases.
+
+## 2. Under-block
+
+**What failure modes does this still miss?**
+
+Under sustained rate-limit pressure a message can now be delivered un-reviewed after
+the 20s budget (an intentional, designed fail-open). This is the same outcome the gate
+already produced via its internal `failedOpen` path — just reached deterministically in
+budget instead of after 2–3 minutes. The change does NOT make the gate review more
+content (no new bypass). It does not address the separate behavioral fallback (a
+session re-sending a failed update into a working topic) — tracked as a follow-up.
+
+## 3. Level-of-abstraction fit
+
+The budget is enforced at the route seam (`checkOutboundMessage`), the same layer that
+already bounds the ArcCheck signal with a 200ms race — the correct altitude, because the
+budget is a property of the OUTBOUND ROUTE (its 120s limit), not of the gate. The gate
+stays a general authority usable by callers with different budgets.
+
+## 4. Signal vs authority compliance
+
+The tone gate remains the single authority; this does not add a competing gate. The
+budget wrapper is a timeout, not a second opinion — when the authority answers in time
+its verdict is used verbatim (pass AND block). On timeout the documented fail-open
+contract applies (deliver). No signal is promoted to authority and no authority is
+demoted to signal.
+
+## 5. Interactions
+
+- Shares the chokepoint with `/telegram/reply`, `/slack/reply`, `/whatsapp/send`,
+  `/imessage/reply`, `/attention` — all inherit the bound (verified: their existing
+  route tests still pass).
+- The abandoned review promise keeps running after a budget timeout (Node has no
+  cancel); it resolves/ignored, and `MessagingToneGate.review` never rejects (internal
+  catch), so no unhandled rejection. `Promise.race` keeps a reaction attached to the
+  review promise, so even a hypothetical late rejection is considered handled.
+- `logToneGateDecision` gains a `budgetExceeded` boolean — additive, back-compatible
+  with existing log consumers.
+
+## 6. External surfaces
+
+No new routes, no new external calls, no auth/permission change, no Telegram/Slack API
+shape change. Adds one optional config field `outboundGateReviewBudgetMs` (absent →
+code default; no migration). No state files written or read.
+
+## 7. Rollback cost
+
+Trivial and low-risk. Revert the commit; the gate returns to its prior un-raced await.
+Or set `config.outboundGateReviewBudgetMs` very high to effectively disable the cap
+without code change. No data migration, no schema, no persisted state to unwind.
+
+## Conclusion
+
+Net safety improvement: the change strictly reduces the worst-case behavior (a 408 that
+both bypasses the gate AND misroutes the message) and never introduces a new block. The
+only new behavior — faster fail-open delivery under sustained rate-limit pressure — is
+the gate's already-documented degraded mode, reached in budget. Safe to ship.
+
+## Second-pass review (if required)
+
+Not required — Tier-1, additive and localized to one already-fail-open seam, full lint
+green, 9 new + 71 existing related tests green.
+
+## Evidence pointers
+
+- Live `[tone-gate]` decision log latencies: 121s / 135s / 157s / 170s / 185s, all
+  `failedOpen`, alongside repeated `429` events (this agent, 2026-06-07/08).
+- Tests: `tests/unit/outbound-gate-budget.test.ts`,
+  `tests/unit/post-update-gate-budget-route.test.ts`.
+- Spec: `docs/specs/outbound-gate-budget.md`.

package/upgrades/side-effects/subscription-token-autorefresh.md

@@ -0,0 +1,29 @@
+# Side-effects review — subscription-pool OAuth access-token auto-refresh
+
+## What changed
+- New `src/core/OAuthRefresher.ts`: a corruption-safe refresh-token→access-token exchange for a config home's Claude Code credential (keychain on macOS, `<configHome>/.credentials.json` elsewhere). Endpoint + client id are the public Claude Code values extracted from the official client binary.
+- `src/core/QuotaPoller.ts`: on a usage-read 401/403 the poller now attempts a refresh + one retry BEFORE marking the account `needs-reauth`. `defaultTokenResolver` refactored to share the OAuthRefresher locator (single source of truth for where a config home's credential lives).
+- `src/core/SubscriptionPool.ts`: new optional `lastRefreshAt` field (visibility only).
+- `dashboard/subscriptions.js`: a "Token auto-refreshed <ago>" line + `relativeAge()` helper.
+
+## Blast radius / who is affected
+- Only anthropic/claude-code accounts in a SubscriptionPool. A pool of zero accounts (single-account agents) is entirely unaffected — the poller only runs when accounts are enrolled.
+- Behavior change is strictly a NARROWING of when `needs-reauth` fires: it no longer fires on a recoverable access-token expiry. Genuinely dead logins still flip to `needs-reauth` exactly as before.
+
+## Corruption safety (the load-bearing concern)
+- The ONLY mutation is the credential write-back. It is gated three ways: (1) only on a fully-validated 200 (new access token shaped `sk-ant-oat…`, positive numeric `expires_in`); (2) read-merge-write that preserves every existing field (scopes, subscriptionType, rateLimitTier, unknown fields); (3) refresh-token rotation persisted when present, old token kept when the server doesn't rotate — never dropped.
+- Any failure (wrong endpoint, wrong client id, network error, malformed body, write failure) writes NOTHING and returns a typed failure → the caller's existing `needs-reauth` path. A misconfiguration can only ever fail to improve, never corrupt a working login. This is fail-CLOSED, not silent-degrade-to-heuristic (consistent with the no-silent-llm-fallback standard, though this path is auth not inference).
+
+## Secrets handling
+- Token values are never logged and never returned to any persisted surface. The pool registry's existing `assertNoCredentialFields` guard still rejects any credential-bearing field name; `lastRefreshAt` is a timestamp, not a secret.
+
+## Framework generality
+- Scoped to claude-code OAuth specifically (the refresh-token grant is provider/framework-specific). It does NOT touch the session launch/inject abstraction (frameworkSessionLaunch / MessageDelivery), so it cannot regress codex-cli / gemini-cli / pi-cli. Non-claude-code accounts are skipped by the same provider/framework guard the poller already applies.
+
+## Migration parity
+- No agent-installed files change (no settings.json hooks, no config defaults, no CLAUDE.md template, no hook scripts, no skills). This is an in-process monitoring component; existing agents pick it up on the next server update. The new `lastRefreshAt` field is optional and back-compatible with existing `subscription-pool.json` on disk.
+
+## Tests
+- Tier 1: `tests/unit/oauth-refresher.test.ts` (rotation, no-rotation, no-refresh-token, exchange-failed, malformed, read-failed, write-failed, locator, request shape) + extended `tests/unit/quota-poller.test.ts` (refresh-recovers, still-401-after-refresh, dead-refresh-token) + `tests/unit/subscriptions-render.test.ts` (token-health line + relativeAge).
+- Tier 2: `tests/integration/subscription-quota-routes.test.ts` — recovery + dead-login through the real `/subscription-pool/poll` HTTP route.
+- Tier 3: `tests/e2e/subscription-quota-lifecycle.test.ts` — expired token auto-refreshes end-to-end, account stays active, stamped to the on-disk registry.