instar 1.3.432 → 1.3.433

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.432",
+  "version": "1.3.433",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-08T20:59:17.649Z",
-  "instarVersion": "1.3.432",
+  "generatedAt": "2026-06-08T22:16:09.710Z",
+  "instarVersion": "1.3.433",
   "entryCount": 199,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ba95e48c020a055480ff5c548630cc97e7797d6f79cb919affdb589ebd3f8d48",
+      "contentHash": "cde0ebbb56e26519e8d6bb35d78dca71eaebafa62c2b7c465145ba5f5c644bbb",
       "since": "2025-01-01"
     },
     "cli:init": {

package/upgrades/1.3.433.md

@@ -0,0 +1,52 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The outbound messaging quality gate (`MessagingToneGate.review`, reached via
+`checkOutboundMessage`) is now bounded by a route-budget timeout that fails OPEN.
+Previously the gate ran inside a single un-raced `await`; under rate-limit pressure
+`review()` waits up to `RATE_LIMIT_WAIT_MS` (120s) for a window plus the call, which
+exceeds the 120s outbound route budget (`OUTBOUND_MESSAGING_TIMEOUT_MS`). The route
+then returns 408 and the calling session falls back to posting the message into
+whatever topic it is active in — which is how update notes ended up in working topics.
+
+A new helper `reviewWithinBudget` (`src/server/outboundGateBudget.ts`) races the
+review against `OUTBOUND_GATE_REVIEW_BUDGET_MS` (20s, defined in `middleware.ts`,
+asserted to be strictly below the route timeout). On time → the real verdict (pass or
+block, unchanged). On budget elapse → a `budgetExceeded` fail-open (delivered,
+logged). This is a structural guarantee at the route seam, covering every outbound
+path that shares the chokepoint (`/telegram/reply`, `/telegram/post-update`,
+`/slack/reply`, `/attention`, …). An optional per-agent override
+`outboundGateReviewBudgetMs` exists; the default lives in code, so existing agents get
+the fix on update with no config change (no migration).
+
+## What to Tell Your User
+
+- **Messages no longer get stuck behind the quality check**: "If you ever saw my
+  updates land in the wrong chat, or replies feel stuck for a minute or two when
+  things are busy — that's fixed. The check that reviews my messages now has a short
+  deadline, so a slow moment can't strand a message anymore."
+
+## Summary of New Capabilities
+
+A behind-the-scenes reliability fix to outbound messaging — no new user-facing
+surface. The message-review gate can no longer outlast its delivery deadline, so
+outbound messages (replies and update posts) can't hang or get misrouted under load.
+
+## Evidence
+
+- Root cause verified in this agent's live `[tone-gate]` decision log: reviews
+  finishing at 121s / 135s / 157s / 170s / 185s, all `failedOpen`, alongside repeated
+  `429` rate-limit events — all past the 120s route budget.
+- `tests/unit/outbound-gate-budget.test.ts` — `reviewWithinBudget` semantics
+  (pass-through, block-through, hang → `budgetExceeded` fail-open, latency, rejection
+  propagation) + the budget-below-route-timeout invariant.
+- `tests/unit/post-update-gate-budget-route.test.ts` — route-level: a hanging gate
+  delivers (200, fast) instead of 408; a fast block still blocks (422, no delivery);
+  a fast pass delivers.
+- Full lint clean; 71 existing related tone-gate/outbound/route tests green.
+- Spec + side-effects review: `docs/specs/outbound-gate-budget.md`,
+  `upgrades/side-effects/outbound-gate-budget.md`.

package/upgrades/side-effects/outbound-gate-budget.md

@@ -0,0 +1,109 @@
+# Side-Effects Review — Outbound tone-gate budget (fail-open within the route budget)
+
+**Version / slug:** `outbound-gate-budget`
+**Date:** `2026-06-08`
+**Author:** `echo`
+**Second-pass reviewer:** `not required (Tier-1, additive + localized)`
+
+## Summary of the change
+
+Every outbound message (telegram/slack reply, attention item, `/telegram/post-update`)
+passes through `checkOutboundMessage` in `src/server/routes.ts`, which calls
+`MessagingToneGate.review` — an LLM call. The gate is fail-open by design, but under
+rate-limit pressure `review()` waits up to `RATE_LIMIT_WAIT_MS` (120s) for a window
+plus the call, all inside one un-raced `await`, exceeding the 120s outbound route
+budget (`OUTBOUND_MESSAGING_TIMEOUT_MS`). The route then 408s and the calling session
+dumps the note into its active topic. This change wraps the review call in
+`reviewWithinBudget` (new file `src/server/outboundGateBudget.ts`), racing it against
+`OUTBOUND_GATE_REVIEW_BUDGET_MS` (20s, new const in `middleware.ts`) and failing OPEN
+past it. Touches: `routes.ts` (one call wrapped + one log field), `MessagingToneGate.ts`
+(+1 optional result field), `types.ts` (+1 optional config field), `middleware.ts`
+(+1 const), new helper + 2 tests + spec.
+
+## Decision-point inventory
+
+- `checkOutboundMessage → tone-gate verdict` — **modify** — the gate verdict is now
+  bounded by a route-budget timeout that fails OPEN; the pass/block decision itself is
+  unchanged when the gate answers in time.
+- `OUTBOUND_GATE_REVIEW_BUDGET_MS vs OUTBOUND_MESSAGING_TIMEOUT_MS` — **add** — a budget
+  invariant (gate budget < route timeout) asserted in tests.
+
+## 1. Over-block
+
+**What legitimate inputs does this change reject that it shouldn't?**
+
+None — the change can only move the gate from "block/hold" toward "deliver". A real
+block returned within budget is passed through unchanged (covered by the route test:
+a fast B3 block still returns 422). The only new outcome is a budget-exceeded
+fail-open, which DELIVERS (pass=true). So over-block strictly decreases; it never
+increases.
+
+## 2. Under-block
+
+**What failure modes does this still miss?**
+
+Under sustained rate-limit pressure a message can now be delivered un-reviewed after
+the 20s budget (an intentional, designed fail-open). This is the same outcome the gate
+already produced via its internal `failedOpen` path — just reached deterministically in
+budget instead of after 2–3 minutes. The change does NOT make the gate review more
+content (no new bypass). It does not address the separate behavioral fallback (a
+session re-sending a failed update into a working topic) — tracked as a follow-up.
+
+## 3. Level-of-abstraction fit
+
+The budget is enforced at the route seam (`checkOutboundMessage`), the same layer that
+already bounds the ArcCheck signal with a 200ms race — the correct altitude, because the
+budget is a property of the OUTBOUND ROUTE (its 120s limit), not of the gate. The gate
+stays a general authority usable by callers with different budgets.
+
+## 4. Signal vs authority compliance
+
+The tone gate remains the single authority; this does not add a competing gate. The
+budget wrapper is a timeout, not a second opinion — when the authority answers in time
+its verdict is used verbatim (pass AND block). On timeout the documented fail-open
+contract applies (deliver). No signal is promoted to authority and no authority is
+demoted to signal.
+
+## 5. Interactions
+
+- Shares the chokepoint with `/telegram/reply`, `/slack/reply`, `/whatsapp/send`,
+  `/imessage/reply`, `/attention` — all inherit the bound (verified: their existing
+  route tests still pass).
+- The abandoned review promise keeps running after a budget timeout (Node has no
+  cancel); it resolves/ignored, and `MessagingToneGate.review` never rejects (internal
+  catch), so no unhandled rejection. `Promise.race` keeps a reaction attached to the
+  review promise, so even a hypothetical late rejection is considered handled.
+- `logToneGateDecision` gains a `budgetExceeded` boolean — additive, back-compatible
+  with existing log consumers.
+
+## 6. External surfaces
+
+No new routes, no new external calls, no auth/permission change, no Telegram/Slack API
+shape change. Adds one optional config field `outboundGateReviewBudgetMs` (absent →
+code default; no migration). No state files written or read.
+
+## 7. Rollback cost
+
+Trivial and low-risk. Revert the commit; the gate returns to its prior un-raced await.
+Or set `config.outboundGateReviewBudgetMs` very high to effectively disable the cap
+without code change. No data migration, no schema, no persisted state to unwind.
+
+## Conclusion
+
+Net safety improvement: the change strictly reduces the worst-case behavior (a 408 that
+both bypasses the gate AND misroutes the message) and never introduces a new block. The
+only new behavior — faster fail-open delivery under sustained rate-limit pressure — is
+the gate's already-documented degraded mode, reached in budget. Safe to ship.
+
+## Second-pass review (if required)
+
+Not required — Tier-1, additive and localized to one already-fail-open seam, full lint
+green, 9 new + 71 existing related tests green.
+
+## Evidence pointers
+
+- Live `[tone-gate]` decision log latencies: 121s / 135s / 157s / 170s / 185s, all
+  `failedOpen`, alongside repeated `429` events (this agent, 2026-06-07/08).
+- Tests: `tests/unit/outbound-gate-budget.test.ts`,
+  `tests/unit/post-update-gate-budget-route.test.ts`.
+- Spec: `docs/specs/outbound-gate-budget.md`.