instar 1.3.458 → 1.3.460

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-10T02:16:54.329Z",
-  "instarVersion": "1.3.458",
+  "generatedAt": "2026-06-10T03:11:13.813Z",
+  "instarVersion": "1.3.460",
   "entryCount": 199,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "eb4defe5f4d62b96e65a44a77d27e716388b052e5eb94d1edf19358f96ee9b5a",
+      "contentHash": "1ed553bfb7805aff766d3d95e6e8f65778d535f804d86ba5b6b7916bc36f9068",
       "since": "2025-01-01"
     },
     "cli:init": {
@@ -1506,7 +1506,7 @@
       "type": "subsystem",
       "domain": "server",
       "sourcePath": "src/server/AgentServer.ts",
-      "contentHash": "317051fc496b236e2c3f2d274f630e9bb33b0f1222234cdfcbbca62accbeec79",
+      "contentHash": "14cae0304a5a9d275cb282874387888f253a9253bec2e029c56c837ef294a3e4",
       "since": "2025-01-01"
     },
     "subsystem:session-manager": {

package/upgrades/1.3.459.md

@@ -0,0 +1,42 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Added Slice 3 (final layer) of the dev-agent dark-gate conformance guard: the
+GrowthMilestoneAnalyst gains rule **R6 (dev-gate conformance)**. On a development
+agent, every registered dev-gated feature (the Slice-2 `DEV_GATED_FEATURES`
+registry) must resolve LIVE; one observed DARK is surfaced as a proactive
+growth-analyst finding ("dev-gated feature X is dark on this dev agent — likely a
+hardcoded enabled:false default or an operator override"). This catches the
+forgot-the-gate-entirely / misconfig class that the Slice-1 lint can't see and
+the Slice-2 default-test only catches at the default level — and it catches it on
+the live config of the very dev agent it affects.
+
+## What to Tell Your User
+
+Nothing requiring action. On a development agent the growth digest may now include
+a "dev-gated feature X is dark" finding if a feature is misconfigured — that is the
+guard working. No fleet-facing change (dark for the fleet, live on dev agents).
+
+## Summary of New Capabilities
+
+- GrowthMilestoneAnalyst rule R6 (`devGateConformance`, default on) + `liveConfig`
+  dep + `devGateDark` digest count.
+- Completes the dev-gate guard (lint → default-test → runtime cross-check) —
+  CMT-1253. <!-- tracked: CMT-1253 -->
+
+## Evidence
+
+R6 is a preventive/observability layer, so "evidence" is a both-sides demonstration:
+- **Catches the regression:** on a `developmentAgent: true` config with a
+  registered feature's flag forced `false`, `computeFindings()` emits an R6
+  finding for that feature and `buildDigest().counts.devGateDark > 0` (test:
+  `growth-analyst-devgate-r6.test.ts`).
+- **Stays quiet otherwise:** all-live-on-dev → no R6; fleet agent (even with a
+  feature forced dark) → no R6 (fleet darkness is expected); `liveConfig` absent →
+  skipped; `devGateConformance` rule disabled → skipped.
+- **No regression to existing rules:** the 42 existing GrowthMilestoneAnalyst /
+  routes / gate-wiring tests stay green (R6 is inert without `liveConfig`).

package/upgrades/1.3.460.md

@@ -0,0 +1,44 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+When two agents on the SAME computer talk over Threadline, a reply could get silently quarantined by
+the anti-hijack guard. The cause: same-computer delivery labels the sender by NAME, but the
+conversation is filed under the sender's FINGERPRINT (derived from their public key) — so the guard
+compared a name against a fingerprint, decided they didn't match, and isolated the reply into a fresh
+empty thread (the conversation "read empty"). The fix teaches the receiving side to work out the
+sender's fingerprint — using the exact same recipe the conversation was filed with (`fingerprint`, else
+the first 32 chars of the public key) — and hand the guard just that one fact. Now a legitimate reply
+matches its conversation and resumes; an unknown sender is still isolated (fail-safe). The cross-machine
+(internet) path was never affected — it already carries the fingerprint. This is the inbound companion
+to the duplicate-identity fix shipped just before it.
+
+## What to Tell Your User
+
+If you run more than one agent on the same machine and noticed that a co-located agent's replies were
+"going through but not arriving" — or that a conversation between two of your agents kept restarting in
+empty threads — this fixes it. Their replies now stay on the same conversation thread. You don't need
+to do anything; it takes effect after the agent updates and restarts. Nothing changes for agents talking
+across different machines.
+
+## Summary of New Capabilities
+
+A reliability/correctness fix, not a new feature: same-computer agent-to-agent replies now resolve to
+the right conversation instead of being false-isolated by the anti-hijack guard. The guard stays fully
+active and still isolates any sender it can't resolve.
+
+## Evidence
+
+- 13 unit tests for the shared name→fingerprint resolver (incl. the publicKey-only shape that was the
+  blocking case, name collisions → no-guess, and malformed/missing-file fail-safe).
+- 3 unit tests driving the REAL anti-hijack guard: the no-hint case reproduces the live incident
+  (`sagemind` isolated on thread `199c20fe owned by 1db85f…`); the hint case resumes; a mismatched hint
+  still isolates.
+- 2 integration tests chaining the real resolver (against a real on-disk `known-agents.json`) into the
+  real guard, on the exact incident data shape.
+- Typecheck clean; 1710 existing threadline tests unaffected; independent second-pass security review:
+  CONCUR.
+- Spec (converged iter 2, approved): `docs/specs/threadline-local-delivery-fingerprint-attribution.md`.

package/upgrades/side-effects/dev-gate-conformance-r6.md

@@ -0,0 +1,73 @@
+# Side-Effects Review — Dev-Gate Conformance Cross-Check (Slice 3, GrowthMilestoneAnalyst R6)
+
+**Change:** Slice 3 of DEV-AGENT-DARK-GATE-CONFORMANCE-SPEC (converged + approved).
+The layer that catches the forgot-the-gate-entirely / misconfig class: on a
+development agent, every registered dev-gated feature (Slice 2's
+`DEV_GATED_FEATURES`) MUST resolve LIVE — one observed DARK is surfaced as a
+proactive growth-analyst finding on the very agent it affects.
+
+- `src/monitoring/GrowthMilestoneAnalyst.ts` — new rule **R6 (devGateConformance)**:
+  `computeDevGateConformanceFindings()` iterates the registry, resolves each via
+  `resolveDevAgentGate(getConfigByPath(liveConfig, path), liveConfig)`, and emits a
+  finding for any that resolve DARK on a dev agent. New `liveConfig?` dep, new
+  `devGateDark` digest count, new `rules.devGateConformance` flag (default on),
+  R6 wired into `computeFindings` + `buildDigest` + `activeSummary`.
+- `src/server/AgentServer.ts` — feeds `liveConfig: options.config` into the analyst.
+- `tests/unit/growth-analyst-devgate-r6.test.ts` — both sides of the R6 boundary.
+
+**Implementation-locus note (deviation from the spec's prose, documented honestly):**
+the spec's Slice 3 said "Extend FeatureRolloutReconciler … surfaces as a
+growth-analyst finding." I implemented the cross-check **in the GrowthMilestoneAnalyst
+itself** (rule R6), not in FeatureRolloutReconciler, because (a) the analyst is the
+finding/digest surface the spec's outcome names, (b) it is itself dev-gated-LIVE so
+it runs on the affected dev agent, and (c) it already consumes the registry pattern.
+Same outcome (a growth-analyst finding), cleaner locus. The reconciler was not
+modified.
+
+## 1. Over-block — what legitimate inputs does this reject?
+R6 is observe-only — it emits a *finding* (signal), never blocks or mutates. A
+false positive would be a feature that is *intentionally* dark on a dev agent but
+sits in the registry; that is prevented by Slice 2's curation (mcpProcessReaper /
+resourceLedger are excluded). Adding a non-conforming feature to the registry is
+the only way to mis-flag, and that is a deliberate, reviewed act.
+
+## 2. Under-block — what does it still miss?
+A dev-gated feature never added to the registry is invisible to R6 (same registry
+dependency as Slice 2). And R6 only runs on a dev agent (`developmentAgent === true`)
+with `liveConfig` present — on the fleet it is silent by design (fleet darkness is
+expected). These are the intended bounds.
+
+## 3. Level-of-abstraction fit
+Right layer: the analyst already computes findings from sensors; R6 is one more
+read-only rule over the live config + the registry. No new subsystem.
+
+## 4. Signal vs authority
+SIGNAL only. R6 produces a digest finding (the analyst never sends/blocks — it
+COMPUTES findings exposed via read routes). It holds no authority over runtime.
+
+## 5. Interactions — shadowing, double-fire, races?
+None. Pure computation over injected `liveConfig` + the static registry. Wrapped
+in try/catch per feature (a bad path routes to `onError`, never throws). Other
+rules (R1–R5) are untouched; R6 is additive in `computeFindings`/`buildDigest`.
+
+## 6. External surfaces
+The existing `/growth/digest` + `/growth/status` routes now may include R6
+findings + a `devGateDark` count — additive fields, no breaking change. Dark for
+the fleet, live on dev agents (the analyst's own gate). No agent-installed files,
+no Migration Parity entry.
+
+## 7. Rollback cost
+Low — revert the analyst R6 additions + the one AgentServer line + the test.
+Behavior reverts to R1–R5 only; no state, no deployed artifact.
+
+## No deferrals
+This is the final slice of the initiative (CMT-1253). With Slices 1–3 shipped, the
+dev-gate guard spans: lint (drift) → registry+default test (hardcoded default) →
+R6 runtime cross-check (forgot-the-gate / misconfig on a live dev agent). <!-- tracked: CMT-1253 -->
+
+## Second-pass review (independent)
+Verified: R6 default-on but inert without `liveConfig` (42 existing analyst tests
+unchanged green); both sides covered (hardcoded-dark on dev → finding; all-live on
+dev → none; fleet → none; absent config → skip; rule-disabled → skip; digest count
++ calm-break asserted). tsc clean; the Slice-1 dark-gate lint stays clean (R6 reads
+the gate via the funnel, hardcodes nothing).