instar 1.3.502 → 1.3.503

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.502",
+  "version": "1.3.503",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-12T23:24:48.391Z",
-  "instarVersion": "1.3.502",
+  "generatedAt": "2026-06-12T23:59:10.477Z",
+  "instarVersion": "1.3.503",
   "entryCount": 201,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "cli:init": {

package/upgrades/1.3.503.md

@@ -0,0 +1,61 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+WS1.3 of the converged multi-machine-seamlessness spec. A topic transfer could leave
+pin and ownership permanently disagreeing (2026-06-12 live incident: owner=Mini /
+pin=Laptop stuck for hours; re-placement waited on an inbound message that delivery
+never routed; the closeout reaper attacked the working session throughout). Now:
+
+- New `OwnershipReconciler` (per-machine tick over LOCAL state): cooperative
+  transfer→claim convergence while the owner lives (flap debounce + bounded safe
+  point), adoption of unowned pinned topics, and `force-claim` ONLY with owner-death
+  evidence (offline + last-seen past the bound) AND quorum membership — a
+  reachable-but-slow owner is never stolen from. Phase-C-ready: quorum is
+  majority-of-N from day one (2-machine pools degrade explicitly to
+  surviving-machine-vs-provably-dark-peer).
+- FSM gains the fenced `force-claim` action (epoch takeover the stale owner cannot
+  override; rejects self-claims and missing records).
+- `GET /pool/placement` now surfaces `pendingReplacement` + `pendingSince` — a
+  half-moved topic is an honest first-class state.
+- SessionReaper's post-transfer closeout HOLDS (audited once per episode) when the
+  topic's pin names this machine — never again attacking the session a transfer-back
+  is bringing home.
+- Journal `PlacementReason` gains `'reconcile'` (additive).
+
+Ships DARK: `multiMachine.seamlessness.ws13Reconcile: false` + `ws13DryRun: true`
+(rehearsal mode logs intended actions without CAS). Single-machine agents: strict
+no-op inside the module, tested.
+
+## What to Tell Your User
+
+- "Moving a conversation between my machines now always finishes — and if a move is
+  mid-flight you can see that honestly ('pending move since…') instead of the system
+  quietly disagreeing with itself. A machine that dies mid-move gets its
+  conversations recovered by the survivors, with proof-of-death required so a
+  merely-slow machine never gets robbed."
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Bounded pin/owner convergence | Enable `multiMachine.seamlessness.ws13Reconcile` (dry-run first via `ws13DryRun`) |
+| Honest half-moved state | `GET /pool/placement?topic=N` → `pendingReplacement`, `pendingSince` |
+
+## Evidence
+
+- `tests/unit/OwnershipReconciler.test.ts` — 15 tests: FSM force-claim fencing (incl.
+  the clock-proof stale-owner rejection), cooperative convergence reproducing the
+  exact 13481 incident, flap debounce, bounded safe point, death-evidence + quorum
+  requirements (a live owner is NEVER force-claimed; minority partitions never act),
+  the exactly-one-owner invariant across 3 simulated machines, dry-run inertness,
+  single-machine strict no-op.
+- `tests/integration/pool-placement-transfer-routes.test.ts` — +2: pendingReplacement
+  true/false with pendingSince presence.
+- Affected suites green (placement/transfer routes 19/19, dark-gate lint, ratchet);
+  `tsc --noEmit` clean; full build green.
+- Side-effects artifact `upgrades/side-effects/multi-machine-seamlessness-ws13.md`
+  with REQUIRED independent second-pass audit (ownership lifecycle + reaper surface).

package/upgrades/side-effects/multi-machine-seamlessness-ws13.md

@@ -0,0 +1,122 @@
+# Side-Effects Review — WS1.3 ownership reconcile + honest pending state
+
+**Spec:** docs/specs/MULTI-MACHINE-SEAMLESSNESS-SPEC.md §WS1.3 (converged + approved, on main)
+**Change:** (1) FSM gains `force-claim` (fenced epoch takeover; caller-validated death
+evidence; rejects self-claim and missing records); (2) new `OwnershipReconciler` —
+per-machine tick that converges pin/owner divergence: cooperative transfer→claim while
+the owner lives (flap debounce + bounded safe point), adoption of unowned pinned
+topics, force-claim ONLY with owner-death evidence (offline + last-seen past bound) AND
+quorum membership; (3) `GET /pool/placement` surfaces `pendingReplacement` +
+`pendingSince`; (4) SessionReaper closeout holds (do-not-act, audited once per episode)
+when the topic's pin names THIS machine — the divergence is reconciling toward us;
+(5) journal `PlacementReason` gains `'reconcile'` (additive); (6) dark flags
+`multiMachine.seamlessness.ws13Reconcile` (false) + `ws13DryRun` (true) + `ws13TickMs`.
+
+## 1. Over-block
+The reconciler never blocks user actions. The closeout hold is the inverse of a block:
+it STOPS an aggressive kill (the 2026-06-12 incident: 2-minute swings at a working
+session for hours). Risk inverted: could the hold protect a session that genuinely
+should close? Only when a pin actively names this machine — a deliberate, operator-set
+state — and it self-clears the moment the pin converges or moves. The hold cannot leak
+to unpinned topics.
+
+## 2. Under-block
+- Force-claim evidence is heartbeat-derived (capacity view). A partitioned-but-alive
+  owner that cannot heartbeat LOOKS dead after the bound; force-claim then fences it
+  out. This is the designed direction (the lease has the same property — clock-proof
+  epochs mean the returning machine cannot double-run; it observes the higher epoch
+  and stands down), and quorum membership prevents the minority side from acting.
+- The cooperative path's CAS can lose races indefinitely under pathological churn;
+  each tick re-evaluates — bounded per tick, eventually consistent, never spinning
+  (one action attempt per topic per tick).
+
+## 3. Level-of-abstraction fit
+The FSM stays pure (sequencing + epochs); evidence/quorum live in the reconciler;
+surfaces stay read-only. Matches the existing place/claim/transfer architecture —
+no parallel ownership mechanism.
+
+## 4. Signal vs authority compliance
+The reconciler holds narrow, evidence-gated authority over ownership RECORDS (not
+messages, not sessions, not user actions) — the same authority class as the existing
+router placement, sharing its CAS arbiter. Force-claim's brittle half (the death
+bound) is fenced by the quorum check and the epoch CAS: a wrong call cannot double-run
+(stale owner is fenced) and cannot orphan (the record stays active under the claimer).
+The closeout hold removes authority rather than adding it. Dry-run default ships the
+whole engine observe-only.
+
+## 5. Interactions
+- The router's own place/claim on inbound messages composes: both go through the same
+  CAS; a reconciler action and a router action race safely (one wins, the loser
+  re-evaluates).
+- The transfer route's existing place-half (quiet-topic repair) is untouched; the
+  reconciler covers the ACTIVE-record case that path deliberately refuses.
+- The closeout's genuine-move path is unchanged for unpinned/pin-elsewhere topics;
+  the -1 sentinel resets cleanly so a future genuine move dwells normally.
+- The cas-pairing discipline (§3.3) holds: every landed reconciler CAS emits a
+  journal placement entry with the new 'reconcile' reason (additive; old readers
+  ignore unknown reasons per the journal's forward-compat contract).
+- WS3's SpeakerElection reads ownership via the same registry — faster convergence
+  directly improves one-voice accuracy. No new coupling.
+
+## 6. External surfaces
+`pendingReplacement`/`pendingSince` on an existing authenticated route. No new mesh
+verbs: force-claim is NOT remotely invokable — each machine force-claims only for
+itself, locally, with its own evidence (L15: a peer cannot drive a takeover).
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+**This IS the multi-machine feature.** Reconciler: per-machine by design — each
+machine reconciles its own pin view against the shared CAS registry (the arbiter).
+Pin stores are machine-local router-write-only by design (provenance). The
+pendingReplacement surface is proxied-on-read via the existing holder-proxy on
+/pool/placement. Phase C: quorum is N-machine from day one (online > total/2; the
+2-machine degradation to surviving-machine-vs-provably-dark-peer is explicit and
+documented because majority-of-2 cannot lose a member); no LAN assumption (all reads
+local/replicated; evidence from the heartbeat registry that already works over the
+public internet); no per-machine interactive steps (headless-VM compatible).
+
+## 8. Rollback cost
+Flag-flip (`ws13Reconcile: false` — the default) stops the engine instantly (read
+live per tick). Records already converged by the reconciler are ordinary valid
+ownership records — no data rollback. The closeout hold de-activates with no pin
+conflicts present. PlacementReason 'reconcile' entries are inert history.
+
+## Second-pass review
+REQUIRED (ownership lifecycle + reaper surface). Independent reviewer response
+appended below.
+
+<!-- second-pass reviewer response appended below by the independent reviewer -->
+
+---
+
+## Second-pass reviewer response (independent subagent, 2026-06-12)
+
+**Concern raised: the journal validator silently drops every `'reconcile'` placement entry — the §3.3 CAS-pairing the artifact (§5) and the OwnershipReconciler doc-comment both claim never actually lands.**
+
+Code evidence: `src/core/CoherenceJournal.ts:591` — the `topic-placement` validator hardcodes its accepted reasons (`['user-move','placed','failover','released','quota-block-move']`); `'reconcile'` was absent. Only the `PlacementReason` TYPE was extended; the annotation `: PlacementReason[]` compiles because a subset of the union is type-legal, so the gap is silent at build time. `validate()` runs on the LOCAL emit path, so the entry is rejected at the source (counted only as `degradation.schemaRejects`). No test caught it because the reconciler unit tests assert against a FAKE emitPlacement and the integration cases only cover the route. Impact: every landed reconciler CAS would have produced NO durable placement evidence — falsifying artifact §5 and the §3.3 pairing invariant.
+
+The reviewer's verification notes on everything else (all confirmed, no further concerns):
+
+1. **Force-claim can NOT fire against a reachable-but-slow owner** — the gate requires `!online` AND last-seen past the 180s bound AND quorum; a slow-but-online owner falls to `deferredNoEvidence`. Dark + dry-run defaults verified at the wiring (`ws13Reconcile === true` gate; dry-run unless explicitly false; `act()` returns without CAS in dry-run).
+2. **No two-active-owner / no-owner race** — the CAS store accepts only strictly-monotonic epochs; reconciler and router compute epoch+1 from the same observed record, the loser re-evaluates; release-during-transferring was already rejected by the FSM.
+3. **The -1 closeout sentinel cannot leak to an unpinned topic and never permanently blocks a genuine move** — hold requires `otherOwner && pinnedHere`; convergence resets -1→0; a direct held→genuine-move transition costs one extra dwell tick (recovers; slightly imprecise in §5's "resets cleanly" but not a defect).
+4. **Tick loop bounded; no spin/flood; no unbounded memory** — one act per topic per tick; `conflictSince` deleted on convergence and on landed CAS; `isTopicBusy` is a sound conservative signal because the 120s `pastDeadline` bound guarantees progress.
+5. **Phase C quorum matches the artifact exactly** — `online * 2 > machines.length` for N>2 with the documented ≤2 degradation.
+
+## Fix addendum (same change, before commit)
+
+The reviewer's concern is fixed in this same PR: `'reconcile'` added to the runtime
+allowlist (`CoherenceJournal.ts`, with a KEEP-IN-SYNC comment naming this exact
+failure shape), plus the missing semantic-correctness test — the REAL
+`CoherenceJournal` accepts `reason:'reconcile'` with zero schemaRejects and the
+persisted entry carries the reason (`tests/unit/CoherenceJournal.test.ts`), proven
+failing with the allowlist fix reverted and passing with it. Reviewer re-verification
+of the fix appended below.
+
+## Reviewer re-verification of the fix (same independent reviewer, 2026-06-12)
+
+Fix verified — concern resolved. Concur with the review.
+
+Notes:
+1. The runtime allowlist now includes `'reconcile'` and carries a KEEP-IN-SYNC comment that names the exact failure shape — a type-legal subset silently schema-rejecting at the source. This addresses the structural root, not just the symptom.
+2. The new test drives the REAL `CoherenceJournal` (no mock) and verifies both the zero-`schemaRejects`-delta AND the persisted-on-disk `data.reason === 'reconcile'`, genuinely exercising the validator and serialization path — the correct semantic-correctness coverage for reconciler-driven CAS journal pairing.
+3. Full suite green: 39/39 pass.