instar 1.3.502 → 1.3.504

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.502",
+  "version": "1.3.504",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-12T23:24:48.391Z",
-  "instarVersion": "1.3.502",
+  "generatedAt": "2026-06-13T00:56:20.626Z",
+  "instarVersion": "1.3.504",
   "entryCount": 201,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "39d98955af3cfd4dbc4829319072dbdcb246cc89f01551b915501bcb8fdb86b1",
+      "contentHash": "309975f149d03b77f16cae7c41f8ea1e3ab68d14476db02d5feb305537215521",
       "since": "2025-01-01"
     },
     "cli:init": {

package/upgrades/1.3.503.md

@@ -0,0 +1,61 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+WS1.3 of the converged multi-machine-seamlessness spec. A topic transfer could leave
+pin and ownership permanently disagreeing (2026-06-12 live incident: owner=Mini /
+pin=Laptop stuck for hours; re-placement waited on an inbound message that delivery
+never routed; the closeout reaper attacked the working session throughout). Now:
+
+- New `OwnershipReconciler` (per-machine tick over LOCAL state): cooperative
+  transfer→claim convergence while the owner lives (flap debounce + bounded safe
+  point), adoption of unowned pinned topics, and `force-claim` ONLY with owner-death
+  evidence (offline + last-seen past the bound) AND quorum membership — a
+  reachable-but-slow owner is never stolen from. Phase-C-ready: quorum is
+  majority-of-N from day one (2-machine pools degrade explicitly to
+  surviving-machine-vs-provably-dark-peer).
+- FSM gains the fenced `force-claim` action (epoch takeover the stale owner cannot
+  override; rejects self-claims and missing records).
+- `GET /pool/placement` now surfaces `pendingReplacement` + `pendingSince` — a
+  half-moved topic is an honest first-class state.
+- SessionReaper's post-transfer closeout HOLDS (audited once per episode) when the
+  topic's pin names this machine — never again attacking the session a transfer-back
+  is bringing home.
+- Journal `PlacementReason` gains `'reconcile'` (additive).
+
+Ships DARK: `multiMachine.seamlessness.ws13Reconcile: false` + `ws13DryRun: true`
+(rehearsal mode logs intended actions without CAS). Single-machine agents: strict
+no-op inside the module, tested.
+
+## What to Tell Your User
+
+- "Moving a conversation between my machines now always finishes — and if a move is
+  mid-flight you can see that honestly ('pending move since…') instead of the system
+  quietly disagreeing with itself. A machine that dies mid-move gets its
+  conversations recovered by the survivors, with proof-of-death required so a
+  merely-slow machine never gets robbed."
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Bounded pin/owner convergence | Enable `multiMachine.seamlessness.ws13Reconcile` (dry-run first via `ws13DryRun`) |
+| Honest half-moved state | `GET /pool/placement?topic=N` → `pendingReplacement`, `pendingSince` |
+
+## Evidence
+
+- `tests/unit/OwnershipReconciler.test.ts` — 15 tests: FSM force-claim fencing (incl.
+  the clock-proof stale-owner rejection), cooperative convergence reproducing the
+  exact 13481 incident, flap debounce, bounded safe point, death-evidence + quorum
+  requirements (a live owner is NEVER force-claimed; minority partitions never act),
+  the exactly-one-owner invariant across 3 simulated machines, dry-run inertness,
+  single-machine strict no-op.
+- `tests/integration/pool-placement-transfer-routes.test.ts` — +2: pendingReplacement
+  true/false with pendingSince presence.
+- Affected suites green (placement/transfer routes 19/19, dark-gate lint, ratchet);
+  `tsc --noEmit` clean; full build green.
+- Side-effects artifact `upgrades/side-effects/multi-machine-seamlessness-ws13.md`
+  with REQUIRED independent second-pass audit (ownership lifecycle + reaper surface).

package/upgrades/1.3.504.md

@@ -0,0 +1,51 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+WS1.1 of the converged multi-machine-seamlessness spec — the pieces the durable-queue
+merge (#1079, which already shipped the receiver half) did not cover:
+
+- **Drain spawn-boundary ownership re-check**: ownership moving between route()'s
+  verdict and the spawn produced the F20 double-spawn; a non-owner spawn now bounces
+  to `un-routable ('ownership-moved-before-spawn')` and re-queues for re-routing.
+- **`MachineCapacity.seamlessnessFlags`** (spec invariant 5): bounded fixed-size
+  capability advertisement (`ws11DeliverReceive`) on the authenticated heartbeat,
+  live-only (a dark queue withdraws it next heartbeat). Absent = non-participant.
+- **Sender-side skew gate** (`SessionRouter.ownerSupportsForward`): a live owner not
+  advertising durable receive is never forwarded to — the 501→retry→failover path
+  would STEAL the conversation from a healthy machine. Messages wait in the durable
+  queue, self-healing on the owner's upgrade. Unknown/absent → exactly today's
+  behavior.
+
+Inert without the pool/queue layer (ships dark). Phase-C clean: fixed-size
+advertisement, O(1) local reads, no LAN or interactive assumptions.
+
+## What to Tell Your User
+
+- "When my conversations move between machines, three new guards make the handoff
+  airtight: no duplicate sessions from mid-move races, machines only receive
+  forwarded messages they can durably accept, and a machine that's merely behind on
+  updates never gets its conversations taken away — messages just wait safely until
+  it catches up."
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Capability-gated cross-machine delivery | Automatic within the multi-machine layer (dark until enabled) |
+
+## Evidence
+
+- `tests/unit/SessionRouter.test.ts` +4: the skew gate's full decision table (true →
+  forward; false → queue, NO deliver, NO cas-steal; null/absent → back-compat).
+- `tests/unit/ws11-dispatch-to-owner-wiring.test.ts` — 6: flags heartbeat roundtrip
+  incl. live-only withdrawal; the drain re-check seam + its exact placement (after
+  direct-inject, before spawn) pinned by source indices.
+- 163 tests green across the queue/router/handler suites; tsc clean; build green.
+- Independent second-pass audit (mandatory — dispatch + ownership surface): CONCUR,
+  6 verification notes, zero concerns — including proof the gate cannot lose a
+  message (refused-queue falls through to delivery, never a drop) and never marks a
+  flag-gated owner suspect. `upgrades/side-effects/multi-machine-seamlessness-ws11.md`.

package/upgrades/side-effects/multi-machine-seamlessness-ws11.md

@@ -0,0 +1,105 @@
+# Side-Effects Review — WS1.1 dispatch-to-owner (the remaining pieces)
+
+**Spec:** docs/specs/MULTI-MACHINE-SEAMLESSNESS-SPEC.md §WS1.1 (converged + approved, on main)
+**Ground truth discovered during build:** the durable-queue merge (#1079) ALREADY
+shipped WS1.1's receiver half — `createDeliverMessageHandler` (epoch fencing, durable
+remote receipts via the queue store + message ledger, sender re-validation, the
+owner-side accept bridge with working-set + topic-profile pulls) — and the router's
+forward/queue verdicts. This change ships ONLY what was genuinely missing:
+
+1. **Drain spawn-boundary ownership re-check** (`_ownershipReadForDrain`): route()'s
+   verdict and the spawn are not atomic — ownership moving in that window produced
+   the F20 double-spawn. A non-owner spawn now bounces to `un-routable
+   ('ownership-moved-before-spawn')`; the entry re-queues and the next drain pass
+   re-routes against fresh ownership. Direct-inject into an EXISTING live local
+   session is deliberately not gated (a live local session is the strongest
+   local-serving signal; its lifecycle belongs to the reconciler/closeout).
+2. **`MachineCapacity.seamlessnessFlags` advertisement** (invariant 5): a bounded
+   fixed-size summary (`ws11DeliverReceive`) self-reported each heartbeat from the
+   LIVE queue handle; registry passthrough is live-observation-only (a peer going
+   dark withdraws the capability — the safe direction). Absent = pre-spec peer or
+   dark feature = non-participant.
+3. **Sender-side skew gate** (`SessionRouter.ownerSupportsForward`): a LIVE owner
+   that does not advertise durable receive is never forwarded to — the forward would
+   501 → retry → failover-STEAL from a live machine (the worst skew outcome). The
+   message waits in OUR durable queue (`'owner-lacks-ws11-receive'`), bounded by the
+   queue's own shelf life and self-healing on the owner's next heartbeat after
+   upgrade. Unknown (null) and absent-dep both preserve today's exact behavior.
+
+## 1. Over-block
+The skew gate can hold messages for a live-but-unflagged owner. Bounds: the queue's
+existing shelf-life/loss-reporting (never silent), the flags flipping true on the
+owner's next heartbeat after its queue enables, and ownership genuinely moving. The
+alternative (forward → 501 → failover steal) takes a conversation from a healthy
+machine — strictly worse. Unknown-capability peers are NOT held (null → forward),
+so the gate cannot over-trigger from a missing signal.
+
+## 2. Under-block
+The drain re-check is a point-read — ownership can still move between the re-check
+and the spawn completing (a narrower TOCTOU). The receipt + ledger dedup bound the
+damage to one extra session at worst, which the post-transfer closeout reaps; full
+elimination belongs to WS1.2's drain barrier. Named honestly, not silently claimed.
+
+## 3. Level-of-abstraction fit
+Each piece sits at its owning layer: the re-check at the spawn boundary (the only
+place the race exists), the flags on the existing heartbeat carrier (no new channel),
+the gate in the router's dispatch decision (beside isMachineAlive, the analogous
+check). No parallel mechanisms.
+
+## 4. Signal vs authority compliance
+The skew gate holds narrow custody authority (queue vs forward) over a deterministic
+signal (the peer's own self-advertisement on an authenticated heartbeat) and fails
+open to today's behavior on unknown. The drain re-check removes a wrong action
+(non-owner spawn) rather than adding authority. No message content, no user actions.
+
+## 5. Interactions
+- Composes with the queue's hold-for-stability: a gated message is an ordinary queued
+  entry (same caps, same loss reporting, same drain re-routing).
+- The existing receiver handler is untouched; the gate only prevents doomed sends.
+- The reconciler (WS1.3, in CI) shortens how long ownership stays pointed at a
+  machine that can't serve — the two compose toward faster convergence.
+- OwnerSuspectBreaker semantics preserved: the gate fires BEFORE forwarding, so a
+  flag-gated owner is never marked suspect for a 501 it never got to return.
+
+## 6. External surfaces
+A new optional heartbeat field (additive; older peers ignore it — the established
+quotaState/guardPosture precedent). No new mesh verbs, no new routes.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+This IS the multi-machine correctness core. Flags: replicated via the authenticated
+heartbeat (named path), live-only by design. Gate + re-check: per-machine local
+reads only on hot paths (spec rule). Phase C: the advertisement is fixed-size
+regardless of pool size (never an inventory); the gate's per-owner read is O(1)
+against the local registry; nothing assumes 2 machines or a LAN; headless VMs
+advertise identically (no interactive step).
+
+## 8. Rollback cost
+All three pieces are inert without the pool/queue layer (which ships dark).
+Flag-flip rollback: disabling the queue withdraws the self-advertisement on the next
+heartbeat AND nulls `_inboundQueue` (the gate's information source degrades to
+null → today's behavior). The heartbeat field is additive data — no migration, no
+cleanup. Revert-and-release covers the code.
+
+## Second-pass review
+REQUIRED (inbound dispatch + ownership surface). Independent reviewer response
+appended below.
+
+<!-- second-pass reviewer response appended below by the independent reviewer -->
+
+### Independent second-pass review (2026-06-12)
+
+**Concur with the review.**
+
+1. **Skew gate never marks a flag-gated owner suspect — verified.** In `SessionRouter.dispatchOne` (SessionRouter.ts:241-245) the `supports === false` branch returns a `queued` outcome and early-exits BEFORE `forwardToOwner`. `markOwnerSuspect` is only reachable inside `forwardToOwner` (line 306) and the owner-dead branch (249); the queue path touches neither. `tests/unit/SessionRouter.test.ts:276` asserts both `deliver` and `cas` are NOT called on the false case, structurally proving the gate fires first and no steal/suspect occurs. The artifact's §5 claim is true.
+
+2. **Gate + queue cannot lose a message — verified safe.** When the gate fires and `queueMessage` returns `'refused'` (queue dark / storage fail), the router returns `acked: false`. At the ingress gate (server.ts:1970-1983) `isRemotelyHandled` is false and the custody short-circuit at 1978 requires `outcome.acked` true, so an un-acked `queued` falls through to local dispatch (line 2000+) — delivery, not a drop. This is exactly the spec's layered rule (invariant 5 line 96-97 "durable queue where available, else today's exact behavior"): the §3 queue path covers queue-available, the refused fall-through covers no-queue. The implementation satisfies BOTH the invariant-5 conservative-side clause and the §WS1.1 line-137 "local inject, never a drop" clause — no contradiction.
+
+3. **Drain re-check placement is correct — verified.** server.ts:2200-2205 runs AFTER `route()` (2142) and AFTER the direct-inject path (which returns at 2184/2186), only on the spawn path, guarded by `_ownershipReadForDrain && _meshSelfId` (null on a dark/single-machine agent → skipped, invariant 6). It cannot block direct-inject (that path already returned) and runs strictly after route()'s now-stale-able ownership consult — the only place the TOCTOU exists. `tests/unit/ws11-dispatch-to-owner-wiring.test.ts:60-66` pins this ordering via source indices.
+
+4. **`'un-routable'` re-queues, never drops — verified.** The new `ownership-moved-before-spawn` → `un-routable` disposition is handled in QueueDrainLoop.ts:731-736 via `releaseWithBackoff(row, attempts+1, …)` — release back to `queued` + backoff + attempts++, re-drained against fresh ownership next pass. The existing attempts-exhaustion path (648/661-663) reports loss loudly (`reportLoss`, terminal `attempts-exhausted`) rather than silently dropping — the bound is honest.
+
+5. **Live-only flags passthrough genuinely clears — verified at the registry.** `recordHeartbeat` REPLACES the whole `obs` (MachinePoolRegistry.ts:205), and `assemble` reads `seamlessnessFlags: live?.obs.seamlessnessFlags` (273) with NO `postureStore`-style durable fallback (unlike `guardPosture`, which deliberately carries forward at 200/277-285). A flags-less heartbeat therefore nulls the field — confirmed by the real-registry test at ws11-dispatch-to-owner-wiring.test.ts:40-45. Self-advertisement is `!!_inboundQueue` (server.ts:12656), so a dark queue withdraws the capability next beat — the safe direction.
+
+6. **"Receiver half already shipped" claim is true.** `createDeliverMessageHandler` (DeliverMessageHandler.ts:44-66) implements epoch fencing (50-53 → `stale-ownership`), sender re-validation BEFORE receipt (54-60 → `sender-rejected`), and idempotent durable receipt/dedupe (61-62 → `duplicate`). Wired at server.ts:12820-12844 with `ownerEpochOf`, `recordReceipt` (queue receipt + message ledger), and `validateSender` against THIS machine's UserManager. §2's residual-TOCTOU honesty holds — the point-read re-check narrows but does not eliminate the window; the receipt+ledger dedup bounds the damage to one extra session reaped by closeout, and full elimination is correctly deferred to WS1.2's drain barrier (not silently claimed as done).
+
+Both relevant unit files run green locally (33 tests passed). No claim in the artifact was found untrue in code.