instar 1.3.504 → 1.3.506

package/src/templates/scripts/telegram-reply.sh

@@ -38,8 +38,18 @@
 #   and every error path (server down, timeout, bad JSON) proceeds straight
 #   to the send as if the preflight returned nothing. Script-class senders
 #   (INSTAR_SENDER_CLASS=script) skip the preflight — there is no agent to
-#   inform. Conversational sessions have none of these env vars and are
-#   completely unaffected.
+#   inform.
+#
+#   Every OTHER sender (including a conversational session with no stamps —
+#   typically an interactive session running an autonomous job) also runs the
+#   preflight, with its real message kind defaulting to "reply". The server
+#   applies ONLY the TIME_CLAIM check to non-automated kinds — an
+#   elapsed/remaining claim contradicting the topic's live session clock
+#   (operator mandate 2026-06-12: accurate time reporting is structural, not
+#   willpower). Jargon/path/link detectors never run for conversational
+#   sends, and when the topic has no active time-boxed session the preflight
+#   returns nothing — conversational sends remain effectively unaffected.
+#   Same fail-open contract end-to-end.
 #
 # Port resolution (in order):
 #   1. INSTAR_PORT environment variable (explicit operator override).
@@ -180,7 +190,13 @@ esac
 JOB_SLUG=$(printf '%s' "${INSTAR_JOB_SLUG:-}" | tr -c 'A-Za-z0-9._-' '_' | head -c 128)
 
 ADVISORY_CODES_CSV=""
-if [ "$MESSAGE_KIND" = "automated" ] && [ "$SENDER_CLASS" = "llm-session" ]; then
+# Preflight gate: every sender EXCEPT script-class (no agent to inform).
+# automated+llm-session → full detector set server-side (unchanged);
+# anything else (incl. unstamped conversational sessions) → the server
+# applies only the TIME_CLAIM clock check, kind defaulting to "reply".
+# An older server returns no advisories for non-automated kinds — the new
+# gate is a no-op against it (version-skew safe both directions).
+if [ "$SENDER_CLASS" != "script" ]; then
   # Timeout: config messaging.outboundAdvisory.timeoutMs (default 2000ms),
   # converted ms→SECONDS for curl --max-time with ceil division, clamped to
   # [1, 10]. A raw `--max-time 2000` would be a ~33-minute fail-HANG and
@@ -194,11 +210,11 @@ if [ "$MESSAGE_KIND" = "automated" ] && [ "$SENDER_CLASS" = "llm-session" ]; the
 
   # Preflight body via python3 (already a hard dependency of this script). If
   # python3 is unavailable the preflight is skipped entirely — fail-open.
-  PREFLIGHT_BODY=$(PF_TOPIC="$TOPIC_ID" PF_SLUG="$JOB_SLUG" PF_KIND="$MESSAGE_KIND" python3 -c '
+  PREFLIGHT_BODY=$(PF_TOPIC="$TOPIC_ID" PF_SLUG="$JOB_SLUG" PF_KIND="${MESSAGE_KIND:-reply}" python3 -c '
 import sys, json, os
 print(json.dumps({
   "text": sys.stdin.read(),
-  "messageKind": os.environ.get("PF_KIND", "automated"),
+  "messageKind": os.environ.get("PF_KIND") or "reply",
   "topicId": int(os.environ.get("PF_TOPIC") or 0),
   "jobSlug": os.environ.get("PF_SLUG", ""),
 }))
@@ -252,7 +268,7 @@ for a in advisories:
       # was deliberately not yet sent and the next move belongs to the agent.
       echo "NOT SENT — advisory (fix and re-run, or re-run with --ack-advisory to send unchanged)"
       echo ""
-      echo "The outbound advisory flagged this automated message BEFORE delivery:"
+      echo "The outbound advisory flagged this outbound message BEFORE delivery:"
       printf '%s\n' "$ADVISORY_DETAIL"
       echo ""
       echo "Next move (yours — the advisory layer never blocks):"
@@ -269,7 +285,7 @@ fi
 # component is enum-validated or charset-clamped above, so this fragment is
 # safe to interpolate into JSON and (parameterized) SQL contexts.
 METADATA_JSON=""
-if [ -n "$MESSAGE_KIND" ] || [ -n "$SENDER_CLASS" ] || [ -n "$JOB_SLUG" ]; then
+if [ -n "$MESSAGE_KIND" ] || [ -n "$SENDER_CLASS" ] || [ -n "$JOB_SLUG" ] || { [ "$ACK_ADVISORY" = "1" ] && [ "$SENDER_CLASS" != "script" ]; }; then
   META_PARTS=""
   [ -n "$MESSAGE_KIND" ] && META_PARTS="\"messageKind\":\"${MESSAGE_KIND}\""
   if [ -n "$SENDER_CLASS" ]; then
@@ -280,7 +296,11 @@ if [ -n "$MESSAGE_KIND" ] || [ -n "$SENDER_CLASS" ] || [ -n "$JOB_SLUG" ]; then
     [ -n "$META_PARTS" ] && META_PARTS="${META_PARTS},"
     META_PARTS="${META_PARTS}\"jobSlug\":\"${JOB_SLUG}\""
   fi
-  if [ "$ACK_ADVISORY" = "1" ] && [ "$MESSAGE_KIND" = "automated" ] && [ "$SENDER_CLASS" = "llm-session" ]; then
+  # Ack annotation rides for EVERY non-script sender (not just automated):
+  # an unstamped interactive session's --ack-advisory must record 'acked'
+  # server-side, or its advised episodes never resolve and the escalation
+  # false-fires on messages that actually delivered (second-pass concern 2).
+  if [ "$ACK_ADVISORY" = "1" ] && [ "$SENDER_CLASS" != "script" ]; then
     # REQUIRED annotation (§2.4(4)) — how the server audits "acked" as the
     # single writer. Carries the overridden codes, including [] for a
     # preemptive ack on a clean message (itself a signal).

package/upgrades/1.3.505.md

@@ -0,0 +1,57 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+- **Post-transfer closeout P19 breaker (SessionReaper):** the closeout's veto-retry
+  loop is now bounded — after `monitoring.sessionReaper.topicMovedVetoBreakerAttempts`
+  (default 5) consecutive vetoed close attempts on the same session, retries stop for
+  the episode, a `closeout-breaker-open` row lands in sentinel-events.jsonl, and ONE
+  deduped attention item surfaces. The session still closes via the normal idle path
+  when its work finishes. Episode resets on success / topic-home / pin-conflict hold.
+- **Autonomous-run transfer consent gate (WS1.4):** `POST /pool/transfer` and the
+  natural-language "move this to <nickname>" now answer `needsConfirmation` when the
+  topic has a LIVE autonomous run on this machine — evaluated first among the consent
+  gates. A confirmed move (`"confirm":true`) suspends the run at its next turn
+  boundary via the new `suspendAutonomousTopicForMove`: `active: false` +
+  `moved_to`/`move_suspended_at` markers, ATOMIC rewrite (temp + fsync + rename), the
+  state file SURVIVES to ride the working-set carrier, and the journal `stopped` emit
+  re-fires the receiver's pull. Response reports `autonomousRunSuspended`.
+- CLAUDE.md template + PostUpdateMigrator migration so new AND deployed agents learn
+  the consent gate (Agent Awareness + Migration Parity).
+
+## What to Tell Your User
+
+Two multi-machine rough edges are gone. First: when a conversation moves between
+your machines, the old machine's cleanup can no longer get stuck hammering a session
+that's still finishing real work — it now backs off after a few refused attempts and
+sends you one clear notice instead of retrying silently for hours. Second: moving a
+topic that has an autonomous job running now asks you first ("there's a run in
+flight, ~N minutes remaining — move anyway?"), and if you say yes, the job is paused
+at a clean stopping point and its progress travels with the conversation to the new
+machine — nothing is lost mid-thought.
+
+## Summary of New Capabilities
+
+- The post-transfer closeout is bounded by a circuit breaker with one honest
+  operator notice per episode (tunable via
+  `monitoring.sessionReaper.topicMovedVetoBreakerAttempts`).
+- Topic transfers are autonomous-run-aware: consent before interrupting a run, clean
+  turn-boundary suspend on confirmation, and the run's state rides the working-set
+  carrier with atomic-write + hash-verified transport.
+
+## Evidence
+
+- `tests/unit/session-reaper-topic-moved.test.ts` +5 (14 total): the spec's required
+  sustained-failure test (permanently-vetoing session → exactly N attempts + ONE
+  escalation with stable dedupe id), episode reset on topic-home, success-clears-
+  counter, pin-conflict clears counter, absent-dep audit-only.
+- `tests/unit/TransferByNickname.test.ts` +4 (17 total): veto prompt content,
+  precedence over offline/mid-reply, idempotency-noop stays ahead, backward compat.
+- `tests/unit/AutonomousSessions.test.ts` +4 (17 total): file survives with markers,
+  idempotent re-suspend, no-run no-op, journal stopped emit with artifact path.
+- PostUpdateMigrator suite 416 green; `tsc --noEmit` clean; build green.
+- Independent second-pass review (reaper kill loop + transfer dispatch surface) —
+  verdict appended to `upgrades/side-effects/multi-machine-seamlessness-ws12-ws14.md`.

package/upgrades/1.3.506.md

@@ -0,0 +1,63 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+- **New `TIME_CLAIM` advisory code in the outbound preflight** (`POST /messaging/preflight`):
+  when the sending topic has an ACTIVE time-boxed (autonomous) session, anchored
+  elapsed/remaining/percent claims in the candidate text ("~7h elapsed", "2h 40m left",
+  "8% through") are verified against the live session clock (`readSessionClocks`).
+  A claim contradicting the clock beyond tolerance (max(15 min, 20%) for durations,
+  15 points for percent) returns a TIME_CLAIM advisory → the relay script's standard
+  NOT-SENT loop (fix and re-run, or `--ack-advisory`). Pure deterministic detector at
+  `src/core/time-claim.ts`; quoted claims (a correction citing the wrong number) and
+  unanchored durations never match.
+- **The relay preflight now covers unstamped senders** (`telegram-reply.sh` template):
+  every non-script sender runs the preflight — an interactive session running an
+  autonomous run (exactly the founding mis-report path) defaults to kind `reply`,
+  where the server applies ONLY the clock check (jargon/path/link detectors still
+  never run for conversational sends; no active clock → no advisories). Fail-open
+  end-to-end, version-skew safe in both directions. Prior shipped template SHA added
+  to `TELEGRAM_REPLY_PRIOR_SHIPPED_SHAS` so deployed stock scripts auto-upgrade.
+- **Ships dark behind the development-agent gate** at
+  `messaging.outboundAdvisory.timeClaim.enabled` (registered in `DEV_GATED_FEATURES`);
+  master advisory off-switch (`messaging.outboundAdvisory.enabled`) still wins.
+- CLAUDE.md template + PostUpdateMigrator bullet-insert migration so new AND deployed
+  agents learn the TIME_CLAIM rule (Agent Awareness + Migration Parity).
+
+## What to Tell Your User
+
+When I'm running a long autonomous job for you, my progress reports state how long
+I've been running and how much time is left. Previously I could (and once did) guess
+those numbers wrong — saying "7 hours in" when the run was 1.5 hours old. Now there's
+a structural check: before a report reaches you, any time claim in it is compared
+against the run's real clock, and a wrong number stops the message until I correct it.
+You'll simply notice that the times in my reports are right.
+
+## Summary of New Capabilities
+
+- Time claims in outbound messages are verified against the live session clock
+  before delivery (TIME_CLAIM advisory; dark by default, dev-agents live, fleet flip
+  via `messaging.outboundAdvisory.timeClaim.enabled: true`).
+- The outbound advisory preflight now also covers interactive sessions running
+  autonomous jobs — the clock check only; conversational text gets no new friction.
+
+## Evidence
+
+- `tests/unit/time-claim.test.ts` (15 new): extraction decision table (anchored,
+  composites, minutes-only, percent), both sides of every tolerance boundary, the
+  founding incident shape fires, quoted-claim and future-tense "in 2 hours" never
+  match, unbounded-run skip, lenient multi-clock.
+- `tests/unit/outbound-advisory-routes.test.ts` +8: automated + reply kinds fire,
+  reply kind runs ONLY the clock check, accurate report passes, inactive run never
+  fires, dev-gate dark-on-fleet / explicit-enable / force-dark, audit row keyed
+  `interactive-session`.
+- `tests/unit/telegram-reply-advisory-script.test.ts` +1/±2: unstamped sender NOT-SENT
+  loop, preflight kind degrades to `reply` under an injection-shaped kind env,
+  script-class senders still skip.
+- `tests/e2e/outbound-advisory-alive.test.ts` +1: TIME_CLAIM alive on the production
+  init path (explicit-enable fires; dark by default on a non-dev config).
+- `tests/unit/devGatedFeatures-wiring.test.ts` auto-covers the new registry entry
+  (live-on-dev / dark-on-fleet, both sides). `tsc --noEmit` clean.

package/upgrades/side-effects/multi-machine-seamlessness-ws12-ws14.md

@@ -0,0 +1,197 @@
+# Side-Effects Review — WS1.2 closeout P19 breaker + WS1.4 autonomous-run transfer guard
+
+**Spec:** docs/specs/MULTI-MACHINE-SEAMLESSNESS-SPEC.md §WS1.2 (closeout coupling + P19
+foundation patch) + §WS1.4 (autonomous runs survive or veto topic moves)
+**Build order position:** step 5's first slice. This change ships the two pieces that
+are complete WITHOUT the drain mesh verb; the drain verb + barrier + terminal
+semantics are the next item in this same workstream's build order (spec §WS1.2 lines
+141–172) and extend — never rework — what ships here.
+
+What ships:
+
+1. **Closeout P19 breaker (SessionReaper):** the post-transfer closeout's veto-retry
+   loop was unbounded — the 2026-06-12 incident was this exact loop attacking a
+   working session every 2 minutes for hours. Now: after
+   `topicMovedVetoBreakerAttempts` (default 5) CONSECUTIVE vetoed terminate attempts
+   on the same session, retries STOP for the episode, one `closeout-breaker-open`
+   audit row lands in sentinel-events.jsonl, and ONE deduped attention item surfaces
+   ("topic moved to X but the old session won't close — held by Y"). The session is
+   NOT stranded: the idle pipeline still evaluates it every tick and reaps it when
+   its work actually finishes. Episode resets on success / topic-home /
+   pin-conflict hold / session end.
+2. **WS1.4 transfer-time veto (planTransferByNickname):** a LIVE local autonomous run
+   on the topic → `confirm-required` (`detail: 'autonomous-run-in-flight'`),
+   evaluated FIRST among the consent gates (spec precedence: the veto fires at
+   transfer-request time, before any move mechanics). Wired into BOTH callers:
+   POST /pool/transfer (confirm:true consents) and the NL "move this to <nick>" arm
+   (prompts conversationally; the confirmed move arrives via the API).
+3. **WS1.4 confirmed move → turn-boundary suspend (suspendAutonomousTopicForMove):**
+   distinct from stop in exactly one way — the state file SURVIVES to ride the
+   working-set carrier. `active: false` releases the stop hook at the run's next
+   turn boundary; `moved_to` + `move_suspended_at` markers are the honest
+   breadcrumb; the rewrite is ATOMIC (same-dir temp + fsync + rename) so the carrier
+   can never ship a half-rewritten file; the journal `stopped` emit is what re-fires
+   the receiving machine's working-set pull (WorkingSetManifest §3.4). Stated
+   outright: NOTHING auto-resumes the run on the receiving machine — the carried
+   file lands `active: false` with its markers, and resuming is a deliberate act
+   (the operator's or a future workstream's). The spec's receiving-side schema
+   gate applies when auto-resume exists; transport integrity (hash-verified
+   assembly, torn-chunk refusal, never-clobber) is already enforced by the
+   carrier today.
+
+**Second-pass fixes folded in (2026-06-13, before merge):** the independent review
+below caught two real defects in the WS1.4 half as first built — (1) a stacked-gate
+consent collapse: `confirm:true` after the autonomous-run prompt would silently
+consent to an offline target the user was never shown (the veto's higher precedence
+suppressed the offline prompt). Fixed at the planner: ALL live consent conditions
+now stack into ONE prompt with a '+'-joined `detail`, the route no longer suppresses
+the gate on confirm (the full chain re-evaluates), and the 409 echoes `detail`.
+(2) a silent false-success: the suspend's `active: true` flip regex was stricter
+than the reader's quote-tolerant parse, so a quoted-active file would be reported
+`suspended: true` while the run stayed live. Fixed: reader-aligned tolerant flip +
+a post-flip verification gate that returns `suspended: false` (and emits nothing)
+when the flip did not land; an inactive file with no move markers is an honest
+no-op. Both fixes carry dedicated tests.
+
+## 1. Over-block
+The veto requires confirmation for EVERY move off a topic with a live run — including
+a move the operator urgently wants. Bounded: one extra round-trip (`confirm:true`),
+and the prompt carries goal + remaining time so the consent is informed
+(context-before-consent, P8). The breaker stops closeout retries while a session
+still SHOULD close — bounded by the idle pipeline still owning the session (it reaps
+on actual completion) and by the attention item handing the operator the manual
+lever. The idempotency no-op stays AHEAD of the veto, so "already there" never asks.
+
+## 2. Under-block
+The veto and the suspend read THIS machine's run registry (the state-file directory)
+— a run living on a REMOTE owner (holder ≠ owner under the active-active pool) is
+not seen, because the holder can neither see nor suspend a remote machine's run
+without a drain signal; that is precisely the WS1.2 drain mesh verb's job (next item
+in this workstream, spec §WS1.2 "drain authorization"), and today's production
+topology (one-awake-machine; the run lives where the transfer executes) is fully
+covered. The breaker counts only REAL vetoed terminate calls — budget-exhausted
+ticks don't increment, so a busy reap hour cannot open the breaker spuriously.
+
+## 3. Level-of-abstraction fit
+The breaker lives inside the loop it bounds (P19's "in-component" rule). The veto is
+a planner consent gate exactly beside the two existing ones (offline / mid-reply) —
+no parallel mechanism. The suspend is a sibling of stopAutonomousTopic in the run
+registry's own module, not route-inline logic. The carrier integrity story reuses
+the EXISTING working-set machinery (manifest sha256, served-bytes assembly hash,
+fstat tear detection, never-clobber landing, liveSource re-fire on `stopped`) —
+nothing re-implemented.
+
+## 4. Signal vs authority compliance
+The breaker REMOVES authority (stops retrying a kill) on a deterministic counter and
+escalates to the operator — the safe direction. The veto converts an implicit move
+into explicit operator consent; it never blocks (confirm proceeds). The suspend acts
+only on the operator's confirmed instruction, and the run's own stop hook remains
+the enforcement authority (`active: false` is the hook's existing contract, not a
+new kill path). No message content is inspected anywhere.
+
+## 5. Interactions
+- Breaker × pin-conflict hold (WS1.3): the hold withdraws the closeout intent and
+  CLEARS the veto counter — a post-reconcile genuine move starts a fresh episode.
+- Breaker × idle pipeline: a breaker-open session falls through to the idle
+  evaluation the same tick (verified: only a successful terminate `continue`s).
+- Breaker × attention queue: keyed `closeout-breaker:<session>` — the store dedupes
+  on id (P17), which makes the dedupe per SESSION LIFETIME, not per episode: a
+  second breaker episode for the same still-running session re-raises the same id
+  and is swallowed even if the first item was resolved. The per-episode audit row
+  still lands; acceptable, named honestly (reviewer correction).
+- Veto × confirm flow: a consented call cannot loop on its own prompt — the route
+  proceeds past `confirm-required` when `confirm:true` — and because the planner
+  stacks every live condition into the one prompt the caller saw, a confirm can
+  never consent to an unseen condition (second-pass fix).
+- Suspend × journal scanner: emitStopped runs BEFORE the rewrite so the runId keys
+  on the live startedAt — op-key dedupe with the scanner's observed-stopped holds.
+- Suspend × stop-all/emergency-stop: untouched — those still DELETE state (a stop is
+  not a move).
+- Suspend × pin/release ordering: suspend runs BEFORE pin+release so the re-fired
+  carrier pull reads the final, consistent file.
+
+## 6. External surfaces
+POST /pool/transfer gains a response field (`autonomousRunSuspended`) and a new
+confirm prompt — additive. The NL arm gains one conversational prompt. CLAUDE.md
+template + PostUpdateMigrator migration ship in this change (Agent Awareness +
+Migration Parity): new installs and deployed agents both learn the consent gate.
+No new mesh verbs, no protocol bump (that arrives with the drain verb).
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+The breaker is per-machine local state over local terminate attempts — no
+replication, no cross-machine reads on the reaper tick (spec hot-path rule). The
+veto/suspend read only the local run registry; the cross-machine arm rides the
+already-replicated coherence journal (`stopped` emit) and the existing carrier.
+Phase C: nothing here assumes 2 machines, a LAN, or interactivity — the breaker
+scales per-session O(1); the veto's registry read is one directory listing
+regardless of pool size; headless VMs run the identical path.
+
+## 8. Rollback cost
+Breaker: `topicMovedVetoBreakerAttempts` is plain config; setting it very high
+restores the old retry-forever behavior (and `topicMovedCloseout:false` disables the
+rule wholesale, as before). Veto/suspend: the planner dep is optional — reverting
+the two wiring sites restores pre-WS1.4 behavior byte-for-byte; a suspended state
+file is manually resumable (`active: true`, delete the markers). No data migration,
+no state repair. Revert-and-release covers all of it.
+
+## Second-pass review
+REQUIRED (session lifecycle: reaper kill loop + transfer dispatch). Independent
+reviewer response appended below.
+
+<!-- second-pass reviewer response appended below by the independent reviewer -->
+
+### Independent second-pass review — round 1 (2026-06-12)
+
+**Concern raised: confirm:true on the autonomous-run prompt silently consents to the
+offline-target gate the user never saw, and `suspendAutonomousTopicForMove` can
+report `suspended: true` while having suspended nothing.**
+
+Summary of the round-1 verdict (full notes in the review record): the WS1.2 breaker
+half was confirmed correct and well-tested without reservation (only-real-vetoes
+counting, exactly-once open/escalation, no-strand fall-through, all four episode
+resets, throw-proof attention wiring). The WS1.4 half had two real defects — (1) the
+stacked-gate consent collapse: the autonomous veto's early return suppressed the
+offline prompt, and the route's confirm:true suppression let a confirm consent to a
+condition the caller was never shown; (2) a latent silent false-success: the
+suspend's `active: true` flip regex was stricter than the quote-tolerant
+`readField`, so a quoted-active file would be reported suspended while the run
+stayed live. Plus two wording corrections: the breaker attention dedupe is per
+session lifetime (not per episode), and the artifact should state outright that
+nothing auto-resumes a carried run on the receiving machine. Both defects were
+fixed and both corrections folded into the artifact before commit (see "Second-pass
+fixes folded in" above).
+
+### Independent second-pass re-verification — round 2 (2026-06-12)
+
+**Concur — both fixes verified.**
+
+1. **Consent collapse FIXED.** All three consent conditions evaluate unconditionally
+   into one `consents` array with no early return between them
+   (TransferByNickname.ts:112-131); `detail` is the '+'-joined list and the prompt
+   joins every condition's sentence (:135-136); the triple-stack is test-pinned
+   (TransferByNickname.test.ts:139-151). The route passes `autonomousRunActive`
+   unconditionally (routes.ts:10609-10627), the only 409 branch requires
+   `confirm !== true` (:10638) so confirm:true falls through to execute (no loop),
+   the 409 echoes `detail` (:10641), and the holder-proxy forwards `confirm`
+   (:10564). The NL arm relays the stacked prompt for free (server.ts:14373-14375)
+   and never executes a confirm itself. Residual (non-blocking): the generic
+   prompt→confirm TOCTOU (a condition going live between the 409 and the retry) —
+   the `detail` echo is the natural hook for an `expectedDetail` handshake if that
+   window ever matters.
+2. **Suspend false-success FIXED — structurally, not regex-patched.** The post-flip
+   verification gate re-reads with the same `readField` the veto uses and returns
+   `{suspended:false}` with no emit and no write when the flip did not land
+   (AutonomousSessions.ts:213-217). Adversarial counterexample search (quoted,
+   unspaced, trailing-whitespace, CRLF, malformed-quote forms): every shape
+   `readField` accepts as 'true' is either flipped or caught by the gate; the only
+   constructed escape (duplicate active keys) is one where all readers already
+   treat the run as inactive — reader and suspend agree, no system-visible false
+   success. Idempotent re-suspend refreshes markers without emitting (:206-228,
+   :232); honest no-op and missing-file paths verified byte-identical/false; the
+   atomic same-dir temp + fsync + rename path is unchanged (:234-242).
+3. **Suite green, artifact accurate.** 51/51 across the three test files;
+   `tsc --noEmit` clean. The artifact records both fixes, the no-auto-resume
+   property, and the per-session-lifetime dedupe wording. The dedicated tests added
+   for both fixes would each have failed against the originally-reviewed code.
+
+No regressions found.

package/upgrades/side-effects/time-claim-advisory.md

@@ -0,0 +1,177 @@
+# Side-Effects Review — TIME_CLAIM outbound advisory (accurate time reporting)
+
+**Version / slug:** `time-claim-advisory`
+**Date:** `2026-06-12`
+**Author:** `Instar Agent (echo)`
+**Second-pass reviewer:** `independent reviewer subagent (verdict appended below)`
+
+## Summary of the change
+
+Adds a `TIME_CLAIM` advisory code to the inform-only outbound preflight: when the
+sending topic has an ACTIVE time-boxed (autonomous) session, anchored
+elapsed/remaining/percent claims in the candidate text are verified against the
+live session clock; a gross contradiction returns an advisory and the relay
+script's existing NOT-SENT loop holds the message until the sender fixes the
+number or acks. Files: `src/core/time-claim.ts` (new pure detector),
+`src/messaging/OutboundAdvisory.ts` (code + guidance + `composeTimeClaimAdvisories`),
+`src/server/routes.ts` (preflight route resolves active clocks; reply-kind sends get
+the clock check ONLY), `src/templates/scripts/telegram-reply.sh` (preflight gate
+widened from automated+llm-session to every non-script sender),
+`src/core/devGatedFeatures.ts` (dev-gate registry), `src/core/PostUpdateMigrator.ts`
+(prior-shipped template SHA + CLAUDE.md bullet migration), `src/scaffold/templates.ts`
+(Agent Awareness). Operator mandate: Justin, 2026-06-12 17:55 PDT, topic 13481.
+
+## Decision-point inventory
+
+- `POST /messaging/preflight` advisory composition — **modify** — adds the TIME_CLAIM
+  detector for automated kinds and makes it the ONLY detector for non-automated kinds.
+  Inform-only: the route returns advisories; it never blocks a send.
+- `telegram-reply.sh` preflight gate — **modify** — widens which senders consult the
+  preflight (every non-script sender). The script's existing NOT-SENT/ack loop is
+  unchanged; sender keeps final authority.
+- `recordPreflight` audit keying — **modify (pass-through shape)** — reply-kind rows
+  with no job slug are keyed `interactive-session` instead of empty string.
+
+---
+
+## 1. Over-block
+
+**What legitimate inputs does this reject that it shouldn't?**
+
+The advisory never rejects — worst case is a held message the sender must re-send or
+ack. The realistic false-hold shapes, and their mitigations:
+
+- A message quoting a WRONG time to correct it ("my '~7h elapsed' line was wrong"):
+  quoted-claim skip (chars `"'""''` + backtick immediately before the claim) — unit-tested.
+- Honest rounding ("about 2h" at 1h54m): tolerance is max(15 min, 20%) — unit-tested
+  on both sides.
+- Talk about OTHER durations ("the regression took 3h", "in 2 hours I'll check"):
+  extraction requires an explicit elapsed/remaining/percent anchor; future-tense
+  "in X hours" and "Xh in CI" shapes are excluded by the boundary lookahead — unit-tested.
+- A topic with NO active timed run: detector is a structural no-op (no clocks → no
+  advisory) — conversational sends remain effectively friction-free.
+
+Residual: a sender quoting a wrong time WITHOUT quote marks in a correction message
+could be held once; the advisory text tells it the real numbers, and `--ack-advisory`
+delivers unchanged. Accepted — this is the exact message class the mandate targets.
+
+## 2. Under-block
+
+**What failure modes does this still miss?**
+
+- Prose-only claims with no anchored number ("we're most of the way through") — out
+  of scope for a deterministic detector; accepted.
+- Wrong ABSOLUTE times ("started at 4pm", "ends at 16:07 tomorrow") — not parsed in
+  v1; the elapsed/remaining/percent family covers the founding incident class.
+  Tracked for a follow-up detector revision if dogfooding shows absolute-time
+  guesses recur. <!-- tracked: 13481 -->
+- Slack/WhatsApp/iMessage relay scripts have no preflight at all today (pre-existing);
+  the Telegram template is where autonomous reports go. Same tracking item.
+  <!-- tracked: 13481 -->
+- Time claims in CONVERSATIONAL sessions on topics with no active run are unchecked
+  by design (no clock = no truth to compare against).
+
+## 3. Level-of-abstraction fit
+
+Right layer. The deterministic detector lives beside the other text detectors
+(`JargonDetector`, `raw-file-path`, `localhost-link`) in `src/core/`; the clock READ
+stays in the route (the module remains pure); the hold-and-fix loop reuses the
+existing advisory mechanism rather than inventing a parallel one. The smarter
+outbound authority (MessagingToneGate) is not the right owner: this is an objective
+numeric contradiction, not a tone/judgment call, and the mandate asks for a
+deterministic guarantee.
+
+## 4. Signal vs authority compliance
+
+Compliant (docs/signal-vs-authority.md). The detector is a brittle/cheap
+signal-producer feeding the existing inform-only advisory surface. It holds NO
+blocking authority: the server route only returns advisories; the script-side loop
+gives the sender the fix-or-ack decision; every error path (clock read failure,
+detector throw, server down, timeout, malformed JSON) fails OPEN to delivery.
+
+## 5. Interactions
+
+- The localhost-link server guard, tone gate, dedup, and delivery pipeline are
+  untouched — the TIME_CLAIM advisory composes alongside the other codes for
+  automated sends and rides the same audit/escalation machinery (signature includes
+  the code set, so per-signature escalation just works).
+- Double-fire: for automated sends the detector runs once inside
+  `composeAdvisories`; the reply path calls `composeTimeClaimAdvisories` directly —
+  one detector run per preflight, never two.
+- The reply-kind preflight writes audit rows that previously only automated sends
+  wrote; rows are keyed `interactive-session`, so per-slug aggregate escalation for
+  real jobs is not polluted.
+- Race with a run finishing between preflight and send: harmless — worst case a
+  passing claim was checked against a clock that then expired; the advisory is
+  point-in-time by design.
+
+## 6. External surfaces
+
+- `POST /messaging/preflight` response may now include a `TIME_CLAIM` advisory; for
+  non-automated kinds the response can be non-empty for the first time. OLD scripts
+  never call the preflight for those kinds → no deployed-behavior change until the
+  script template migrates (SHA-gated, stock copies only; customized copies get a
+  `.new` candidate + degradation event — the established mechanism).
+- NEW script + OLD server: server returns `[]` for non-automated kinds → no-op.
+  Version-skew safe both directions (tested at the route level for the kinds matrix).
+- Timing dependence: yes, inherently — the detector compares against the live clock
+  at preflight time; tolerances absorb request latency (seconds vs a 15-minute floor).
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+**machine-local BY DESIGN.** The session clock reads `<stateDir>/autonomous/*.local.md`
+— per-machine state for runs executing ON this machine — and the preflight runs on
+the same machine as the sending session, so the clock consulted is the right one by
+construction. A topic transferred mid-run carries its autonomous state file via the
+working-set carrier (WS1.4, PR #1092); after a transfer the new machine's preflight
+reads the carried file once the run resumes there. No replication needed; no URL or
+notice surface is generated; one-voice gating is unaffected (this layer holds a
+message BEFORE send, it never speaks).
+
+## 8. Rollback cost
+
+Cheap, three independent levers, no data migration:
+- Live-config: `messaging.outboundAdvisory.timeClaim.enabled: false` (or the master
+  `messaging.outboundAdvisory.enabled: false`) — read live, no restart.
+- The feature ships DARK on the fleet (dev-agent gate); never enabling it is the
+  default state.
+- Full revert: the detector is additive; reverting the PR restores the prior
+  template SHA path (the SHA set keeps old entries valid as migration sources).
+State written: only advisory audit JSONL rows (observe-only).
+
+---
+
+## Second-pass review
+
+**Round 1 (independent reviewer): CONCERN RAISED — two genuine defects; all safety
+claims (fail-open at every layer, dev-gate resolution, version-skew no-op both
+directions, ReDoS-bounded regexes ≤1.3ms on adversarial 64KB inputs, migration
+idempotency, template-SHA correctness) verified clean.**
+
+- **Concern 1 — percent anchors captured TASK progress.** `done`/`complete`/bare-`in`
+  ("the migration is 90% done", "passes 100% in CI") parsed as TIME claims; task
+  progress diverges from wall-clock percent in the NORMAL state, so honest reports
+  would be held routinely — and the guidance would have made them WRONG.
+  **Fixed:** percent anchors now require an explicit time noun
+  (`elapsed | (through|of|into) the (run|session|clock)`); 5 new negative tests on
+  the reviewer's exact counterexamples.
+- **Concern 2 — a non-automated `--ack-advisory` never recorded `acked`.** The
+  script's ack annotation was gated to automated+llm-session, and the route's ack
+  writer used the raw (empty) jobSlug — so an interactive session's advised
+  episodes could never resolve, and the ignore-escalation would false-page on
+  messages that actually DELIVERED (compounded by every interactive session
+  sharing the `interactive-session` signature). **Fixed:** the script annotates
+  the ack for every non-script sender, and the route's ack writer applies the same
+  `interactive-session` slug fallback as the preflight writer; covered by a new
+  script test (unstamped ack carries advisoryAck + codes) and a new route test
+  (kindless ack lands `acked` under the SAME signature key).
+
+**Round 2: CONCUR.** The reviewer executed the literal percent regex against all
+round-1 counterexamples (zero matches) and the three time-noun shapes (all match);
+traced the script's ack-first METADATA_JSON assembly for the all-env-empty case
+(valid JSON, no leading-comma defect, confirmed empirically by the unstamped-ack
+test JSON-parsing the delivered body); and verified the preflight writer and the
+ack writer resolve to the IDENTICAL signature key for every kind, so a reply-kind
+advised episode is genuinely resolved by its acked row (recordAck clears
+`unresolved` + `escalatedIgnore` on the `slug|topic|codes` signature). 55/55 tests
+green in the three touched files.