instar 1.3.560 → 1.3.562

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-14T09:02:12.574Z",
-  "instarVersion": "1.3.560",
+  "generatedAt": "2026-06-14T11:06:11.902Z",
+  "instarVersion": "1.3.562",
   "entryCount": 201,
   "entries": {
     "hook:session-start": {
@@ -11,7 +11,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/session-start.sh",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:dangerous-command-guard": {
@@ -20,7 +20,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/dangerous-command-guard.sh",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:grounding-before-messaging": {
@@ -29,7 +29,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/grounding-before-messaging.sh",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:compaction-recovery": {
@@ -38,7 +38,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/compaction-recovery.sh",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:external-operation-gate": {
@@ -47,7 +47,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-operation-gate.js",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:deferral-detector": {
@@ -56,7 +56,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/deferral-detector.js",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:self-stop-guard": {
@@ -65,7 +65,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/self-stop-guard.js",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:post-action-reflection": {
@@ -74,7 +74,7 @@
       "domain": "evolution",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/post-action-reflection.js",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:external-communication-guard": {
@@ -83,7 +83,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-communication-guard.js",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-collector": {
@@ -92,7 +92,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-collector.js",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-checkpoint": {
@@ -101,7 +101,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-checkpoint.js",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:free-text-guard": {
@@ -110,7 +110,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/free-text-guard.sh",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:claim-intercept": {
@@ -119,7 +119,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept.js",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:claim-intercept-response": {
@@ -128,7 +128,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept-response.js",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:stop-gate-router": {
@@ -137,7 +137,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/stop-gate-router.js",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "hook:auto-approve-permissions": {
@@ -146,7 +146,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/auto-approve-permissions.js",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "job:health-check": {
@@ -1554,7 +1554,7 @@
       "type": "subsystem",
       "domain": "updates",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
-      "contentHash": "aeb4daa33c893c34809e18e462677e357018f6ca71faae1c5c95ab4290388b56",
+      "contentHash": "e0ddbc39521447ae1bfecddfc98b2bd579400889d5fac37cf7df7d380e6a2fb7",
       "since": "2025-01-01"
     },
     "subsystem:scheduler": {

package/upgrades/1.3.561.md

@@ -0,0 +1,31 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: minor -->
+
+## What Changed
+
+**This release is the feedback-factory sender repoint** (docs/specs/feedback-factory-migration.md §2.5 Phase 4): the fleet's canonical feedback endpoint moves from Portal's receiver (`dawn.bot-me.ai/api/instar/feedback`) to the Instar operated instance's canonical front (`feedback.dawn-tunnel.dev/api/feedback`) — a live, verified Vercel receiver whose DNS zone is operator-controlled. (`feedback.instar.sh` is the intended long-term name; its DNS was not reachable at repoint time, so the operated endpoint went live on `feedback.dawn-tunnel.dev` first. A later re-point to instar.sh, if that becomes serviceable, is a one-line constant change + an idempotent migration.)
+
+- **Single-source constant.** `src/core/canonicalFeedback.ts` now defines `CANONICAL_FEEDBACK_URL` + `LEGACY_FEEDBACK_URLS`; the Config loader default and both init shapes consume it (the literal URL can never drift across call sites again — pinned by test).
+- **Migration Parity (the actual fleet repoint).** An idempotent `PostUpdateMigrator.migrateConfig` block rewrites a deployed agent's `feedback.webhookUrl` to the canonical front **only when it exactly equals a known legacy canonical default**. A custom operator webhook URL is structurally untouched (exact-match allowlist). Variant spellings that miss the match keep working through the old receiver's 301/proxy-forward (spec Phase 5) — the long tail loses nothing.
+- **Unchanged:** the HMAC signing model and shared secret (same key through cutover, spec §2.9), the sender code itself, and `dispatches.dispatchUrl` (the dispatch move is sequenced separately).
+
+## What to Tell Your User
+
+- "The address I send Instar bug reports and feedback to has moved to its new home (run by the Instar maintainer). This happened automatically with this update — nothing for you to do, and no reports were lost: the old address keeps forwarding while the fleet rolls over."
+- "If you ever configured a CUSTOM feedback webhook of your own, it was not touched."
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Canonical feedback endpoint (stable) | Automatic — `feedback.webhookUrl` repoints on update; new installs get it via `init` |
+| Single-source endpoint constant | `src/core/canonicalFeedback.ts` (`CANONICAL_FEEDBACK_URL`) |
+
+## Evidence
+
+- `tests/unit/PostUpdateMigrator-feedbackUrlRepoint.test.ts`: both sides of the rewrite decision boundary (legacy URL repointed / custom URL untouched), idempotency (second run = no change), no-invention on absent config, legacy-list regression pin, and the canonical URL passing the sender's own `validateWebhookUrl` gate.
+- `tests/unit/feedback-webhook.test.ts` updated: Config loader resolves through the constant; the legacy literal is banned from the loader source.
+- Full unit suite green; side-effects artifact `upgrades/side-effects/feedback-sender-repoint.md` with independent second-pass review.
+- Live pre-merge gate (operational): a signed HMAC round-trip against `https://feedback.dawn-tunnel.dev/api/feedback` was verified green before this repoint — `200 {received:true}` with the report landing durably in the operated instance's Blob inbox marked `verified:true`.

package/upgrades/1.3.562.md

@@ -0,0 +1,46 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The boot helpers that auto-create the Slack "Updates" and "Attention" channels
+(`ensureSlackUpdatesChannel` / `ensureSlackAttentionChannel` in
+`src/commands/server.ts`) passed a raw, workspace-derived name straight into
+`SlackAdapter.createChannel`. When the workspace name contained spaces or
+uppercase (e.g. "SageMind Live Test"), that produced an invalid Slack channel
+name like `SageMind Live Test-sys-updates`, which `createChannel` rejects via
+`validateChannelName` — so the channel never got created and the boot logged
+`Failed to create Slack Updates channel: Invalid channel name`.
+
+Both callers now slugify the name first through a new shared
+`slugifyChannelName` helper in `src/messaging/slack/sanitize.ts` (lowercase,
+collapse non-`[a-z0-9]` runs to a single hyphen, trim edge hyphens, clamp to
+Slack's 80-char limit) — mirroring the per-session channel slug logic the
+adapter already used on its `-sess-` path. The `createChannel` /
+`validateChannelName` contract other callers rely on is untouched.
+
+## What to Tell Your User
+
+If your Slack workspace name has spaces or capital letters and your agent failed
+to create its Updates or Attention channel (an "Invalid channel name" error on
+startup), that's now fixed — the channel name is cleaned into a valid Slack
+slug before creation. Workspaces whose name was already lowercase-and-dashes see
+no change at all.
+
+## Summary of New Capabilities
+
+- New `slugifyChannelName(name)` helper in the Slack sanitize module — a single
+  source of truth for turning an arbitrary name into a valid Slack channel name.
+- The Slack Updates and Attention boot channels now create reliably regardless
+  of workspace-name casing or spaces.
+
+## Evidence
+
+- `tests/unit/slack-channel-slug.test.ts` — the exact failing name
+  ("SageMind Live Test-sys-updates") now slugifies to a name `validateChannelName`
+  accepts; covers lowercasing, space-collapse, punctuation stripping, edge-hyphen
+  trim, already-valid passthrough, 80-char clamp, and a regression assertion that
+  the raw un-slugified name is rejected.
+- `npx tsc --noEmit` clean; 9/9 new unit tests green.

package/upgrades/eli16/slack-updates-channel-slug.md

@@ -0,0 +1,16 @@
+# Why the Slack Updates channel failed to create (and now doesn't)
+
+## The one-sentence version
+When your Slack workspace had a space or a capital letter in its name (like "SageMind Live Test"), the agent tried to make a Slack channel literally named "SageMind Live Test-sys-updates" — but Slack only allows lowercase, no-spaces channel names, so the creation crashed every time. Now the name is cleaned up first.
+
+## Picture it
+Imagine a mailroom that will only accept package labels written in lowercase with dashes instead of spaces. The agent was handing it a label that said "SageMind Live Test-sys-updates" — capital letters, spaces and all — and the mailroom kept rejecting it. The fix is a tiny label-printer that rewrites the label as "sagemind-live-test-sys-updates" before handing it over.
+
+## What changed, precisely
+- The two callers that auto-create the Slack "Updates" and "Attention" channels were passing a raw, workspace-derived name straight into channel creation.
+- That raw name kept its spaces and capitals, which Slack rejects — so the channel never got made and you saw "Invalid channel name".
+- Now both callers run the name through a small slugifier first (lowercase it, turn anything that isn't a-z/0-9 into a single dash, trim stray dashes, cap at Slack's 80-char limit) — exactly the same cleanup the per-session Slack channels already used.
+
+## Why this is safe
+- It only changes how the name is *built* before creation; it does not touch the channel-creation rule that other code relies on (that rule still rejects bad names — it just never sees one now).
+- A name that was already valid passes through unchanged.

package/upgrades/side-effects/feedback-sender-repoint.md

@@ -0,0 +1,61 @@
+# Side-Effects Review — Canonical feedback URL repoint (Phase-4 cutover flip)
+
+**Version / slug:** `feedback-sender-repoint`
+**Date:** `2026-06-11`
+**Author:** `Echo (instar-dev agent)`
+**Second-pass reviewer:** `required (fleet-wide sender repoint — the one-way door) — see appended response`
+
+## Summary of the change
+
+The migration spec's Phase-4 sender repoint (docs/specs/feedback-factory-migration.md §2.5): **merging this PR repoints the entire fleet's feedback sender** to the Echo-operated canonical front, an operator-authorized fleet-wide change. Introduces `src/core/canonicalFeedback.ts` (the single source for the fleet's canonical feedback endpoint: `CANONICAL_FEEDBACK_URL = https://feedback.dawn-tunnel.dev/api/feedback` — the live operated receiver, its DNS zone operator-controlled; `feedback.instar.sh` is the intended long-term name, not DNS-reachable at repoint time — plus the `LEGACY_FEEDBACK_URLS` rewrite allowlist), repoints the three in-code default sites (`src/core/Config.ts` loader default, `src/commands/init.ts` ×2 new-install shapes), and adds the **Migration Parity** arm: an idempotent `PostUpdateMigrator.migrateConfig` block that rewrites a deployed agent's `feedback.webhookUrl` to the canonical front **only when it exactly equals a known legacy canonical default** — an operator's custom URL is structurally untouchable. `dispatches.dispatchUrl` is deliberately NOT flipped (spec sequences the dispatch move separately; the old receiver's Phase-5 proxy-forward covers continuity). Tests: new `PostUpdateMigrator-feedbackUrlRepoint.test.ts` (both sides of the rewrite boundary, idempotency, no-invention, regression pins, sender-validation gate) and the updated `feedback-webhook.test.ts` (single-source + legacy-literal-banned pins).
+
+## Decision-point inventory
+
+- `migrateConfig` webhookUrl rewrite — **add** — a string-equality membership check against `LEGACY_FEEDBACK_URLS`. Deliberately brittle-and-cheap by design: exact-match-only is the conservative direction (a non-match means NO action), and it holds no blocking authority — it rewrites a default, never gates a flow.
+- Sender POST target (`FeedbackManager`) — **pass-through** — unchanged code; its destination value changes at config level. `validateWebhookUrl` (https + non-internal) passes the new URL (pinned by test).
+
+---
+
+## 1. Over-block
+
+No block/allow surface — over-block not applicable. The closest analogue: the rewrite could "over-fire" on an operator who deliberately pointed at Dawn's legacy URL as a *custom* choice — indistinguishable from the shipped default by construction. Post-cutover that URL is a 301/proxy-forward to the canonical front (spec Phase 5), so even that case lands at the same place. No issue identified.
+
+## 2. Under-block
+
+The rewrite "under-fires" for an agent whose config carries a variant spelling (trailing slash, http://, different casing) — exact-match misses it. Those agents keep posting to the old URL, which is exactly what the Phase-5 proxy-forward exists for: they keep landing on the canonical front via the forward, losing nothing. The long tail is covered structurally, not by widening the match (widening would risk touching custom URLs — the wrong trade).
+
+## 3. Level-of-abstraction fit
+
+The constant lives at the core layer (one definition, three consumers + the migrator — no string drift possible again); the repoint of deployed agents lives in the migration layer (`PostUpdateMigrator`), which is the system's designated mechanism for exactly this (Migration Parity standard names this very case: "the sender's canonical feedback URL must flip for EXISTING agents via PostUpdateMigrator"). No layer inversion.
+
+## 4. Signal vs authority compliance
+
+Compliant — the change adds no detector and no authority. The migration is a one-shot data rewrite with an exact-match guard whose failure mode is "do nothing" (deny-safe in the conservative direction). Reference: docs/signal-vs-authority.md.
+
+## 5. Interactions
+
+- Composes with the receiver-persistence PR (the canonical front + inbox + drainer must be live and verified BEFORE this merges — preflight-gated in the cutover runbook/windows, not by code coupling; this PR is inert until published + agents update).
+- The migrator block runs inside `migrateConfig` after the PIN block; it touches only `feedback.webhookUrl` and cannot race the ConfigDefaults registry (which only ADDS missing fields, never rewrites existing values — the reason a dedicated block is required at all).
+- `QuotaTracker` (`dawn.bot-me.ai/api/instar/quota`) and `paritySubmitClient`/`integrityPassRunner` (parity tooling) deliberately keep their own URLs — different services, out of Phase-4 scope.
+- The CLAUDE.md "API Authentication" prose in agent templates mentions the old webhook host; the canonical front uses the SAME auth model (User-Agent/X-Instar-Version + HMAC), so the prose stays accurate in mechanism; the host mention is updated by the template's normal regeneration path, not load-bearing.
+
+## 6. External surfaces
+
+This is the maximal external surface: every deployed agent's feedback sender repoints on its next update. Mitigations are the spec's own: (a) the merge is held to Dawn's freeze window (PR title carries `[HOLD: merge = cutover flip]`); (b) the flip is gradual by nature — agents repoint as they update; the old receiver's Phase-5 proxy-forward catches every not-yet-updated sender; (c) the new URL must pass a live signed HMAC round-trip BEFORE the window opens (preflight gate); (d) the shared `INSTAR_WEBHOOK_SECRET` is unchanged through cutover (spec §2.9), so signed reports verify identically on both receivers.
+
+## 7. Rollback cost
+
+The spec's own rollback path (Part-3 §5): re-pointing BACK is the same mechanism in reverse — a follow-up release moves `CANONICAL_FEEDBACK_URL` back and the legacy list gains the new URL; deployed agents re-migrate on update. During any gap, Dawn's old receiver is still warm (Phase 5 keeps it as proxy-forward, not dark), so no report is lost in either direction. No data migration, no schema, no state created at merge time beyond config rewrites that are themselves reversible.
+
+---
+
+## Second-pass review response (independent reviewer subagent, 2026-06-11)
+
+Concur with the review.
+
+1. **The rewrite is genuinely conservative.** `PostUpdateMigrator.ts` gates the rewrite on an exact-string membership check against the one-entry allowlist (`canonicalFeedback.ts`); a custom/variant URL falls through to no action, absent `feedback`/`webhookUrl` invents nothing (ConfigDefaults has no `feedback.webhookUrl` entry — only the unrelated `feedbackPostDelayMs` — so there is no second path that could write a URL), and the write is atomic with a `.bak` backup. Idempotency holds by construction (the canonical URL is pinned out of the legacy list by test).
+2. **No missed in-code default site.** `git grep` over `src/` returns only `paritySubmitClient.ts` (a DIFFERENT endpoint — `/api/instar/feedback-factory/parity-submit`) plus the legacy-list entry; the remaining host mentions (init dispatchUrl ×2, integrityPassRunner, QuotaTracker comment, a grounding-gate doc example) are the deliberate out-of-scope set §5 names. No agent-installed template surface carries the URL.
+3. **Inert before merge, real rollback.** The diff is pure source + tests + docs — nothing executes from an unmerged branch; the repoint only reaches agents via a published release + their next migration run. The rollback claim matches the spec verbatim (Phase-4 repoint "itself reversible (re-migrate to old URL)"). All 9 tests in the two test files pass, covering both sides of the decision boundary, idempotency, and the `validateWebhookUrl` gate.
+4. **Artifact and fragment honesty.** The seven sections match the code; the fragment publishes only at merge (the cutover itself), so it announces nothing as live early. One non-blocking nit: §5 attributed the stale old-host prose to "agent templates" — it actually lives in the repo's own `CLAUDE.md`; substance correct.
+
+**Resolution (author, same session):** the nit was fixed in this PR — the repo `CLAUDE.md` webhook line now names the canonical front + the constant module. Iterated and closed.

package/upgrades/side-effects/slack-updates-channel-slug.md

@@ -0,0 +1,46 @@
+# Side-Effects Review — Slack Updates/Attention channel name slugify
+
+## Change summary
+Caller-side fix in `src/commands/server.ts`: the `ensureSlackUpdatesChannel` and
+`ensureSlackAttentionChannel` boot helpers now slugify the workspace-derived
+channel name before calling `SlackAdapter.createChannel`, via a new shared
+`slugifyChannelName` helper in `src/messaging/slack/sanitize.ts`. Mirrors the
+existing per-session channel slug logic in `SlackAdapter` (`-sess-` path).
+
+## Tier
+Tier 1 — small, low-risk, single-machine Slack-adapter boot-path bugfix. No
+converged spec required.
+
+## Files touched
+- `src/messaging/slack/sanitize.ts` — adds exported `slugifyChannelName(name)`.
+- `src/commands/server.ts` — imports the helper; wraps both `-sys-updates` and
+  `-sys-attention` channel names with it before `createChannel`.
+- `tests/unit/slack-channel-slug.test.ts` — new focused unit test.
+
+## Behavioral side-effects
+- **Channel names on FRESH creation**: a workspace name containing spaces or
+  uppercase now yields a slugified channel (e.g. "SageMind Live Test" →
+  `sagemind-live-test-sys-updates`) instead of a hard failure. For workspaces
+  whose name was already slug-clean (lowercase, no spaces), the produced name is
+  byte-identical to before — no change.
+- **No change to `createChannel` / `validateChannelName`**: the validate-and-throw
+  behavior other callers depend on is untouched; the fix only ensures these two
+  callers never hand it an invalid name.
+- **Idempotent at the state layer**: both helpers early-return when their
+  `slack-*-channel` state key is already set, so this only affects the one-time
+  creation path; existing installs that already created a channel are unaffected.
+
+## Migration parity
+- No agent-installed file changed (no `.claude/settings.json` hooks, no
+  `.instar/config.json` defaults, no CLAUDE.md template, no hook scripts, no
+  built-in skills). This is server-side runtime code shipped in the normal
+  build — existing agents receive it on their next update with no migration.
+
+## Rollback
+- Revert the squash commit. The change is self-contained (one helper + two call
+  sites + one test); no data migration, no state schema change, nothing to undo.
+
+## Blast radius
+- Limited to the Slack adapter boot path. Telegram / WhatsApp / iMessage and all
+  non-Slack code paths are untouched. Dark-gate config line-map unchanged (no
+  ConfigDefaults edit).