instar 1.3.561 → 1.3.563

package/dist/core/inboundQueueConfig.d.ts

@@ -57,6 +57,23 @@ export declare const PROTOCOL_REDISPATCH_HORIZON_MAX_MS: number;
  * safe to queue-OFF on violation, so a generous constant only tightens).
  */
 export declare const BOOT_SWEEP_WINDOW_MS: number;
+/**
+ * Resolve the Multi-Machine Session Pool rollout STAGE from a config block.
+ * Returns the configured `stage` string only when the pool is BOTH enabled AND
+ * carries a `stage`; otherwise 'dark' (the inert default). This is the single
+ * source of truth for "is the session pool active, and at what stage?" — both
+ * the boot-time inbound-queue construction gate AND the live `_sessionPoolStage`
+ * getter in server.ts resolve through this one pure function, so the two can
+ * never drift (the original divergence is exactly what let the construction gate
+ * read a stale stub and keep the inbound queue dark forever — boot-order bug).
+ *
+ * @param cfg the resolved `multiMachine.sessionPool` block (liveConfig override
+ *   merged over the static config block, or just the static block at boot).
+ */
+export declare function resolveSessionPoolStage(cfg: {
+    enabled?: boolean;
+    stage?: string;
+} | null | undefined): string;
 /** Σbackoff: total worst-case backoff across maxAttempts (capped curve). */
 export declare function sumBackoffMs(cfg: Pick<InboundQueueConfig, 'baseBackoffMs' | 'maxBackoffMs' | 'maxAttempts'>): number;
 /** The full redispatch horizon a receipt must outlive (§3.4 receipt floor). */

package/dist/core/inboundQueueConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inboundQueueConfig.d.ts","sourceRoot":"","sources":["../../src/core/inboundQueueConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,0BAA0B,EAAE,MAAM,CAAC;IACnC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,eAAO,MAAM,4BAA4B,EAAE,kBA0B1C,CAAC;AAEF,eAAO,MAAM,iCAAiC,EAAE,sBAK/C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kCAAkC,QAAsB,CAAC;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAgB,CAAC;AAElD,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,eAAe,GAAG,cAAc,GAAG,aAAa,CAAC,GAAG,MAAM,CAMpH;AAED,+EAA+E;AAC/E,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,kBAAkB,GAAG,MAAM,CAEnE;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,CAAC,EAAE,kBAAkB,EACrB,CAAC,EAAE,sBAAsB,GACxB;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,kBAAkB,EAAE,CAAA;CAAE,CAkEnD"}
+{"version":3,"file":"inboundQueueConfig.d.ts","sourceRoot":"","sources":["../../src/core/inboundQueueConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,0BAA0B,EAAE,MAAM,CAAC;IACnC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,eAAO,MAAM,4BAA4B,EAAE,kBA0B1C,CAAC;AAEF,eAAO,MAAM,iCAAiC,EAAE,sBAK/C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kCAAkC,QAAsB,CAAC;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAgB,CAAC;AAElD;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAC5D,MAAM,CAER;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,eAAe,GAAG,cAAc,GAAG,aAAa,CAAC,GAAG,MAAM,CAMpH;AAED,+EAA+E;AAC/E,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,kBAAkB,GAAG,MAAM,CAEnE;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,CAAC,EAAE,kBAAkB,EACrB,CAAC,EAAE,sBAAsB,GACxB;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,kBAAkB,EAAE,CAAA;CAAE,CAkEnD"}

package/dist/core/inboundQueueConfig.js

@@ -55,6 +55,22 @@ export const PROTOCOL_REDISPATCH_HORIZON_MAX_MS = 12 * 60 * 60 * 1000; // 12h
  * safe to queue-OFF on violation, so a generous constant only tightens).
  */
 export const BOOT_SWEEP_WINDOW_MS = 5 * 60 * 1000; // 5 min
+/**
+ * Resolve the Multi-Machine Session Pool rollout STAGE from a config block.
+ * Returns the configured `stage` string only when the pool is BOTH enabled AND
+ * carries a `stage`; otherwise 'dark' (the inert default). This is the single
+ * source of truth for "is the session pool active, and at what stage?" — both
+ * the boot-time inbound-queue construction gate AND the live `_sessionPoolStage`
+ * getter in server.ts resolve through this one pure function, so the two can
+ * never drift (the original divergence is exactly what let the construction gate
+ * read a stale stub and keep the inbound queue dark forever — boot-order bug).
+ *
+ * @param cfg the resolved `multiMachine.sessionPool` block (liveConfig override
+ *   merged over the static config block, or just the static block at boot).
+ */
+export function resolveSessionPoolStage(cfg) {
+    return cfg?.enabled && cfg?.stage ? String(cfg.stage) : 'dark';
+}
 /** Σbackoff: total worst-case backoff across maxAttempts (capped curve). */
 export function sumBackoffMs(cfg) {
     let sum = 0;

package/dist/core/inboundQueueConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"inboundQueueConfig.js","sourceRoot":"","sources":["../../src/core/inboundQueueConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAqCH,MAAM,CAAC,MAAM,4BAA4B,GAAuB;IAC9D,OAAO,EAAE,KAAK;IACd,MAAM,EAAE,IAAI;IACZ,aAAa,EAAE,EAAE;IACjB,QAAQ,EAAE,GAAG;IACb,YAAY,EAAE,IAAI;IAClB,YAAY,EAAE,GAAG;IACjB,eAAe,EAAE,KAAK;IACtB,UAAU,EAAE,OAAO;IACnB,iBAAiB,EAAE,MAAM;IACzB,mBAAmB,EAAE,MAAM;IAC3B,oBAAoB,EAAE,QAAQ;IAC9B,WAAW,EAAE,KAAK;IAClB,cAAc,EAAE,EAAE;IAClB,gBAAgB,EAAE,CAAC;IACnB,cAAc,EAAE,GAAG;IACnB,cAAc,EAAE,KAAK;IACrB,aAAa,EAAE,IAAI;IACnB,YAAY,EAAE,MAAM;IACpB,WAAW,EAAE,EAAE;IACf,YAAY,EAAE,MAAM;IACpB,sBAAsB,EAAE,KAAK;IAC7B,mBAAmB,EAAE,CAAC;IACtB,0BAA0B,EAAE,CAAC;IAC7B,kBAAkB,EAAE,KAAK;IACzB,UAAU,EAAE,QAAQ;CACrB,CAAC;AAEF,MAAM,CAAC,MAAM,iCAAiC,GAA2B;IACvE,OAAO,EAAE,KAAK;IACd,SAAS,EAAE,KAAK;IAChB,aAAa,EAAE,KAAK;IACpB,oBAAoB,EAAE,CAAC;CACxB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,MAAM;AAE7E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ;AAE3D,4EAA4E;AAC5E,MAAM,UAAU,YAAY,CAAC,GAA+E;IAC1G,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QAC3D,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,GAAG,CAAC,IAAI,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,mBAAmB,CAAC,GAAuB;IACzD,OAAO,GAAG,CAAC,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,YAAY,GAAG,GAAG,CAAC,UAAU,GAAG,oBAAoB,CAAC;AACvG,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAC5C,CAAqB,EACrB,CAAyB;IAEzB,MAAM,CAAC,GAAyB,EAAE,CAAC;IAEnC,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC;IAC3G,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,CAAC,CAAC,IAAI,CAAC;YACL,SAAS,EAAE,CAAC;YACZ,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,4EAA4E,SAAS,2BAA2B,CAAC,CAAC,UAAU,GAAG;SACzI,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,mEAAmE;IACnE,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7C,CAAC,CAAC,IAAI,CAAC;YACL,SAAS,EAAE,CAAC;YACZ,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,uBAAuB,CAAC,CAAC,kBAAkB,6BAA6B,CAAC,CAAC,YAAY,GAAG;SACnG,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,MAAM,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,CAAC,CAAC,CAAC,oBAAoB,GAAG,OAAO,CAAC,EAAE,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC;YACL,SAAS,EAAE,CAAC;YACZ,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,yBAAyB,CAAC,CAAC,oBAAoB,oFAAoF,OAAO,GAAG;SACvJ,CAAC,CAAC;IACL,CAAC;IAED,4DAA4D;IAC5D,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,SAAS,2BAA2B,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;IAC9H,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC,aAAa,0BAA0B,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;IACpI,CAAC;IAED,sCAAsC;IACtC,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3C,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC,iBAAiB,2BAA2B,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;IAChJ,CAAC;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,kDAAkD;IAClD,IAAI,CAAC,CAAC,OAAO,IAAI,kCAAkC,CAAC,EAAE,CAAC;QACrD,CAAC,CAAC,IAAI,CAAC;YACL,SAAS,EAAE,CAAC;YACZ,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,uBAAuB,OAAO,gDAAgD,kCAAkC,GAAG;SAC7H,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,CAAC,oBAAoB,IAAI,kCAAkC,CAAC,EAAE,CAAC;QACpE,CAAC,CAAC,IAAI,CAAC;YACL,SAAS,EAAE,CAAC;YACZ,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,yBAAyB,CAAC,CAAC,oBAAoB,gDAAgD,kCAAkC,GAAG;SAC9I,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"inboundQueueConfig.js","sourceRoot":"","sources":["../../src/core/inboundQueueConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAqCH,MAAM,CAAC,MAAM,4BAA4B,GAAuB;IAC9D,OAAO,EAAE,KAAK;IACd,MAAM,EAAE,IAAI;IACZ,aAAa,EAAE,EAAE;IACjB,QAAQ,EAAE,GAAG;IACb,YAAY,EAAE,IAAI;IAClB,YAAY,EAAE,GAAG;IACjB,eAAe,EAAE,KAAK;IACtB,UAAU,EAAE,OAAO;IACnB,iBAAiB,EAAE,MAAM;IACzB,mBAAmB,EAAE,MAAM;IAC3B,oBAAoB,EAAE,QAAQ;IAC9B,WAAW,EAAE,KAAK;IAClB,cAAc,EAAE,EAAE;IAClB,gBAAgB,EAAE,CAAC;IACnB,cAAc,EAAE,GAAG;IACnB,cAAc,EAAE,KAAK;IACrB,aAAa,EAAE,IAAI;IACnB,YAAY,EAAE,MAAM;IACpB,WAAW,EAAE,EAAE;IACf,YAAY,EAAE,MAAM;IACpB,sBAAsB,EAAE,KAAK;IAC7B,mBAAmB,EAAE,CAAC;IACtB,0BAA0B,EAAE,CAAC;IAC7B,kBAAkB,EAAE,KAAK;IACzB,UAAU,EAAE,QAAQ;CACrB,CAAC;AAEF,MAAM,CAAC,MAAM,iCAAiC,GAA2B;IACvE,OAAO,EAAE,KAAK;IACd,SAAS,EAAE,KAAK;IAChB,aAAa,EAAE,KAAK;IACpB,oBAAoB,EAAE,CAAC;CACxB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,MAAM;AAE7E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ;AAE3D;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAA6D;IAE7D,OAAO,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AACjE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,YAAY,CAAC,GAA+E;IAC1G,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QAC3D,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,GAAG,CAAC,IAAI,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,mBAAmB,CAAC,GAAuB;IACzD,OAAO,GAAG,CAAC,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,YAAY,GAAG,GAAG,CAAC,UAAU,GAAG,oBAAoB,CAAC;AACvG,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAC5C,CAAqB,EACrB,CAAyB;IAEzB,MAAM,CAAC,GAAyB,EAAE,CAAC;IAEnC,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC;IAC3G,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,CAAC,CAAC,IAAI,CAAC;YACL,SAAS,EAAE,CAAC;YACZ,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,4EAA4E,SAAS,2BAA2B,CAAC,CAAC,UAAU,GAAG;SACzI,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,mEAAmE;IACnE,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7C,CAAC,CAAC,IAAI,CAAC;YACL,SAAS,EAAE,CAAC;YACZ,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,uBAAuB,CAAC,CAAC,kBAAkB,6BAA6B,CAAC,CAAC,YAAY,GAAG;SACnG,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,MAAM,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,CAAC,CAAC,CAAC,oBAAoB,GAAG,OAAO,CAAC,EAAE,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC;YACL,SAAS,EAAE,CAAC;YACZ,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,yBAAyB,CAAC,CAAC,oBAAoB,oFAAoF,OAAO,GAAG;SACvJ,CAAC,CAAC;IACL,CAAC;IAED,4DAA4D;IAC5D,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,SAAS,2BAA2B,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;IAC9H,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC,aAAa,0BAA0B,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;IACpI,CAAC;IAED,sCAAsC;IACtC,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3C,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC,iBAAiB,2BAA2B,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;IAChJ,CAAC;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,kDAAkD;IAClD,IAAI,CAAC,CAAC,OAAO,IAAI,kCAAkC,CAAC,EAAE,CAAC;QACrD,CAAC,CAAC,IAAI,CAAC;YACL,SAAS,EAAE,CAAC;YACZ,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,uBAAuB,OAAO,gDAAgD,kCAAkC,GAAG;SAC7H,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,CAAC,oBAAoB,IAAI,kCAAkC,CAAC,EAAE,CAAC;QACpE,CAAC,CAAC,IAAI,CAAC;YACL,SAAS,EAAE,CAAC;YACZ,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,yBAAyB,CAAC,CAAC,oBAAoB,gDAAgD,kCAAkC,GAAG;SAC9I,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;AAC/C,CAAC"}

package/dist/messaging/slack/sanitize.d.ts

@@ -3,6 +3,10 @@
  *
  * Prevents prompt injection, path traversal, and SSRF attacks
  * by validating and cleaning user-controlled fields before use.
+ *
+ * CONTRACT-EVIDENCE: EXEMPT — pure string-validation/slug helpers; this module
+ * makes NO Slack API calls and touches no API-contract surface. The added
+ * slugifyChannelName is covered by tests/unit/slack-channel-slug.test.ts.
  */
 /**
  * Sanitize a Slack display name for safe injection into session context.
@@ -21,6 +25,19 @@ export declare function validateChannelId(id: string): boolean;
  * Must be lowercase alphanumeric with hyphens/underscores, max 80 chars.
  */
 export declare function validateChannelName(name: string): boolean;
+/**
+ * Slugify an arbitrary string into a valid Slack channel name.
+ *
+ * Slack channel names must be lowercase and may only contain [a-z0-9-_]
+ * (see {@link validateChannelName}). A workspace-derived name like
+ * "SageMind Live Test" contains spaces and uppercase, which `createChannel`
+ * rejects via validate-and-throw. This produces a guaranteed-valid slug:
+ * lowercase, non-[a-z0-9] runs collapsed to a single hyphen, leading/trailing
+ * hyphens trimmed, and clamped to Slack's 80-char limit.
+ *
+ * Mirrors the session-channel slug logic in SlackAdapter.
+ */
+export declare function slugifyChannelName(name: string): string;
 /**
  * Validate that a URL hostname belongs to *.slack.com.
  * Used to prevent SSRF via manipulated upload URLs.

package/dist/messaging/slack/sanitize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../../src/messaging/slack/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMxD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAO1D;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKjD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGjD"}
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../../src/messaging/slack/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMxD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMvD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAO1D;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKjD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGjD"}

package/dist/messaging/slack/sanitize.js

@@ -3,6 +3,10 @@
  *
  * Prevents prompt injection, path traversal, and SSRF attacks
  * by validating and cleaning user-controlled fields before use.
+ *
+ * CONTRACT-EVIDENCE: EXEMPT — pure string-validation/slug helpers; this module
+ * makes NO Slack API calls and touches no API-contract surface. The added
+ * slugifyChannelName is covered by tests/unit/slack-channel-slug.test.ts.
  */
 const CHANNEL_ID_PATTERN = /^[CDG][A-Z0-9]{8,12}$/;
 const CHANNEL_NAME_PATTERN = /^[a-z0-9][a-z0-9\-_]{0,79}$/;
@@ -36,6 +40,25 @@ export function validateChannelId(id) {
 export function validateChannelName(name) {
     return CHANNEL_NAME_PATTERN.test(name);
 }
+/**
+ * Slugify an arbitrary string into a valid Slack channel name.
+ *
+ * Slack channel names must be lowercase and may only contain [a-z0-9-_]
+ * (see {@link validateChannelName}). A workspace-derived name like
+ * "SageMind Live Test" contains spaces and uppercase, which `createChannel`
+ * rejects via validate-and-throw. This produces a guaranteed-valid slug:
+ * lowercase, non-[a-z0-9] runs collapsed to a single hyphen, leading/trailing
+ * hyphens trimmed, and clamped to Slack's 80-char limit.
+ *
+ * Mirrors the session-channel slug logic in SlackAdapter.
+ */
+export function slugifyChannelName(name) {
+    return name
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 80);
+}
 /**
  * Validate that a URL hostname belongs to *.slack.com.
  * Used to prevent SSRF via manipulated upload URLs.

package/dist/messaging/slack/sanitize.js.map

@@ -1 +1 @@
-{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../../src/messaging/slack/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AACnD,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAC3D,4CAA4C;AAC5C,MAAM,aAAa,GAAG,kBAAkB,CAAC;AACzC,MAAM,eAAe,GAAG,UAAU,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,IAAI;SACR,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;SAC1B,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;SAC5B,IAAI,EAAE;SACN,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAU;IAC1C,OAAO,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,IAAI;SACR,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;AACnC,CAAC"}
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../../src/messaging/slack/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AACnD,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAC3D,4CAA4C;AAC5C,MAAM,aAAa,GAAG,kBAAkB,CAAC;AACzC,MAAM,eAAe,GAAG,UAAU,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,IAAI;SACR,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;SAC1B,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;SAC5B,IAAI,EAAE;SACN,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAU;IAC1C,OAAO,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,IAAI;SACR,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,IAAI;SACR,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;AACnC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.561",
+  "version": "1.3.563",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-14T10:35:51.901Z",
-  "instarVersion": "1.3.561",
+  "generatedAt": "2026-06-14T11:52:44.425Z",
+  "instarVersion": "1.3.563",
   "entryCount": 201,
   "entries": {
     "hook:session-start": {

package/upgrades/1.3.562.md

@@ -0,0 +1,46 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The boot helpers that auto-create the Slack "Updates" and "Attention" channels
+(`ensureSlackUpdatesChannel` / `ensureSlackAttentionChannel` in
+`src/commands/server.ts`) passed a raw, workspace-derived name straight into
+`SlackAdapter.createChannel`. When the workspace name contained spaces or
+uppercase (e.g. "SageMind Live Test"), that produced an invalid Slack channel
+name like `SageMind Live Test-sys-updates`, which `createChannel` rejects via
+`validateChannelName` — so the channel never got created and the boot logged
+`Failed to create Slack Updates channel: Invalid channel name`.
+
+Both callers now slugify the name first through a new shared
+`slugifyChannelName` helper in `src/messaging/slack/sanitize.ts` (lowercase,
+collapse non-`[a-z0-9]` runs to a single hyphen, trim edge hyphens, clamp to
+Slack's 80-char limit) — mirroring the per-session channel slug logic the
+adapter already used on its `-sess-` path. The `createChannel` /
+`validateChannelName` contract other callers rely on is untouched.
+
+## What to Tell Your User
+
+If your Slack workspace name has spaces or capital letters and your agent failed
+to create its Updates or Attention channel (an "Invalid channel name" error on
+startup), that's now fixed — the channel name is cleaned into a valid Slack
+slug before creation. Workspaces whose name was already lowercase-and-dashes see
+no change at all.
+
+## Summary of New Capabilities
+
+- New `slugifyChannelName(name)` helper in the Slack sanitize module — a single
+  source of truth for turning an arbitrary name into a valid Slack channel name.
+- The Slack Updates and Attention boot channels now create reliably regardless
+  of workspace-name casing or spaces.
+
+## Evidence
+
+- `tests/unit/slack-channel-slug.test.ts` — the exact failing name
+  ("SageMind Live Test-sys-updates") now slugifies to a name `validateChannelName`
+  accepts; covers lowercasing, space-collapse, punctuation stripping, edge-hyphen
+  trim, already-valid passthrough, 80-char clamp, and a regression assertion that
+  the raw un-slugified name is rejected.
+- `npx tsc --noEmit` clean; 9/9 new unit tests green.

package/upgrades/1.3.563.md

@@ -0,0 +1,32 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Fixed a boot-ordering bug that meant the **Durable Inbound Message Queue** (`multiMachine.sessionPool.inboundQueue`) could NEVER construct its engine, regardless of config. In `startServer()`, the queue-engine construction gate read the module-level `_sessionPoolStage()` getter while it was still its initial stub (`() => 'dark'`) — the real liveConfig-reading implementation is only assigned ~350 lines further down the same synchronous boot flow. So the gate's `_sessionPoolStage() !== 'dark'` test was always false at construction time, the engine never built, and `GET /pool/queue` answered 503 forever even with the feature enabled and a non-dark session-pool stage. The feature ships dark/dry-run by default, so the fleet never hit this; it only bites the first agent to enable it for real.
+
+The fix resolves the stage INLINE at the construction site, reading the same `multiMachine.sessionPool` config (liveConfig override over the static block) via a new shared pure helper `resolveSessionPoolStage(cfg)` in `src/core/inboundQueueConfig.ts`, instead of consulting the not-yet-wired ref. The live `_sessionPoolStage` getter is refactored to call the same helper, so the two stage readers can never drift apart again (that drift was the root cause). No new capability, config key, HTTP route, or authority — purely a correction to WHEN an existing decision is read.
+
+audience: agent-only
+maturity: stable
+
+A no-deferrals audit of all five `_sessionPoolStage()` call sites confirmed exactly one genuinely-premature boot-time read (the construction gate). The three runtime-handler reads (`wireTelegramRouting` x2, the `onAccepted` forwarded-message callback) are correct as-is: they execute per-message AFTER boot and close over the ref, so they see the wired implementation when invoked.
+
+## What to Tell Your User
+
+Nothing to announce proactively — the inbound queue ships disabled by default, so for any agent that hasn't deliberately turned it on, nothing changes. If asked: the crash-proof holding area for messages that arrive while a conversation is mid-move between machines had a startup bug that kept it from ever turning on; it now starts correctly when enabled. For a developer agent running it live, the queue's status page now returns real data instead of "not available." Every error path still fails toward off (no queue), which is identical to the shipped default.
+
+## Summary of New Capabilities
+
+No new capability — a latent behavior-correctness fix restoring intended behavior.
+
+| Change | Effect |
+|--------|--------|
+| Inbound-queue construction gate reads stage inline | The queue engine constructs when `inboundQueue.enabled=true` + a non-dark `sessionPool` stage (was: never) |
+| `resolveSessionPoolStage(cfg)` shared helper | Single source of truth for the pool stage; boot gate + live getter can no longer drift |
+
+## Evidence
+
+Behavior-correctness fix; reproduced by code-read on `JKHeadley/main` and pinned by a fails-before/passes-after structural regression guard. `tests/unit/inbound-queue-boot-order.test.ts` (5) asserts the construction gate no longer calls the stub getter, resolves inline before gating, routes both readers through the shared helper, and leaves the stub declaration intact (4 of 5 assertions fail against pre-fix `server.ts`; all 5 pass against the fix). `tests/unit/resolve-session-pool-stage.test.ts` (5) covers both sides of the stage-resolution boundary (enabled+stage→stage; disabled/missing→dark). The existing `tests/integration/inbound-queue-route.test.ts` and `tests/e2e/inbound-queue-lifecycle.test.ts` already prove a constructed engine serves a real 200 on `/pool/queue`. `npx tsc --noEmit` clean; full lint + dark-gate (24/24, line-map unchanged) + no-silent-fallbacks (baseline 474 unchanged) + feature-delivery-completeness + route-completeness green.

package/upgrades/eli16/slack-updates-channel-slug.md

@@ -0,0 +1,16 @@
+# Why the Slack Updates channel failed to create (and now doesn't)
+
+## The one-sentence version
+When your Slack workspace had a space or a capital letter in its name (like "SageMind Live Test"), the agent tried to make a Slack channel literally named "SageMind Live Test-sys-updates" — but Slack only allows lowercase, no-spaces channel names, so the creation crashed every time. Now the name is cleaned up first.
+
+## Picture it
+Imagine a mailroom that will only accept package labels written in lowercase with dashes instead of spaces. The agent was handing it a label that said "SageMind Live Test-sys-updates" — capital letters, spaces and all — and the mailroom kept rejecting it. The fix is a tiny label-printer that rewrites the label as "sagemind-live-test-sys-updates" before handing it over.
+
+## What changed, precisely
+- The two callers that auto-create the Slack "Updates" and "Attention" channels were passing a raw, workspace-derived name straight into channel creation.
+- That raw name kept its spaces and capitals, which Slack rejects — so the channel never got made and you saw "Invalid channel name".
+- Now both callers run the name through a small slugifier first (lowercase it, turn anything that isn't a-z/0-9 into a single dash, trim stray dashes, cap at Slack's 80-char limit) — exactly the same cleanup the per-session Slack channels already used.
+
+## Why this is safe
+- It only changes how the name is *built* before creation; it does not touch the channel-creation rule that other code relies on (that rule still rejects bad names — it just never sees one now).
+- A name that was already valid passes through unchanged.

package/upgrades/side-effects/inbound-queue-boot-order-fix.md

@@ -0,0 +1,72 @@
+# Side-Effects Review — Inbound-Queue Boot-Order Fix
+
+**Tier:** 1 (latent behavior-correctness fix restoring intended behavior — no new capability, no new config key, no new route, no new authority). **Parent principle:** Structure > Willpower / feature-is-alive — a feature that can never construct is a broken feature; this restores the intended construction path and pins it with a regression guard.
+**Files:** src/commands/server.ts, src/core/inboundQueueConfig.ts, tests/unit/resolve-session-pool-stage.test.ts (new), tests/unit/inbound-queue-boot-order.test.ts (new)
+
+## The bug
+
+The Durable Inbound Message Queue (`multiMachine.sessionPool.inboundQueue`, spec `docs/specs/durable-inbound-message-queue.md`) NEVER constructed its engine, regardless of correct config, because of a boot-ordering bug in `src/commands/server.ts`:
+
+- `let _sessionPoolStage: () => string = () => 'dark';` — a module-level stub initialized to always return `'dark'`.
+- The inbound-queue engine construction is gated `if (qcfg.enabled && _sessionPoolStage() !== 'dark') { … _inboundQueue = new QueueDrainLoop(…) … }`, running SYNCHRONOUSLY in the mesh boot block (`if (meshIdMgr && meshSelfId)`) inside `startServer()`.
+- The ONLY reassignment of `_sessionPoolStage` to the real (liveConfig-reading) impl executes ~350 lines BELOW that construction site, also synchronously, in the same block.
+
+At construction time the stub is still in force → `_sessionPoolStage()` returns `'dark'` → `'dark' !== 'dark'` is false → the engine never constructs. The same gate guards the `else if (_sweptInboundStore)` cleanup branch. Net: the feature has been inert since it shipped (it ships dark/dry-run by default, so nobody on the fleet hit it). `/pool/queue` returns 503 forever even with `inboundQueue.enabled=true` + a non-dark stage.
+
+## The no-deferrals audit — every `_sessionPoolStage()` call site
+
+Grepped ALL uses of `_sessionPoolStage` in `src/commands/server.ts`. Verdict for each:
+
+| Line (main) | Context | Runs synchronously at boot before the ~16045 reassignment? | Verdict |
+|---|---|---|---|
+| ~443 | `let _sessionPoolStage = () => 'dark'` | n/a (the stub declaration) | the bug SOURCE — left in place by design (runtime handlers legitimately close over it) |
+| ~1992 | inside `wireTelegramRouting` (the per-message inbound dispatch handler) | NO — invoked per-message at runtime, after boot; closes over the ref and sees the wired impl | FINE — not fixed |
+| ~2000 | inside `wireTelegramRouting` (same handler) | NO — same as above | FINE — not fixed |
+| ~14434 | inside the `onAccepted` callback (fires when a forwarded mesh message arrives) | NO — runtime mesh-message handler; closes over the ref | FINE — not fixed |
+| ~15694 | the inbound-queue engine CONSTRUCTION gate | **YES** — synchronous boot read, BEFORE the ~16045 reassignment | **BUGGY — FIXED** |
+| ~16045 | the `_sessionPoolStage = () => {…}` reassignment to the real impl | n/a (the assignment itself; everything after it sees the wired impl) | FINE — refactored to use the shared helper |
+
+Exactly ONE genuinely-premature boot-time read (15694). No sibling premature read left unfixed. The three runtime-handler reads (1992/2000/14434) are correct as-is — they execute only after boot, by which time the ref is wired; the `session-pool-activation-wiring.test.ts` structural test continues to assert those handlers use `_sessionPoolStage()`, and it stays green.
+
+## What changed
+
+1. **`src/core/inboundQueueConfig.ts`** — added a pure helper `resolveSessionPoolStage(cfg)` that returns the configured `stage` only when the pool is BOTH `enabled` AND carries a `stage`, else `'dark'`. This becomes the single source of truth for the stage decision, eliminating the hand-duplicated logic that let the two readers drift. No config types, defaults, or invariants changed.
+2. **`src/commands/server.ts` (construction site, ~15694):** the gate now computes the stage INLINE — `const _sessionPoolStageNow = (() => { try { const live = liveConfig.get('multiMachine.sessionPool', fallback); return iqcMod.resolveSessionPoolStage(live); } catch { return 'dark'; } })();` — mirroring the ~16045 impl exactly (liveConfig override over the static config block), then gates on `qcfg.enabled && _sessionPoolStageNow !== 'dark'`. It no longer consults the not-yet-wired `_sessionPoolStage()` ref.
+3. **`src/commands/server.ts` (the real getter, ~16045):** refactored to call the same `resolveSessionPoolStage` helper (dynamic-imported at that site, matching the file's existing dynamic-import pattern) instead of its own inline copy of the logic. Behavior identical; now DRY with the boot gate.
+4. **Tests (new):** `tests/unit/resolve-session-pool-stage.test.ts` (5) proves the resolution logic on both sides of the decision boundary; `tests/unit/inbound-queue-boot-order.test.ts` (5) is the structural regression guard — it asserts the construction gate no longer reads the stub, resolves inline before gating, routes both readers through the shared helper, and leaves the stub declaration intact.
+
+## Blast radius (activation, explicit)
+
+- **Fleet = no-op.** The inbound queue ships `enabled: false` (and `dryRun: true` even when enabled) by default. No fleet agent's behavior changes: with the queue disabled, `qcfg.enabled` is false and the gate short-circuits before the stage is even consulted.
+- **Any agent with `inboundQueue.enabled=true` AND `sessionPool` stage `!== 'dark'`** will now CONSTRUCT the queue engine where before it silently did not. `/pool/queue` flips from 503 to 200. For **Echo** this is the intended **no-dark-on-dev activation** — the dev agent enabling the feature live is the first real exercise of the construction path, which is exactly the path this fixes.
+- **Multi-machine posture:** machine-local construction only. This is a behavior-correctness fix — it changes WHEN an existing local decision is read, not any cross-machine protocol, route, or mesh verb. A single-machine agent that hasn't enabled the queue is wholly unaffected.
+- **No new authority surface.** The construction still requires the full existing gate chain (enabled + non-dark stage + the six config-seam invariants validated by `validateInboundQueueInvariants` + dry-run handling). Nothing about WHAT the queue is allowed to do changed.
+
+## Risk + mitigation
+
+- **Risk:** the inline read disagrees with the live getter (the same drift class that caused the bug). **Mitigation:** both now call the single `resolveSessionPoolStage` helper — there is no second copy of the logic to drift. Pinned by `inbound-queue-boot-order.test.ts` (asserts ≥2 helper callsites) + `resolve-session-pool-stage.test.ts`.
+- **Risk:** a config-read throw at the inline site crashes boot or builds a half-configured queue. **Mitigation:** the inline resolution is try/caught and fails to `'dark'` (the safe, queue-OFF direction = the shipped default), carrying an in-brace `@silent-fallback-ok` justification. Verified against `tests/unit/no-silent-fallbacks.test.ts` (baseline unchanged at 474).
+- **Risk:** the fix accidentally activates the queue on the fleet. **Mitigation:** the `qcfg.enabled` half of the gate is untouched and still defaults false; the fix only corrects the stage half. Fleet default behavior is byte-identical.
+
+## Migration parity
+
+- No agent-installed files changed: no `.claude/settings.json` hooks, no `.instar/config.json` defaults, no CLAUDE.md template section, no hook scripts, no built-in skills. `resolveSessionPoolStage` is a pure code helper consumed only by `server.ts`. No `PostUpdateMigrator` change is needed — existing agents pick up the corrected construction path the moment their server runs the new code.
+
+## Dark-gate line-map
+
+- UNCHANGED. The change touches `src/core/inboundQueueConfig.ts` (a new pure function, no `enabled:` literal) and `src/commands/server.ts` (no `ConfigDefaults.ts` edit). The dark-gate attributor reads `src/core/ConfigDefaults.ts` only and matches `enabled:` lines; no such line shifted. Verified: `tests/unit/lint-dev-agent-dark-gate.test.ts` → 24/24 green, unchanged.
+
+## Rollback
+
+- Revert the two source edits (the inline resolution at the construction site + the helper call at the getter) and delete the helper + the two new test files. The queue reverts to never-constructing (the prior broken-but-inert state). Because the feature ships dark, the revert is a strict no-op on the fleet. No data migration, no durable-state change.
+
+## Tests
+
+- `tests/unit/resolve-session-pool-stage.test.ts` (5) — the stage-resolution logic: enabled+stage→stage; enabled+missing-stage→dark; disabled→dark; empty/null/undefined→dark; non-string stage coerced.
+- `tests/unit/inbound-queue-boot-order.test.ts` (5) — the structural regression guard: the construction gate does not call the stub getter; resolves inline; resolution precedes the gate; both readers use the shared helper; the stub declaration is intact. Fails-before/passes-after verified (4 of 5 assertions fail against pre-fix `server.ts`; all 5 pass against the fix).
+- Existing coverage already proves feature-alive: `tests/integration/inbound-queue-route.test.ts` (engine present → 200, absent → 503) and `tests/e2e/inbound-queue-lifecycle.test.ts` (boot-sweep → construct → drain → /pool/queue 200).
+- Green locally: `npx tsc --noEmit` clean; the two new suites + `session-pool-activation-wiring` + `inbound-queue-route` + `inbound-queue-config` + `no-silent-fallbacks` + `feature-delivery-completeness` + `route-completeness` + `lint-dev-agent-dark-gate` (159 tests) all pass.
+
+## Agent awareness
+
+- No CLAUDE.md change. The inbound queue is already documented in the agent template ("Durable Inbound Message Queue + Hold-for-Stability"); this fix restores the documented behavior rather than adding a capability, so no `generateClaudeMd`/`migrateClaudeMd` change is required (feature-delivery-completeness green — no new tracked section). <!-- tracked: inbound-queue-boot-order-fix -->

package/upgrades/side-effects/slack-updates-channel-slug.md

@@ -0,0 +1,46 @@
+# Side-Effects Review — Slack Updates/Attention channel name slugify
+
+## Change summary
+Caller-side fix in `src/commands/server.ts`: the `ensureSlackUpdatesChannel` and
+`ensureSlackAttentionChannel` boot helpers now slugify the workspace-derived
+channel name before calling `SlackAdapter.createChannel`, via a new shared
+`slugifyChannelName` helper in `src/messaging/slack/sanitize.ts`. Mirrors the
+existing per-session channel slug logic in `SlackAdapter` (`-sess-` path).
+
+## Tier
+Tier 1 — small, low-risk, single-machine Slack-adapter boot-path bugfix. No
+converged spec required.
+
+## Files touched
+- `src/messaging/slack/sanitize.ts` — adds exported `slugifyChannelName(name)`.
+- `src/commands/server.ts` — imports the helper; wraps both `-sys-updates` and
+  `-sys-attention` channel names with it before `createChannel`.
+- `tests/unit/slack-channel-slug.test.ts` — new focused unit test.
+
+## Behavioral side-effects
+- **Channel names on FRESH creation**: a workspace name containing spaces or
+  uppercase now yields a slugified channel (e.g. "SageMind Live Test" →
+  `sagemind-live-test-sys-updates`) instead of a hard failure. For workspaces
+  whose name was already slug-clean (lowercase, no spaces), the produced name is
+  byte-identical to before — no change.
+- **No change to `createChannel` / `validateChannelName`**: the validate-and-throw
+  behavior other callers depend on is untouched; the fix only ensures these two
+  callers never hand it an invalid name.
+- **Idempotent at the state layer**: both helpers early-return when their
+  `slack-*-channel` state key is already set, so this only affects the one-time
+  creation path; existing installs that already created a channel are unaffected.
+
+## Migration parity
+- No agent-installed file changed (no `.claude/settings.json` hooks, no
+  `.instar/config.json` defaults, no CLAUDE.md template, no hook scripts, no
+  built-in skills). This is server-side runtime code shipped in the normal
+  build — existing agents receive it on their next update with no migration.
+
+## Rollback
+- Revert the squash commit. The change is self-contained (one helper + two call
+  sites + one test); no data migration, no state schema change, nothing to undo.
+
+## Blast radius
+- Limited to the Slack adapter boot path. Telegram / WhatsApp / iMessage and all
+  non-Slack code paths are untouched. Dark-gate config line-map unchanged (no
+  ConfigDefaults edit).