instar 1.3.569 → 1.3.571

package/dist/core/ws2SendWiring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws2SendWiring.js","sourceRoot":"","sources":["../../src/core/ws2SendWiring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;+CAE+C;AAC/C,MAAM,CAAC,MAAM,qBAAqB,GAA0B,MAAM,CAAC,MAAM,CAAC;IACxE,WAAW;CACZ,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA0B,MAAM,CAAC,MAAM,CAAC;IAC1E,eAAe;IACf,WAAW;IACX,kBAAkB;IAClB,cAAc;IACd,eAAe;IACf,aAAa;CACd,CAAC,CAAC;AAKH,wDAAwD;AACxD,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,qBAAqB,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAC1D,IAAI,uBAAuB,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO,cAAc,CAAC;AACxB,CAAC;AAWD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,gBAAuC;IACxE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;aACrC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;YAC9C,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;AACzE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.569",
+  "version": "1.3.571",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-15T06:43:57.537Z",
-  "instarVersion": "1.3.569",
+  "generatedAt": "2026-06-15T09:28:36.949Z",
+  "instarVersion": "1.3.571",
   "entryCount": 201,
   "entries": {
     "hook:session-start": {

package/upgrades/1.3.570.md

@@ -0,0 +1,69 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+When an agent runs on more than one machine, each machine advertises which kinds of
+records it can durably RECEIVE (its `stateSyncReceive` capability, carried inside
+`seamlessnessFlags` on the machine-pool heartbeat). Before a machine replicates a record
+to a peer, the flag-coherence gate checks that the peer advertises it can receive that
+kind — otherwise it withholds, because the journal applier silently drops unknown kinds.
+
+That peer advert was being DROPPED on the receive side, so every machine saw its peers as
+having zero receive capability and the gate blocked replication in both directions.
+Root-caused live on a Laptop↔Mac-Mini pair (2026-06-14): each machine's `GET /pool` showed
+itself with its full receive-key set but every peer with 0.
+
+The fix is three receive-side changes, plus a regression guard:
+
+- **`src/core/PeerPresencePuller.ts`** — extracted the peer `session-status` narrowing into a
+  single exported pure helper, `narrowSessionStatusToPeerCapacity`, that now passes
+  `seamlessnessFlags` through (it had been dropped, exactly like commitmentsAdvert in #930,
+  quotaState in A2/#804, and preferencesAdvert in WS2.1 — this is the fourth instance of the
+  same "narrowing return forgets a field" class). Added the field to the `PeerCapacity`
+  interface and the `recordHeartbeat` dependency signature, and forwarded it in `pullOnce`.
+  Added an exported `SESSION_STATUS_ADVERT_FIELDS` registry that drives the regression test.
+- **`src/commands/server.ts`** — `fetchPeerCapacity` now delegates to that shared helper
+  (keeping only the closure-bound journal-advert unwrap), so production and the round-trip
+  integration test run ONE mapping instead of a hand-copied mirror.
+- **`src/core/MachinePoolRegistry.ts`** — `recordHeartbeat` now carries a peer's
+  `seamlessnessFlags` forward when a beat omits it (the same pattern guardPosture already
+  uses), so the 30-second sparse liveness heartbeat can no longer wipe an HTTP-pulled advert.
+  A genuine withdrawal (a present object with a flag flipped) still propagates.
+
+The sender side already emitted the advert (via `getCapacity(self)`), so no sender change was
+needed. The whole path ships behind the already-merged WS2 stateSync substrate; a
+single-machine install is a strict no-op.
+
+## What to Tell Your User
+
+If you run your agent on more than one computer — say a laptop and a desktop — it is supposed
+to share what it learns between them. That sharing was silently blocked: each machine could
+not see that the other was ready to receive, so neither ever sent. This release fixes that.
+Each machine now correctly sees its peers' readiness, and the pool view shows real peer
+capability instead of a blank. If you only run on one machine, nothing changes for you. After
+updating on both machines, you can confirm it works by saving a learning on one machine and
+reading it on the other.
+
+## Summary of New Capabilities
+
+No new user-facing capability or configuration — this is a correctness fix to an existing,
+default-off multi-machine feature. It removes a silent block so cross-machine memory
+replication can actually take effect once the feature is enabled. The pool view now shows each
+peer's real receive-capability set instead of zero.
+
+## Evidence
+
+- Unit: `tests/unit/peer-presence-puller.test.ts` — the shared helper preserves every advert
+  field in `SESSION_STATUS_ADVERT_FIELDS` (a forgotten field fails loudly); presence-guard,
+  not truthiness, so an all-disabled object survives; the puller forwards `seamlessnessFlags`.
+- Unit: `tests/unit/MachinePoolRegistry.test.ts` — a sparse liveness beat does not wipe a
+  pulled `seamlessnessFlags`; a genuine withdrawal still propagates; the carry-forward is
+  scoped to `seamlessnessFlags` (quotaState still clears) and is per-peer (correct for N≥1).
+- Integration: `tests/integration/peer-presence-roundtrip.test.ts` — over a real signed
+  `/mesh/rpc` round-trip using the SHARED production mapping, a peer's advertised
+  `stateSyncReceive` lands in the puller's pool registry and SURVIVES a subsequent sparse beat.
+- Spec + convergence: `docs/specs/STATESYNC-PEER-ADVERT-PROPAGATION-FIX-SPEC.md`
+  (review-convergence, approved; codex-cli gpt-5.5 + gemini-cli gemini-2.5-pro external passes).

package/upgrades/1.3.571.md

@@ -0,0 +1,64 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: minor -->
+
+## What Changed
+
+The send half of multi-machine memory replication is now wired. The WS2 substrate
+shipped the replicated-kind registry, the receive/apply machinery, and the
+capability advert, but the journal-backed emitter that the per-store managers' write
+hooks call was never constructed — so memory records were never written to the
+coherence-journal own-streams, and a peer had nothing to pull (root-caused live on a
+Laptop↔Mac-Mini pair).
+
+This change adds the generic, store-agnostic `ReplicatedRecordEmitter` (HLC tick +
+last-writer-witness + the store's record builder + journal append, behind the
+per-store dark gate), closes the three matching gaps so a record crosses end-to-end —
+the journal can now append/validate a `*-record` kind, the applier accepts a peer's
+`*-record` instead of suspect-flagging the stream, and the union read materializes
+own + peer journal streams (so a received record is readable) — and replaces the
+snapshot-serve `loadOwnEntries` stub with a real own-stream loader. The first kind,
+`learnings`, is wired end-to-end; the remaining memory stores follow on the same
+machinery (tracked in the send-wiring manifest). A wiring-integrity ratchet now fails
+CI if a future replicated kind is added receive-only with no send path.
+
+Everything is gated behind the per-store multi-machine memory-sync switch (off by
+default; the development-agent gate flips it live on a dev agent only). Records ride
+the existing journal-sync tail and pull — no new HTTP route or mesh verb.
+
+## What to Tell Your User
+
+- **Cross-machine memory (lessons) now actually crosses**: "If you run me on more than
+  one machine, a lesson I learn on one is now known on the others — one shared learning
+  registry instead of one per machine. A copy from another machine is always treated as
+  a hint, never as the boss: it never silently overwrites what this machine already
+  believes, and if two machines disagree I surface both and flag it for you. It stays
+  off until you ask me to turn on multi-machine memory sync."
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Cross-machine replication of learned lessons (learnings) | Automatic once multi-machine memory sync is enabled for the store (off by default) |
+| A received peer memory is readable through the no-clobber union read | Automatic (read path) |
+| Snapshot serve returns real own-stream entries | Automatic (bootstrap path) |
+| Wiring-integrity ratchet — no new kind can ship receive-only | CI test (automatic) |
+
+## Evidence
+
+The live gap: after the receive-advert fix (#1167) deployed to both machines, a
+learning written on the Laptop never appeared on the Mac-Mini after 5+ minutes; the
+Laptop's coherence-journal meta listed only the 5 lifecycle kinds — none of the 7 WS2
+record kinds — proving no record was ever emitted to an own-stream.
+
+Verified by a two-instance in-process E2E
+(tests/e2e/ws2-learnings-cross-instance.test.ts): a learning written on instance A,
+shipped over the real journal serve/apply path, is read back on instance B through the
+bypass-proof union reader as a foreign-origin record; a markApplied edit replicates and
+the latest wins; the same lesson learned on both machines collapses to one record key
+across origins. Before this change B's union read returned null (the reproduced bug);
+after, it returns A's record. Plus integration (serve→apply→read, forged-batch
+rejection, snapshot serve returns entries) and unit coverage (emitter dark-gate /
+witness-order / throw-isolation, journal record append + op-key dedup + 80 KB cap, peer
+stream materialization). 32 new tests, all green.

package/upgrades/side-effects/statesync-peer-advert-propagation-fix.md

@@ -0,0 +1,125 @@
+# Side-Effects Review — Fix: peer stateSync receive-advert dropped → cross-machine memory replication never crosses
+
+**Version / slug:** `statesync-peer-advert-propagation-fix`
+**Date:** `2026-06-15`
+**Author:** `echo`
+**Second-pass reviewer:** `echo (independent reviewer subagent — Phase 5; touches a coherence gate's input)`
+**Spec:** `docs/specs/STATESYNC-PEER-ADVERT-PROPAGATION-FIX-SPEC.md` (review-convergence + approved; codex/gemini external passes)
+**Parent principle:** Cross-Machine Coherence — One Agent, Robust Under Degraded Conditions
+
+## Summary of the change
+
+A peer's `seamlessnessFlags` advert (the carrier of `stateSyncReceive` — which replicated
+kinds a machine can durably receive) was emitted by the sender but DROPPED on the receive
+side, so the flag-coherence gate read every peer as "cannot receive" and blocked
+cross-machine replication in both directions (root-caused live Laptop↔Mini, 2026-06-14).
+Three receive-side files: `src/core/PeerPresencePuller.ts` (new exported pure helper
+`narrowSessionStatusToPeerCapacity` + `PeerCapacity` field + `recordHeartbeat` dep +
+`pullOnce` forward + `SESSION_STATUS_ADVERT_FIELDS` registry), `src/commands/server.ts`
+(`fetchPeerCapacity` delegates to the shared helper), `src/core/MachinePoolRegistry.ts`
+(`recordHeartbeat` carries `seamlessnessFlags` forward on a beat that omits it). No new
+decision point — this FEEDS the existing `checkPoolFlagCoherence` / `shouldEmitToPeer` gate
+with the data it was missing.
+
+## Decision-point inventory
+
+- `checkPoolFlagCoherence` / `shouldEmitToPeer` (`src/core/ReplicatedRecordEnvelope.ts`) — **pass-through (feeds, does not modify)** — the gate already exists and already reads `peer.stateSyncReceive`; this change makes that field actually arrive. No gate logic changed.
+- `MachinePoolRegistry.recordHeartbeat` carry-forward — **modify (data retention)** — carries the last pulled `seamlessnessFlags` across a beat that omits it; not a block/allow decision, a freshness-of-observation rule mirroring the existing `guardPosture` carry-forward.
+- `narrowSessionStatusToPeerCapacity` — **add (pure data-narrowing helper, no decision logic)** — extracted from the inline `fetchPeerCapacity` so production + tests share one mapping.
+
+---
+
+## 1. Over-block
+
+**What legitimate inputs does this change reject that it shouldn't?**
+
+No block/allow surface is added. The change REMOVES an unintended over-block: before it, a
+peer that was genuinely receive-capable was treated as not, so legitimate replication was
+withheld. The carry-forward never fabricates capability where none was pulled (the "no prior
+pull → sparse beat does not fabricate" unit test pins this), so it cannot over-advertise.
+
+## 2. Under-block
+
+**What failure modes does this still miss?**
+
+`quotaState` and `inboundQueue` ride the same light-beat clobber and are NOT carry-forwarded
+here — but both are fail-open (absent = not-blocked / depth-unknown), so a transient wipe is
+benign (bounded to ~one 30s beat, self-correcting on the next rich pull). Scoping the
+carry-forward to the fail-CLOSED `seamlessnessFlags` is deliberate; the fail-open siblings are
+tracked (`<!-- tracked: CMT-statesync-lightbeat-carryforward -->`). A genuinely offline peer
+still ages out of `online` via `routerReceivedAtMs`, so a stale carried advert is never acted
+on as a live one.
+
+## 3. Level-of-abstraction fit
+
+**Is this at the right layer?**
+
+Yes. The narrowing belongs in the receive mapping (`PeerPresencePuller`), the carry-forward
+belongs in the registry that owns the per-machine observation (`MachinePoolRegistry`, beside
+the identical `guardPosture` carry-forward), and the gate that consumes the advert
+(`ReplicatedRecordEnvelope`) is untouched. Extracting the inline narrowing into a shared pure
+helper raises a hard-to-test closure into a unit-testable function — the correct layer for the
+regression guard the recurring bug class demands.
+
+## 4. Signal vs authority compliance
+
+**Does this hold blocking authority with brittle logic, or feed a smart gate?**
+
+It FEEDS. The change adds no blocking authority. The flag-coherence gate
+(`checkPoolFlagCoherence` / `shouldEmitToPeer`) is the existing authority; this change only
+delivers the peer-advert signal it was already designed to read. Per
+`docs/signal-vs-authority.md`, this is a signal-delivery fix, not a new gate. The helper is a
+pure data map; the carry-forward is a freshness rule, not a decision.
+
+## 5. Interactions
+
+**Does it shadow another check, get shadowed, double-fire, race?**
+
+Two writers race on each peer's registry entry every 30s: the rich `PeerPresencePuller.pullOnce`
+and the sparse `refreshPool` liveness echo. Before the fix the sparse beat clobbered the rich
+advert; the carry-forward resolves that race deterministically (omission → keep prior). It does
+NOT shadow `guardPosture` (separate field, separate carry-forward) or `quotaState` (intentionally
+still clears). The shared helper means `server.ts:fetchPeerCapacity` and the round-trip test can
+never drift apart (the gap that let this bug hide from the existing test).
+
+## 6. External surfaces
+
+**Does it change anything visible to other agents/users/systems?**
+
+`GET /pool` now shows each peer's real `seamlessnessFlags.stateSyncReceive` instead of an empty
+0 — a more-correct read, no schema change (the field was already in the `MachineCapacity` type
+and the assemble output; it was simply always undefined for peers). No new route, no new MeshRpc
+verb. The peer advert is fixed-size booleans from an Ed25519-authenticated registered peer,
+stored as-is exactly like its `quotaState`/`guardPosture` siblings — no new untrusted surface.
+Old peers that never advertise are treated as non-participants (the conservative side), unchanged.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+This change IS the cross-machine path. Posture: **replicated-capability advert** — the peer's
+receive capability crosses via the existing signed `session-status` mesh pull and is recorded
+per-peer in `MachinePoolRegistry`. Correct for N ≥ 1 peers: `checkPoolFlagCoherence` iterates all
+online peers with no pairwise/"exactly 2" assumption; each peer is an independent registry Map
+entry (pinned by the per-peer carry-forward unit test). No LAN assumption, no broadcast. No
+user-facing notice, no durable-state-on-transfer, no generated URL involved.
+
+## 8. Rollback cost
+
+Low. Pure runtime code fix in three files, no config/schema/migration. Back-out is a plain
+revert of the commit — the prior behavior (peers read as non-receiving, replication withheld)
+is the safe-but-broken state this fixes, so reverting cannot cause data loss, only re-disable
+the (default-off) replication path. No data migration, no agent-state repair.
+
+---
+
+## Second-pass review
+
+**Concur with the review.** Independent reviewer audited the artifact against the actual
+`git diff src/ tests/` and verified: (1) no new gate/block logic — `ReplicatedRecordEnvelope.ts`
+untouched, the change only feeds the existing flag-coherence gate; (2) the carry-forward in
+`MachinePoolRegistry.recordHeartbeat` is correctly scoped to `seamlessnessFlags` only and does
+not alter `quotaState`/`guardPosture`/`inboundQueue` handling (`quotaState` still clears on a
+sparse beat); (3) the shared helper uses `!== undefined` presence guards so an all-disabled
+`{ stateSyncReceive: {} }` survives, and preserves all six advert fields with the same shape as
+the old inline mapping (none dropped or added); (4) `server.ts` preserves the `journalAdvert`
+unwrap (computed locally with `machineId` context, then passed to the helper and re-emitted
+unconditionally, identical to the old inline return). No missed side effect identified.

package/upgrades/side-effects/ws2-send-side-emission.md

@@ -0,0 +1,40 @@
+# Side-Effects Review — WS2 send-side emission (wire the journal-backed replicated-record emitter)
+
+**Spec:** docs/specs/WS2-SEND-SIDE-EMISSION-SPEC.md (converged + approved — operator pre-approval, Justin topic 13481, the multi-machine memory-replication headline). **Parent:** Cross-Machine Coherence — One Agent, Robust Under Degraded Conditions.
+**Ships DARK** behind `multiMachine.stateSync.<store>.enabled` (default false; the dev-agent gate flips it live on a dev agent only). Single-machine installs, and any agent with the stores off, are a strict no-op.
+**Files:** src/core/ReplicatedRecordEmitter.ts (new), src/core/ReplicatedPeerStreamReader.ts (new), src/core/ws2SendWiring.ts (new), src/core/CoherenceJournal.ts, src/core/JournalSyncApplier.ts, src/commands/server.ts.
+
+## What changed
+
+1. **ReplicatedRecordEmitter.ts (new):** the generic, store-agnostic, journal-backed emitter the per-store managers' existing `emitPut`/`emitDelete` hooks call. One `emit(store, recordKey, build)` path: dark gate → degenerate-key guard → `observed` witness → HLC tick → store builder → `journal.emitReplicatedRecord`. Never throws into the manager (a builder/journal fault is a counted no-op). Single-origin by construction (stamps `origin = this machine`).
+2. **ReplicatedPeerStreamReader.ts (new):** materializes the union's per-origin records from the OWN journal stream + every peer replica stream (`peers/<M>.<kind>.jsonl`, quarantine/meta excluded), validated through `validateReplicatedEnvelope` + the store schema, folded to the latest per (origin, recordKey) by HLC. Supplies three seams: `loadOriginRecords`/`listRecordKeys` (the union reader), `loadWitness` (the emitter's `observed` source), and `loadOwnEntries` (the snapshot-serve source — replaces the `() => ({})` stub).
+3. **ws2SendWiring.ts (new):** the send-wiring manifest (WIRED vs PENDING stores) + the `auditWs2SendWiring` ratchet — every registered replicated kind must be consciously classified, so a future kind cannot be added receive-only with a silent no-op SEND half.
+4. **CoherenceJournal.ts:** optional `setReplicatedKindRegistry`; new public `emitReplicatedRecord(kind, data)` (validates a registered `*-record` kind through the generic envelope validator, op-key = `recordKey:hlcKey`); the `validate()` switch gains ONE branch delegating a registered replicated kind to `validateReplicatedEnvelope`; the per-entry byte cap is per-kind (80 KB for `*-record` kinds, the 8 KB lifecycle cap unchanged). Absent registry ⇒ byte-identical prior behavior.
+5. **JournalSyncApplier.ts:** optional `setReplicatedKindRegistry` (+ config option); `validateData()` delegates a registered replicated kind to `validateReplicatedEnvelope`; the per-entry size cap is per-kind (matching the writer). Without the registry a peer's `*-record` would `invalid`-flag the stream — the receive-only gap; with it, the record applies on the existing tail transport.
+6. **server.ts:** constructs (when the coherence journal is live) the peer-stream reader + a persisted HLC clock + the generic emitter; injects the now-populated registry into BOTH the journal writer and the applier; replaces the `loadOwnEntries` stub with the reader; switches the `learnings` union reader to read own + peer journal streams; attaches the learnings emitter adapter to `EvolutionManager.setLearningReplicationEmitter`.
+
+## Blast radius
+
+- **Config-gated, not wiring-gated.** With `multiMachine.stateSync.learnings.enabled` false (the fleet default), the emitter is a strict no-op (the dark gate returns before any tick/append), so no `*-record` stream is ever written and the union read is byte-identical to today. The seams are always constructed (so the feature turns on without a restart-to-rewire) but do nothing until the store is enabled.
+- **No new HTTP route, no new MeshRpc verb.** Records ride the EXISTING `journal-sync` tail (`buildServeBatch` serve + `apply` receive) and the EXISTING receiver-driven `PeerPresencePuller.driveJournalDelta` (which already pulls every advertised kind). The `state-snapshot` serve verb (already wired) now returns real entries via the real `loadOwnEntries`.
+- **Single-origin + first-hop binding unchanged.** The emitter stamps `origin = this machine`; the applier's first-hop binding (`entry.machine === sender`) still rejects a forged cross-origin record. A peer's record lands only in its own `peers/<M>.<kind>.jsonl` namespace; the union read keeps origins separate and never writes a foreign record back into the local manager store (read-only union, no origin laundering).
+- **No-clobber read.** A received record is read through the existing `ReplicatedStoreReader` + `UnionReader` (append-both-and-flag for high-impact); a replicated record never clobbers a divergent local one. The conflict ledger + dropped-origin exclusion are untouched.
+
+## Risk + mitigation
+
+- **Risk:** a replication emit fault breaks a local memory write. **Mitigation:** the emitter catches every builder/journal throw (counted in stats), and the managers' hooks were already try-wrapped — the durable local write is persisted before the emit hook runs. Proven by the "catches a builder/journal throw" unit tests.
+- **Risk:** a wrong `observed` witness marks a genuinely-concurrent pair as sequential (a silent clobber). **Mitigation:** the witness is the MAX HLC over records PROVABLY on disk, read BEFORE the tick — it can only ever under-witness (a not-yet-pulled peer version is absent ⇒ the pair flags concurrent, the err-toward-flag safe direction). Proven by the witness-order unit test.
+- **Risk:** a fat-but-legal learning is dropped as oversize. **Mitigation:** the per-entry byte cap is raised to 80 KB for `*-record` kinds on BOTH the writer and the applier (the store builders already cap `data` at 64 KB), so a record the writer emits is never rejected on receive. Proven by the 20 KB-description journal test.
+- **Risk:** a future kind is added receive-only again (the exact original gap). **Mitigation:** the wiring-integrity ratchet (`auditWs2SendWiring`) fails CI if any registered store is neither send-wired nor explicitly send-pending.
+
+## Migration parity
+
+- No agent-installed files change. The feature is server-internal and activates on the next restart of an agent whose `multiMachine.stateSync.<store>` is enabled (the dev-agent gate decides for a dev agent). No `migrateConfig` / `migrateClaudeMd` / `migrateHooks` change is required for the dark slice; CLAUDE.md awareness lands when a kind is flipped on for the fleet (a later rollout step).
+
+## Dark-gate line-map
+
+- UNCHANGED. This PR adds no new `enabled:` line to `ConfigDefaults.ts` — the per-store stateSync flags already exist there (omitted `enabled`, resolved by the dev-agent gate, shipped in the WS2.x substrate PRs). The emitter reads the SAME resolved `_stateSyncStoresResolved` map. `node scripts/lint-dev-agent-dark-gate.js` stays clean.
+
+## Rollback
+
+- Revert the PR (or set `multiMachine.stateSync.learnings.enabled: false`). The emitter goes dark, no `*-record` streams are written, the union read returns to own-only/no-op, and any already-replicated peer replica files age out under the journal's per-kind retention. No durable migration to unwind.