instar 1.3.584 → 1.3.586

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-15T23:28:58.740Z",
-  "instarVersion": "1.3.584",
+  "generatedAt": "2026-06-16T00:12:28.453Z",
+  "instarVersion": "1.3.586",
   "entryCount": 201,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "03c42d60209c63e78352050a07406acbd9d4674044449e6a153d8bf671357dee",
+      "contentHash": "f25efb874f94ac6c3825e6ef5dee658670a80c6540d38bbb35f285a694295e3f",
       "since": "2025-01-01"
     },
     "cli:init": {

package/upgrades/1.3.585.md

@@ -0,0 +1,48 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+When an inbound message gets stranded mid-turn (the machine handling it crashed or was handed off),
+recovery re-runs it a few times, then gives up. Previously "give up" did nothing useful: the message
+was **silently dropped** (the user never told) AND it stayed marked "being-worked-on", so the
+recovery routine kept re-finding it and logging `stuck-recovery: giving up … after 3 attempts` every
+~10 minutes, indefinitely (observed firing for hours on the same entries).
+
+Now an exhausted entry is **terminally abandoned** and **announced**: a new terminal `abandoned`
+state in `MessageProcessingLedger` (`markAbandoned`) moves it out of `processing` — so `reclaimStuck`
+stops re-selecting it (the log-loop ends), `beginProcessing` refuses to revive it, and a provider
+redelivery of the same event is dropped (a genuine resend uses a fresh dedupeKey). It leaves
+`reply_committed_at` NULL, so it never masquerades as a real reply. `recoverStuckMessages` surfaces
+abandoned entries and the server emits one per-topic loss notice.
+
+## What to Tell Your User
+
+- **No more silently-dropped messages**: "If I ever can't finish handling something you sent — say my
+  machine crashed mid-thought — I'll now tell you plainly that I didn't get to it and ask you to
+  resend, instead of leaving you waiting on a reply that never comes."
+- **A quieter, healthier system**: "I also fixed a case where I'd keep silently retrying the same
+  failed message every few minutes, forever. Now I close it out cleanly the first time."
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Honest loss notice when a stuck message is abandoned | automatic (posted to the affected conversation) |
+| Stuck-recovery give-up no longer loops or drops silently | automatic |
+
+## Evidence
+
+Reproduction (live, 2026-06-15): `logs/server.log` showed `stuck-recovery: giving up on
+telegram:21487:990487 after 3 attempts` (plus two sibling entries) firing on a ~10-minute cadence for
+hours (19:07 → 20:11+), because the give-up branch did `skipped++; continue` — leaving the entry in
+`processing` so `reclaimStuck` re-selected it every cycle, with no user notice.
+
+After the fix (verified by 30/30 ledger + recovery unit tests, both sides of the boundary): an
+exhausted entry is marked `abandoned` (state asserted terminal, `replyCommittedAt` NULL,
+`hasReplyCommittedForTopicSince` still false, `reclaimStuck` no longer returns it), surfaced in
+`result.abandoned`, and a subsequent recovery pass neither re-selects nor re-surfaces it — the
+10-minute log-loop is gone and exactly one "resend anything still needed" notice is emitted per
+abandoned entry. tsc clean.

package/upgrades/1.3.586.md

@@ -0,0 +1,76 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+An internal correction to the stop-gate's autonomous-run detection. The gate that
+decides whether a stopping session is a registered autonomous run was reading only
+an old single-file convention that modern runs no longer write — so a run that
+registered itself per-topic was invisible to the gate and got treated as a plain
+idle session, defeating the revive-it-later safety net.
+
+The read now follows a fixed precedence chain: the canonical per-topic registration
+under the .instar autonomous directory first, then the .instar legacy single-file,
+then the oldest .claude legacy single-file. autonomousActive is true if any exists.
+
+To check the per-topic path the server now resolves the serving topic itself: it
+maps the Claude session id to its tmux session name via the session manager, then
+inverts the topic-session registry on that name — the same inversion the bash stop
+hook already uses. A resolution miss (no session record, corrupt or missing
+registry, unknown name) explicitly falls back to the legacy paths and NEVER silently
+returns a false negative — the no-silent-fallback boundary, annotated and covered by
+tests on both sides.
+
+This is the deterministic read-path fix. The dev-gated registration-guard that
+auto-writes a registration stub when a run starts without one is a distinct change
+specified separately in the spec's PR2 section.
+
+`scripts/safe-merge.mjs` gained a `--auto` flag: it arms GitHub native
+auto-merge (`gh pr merge --auto`) and returns immediately, instead of polling
+the PR's checks until a deadline and force-merging with `--admin`. Native
+auto-merge lets GitHub merge the PR the instant every required check passes —
+it bypasses no check (strictly safer than `--admin`, which it then has to
+re-impose) and it never times out (the failure mode that wedged hot-branch
+merges: the poll watcher gets killed at ~18min before slow CI finishes).
+
+`--auto` and `--admin` are mutually exclusive (parser-enforced). New exit code
+`5 = auto-merge-armed` (distinct from `0 = merged-confirmed`). The existing
+`--admin` synchronous path is byte-untouched and remains the fallback for repos
+without "Allow auto-merge" enabled.
+
+## What to Tell Your User
+
+Your autonomous runs are now recognized more reliably when a session stops. The check that
+decides whether a stopping session is a real autonomous run used to look only at an old
+location that current runs no longer write, so a run that had registered itself could be
+mistaken for an idle session. It now looks at the modern per-run location first and falls
+back to the older ones, and it figures out which conversation it is looking at on its own.
+If it cannot tell, it still checks the older locations rather than assuming the run is idle.
+You do not need to do anything; this just makes the autonomous safety net harder to miss.
+
+## Summary of New Capabilities
+
+No new capabilities or APIs. This is a correctness fix to an existing internal check —
+behavior only, fully backwards compatible, and reversible.
+
+## Evidence
+
+- tsc clean; full lint clean (no-silent-fallbacks ratchet green over the annotated catches).
+- 38 tests green across tests/unit/stopGate.test.ts (D1 precedence, the D2 unresolved-topic boundary both sides, and the resolveTopicForTmux registry inversion) and tests/integration/stop-gate-autonomous-topic-resolution.test.ts (the full HTTP hot-path UUID to tmux to topic resolution).
+- Server-only change — no agent-installed file touched, so no migration parity is required.
+
+Side-effects review: upgrades/side-effects/autonomous-run-registration-guarantee.md
+
+- `scripts/safe-merge.mjs`: new `--auto` flag, mutual-exclusion guard,
+  `native-auto-merge` capability + `autoMergeArmed:5` exit code, and the
+  arm-and-confirm block in `main()` (early-returns before the poll loop, so the
+  `--admin` path is unaffected).
+- `tests/unit/safe-merge-hardening.test.ts`: +4 tests (parses `--auto`, defaults
+  off, rejects `--auto --admin` both orders, capabilities exposes the new
+  feature + exit code). 29/29 green.
+- Second-pass review (merge machinery): CONCUR.
+
+Follow-up (separately spec'd, NOT in this PR): switch the green-pr-automerge
+watcher (`MergeRunner`) to `--auto` so the automated path also stops timing out.

package/upgrades/side-effects/autonomous-run-registration-guarantee.md

@@ -0,0 +1,40 @@
+# Side-Effects Review — Autonomous-Run Registration Guarantee (GAP-B, PR1)
+
+**Spec:** docs/specs/autonomous-run-registration-guarantee.md (converged R1 + approved — operator full pre-approval, Justin 2026-06-15). **Parent:** An Autonomous Run Must Outlive Its Session.
+**Scope:** PR1 only — the deterministic read-path correction (D1 precedence chain + D2 server-side topic resolution). Ships LIVE (no flag; a pure accuracy fix to an existing read).
+**Files:** src/server/stopGate.ts, src/server/routes.ts, tests/unit/stopGate.test.ts, tests/integration/stop-gate-autonomous-topic-resolution.test.ts
+
+## What changed
+
+1. **stopGate.ts (`readAutonomousActive`):** replaced the single oldest-legacy-path existence check with a fixed precedence chain — (1) the per-topic canonical path .instar/autonomous/TOPIC.local.md, only when a topicId resolves; (2) the .instar legacy single-file; (3) the .claude oldest-legacy single-file. autonomousActive is true if ANY exists. The historical autonomousStateFile override still wins as the sole path read (back-compat). New optional HotPathInputs fields: topicId and stateRoot.
+2. **stopGate.ts (`resolveTopicForTmux`, new exported pure fn):** inverts topic-session-registry.json's topicToSession map on a tmux name — the SAME inversion the bash stop hook uses. Pure, injectable reader, fail-open to null on any read/parse error.
+3. **routes.ts (`resolveTopicForStopGate` helper + two getHotPathState callsites):** resolves the Claude session UUID to its tmux name via the session manager's claudeSessionId record, then to a topicId via resolveTopicForTmux, and passes topicId + stateRoot into both hot-path reads.
+
+## Blast radius
+
+Server-only. The single behavior touched is the stop-gate's autonomousActive read — which it computes for two consumers: the hot-path stop decision input and the StopNotifier unattended-session gate. No agent-installed file changed; no new HTTP route, no new config key, no new state file, no schema change. A single-machine or non-autonomous agent simply reads the same three paths and gets the same answer it would expect.
+
+## Reversibility
+
+Fully reversible. This is a read-path change with no persisted side effects — nothing is written, migrated, or stamped. Reverting the two source files restores the prior single-path read exactly; there is no on-disk state to unwind.
+
+## Signal vs authority
+
+The stop-gate's autonomousActive is a SIGNAL that informs the stop decision and the unattended-notice gate — it is not itself an authority that blocks or commits anything. This change adds NO new authority: it makes the existing signal MORE accurate by reading the canonical per-topic path a modern autonomous run actually writes. It never blocks a message, never gates a session, never spawns or kills anything. A more-accurate "this is an autonomous run" reading only changes whether the existing revive/notify machinery engages — the machinery's own authorities are unchanged.
+
+## Failure modes
+
+The one boundary that matters is the topic-resolution miss (no session record, corrupt/missing registry, unknown tmux name). It resolves to undefined/null and the read falls back EXPLICITLY to both legacy paths — it can never coerce a miss into a silent autonomousActive:false (the no-silent-fallbacks ratchet). Three @silent-fallback-ok catches are annotated and justified: a session-manager read failure (resolver returns undefined → legacy fallback), a per-path stat error (the chain continues to the next path, never short-circuiting the whole read), and a corrupt/missing registry (resolveTopicForTmux returns null → legacy fallback). All three are test-covered on both sides of the boundary.
+
+## Migration parity
+
+NONE required. No agent-installed file changed — this is server code only (the stop-gate read and the route resolver). Existing agents pick up the corrected read the moment their server runs the new code; there is no .claude/settings.json hook, .instar/config.json default, CLAUDE.md section, hook script, or built-in skill to migrate.
+
+## Tests
+
+- tests/unit/stopGate.test.ts — D1 precedence (per-topic wins; a different topic does not activate; fall-through to each legacy path; none-exist false; topic-less still reads both legacy paths; override-is-sole-path back-compat) and the D2 unresolved-topic boundary both sides (HIT reads per-topic; MISS-with-legacy stays true; MISS-with-nothing is the genuinely-inactive false) plus resolveTopicForTmux inversion (hit, unknown-name miss, null/empty, corrupt-registry fail-open).
+- tests/integration/stop-gate-autonomous-topic-resolution.test.ts — the full HTTP hot-path: UUID→tmux→topic resolution feeds the canonical per-topic read end to end.
+
+## What's scoped to the follow-on PR
+
+PR1 covers the read-path correction only — the gate now SEES a registration that already exists on disk. The dev-gated registration-guard that auto-writes a TTL-bounded provenance stub when a run starts without one (D3) is specified separately in the spec's PR2 section, with its own dev-gate rollout and sign-off. <!-- tracked: autonomous-run-registration-guarantee -->

package/upgrades/side-effects/safe-merge-native-auto-merge.md

@@ -0,0 +1,92 @@
+# Side-effects review — safe-merge `--auto` (native auto-merge path)
+
+**Change:** add a `--auto` flag to `scripts/safe-merge.mjs` that arms GitHub
+native auto-merge and returns immediately, as an additive alternative to the
+existing `--admin` synchronous poll-and-merge path. Plus unit coverage.
+
+## 1. Over-block (legitimate inputs rejected that shouldn't be)
+None introduced. The new path is opt-in (`--auto`). The one new rejection is the
+incoherent `--auto --admin` combo — that SHOULD be rejected (the two are
+contradictory merge strategies). No existing invocation is affected: every
+current caller passes `--admin` (or neither) and behaves byte-identically.
+
+## 2. Under-block (failure modes still missed)
+The `--auto` path delegates required-check enforcement to GitHub's branch
+protection. If a repo has auto-merge enabled but branch protection is weak/absent
+(no required checks), native auto-merge would merge on mergeable-state alone — but
+that is GitHub's configured posture, not a bypass this script introduces, and it
+is identical to what a human `gh pr merge --auto` would do. The `--admin` path's
+manual re-imposition (e2e-presence, producer-bound floor) intentionally does NOT
+run on `--auto` because GitHub enforces the required contexts itself; on a repo
+with no required contexts there is nothing to enforce either way. Documented in
+the ELI16. Mitigation for instar's own repo: main has 12 required checks, so
+auto-merge waits for all of them.
+
+## 3. Level-of-abstraction fit
+Correct layer: this is the merge-mechanism wrapper, and native auto-merge is a
+merge mechanism. It does not duplicate a higher gate — it DELEGATES to GitHub's
+branch protection (a smarter, platform-level gate) rather than re-implementing
+enforcement in-process. That is the right direction (less brittle in-process
+logic, more native enforcement).
+
+## 4. Signal vs authority compliance
+The act-time authority on the `--auto` path is GitHub's branch protection (it
+decides whether/when to merge). `safe-merge --auto` is a thin arming command +
+honest confirmation reader — it holds no brittle blocking authority of its own;
+it cannot merge anything GitHub's required checks haven't cleared. This is MORE
+aligned with signal-vs-authority than `--admin` (which bypasses the authority and
+then re-imposes it in brittle script logic). No new in-process gate is created.
+
+## 5. Interactions (shadowing, double-fire, races)
+- Does not shadow or get shadowed by the `--admin` path — they are mutually
+  exclusive (parser-enforced) and the `--auto` branch returns before the poll
+  loop is reached.
+- No double-merge: arming auto-merge is idempotent (re-arming an armed PR is a
+  no-op on GitHub); the independent confirmation reports `merged`/`armed`/error
+  honestly.
+- The dangerous-command-guard does NOT block `gh pr merge --auto` (verified
+  live 2026-06-15: `--auto` only QUEUES, it does not merge-before-green) — so the
+  arming command runs without tripping the #539-outage guard.
+- `--match-head-commit` interaction: when an explicit SHA is supplied it is
+  passed through to `gh pr merge --auto`, so a moved head cancels the arming
+  (GitHub behavior), consistent with the head-pin intent. When NO explicit SHA is
+  supplied, the head is intentionally NOT pinned on the `--auto` path — native
+  auto-merge re-evaluates required checks against whatever the head becomes, so a
+  post-arming push simply makes GitHub wait for the new head's checks; it cannot
+  merge an unverified head. (This differs from the `--admin` path, which always
+  pins; the difference is sound under native enforcement.)
+
+## 6. External surfaces
+- Changes the script's CLI contract (new `--auto` flag, new feature
+  `native-auto-merge`, new exit code `5 = autoMergeArmed`) — surfaced in
+  `--capabilities` and asserted in tests, so a caller probing the contract sees
+  it.
+- Depends on the repo having "Allow auto-merge" enabled (enabled on
+  JKHeadley/instar 2026-06-15). On a repo without it, arming fails with a clear
+  `refused:auto-arm-<cls>` + a message naming the missing setting — an honest
+  refusal, never a silent degrade, and the `--admin` path remains the fallback.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+**Machine-local BY DESIGN.** `safe-merge.mjs` is a stateless CLI invoked
+synchronously by whichever machine runs it; it holds no durable state, opens no
+topic, generates no URL. The arming call targets GitHub (a shared external
+authority), so the outcome is identical regardless of which machine arms it —
+and GitHub de-dupes (arming an already-armed PR is a no-op), so two machines
+arming the same PR cannot double-merge. No replication or proxied-read needed.
+
+## 8. Rollback cost
+Trivial. The flag is additive; reverting the commit removes `--auto` and leaves
+the untouched `--admin` path. No data migration, no state repair, no fleet
+coordination. At the repo level, `allow_auto_merge` can be toggled back off in
+one API call / settings click if ever undesired (independent of this code).
+
+## Second-pass review (required — touches merge machinery)
+
+Second-pass: CONCUR — the `if (args.auto)` block early-returns before the poll
+loop so the `--admin` path is behavior-identical, the independent `pr view`
+re-read only claims `merged`/`armed` on a real `MERGED`/`autoMergeRequest` state
+and otherwise exits 2 (no false success), and mutual-exclusion + exit codes are
+correct; the only weakening is the author-disclosed branch-protection delegation
+(§2), which is bounded — it adds no bypass and is moot on JKHeadley/instar's 12
+required checks, so "strictly safer than --admin" holds wherever required checks
+exist. (Reviewer's §5 doc-precision nit on head-pinning was applied above.)