instar 1.3.586 → 1.3.588

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-16T00:12:28.453Z",
-  "instarVersion": "1.3.586",
+  "generatedAt": "2026-06-16T04:42:24.637Z",
+  "instarVersion": "1.3.588",
   "entryCount": 201,
   "entries": {
     "hook:session-start": {
@@ -11,7 +11,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/session-start.sh",
-      "contentHash": "6514d29ddd92b5c74e0a2a3c4a4bf59abef87c83008b881a42fd1c01398533b6",
+      "contentHash": "0a4291b73a00cf3d53aa583991e023077ccb206a395a917b7541eb11715062de",
       "since": "2025-01-01"
     },
     "hook:dangerous-command-guard": {
@@ -20,7 +20,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/dangerous-command-guard.sh",
-      "contentHash": "6514d29ddd92b5c74e0a2a3c4a4bf59abef87c83008b881a42fd1c01398533b6",
+      "contentHash": "0a4291b73a00cf3d53aa583991e023077ccb206a395a917b7541eb11715062de",
       "since": "2025-01-01"
     },
     "hook:grounding-before-messaging": {
@@ -29,7 +29,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/grounding-before-messaging.sh",
-      "contentHash": "6514d29ddd92b5c74e0a2a3c4a4bf59abef87c83008b881a42fd1c01398533b6",
+      "contentHash": "0a4291b73a00cf3d53aa583991e023077ccb206a395a917b7541eb11715062de",
       "since": "2025-01-01"
     },
     "hook:compaction-recovery": {
@@ -38,7 +38,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/compaction-recovery.sh",
-      "contentHash": "6514d29ddd92b5c74e0a2a3c4a4bf59abef87c83008b881a42fd1c01398533b6",
+      "contentHash": "0a4291b73a00cf3d53aa583991e023077ccb206a395a917b7541eb11715062de",
       "since": "2025-01-01"
     },
     "hook:external-operation-gate": {
@@ -47,7 +47,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-operation-gate.js",
-      "contentHash": "6514d29ddd92b5c74e0a2a3c4a4bf59abef87c83008b881a42fd1c01398533b6",
+      "contentHash": "0a4291b73a00cf3d53aa583991e023077ccb206a395a917b7541eb11715062de",
       "since": "2025-01-01"
     },
     "hook:deferral-detector": {
@@ -56,7 +56,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/deferral-detector.js",
-      "contentHash": "6514d29ddd92b5c74e0a2a3c4a4bf59abef87c83008b881a42fd1c01398533b6",
+      "contentHash": "0a4291b73a00cf3d53aa583991e023077ccb206a395a917b7541eb11715062de",
       "since": "2025-01-01"
     },
     "hook:self-stop-guard": {
@@ -65,7 +65,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/self-stop-guard.js",
-      "contentHash": "6514d29ddd92b5c74e0a2a3c4a4bf59abef87c83008b881a42fd1c01398533b6",
+      "contentHash": "0a4291b73a00cf3d53aa583991e023077ccb206a395a917b7541eb11715062de",
       "since": "2025-01-01"
     },
     "hook:post-action-reflection": {
@@ -74,7 +74,7 @@
       "domain": "evolution",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/post-action-reflection.js",
-      "contentHash": "6514d29ddd92b5c74e0a2a3c4a4bf59abef87c83008b881a42fd1c01398533b6",
+      "contentHash": "0a4291b73a00cf3d53aa583991e023077ccb206a395a917b7541eb11715062de",
       "since": "2025-01-01"
     },
     "hook:external-communication-guard": {
@@ -83,7 +83,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-communication-guard.js",
-      "contentHash": "6514d29ddd92b5c74e0a2a3c4a4bf59abef87c83008b881a42fd1c01398533b6",
+      "contentHash": "0a4291b73a00cf3d53aa583991e023077ccb206a395a917b7541eb11715062de",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-collector": {
@@ -92,7 +92,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-collector.js",
-      "contentHash": "6514d29ddd92b5c74e0a2a3c4a4bf59abef87c83008b881a42fd1c01398533b6",
+      "contentHash": "0a4291b73a00cf3d53aa583991e023077ccb206a395a917b7541eb11715062de",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-checkpoint": {
@@ -101,7 +101,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-checkpoint.js",
-      "contentHash": "6514d29ddd92b5c74e0a2a3c4a4bf59abef87c83008b881a42fd1c01398533b6",
+      "contentHash": "0a4291b73a00cf3d53aa583991e023077ccb206a395a917b7541eb11715062de",
       "since": "2025-01-01"
     },
     "hook:free-text-guard": {
@@ -110,7 +110,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/free-text-guard.sh",
-      "contentHash": "6514d29ddd92b5c74e0a2a3c4a4bf59abef87c83008b881a42fd1c01398533b6",
+      "contentHash": "0a4291b73a00cf3d53aa583991e023077ccb206a395a917b7541eb11715062de",
       "since": "2025-01-01"
     },
     "hook:claim-intercept": {
@@ -119,7 +119,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept.js",
-      "contentHash": "6514d29ddd92b5c74e0a2a3c4a4bf59abef87c83008b881a42fd1c01398533b6",
+      "contentHash": "0a4291b73a00cf3d53aa583991e023077ccb206a395a917b7541eb11715062de",
       "since": "2025-01-01"
     },
     "hook:claim-intercept-response": {
@@ -128,7 +128,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept-response.js",
-      "contentHash": "6514d29ddd92b5c74e0a2a3c4a4bf59abef87c83008b881a42fd1c01398533b6",
+      "contentHash": "0a4291b73a00cf3d53aa583991e023077ccb206a395a917b7541eb11715062de",
       "since": "2025-01-01"
     },
     "hook:stop-gate-router": {
@@ -137,7 +137,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/stop-gate-router.js",
-      "contentHash": "6514d29ddd92b5c74e0a2a3c4a4bf59abef87c83008b881a42fd1c01398533b6",
+      "contentHash": "0a4291b73a00cf3d53aa583991e023077ccb206a395a917b7541eb11715062de",
       "since": "2025-01-01"
     },
     "hook:auto-approve-permissions": {
@@ -146,7 +146,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/auto-approve-permissions.js",
-      "contentHash": "6514d29ddd92b5c74e0a2a3c4a4bf59abef87c83008b881a42fd1c01398533b6",
+      "contentHash": "0a4291b73a00cf3d53aa583991e023077ccb206a395a917b7541eb11715062de",
       "since": "2025-01-01"
     },
     "job:health-check": {
@@ -1554,7 +1554,7 @@
       "type": "subsystem",
       "domain": "updates",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
-      "contentHash": "6514d29ddd92b5c74e0a2a3c4a4bf59abef87c83008b881a42fd1c01398533b6",
+      "contentHash": "0a4291b73a00cf3d53aa583991e023077ccb206a395a917b7541eb11715062de",
       "since": "2025-01-01"
     },
     "subsystem:scheduler": {

package/src/scaffold/templates.ts

@@ -833,10 +833,10 @@ ${PLAYWRIGHT_PROFILE_REGISTRY_CLAUDEMD_SECTION(port)}
 - Check: \`curl -H "Authorization: Bearer $AUTH" "http://localhost:${port}/parallel-work/activities"\` → \`{ count, runningCount, activities: [{ topicId, focus, tags, running, updatedAt }] }\`.
 - **When to use** (PROACTIVE): before starting substantial new work in a topic, glance here to see if another topic is already on it; when the user asks "what am I working on across topics?" / "is another session already doing this?". (The proactive overlap councilor — ParallelWorkSentinel — is Phase B, ships dark.) Read-only; never gates. Spec: \`docs/specs/parallel-activity-coherence.md\`.
 
-**Per-Component Framework Routing** — Run different INTERNAL components on different agentic frameworks to spread LLM load off a single account's rate limit. For example: you run on Claude Code, but ALL your sentinels/gates run on Codex — so that background chatter stops spending your Claude quota. Model "size" is preserved automatically (a \`fast\` check becomes Haiku on Claude or a small GPT model on Codex). Routing is opt-in; with no config, everything stays on your default framework.
-- See current routing: \`curl -H "Authorization: Bearer $AUTH" "http://localhost:${port}/intelligence/routing"\` → \`{ defaultFramework, components: [{ component, category, framework, available }], coverage }\`.
-- Turn it on in \`.instar/config.json\` → \`sessions.componentFrameworks\`, e.g. \`{ "categories": { "sentinel": "codex-cli", "gate": "codex-cli" }, "overrides": { "CoherenceReviewer": "claude-code" }, "fallback": "default" }\`. Categories: \`sentinel | gate | job | reflector | other\`. Resolution: \`overrides[name] → categories[category] → default\`. Frameworks: \`claude-code | codex-cli | gemini-cli | pi-cli\` (pi-cli is the pi agent harness — additive, requires the \`pi\` binary + \`enabledFrameworks\` opt-in; its component-routing provider lands in PI-HARNESS-INTEGRATION-SPEC Phase B/C).
-- Each framework gets its own circuit breaker (a Claude trip can't pause Codex). If a routed framework's CLI is missing it degrades to the default and reports it; if it's just rate-limited the component falls back to its heuristic (no herd onto the default). Routes INTERNAL component calls only — spawned interactive sessions stay governed by \`topicFrameworks\`.
+**Per-Component Framework Routing** — Your internal background components (sentinels, gates, reflectors) **run off Claude by default**: with no \`componentFrameworks\` set, they auto-route to the first ACTIVE off-Claude CLI in the preference chain \`codex-cli → pi-cli → gemini-cli → claude-code\` (Claude last), so that background chatter stops spending your Claude quota and a single provider's bad night can't strangle the agent. The remaining active frameworks become an ordered failure-swap tail: when a *gating* call's primary provider fails at runtime, it swaps DOWN the active chain (each circuit-checked) before falling closed — never silently degrading to a brittle heuristic. Model "size" is preserved automatically (a \`fast\` check becomes Haiku on Claude or a small GPT model on Codex). On a Claude-only agent (no off-Claude CLI installed) the default is a no-op — everything stays on Claude, byte-identical to before.
+- See current routing: \`curl -H "Authorization: Bearer $AUTH" "http://localhost:${port}/intelligence/routing"\` → \`{ defaultFramework, components: [{ component, category, framework, available }], coverage }\`. On a Codex-active agent, sentinel/gate/reflector resolve to \`codex-cli\`; \`job\` (cost-bearing background work, e.g. CartographerSweep) stays on the agent default.
+- Override in \`.instar/config.json\` → \`sessions.componentFrameworks\`, e.g. \`{ "categories": { "sentinel": "codex-cli", "gate": "codex-cli" }, "overrides": { "CoherenceReviewer": "claude-code" }, "fallback": "default" }\` — an explicitly-set block is used verbatim (the default no longer applies). Categories: \`sentinel | gate | job | reflector | other\`. Resolution: \`overrides[name] → categories[category] → default\`. Frameworks: \`claude-code | codex-cli | gemini-cli | pi-cli\`. **Rollback lever:** set \`componentFrameworks\` to \`{}\` (explicit empty) to force everything back to the default framework with no swap — today's pre-default behavior.
+- Each framework gets its own circuit breaker (a Claude trip can't pause Codex). If a routed framework's CLI is missing it degrades to the default and reports it. A gating call's failure-swap is bounded by a per-attempt timeout (default 5s, \`intelligence.swapAttemptTimeoutMs\`) so a slow provider is abandoned at the cap, not waited on in full. Routes INTERNAL component calls only — spawned interactive sessions stay governed by \`topicFrameworks\`.
 - **When to use** (PROACTIVE): when the user is hitting rate limits and asks how to spread load, or says "run my sentinels on Codex" / "move the background checks off Claude" → point them at \`sessions.componentFrameworks\` and \`GET /intelligence/routing\`. Restart sessions to apply (config is read into the router at the call path, but a file edit needs the server to pick it up). (Spec: \`docs/specs/per-component-framework-routing.md\`.)
 
 **Topic Profile (per-topic model, thinking, framework pins)** — Every conversation topic can carry a durable profile pinning its BASELINE model (an explicit id OR a tier — never both), thinking depth (\`off\`/\`low\`/\`medium\`/\`high\`/\`max\`), and framework (\`claude-code\`/\`codex-cli\`/…). Pins survive restarts and follow the topic. **The conversational surface is PRIMARY** (PROACTIVE — these are the triggers): when the user says "use codex here", "pin this topic to Fable", or "set high thinking on this topic", that IS the request — propose the change back in plain words, confirm, and the pin is durable from then on. NEVER instruct the user to type \`/topic\`; the \`/topic\` command exists only as a power-user convenience.

package/upgrades/1.3.587.md

@@ -0,0 +1,28 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Instar's internal background LLM work — sentinels, gates, and reflectors — now runs **off Claude by default** when the agent has another provider CLI installed. The agent picks the first available provider in the preference order **Codex → PI → Gemini → Claude**, with the existing failure-swap engine falling down the chain and Claude as the true last resort. A new bounded per-attempt timeout (`intelligence.swapAttemptTimeoutMs`, default 5s) keeps the longer chain from stacking slow providers into the very stall it exists to prevent — a timed-out provider is abandoned and the next one is tried.
+
+The `job` category is deliberately **excluded** (cost-bearing background jobs stay on the agent default). Operators retain full control: an explicit `sessions.componentFrameworks` block wins verbatim, and setting it to `{}` reverts to exactly the prior behavior.
+
+## What to Tell Your User
+
+If your agent has Codex (or another non-Claude CLI) installed, its background safety checks now run off Claude by default — so a Claude outage or a maxed weekly quota can no longer freeze your sentinels, gates, or message delivery. You can see which provider is serving each check in the routing and metrics views, and you can override the routing or revert it entirely any time with one config setting. If you only run Claude, nothing changes — by design.
+
+## Summary of New Capabilities
+
+- Internal sentinels, gates, and reflectors auto-route off Claude via an active-filtered fallback chain (Codex then PI then Gemini then Claude), so no single provider's bad night can strangle the agent.
+- A tunable per-attempt swap timeout keeps the fallback chain fast.
+- A new degrade signal makes a slow provider being abandoned visible in the existing observability surfaces.
+
+## Evidence
+
+- `src/core/internalFrameworkDefault.ts` (new) — the active-filtered policy resolver + the `INTERNAL_FRAMEWORK_PREFERENCE` constant.
+- `src/core/IntelligenceRouter.ts` — `Promise.race` per-attempt swap timeout + `swap-attempt-timeout` degrade signal; fail-open, fail-closed-if-all-down preserved.
+- `src/commands/server.ts` — boot active-set probe + the live-read, layered `resolveConfig` (preserves CartographerSweep's runtime override).
+- 31 new tests (3 unit files 24 green + integration + e2e/wiring-integrity); tsc clean; 14 lints clean; second-pass review concurred.
+- Spec `docs/specs/provider-fallback-default-policy.md` — CONVERGED over 4 review rounds (6 internal lenses + codex/gemini external + conformance gate each).

package/upgrades/1.3.588.md

@@ -0,0 +1,27 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+When an autonomous run is age-limit-reaped, the reaper can now recognize it as live work and revive it even if it was never formally registered — as long as it has a fresh, agent-owned open commitment for the topic AND a recent user message. This closes the exact gap that killed a run overnight: the operator said "go autonomous", the formal state file was never written, and the session died as a plain idle timeout, invisible to all the revival machinery.
+
+The revival path ships dark (off by default; explicit enable, then a dry-run soak before going live). The one live change is that the reaper's "recently messaged" keep-guard — previously inert — now actually works, so a session you messaged recently is kept rather than reaped (always the safe direction). A new, deliberately shared check guarantees the keep-guard and the revive-check always agree, which structurally prevents the kill-then-revive loop that a naive version would re-create.
+
+## What to Tell Your User
+
+If a long autonomous run gets recycled by the reaper while it still has live work, it now revives itself instead of silently dying — even if it was never formally registered. This ships off by default and goes through a careful dry-run soak before it ever revives anything, so nothing changes for you until you turn it on. The only immediately-live improvement is that a session you messaged recently is now reliably kept rather than reaped.
+
+## Summary of New Capabilities
+
+- The reaper revives an unregistered-but-actively-working autonomous run (corroborated by a fresh commitment plus recent activity), instead of letting it die as a plain idle timeout.
+- A previously-inert "recently messaged" keep-guard now actually protects active sessions from the reaper.
+- A shared agreement-check structurally prevents the kill-then-revive loop, so the resilience fix cannot misfire.
+
+## Evidence
+
+- New src/core/gapBCommitmentEvidence.ts — the shared qualifying/freshness/agreement/dark-gate predicates (one source of truth for enqueue + drain so they cannot disagree).
+- src/commands/server.ts — the dark-gated commitment-evidence injection in the reaped path + the inert keep-predicate promoted to real (shared across ReapGuard and SessionReaper).
+- 54 new tests across unit/integration/e2e incl. the anti-loop regression and the dark-no-op; tsc clean; 14 lints clean; independent reaper-class second-pass concurred.
+- Spec docs/specs/autonomous-registration-guarantee.md — converged (2 rounds + a focused Part-D re-converge that caught a build-blocking store error before any code).

package/upgrades/side-effects/autonomous-registration-guarantee.md

@@ -0,0 +1,51 @@
+# Side-Effects Review — Autonomous-Registration Guarantee (GAP-B)
+
+**Spec:** `docs/specs/autonomous-registration-guarantee.md` (CONVERGED 2 rounds + Part-D focused re-converge, approved:true) · P1 GAP-B
+**Change:** revive an UNregistered-but-actively-working autonomous run after an age-limit reap, by injecting commitment-evidence into the reaper's existing eligibility path (Part B, DARK) + promoting the inert `recentUserMessage` KEEP-predicate to real (Part D, the one live part) + an observe-only attention surface (Part A). Part C was already shipped (#1186).
+
+## Phase 1 — Principle check (signal vs authority)
+Touches the reaper eligibility decision, so the principle applies. **No new brittle blocking authority:** Part B injects a *signal* (a fresh qualifying open-commitment) into the **existing** `evidenceEligible`/ResumeQueue authority — it never decides revival itself. Part A is observe-only (an aggregated attention signal). Part D promotes a KEEP-*predicate* (a signal ReapGuard already consults). The load-bearing safety is the **D8 agreement-invariant**: KEEP and the new eligibility compute from ONE shared `recentUserMessage` predicate, so they cannot disagree (the 2026-06-13 13-session loop came from disagreement). Compliant (`docs/signal-vs-authority.md`).
+
+## Phase 2 — Plan
+Built in `.worktrees/gapb-autonomous-registration` (rebased onto current `JKHeadley/main c41b27db5`). Decision points: the `sessionReaped` evidence wiring (gains an additive, dark, corroborated source) + ReapGuard/SessionReaper KEEP behavior (Part D un-stub). Rollback: dark by default (Part B needs explicit `enabled:true`) + revert the PR.
+
+## 1. Over-block
+The change does not block — it injects evidence to REVIVE. The inverse risk is **over-revive** (resurrecting a finished/idle run). Bounded by: the D2 qualifying filter (pending + agent-driven + this-machine + not-beacon-paused), D1 createdAt-freshness (6h), the **D8 agreement** (also needs a recent user message — a stale-per-KEEP commitment can't revive), drain-time D9 re-validation (`commitmentStillActiveForTopic` — a since-closed commitment is invalidated), the existing **resurrection cap** (≤2 resumes/24h/topic, then gives up loudly), and — decisively — Part B ships **DARK** (no injection ⇒ no revival) until `enabled:true`.
+
+## 2. Under-block
+A genuinely-working unregistered run with **no open commitment AND no recent user message** is not revived — the structural registration guarantee (make "go autonomous" always write the state file) is the root fix, an explicitly tracked follow-up (Follow-ups section), not this PR. Part B is a *corroborated* backstop (commitment + recent activity), not a universal catch.
+
+## 3. Level-of-abstraction fit
+Correct layer. The evidence feeds the **existing** `evidenceEligible`/ResumeQueue authority (no parallel revival path; no new WorkEvidence enum value — reuses `build-or-autonomous-active` + a distinct reason tag). Part D shares ONE predicate across all consumers (`gapBCommitmentEvidence.recentUserMessageFromHistory`), so KEEP and eligibility are computed identically — the right place to enforce agreement.
+
+## 4. Signal vs authority compliance
+See Phase 1. No brittle check gains blocking authority. Part B = signal → existing gate; Part A = observe-only; Part D = a shared predicate. Fail-open throughout (D7). Compliant.
+
+## 5. Interactions
+- **The D8 loop-prevention** is the central interaction: ReapGuard's KEEP (`ReapGuard.ts:149`, 8h) and the new eligibility both call the same `recentUserMessage` — verified by the anti-loop regression test (a stale-per-KEEP commitment is NOT eligible).
+- **Part D un-stubs FIVE live sites consistently** via one shared closure spread into the single `reapGuardDeps` object backing BOTH `ReapGuard` (:137 standalone 30min, :149 commitment 8h, :221/:239 terminate-path) AND `SessionReaper` (:489 `staleIdle` inversion). All safe-direction (keep-more) — none makes the reaper kill more.
+- **Drain-time D9** re-checks liveness for `COMMITMENT_ACTIVE_RUN_REASON` (state-file source is untouched, routed by the distinct reason).
+- No double-fire: the commitment branch is mutually exclusive with the state-file branch (PRESENT vs ABSENT).
+
+## 6. External surfaces
+- Part A: ONE aggregated attention signal (`unregistered-autonomous:<topic>`, dedup'd via the existing chokepoint) — only when Part B fires LIVE. No new HTTP route.
+- Reap-log gains an optional `evidenceSource` field (additive, back-compat, no PII — D3).
+- Observable via the existing reap-log; dark by default so no user-visible behavior change until enabled.
+
+## 7. Multi-machine posture
+**Machine-local by design.** Part B's qualifying filter requires `originMachineId` is this machine or absent — a *replicated peer* commitment is advisory data, never revival authority (it can't revive a session on the wrong machine). `recentUserMessage` reads THIS machine's `TelegramAdapter.getTopicHistory`. No replicated/persisted state introduced; the per-topic state file source is unchanged. No generated URL, no cross-machine notice.
+
+## 8. Rollback cost
+Cheap and dark. (a) **Dark by default:** Part B is inert unless `monitoring.resumeQueue.commitmentEvidence.enabled === true`; even when armed it defaults to `dryRun:true` (no spawn). (b) **The one live change** (Part D `recentUserMessage` promotion) is safe-direction (keep-more) and bounded by the window — to revert just that, restore the stub. (c) **Full back-out:** revert the PR — additive code, no data migration, no state repair. The config keys are code-defaulted (absent from ConfigDefaults) so removal is clean.
+
+## No-deferrals (Phase 4.5)
+The structural registration guarantee (root fix) and the stopGate per-topic plumbing are explicitly **tracked** follow-ups (Follow-ups section, `<!-- tracked -->` markers) — Part B is a deliberate *corroborated backstop*, the honest scope, not a partial fix papering over the root.
+
+## Phase 5 — Second-pass review
+*(appended below)*
+**Concur with the review.** An independent reaper-class reviewer verified the load-bearing safety against the real code (file:line), not the artifact:
+- D8 agreement: the SAME closure `recentUserMessageShared` backs both GAP-B eligibility (`gapBCommitmentEvidence.ts:150`) and ReapGuard's commitment KEEP (`ReapGuard.ts:149`/:239), with a single-sourced window (`staleCommitmentWindowMinutes ?? 480`); GAP-B's `commitmentQualifies` is a strict superset-filter of ReapGuard's, so a GAP-B revive structurally implies KEEP would have fired — the 2026-06-13 loop is impossible.
+- Dark containment airtight: armed only on `enabled===true`, dryRun-default-true; dryRun fires the Part A surface only, tags/injects nothing; disarmed skips the cost-bearing eligibility entirely.
+- All 5 `recentUserMessage` sites (ReapGuard 137/149/221/239 + SessionReaper 489) consume the real shared predicate (stub at server.ts removed); tsc-clean proves no mismatch; all safe-direction (keep-more).
+- Fail-open (D7) + D9 drain-revalidation verified both sides (`safeBool(..., true)` → throw resolves still-active, never a wrong drop); multi-machine strand closed by the `originMachineId` local-origin filter.
+- No new failure mode, double-fire (commitment vs state-file branches mutually exclusive), or cross-machine revival risk.

package/upgrades/side-effects/provider-fallback-default-policy.md

@@ -0,0 +1,52 @@
+# Side-Effects Review — Provider-Fallback Default Policy
+
+**Spec:** `docs/specs/provider-fallback-default-policy.md` (CONVERGED 4 rounds, approved:true) · CMT-1554/1555
+**Change:** ship the existing `IntelligenceRouter` failure-swap engine turned ON by default for internal gating/sentinel/reflector components (active-filtered chain Codex→PI→Gemini→Claude), plus a bounded per-attempt swap timeout so the longer default chain cannot re-create the stall it prevents.
+
+## Phase 1 — Principle check (signal vs authority)
+This touches a decision point (which provider serves a gating/safety call), so the principle applies. The change adds **no new brittle blocking authority**: the router's `failureSwap` fail-closed authority already exists and is preserved (it re-throws when primary + every swap target is down → the gating caller fails closed, never a silent brittle heuristic). The new pieces are (a) a default *preference order* (a policy, not an authority) and (b) a **fail-open** per-attempt timeout (timed-out attempt → next target → Claude tail → fail-closed only if all exhausted). The timeout is signal-shaped (abandon-slow → try-next) and cannot turn a fail-closed outcome into a silent pass. Observability rides the existing `DegradationReporter` (`onDegrade` reason `swap-attempt-timeout:<target>`). **Compliant.**
+
+## Phase 2 — Plan
+Built in the existing worktree `.worktrees/provider-fallback-chain` (verified current with `JKHeadley/main @ce13f42a3`; `git remote -v` → JKHeadley; tags `review-convergence`+`approved:true` present). Decision points touched: the router's `failureSwap` (existing authority — preserved). Existing detectors interacted with: `DegradationReporter` (observability), the per-framework circuit breakers (unchanged). Rollback: the no-op guarantee + the `{}` config lever (below).
+
+## 1. Over-block
+The change does not *block* inputs; it routes them to a different provider. The closest "over-block" risk is the §4.5 per-attempt timeout abandoning a provider that *would* have answered correctly just slowly. Mitigated: (a) the cap (5s) only fires on a swap attempt that is already past the failed primary, i.e. in a degraded path; (b) a timed-out attempt is *fail-open* — it advances to the next target and ultimately the Claude tail, never to a denial; (c) the cap is operator-tunable (`intelligence.swapAttemptTimeoutMs`). No legitimate gating decision is rejected — at worst it is served by the next provider or Claude.
+
+## 2. Under-block
+A provider that is reachable but returns **well-formed-but-semantically-wrong** output is not caught (the circuit breaker only trips on errors). This is a **pre-existing property of any LLM gate**, provider-independent, NOT introduced here — and round-3 grounding confirmed the gating *callers* already validate their own output (`MessagingToneGate.parseResponse` fail-opens on malformed JSON + validates the `VALID_RULES` allowlist; `MessageSentinel` try/catch fail-opens). This change only changes *which* provider can serve a weak answer, not the property. Documented (§6.4) as a tracked, non-owed hardening item, not part of this feature's scope.
+
+## 3. Level-of-abstraction fit
+Correct layer. The fallback mechanism, breakers, and gating-scope already live in `IntelligenceRouter` (the right place — one router every internal LLM call already flows through). This change is a thin **policy** computed at the router-construction site (`server.ts`) + one minimal engine touch (the swap-loop timeout). It does not duplicate a smarter gate; it *feeds* the existing `DegradationReporter`/`/metrics/features` observability rather than building a parallel one. The `job` category was deliberately EXCLUDED so a cost-bearing background feature (CartographerSweep) is never auto-armed as a side effect of this policy.
+
+## 4. Signal vs authority compliance
+See Phase 1. No brittle check gains blocking authority. The timeout is fail-open; the only blocking authority (router re-throw → caller fail-closed) is the pre-existing one, unchanged. **Compliant** (`docs/signal-vs-authority.md`).
+
+## 5. Interactions
+- **CartographerSweep** mutates `config.sessions.componentFrameworks` in memory at runtime. The §4.6 resolver reads config **live every call** and layers the computed default UNDER any live override, so CartographerSweep's injection still wins for its slot. A frozen memoized default would have silently disabled the freshness sweep — this was caught in convergence (R3-1) and is the reason the resolver is live-read + layered, with only the active-SET memoized.
+- **Operator-set detection** is snapshotted once at the construction site (which runs before CartographerSweep's auto-vivify — verified ~line 4755 vs ~11331), so a later in-memory auto-vivify cannot masquerade as an operator override and disable the default (M5; covered by a unit test).
+- **Per-framework circuit breakers** (existing): a broadly rate-limited Codex trips its own breaker → gating calls skip it fast, damping any herd onto the Claude tail (§6.2). Non-gating calls are untouched (they propagate to their heuristic — no herd).
+- No double-fire / shadowing: the swap loop is unchanged except for wrapping each attempt in `Promise.race`; the re-throw-if-all-down path is preserved.
+
+## 6. External surfaces
+- `GET /intelligence/routing` and `/metrics/features` now reflect sentinels/gates/reflectors resolving off Claude on agents that have an off-Claude CLI — visible, intended observability (the operator can SEE the routing). No new route added (config-driven).
+- CLAUDE.md template gains the corrected default-behavior text (new agents via `generateClaudeMd`; existing agents via `migrateClaudeMd` appended on the new `run off Claude by default` marker).
+- Depends on runtime condition: which provider CLIs are installed on the machine (active-set). Honestly machine-local (see §7). No timing/conversation-state coupling.
+
+## 7. Multi-machine posture
+**Machine-local BY DESIGN.** The active-set is computed from `buildProvider(fw)!==null` against THIS machine's installed CLIs, at THIS machine's router-construction site, and is **never persisted or replicated** (runtime-computed default, no config block written). So machine A's installed-providers can never pin onto machine B — each machine routes by what it has. `/intelligence/routing` reflects the local machine's resolution (the route reads the local `resolveConfig`). This is the correct posture (a different machine genuinely has different CLIs) and is stated explicitly, not a silent single-machine assumption. No user-facing notice surface (no one-voice concern); no durable state that strands on topic transfer; no generated URL.
+
+## 8. Rollback cost
+Cheap and layered. (a) **No-op guarantee:** an agent with no off-Claude provider resolves to byte-identical-today behavior (claude-only → empty swap). (b) **`{}` lever:** operator sets `sessions.componentFrameworks: {}` → every category resolves to the agent default, empty swap — exactly today's behavior (unit-tested, M7). (c) **Timeout knob:** `intelligence.swapAttemptTimeoutMs` tunes/effectively-disables the cap (set very large). (d) **Full back-out:** revert the PR — purely additive code, no data migration, no agent-state repair (the default is runtime-computed, nothing persisted to roll back).
+
+## No-deferrals (Phase 4.5)
+The one out-of-scope item (semantically-wrong swap-target output, §6.4) is a pre-existing provider-independent property, explicitly NOT this feature's in-scope work, and carries an in-spec `<!-- tracked: -->` marker for No-Deferrals hygiene. No partial fix is shipped.
+
+## Phase 5 — Second-pass review
+**Concur with the review.** An independent reviewer audited the change against the real code (not the artifact's claims) and confirmed each high-risk dimension at named file:line:
+- Fail-open / Signal-vs-Authority: `IntelligenceRouter.ts:212-268` — the cap only races already-degraded swap attempts (`continue` → next → Claude tail); the pre-existing fail-closed re-throw (`throw err`, line 268) and non-gating passthrough (line 206) are unchanged. No new blocking authority.
+- `Promise.race` orphan-safety: `IntelligenceRouter.ts:228-238` uses `await Promise.race([...])` (never a detached handle); the unit test registers a real `unhandledRejection` listener, rejects the abandoned attempt after the cap, and asserts zero unhandled + late-result-not-used.
+- §4.6 live-read+layer + boot-snapshot ordering: `server.ts:4750-4751` snapshots operator-set at construction; `resolveConfig` (4766-4781) reads live + layers computed default UNDER live overrides; CartographerSweep's auto-vivify (`server.ts:11329-11331`) runs later and cannot masquerade as operator-set — its `overrides` survive the layering.
+- M11 honest+sufficient: the reviewer verified the REAL `ExternalOperationGate.consultLLM` (`ExternalOperationGate.ts:509-540`) fails closed (`'show-plan'` on catch) exactly as the test's synthetic fail-closed caller models; `MessagingToneGate` fails OPEN by design (delivery-path), correctly asserted as such.
+- No double-fire/shadow/multi-machine strand: `target===framework` guard prevents re-firing the primary; active-set is machine-local and never persisted; `job` excluded so CartographerSweep's slot is never contended.
+
+Non-blocking observation (already documented in spec §4.6): a runtime `PATCH /config {sessions:{componentFrameworks}}` changes gating routing live (resolveConfig reads live) — operator-scoped + every path fail-opens, so safe.