instar 1.3.633 → 1.3.635

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.633",
+  "version": "1.3.635",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-20T22:29:33.870Z",
-  "instarVersion": "1.3.633",
+  "generatedAt": "2026-06-21T10:22:16.189Z",
+  "instarVersion": "1.3.635",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "e247652ca9c7f1e85815c18205495129ccf360de5410c0b6d50a2863b038bf81",
+      "contentHash": "dd358e22670951895a29a9427c0c6bb9d131542b5d66bf88551373b79873dc67",
       "since": "2025-01-01"
     },
     "cli:init": {
@@ -1586,7 +1586,7 @@
       "type": "subsystem",
       "domain": "monitoring",
       "sourcePath": "src/monitoring/DegradationReporter.ts",
-      "contentHash": "92982f94e8d2df044ca983d1011323719bdcd1a07ec4a181a80b1805375cb1ed",
+      "contentHash": "cafbe8bf319bee2c188c4323f2779b189faba87643f2e29e29d375c2b0c5ceed",
       "since": "2025-01-01"
     },
     "subsystem:telegram-lifeline": {
@@ -1594,7 +1594,7 @@
       "type": "subsystem",
       "domain": "communication",
       "sourcePath": "src/lifeline/TelegramLifeline.ts",
-      "contentHash": "4de84b772c789b564e3e8b955fc572ab41604a43209c3db36196d6474ece2351",
+      "contentHash": "459f66059e04e9893003e593c9a4836ffd5eaad268d73e8277f97993d2bfdbe8",
       "since": "2025-01-01"
     },
     "subsystem:orphan-process-reaper": {
@@ -1618,7 +1618,7 @@
       "type": "subsystem",
       "domain": "coordination",
       "sourcePath": "src/core/MultiMachineCoordinator.ts",
-      "contentHash": "7ff2c287a93bf83d18a2bf6751510a8c5b01534688366d06d4cc76d4864182a3",
+      "contentHash": "8ac73d6d545d82629338e0c72353427cc4448d108bc94c55af2c51c2b41fed9c",
       "since": "2025-01-01"
     },
     "subsystem:backup-manager": {

package/upgrades/1.3.634.md

@@ -0,0 +1,59 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+`FeedbackManager` now treats a `429`/`503` from the canonical feedback endpoint as a
+stop-signal: it HALTS the current retry batch and waits (honoring `Retry-After`, else
+exponential 60s→1h) before POSTing again. Previously `retryUnforwarded()` re-POSTed the
+ENTIRE un-forwarded backlog every scheduled cycle regardless of rate-limiting — against
+a 429-ing endpoint that re-sent the whole backlog forever (observed live: 661 backlog
+items → 2,384+ failed POSTs). A pure `decideFeedbackRetry()` helper makes the cadence
+decision; the local feedback record is always written (nothing is lost or dropped).
+
+Phase 1 of the permanent fixes for the recurring multi-machine failures (double-handling, total silence, the awake/standby lease flap, the clock-skew-broken cross-machine handshake) from the 2026-06-20 audit. Five tightly-coupled fixes to the fenced-lease + Telegram poll-ownership machinery, all **dev-gated / dark-on-fleet** (live-on-dev, dry-run/observe even there), single-machine no-ops, each with a clean kill-switch:
+
+- **B3 — lease renew timer.** A dedicated renew timer at `clamp(leaseTtlMs×0.5,[5s,60s])` so a held lease is renewed (same epoch) before it lapses, fixing the epoch-climb (default TTL 60s < heartbeat tick 120s → re-acquire every tick). Flag `leaseSelfHeal.resilientRenew`.
+- **B4 — skew-immune lease liveness.** The lease's `presumedDeadHolders`/`allPeersPresumedGone` now derive peer liveness from the skew-immune router-observed clock (`routerReceivedAt`) instead of the peer's skew-contaminated `lastSeen` — the flap's root trigger. Plus a `pollingActive` heartbeat field (B5's source). Flag `leaseSelfHeal.skewImmuneLiveness`.
+- **B2 — churn breaker.** Implements the previously-dead `leaseSelfHeal.churnDetector`: on >N role flips it latches deterministically to the preferred-awake role (exactly-one-awake resting state) with a hard cap. Observe-only/dry-run.
+- **B5 — exactly-one-listener decision.** A three-valued (ok/dual/silence/indeterminate) poller-count decision + pool adapter; a dark peer → indeterminate (never a false alarm), and the Telegram 409 conflict is partition-immune dual-poll evidence. Decision core + `pollingActive` heartbeat propagation (the `/guards` row is a follow-up).
+- **B1 — poll-ownership follows the lease.** The server publishes a lease-derived poll-intent file (PID/bootId/ts integrity); the lifeline reconciles its real Telegram poll to it with asymmetric hysteresis (slow-start/instant-stop). Ships dry-run even on dev (changes no ingress); the live flip is gated on the Phase-4 two-host proof + B2/B5 live. Flag `multiMachine.pollFollowsLease`.
+
+No user-facing or fleet behavior changes ship in this PR — every item is dark/dry-run and verified (second-pass, against the live config) unable to disturb the live agent.
+
+## What to Tell Your User
+
+If your agent had been quietly retrying feedback against a busy endpoint, it now backs
+off politely instead of hammering it — fewer wasted network calls and less background
+churn. Nothing you do changes; no feedback is lost (notes are still saved locally and
+sent once the endpoint is ready).
+
+Nothing changes for you yet — this PR is dark-shipped infrastructure. Every fix is OFF on the fleet and runs in observe/dry-run mode even on the development agent, so your agent's behaviour is byte-for-byte unchanged. These are the permanent fixes for the multi-machine glitches (two-of-me answering, occasional silence, the "who's awake" role flip-flopping) but they only switch on after a live two-machine test proves them — at which point a separate release will announce it. If your agent runs on a single machine, this is a complete no-op.
+
+## Summary of New Capabilities
+
+- Rate-limit-aware feedback forwarding: halts on 429/503, honors `Retry-After`, backs
+  off exponentially (capped), and never re-sends the whole backlog against a limited
+  endpoint. Back-compatible on a healthy endpoint (forwards immediately as before).
+
+No new user-facing capabilities ship enabled in this release. Dark/dev-gated infrastructure added (each with an off-switch, single-machine no-op): a lease renew timer (`leaseSelfHeal.resilientRenew`), skew-immune lease liveness (`leaseSelfHeal.skewImmuneLiveness`), a lease-flap circuit-breaker (`leaseSelfHeal.churnDetector`), an exactly-one-Telegram-listener decision + `pollingActive` heartbeat field, and poll-ownership-follows-the-lease (`multiMachine.pollFollowsLease`, dry-run). These graduate to live (and get their own user-facing announcement) only after the Phase-4 live two-host proof.
+
+### Phase 2 #7 (also in this PR)
+Startup config-coherence WARNINGS (never a boot reject): flags `meshTransport.enabled:false` while session transfer is live (the worst-of-both state the 2026-06-20 audit identified) and duplicate/non-positive mesh rope priorities. Logged at boot on multi-machine agents only; single-machine is a no-op. No behaviour change beyond a yellow boot warning.
+
+## Evidence
+
+- New `tests/unit/feedbackBackoff.test.ts` (11 cases): 2xx clears backoff; 429/503 halt
+  + exponential backoff capped at 1h; `Retry-After` honored + capped; non-429 errors
+  retry-next-cycle and PRESERVE the 429 streak (flap protection); junk/negative
+  `Retry-After` rejected.
+- `tests/unit/FeedbackManager.test.ts` (+2 cases): a 429 halts the batch after ONE POST
+  (not the whole backlog) and the next cycle POSTs zero times while backed off; no item
+  lost. Independent second-pass review concurred.
+
+- Spec: `docs/specs/multimachine-lease-poll-robustness.md` (converged via /spec-converge, 2 rounds, 6 reviewers + constitution gate; approved). ELI16: `docs/specs/multimachine-lease-poll-robustness.eli16.md`.
+- ~48 unit tests across `LeaseCoordinator-resilientRenew`, `leaseLiveness`, `churnBreaker`, `pollerCount`, `pollDecision`, `pollIntent` — all green. `tsc --noEmit` clean; dev-gate-dark + SafeFs containment lints clean.
+- Side-effects artifacts (one per increment) in `upgrades/side-effects/mm-lease-poll-robustness-*.md`; each ingress/lease/recovery-touching change had an independent second-pass review (B3's caught + fixed an observe-only-renew edge; B1's lifeline consumer verified dry-run-safe against the live config).
+- Tracks CMT-1710 + the 2026-06-20 multi-machine audit.

package/upgrades/1.3.635.md

@@ -0,0 +1,53 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+`CommitmentTracker.verify()` runs every 60 seconds and checks each active commitment.
+Previously, each check that mutated a commitment rewrote the **entire** commitments
+store to disk (a full `JSON.stringify` of the whole file). On an agent whose store had
+grown large (observed: 1.6MB, ~1,700 commitments), a single 60-second sweep did
+hundreds of full-store serializations back-to-back — enough synchronous work to freeze
+the server's event loop for minutes (health checks timing out, an external watchdog
+restarting the process in a loop).
+
+Now `verify()` batches the whole sweep into **one** store write at the end, and writes
+the store compactly instead of pretty-printed. The per-sweep cost drops from
+"once per commitment" to "once per sweep".
+
+## What to Tell Your User
+
+If your agent ever became briefly unresponsive on a regular cadence — health checks
+failing, the server restarting itself — and you had accumulated a lot of tracked
+commitments, this removes the cause. Nothing changes in how commitments work or what
+gets saved; the agent just stops doing hundreds of redundant full-file saves each
+minute. No action needed.
+
+## Summary of New Capabilities
+
+No new user-facing capability — this is a performance/reliability fix. The commitments
+store is now persisted once per verification sweep (was once per mutated commitment),
+and saved compactly. Existing agents get it via the normal update; the on-disk store
+format is unchanged (still a JSON object, just not pretty-printed).
+
+## Evidence
+
+- New unit test `tests/unit/CommitmentTracker-verify-batches-saves.test.ts`: a sweep
+  over 40 mutated commitments produces exactly **1** store write (was 40); a lone mutate
+  outside a sweep still persists immediately.
+- Live diagnosis on Echo (2026-06-21): a `JSON.stringify` tracer captured
+  `verify → verifyOne → mutateSync → saveStore` re-serializing the 1.6MB store
+  repeatedly within one sweep; after the fix the per-sweep write count is 1 and the
+  multi-minute event-loop freezes shortened.
+
+## What Changed (DegradationReporter reentrancy — same incident)
+
+The "something degraded" reporter could feed itself into an infinite loop: reporting a
+degradation runs a small AI "tone gate" to phrase the alert nicely, but that gate goes through
+the same router that just degraded — so if a configured tool is missing, the gate degrades
+again, which reports again, forever. The growing internal events list, serialized each cycle,
+froze the agent for minutes (the restart "flapping"). Fixed with a reentrancy guard (the gate
+won't run inside itself) plus a hard cap on the events list. Degradations are still logged and
+alerted; the agent just no longer melts down when a configured framework isn't installed.

package/upgrades/side-effects/commitment-tracker-verify-batches-saves.md

@@ -0,0 +1,109 @@
+# Side-Effects Review — CommitmentTracker.verify() batches store saves (event-loop wedge fix)
+
+**Version / slug:** `commitment-tracker-verify-batches-saves`
+**Date:** `2026-06-21`
+**Author:** Echo (autonomous)
+**Second-pass reviewer:** required (touches a core monitoring write path on every agent)
+
+## Summary of the change
+
+`CommitmentTracker.verify()` runs on a 60-second timer. It iterates every *active*
+commitment and mutates each via `mutateSync()`, and **every** `mutateSync()` calls
+`saveStore()`, which does `JSON.stringify(this.store, null, 2)` of the **entire**
+commitments store. With a large store (observed live on Echo: **1.6MB, 1,724
+commitments**, 1,137 of them terminal/never-pruned) and N active commitments, that is
+**O(N) full-store serializations per sweep** — hundreds of 1.6MB pretty-printed
+serializations every 60s. This monopolized the single event-loop thread for **minutes**:
+`/health` returned HTTP 000, and an external watchdog SIGKILL/respawn loop ensued
+(diagnosed 2026-06-21 via a `JSON.stringify` entry-tracer that caught the
+`verify → verifyOne → mutateSync → saveStore` stack firing repeatedly in one sweep).
+
+The fix:
+1. **Batch the sweep's writes.** `verify()` sets a `batchingSaves` flag for the duration
+   of its (fully synchronous) sweep; while set, `saveStore()` marks the store dirty and
+   returns instead of writing. The sweep flushes **exactly one** write at the end. This
+   collapses O(N) serializations to 1 per sweep. Proven by a new unit test: 40 mutated
+   commitments → 1 store write (was 40).
+2. **Compact JSON.** `JSON.stringify(this.store)` (drop `, null, 2`) — the store is a
+   machine-read state file; pretty-printing ~1.6MB was pure serialization + I/O overhead.
+
+## Decision-point inventory
+
+- **Batch scope = the verify() sweep only.** A lone `mutateSync()` outside `verify()`
+  (e.g. from PresenceProxy / PromiseBeacon / a route) still persists immediately —
+  batching is sweep-scoped, asserted by a second unit test. Chosen because `verify()` is
+  the only O(N) caller; broadening batching would risk a non-sweep mutation not landing.
+- **Safety of deferral.** `verify()` is fully synchronous (no `await` between mutations;
+  `verifyConfigChange`/`verifyBehavioral` use `readFileSync`), so the event loop never
+  turns during the deferred window → no concurrent write path can observe or interleave.
+  A crash mid-sweep loses only the in-memory mutations of that sweep, which the next
+  idempotent sweep re-derives — strictly no worse than the prior per-mutation writes.
+- **Compact vs pretty.** Compact chosen; `loadStore()` parses with `JSON.parse` (format
+  agnostic), and the replication peer reader parses the same way. No human/tool consumes
+  the file as formatted text.
+- **NOT in scope (tracked follow-up):** pruning terminal commitments to bound store
+  growth. The batch+compact fix removes the wedge regardless of store size; pruning
+  interacts with the P1.5 replication incarnation/seq machinery and deserves its own
+  reviewed change.
+
+## Roll-up across the seven review dimensions
+
+- **Security:** none — no new inputs, no auth/credential surface, no external I/O change.
+- **Scalability:** the entire point — per-sweep cost goes from O(N × storeSize) to
+  O(storeSize). Removes a fleet-wide event-loop-freeze class as commitment stores grow.
+- **Adversarial:** the deferred-save flag is process-local and reset in a `finally`; a
+  thrown error inside the sweep still flushes and clears the flag.
+- **Integration:** `saveStore()` and `verify()` are internal; the only behavioral change
+  is *fewer* identical writes. The store's on-disk shape is unchanged (still the same
+  JSON object, just compact).
+- **Reliability:** one atomic write per sweep instead of N — fewer fsync/rename cycles,
+  less chance of a partial-write window.
+- **Observability:** unchanged (the `verification` event still emits post-flush).
+- **Migration parity:** pure code path; no installed-file/config/CLAUDE.md change, so no
+  PostUpdateMigrator entry needed. Existing agents get it via the normal dist update.
+
+## Evidence pointers
+
+- New test: `tests/unit/CommitmentTracker-verify-batches-saves.test.ts` (2 cases) — green.
+  Asserts 1 store write per sweep over 40 mutated commitments, and immediate persist for a
+  lone mutate.
+- Live diagnosis: a `JSON.stringify` tracer on Echo's server captured the
+  `CommitmentTracker.saveStore` stack firing repeatedly from `verify()`'s timer; the store
+  was 1.6MB / 1,724 commitments. Post-hotfix the per-sweep write count dropped to 1 and the
+  4+ minute freezes shortened.
+
+---
+
+# Side-Effects Review — DegradationReporter reentrancy wedge (same incident)
+
+**Added 2026-06-21** — the dominant event-loop wedge from the same live investigation.
+
+## Summary
+`DegradationReporter.gateHealthAlert()` runs `toneGate.review()` — an LLM call routed through
+the IntelligenceRouter. When the configured framework is unavailable the router DEGRADES, and
+that degradation re-enters `report → reportEvent → gateHealthAlert` in the same synchronous
+stack — unbounded recursion. Each level pushes another event; a `JSON.stringify` of the growing
+`events` array eventually hangs the single event-loop thread for minutes (observed live: /health
+HTTP 000, watchdog SIGKILL/respawn loop — the dominant cause of Echo's flapping).
+
+## The change
+1. **Reentrancy guard** (`_gatingHealthAlert`): `gateHealthAlert` refuses to gate-within-a-gate,
+   returning the safe template instead of recursing. Breaks the cycle regardless of which
+   framework degrades.
+2. **Bounded `events` array** (`MAX_EVENTS = 500`): defence in depth — the in-memory array can
+   never grow without limit, so whole-array serializations stay cheap.
+
+## Roll-up
+- **Security/Integration/Migration:** none — internal monitoring path; on-disk/event shapes
+  unchanged; degradations are still logged and alerted.
+- **Reliability:** the entire point — removes a fleet-wide event-loop-freeze class. Any agent
+  with an unavailable configured framework would hit this.
+- **Adversarial:** the guard flag is reset in a `finally`; a throw inside the gate still clears it.
+
+## Evidence
+- `tests/unit/degradation-reporter-reentrancy-wedge.test.ts` (3 cases): the guard short-circuits
+  the gate while already gating; a re-entrant tone gate stays bounded (doesn't hang); the events
+  array is capped at 500. All green.
+- Live: captured the hung `JSON.stringify` stack via a write-on-entry/clear-on-return catcher
+  (the call never returns, so profilers can't flush); post-fix verification showed 0 CPU-wedges,
+  0 watchdog SIGKILLs, 200s continuous healthy (was flapping every ~3 min).