instar 1.3.672 → 1.3.674

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.672",
+  "version": "1.3.674",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-26T08:03:29.818Z",
-  "instarVersion": "1.3.672",
+  "generatedAt": "2026-06-26T09:54:44.118Z",
+  "instarVersion": "1.3.674",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "b4db46b3171f84b9c8bc2aa3580c8bd4ac1e98ab36f89470d1cee78dfb4bd9f3",
+      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
       "since": "2025-01-01"
     },
     "cli:init": {
@@ -1530,7 +1530,7 @@
       "type": "subsystem",
       "domain": "server",
       "sourcePath": "src/server/AgentServer.ts",
-      "contentHash": "7b17ecb4fd95c868ed3f4da3c50948d3d6a5665e842e39d58f0e5845ce5daea3",
+      "contentHash": "a73492206f14f63eeed51a76c183fa717f5ff6cf4585ec19925bff6fc241b6fa",
       "since": "2025-01-01"
     },
     "subsystem:session-manager": {

package/upgrades/1.3.673.md

@@ -0,0 +1,50 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Added `EnforcedTerminationWatchdog` — an external, level-triggered loop that hard-stops an
+autonomous run which has provably overrun its budget. It is the structural counterweight to
+the `AutonomousLivenessReconciler`: that keeps a run *alive* across vessel events; this keeps
+a run from *outliving its budget*. Previously the only deadline enforcement was the run's own
+in-hook Stop-event check — which a wedged/looping session never reaches, an unbounded run has
+no budget for, and an unparseable timestamp fails toward keep-running. That gap let an
+autonomous run with a 24h budget run ~46h (topic 27515, 2026-06-25). The watchdog reuses the
+reconciler's proven `settleKill` path plus the operator-stop record + resume-queue cancel, so
+a terminated run is durable and not revived; it gates out inactive/paused/mid-move runs, fires
+only on a provable overrun, requires a two-tick confirm, fails safe on uncertainty, caps
+actuations per window, and audits every transition to `logs/enforced-termination.jsonl`.
+
+Constitution: *The User Experience Is the Product* → sub-standard #2 (Enforced Termination);
+"Structure beats Willpower" applied to the END of work.
+
+## What to Tell Your User
+
+Nothing yet — this ships **dark on the fleet** (dev-agent gated) and **dry-run first** (it
+logs what it *would* stop and actuates nothing until a deliberate flip). It is a safety
+backstop against a runaway autonomous job blowing past its deadline; it has no user-facing
+behavior until an operator enables and live-tests it. Do not announce it as a finished
+capability.
+
+## Summary of New Capabilities
+
+- `GET /autonomous/enforced-termination` — read-only status (enabled/dryRun, grace +
+  ceiling, lastTickAt, pending topics, terminated/would-terminate/cap-exceeded counts). 503
+  when the watchdog is dark/disabled on the agent.
+- Config: `monitoring.enforcedTermination` (`enabled` omitted = dev-gated dark; `dryRun`
+  default true; `graceSeconds` 120; `absoluteCeilingSeconds` 26h; `maxIterations` opt-in;
+  `tickIntervalSec` 120; `maxTerminationsPerWindow` 5).
+- Guard posture: `monitoring.enforcedTermination.enabled` registered on `GET /guards`.
+- Audit: `logs/enforced-termination.jsonl`.
+
+## Evidence
+
+- 41 unit tests green (pure predicate + two-tick confirm: 21; orchestration incl. dryRun
+  never-actuates / fail-safe / cap: 9; read adapters against real files: 9; route
+  alive 200/503: 2), clean full `tsc`.
+- Side-effects review: `upgrades/side-effects/enforced-termination-watchdog.md` (the
+  KILL-path blast-radius analysis; second-pass reviewer verdict required before any
+  `dryRun:false`).
+- Spec: `docs/specs/enforced-termination-watchdog.md`.

package/upgrades/1.3.674.md

@@ -0,0 +1,43 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The durable inbound holding-queue's loss notices ("I didn't get to your messages")
+were delivered to a single internal attention-topic and **silently dropped when that
+topic was unset** — so a held inbound user message could expire AND the user never be
+told (postmortem Failure 3, the "why aren't you responding?" failure). This routes each
+loss notice to the **originating topic** the user actually messaged from (every loss
+item carries its `sessionKey` = topic id), and surfaces LOUDLY (`console.error`) the one
+residual case where a loss has no resolvable topic and no attention topic is configured.
+A lost inbound message is now never silently expired.
+
+New pure router `planInboundLossNotices` (`src/core/inboundLossRouting.ts`, unit-tested)
++ a `notifyInboundLoss` helper in server.ts, applied to all 5 inbound-queue loss sites.
+Constitution: *The User Experience Is the Product* → sub-standard #3.
+
+## What to Tell Your User
+
+Nothing changes day-to-day — the inbound holding-queue ships **dark** (off by default),
+so this code only runs when it is deliberately enabled. The guarantee it adds: when the
+queue IS in use and can't deliver one of your messages, you hear about it **in your own
+conversation**, not in a side channel you might never see. A message you send either
+gets through or you're told it didn't — never silence.
+
+## Summary of New Capabilities
+
+- Inbound-queue loss notices now route to the originating topic (per-user, in their
+  conversation) instead of a single attention topic.
+- A loss with no resolvable topic and no attention topic configured is surfaced loudly
+  (error log) instead of silently dropped.
+- No new config, route, or surface; no behavior change while the inbound queue is dark.
+
+## Evidence
+
+- 6 unit tests for the pure router (`tests/unit/inboundLossRouting.test.ts`) — originating-topic
+  routing, unresolved counting, zero/negative/non-numeric → unresolved, deterministic order.
+- Full `npm run lint` (tsc + ~20 lint scripts) exits 0; clean tsc.
+- Side-effects review: `upgrades/side-effects/inbound-delivery-sacred.md`.
+- Spec: `docs/specs/inbound-delivery-sacred.md`.

package/upgrades/side-effects/enforced-termination-watchdog.md

@@ -0,0 +1,95 @@
+# Side-Effects Review — Enforced Termination Watchdog (Postmortem F2)
+
+**Version / slug:** `enforced-termination-watchdog`
+**Date:** `2026-06-26`
+**Author:** `Echo (instar-dev agent)`
+**Second-pass reviewer:** `required (an autonomous-process KILL path + a new monitoring loop) — verdict appended at the end`
+
+## Summary of the change
+
+A new monitoring loop, `EnforcedTerminationWatchdog`, that **externally hard-stops an
+autonomous run which has provably overrun its budget** — the counterweight to the
+`AutonomousLivenessReconciler` (which keeps a run *alive*). It exists because on
+2026-06-25 an autonomous run (topic 27515) with a hard 24h budget ran ~46h: the only
+deadline enforcement was the run's OWN in-hook Stop-event check, which a wedged/looping
+session never reaches, which an unbounded run has no budget for, and which fails toward
+keep-running on an unparseable timestamp. This is "Structure beats Willpower" applied to
+the END of work. Constitution: *The User Experience Is the Product* → sub-standard #2.
+
+## What it touches (blast radius)
+
+- **NEW files only for the logic**: `src/monitoring/enforcedTermination.ts` (pure
+  predicate + two-tick confirmer), `EnforcedTerminationWatchdog.ts` (loop),
+  `enforcedTerminationWiring.ts` (read adapters + audit). No existing module's behavior
+  changes.
+- **`src/commands/server.ts`**: constructs + starts the watchdog in the existing
+  queue-started scope (alongside the reconciler). The durable-kill actuator **reuses the
+  exact primitives the reconciler's `settleKill` already uses** — it adds NO new
+  session-killing code path.
+- **`AgentServer.ts` / `routes.ts`**: a function-typed status getter threaded for the
+  read-only `GET /autonomous/enforced-termination` route. No mutation surface added.
+
+## The dangerous side effect: it KILLS sessions. How it is bounded.
+
+1. **Off by default, dry-run first.** `monitoring.enforcedTermination.enabled` is OMITTED
+   from `ConfigDefaults` → the dev-agent gate resolves it (dark on the fleet); `dryRun`
+   defaults `true` → it LOGS `would-terminate` and actuates NOTHING until a deliberate
+   `dryRun:false`. A fleet agent is a strict no-op.
+2. **Only a provable budget overrun.** `computeOverrun` fires solely on time-budget+grace,
+   an absolute ceiling (26h), or an opt-in iteration ceiling — and gates OUT inactive,
+   paused, and mid-move runs. It is NOT a pressure/idle reaper; it never kills a run inside
+   its budget.
+3. **Two-tick confirm.** A kill requires the SAME topic overrun on two consecutive ticks,
+   absorbing a clock blip / an in-flight cooperative stop / a just-completed run.
+4. **Fail-safe on uncertainty.** Every predicate failure (unreadable state, malformed
+   snapshot, a `listRuns` throw) swallows toward NO actuation. The watchdog never kills on
+   ambiguity.
+5. **Per-window cap.** A flapping detector gives up LOUDLY (`cap-exceeded`, audited) rather
+   than kill-loop (P19).
+6. **The kill is durable AND non-reviving.** The actuator composes, in order: delete the
+   state file (`stopAutonomousTopic`), record the operator-stop (`recordOperatorStop`),
+   cancel queued resumes (`rq.cancelByTopic`), then clear `endedMidWork` and `killSession`
+   (the reconciler's `settleKill` path). So neither the liveness reconciler nor the resume
+   queue revives a deliberately-terminated run — and the generation guard still lets a
+   genuinely-NEW run on the same topic start later.
+7. **Full audit.** Every transition → `logs/enforced-termination.jsonl` (rotating). The
+   guard posture is registered (`GET /guards`), so a silently-off watchdog is visible.
+
+## What it does NOT do
+
+- Does not touch legacy single-file (non-per-topic) jobs.
+- A real termination is NOT silent (spec §3): the actuator posts one plain-English notice
+  to the run's topic on a real stop ("I stopped the autonomous run … it ran past its time
+  budget …"). It fires only outside dryRun (etTerminate is never called in dryRun), so a
+  dark/dryRun agent emits nothing. Best-effort (a notice failure never blocks the stop).
+- Does not change the cooperative in-hook duration check; it is the EXTERNAL backstop the
+  grace window defers to.
+
+## Rollback
+
+Set `monitoring.enforcedTermination.enabled: false` (or leave it omitted) — the watchdog
+is not constructed and the route 503s. No migration, no persisted state to unwind beyond
+the append-only audit log.
+
+## Second-pass reviewer verdict
+
+**Concur with the review** (independent reviewer, 2026-06-26 — verified the artifact's claims
+against the actual code, not just the prose).
+
+Verified: `computeOverrun` returns null for `!active||paused||moveSuspended` BEFORE any time
+check (enforcedTermination.ts:87); time-budget fires only at `elapsed >= duration+grace`; every
+uncertainty path (listRuns throw, computeOverrun throw, audit throw) fails toward NO actuation;
+the two-tick confirm is genuinely enforced (only `confirmer.reconcile()` output actuates, streak
+resets when a topic drops out); the durable kill composes delete-state-file → recordOperatorStop
+→ rq.cancelByTopic → clear endedMidWork → killSession in that order (server.ts etTerminate),
+mirroring the reconciler's proven settleKill, so a terminated run is not revived; and it is
+genuinely dark (absent from ConfigDefaults → not even constructed on the fleet) + dryRun-first
+(the dryRun path audits then `continue`s, never calling terminate). Cap bounds actuations to 5
+per ~2h window.
+
+Residual observation (NON-blocking, intended semantics): a doubly-corrupt run (unparseable
+`started_at` AND unreadable mtime → fileMtimeMs=0) classifies as past the absolute ceiling and
+fails TOWARD a kill — the deliberate, spec-documented inverse of the 27515 "fails toward
+run-forever" bug. It remains gated behind active+unpaused+not-moving + two-tick confirm + dryRun
++ dev-gate, so it is the intended fail-direction, not a hole — worth keeping visible when the §5
+live-flip battery runs.