instar 1.3.674 → 1.3.676

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.674",
+  "version": "1.3.676",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-26T09:54:44.118Z",
-  "instarVersion": "1.3.674",
+  "generatedAt": "2026-06-26T13:09:14.108Z",
+  "instarVersion": "1.3.676",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "cli:init": {
@@ -1618,7 +1618,7 @@
       "type": "subsystem",
       "domain": "coordination",
       "sourcePath": "src/core/MultiMachineCoordinator.ts",
-      "contentHash": "8ac73d6d545d82629338e0c72353427cc4448d108bc94c55af2c51c2b41fed9c",
+      "contentHash": "7920e0bbe7f86ae0e4b5a2f39c6ef2e0272c3e90f1d8dccf11ced30d8bbcc76a",
       "since": "2025-01-01"
     },
     "subsystem:backup-manager": {

package/upgrades/1.3.675.md

@@ -0,0 +1,26 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+When the mesh "who's-in-charge" lease tick stalls and the in-process watchdog re-arms it, that recovery used to be **silent** (a log line + a `tickStallRecovered` event nobody listened to) — so a >10-min coordination stall was invisible until the user's messages started disappearing (postmortem Failure 6). Now the FIRST re-arm of a stall episode surfaces to the user through the existing `DegradationReporter` path (which already routes to the attention topic), deduped per episode so a single stall surfaces once and a runaway stall remains its own louder self-disarm alarm. The watchdog's recovery decisions are unchanged — only the recovery is made visible.
+
+Constitution: *The User Experience Is the Product* → sub-standard #6. Pure signal-surfacing; no control authority added (the lease-tick re-arm/disarm logic is byte-identical).
+
+## What to Tell Your User
+
+If your multi-machine coordination ever briefly degrades and self-heals, you'll now see a short "this degraded and recovered" note instead of silence — most of the time you'll see nothing, because most of the time nothing stalls. Single-machine setups are unaffected.
+
+## Summary of New Capabilities
+
+- A stalled-and-recovered mesh lease tick surfaces ONE user-visible degradation notice per episode (the previously-silent Failure-6 site).
+- No new config, route, or authority; multi-machine only; single-machine agents are a no-op.
+
+## Evidence
+
+- New unit test in `tests/unit/MultiMachineCoordinator-tickSelfHeal.test.ts`: first re-arm surfaces once, deduped within an episode, resets on a real tick, re-surfaces on a new stall.
+- Full `npm run lint` (tsc + ~20 lint scripts) exits 0.
+- Side-effects review: `upgrades/side-effects/degradation-is-an-event.md` (signal-vs-authority analysis — no control change).
+- Spec: `docs/specs/degradation-is-an-event.md`.

package/upgrades/1.3.676.md

@@ -0,0 +1,45 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The host spawn cap (the fork-bomb/OOM safety floor that bounds how many LLM
+subprocesses run at once) now reserves a little headroom for the user's reply. Under
+load, the user-facing tone gate used to wait in the same undifferentiated line as
+background sentinels and could time out (a cause of the 2026-06-25 silent-outbound
+incident). The cap now SUBDIVIDES into a small interactive reserve + a small background
+reserve, so a synchronous operator reply always has slots and is never starved by
+background chatter. The total cap is NEVER raised — only *who gets which slot* changes.
+Ships dark on the fleet / live on a development agent (dev-agent gate); byte-identical
+to today when off.
+
+## What to Tell Your User
+
+When the machine is busy, your reply's safety check now jumps to a reserved slot instead
+of waiting behind background work — fewer slow/held replies under load. The crash
+protection is exactly as strong as before. Most setups see no change (it's off on the
+fleet for now).
+
+## Summary of New Capabilities
+
+- `attribution.lane:'interactive'` requests reserved headroom — honored ONLY for an
+  allowlisted, user-blocking seam (the operator-facing tone gate); everything else stays
+  background.
+- Symmetric reservation within the existing cap N (`Ri`/`Rb`, default 2/2): interactive
+  guaranteed ≥Ri slots, background guaranteed ≥Rb — neither starves the other.
+- `/spawn-limiter` reports per-lane live counts + the reservation config.
+- Off (the fleet default) ⇒ byte-identical to the all-or-nothing cap (no `lane` written).
+
+## Evidence
+
+- `hostSpawnSemaphore-priority.test.ts` (10): symmetric reserve, OOM floor unconditional,
+  garbage-lane→background-never-dropped, clamp (N=1/N=2/oversized/0), off=byte-identical.
+- `spawn-cap-provider-lane.test.ts` (7): allowlist downgrade (CoherenceReviewer→background),
+  off→background, interactive fast-path, saturated interactive still fails closed,
+  membership pinned.
+- 25 existing spawn-cap tests + 160 tone-gate tests pass unchanged (no regression; the
+  fork-bomb burst-invariant test still green). `tsc --noEmit` clean.
+- Side-effects: `upgrades/side-effects/spawn-cap-interactive-priority.md`.
+- Spec (converged + approved): `docs/specs/spawn-cap-interactive-priority.md`.

package/upgrades/side-effects/degradation-is-an-event.md

@@ -0,0 +1,35 @@
+# Side-Effects Review — Degradation Is an Event (Postmortem F6)
+
+**Version / slug:** `degradation-is-an-event`
+**Date:** `2026-06-26`
+**Author:** `Echo (instar-dev agent)`
+**Second-pass reviewer:** `inline (Phase-5 'watchdog' trigger fires by name, but the change adds NO control authority — analysis below)`
+
+## Summary
+
+In `MultiMachineCoordinator.runTickWatchdog`, surface the FIRST re-arm of a stalled-lease-tick episode to the user via the existing `DegradationReporter.report(...)` (deduped per episode, reset when a real tick resumes). Closes postmortem Failure 6 (a >10-min coordination stall was silently re-armed, log-only).
+
+## The 8 questions
+
+1. **Over-block** — N/A. No gate, no block. It cannot reject anything; it adds a user notice.
+2. **Under-block** — N/A.
+3. **Level-of-abstraction fit** — Correct. The watchdog already DETECTS the stall and recovers it; the only missing thing was surfacing, and the surface (`DegradationReporter`) already exists and already reaches the user. This adds nothing new structurally — it routes an existing internal event to an existing user channel.
+4. **Signal vs authority** — **Pure signal; no authority added.** This is the load-bearing review point given the Phase-5 'watchdog' trigger: the watchdog's control decisions — when to re-arm, when to reset a stuck guard, when to self-disarm — are **byte-identical** before and after this change. The diff adds only (a) a `leaseStallSurfaced` dedup flag, (b) one `DegradationReporter.report(...)` call on the first re-arm, (c) a flag reset on a real tick. No branch that decides watchdog behavior is touched. It produces a signal; it gates nothing. Complies with `docs/signal-vs-authority.md`.
+5. **Interactions** — Reuses the SAME `DegradationReporter` path the self-disarm already used (and that framework-unavailable + native-heal already use). The dedup prevents double/flood-fire within an episode; the self-disarm event remains separate and louder. No race: the flag is set/read on the single-threaded watchdog tick and reset on the single-threaded main tick.
+6. **External surfaces** — Adds a user-facing degradation notice when a multi-machine lease tick stalls and self-heals. Single-machine agents never construct a lease coordinator, so `runTickWatchdog` early-returns — zero new surface there.
+7. **Multi-machine posture** — Machine-local BY DESIGN: each machine surfaces ITS OWN lease-tick stall. The notice is a local degradation event; no replication needed.
+8. **Rollback cost** — Trivial. Revert the commit (one file + test). No state, no migration. The dedup flag is in-memory.
+
+## What it does NOT do
+
+- Does not change the watchdog's re-arm / guard-reset / self-disarm logic.
+- Does not touch the secondary site (speaker-election fallback) — deferred with a named reason in the spec (notification-noise risk), not orphaned.
+- Single-machine agents: no-op (no lease coordinator).
+
+## Rollback
+
+Revert the commit. In-memory flag only; no migration.
+
+## Second-pass reviewer verdict
+
+Inline (Phase-5 fires on the literal 'watchdog' keyword). The substantive review is Question 4: the change adds NO control authority — the watchdog's safety decisions are byte-identical; only a deduped user-surfacing signal is added. The decision boundary (first-re-arm-surfaces / dedup / reset-on-real-tick) is covered by the new unit test. A full independent reviewer was judged unnecessary for an authority-free additive surfacing; the PR is the review surface.

package/upgrades/side-effects/spawn-cap-interactive-priority.md

@@ -0,0 +1,76 @@
+# Side-Effects Review — Interactive Priority Lane for the Host Spawn Cap (F5 build)
+
+**Version / slug:** `spawn-cap-interactive-priority`
+**Date:** `2026-06-26`
+**Author:** `Echo (instar-dev agent)`
+**Tier:** 2 (converged + approved spec: `docs/specs/spawn-cap-interactive-priority.md`)
+
+## Summary
+
+Implements the converged F5 design: the host spawn cap (the fork-bomb OOM floor) now
+SUBDIVIDES into reserved interactive/background headroom so the user-facing tone gate
+is not starved by background sentinels under contention. It NEVER raises the total cap.
+Ships dark-on-fleet / live-on-dev via the dev-agent gate; byte-identical when off.
+
+Implemented this change:
+- `attribution.lane?: 'interactive'|'background'` (types.ts) — the lane signal.
+- `hostSpawnSemaphore`: `SpawnLane` + optional per-holder `lane`; `clampInteractiveReserves`;
+  `acquire(id, lane)` with the symmetric reserve (interactive iff `liveTotal<N AND
+  liveInteractive<N−Rb`; background symmetric); `interactivePriorityEnabled()`; per-lane
+  `status()` fields. The `liveTotal<N` OOM floor remains the UNCONDITIONAL first predicate.
+- `SpawnCapIntelligenceProvider`: `INTERACTIVE_LANE_ALLOWLIST` (downgrade non-allowlisted
+  `interactive` to background); lane-aware ingress (interactive fast-path before the
+  waiters cap + a CARVE-OUT of `waitersMax`, never additive); passes the lane to acquire.
+- `MessagingToneGate`: `synchronousReply` context flag → sets `lane:'interactive'` only on
+  the operator-facing synchronous reply.
+- Dev-gated flag wiring (server.ts `configureHostSpawnSemaphore`), config type +
+  ConfigDefaults (`enabled` OMITTED → dev-gate; `ri:2, rb:2`), `/spawn-limiter` per-lane
+  fields.
+
+## The 8 questions
+
+1. **Over-block** — N/A. The reservation gates spawns (existing authority); it adds no new
+   rejection. A saturated interactive call still fails closed (typed shed) exactly as today.
+2. **Under-block** — N/A. The total cap is byte-identical (`liveTotal<N` first, always).
+3. **Level-of-abstraction fit** — Correct. `ComponentFrameworks`/attribution already carry
+   per-call metadata; the reserve lives in the one primitive (`hostSpawnSemaphore`) +
+   its wrapper. No routing-engine change.
+4. **Signal vs authority** — Subdivides EXISTING authority by a lane; no new brittle
+   blocking logic (pure integer counting over the holder set, same shape as `liveHolders<cap`).
+   The interactive signal is hardened by a code allowlist + a membership-pinning test (not
+   convention). Complies with docs/signal-vs-authority.md.
+5. **Interactions** — Disabled ⇒ byte-identical (no `lane` written, ingress carve-out
+   gated on `priorityOn`, lane resolves to background). Confirmed: 25 existing spawn-cap
+   tests + 160 tone-gate tests pass unchanged. The wrapper ingress carve-out keeps the
+   aggregate poller bound at `waitersMax` (not additive). Garbage/missing lane → background,
+   never drops a holder (`isWellFormedHolder` untouched) — the OOM floor cannot be eroded.
+6. **External surfaces** — `/spawn-limiter` gains per-lane fields (additive). The tone
+   gate's LLM call may run on a different framework lane than background — intended, visible.
+7. **Multi-machine** — Host-local BY DESIGN (the holders file is per-host, never synced).
+   Each host reserves its own headroom. The optional `lane` rides inside the host-local
+   file; an old reader ignores it, a new reader counts a missing lane as background — total
+   cap bounded both directions during a mixed-version window (priority is best-effort until
+   all co-resident agents upgrade; moot while dark). No replication.
+8. **Rollback cost** — Trivial. The dev-gate flag off (or `interactivePriority.enabled:false`)
+   restores all-or-nothing. No migration (deepMerge backfills `ri/rb`; no stale `enabled`
+   to strip on a new block). No state. Revert the commit otherwise.
+
+## Tracked follow-ups (not orphan deferrals)
+
+- A `lint-interactive-lane-allowlist` CI script (Structure>Willpower belt-and-suspenders).
+  The wrapper DOWNGRADE + the membership-pinning unit test already guarantee safety; the
+  lint is additional defense against a new static assignment site. <!-- tracked: topic-28744 F5-followup interactive-lane-lint -->
+- The §A.1 second tagged seam (operator-inbound `MessageSentinel`) is on the allowlist; its
+  synchronousReply-equivalent wiring on the inbound path lands with the inbound work. <!-- tracked: topic-28744 F5-followup messagesentinel-inbound-lane -->
+
+## Second-pass note (spawn-cap = safety floor)
+
+This touches the fork-bomb OOM floor (a Phase-5 trigger area). The load-bearing review
+point: the change ONLY subdivides within `N` — `liveTotal<N` is the unconditional first
+predicate of every lane, the reserve never raises the ceiling, a garbage lane never drops
+a holder, and `enabled:false` is byte-identical (verified by the existing burst-invariant
+fork-bomb test passing unchanged). The decision boundary is covered by 17 new unit tests.
+
+## Rollback
+
+Dev-gate off / `enabled:false`. No migration, no state.