instar 1.3.675 → 1.3.677

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.675",
+  "version": "1.3.677",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-26T10:12:23.627Z",
-  "instarVersion": "1.3.675",
+  "generatedAt": "2026-06-26T13:12:48.410Z",
+  "instarVersion": "1.3.677",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ed31d0e557159f264ecfd3d5dea6e1a84b9b585fc34d0577049f093119a19160",
+      "contentHash": "547dda376f95e289d9f39a2931a30753cdfe62f2ee9c13479db256dc76ed8d1b",
       "since": "2025-01-01"
     },
     "cli:init": {

package/upgrades/1.3.677.md

@@ -0,0 +1,78 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The host spawn cap (the fork-bomb/OOM safety floor that bounds how many LLM
+subprocesses run at once) now reserves a little headroom for the user's reply. Under
+load, the user-facing tone gate used to wait in the same undifferentiated line as
+background sentinels and could time out (a cause of the 2026-06-25 silent-outbound
+incident). The cap now SUBDIVIDES into a small interactive reserve + a small background
+reserve, so a synchronous operator reply always has slots and is never starved by
+background chatter. The total cap is NEVER raised — only *who gets which slot* changes.
+Ships dark on the fleet / live on a development agent (dev-agent gate); byte-identical
+to today when off.
+
+Lands postmortem fix F7 (Blast-Radius / Verify-After), dark on the fleet / live on a dev
+agent. Two parts: (1) the live inbound spawn-guard is now a token-tagged
+`SpawningTopicsRegistry` — a hung session start no longer silently wedges a topic forever
+(ABA-safe; the `.finally` stays the sole clearer, no risky auto-clear). (2) a pure-signal
+`TopicReachabilityVerifier`: after a session is killed/reaped, it checks (after a grace
+window) that the conversation can still receive your next message, and if a genuine
+orphan (e.g. a wedged start-up) it surfaces ONE calm NORMAL heads-up. It mutates nothing —
+never kills, spawns, or clears. The probe is conservative + fail-safe (uncertain ⇒
+treated as reachable), so it never cries wolf on a normal idle kill.
+
+## What to Tell Your User
+
+When the machine is busy, your reply's safety check now jumps to a reserved slot instead
+of waiting behind background work — fewer slow/held replies under load. The crash
+protection is exactly as strong as before. Most setups see no change (it's off on the
+fleet for now).
+
+If I ever shut down a conversation's session and it genuinely can't be reached again
+(e.g. a start-up that hung), you now get one calm "this conversation may be unreachable"
+heads-up instead of your messages silently vanishing. Most of the time you see nothing,
+because most kills self-heal on your next message. It only watches — it never tries to
+auto-fix the stuck state (that proved too risky); the mechanical repair stays a tracked
+follow-up. Off on the fleet for now.
+
+## Summary of New Capabilities
+
+- `attribution.lane:'interactive'` requests reserved headroom — honored ONLY for an
+  allowlisted, user-blocking seam (the operator-facing tone gate); everything else stays
+  background.
+- Symmetric reservation within the existing cap N (`Ri`/`Rb`, default 2/2): interactive
+  guaranteed ≥Ri slots, background guaranteed ≥Rb — neither starves the other.
+- `/spawn-limiter` reports per-lane live counts + the reservation config.
+- Off (the fleet default) ⇒ byte-identical to the all-or-nothing cap (no `lane` written).
+
+- A hung session start-up can no longer permanently jam a conversation's inbound path
+  (token-tagged spawn guard; ABA-safe).
+- After a destructive session/routing op, a dev agent verifies the topic is still
+  reachable and surfaces a genuine orphan as ONE NORMAL attention item (deduped,
+  flap-backoff-capped, burst-rolled-up, pressure/emergency-stop aware with a re-sweep).
+- Visible in `/guards` (registered). Dark on the fleet (dev-agent gate). Mutates nothing.
+
+## Evidence
+
+- `hostSpawnSemaphore-priority.test.ts` (10): symmetric reserve, OOM floor unconditional,
+  garbage-lane→background-never-dropped, clamp (N=1/N=2/oversized/0), off=byte-identical.
+- `spawn-cap-provider-lane.test.ts` (7): allowlist downgrade (CoherenceReviewer→background),
+  off→background, interactive fast-path, saturated interactive still fails closed,
+  membership pinned.
+- 25 existing spawn-cap tests + 160 tone-gate tests pass unchanged (no regression; the
+  fork-bomb burst-invariant test still green). `tsc --noEmit` clean.
+- Side-effects: `upgrades/side-effects/spawn-cap-interactive-priority.md`.
+- Spec (converged + approved): `docs/specs/spawn-cap-interactive-priority.md`.
+
+- `spawningTopicsRegistry.test.ts` (5): ABA token-guard; `.finally` sole clearer (no
+  timeout/sweep); stuck-age seam.
+- `topicReachabilityVerifier.test.ts` (8): grace; reachable-honesty (no false orphan on a
+  topic that self-heals); orphan→one NORMAL item; pressure/halt skip + re-sweep; flap
+  backoff; burst roll-up; coalescing.
+- `tsc --noEmit` clean.
+- Side-effects: `upgrades/side-effects/verify-after-reachability.md`.
+- Spec (converged + approved): `docs/specs/verify-after-reachability.md`.

package/upgrades/side-effects/spawn-cap-interactive-priority.md

@@ -0,0 +1,76 @@
+# Side-Effects Review — Interactive Priority Lane for the Host Spawn Cap (F5 build)
+
+**Version / slug:** `spawn-cap-interactive-priority`
+**Date:** `2026-06-26`
+**Author:** `Echo (instar-dev agent)`
+**Tier:** 2 (converged + approved spec: `docs/specs/spawn-cap-interactive-priority.md`)
+
+## Summary
+
+Implements the converged F5 design: the host spawn cap (the fork-bomb OOM floor) now
+SUBDIVIDES into reserved interactive/background headroom so the user-facing tone gate
+is not starved by background sentinels under contention. It NEVER raises the total cap.
+Ships dark-on-fleet / live-on-dev via the dev-agent gate; byte-identical when off.
+
+Implemented this change:
+- `attribution.lane?: 'interactive'|'background'` (types.ts) — the lane signal.
+- `hostSpawnSemaphore`: `SpawnLane` + optional per-holder `lane`; `clampInteractiveReserves`;
+  `acquire(id, lane)` with the symmetric reserve (interactive iff `liveTotal<N AND
+  liveInteractive<N−Rb`; background symmetric); `interactivePriorityEnabled()`; per-lane
+  `status()` fields. The `liveTotal<N` OOM floor remains the UNCONDITIONAL first predicate.
+- `SpawnCapIntelligenceProvider`: `INTERACTIVE_LANE_ALLOWLIST` (downgrade non-allowlisted
+  `interactive` to background); lane-aware ingress (interactive fast-path before the
+  waiters cap + a CARVE-OUT of `waitersMax`, never additive); passes the lane to acquire.
+- `MessagingToneGate`: `synchronousReply` context flag → sets `lane:'interactive'` only on
+  the operator-facing synchronous reply.
+- Dev-gated flag wiring (server.ts `configureHostSpawnSemaphore`), config type +
+  ConfigDefaults (`enabled` OMITTED → dev-gate; `ri:2, rb:2`), `/spawn-limiter` per-lane
+  fields.
+
+## The 8 questions
+
+1. **Over-block** — N/A. The reservation gates spawns (existing authority); it adds no new
+   rejection. A saturated interactive call still fails closed (typed shed) exactly as today.
+2. **Under-block** — N/A. The total cap is byte-identical (`liveTotal<N` first, always).
+3. **Level-of-abstraction fit** — Correct. `ComponentFrameworks`/attribution already carry
+   per-call metadata; the reserve lives in the one primitive (`hostSpawnSemaphore`) +
+   its wrapper. No routing-engine change.
+4. **Signal vs authority** — Subdivides EXISTING authority by a lane; no new brittle
+   blocking logic (pure integer counting over the holder set, same shape as `liveHolders<cap`).
+   The interactive signal is hardened by a code allowlist + a membership-pinning test (not
+   convention). Complies with docs/signal-vs-authority.md.
+5. **Interactions** — Disabled ⇒ byte-identical (no `lane` written, ingress carve-out
+   gated on `priorityOn`, lane resolves to background). Confirmed: 25 existing spawn-cap
+   tests + 160 tone-gate tests pass unchanged. The wrapper ingress carve-out keeps the
+   aggregate poller bound at `waitersMax` (not additive). Garbage/missing lane → background,
+   never drops a holder (`isWellFormedHolder` untouched) — the OOM floor cannot be eroded.
+6. **External surfaces** — `/spawn-limiter` gains per-lane fields (additive). The tone
+   gate's LLM call may run on a different framework lane than background — intended, visible.
+7. **Multi-machine** — Host-local BY DESIGN (the holders file is per-host, never synced).
+   Each host reserves its own headroom. The optional `lane` rides inside the host-local
+   file; an old reader ignores it, a new reader counts a missing lane as background — total
+   cap bounded both directions during a mixed-version window (priority is best-effort until
+   all co-resident agents upgrade; moot while dark). No replication.
+8. **Rollback cost** — Trivial. The dev-gate flag off (or `interactivePriority.enabled:false`)
+   restores all-or-nothing. No migration (deepMerge backfills `ri/rb`; no stale `enabled`
+   to strip on a new block). No state. Revert the commit otherwise.
+
+## Tracked follow-ups (not orphan deferrals)
+
+- A `lint-interactive-lane-allowlist` CI script (Structure>Willpower belt-and-suspenders).
+  The wrapper DOWNGRADE + the membership-pinning unit test already guarantee safety; the
+  lint is additional defense against a new static assignment site. <!-- tracked: topic-28744 F5-followup interactive-lane-lint -->
+- The §A.1 second tagged seam (operator-inbound `MessageSentinel`) is on the allowlist; its
+  synchronousReply-equivalent wiring on the inbound path lands with the inbound work. <!-- tracked: topic-28744 F5-followup messagesentinel-inbound-lane -->
+
+## Second-pass note (spawn-cap = safety floor)
+
+This touches the fork-bomb OOM floor (a Phase-5 trigger area). The load-bearing review
+point: the change ONLY subdivides within `N` — `liveTotal<N` is the unconditional first
+predicate of every lane, the reserve never raises the ceiling, a garbage lane never drops
+a holder, and `enabled:false` is byte-identical (verified by the existing burst-invariant
+fork-bomb test passing unchanged). The decision boundary is covered by 17 new unit tests.
+
+## Rollback
+
+Dev-gate off / `enabled:false`. No migration, no state.

package/upgrades/side-effects/verify-after-reachability.md

@@ -0,0 +1,65 @@
+# Side-Effects Review — Verify-After Topic Reachability (F7 — core components)
+
+**Version / slug:** `verify-after-reachability`
+**Date:** `2026-06-26`
+**Author:** `Echo (instar-dev agent)`
+**Tier:** 2 (converged + approved spec: `docs/specs/verify-after-reachability.md`)
+**Scope:** the two pure components (first commit) PLUS the server wiring (this commit):
+Piece 1 (`spawningTopics` closure→`SpawningTopicsRegistry` refactor of the live inbound
+path, token-guarded at all 4 callsites) and Piece 2 (the verifier constructed dev-gated,
+triggered by `sessionReaped`, a conservative fail-safe probe, a 15s tick, NORMAL
+attention surfacing, and `guardRegistry` registration). The probe is deliberately
+CONSERVATIVE: a live session ⇒ reachable; a topic stuck-spawning past `stuckSpawnMs` ⇒
+orphan; ANYTHING ELSE ⇒ reachable (the next inbound self-heals) — so it never
+false-orphans an idle kill. The multi-machine released-no-placement + at-capacity orphan
+cases (placement reads) and a dedicated `/topic-reachability` route are a tracked
+follow-up; their absence means LESS coverage, never a false orphan (the probe fails safe
+to reachable). <!-- tracked: topic-28744 F7-followup multimachine-probe-and-route -->
+
+## What this commit adds
+
+- `SpawningTopicsRegistry` (src/core) — token-tagged replacement for the closure-local
+  `spawningTopics` Set: `add` returns a token, `clear` is token-guarded (the ABA fix so a
+  late `.finally` from a superseded spawn cannot delete a newer entry), `stuckSinceMs`
+  exposes in-flight age for the verifier. NO timeout, NO sweep — the `.finally` remains
+  the sole clearer (round-2 proved any external clear relocates the double-spawn race).
+- `TopicReachabilityVerifier` (src/monitoring) — the PURE-SIGNAL decision core: grace +
+  per-topic coalescing, the reachable-honesty guard (a topic that will self-heal on next
+  inbound is REACHABLE, not orphaned), NORMAL-priority surfacing with per-topic
+  exponential backoff (flap cap), burst roll-up, pressure-skip + emergency-stop-suppress
+  WITH a re-sweep on clear (no never-surfaced orphan). It MUTATES NOTHING.
+
+Neither component is wired into the running server yet (no runtime surface), so this
+commit is inert at runtime — pure library code under test.
+
+## The 8 questions (for the components as committed)
+
+1. **Over-block** — N/A. The verifier blocks nothing; it surfaces a signal. The registry
+   only guards double-spawn (existing behavior), now ABA-safe.
+2. **Under-block** — N/A.
+3. **Level-of-abstraction fit** — Correct. Pure decision logic separated from the server
+   wiring + live-state probe (the spec's design).
+4. **Signal vs authority** — The verifier is a pure signal (zero mutation). The registry's
+   only authority is the EXISTING token-guarded clear (no new clearer). Complies.
+5. **Interactions** — None at runtime (unwired). The registry, once wired, replaces the
+   closure Set; the token guard makes its clear idempotent/ABA-safe.
+6. **External surfaces** — None yet (unwired). The future wiring adds a NORMAL attention
+   item + a `/topic-reachability` status route + a `/guards` entry.
+7. **Multi-machine** — The verifier's released-no-placement detection (future probe) is
+   machine-local (reads the local placement snapshot, freshness-gated); machine-local BY
+   DESIGN. The components themselves hold no cross-machine state.
+8. **Rollback cost** — Trivial. Delete two new files + their tests; nothing references
+   them at runtime yet.
+
+## Tests
+
+- `spawningTopicsRegistry.test.ts` (5): the ABA token-guard, `.finally` is the sole
+  clearer (no timeout/sweep), `stuckSinceMs`, entries snapshot.
+- `topicReachabilityVerifier.test.ts` (8): grace; reachable-honesty (no false orphan);
+  orphan→one NORMAL item; pressure-skip+re-sweep; halt-suppress+re-sweep; flap backoff;
+  burst roll-up; coalescing.
+- `tsc --noEmit` clean.
+
+## Rollback
+
+Delete the two component files + tests. No runtime reference.