instar 1.3.702 → 1.3.704

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.702",
+  "version": "1.3.704",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-30T08:25:23.427Z",
-  "instarVersion": "1.3.702",
+  "generatedAt": "2026-07-02T01:48:54.107Z",
+  "instarVersion": "1.3.704",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/upgrades/1.3.703.md

@@ -0,0 +1,33 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Adds the missing Tier-3 "feature is alive" E2E test for the WS1.3 OwnershipReconciler (the
+cross-machine stuck-move fix): `tests/e2e/pool-reconciler-alive-lifecycle.test.ts`. It
+starts a real `AgentServer` with the reconciler wired and asserts over HTTP that
+`GET /pool/reconciler` is alive (200, not 503), reports both machines, and that one
+reconciler tick CONVERGES a pinned topic (owner != pin → transferring toward the pin
+target), with the live status route reflecting the transfer. Test-only; no runtime change.
+This completes the unit + integration + e2e three-tier coverage the Testing Integrity
+Standard requires — the reconciler previously had unit + integration but no tests/e2e/
+feature-alive test (the tier that catches "the dependency wasn't wired" defects, the class
+the boot-ordering bugs belonged to).
+
+## What to Tell Your User
+
+None — internal change (no user-facing surface).
+
+## Summary of New Capabilities
+
+None — internal change (no user-facing surface).
+
+## Evidence
+
+- `tests/e2e/pool-reconciler-alive-lifecycle.test.ts` — 4 tests, all pass locally
+  (`vitest run --config vitest.e2e.config.ts`): route alive (200), decision explanation
+  (transfer), the tick converges (status `transferring`, transferTo = peer, lastReport
+  transfers = 1), and auth (401/403 without a Bearer token).
+- No source files changed (test-only); `tsc --noEmit` clean.

package/upgrades/1.3.704.md

@@ -0,0 +1,48 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Ratifies six constitutional standards into `docs/STANDARDS-REGISTRY.md`, earned from the
+2026-07-01 silent-Telegram-message-loss postmortem (operator-ratified, topic 29836):
+
+- **A Refusal Stays a Refusal — conservation of negative outcomes** (Building): a terminal
+  refusal/rejection/drop must stay distinguishable from success at every boundary; ack
+  vocabularies name what was actually promised; a refusal affecting the verified operator
+  is always loud.
+- **Cross-Store Coherence Is an Invariant** (Building): any two stores answering the same
+  question carry a declared, machine-checked agreement invariant.
+- **Test Identity Never Enters Production State** (Building): live tests run in throwaway
+  agent homes; fixture writes into real stores are refused structurally; durable-state
+  touches open teardown obligations at write time.
+- **A Dark Feature Guards Nothing** (Shipping): a load-bearing path depending on a
+  dark/disabled feature forces a decision — graduate it or record accepted manual fallback;
+  postmortems must ask which dark features would have prevented the incident.
+- **Runtime End-to-End Proof — the canary standard** (Building): every critical
+  user-visible outcome gets a synthetic full-path probe on a cadence; component liveness is
+  never accepted as proof of outcome.
+- **Session Input Is a Principal** (Substrate): extends Know Your Principal to session
+  input channels — synthetic typers must be structurally distinguishable from the driver.
+
+Also adds the postmortem the entries cite:
+`docs/postmortems/2026-07-01-silent-telegram-message-loss.md`. Docs-only; no runtime change.
+
+## What to Tell Your User
+
+None — internal change (no user-facing surface).
+
+## Summary of New Capabilities
+
+None — internal change (no user-facing surface).
+
+## Evidence
+
+- Registry amendment follows the documented amendment loop (agent proposes with the story,
+  operator ratifies — ratification 2026-07-01, topic 29836, decisions recorded per entry).
+- Each entry names its enforcement arms honestly: live guards on the originating fleet
+  (coherence audit, delivery canary, fixture-write guard) plus tracked upstream filings
+  (fb-1e751537-655, fb-b15ac10b-85c, fb-dd043916-28f) for the structural layers; the
+  conformance-coverage audit will classify the not-yet-landed guards as gaps by design.
+- Side-effects artifact: `upgrades/side-effects/postmortem-standards-s1-s6.md`.

package/upgrades/side-effects/postmortem-standards-s1-s6.md

@@ -0,0 +1,46 @@
+# Side-Effects Review — Six constitutional standards from the 2026-07-01 silent-message-loss postmortem
+
+**Version / slug:** `postmortem-standards-s1-s6`
+**Date:** `2026-07-01`
+**Author:** `Echo (agent), operator-ratified by Justin (topic 29836)`
+**Second-pass reviewer:** `not required (docs-only constitutional amendment; each entry operator-ratified verbatim by decision scope)`
+
+## Summary of the change
+
+Docs-only. Adds six operator-ratified standards to `docs/STANDARDS-REGISTRY.md`, each with its earned-from story per the registry's amendment loop ("proposed by the agent with its story, ratified by the operator" — ratification recorded 2026-07-01, topic 29836): **A Refusal Stays a Refusal** (Building), **Cross-Store Coherence Is an Invariant** (Building), **Test Identity Never Enters Production State** (Building), **A Dark Feature Guards Nothing** (Shipping), **Runtime End-to-End Proof** (Building), **Session Input Is a Principal** (Substrate, extends Know Your Principal). Also adds the in-repo postmortem the entries cite (`docs/postmortems/2026-07-01-silent-telegram-message-loss.md`). No source, config, template, hook, or test files are touched.
+
+## Decision-point inventory
+
+No runtime decision point is added, modified, removed, or passed through. The change is constitutional text. Two READ consumers gain input: the Standards-Conformance Gate and the conformance-coverage audit read this registry — both are signal-only surfaces (findings feed reviewers; nothing blocks). The new entries will be classified by the coverage audit as `spec-only`/`documented-only` until their named guards land upstream (the U1/U2/G3 tracked filings) — that classification is the honest, intended state and is exactly the gap-surfacing that audit exists to do.
+
+---
+
+## 1. Over-block
+
+No block/allow surface — over-block not applicable. (The conformance gate that reads this registry is signal-only by the Signal vs. Authority standard; a new standard cannot block a spec.)
+
+---
+
+## 2. Under-block
+
+No block/allow surface — under-block not applicable. The standards' enforcement arms (test ratchet on ack-mappings, registry-level fixture validation, dark-but-load-bearing classification, canary coverage tracking) land in tracked upstream work (fb-1e751537-655, fb-b15ac10b-85c, fb-dd043916-28f); until then the entries are deliberately prose-with-named-guards, and the coverage audit will report them as gaps rather than silently claiming enforcement.
+
+---
+
+## 3. Level of abstraction
+
+Correct level: these are constitutional standards (family-level rules with earned-from stories), not operational runbooks. Each entry names its operational machinery in **Applied through** rather than embedding procedure. S6 extends an existing standard (Know Your Principal) rather than duplicating it; S2/S5 cross-reference their sibling standards (Verify the State Not Its Symbol; The User Experience Is the Product) rather than restating them.
+
+## 4. Signal vs. authority
+
+Compliant. The registry is read by signal-only surfaces (spec-converge conformance check, coverage audit). Nothing in this change grants any gate blocking authority.
+
+## 5. Interactions with adjacent systems
+
+- The Standards-Conformance Gate will start checking future specs against six more rules — intended effect; signal-only.
+- The conformance-coverage audit (`/conformance/coverage`) will list six new standards, initially as documented-only gaps — intended gap-surfacing.
+- The registry's own "Two layers" and amendment-loop sections are untouched; the entries follow the existing family structure (Substrate / Building / Shipping).
+
+## 6. Rollback cost
+
+Trivial: `git revert` of one commit removes both files cleanly. No config, no state, no migration, no deployed-agent impact.

package/upgrades/side-effects/reconciler-alive-e2e.md

@@ -0,0 +1,42 @@
+# Side-Effects Review — Tier-3 feature-alive E2E for the ownership reconciler
+
+**Slug:** reconciler-alive-e2e
+**Change:** Add `tests/e2e/pool-reconciler-alive-lifecycle.test.ts` (4 tests). Test-only;
+no runtime/source changes. Completes the unit + integration + **e2e** three-tier coverage
+required by the Testing Integrity Standard for the reconciler stuck-move fix.
+
+## 1. Over-block — what legitimate inputs does this reject that it shouldn't?
+N/A — it's a test, not a gate. It asserts the real behavior (200 not 503, decision=transfer,
+a tick converges). It cannot reject any production input.
+
+## 2. Under-block — what failure modes does this still miss?
+It does not re-run `server.ts`'s exact boot ordering (it wires AgentServer directly, like
+the sibling pool-placement-transfer-alive E2E), so the specific boot-construction ordering
+is NOT asserted here — that is covered by OwnershipReconciler.test.ts's late-bound-dep
+regression tests. The comment states this honestly so the test isn't over-trusted. It also
+exercises a single ownership registry (the route + the owner-side transfer), not the
+cross-machine journal replication (covered by JournalSyncApplier + topic-pin-replication).
+
+## 3. Level-of-abstraction fit — right layer?
+Yes. Tier-3 "feature is alive" is exactly the missing tier for a feature with an API route.
+It belongs in tests/e2e/ and mirrors the established pattern.
+
+## 4. Signal vs authority compliance
+N/A — a test holds no production authority. It only constrains CI.
+
+## 5. Interactions — shadow / double-fire / race?
+None. It binds an ephemeral port (47261) + a tmpdir, starts/stops its own AgentServer in
+before/afterAll, and cleans up. No shared state with other tests.
+
+## 6. External surfaces — visible to other agents/users/systems?
+No. Test-only; no endpoint, config, or user surface. Marked internal-only in the release
+notes (no runtime src change).
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+The test simulates the multi-machine reconciler decision (two machines in machines(), a
+topic owned by SELF pinned to PEER) within one process — the standard way the e2e tier
+proves a multi-machine feature is alive. It does not itself run on multiple machines (a
+test never does); it asserts the convergence LOGIC the real multi-machine path relies on.
+
+## 8. Rollback cost
+Trivial — delete one test file. No migration, no state, no behavior change.