instar 1.3.703 → 1.3.705

package/dist/core/DeliverMessageHandler.d.ts

@@ -36,6 +36,22 @@ export interface DeliverMessageHandlerDeps {
     validateSender?: (senderEnvelope: {
         userId?: string | number;
     }, session: string) => boolean;
+    /**
+     * silent-loss-refusal-conservation §2.B — the receiver-side rejection trace.
+     * Fired SYNCHRONOUSLY, once, immediately before the `sender-rejected` NACK is
+     * returned, so the DECIDING (owner) machine keeps a forensic record of its own
+     * refusal (the incident was diagnosed only from the sender's ledger). METADATA
+     * ONLY: the raw command/payload is NEVER passed through this seam (round-1
+     * security #1). try/catch-wrapped by the handler — a trace fault never changes
+     * the NACK. Not fired on a suppression-cache short-circuit (a replay of the
+     * SAME rejected messageId) — the trace is written once per rejection, bounded.
+     */
+    onRejected?: (meta: {
+        reason: 'sender-rejected';
+        session: string;
+        messageId: string;
+        senderUid?: number;
+    }) => void;
 }
 export type DeliverMessageAck = {
     messageId: string;

package/dist/core/DeliverMessageHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DeliverMessageHandler.d.ts","sourceRoot":"","sources":["../../src/core/DeliverMessageHandler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEpE,MAAM,WAAW,yBAAyB;IACxC,+EAA+E;IAC/E,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD,2FAA2F;IAC3F,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/D,0FAA0F;IAC1F,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC,KAAK,IAAI,CAAC;IACjF;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,CAAC,cAAc,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;CAC7F;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,QAAQ,GAAG,WAAW,GAAG,iBAAiB,GAAG,iBAAiB,CAAC;CAC1E,CAAC;AAEF,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,yBAAyB,GAAG,kBAAkB,CAsB/F"}
+{"version":3,"file":"DeliverMessageHandler.d.ts","sourceRoot":"","sources":["../../src/core/DeliverMessageHandler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEpE,MAAM,WAAW,yBAAyB;IACxC,+EAA+E;IAC/E,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD,2FAA2F;IAC3F,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/D,0FAA0F;IAC1F,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC,KAAK,IAAI,CAAC;IACjF;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,CAAC,cAAc,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IAC5F;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,iBAAiB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACpH;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,QAAQ,GAAG,WAAW,GAAG,iBAAiB,GAAG,iBAAiB,CAAC;CAC1E,CAAC;AAYF,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,yBAAyB,GAAG,kBAAkB,CA8D/F"}

package/dist/core/DeliverMessageHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"DeliverMessageHandler.js","sourceRoot":"","sources":["../../src/core/DeliverMessageHandler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA4BH,MAAM,UAAU,2BAA2B,CAAC,IAA+B;IACzE,OAAO,CAAC,OAAoB,EAAqB,EAAE;QACjD,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACtC,4EAA4E;YAC5E,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACtD,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,UAAU,IAAI,IAAI,IAAI,OAAO,CAAC,cAAc,GAAG,UAAU,EAAE,CAAC;YAC9D,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;QACvE,CAAC;QACD,sEAAsE;QACtE,2EAA2E;QAC3E,iDAAiD;QACjD,MAAM,QAAQ,GAAI,OAA6D,CAAC,cAAc,CAAC;QAC/F,IAAI,QAAQ,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACvF,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;QACvE,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACzE,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;QAC/E,IAAI,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,CAAC;QAC3B,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC9D,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"DeliverMessageHandler.js","sourceRoot":"","sources":["../../src/core/DeliverMessageHandler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAuCH;;;;;;kDAMkD;AAClD,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACpD,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAEvC,MAAM,UAAU,2BAA2B,CAAC,IAA+B;IACzE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,0BAA0B;IAE5E,SAAS,mBAAmB,CAAC,KAAa;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC;YACrC,IAAI,KAAK,GAAG,EAAE,GAAG,4BAA4B;gBAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,cAAc,CAAC,IAAI,GAAG,yBAAyB,EAAE,CAAC;YACpD,sEAAsE;YACtE,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,GAAG,yBAAyB,CAAC;YAC/D,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,KAAK,MAAM,CAAC,IAAI,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC;gBACtC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACzB,IAAI,EAAE,OAAO,IAAI,MAAM;oBAAE,MAAM;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,OAAoB,EAAqB,EAAE;QACjD,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACtC,4EAA4E;YAC5E,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACtD,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,UAAU,IAAI,IAAI,IAAI,OAAO,CAAC,cAAc,GAAG,UAAU,EAAE,CAAC;YAC9D,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;QACvE,CAAC;QACD,sEAAsE;QACtE,2EAA2E;QAC3E,iDAAiD;QACjD,MAAM,QAAQ,GAAI,OAA6D,CAAC,cAAc,CAAC;QAC/F,IAAI,QAAQ,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACpC,MAAM,WAAW,GAAG,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACjD,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,GAAG,QAAQ,IAAI,4BAA4B,EAAE,CAAC;gBAC/E,oEAAoE;gBACpE,0EAA0E;gBAC1E,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;YACvE,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpD,cAAc,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;gBACvC,mBAAmB,CAAC,KAAK,CAAC,CAAC;gBAC3B,0EAA0E;gBAC1E,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;oBAC/B,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBACvE,IAAI,CAAC,UAAU,EAAE,CAAC;wBAChB,MAAM,EAAE,iBAAiB;wBACzB,OAAO,EAAE,OAAO,CAAC,OAAO;wBACxB,SAAS,EAAE,OAAO,CAAC,SAAS;wBAC5B,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;qBAC9D,CAAC,CAAC;gBACL,CAAC;gBAAC,MAAM,CAAC,CAAC,wCAAwC,CAAC,CAAC;gBACpD,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;YACvE,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACzE,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;QAC/E,IAAI,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,CAAC;QAC3B,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC9D,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/PostUpdateMigrator.d.ts

@@ -27,6 +27,7 @@ import { type MigratorStep, type RunPendingStepsResult } from './MigratorStepEng
  * Registry'. Spec: docs/specs/playwright-profile-registry.md.
  */
 export declare function MACHINE_LOAD_ASSESSMENT_CLAUDEMD_SECTION(): string;
+export declare function SENDER_REJECTION_CLAUDEMD_SECTION(): string;
 export declare function DYNAMIC_MCP_CLAUDEMD_SECTION(port: number): string;
 export declare function PLAYWRIGHT_PROFILE_REGISTRY_CLAUDEMD_SECTION(port: number): string;
 export interface MigrationResult {
@@ -251,6 +252,20 @@ export declare class PostUpdateMigrator {
      * each migration is idempotent.
      */
     migrate(): MigrationResult;
+    /**
+     * silent-loss-refusal-conservation §4 — one-time idempotent remediation of an
+     * ALREADY-polluted `users.json`. `validateProfile`/`loadUsers` only guard NEW
+     * writes + in-memory loads; a machine already carrying fixture rows on disk
+     * would re-create the 2026-07-01 incident on its next captain flip. This scans
+     * `users.json` against `TEST_IDENTITY_MARKERS`, SKIPS any row carrying a `sig`
+     * that VERIFIES (the signed allow-marker — a legitimate collision), QUARANTINES
+     * the rest (backup + audit), and BACK-FILLS the high-water marker when ≥1
+     * surviving NON-fixture user remains in a store that has no marker (the
+     * installed-base set-point). Idempotent: after quarantine no fixtures remain →
+     * a re-run is a no-op. NOTE (§6 rollback): the quarantine is NOT git-revertable
+     * — a wrongly-quarantined legitimate user is recovered from the timestamped backup.
+     */
+    private migrateFixtureIdentityQuarantine;
     /**
      * Backfill the AutonomousProgressHeartbeat config defaults into an EXISTING
      * agent's config.json (Migration Parity item 2 + the spec's §Migration parity).

package/dist/core/PostUpdateMigrator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PostUpdateMigrator.d.ts","sourceRoot":"","sources":["../../src/core/PostUpdateMigrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AA0CH,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAIjC;;;;;;GAMG;AACH,wBAAgB,wCAAwC,IAAI,MAAM,CAQjE;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQjE;AAED,wBAAgB,4CAA4C,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAcjF;AAuBD,MAAM,WAAW,eAAe;IAC9B,wBAAwB;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,kCAAkC;IAClC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAYnF;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAUnF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAUjG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sCAAsC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAQ/F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAgBjG;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAwB3F;AAaD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,mCAAmC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAsB5F;AAgBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAwBzF;AAED;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAoB5F;AAED;;;;;;;GAOG;AACH,wBAAgB,8CAA8C,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAQvG;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAiB;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU,CAAiC;gBAEvC,MAAM,EAAE,cAAc;IAIlC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IA0B5B;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAItC;;;;;;OAMG;IACG,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAIjC,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,kBAAkB;IAO1B;;;;OAIG;IACH,OAAO,CAAC,YAAY;IASpB;;;OAGG;IACH,OAAO,IAAI,eAAe;IA8D1B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,kCAAkC;IA4E1C,OAAO,CAAC,gCAAgC;IAwCxC,OAAO,CAAC,8BAA8B;IAkFtC,OAAO,CAAC,6BAA6B;IA4DrC,OAAO,CAAC,yCAAyC;IA8DjD,OAAO,CAAC,0BAA0B;IAsFlC,OAAO,CAAC,wBAAwB;IAiFhC,OAAO,CAAC,sCAAsC;IAmE9C;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,uCAAuC;IAqC/C;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,0BAA0B;IAmFlC,OAAO,CAAC,0BAA0B;IAmDlC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kCAAkC;IAwH1C;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,kCAAkC;IA8C1C;;;;;;;;OAQG;IACH,OAAO,CAAC,kCAAkC;IA2B1C,OAAO,CAAC,uBAAuB;IAwE/B,OAAO,CAAC,4CAA4C;IA+CpD;;;;;;;OAOG;IACH,OAAO,CAAC,iCAAiC;IA0BzC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oCAAoC;IAmB5C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yCAAyC;IAWjD;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,kCAAkC;IAW1C,OAAO,CAAC,yBAAyB;IA6FjC;;;;;;;;;;OAUG;IACG,YAAY,IAAI,OAAO,CAAC,eAAe,CAAC;YA4BhC,uBAAuB;IAkGrC,OAAO,CAAC,0BAA0B;IAkGlC,OAAO,CAAC,0BAA0B;IAoElC,OAAO,CAAC,oBAAoB;IAuH5B,OAAO,CAAC,8BAA8B;IA2EtC;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,0BAA0B;IA8BlC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,4BAA4B;IAwBpC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,sBAAsB;IAwB9B;;;;;;;;;OASG;IACH,OAAO,CAAC,wCAAwC;IAuBhD;;;;;;;;OAQG;IACH,OAAO,CAAC,2CAA2C;IAuBnD;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,kCAAkC;IAuB1C;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,mCAAmC;IAmK3C;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;IA2B1B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,yBAAyB;IA4HjC;6EACyE;IACzE,OAAO,CAAC,wBAAwB;IAShC;sDACkD;IAClD,OAAO,CAAC,wBAAwB;IAQhC;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAgRpB;;;;;;;;OAQG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI;IA6CvE;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAkEzB;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAkChC;;;;;;;;;OASG;IACH,OAAO,CAAC,wBAAwB;IAoEhC;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAiE5B;;;;;OAKG;IACH,OAAO,CAAC,2BAA2B;IA8BnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,CAAC,0BAA0B;IAyClC;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAyIhC;;;;;;OAMG;IACH,OAAO,CAAC,8BAA8B;IAwDtC,OAAO,CAAC,0BAA0B;IAiElC;;;OAGG;IACH,OAAO,CAAC,eAAe;IAw+FvB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,kCAAkC;IA0P1C;;;OAGG;IACH,OAAO,CAAC,cAAc;IAsMtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,OAAO,CAAC,yCAAyC;IAyDjD;;;OAGG;IACH,OAAO,CAAC,eAAe;IAmYvB;;;OAGG;IACH,OAAO,CAAC,aAAa;IA0NrB;;;OAGG;IACH;;;OAGG;IACH;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,wBAAwB;IAmEhC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,6BAA6B;IAwDrC;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAsDjC,OAAO,CAAC,wBAAwB;IAqChC,OAAO,CAAC,gBAAgB;IAuBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACH,OAAO,CAAC,qBAAqB;IAsG7B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,0BAA0B;IAgDlC;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAkC5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kBAAkB;IA2C1B;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IA+BzB,OAAO,CAAC,oBAAoB;IAgC5B;;;OAGG;IACH,OAAO,CAAC,aAAa;IAyBrB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAqC9B;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,wBAAwB,GAAG,qBAAqB,GAAG,yBAAyB,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,8BAA8B,GAAG,2BAA2B,GAAG,4BAA4B,GAAG,iBAAiB,GAAG,0BAA0B,GAAG,wBAAwB,GAAG,iBAAiB,GAAG,kBAAkB,GAAG,0BAA0B,GAAG,uBAAuB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,uBAAuB,GAAG,MAAM;IA0BxiB,oFAAoF;IACpF,iCAAiC,IAAI,MAAM;IAI3C,6EAA6E;IAC7E,yBAAyB,IAAI,MAAM;IAInC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,2BAA2B;IAmFnC,OAAO,CAAC,mBAAmB;IAgiB3B,OAAO,CAAC,wBAAwB;IA6JhC,OAAO,CAAC,2BAA2B;IAwEnC,OAAO,CAAC,yBAAyB;IA8IjC,OAAO,CAAC,2BAA2B;IAqKnC,OAAO,CAAC,qBAAqB;IA2W7B,OAAO,CAAC,uBAAuB;IAmS/B,OAAO,CAAC,oBAAoB;IAgG5B,OAAO,CAAC,qBAAqB;IA8H7B,OAAO,CAAC,2BAA2B;IAoHnC,OAAO,CAAC,iCAAiC;IA6DzC,OAAO,CAAC,+BAA+B;IA+DvC,OAAO,CAAC,uBAAuB;IA0F/B,OAAO,CAAC,4BAA4B;IA+MpC;;;;;;;;;;OAUG;IACH;;;;;;;;;;;OAWG;IAEH,gBAAuB,iCAAiC,EAAE,WAAW,CAAC,MAAM,CAAC,CA2C1E;IAEH;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,8BAA8B;IAiHtC,OAAO,CAAC,uBAAuB;IAwD/B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,sBAAsB;IAwC9B,OAAO,CAAC,iBAAiB;IAwBzB,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,8BAA8B;IA6HtC,OAAO,CAAC,+BAA+B;IAuKvC,OAAO,CAAC,oBAAoB;IAY5B,OAAO,CAAC,qBAAqB;IAqO7B,OAAO,CAAC,qBAAqB;IAwI7B,OAAO,CAAC,qBAAqB;IA8Q7B,OAAO,CAAC,6BAA6B;IAkLrC,OAAO,CAAC,0BAA0B;IAiClC,OAAO,CAAC,0BAA0B;IA8ElC,OAAO,CAAC,0BAA0B;IA8IlC,OAAO,CAAC,gBAAgB;IAmJxB,OAAO,CAAC,6BAA6B;CAoCtC"}
+{"version":3,"file":"PostUpdateMigrator.d.ts","sourceRoot":"","sources":["../../src/core/PostUpdateMigrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AA0CH,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAUjC;;;;;;GAMG;AACH,wBAAgB,wCAAwC,IAAI,MAAM,CAQjE;AAED,wBAAgB,iCAAiC,IAAI,MAAM,CAO1D;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQjE;AAED,wBAAgB,4CAA4C,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAcjF;AAuBD,MAAM,WAAW,eAAe;IAC9B,wBAAwB;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,kCAAkC;IAClC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAYnF;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAUnF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAUjG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sCAAsC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAQ/F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAgBjG;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAwB3F;AAaD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,mCAAmC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAsB5F;AAgBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAwBzF;AAED;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAoB5F;AAED;;;;;;;GAOG;AACH,wBAAgB,8CAA8C,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAQvG;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAiB;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU,CAAiC;gBAEvC,MAAM,EAAE,cAAc;IAIlC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IA0B5B;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAItC;;;;;;OAMG;IACG,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAIjC,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,kBAAkB;IAO1B;;;;OAIG;IACH,OAAO,CAAC,YAAY;IASpB;;;OAGG;IACH,OAAO,IAAI,eAAe;IA+D1B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,gCAAgC;IA8ExC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,kCAAkC;IA4E1C,OAAO,CAAC,gCAAgC;IAwCxC,OAAO,CAAC,8BAA8B;IAkFtC,OAAO,CAAC,6BAA6B;IA4DrC,OAAO,CAAC,yCAAyC;IA8DjD,OAAO,CAAC,0BAA0B;IAsFlC,OAAO,CAAC,wBAAwB;IAiFhC,OAAO,CAAC,sCAAsC;IAmE9C;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,uCAAuC;IAqC/C;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,0BAA0B;IAmFlC,OAAO,CAAC,0BAA0B;IAmDlC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kCAAkC;IAwH1C;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,kCAAkC;IA8C1C;;;;;;;;OAQG;IACH,OAAO,CAAC,kCAAkC;IA2B1C,OAAO,CAAC,uBAAuB;IAwE/B,OAAO,CAAC,4CAA4C;IA+CpD;;;;;;;OAOG;IACH,OAAO,CAAC,iCAAiC;IA0BzC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oCAAoC;IAmB5C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yCAAyC;IAWjD;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,kCAAkC;IAW1C,OAAO,CAAC,yBAAyB;IA6FjC;;;;;;;;;;OAUG;IACG,YAAY,IAAI,OAAO,CAAC,eAAe,CAAC;YA4BhC,uBAAuB;IAkGrC,OAAO,CAAC,0BAA0B;IAkGlC,OAAO,CAAC,0BAA0B;IAoElC,OAAO,CAAC,oBAAoB;IAuH5B,OAAO,CAAC,8BAA8B;IA2EtC;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,0BAA0B;IA8BlC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,4BAA4B;IAwBpC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,sBAAsB;IAwB9B;;;;;;;;;OASG;IACH,OAAO,CAAC,wCAAwC;IAuBhD;;;;;;;;OAQG;IACH,OAAO,CAAC,2CAA2C;IAuBnD;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,kCAAkC;IAuB1C;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,mCAAmC;IAmK3C;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;IA2B1B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,yBAAyB;IA4HjC;6EACyE;IACzE,OAAO,CAAC,wBAAwB;IAShC;sDACkD;IAClD,OAAO,CAAC,wBAAwB;IAQhC;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAgRpB;;;;;;;;OAQG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI;IA6CvE;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAkEzB;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAkChC;;;;;;;;;OASG;IACH,OAAO,CAAC,wBAAwB;IAoEhC;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAiE5B;;;;;OAKG;IACH,OAAO,CAAC,2BAA2B;IA8BnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,CAAC,0BAA0B;IAyClC;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAyIhC;;;;;;OAMG;IACH,OAAO,CAAC,8BAA8B;IAwDtC,OAAO,CAAC,0BAA0B;IAiElC;;;OAGG;IACH,OAAO,CAAC,eAAe;IAk/FvB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,kCAAkC;IA0P1C;;;OAGG;IACH,OAAO,CAAC,cAAc;IAsMtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,OAAO,CAAC,yCAAyC;IAyDjD;;;OAGG;IACH,OAAO,CAAC,eAAe;IAmYvB;;;OAGG;IACH,OAAO,CAAC,aAAa;IA0NrB;;;OAGG;IACH;;;OAGG;IACH;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,wBAAwB;IAmEhC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,6BAA6B;IAwDrC;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAsDjC,OAAO,CAAC,wBAAwB;IAqChC,OAAO,CAAC,gBAAgB;IAuBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACH,OAAO,CAAC,qBAAqB;IAsG7B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,0BAA0B;IAgDlC;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAkC5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kBAAkB;IA2C1B;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IA+BzB,OAAO,CAAC,oBAAoB;IAgC5B;;;OAGG;IACH,OAAO,CAAC,aAAa;IAyBrB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAqC9B;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,wBAAwB,GAAG,qBAAqB,GAAG,yBAAyB,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,8BAA8B,GAAG,2BAA2B,GAAG,4BAA4B,GAAG,iBAAiB,GAAG,0BAA0B,GAAG,wBAAwB,GAAG,iBAAiB,GAAG,kBAAkB,GAAG,0BAA0B,GAAG,uBAAuB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,uBAAuB,GAAG,MAAM;IA0BxiB,oFAAoF;IACpF,iCAAiC,IAAI,MAAM;IAI3C,6EAA6E;IAC7E,yBAAyB,IAAI,MAAM;IAInC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,2BAA2B;IAmFnC,OAAO,CAAC,mBAAmB;IAgiB3B,OAAO,CAAC,wBAAwB;IA6JhC,OAAO,CAAC,2BAA2B;IAwEnC,OAAO,CAAC,yBAAyB;IA8IjC,OAAO,CAAC,2BAA2B;IAqKnC,OAAO,CAAC,qBAAqB;IA2W7B,OAAO,CAAC,uBAAuB;IAmS/B,OAAO,CAAC,oBAAoB;IAgG5B,OAAO,CAAC,qBAAqB;IA8H7B,OAAO,CAAC,2BAA2B;IAoHnC,OAAO,CAAC,iCAAiC;IA6DzC,OAAO,CAAC,+BAA+B;IA+DvC,OAAO,CAAC,uBAAuB;IA0F/B,OAAO,CAAC,4BAA4B;IA+MpC;;;;;;;;;;OAUG;IACH;;;;;;;;;;;OAWG;IAEH,gBAAuB,iCAAiC,EAAE,WAAW,CAAC,MAAM,CAAC,CA2C1E;IAEH;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,8BAA8B;IAiHtC,OAAO,CAAC,uBAAuB;IAwD/B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,sBAAsB;IAwC9B,OAAO,CAAC,iBAAiB;IAwBzB,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,8BAA8B;IA6HtC,OAAO,CAAC,+BAA+B;IAuKvC,OAAO,CAAC,oBAAoB;IAY5B,OAAO,CAAC,qBAAqB;IAqO7B,OAAO,CAAC,qBAAqB;IAwI7B,OAAO,CAAC,qBAAqB;IA8Q7B,OAAO,CAAC,6BAA6B;IAkLrC,OAAO,CAAC,0BAA0B;IAiClC,OAAO,CAAC,0BAA0B;IA8ElC,OAAO,CAAC,0BAA0B;IA8IlC,OAAO,CAAC,gBAAgB;IAmJxB,OAAO,CAAC,6BAA6B;CAoCtC"}

package/dist/core/PostUpdateMigrator.js

@@ -50,6 +50,8 @@ import { armCodexHooks, makeTmuxTrustDriver } from './codexHookArm.js';
 import { detectCodexPath, detectTmuxPath } from './Config.js';
 import { DegradationReporter } from '../monitoring/DegradationReporter.js';
 import { MigratorStepEngine, } from './MigratorStepEngine.js';
+import { matchTestIdentity, verifyAllowTestIdentity, loadTestIdentityKey, } from '../users/testIdentityMarkers.js';
+import { readRegistryHighWater, setRegistryHighWater } from './registryHighWater.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 /**
  * The "Playwright Profile Registry" CLAUDE.md awareness section. SHARED by
@@ -67,6 +69,14 @@ Before deferring work because the machine "looks loaded," RUN \`.instar/scripts/
 - **NEVER** judge load from \`uptime\` 1-min load average alone — quote the script's verdict + real idle%, never the load average. (This rule exists because that exact misread caused a false "heavy load" deferral on 2026-06-19.)
 - **When to use** (PROACTIVE — this is the trigger): the moment you catch yourself about to hold off on work, fan out parallel sub-agents, or report "the machine is loaded" → run \`load-assess.sh\` and act on its verdict, not on a load-average glance.\n`;
 }
+export function SENDER_REJECTION_CLAUDEMD_SECTION() {
+    return `\n### Sender-Rejection Notices ("message not delivered — sender not recognized")
+
+When I run across more than one machine and a message is forwarded to the machine that OWNS the conversation, that machine re-validates the sender against its OWN user registry. If it can't confirm the sender, the message is REFUSED (a first-class terminal outcome — never silently logged as "delivered") and the user is told with ONE neutral notice: *"I got your message but couldn't confirm you as an approved sender, so it wasn't delivered. I've logged the details so this can be diagnosed."*
+- **Why a user got that notice:** the owning machine didn't resolve the sender's id in its user registry. Read \`logs/mesh-rejections.jsonl\` on the DECIDING machine (metadata-only: \`ts/reason/session/messageId/senderUid\`, never payload) and check the registration path — the sender may not be registered on that machine, or its \`users.json\` may be degenerate.
+- **The safety gate (silent-loss-refusal-conservation §2.D):** sender re-validation refuses to ARM against a genuinely-empty / never-populated / corrupt / operator-unresolvable registry — it fails toward DELIVERY and shouts (a fresh install must let the operator's first message through), and it keeps a durable \`state/registry-high-water.json\` marker so a never-populated \`[]\` (fresh install → deliver) is told apart from an emptied-by-deletion \`[]\` (→ keep rejecting + HIGH alert). A corrupt/unparseable registry fails CLOSED (reject unresolved) — never silently opens the doors. Test/fixture identities are refused at the write AND load layers so the registry can't be clobbered the way it was on 2026-07-01.
+- **When to use** (PROACTIVE): user asks "why did I get a 'message not delivered / sender not recognized' notice?" → read \`logs/mesh-rejections.jsonl\` + check whether they're registered on the owning machine. "why did my messages silently stop?" → check that machine's registry health (an emptied registry disarms + shouts; a corrupt one fails closed). Spec: \`docs/specs/silent-loss-refusal-conservation.md\`.\n`;
+}
 export function DYNAMIC_MCP_CLAUDEMD_SECTION(port) {
     return `\n### Dynamic MCP Lifecycle (⚗️ experimental, ships DARK) — load heavy MCP servers on demand
 
@@ -631,8 +641,97 @@ export class PostUpdateMigrator {
         this.migrateConformanceGateAutoInvoke(result);
         this.migrateHonestProgressMessagingDefaults(result);
         this.migrateAutonomousHeartbeatDefaults(result);
+        this.migrateFixtureIdentityQuarantine(result);
         return result;
     }
+    /**
+     * silent-loss-refusal-conservation §4 — one-time idempotent remediation of an
+     * ALREADY-polluted `users.json`. `validateProfile`/`loadUsers` only guard NEW
+     * writes + in-memory loads; a machine already carrying fixture rows on disk
+     * would re-create the 2026-07-01 incident on its next captain flip. This scans
+     * `users.json` against `TEST_IDENTITY_MARKERS`, SKIPS any row carrying a `sig`
+     * that VERIFIES (the signed allow-marker — a legitimate collision), QUARANTINES
+     * the rest (backup + audit), and BACK-FILLS the high-water marker when ≥1
+     * surviving NON-fixture user remains in a store that has no marker (the
+     * installed-base set-point). Idempotent: after quarantine no fixtures remain →
+     * a re-run is a no-op. NOTE (§6 rollback): the quarantine is NOT git-revertable
+     * — a wrongly-quarantined legitimate user is recovered from the timestamped backup.
+     */
+    migrateFixtureIdentityQuarantine(result) {
+        const usersFile = path.join(this.config.stateDir, 'users.json');
+        if (!fs.existsSync(usersFile)) {
+            result.skipped.push('fixture-identity-quarantine: users.json not found');
+            return;
+        }
+        let rows;
+        try {
+            const parsed = JSON.parse(fs.readFileSync(usersFile, 'utf-8'));
+            if (!Array.isArray(parsed)) {
+                result.skipped.push('fixture-identity-quarantine: users.json is not an array (left untouched — corruption is not this migration\'s job)');
+                return;
+            }
+            rows = parsed;
+        }
+        catch (err) {
+            // A corrupt store is NOT this migration's concern (loadUsers backs it up);
+            // never clobber an unparseable file.
+            result.skipped.push(`fixture-identity-quarantine: users.json parse-failure (left untouched): ${err instanceof Error ? err.message : String(err)}`);
+            return;
+        }
+        const key = loadTestIdentityKey(this.config.stateDir);
+        const survivors = [];
+        const quarantined = [];
+        for (const row of rows) {
+            const profile = row;
+            const marker = matchTestIdentity({ id: String(profile.id ?? ''), slackUserId: profile.slackUserId, channels: profile.channels ?? [] });
+            if (!marker) {
+                survivors.push(row);
+                continue;
+            }
+            // A row with a VERIFYING signed allow-marker is a legitimate collision — keep it.
+            if (verifyAllowTestIdentity(key, String(profile.id ?? ''), marker, profile.allowTestIdentity)) {
+                survivors.push(row);
+                continue;
+            }
+            quarantined.push(row);
+        }
+        if (quarantined.length > 0) {
+            // Back up the quarantined rows to a timestamped file (recoverable — §6).
+            const backupPath = `${usersFile}.fixture-quarantine.${Date.now()}.json`;
+            try {
+                fs.writeFileSync(backupPath, JSON.stringify(quarantined, null, 2));
+            }
+            catch (err) {
+                // If we can't back up, do NOT quarantine (never a non-recoverable delete).
+                result.errors.push(`fixture-identity-quarantine: backup write failed, leaving users.json untouched: ${err instanceof Error ? err.message : String(err)}`);
+                return;
+            }
+            // Atomic rewrite of users.json with the survivors (temp + rename).
+            try {
+                const tmp = `${usersFile}.${process.pid}.${crypto.randomBytes(6).toString('hex')}.tmp`;
+                fs.writeFileSync(tmp, JSON.stringify(survivors, null, 2));
+                fs.renameSync(tmp, usersFile);
+            }
+            catch (err) {
+                result.errors.push(`fixture-identity-quarantine: users.json rewrite failed: ${err instanceof Error ? err.message : String(err)}`);
+                return;
+            }
+            result.upgraded.push(`fixture-identity-quarantine: quarantined ${quarantined.length} fixture/test identit${quarantined.length === 1 ? 'y' : 'ies'} out of users.json ` +
+                `(backup: ${path.basename(backupPath)}); ${survivors.length} real user(s) remain`);
+        }
+        // Back-fill the high-water marker for the installed base: a store that has
+        // held ≥1 real (non-fixture) user should classify POPULATED if later emptied
+        // (emptied-by-deletion → keep rejecting), not never-populated.
+        const realSurvivors = survivors.filter((r) => {
+            const p = r;
+            return matchTestIdentity({ id: String(p.id ?? ''), slackUserId: p.slackUserId, channels: p.channels ?? [] }) === null;
+        });
+        if (realSurvivors.length > 0 && !readRegistryHighWater(this.config.stateDir)) {
+            if (setRegistryHighWater(this.config.stateDir, 'migration-backfill')) {
+                result.upgraded.push('fixture-identity-quarantine: back-filled registry high-water marker (installed-base set-point)');
+            }
+        }
+    }
     /**
      * Backfill the AutonomousProgressHeartbeat config defaults into an EXISTING
      * agent's config.json (Migration Parity item 2 + the spec's §Migration parity).
@@ -6856,6 +6955,15 @@ Create worktrees for collaborator repos with \`instar worktree create <branch>\`
             patched = true;
             result.upgraded.push('CLAUDE.md: added Fork-Bomb Spawn Cap section');
         }
+        // Sender-Rejection Notices (silent-loss-refusal-conservation §2.E) — Agent
+        // Awareness + Migration Parity: an agent that doesn't know a "sender not
+        // recognized" notice comes from the mesh sender re-validation will be confused
+        // by it. Content-sniffed on a stable heading → idempotent.
+        if (!content.includes('Sender-Rejection Notices')) {
+            content += SENDER_REJECTION_CLAUDEMD_SECTION();
+            patched = true;
+            result.upgraded.push('CLAUDE.md: added Sender-Rejection Notices section');
+        }
         if (patched) {
             try {
                 fs.writeFileSync(claudeMdPath, content);