instar 1.3.709 → 1.3.710

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.709",
+  "version": "1.3.710",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-02T08:48:48.771Z",
-  "instarVersion": "1.3.709",
+  "generatedAt": "2026-07-02T09:05:31.088Z",
+  "instarVersion": "1.3.710",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/upgrades/1.3.710.md

@@ -0,0 +1,22 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The five circuit-breaker tests in `tests/unit/TopicProfileOrchestrator.test.ts` synchronized on `parkedFor(...) !== null` — an intermediate state that `parkAndRevert` makes visible before its internal `flushDurably` await yields control. Under CI load, the 10ms poll could observe the park and assert on trip effects (un-park, `breaker-revert` audit, disclosure) that had not executed yet, failing the shard intermittently (twice on PR #1320's CI tonight; reproduced locally on iteration 1 of a 15-run loop). The tests now synchronize on the `breaker-revert` audit — emitted after every other synchronous trip side-effect — via a shared `waitForBreakerTrip(h)` helper. Test-only; no runtime source touched.
+
+## What to Tell Your User
+
+None — internal change (no user-facing surface).
+
+## Summary of New Capabilities
+
+None — internal change (no user-facing surface).
+
+## Evidence
+
+- Pre-fix: `tests/unit/TopicProfileOrchestrator.test.ts` failed iteration 1/15 of a local repetition loop with the exact CI assertion (`expected [] to include '7'` at the `unparks` check), matching both CI shard 2/4 failures on PR #1320 (runs 28573712457 and its predecessor).
+- Post-fix: 25 consecutive local runs green under concurrent benchmark load on the same machine.
+- Full unit suite green at push (husky pre-push).

package/upgrades/side-effects/tpo-breaker-flake-fix.md

@@ -0,0 +1,16 @@
+# Side-Effects Review — tpo-breaker-flake-fix
+
+**Change:** test-only. `tests/unit/TopicProfileOrchestrator.test.ts` — the five §10.4 circuit-breaker tests waited on `parkedFor('7') !== null`, an intermediate state `parkAndRevert` makes visible before its internal `flushDurably` await yields; under CI load the 10ms poll observed the park and asserted on trip effects (unpark / audit / disclosure) that had not run yet. They now wait on the `breaker-revert` audit — the trip's terminal signal, emitted after every other synchronous trip side-effect — via a shared `waitForBreakerTrip(h)` helper. No `src/` file touched.
+
+1. **Over-block** — none. No runtime decision surface; the tests assert the same behavior with a later, race-free synchronization point.
+2. **Under-block** — none. Coverage is unchanged: every assertion that existed still runs (including `parkedFor` non-null, asserted explicitly after the wait). The wait is stricter, not looser — it requires the full trip, not just the park.
+3. **Level-of-abstraction fit** — considered fixing the production ordering instead (assign `entry.parked` after `flushDurably`). Rejected: the mid-trip visibility is harmless in production (no production consumer polls `parkedFor` during a trip; the store lock serializes real readers), and reordering durable-write vs in-memory state has its own failure-mode tradeoffs (a crash between write and assign). The test was the thing making a timing assumption; the test is the right layer to fix.
+4. **Signal vs authority compliance** — n/a; no decision point, no gate, no blocking authority. Test-only.
+5. **Interactions** — the helper waits on `h.audits`, which each test's fresh harness resets, so no cross-test bleed. The two tests that subsequently call `requestRecoveryWrite` also benefit (they previously raced `durable.breakerTrips` being set mid-trip).
+6. **External surfaces** — none. Nothing visible to agents, users, or other systems changes.
+7. **Multi-machine posture** — n/a (test-only; no state, no replication surface).
+8. **Rollback cost** — `git revert` of one commit restores the old waits; zero data or fleet impact.
+
+**Evidence:** old code failed iteration 1 of a 15-run local loop (same assertion as CI shard 2/4 failures on PR #1320 tonight, twice); fixed code passed 25 consecutive runs under benchmark load on the same machine.
+
+**Second-pass review:** not required — no sentinel/gate/lifecycle runtime code touched (test file only).

package/upgrades/tpo-breaker-flake-fix.eli16.md

@@ -0,0 +1,11 @@
+# A flaky safety-net test now waits for the finish line, not the halfway mark
+
+Instar has a "circuit breaker" for conversation settings: if an operator pins a topic to a model that keeps failing to launch, the breaker parks the bad pin, reverts to the last working settings, and restarts the session — so a typo'd model name can never brick a conversation.
+
+The breaker itself works fine. Its TESTS, though, were flaky — they'd pass most of the time and occasionally fail on the build servers (twice tonight alone, blocking an unrelated PR from merging). Flaky tests are poison: every red build that ISN'T real teaches people to ignore red builds.
+
+The root cause is a classic race. When the breaker trips, it does several things in a row: park the bad pin → revert → un-park the resume entry → write an audit record → tell the user → restart the session. The tests waited for the FIRST visible step ("is the pin parked yet?") and then immediately checked ALL the later steps. There's a tiny window where the park is visible but the rest hasn't happened yet — normally sub-millisecond, but on a loaded build machine the test's polling could land exactly inside it and fail on assertions about steps that were still in flight.
+
+The fix: the tests now wait for the audit record — which the breaker writes only AFTER everything else in the trip is done — before checking any of the trip's effects. Same coverage, zero timing dependence. Verified by running the test file 25 times in a row under load (the old version failed on the very first try of a 15-run loop).
+
+No production code changed at all — this is a test-only fix. The breaker behaves exactly as before; its report card just stopped lying about it.