instar 1.3.739 → 1.3.741

package/dist/monitoring/ReapLog.js

@@ -14,6 +14,47 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
+/**
+ * Read only the last `maxBytes` of a file and return its non-empty lines,
+ * newest last. Bounded by construction: an arbitrarily large log is never
+ * loaded whole (the readFileSync-whole-file pattern that froze the event loop
+ * on a 142MB reap-log, 2026-07-03). If the read starts mid-file (the file is
+ * larger than `maxBytes`), the first — possibly partial — line is dropped so a
+ * torn record is never mis-parsed. Never throws; an absent/unreadable file
+ * yields [].
+ */
+function tailLines(filePath, maxBytes) {
+    let fd;
+    try {
+        const size = fs.statSync(filePath).size;
+        if (size === 0)
+            return [];
+        const readBytes = Math.min(size, maxBytes);
+        const start = size - readBytes;
+        const buf = Buffer.allocUnsafe(readBytes);
+        fd = fs.openSync(filePath, 'r');
+        fs.readSync(fd, buf, 0, readBytes, start);
+        const text = buf.toString('utf-8');
+        const lines = text.split('\n');
+        // Dropped: a leading partial line when we didn't read from byte 0.
+        if (start > 0 && lines.length > 0)
+            lines.shift();
+        return lines.filter((l) => l.trim().length > 0);
+    }
+    catch {
+        return []; // @silent-fallback-ok — absent/unreadable ⇒ no rows.
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                fs.closeSync(fd);
+            }
+            catch {
+                /* fd already gone */
+            }
+        }
+    }
+}
 const NOTIFY_OUTCOMES = new Set([
     'enqueued',
     'sent',
@@ -21,12 +62,47 @@ const NOTIFY_OUTCOMES = new Set([
     'no-topic',
     'enqueue-failed',
 ]);
+/** Rotate the reap-log once it crosses this many bytes. The current file is
+ *  renamed to `<path>.1` (O(1), no data rewrite) and a fresh file started, so
+ *  the on-disk log can NEVER grow unbounded — even if some future caller floods
+ *  it past the transition-dedup below. One backup generation is retained;
+ *  `read()` merges its tail so recent history survives a rotation boundary. */
+const MAX_LOG_BYTES = 16 * 1024 * 1024;
+/** `read()` only ever pulls the last this-many bytes of a log file, so a large
+ *  reap-log can never be slurped whole into memory (the 142MB readFileSync +
+ *  split that blocked the event loop, 2026-07-03). Generous vs the default
+ *  `limit` of 200 rows (~300 B/row ⇒ ~6.5k rows fit in 2 MB). */
+const TAIL_READ_BYTES = 2 * 1024 * 1024;
+/** Cap on the in-memory transition-dedup map. Live session names are bounded
+ *  (dozens); this is a safety ceiling so a pathological churn of distinct names
+ *  can't grow the map without bound. Oldest entries are pruned first. */
+const MAX_SKIP_STATE = 2000;
 export class ReapLog {
     logPath;
     machineId;
-    constructor(stateDir, machineId) {
+    maxLogBytes;
+    tailReadBytes;
+    maxSkipState;
+    /** session name → last-LOGGED skip signature (`${reason}::${skipped}`).
+     *  A `recordSkipped` whose signature equals the session's last-logged one is
+     *  the SAME permanent veto being re-evaluated at tick speed (open-commitment,
+     *  not-lease-holder, protected …) — it is NOT re-appended. This is the
+     *  primary cure for the reaper self-inflicted log flood (3218 open-commitment
+     *  + 1608 not-lease-holder repeat rows ⇒ 142MB, 2026-07-03): mirror the
+     *  reaper-audit "log on transition, not every tick" pattern. Cleared when the
+     *  session is reaped so a same-named successor logs its first skip fresh. */
+    skipState = new Map();
+    /** Cheap running estimate of the current log's byte size, so rotation is
+     *  decided WITHOUT a statSync on every append. Seeded from the real size on
+     *  first append, then advanced by each write; re-synced on rotation. -1 =
+     *  not yet seeded. */
+    approxSize = -1;
+    constructor(stateDir, machineId, opts = {}) {
         this.logPath = path.join(stateDir, '..', 'logs', 'reap-log.jsonl');
         this.machineId = machineId;
+        this.maxLogBytes = opts.maxLogBytes ?? MAX_LOG_BYTES;
+        this.tailReadBytes = opts.tailReadBytes ?? TAIL_READ_BYTES;
+        this.maxSkipState = opts.maxSkipState ?? MAX_SKIP_STATE;
     }
     recordReaped(e) {
         this.append({
@@ -44,6 +120,9 @@ export class ReapLog {
             ...(e.workEvidence && e.workEvidence.length > 0 ? { workEvidence: e.workEvidence } : {}),
             ...(e.evidenceSource ? { evidenceSource: e.evidenceSource } : {}),
         });
+        // The session is gone — drop its skip-dedup state so a same-named successor
+        // logs its first skip fresh and the map never leaks reaped names.
+        this.forgetSkip(e.session);
     }
     /**
      * Append one reap-notice delivery outcome record (reap-notify spec R1.3).
@@ -66,6 +145,18 @@ export class ReapLog {
         });
     }
     recordSkipped(e) {
+        // Log-on-transition: a reaper evaluates a permanently-vetoed session
+        // (open-commitment, not-lease-holder, protected, …) on EVERY tick and would
+        // emit an identical `skipped` row each time — 5k+ repeat rows ⇒ a 142MB log
+        // that froze the event loop when read (2026-07-03). Only append when the
+        // skip STATE changes for this session; a re-evaluation with the same
+        // (reason, skipped) is the same veto and is dropped. The reaper keeps
+        // evaluating every tick, so the moment the veto lifts (commitment closes,
+        // lease moves) the state changes and the next skip — or the reap — logs.
+        const sig = `${e.reason}::${e.skipped}`;
+        if (this.skipState.get(e.session) === sig)
+            return;
+        this.rememberSkip(e.session, sig);
         this.append({
             ts: new Date().toISOString(),
             type: 'skipped',
@@ -78,27 +169,77 @@ export class ReapLog {
             machine: this.machineId?.(),
         });
     }
+    /** Record a session's last-logged skip signature, enforcing the map ceiling
+     *  (oldest-first prune — Map preserves insertion order). Re-inserting an
+     *  existing key does not reorder it, which is fine: churny NEW names are the
+     *  growth risk, and those get pruned. */
+    rememberSkip(session, sig) {
+        this.skipState.set(session, sig);
+        while (this.skipState.size > this.maxSkipState) {
+            const oldest = this.skipState.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.skipState.delete(oldest);
+        }
+    }
+    /** Forget a session's skip state — call when the session is gone (reaped) so a
+     *  same-named successor logs its first skip fresh and the map can't leak. */
+    forgetSkip(session) {
+        this.skipState.delete(session);
+    }
     append(entry) {
         try {
             fs.mkdirSync(path.dirname(this.logPath), { recursive: true });
-            fs.appendFileSync(this.logPath, JSON.stringify(entry) + '\n');
+            const line = JSON.stringify(entry) + '\n';
+            this.rotateIfNeeded(Buffer.byteLength(line));
+            fs.appendFileSync(this.logPath, line);
+            if (this.approxSize >= 0)
+                this.approxSize += Buffer.byteLength(line);
         }
         catch {
             // never throw from the audit sink
         }
     }
-    /** Read the most-recent `limit` entries (newest last), tolerating partial/corrupt lines. */
-    read(limit = 200) {
-        let raw;
+    /** Roll the log to `<path>.1` (single retained generation) once it would cross
+     *  MAX_LOG_BYTES, so the file can never grow unbounded. Rename is O(1) — no
+     *  data rewrite on the append hot path (rewriting a large file synchronously
+     *  here would reintroduce the very event-loop stall we're removing). Seeds the
+     *  cheap size estimate from the real file size on first use. */
+    rotateIfNeeded(incomingBytes) {
+        if (this.approxSize < 0) {
+            try {
+                this.approxSize = fs.statSync(this.logPath).size;
+            }
+            catch {
+                this.approxSize = 0; // absent file ⇒ empty
+            }
+        }
+        if (this.approxSize + incomingBytes <= this.maxLogBytes)
+            return;
         try {
-            raw = fs.readFileSync(this.logPath, 'utf-8');
+            fs.renameSync(this.logPath, `${this.logPath}.1`); // overwrites a prior .1
         }
         catch {
-            // @silent-fallback-ok — no log file yet means no reaps recorded; an empty
-            // list is the correct answer, not a degraded one.
-            return [];
+            // @silent-fallback-ok — if the roll fails the append still proceeds; the
+            // read path is tail-bounded so an oversize file is a perf hit, never a
+            // correctness failure.
+        }
+        this.approxSize = 0;
+    }
+    /** Read the most-recent `limit` entries (newest last), tolerating partial/corrupt lines.
+     *  Only the last TAIL_READ_BYTES of each file are ever read, so a large log can
+     *  never be slurped whole into memory (the readFileSync-whole-file freeze). If
+     *  the current file's tail doesn't yield enough rows and a rotated `.1` backup
+     *  exists, its tail is merged so recent history survives a rotation boundary. */
+    read(limit = 200) {
+        const wanted = limit > 0 ? limit : Number.MAX_SAFE_INTEGER;
+        let lines = tailLines(this.logPath, this.tailReadBytes);
+        if (lines.length < wanted) {
+            // Backfill from the rotated generation (older lines first).
+            const older = tailLines(`${this.logPath}.1`, this.tailReadBytes);
+            if (older.length > 0)
+                lines = older.concat(lines);
         }
-        const lines = raw.split('\n').filter((l) => l.trim().length > 0);
         const tail = limit > 0 ? lines.slice(-limit) : lines;
         const out = [];
         for (const line of tail) {

package/dist/monitoring/ReapLog.js.map

@@ -1 +1 @@
-{"version":3,"file":"ReapLog.js","sourceRoot":"","sources":["../../src/monitoring/ReapLog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAe7B,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IACnD,UAAU;IACV,MAAM;IACN,uBAAuB;IACvB,UAAU;IACV,gBAAgB;CACjB,CAAC,CAAC;AAmDH,MAAM,OAAO,OAAO;IACD,OAAO,CAAS;IAChB,SAAS,CAA4B;IAEtD,YAAY,QAAgB,EAAE,SAAoC;QAChE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACnE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,YAAY,CAAC,CAWZ;QACC,IAAI,CAAC,MAAM,CAAC;YACV,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,UAAU;YACxC,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;YAC3B,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,YAAY,CAAC,CAMZ;QACC,IAAI,CAAC,MAAM,CAAC;YACV,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,CAAC,CAAC,QAAQ;YACnB,WAAW,EAAE,GAAG;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO;YAC7B,WAAW,EAAE,UAAU,CAAC,CAAC,OAAO,EAAE;YAClC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;YAC3B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CAAC,CAMb;QACC,IAAI,CAAC,MAAM,CAAC;YACV,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,WAAW,EAAE,WAAW,CAAC,CAAC,OAAO,EAAE;YACnC,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;SAC5B,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,KAAmB;QAChC,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;IACH,CAAC;IAED,4FAA4F;IAC5F,IAAI,CAAC,KAAK,GAAG,GAAG;QACd,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,kDAAkD;YAClD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACrD,MAAM,GAAG,GAAmB,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0B,CAAC,CAAC,CAAC;YAC3E,CAAC;YAAC,MAAM,CAAC;gBACP,iEAAiE;YACnE,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,cAAc,CAAC,KAA4B;QACjD,2EAA2E;QAC3E,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,IAAI,GACR,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvF,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,MAAM,OAAO,GACX,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;YACrE,CAAC,CAAE,KAAK,CAAC,OAA6B;YACtC,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,WAAW;gBACT,IAAI,KAAK,SAAS;oBAChB,CAAC,CAAC,WAAW,OAAO,IAAI,SAAS,EAAE;oBACnC,CAAC,CAAC,IAAI,KAAK,QAAQ;wBACjB,CAAC,CAAC,UAAU,OAAO,IAAI,SAAS,EAAE;wBAClC,CAAC,CAAC,UAAU,CAAC;QACrB,CAAC;QAED,MAAM,UAAU,GACd,KAAK,CAAC,UAAU,KAAK,UAAU,IAAI,KAAK,CAAC,UAAU,KAAK,sBAAsB;YAC5E,CAAC,CAAC,KAAK,CAAC,UAAU;YAClB,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;YACpD,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACtE,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO;YACL,EAAE,EAAE,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;YACvE,IAAI;YACJ,OAAO,EAAE,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YACtE,WAAW,EAAE,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;YAClF,MAAM,EAAE,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YACnE,WAAW;YACX,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO;YACP,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"ReapLog.js","sourceRoot":"","sources":["../../src/monitoring/ReapLog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,QAAgB,EAAE,QAAgB;IACnD,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;QACxC,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,GAAG,SAAS,CAAC;QAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC1C,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAChC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,mEAAmE;QACnE,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,qDAAqD;IAClE,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,qBAAqB;YACvB,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAeD,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IACnD,UAAU;IACV,MAAM;IACN,uBAAuB;IACvB,UAAU;IACV,gBAAgB;CACjB,CAAC,CAAC;AAmDH;;;;+EAI+E;AAC/E,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACvC;;;iEAGiE;AACjE,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACxC;;yEAEyE;AACzE,MAAM,cAAc,GAAG,IAAI,CAAC;AAU5B,MAAM,OAAO,OAAO;IACD,OAAO,CAAS;IAChB,SAAS,CAA4B;IACrC,WAAW,CAAS;IACpB,aAAa,CAAS;IACtB,YAAY,CAAS;IACtC;;;;;;;iFAO6E;IAC5D,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvD;;;0BAGsB;IACd,UAAU,GAAG,CAAC,CAAC,CAAC;IAExB,YAAY,QAAgB,EAAE,SAAoC,EAAE,OAAuB,EAAE;QAC3F,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACnE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,aAAa,CAAC;QACrD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,eAAe,CAAC;QAC3D,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,cAAc,CAAC;IAC1D,CAAC;IAED,YAAY,CAAC,CAWZ;QACC,IAAI,CAAC,MAAM,CAAC;YACV,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,UAAU;YACxC,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;YAC3B,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC,CAAC;QACH,4EAA4E;QAC5E,kEAAkE;QAClE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,YAAY,CAAC,CAMZ;QACC,IAAI,CAAC,MAAM,CAAC;YACV,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,CAAC,CAAC,QAAQ;YACnB,WAAW,EAAE,GAAG;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO;YAC7B,WAAW,EAAE,UAAU,CAAC,CAAC,OAAO,EAAE;YAClC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;YAC3B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CAAC,CAMb;QACC,qEAAqE;QACrE,4EAA4E;QAC5E,4EAA4E;QAC5E,yEAAyE;QACzE,qEAAqE;QACrE,sEAAsE;QACtE,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,GAAG;YAAE,OAAO;QAClD,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC;YACV,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,WAAW,EAAE,WAAW,CAAC,CAAC,OAAO,EAAE;YACnC,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;SAC5B,CAAC,CAAC;IACL,CAAC;IAED;;;6CAGyC;IACjC,YAAY,CAAC,OAAe,EAAE,GAAW;QAC/C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAClD,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM;YAChC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED;iFAC6E;IACrE,UAAU,CAAC,OAAe;QAChC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAEO,MAAM,CAAC,KAAmB;QAChC,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;YAC1C,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7C,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACtC,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC;gBAAE,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;IACH,CAAC;IAED;;;;oEAIgE;IACxD,cAAc,CAAC,aAAqB;QAC1C,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,sBAAsB;YAC7C,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,GAAG,aAAa,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAChE,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,wBAAwB;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,uEAAuE;YACvE,uBAAuB;QACzB,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;IACtB,CAAC;IAED;;;;qFAIiF;IACjF,IAAI,CAAC,KAAK,GAAG,GAAG;QACd,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAC3D,IAAI,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACxD,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;YAC1B,4DAA4D;YAC5D,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACjE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACrD,MAAM,GAAG,GAAmB,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0B,CAAC,CAAC,CAAC;YAC3E,CAAC;YAAC,MAAM,CAAC;gBACP,iEAAiE;YACnE,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,cAAc,CAAC,KAA4B;QACjD,2EAA2E;QAC3E,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,IAAI,GACR,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvF,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,MAAM,OAAO,GACX,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;YACrE,CAAC,CAAE,KAAK,CAAC,OAA6B;YACtC,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,WAAW;gBACT,IAAI,KAAK,SAAS;oBAChB,CAAC,CAAC,WAAW,OAAO,IAAI,SAAS,EAAE;oBACnC,CAAC,CAAC,IAAI,KAAK,QAAQ;wBACjB,CAAC,CAAC,UAAU,OAAO,IAAI,SAAS,EAAE;wBAClC,CAAC,CAAC,UAAU,CAAC;QACrB,CAAC;QAED,MAAM,UAAU,GACd,KAAK,CAAC,UAAU,KAAK,UAAU,IAAI,KAAK,CAAC,UAAU,KAAK,sBAAsB;YAC5E,CAAC,CAAC,KAAK,CAAC,UAAU;YAClB,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;YACpD,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACtE,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO;YACL,EAAE,EAAE,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;YACvE,IAAI;YACJ,OAAO,EAAE,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YACtE,WAAW,EAAE,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;YAClF,MAAM,EAAE,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YACnE,WAAW;YACX,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO;YACP,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC;IACJ,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.739",
+  "version": "1.3.741",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-03T22:57:15.282Z",
-  "instarVersion": "1.3.739",
+  "generatedAt": "2026-07-03T23:25:24.796Z",
+  "instarVersion": "1.3.741",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/src/data/llmBenchCoverage.ts

@@ -360,3 +360,203 @@ export const LLM_JUDGES_CLAIMS: Readonly<Record<string, JudgesClaimsFlag>> = {
   CartographerSweep: false, // authors doc-tree summaries over code
   StandardsCoverageEnrichment: false, // enriches standards-coverage rows
 };
+
+// ───────────────────────────────────────────────────────────────────────────
+// Prompt↔parser contract standard (defect class 1 — docs/specs/prompt-parser-
+// contract-standard.md §4)
+//
+// The `contract` axis of the program's shared per-callsite metadata record
+// (class-closure-gate.md §"Program-shared machinery"). It co-locates in THIS
+// file with the bench-coverage record it extends, exactly like the sibling
+// `untrustedInput` (authority-clause) and `judgesClaims` (evidence-bar) axes.
+//
+// THE FIELD IS REQUIRED AND EXPLICIT FOR EVERY COMPONENT_CATEGORY KEY — there is
+// NO DEFAULT. A callsite whose output is machine-parsed into a CLOSED, taught
+// verdict/decision vocabulary (the B15 failure surface: prompt teaches "B15",
+// parser accepts only "B15_CONTEXT_DEATH_STOP") either NAMES its contract-test
+// file (`{ contractTest: '<path>' }`, covered) or is queued in the shrink-only
+// pending set (`{ pending: 'contract-wave-1' | 'contract-wave-2' }`). A callsite
+// with NO such closed-vocabulary parse — no live LLM prompt, a fixed canary, or
+// free-text / open-set CONTENT consumed as data (summaries, extractions,
+// syntheses, briefs, reviews, open-set id routing) — is `{ false: '<reason>' }`
+// and pinned shrink-only in
+// tests/unit/parser-contract-classification-ratchet.test.ts. A silent omission
+// is red CI, so the flag can NEVER default toward the un-contracted state.
+//
+// POLARITY (spec §3: "Undeclared content is hazard-scanned by default"): the
+// default pulls TOWARD "needs a contract" — a callsite is `false` only with an
+// argued reason, exactly like the sibling `untrustedInput` axis defaults toward
+// `true`.
+//
+// WAVE-1 is the spec-named SHIPPED-FIX set (rollout §0/§1): the four
+// highest-stakes parsed callsites — MessagingToneGate (the motivating B15
+// defect), ExternalOperationGate, CompletionEvaluator (stop-judge), and
+// InputClassifier. It is pinned as a seed floor in the ratchet so a
+// highest-stakes callsite can never silently slip out of scope. WAVE-2 is every
+// other enumerated-verdict/decision callsite, graduating on the shrink-only
+// schedule (rollout §2).
+//
+// DARK / REPORT-ONLY: this record is build-time metadata read ONLY by the new
+// pinned ratchet. Nothing here is a contract test yet (those render the REAL
+// production prompt and need the live-builder render refactor, deferred to its
+// own A/B-gated increments — spec rollout §0/§1). The pending set IS the report
+// (spec §4: "report-only inventory happens by construction").
+//
+// A cross-check lint flags any GATE/SENTINEL-category callsite marked `false`
+// for review (these categories most often parse a verdict) — see the ratchet's
+// REVIEWED_FALSE_PARSER_GATE pin.
+// ───────────────────────────────────────────────────────────────────────────
+
+export type ParserContractFlag =
+  | { contractTest: string }
+  | { pending: 'contract-wave-1' | 'contract-wave-2' }
+  | { false: string };
+
+export const LLM_PARSER_CONTRACT: Readonly<Record<string, ParserContractFlag>> = {
+  // ── WAVE-1: the four spec-named highest-stakes parsed callsites (rollout §0) ──
+  MessagingToneGate: { pending: 'contract-wave-1' }, // THE motivating defect: prompt taught "B15", parser accepts only "B15_CONTEXT_DEATH_STOP"
+  ExternalOperationGate: { pending: 'contract-wave-1' }, // parses a closed mutability/reversibility classification
+  CompletionEvaluator: { pending: 'contract-wave-1' }, // the stop-judge surface parses a closed done/blocked/continue verdict
+  InputClassifier: { pending: 'contract-wave-1' }, // parses a closed auto-approve vs relay decision
+
+  // ── WAVE-2: every other enumerated-verdict / decision callsite (rollout §2) ──
+  MessageSentinel: { pending: 'contract-wave-2' }, // closed intent set (pause / emergency / normal)
+  LLMSanitizer: { pending: 'contract-wave-2' }, // parses a closed sanitize verdict/decision
+  WarrantsReplyGate: { pending: 'contract-wave-2' }, // closed should-reply yes/no verdict
+  InputGuard: { pending: 'contract-wave-2' }, // closed input-coherence verdict
+  StallTriageNurse: { pending: 'contract-wave-2' }, // closed stall-triage diagnosis label
+  CommitmentSentinel: { pending: 'contract-wave-2' }, // closed commitment-detected verdict + structured envelope
+  PresenceProxy: { pending: 'contract-wave-2' }, // closed tier-3 stall verdict
+  ProjectDriftChecker: { pending: 'contract-wave-2' }, // closed on-project verdict
+  TemporalCoherenceChecker: { pending: 'contract-wave-2' }, // closed temporal-coherence verdict
+  SessionWatchdog: { pending: 'contract-wave-2' }, // closed stuck verdict
+  ResumeQueueDrainer: { pending: 'contract-wave-2' }, // closed resume-sanity verdict
+  TopicIntentArcCheck: { pending: 'contract-wave-2' }, // closed arc-check classification label
+  TelegramAdapter: { pending: 'contract-wave-2' }, // stall-confirm — closed genuinely-stalled verdict
+  SlackAdapter: { pending: 'contract-wave-2' }, // stall-confirm (byte-identical prompt to Telegram's; parity)
+  PromptGate: { pending: 'contract-wave-2' }, // closed injection-detected verdict
+  UnjustifiedStopGate: { pending: 'contract-wave-2' }, // closed stop-justified verdict
+  OverrideDetector: { pending: 'contract-wave-2' }, // closed override-intent verdict
+  TaskClassifier: { pending: 'contract-wave-2' }, // closed task-type label set
+  ResumeValidator: { pending: 'contract-wave-2' }, // closed resume-UUID match yes/no verdict
+  CoherenceReviewer: { pending: 'contract-wave-2' }, // gate-triage — closed coherence verdict
+
+  // ── Argued false (pinned shrink-only) — no closed-vocabulary verdict parse ──
+  // No live LLM callsite, a fixed canary, or free-text / open-set content.
+  InputDetector: {
+    false:
+      'attribution-manifest alias only (a legacy prompt-pattern matcher); the live matcher calls with attribution PromptGate, contracted there',
+  },
+  SessionActivitySentinel: {
+    false:
+      'authors a free-text activity DIGEST — the product is prose, not a closed verdict vocabulary a prompt teaches and a parser gates on',
+  },
+  PromiseBeacon: {
+    false:
+      'no live LLM prompt — generateStatusLine/classifyProgress hooks are unwired at the construction site; nothing parses a taught vocabulary (matches its bench-coverage exemption)',
+  },
+  InteractivePoolCanaryJudge: {
+    false:
+      'judges a FIXED known-answer canary probe — the expected output is a constant, so the canary is its own contract; a prompt↔parser contract test would re-test the same constant',
+  },
+  SessionSummarySentinel: {
+    false:
+      'extracts task/phase/files as open-set free-text FIELDS — there is no closed taught verdict vocabulary, so the B15 prompt↔parser drift cannot arise here',
+  },
+  AutoApprover: {
+    false:
+      'mechanical key injection + audit logging, no LLM prompt of its own; the upstream parsed decision is InputClassifier.classify(), contracted there',
+  },
+  IntegrationGate: {
+    false:
+      'no LLM prompt of its own — delegates to JobReflector.reflect(); zero LLM-provider callsites of its own that parse a taught vocabulary',
+  },
+  CoherenceGate: {
+    false:
+      'no callsite carries attribution CoherenceGate — all LLM calls flow through CoherenceReviewer.callApi(), contracted there',
+  },
+  JobReflector: {
+    false:
+      'reflection produces free-text content over a job — no closed taught verdict vocabulary a parser gates on (its own bench coverage is wave-3)',
+  },
+  crossModelReviewer: {
+    false:
+      'produces a free-text review of a SPEC document — no closed output vocabulary the prompt teaches and a parser must accept',
+  },
+  SelfKnowledgeTree: {
+    false:
+      'extracts self-knowledge tree fragments as content that is stored/merged — no closed verdict token gates a branch on a taught vocabulary',
+  },
+  TreeTriage: {
+    false:
+      'triages knowledge-tree fragments into content — no closed taught output vocabulary a parser must accept or reject',
+  },
+  TopicSummarizer: {
+    false:
+      'produces a free-text topic summary — the prose is the product; there is no closed vocabulary the prompt teaches and a parser gates on',
+  },
+  ContextualEvaluator: {
+    false:
+      'evaluates context relevance into content — no closed taught verdict vocabulary that a parser accepts a promised form of',
+  },
+  RelationshipManager: {
+    false:
+      'extracts relationship facts as open-set structured content — no closed taught vocabulary a prompt promises and a parser gates on',
+  },
+  StandardsConformanceReviewer: {
+    false:
+      'reviews artifact-vs-standard conformance as content — no closed output vocabulary the prompt teaches and a parser must accept',
+  },
+  DiscoveryEvaluator: {
+    false:
+      'evaluates serendipity discoveries into content — no closed taught verdict vocabulary a parser accepts a promised form of',
+  },
+  Usher: {
+    false:
+      'routes a turn to candidate TOPIC IDS — an OPEN, machine-supplied set, not a closed taught vocabulary the prompt fixes and a parser gates on',
+  },
+  TopicIntentExtractor: {
+    false:
+      'extracts a topic-intent description from a turn — free-text content, not a closed taught verdict vocabulary a parser accepts',
+  },
+  PreCompactionFlush: {
+    false:
+      'extracts durable facts before compaction as free-text content — no closed taught output vocabulary a parser gates on',
+  },
+  TreeSynthesis: {
+    false:
+      'synthesizes knowledge fragments into a free-text answer — the prose is the product, no closed taught verdict vocabulary a parser accepts',
+  },
+  LLMConflictResolver: {
+    false:
+      'resolves divergent multi-machine state into a merged value/content — no closed taught verdict vocabulary a prompt promises and a parser gates on',
+  },
+  openConversationBrief: {
+    false:
+      'generates a free-text A2A conversation brief — the prose is the product, no closed output vocabulary the prompt teaches and a parser must accept',
+  },
+  'a2a-checkin': {
+    false:
+      'summarizes A2A check-in threads into free-text content — no closed taught verdict vocabulary a parser accepts a promised form of',
+  },
+  'correction-learning': {
+    false:
+      'distills recurring corrections into a preference (content) — no closed taught output vocabulary a parser gates on',
+  },
+  'mentor-stage-b': {
+    false:
+      'classifies mentor signals over mentee output into differential content — no closed taught verdict vocabulary a parser gates on (its own bench coverage is wave-3)',
+  },
+  PipeSessionSpawner: {
+    false:
+      'spawns sessions from task descriptions — no LLM output parsed into a closed taught verdict vocabulary',
+  },
+  CartographerSweep: {
+    false:
+      'authors doc-tree summaries over code as free text — the prose is the product, no closed taught output vocabulary a parser gates on',
+  },
+  StandardsCoverageEnrichment: {
+    false:
+      'enriches standards-coverage rows with content — no closed taught verdict vocabulary a prompt promises and a parser accepts',
+  },
+};

package/upgrades/1.3.740.md

@@ -0,0 +1,65 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Three self-limiting changes to `src/monitoring/ReapLog.ts` (the audit trail behind
+`GET /sessions/reap-log`) that stop the reaper from flooding — and freezing on — its own log.
+
+The reaper re-evaluates every session on each tick. When a session **can't** be reaped yet — it
+holds an open commitment, or it belongs to another machine (`not-lease-holder`), or it's
+protected — the reaper skips it and recorded a `skipped` row **every tick**. On a live agent
+that produced 3218 `open-commitment` + 1608 `not-lease-holder` **identical repeat rows** and
+grew `reap-log.jsonl` to **142MB / 463k lines** (observed 2026-07-03). Worse, `read()` did
+`fs.readFileSync(WHOLE file).split('\n')` just to return the last N rows — a 142MB slurp that
+**blocked the event loop** (~90s CPU-bound stalls) whenever the route was queried.
+
+- **Write-side transition dedup (primary cure).** `recordSkipped()` now logs on *transition*:
+  it keeps an in-memory `session → last-logged skip signature (${reason}::${skipped})` map and
+  drops a re-append when the signature is unchanged — mirroring the sibling `reaper-audit.jsonl`
+  "log on change, not every tick" discipline. State is cleared when the session is reaped
+  (`forgetSkip`) so a same-named successor logs fresh and the map can't leak (hard ceiling
+  `MAX_SKIP_STATE`, 2000, oldest-pruned). The reaper still **evaluates** every tick, so the
+  moment a veto lifts the next skip — or the reap — is logged.
+- **Read-side bounded tail.** `read()` now reads only the last `TAIL_READ_BYTES` (2MB) via a
+  positional `readSync`, drops a torn leading line, and merges the rotated `.1` tail if needed —
+  so a large log can never be slurped whole into memory again.
+- **Size-cap rotation (defense-in-depth).** `append()` rolls the file to `<path>.1` (O(1)
+  `renameSync`, no hot-path rewrite) once it crosses `MAX_LOG_BYTES` (16MB), so it can never
+  grow unbounded even if a future caller floods it.
+
+Caps are overridable via an optional `ReapLogOptions` constructor arg (defaults = the module
+constants) purely so tests can trigger rotation cheaply; the production callsite is unchanged.
+
+## What to Tell Your User
+
+If your agent's server ever felt like it "froze for a minute" periodically, or your disk was
+filling up with a giant session-audit log, this is a fix for that. The background tidier that
+closes finished sessions was writing the same "couldn't clean this up yet" note thousands of
+times, and reading that log loaded the whole thing at once. Now it writes the note once and
+reads only the end of the file. Nothing you do changes — your "why did my session vanish?"
+history is still complete (the first skip, every change of reason, and every actual close are
+all still recorded); it just stops the duplicate spam and the stall it caused, and a log that's
+already huge stops growing and gets trimmed automatically.
+
+## Summary of New Capabilities
+
+None — this is a reliability fix to existing behavior, not a new capability. The session-audit
+history keeps the same shape and meaning; it's just bounded and de-duplicated now.
+
+## Evidence
+
+- `npx vitest run tests/unit/reap-log.test.ts` → **16 tests, 0 failures** (transition-dedup:
+  identical-skip-suppressed, reason-transition-logs, per-session independence, re-log-after-reap;
+  bounded read returns correct last-N; rotation to `.1` + cross-boundary merge + live file
+  bounded; absent-file empty read).
+- `npx vitest run tests/unit/reap-log.test.ts tests/unit/session-reaper.test.ts
+  tests/unit/reap-notifier.test.ts tests/unit/reap-guard.test.ts` → **115 tests, 0 failures**
+  (reaper family regression-clean; `normalizeEntry` whitelist untouched).
+- `npx tsc --noEmit -p tsconfig.json` → **0 errors**.
+- Independent second-pass reviewer: **Concur** — observability-only, touches no kill/keep
+  decision; no operator-needed row hidden; read/rotation off-by-one-clean.
+- Side-effects review: `upgrades/side-effects/reaper-log-flood-fix.md` (8 questions +
+  signal-vs-authority + multi-machine posture + second-pass concurrence).

package/upgrades/1.3.741.md

@@ -0,0 +1,85 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: minor -->
+
+## What Changed
+
+The mechanical arm of the **"The Prompt and the Parser Are One Contract"** standard
+(`docs/specs/prompt-parser-contract-standard.md`, defect class 1 / `prompt-parser-contract`
+closure), shipped as a self-contained DARK increment — no runtime wiring, no operator-gated
+registry text, no config key, and **no change to any live prompt or parser**. It is the
+structural answer to the 2026-07-02 INSTAR-Bench v2 finding: the tone gate's PROMPT taught
+models the short rule id (`B15`) while its production PARSER accepts only the full identifier
+(`B15_CONTEXT_DEATH_STOP`) and fails closed on the short form — so every model through every
+door obeyed the prompt and "failed." A single CI test comparing what the prompt promises
+against what the parser accepts would have made that defect unrepresentable.
+
+This increment ships **the shared contract library + the per-callsite classification + its CI
+ratchet only**:
+
+- A **shared contract library** (`src/core/promptContract.ts`): the `PromptContract` manifest
+  type (the co-located machine-readable promise a prose-shaped callsite carries next to its
+  prompt) and `deriveRejectedForms` — a pure generator for the counter-examples a contract
+  test feeds the REAL parser to prove its fail-closed behavior (case-mutation,
+  prefix-truncation at each separator — the exact `B15` shape — and separator-stripping, plus
+  hand-picked extras, minus any form that collides with a promised token). Machine-derived by
+  design: a hand-only reject list invites trivial rejects that prove nothing.
+- The **`contract` classification** (`LLM_PARSER_CONTRACT` in `src/data/llmBenchCoverage.ts`):
+  the `contract` axis of the program's ONE shared per-callsite metadata record (sibling of the
+  authority-clause `untrustedInput` and evidence-bar `judgesClaims` axes), required-explicit
+  for every LLM component — no default, so a silent omission is red CI and the flag can never
+  default toward the un-contracted state. The four spec-named highest-stakes parsed callsites
+  (tone gate, external-op gate, stop judge, input classifier) seed `contract-wave-1`; every
+  other enumerated-verdict callsite is `contract-wave-2`; a callsite with no closed-vocabulary
+  parse (no live prompt, a fixed canary, or free-text/open-set content) is an argued `false`.
+- A **classification ratchet** (`tests/unit/parser-contract-classification-ratchet.test.ts`):
+  required-explicit + no-dangling + valid-wave + the wave-1 seed pinned as a floor (a
+  highest-stakes callsite can never silently slip scope) + the pending set pinned shrink-only
+  + the argued-false set pinned shrink-only with a real-reason floor + a gate/sentinel
+  cross-check. Same pinned-baseline family as `llm-bench-coverage-ratchet` and the sibling
+  `untrusted-input-classification-ratchet`.
+
+Deliberately OUT of scope (not orphan deferrals — see `upgrades/side-effects/`):
+
+- The **per-callsite contract tests** and the **live-builder render refactor** (spec rollout
+  §0/§1). A contract test renders the REAL production prompt through an exported pure render
+  function; several production builders are private instance methods with live deps and need
+  that refactor, which TOUCHES live parsing code. It is deferred to its own A/B-gated
+  increments, one callsite at a time — never inside this dark inventory increment.
+- The **runtime contract-drift warning** (spec Frontloaded Decision #3) — a prompt-build-time
+  signal that also touches the live builders; it lands with the single-sourcing migrations.
+- The **registry / constitution text** (spec §1) — operator-gated; ships ONLY with Justin's
+  explicit sign-off. It is DRAFTED in the spec; this run does not edit the standards registry.
+
+## What to Tell Your User
+
+Nothing changes for you right now — this ships dark, and it is maintainer-only machinery (a
+no-op on your install unless you develop instar itself). What it does is give my own AI checks
+a safety net: the words a check's prompt tells a model to answer with, and the words the code
+behind that check will actually accept, are now recorded together and held in sync by an
+automatic test. That closes a class of bug where a check would quietly reject every correct
+answer because the two halves had drifted apart — a mistake that was entirely mine, never the
+model's. The real per-check tests and any wording changes come later, one at a time, and only
+after careful review.
+
+## Summary of New Capabilities
+
+None active for end users in this increment — everything ships dark and additive. (For instar
+maintainers: a shared prompt↔parser contract library plus a required per-callsite `contract`
+classification with a shrink-only ratchet and a pinned highest-stakes seed floor, so a
+machine-parsed callsite can never silently ship a taught output vocabulary its own parser
+rejects.)
+
+## Evidence
+
+- `npx vitest run tests/unit/parser-contract-classification-ratchet.test.ts tests/unit/promptContract.test.ts tests/unit/llm-bench-coverage-ratchet.test.ts`
+  → **3 files, 26 tests, 0 failures** (required-explicit + no-dangling + wave-1 seed floor +
+  shrink-only pending + shrink-only argued-false + real-reason floor + gate/sentinel
+  cross-check + the derive-rejected-forms mutation logic incl. the B15 prefix shape; the
+  pre-existing coverage ratchet still green against the additive record).
+- `npx tsc --noEmit` → exit 0. `npm run lint` → exit 0.
+- Dark-by-construction: `LLM_PARSER_CONTRACT` is build-time metadata read only by the new
+  pinned ratchet; `promptContract.ts` has no runtime caller. It changes NO prompt text and
+  wires NO runtime parser — verified by the absence of any src import of the new module
+  outside tests.