instar 1.3.758 → 1.3.760

package/upgrades/1.3.760.md

@@ -0,0 +1,100 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Maintainer-only development machinery — the first product-code member of the
+class-closure program (#1347), and the constitution standard it enforces.
+
+- **New defect class `unbounded-self-action`** in `docs/defect-classes.json`
+  (severity `critical`, seeded-closed at the 20 already-fixed instances). A
+  post-seed recurrence fires the deterministic re-raise at lint time.
+- **The live guard** — `tests/unit/self-action-convergence.test.ts` drives every
+  controller in the new `src/testing/selfActionRegistry.ts` registry N ticks
+  under a pinned sustained-pressure fixture (all accounts hot / veto never clears
+  / no progress) and asserts the action count SETTLES to a small bound that does
+  NOT scale with the horizon. Seeded with faithful convergence models of four
+  real controllers (proactive swap monitor, age-kill backoff, promise-beacon
+  notify, and a declared Eternal-Sentinel liveness heartbeat exercising the P19
+  exemption).
+- **The forcing lint** — `scripts/lint-no-unregistered-self-action.js`
+  (emit-anchored, fail-closed once enforcing) refuses an unregistered self-action
+  controller emit so a NEW self-action inherits the invariant. **Report-only by
+  default** — it reports the population of unregistered controllers and exits 0
+  until `prGate.classClosure.dryRun:false`.
+- **The detector + scope** — `scripts/lib/self-action-detect.mjs` is the single
+  shared source (emit set + controller-shape predicate + the gate decision). It
+  widens the class-closure CI lint's scope (`scripts/class-closure-lint.mjs`) so
+  a self-action diff requires a `classClosure` declaration, adds a
+  convergence-addressed check (a per-tick-cap-only `howCaught` is flagged), and
+  powers `assertSelfActionDeclared` in `scripts/instar-dev-precommit.js` — the
+  early arm at the LIGHT commit path #1035 (swap-thrash) slipped through. Both new
+  hard-violation conditions land report-only under the existing
+  `prGate.classClosure.dryRun` default.
+- **`scripts/class-closure-declare.mjs`** gains `--to-trace` (write the block into
+  the instar-dev trace, the E3 declaration host) and an explicit negative
+  declaration (`--closure n/a --reason`), the trace-level analog of the lint's
+  allowlist.
+- **The standard** "Capacity Safety — No Unbounded Self-Action" added to
+  `docs/STANDARDS-REGISTRY.md` (operator-ratified 2026-07-04) — BBR's temporal
+  twin: BBR bounds instantaneous MASS, this bounds steady-state FREQUENCY under
+  feedback.
+- **Migration Parity** — `migrateClassClosureTemplateSelfActionClause` extends the
+  deployed side-effects template's Class-Closure trigger with the self-action
+  clause for existing agents.
+
+Named follow-on increments (own specs, NOT built here): the unified default-on
+self-action backpressure primitive (the obfuscation-resistant funnel), and the
+swap decoupling / live credential re-pointing (the durable swap fix).
+<!-- tracked: CMT-1911 -->
+
+## What to Tell Your User
+
+This is maintainer-only development machinery — there is nothing for you to do or
+notice in day-to-day use. If your operator asks "why do we keep fighting the same
+runaway loops (account swaps, notification floods, the reaper firing thousands of
+kill requests)?" — the answer is: those were 20 instances of ONE unnamed defect
+class, and this change names it (unbounded self-action) and builds the automatic
+CI test that proves any self-triggered action settles under sustained pressure
+instead of running away. It ships report-only first (it logs what it would flag)
+and only starts blocking after a clean soak, per the class-closure gate's own dark
+default — so it changes nothing about how I respond to you today.
+
+## Summary of New Capabilities
+
+- **A new defect class + its guard.** "Unbounded / oscillating self-action" is now
+  a registered class with a live CI ratchet (`tests/unit/self-action-convergence.test.ts`)
+  that drives every self-triggered controller under worst-case pressure and fails
+  the build if the action count doesn't converge — the temporal twin of Bounded
+  Blast Radius (which caps how many run at once; this caps how often one fires).
+- **A forcing lint + a shared detector** so a NEW self-triggered action inherits
+  the convergence check instead of earning a bespoke brake after it breaks
+  something — caught at both the commit gate and CI.
+- **A ratified constitution standard** — "Capacity Safety — No Unbounded
+  Self-Action" (`docs/STANDARDS-REGISTRY.md`).
+- No user-facing surface, no routes, no config to set. Report-only until the
+  operator flips enforcing.
+
+## Evidence
+
+- `tests/unit/self-action-convergence.test.ts` — the ratchet: 26 cases, every
+  registered controller settles (count ≤ boundK, horizon-independent at 2×ticks,
+  no single target thrashed), the Eternal-Sentinel honors its P19 rate floor,
+  wiring-integrity (no vacuous/no-op controllers), verb-superset coherence, and
+  grader-parity (the three new guards grade ratchet/lint/gate).
+- `tests/unit/self-action-detect.test.ts` — the shared detector + the pure gate
+  decision (both precommit call sites): emit true-positives, comment/prose
+  false, fail-open on empty diff, all declaration branches.
+- `tests/unit/lint-no-unregistered-self-action.test.ts` — the forcing lint's pure
+  evaluator: unmarked → violation, marked+registered → clean, marked-unregistered
+  → violation, allowlisted → clean, no-emit / non-shape → skipped.
+- `tests/integration/class-closure-lint-self-action.test.ts` — the CI lint's
+  self-action scope arm over synthetic diffs: good guard declaration → clean; no
+  declaration → hard violation (report-only exit 0, enforcing exit 1); a
+  per-tick-cap-only `howCaught` → convergence-addressed violation.
+- `tests/unit/migrate-class-closure-self-action-clause.test.ts` — the migration:
+  stock template updated, idempotent, customized-left-untouched, no-op when absent.
+- Full lint chain (`npm run lint`) green — including the new forcing lint
+  (report-only) and the class-closure grader-parity. `tsc --noEmit` clean.

package/upgrades/side-effects/machine-coherence-guard-5b-awake-count.md

@@ -0,0 +1,105 @@
+# Side-Effects Review — machine-coherence-guard §5b: lease-live `awakeMachineCount`
+
+**Version / slug:** `machine-coherence-guard-5b-awake-count`
+**Date:** `2026-07-04`
+**Author:** Echo (autonomous)
+**Spec:** `docs/specs/machine-coherence-guard.md` §5b (converged 2026-07-03, approved)
+**Second-pass reviewer:** not-required (Tier 2; a read-only telemetry-derivation fix — no gate, no demotion authority, no mutation)
+
+## Summary of the change
+
+`/health.multiMachine.syncStatus.awakeMachineCount` reported **0** while both the
+Laptop and the Mac Mini were online and the Mini correctly held the lease
+(`leaseHolder` named the Mini). Root cause, confirmed in code: `getSyncStatus()`
+derived the count SOLELY by counting `registry.machines[].role === 'awake'` rows
+(`MultiMachineCoordinator.ts`) — a git-synced SYMBOL that lags the authoritative
+lease and that a dead Cloudflare rope or a slow registry push can leave stale — so
+it read 0 even though the lease (the same signal `leaseHolder` uses) named the
+holder. The multi-transport hedge was NOT the wedge: it carries the lease over the
+healthy Tailscale/LAN ropes (that is why `leaseHolder` was correct). The count
+simply consulted the wrong source. This implements the spec's already-designed
+§5b remedy: derive the count from LIVE lease observations, source-tagged and
+honest.
+
+Files modified:
+- `src/core/LeaseCoordinator.ts` — new `deriveLiveAwakeCount(staleMs)`: `(self
+  holds ? 1 : 0)` + distinct peers whose most-recent observation is FRESH, LIVE
+  (not expired on our clock), and a SELF-CLAIM (`lease.holder === peerId`). The
+  per-peer observation seam (`peerLeaseObservations()` / transport `observedByPeer()`)
+  already existed; this wires the counting rule onto it. Advisory only.
+- `src/core/MultiMachineCoordinator.ts` — `getSyncStatus()` rewritten to prefer
+  the lease-live basis (when a lease coordinator with pull capability is attached),
+  degrade to the registry-role basis on a git-only mesh, and yield `null` on a read
+  failure; a new `leaseObservationStaleMs()` (3× lease-pull interval, floor 30s).
+  `MultiMachineSyncStatus.awakeMachineCount` becomes `number | null` and gains
+  `awakeMachineCountSource: 'lease-live' | 'registry-roles' | 'unavailable'`.
+  `splitBrainState` now null-safely reads `count > 1` (degrades to the pull-contest
+  latch alone when the count is null).
+- `src/server/routes.ts` — `/pool` router block carries `awakeMachineCountSource`
+  (`/health` spreads the whole object, so it flows automatically).
+- `src/commands/machine.ts` — `instar doctor` labels the registry-role check as a
+  "may-lag" VIEW and, when the server is reachable, adds a **Live lease view**
+  check that prints the authoritative count + source and names any divergence.
+- `src/scaffold/templates.ts` + `src/core/PostUpdateMigrator.ts` — the two deployed
+  CLAUDE.md mentions updated to the new shape (Agent Awareness + Migration Parity).
+
+Tests: `tests/unit/multimachine-awake-count-lease-live.test.ts` (new; the
+load-bearing "Cloudflare dead, Tailscale/LAN alive, Mini holds lease → count 1
+lease-live, NOT 0" case plus stale/expired/hearsay/no-lease/registry-fallback/
+unavailable), updated `tests/unit/multimachine-syncstatus.test.ts`,
+`tests/integration/pool-routes.test.ts` (+ two other mocks), and an extended
+`tests/e2e/multi-machine-lease-split-brain.test.ts` (lease-live convergence).
+
+## Roll-up across the seven review dimensions
+
+1. **Over-block**: none. Nothing is blocked, delayed, or rewritten — this is a
+   read-only observability derivation. It NEVER drives a demotion (demotion
+   authority stays exclusively with the strictly-higher-epoch supersede gate and
+   the operator flow), so it cannot mis-fence a healthy holder.
+2. **Under-block**: none. Genuine split-brain is still detected: `count > 1` OR
+   the pull-contest latch → `splitBrainState: 'contested'`. The freshness (3×
+   pull-interval), liveness (not-expired), and self-claim (no third-machine
+   hearsay) gates prevent both over- and under-count.
+3. **Level-of-abstraction fit**: correct. The count derivation lives in
+   `LeaseCoordinator` (where the lease/clock/expiry logic already lives) behind a
+   pure method; `getSyncStatus()` only chooses the basis and tags it.
+4. **Signal-vs-authority compliance**: fully signal-only. Peer lease claims are
+   self-asserted advisory data (L4/SEC-4); the count feeds dashboards + the
+   existing human-decision attention flow, never an automatic action. No silent
+   fallback: each `catch` yields an honest `null`+`'unavailable'` (tagged
+   `@silent-fallback-ok` as a read-only health field), never a fabricated 0.
+5. **Interactions**: the `MultiMachineSyncStatus` shape change (`number → number |
+   null` + source tag) is swept across every consumer — `/health`, `/pool`, the
+   two other route callers (leaseHolder-only, unaffected), the unit/integration/e2e
+   fixtures, `instar doctor`, and both CLAUDE.md templates. `splitBrainState`'s
+   three in-code consumers (ingress suppression, speaker-election, rope-health
+   `splitBrainItemOpen`) keep their exact semantics.
+6. **External surfaces**: none added. No new network path, no new egress. `instar
+   doctor` adds a Bearer'd localhost `/health` read (the same host it already
+   contacts) to fetch the live count.
+7. **Rollback cost**: low. Additive method + a localized `getSyncStatus()` rewrite;
+   revertable in one commit. No persistent state, no migration data. The
+   `registry-roles` basis remains as the automatic git-only-mesh degrade (there is
+   deliberately no config lever back to the old always-registry behavior — that
+   would preserve the documented defect).
+
+## Clock assumption
+
+Lease liveness (`expiresAt` vs now) is judged on the OBSERVER's clock. A
+clock-drifted machine could misjudge a peer lease's expiry and skew its own
+published count; the mesh's existing per-peer clock-skew gate
+(`MachinePoolRegistry`) marks a divergent machine placement-ineligible, and the
+freshness bound caps how long any one misjudged observation can distort the count.
+The count inherits the mesh's clock-sanity envelope rather than adding its own.
+
+## Evidence pointers
+
+- `npx tsc --noEmit` — clean.
+- `npm run lint` — exit 0 (all ratchets green, including no-silent-fallbacks).
+- `npm run build` — exit 0.
+- `npx vitest run tests/unit/multimachine-awake-count-lease-live.test.ts` — 8/8
+  pass (load-bearing Cloudflare-dead case asserts count 1 + `lease-live`, NOT 0).
+- `npx vitest run` across the mesh/lease suites (MultiMachineCoordinator-leasePull,
+  multi-machine-coordinator, HttpLeaseTransport, multimachine-syncstatus,
+  lease-contested-resolution, pool-routes, multi-machine-lease-split-brain) — all
+  green (59 + 9 pass).

package/upgrades/side-effects/self-action-convergence.md

@@ -0,0 +1,62 @@
+# Side-Effects Review — Self-Action Convergence (the class-closure guard for self-inflicted loops)
+
+**Version / slug:** `self-action-convergence`
+**Date:** `2026-07-04`
+**Author:** `echo`
+**Second-pass reviewer:** `not required — additive dev-tooling (a defect-class entry, a test ratchet, two lints, a shared detector, a precommit arm, a template clause, a migration, a constitution standard). No runtime decision surface, no routes, no user-facing behavior, no data migration. Everything ships report-only under the pre-existing prGate.classClosure dark default.`
+
+## Summary of the change
+
+Registers `unbounded-self-action` as a formal defect class in the class-closure registry (#1347) — the FIRST product-code member of that program — and builds the live guard that ends it: an N-tick sustained-pressure convergence ratchet (`tests/unit/self-action-convergence.test.ts` + the `src/testing/selfActionRegistry.ts` controller registry), a fail-closed forcing lint (`scripts/lint-no-unregistered-self-action.js`), a shared detector (`scripts/lib/self-action-detect.mjs`), a scope+convergence arm added to the class-closure CI lint (`scripts/class-closure-lint.mjs`), an early-detection arm at instar-dev commit time (`assertSelfActionDeclared` in `scripts/instar-dev-precommit.js`), a `--to-trace`/negative-declaration mode in `scripts/class-closure-declare.mjs`, a one-line side-effects-template clause, its migration (`migrateClassClosureTemplateSelfActionClause`), and the ratified constitution standard "Capacity Safety — No Unbounded Self-Action."
+
+This is the structural fix for the entire self-inflicted-loop class (swap-thrash being the presenting case). It is BBR's temporal twin: Bounded Blast Radius bounds instantaneous MASS; this bounds steady-state FREQUENCY under feedback.
+
+Files touched: `docs/defect-classes.json`, `docs/STANDARDS-REGISTRY.md`, `docs/specs/self-action-convergence.md` (+ `.eli16.md`), `scripts/lib/self-action-detect.mjs` (new), `src/testing/selfActionRegistry.ts` (new), `tests/unit/self-action-convergence.test.ts` (new), `scripts/lint-no-unregistered-self-action.js` (new), `scripts/class-closure-lint.mjs`, `scripts/class-closure-declare.mjs`, `scripts/instar-dev-precommit.js`, `skills/instar-dev/templates/side-effects-artifact.md`, `src/core/PostUpdateMigrator.ts`, `package.json`, plus tests (`tests/unit/self-action-detect.test.ts`, `tests/unit/lint-no-unregistered-self-action.test.ts`, `tests/unit/migrate-class-closure-self-action-clause.test.ts`, `tests/integration/class-closure-lint-self-action.test.ts`).
+
+## Decision-point inventory
+
+- **`unbounded-self-action` defect class** — add (registry semantics) — a protected-path registry entry. Governs fix-time declarations; does not gate runtime.
+- **Convergence ratchet + controller registry** — add (CI test) — drives modeled controllers under a pinned worst-case fixture; fails the build (once green) if a registered controller does not settle. Zero runtime authority.
+- **Forcing lint** — add (CI lint) — refuses an unregistered self-action controller emit. **Report-only by default** (exits 0 unless `prGate.classClosure.enabled && !dryRun`).
+- **Class-closure CI lint scope arm + convergence check** — modify (CI lint) — a self-action diff now requires a declaration; a per-tick-cap-only `howCaught` is flagged. Hard-violations recorded; **fail the build only when enforcing** (dark default).
+- **`assertSelfActionDeclared` precommit arm** — add (commit gate) — blocks a self-action src/ change with no declaration/negative. FAIL-OPEN on tooling failure; a genuine one-shot costs one attested negative line.
+- **Shared detector** — add (pure library) — the single source for the emit set + scope predicate + the gate decision. Deterministic; never LLM-guesses.
+- **Side-effects template clause + migration** — modify (skill template) — the Class-Closure Declaration trigger now names the self-action case; the migration reaches existing agents (Migration Parity).
+- **Constitution standard** — add (standards text) — "Capacity Safety — No Unbounded Self-Action," ratified by the operator 2026-07-04.
+- **All existing gates** — pass-through — the tone gate, coherence gate, external-operation gate, class-closure gate's existing behavior are unchanged; this composes with #1347, it does not fork it.
+
+## 1. Over-block
+
+**No runtime block/allow surface — over-block N/A.** The only new blocking paths are DEV-TIME gates (the precommit arm + the CI lints), and both ship report-only under the pre-existing `prGate.classClosure` dark default. The precommit arm fails OPEN on any tooling failure (empty diff, no src/ file, unreadable artifact) and offers an explicit one-line negative-declaration escape, so a genuine one-shot / user-driven action is never unescapably blocked. The forcing lint is scoped to controller-SHAPE files to avoid flagging every `retry(` in src/.
+
+## 2. Under-block
+
+**No runtime under-block surface.** The completeness guarantee (every controller registered) is report-only until the operator flips enforcing on measured declaration population, per #1347's own criterion. Until then a NEW self-action can still ship un-registered — the honest, deliberate soak posture; the E2 CI lint + E3 precommit arm are the earlier backstops, and the string-based scope is named as an accident-deterrent (the obfuscation-resistant closure is the follow-on funnel, Part B).
+
+## 3. Ordering / idempotency
+
+The migration is idempotent (marker short-circuit). The declare `--to-trace` mode is idempotent (identical block → no change). The ratchet + lints are pure re-runnable evaluations. No persistent runtime state, no ordering dependency.
+
+## 4. Signal vs. Authority
+
+Compliant. The detector is DETERMINISTIC — it forces a declaration, it never LLM-guesses (Signal vs. Authority). The ratchet + lints are structure, not willpower. The convergence proof is a CI ratchet, not discretionary prose. No new blocking authority is granted to any LLM path.
+
+## 5. Feedback loops
+
+**This spec IS the answer to the feedback-loop question** the swap-thrash review never answered. The change adds NO new runtime control loop — it adds a CI/commit-time invariant that PROVES other control loops converge. It cannot itself spiral (it is a stateless test/lint run per CI invocation).
+
+## 6. External surfaces
+
+None. No HTTP routes, no external API calls, no network egress. All new surfaces are local dev-tooling (a test, two lints, a shared library, a commit-gate arm, a registry entry, a template clause, a migration, a standard).
+
+## 7. Multi-machine posture
+
+`unified` (repo-resident). The registry entry, the lints, the detector, the ratchet, and the standard all ride the git repo itself (the replication medium), reaching every checkout on `git pull` — matching #1347's declared posture. The template clause reaches existing deployed agents through the PostUpdateMigrator migration. No machine-local state, no per-machine divergence.
+
+## Class-Closure Declaration (display-only mirror)
+
+- **`defectClass`** — `unbounded-self-action` (this change REGISTERS the class AND builds its closing guard; the self-referential canonical closure).
+- **`closure`** — `guard`.
+- **`guardEvidence`** — `{ enforcementType: ratchet, citation: tests/unit/self-action-convergence.test.ts, howCaught: the ratchet drives every registered self-action controller N ticks under a pinned sustained-pressure fixture (all accounts hot / veto never clears / no progress) and asserts the action count SETTLES to a small bound that does NOT scale with the horizon — steady-state convergence via each controller's settling brake (all-hot / projected-load / exponential-backoff+breaker / suppress-unchanged), with the declared Eternal-Sentinel exemption asserting a P19 rate floor instead. A per-tick cap would NOT satisfy this — it bounds one pass, never the loop. }`
+
+The machine-readable counterpart lives in the commit's decision-audit entry (persisted from the instar-dev trace by `writeDecisionAudit`), which the CI class-closure lint reads. This mirror is display-only and is never summed with it (C1).

package/upgrades/side-effects/telegram-conservatism-pass.md

@@ -0,0 +1,83 @@
+# Side-Effects Review — Telegram Conservatism Pass
+
+**Version / slug:** `telegram-conservatism-pass`
+**Date:** `2026-07-04`
+**Author:** `echo`
+**Second-pass reviewer:** `echo (guard-adjacent; independent re-read appended)`
+
+## Summary of the change
+
+Closes the `origin:'system'`/`'user'` bypass in the auto-topic flood ceiling. `TelegramAdapter.createForumTopic` previously enforced its last-resort budget ONLY for `origin:'auto'`; a bare `origin:'system'` skipped it entirely, and `createAttentionItem` used `origin:'system'` for every HIGH/URGENT item (never coalesced) → an unbounded per-item topic path. The change: (1) the ceiling now applies to every origin except an explicit human request (`origin:'user'`) or a caller that declares its topic cardinality-bounded (`opts.bounded === true`); (2) the genuine create-once system topics are marked `bounded:true`; (3) critical attention topics get a distinct budget label and coalesce (never drop) on ceiling-refusal. Files: `src/messaging/TelegramAdapter.ts`, `src/commands/server.ts`, `tests/integration/notification-flood-burst-invariant.test.ts`. Decision point touched: the topic-creation flood ceiling (a delivery shaper).
+
+## Decision-point inventory
+
+- `TelegramAdapter.createForumTopic` flood-ceiling exemption — **modify** — exemption narrowed from `origin ∈ {user,system}` to `origin===user || bounded===true`.
+- `TelegramAdapter.createAttentionItem` critical-topic path — **modify** — critical items now ride a distinct budget label and coalesce on refusal instead of degrading.
+
+---
+
+## 1. Over-block
+
+A create-once system topic caller that a FUTURE author forgets to mark `bounded:true` would be budgeted against the ceiling (12/10min global). Because these topics are low-volume create-once, the ceiling is not approached in normal operation; a refusal self-heals on the next window (the topic recreates). No user message and no attention item is ever rejected — only a redundant per-item topic is withheld, and even then the item is coalesced into the single notices topic. Conservative-direction residual.
+
+---
+
+## 2. Under-block
+
+The raw-API lifeline topic creation (`lifeline/TelegramLifeline.ts:2685`) bypasses the adapter chokepoint entirely (separate process, create-once) and is NOT covered by this change — tracked follow-up `<!-- tracked: CMT-1901 -->`. It is create-once and cannot flood, so the miss is bounded. `origin:'user'` remains fully exempt by design (a human explicitly asking for a topic is the sanctioned exception).
+
+---
+
+## 3. Level-of-abstraction fit
+
+Correct layer. The change lives in the ONE function where topics are born (`createForumTopic`) and reuses the existing `topicCreationGuard` (an `AttentionTopicGuard` instance) and `routeToFloodNotice` — it does not add a parallel guard or a new primitive. The ceiling is exactly the chokepoint the *Bounded Notification Surface* standard designates; this change fixes a hole in it rather than bolting on a new layer.
+
+---
+
+## 4. Signal vs authority compliance
+
+- [x] No — this change has no NEW block/allow authority over agent behavior or information flow; it tunes an existing delivery shaper.
+
+The `topicCreationBudget` ceiling and `AttentionTopicGuard` are DELIVERY SHAPERS (the rate-counter carve-out in `docs/signal-vs-authority.md`): they change the FORM of delivery (one coalesced topic + a log line instead of a new topic per item) and never withhold a critical notice or drop an item. This change narrows an over-broad exemption and adds a coalesce branch — strictly more conservative, no new brittle blocking logic.
+
+---
+
+## 5. Interactions
+
+- **Shadowing:** the critical path now uses a distinct budget label (`attention-item-critical`) so LOW/NORMAL attention topics (`attention-item`) do not starve the critical budget and vice-versa. No shadowing.
+- **Double-fire:** none — one `decide()` call per creation attempt (unchanged cardinality).
+- **Races:** the guard is a per-process in-memory counter (no shared state); concurrent creations share the existing `floodNoticePending` in-flight map so the coalesce topic is created once. Unchanged.
+- **Feedback loops:** the overflow surfaces (flood-notice, agent-health lane) are marked `bounded:true`, so the ceiling can NEVER refuse the very topic the coalesce path needs — no infinite regress. Verified in the design and by the passing 1,000-item critical-flood test (which creates exactly one coalesced topic).
+
+---
+
+## 6. External surfaces
+
+- **Telegram:** fewer topics under a flood — the intended user-visible effect. A genuine lone emergency still gets its own topic (verified by the retained lone-emergency test).
+- **Persistent state:** none changed. Coalesced items are still written to the attention store + `state/attention-suppressed.jsonl` (existing paths).
+- **Other agents / users:** none — internal delivery shaping.
+- **Operator surface (Mobile-Complete):** no operator-facing actions added or touched. Not applicable.
+
+---
+
+## 6b. Operator-surface quality
+
+No operator surface (no `dashboard/*`, approval, or grant/secret form touched) — not applicable.
+
+---
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+**machine-local BY DESIGN.** The topic-creation budget is a per-`TelegramAdapter`-instance rate counter, and only the machine fronting Telegram polling creates topics. A per-machine budget is correct: it bounds the topics THAT machine creates, which is the only machine creating any. No durable state is introduced (nothing to strand on a topic transfer), no user-facing notice needs one-voice gating beyond what already exists (the change reduces notices), and no URLs are generated. Same posture as the existing `AttentionTopicGuard`.
+
+---
+
+## 8. Rollback cost
+
+Pure code, no migration, no durable-state change. Back-out = revert the diff in a single hot-fix release. The new `bounded` opt is falsy-by-default, so an un-reverted partial state can only be MORE conservative, never a flood. Lowest-cost rollback class.
+
+---
+
+## Second-pass review (guard-adjacent — independent re-read)
+
+Re-read the diff cold against the artifact. The one real behavior change is that a FLOOD (8+ in 10min per label, or 12+ global) of HIGH/URGENT attention items now coalesces instead of each spawning a topic. This contradicts the OLD "critical never coalesced" invariant — but that invariant was itself the unbounded hole (it made "mark it HIGH" a flood bypass), and the operator directive explicitly prefers a single alert topic under flood. The item is never dropped (coalesced + stored + audited). The generous per-label ceiling means a normal handful of genuine emergencies is unaffected. **Concur with the review.** No concern raised.