instar 1.3.768 → 1.3.770

package/upgrades/1.3.769.md

@@ -0,0 +1,62 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Adds two enforcement lints — deterministic, no-LLM parser scripts — that back the two
+already-ratified constitutional standards A ("An Instar Agent Is Always a Multi-Machine
+Entity") and B ("Self-Heal Before Notify") with a cheap structural signal, per
+`docs/specs/three-standards-enforcement.md` (§178-202 for A, §256-289 / §343-361 for B).
+
+- `scripts/lint-machine-local-justification.js` grades a spec's `machine-local-justification: <taxonomy-key>`
+  marker: an undefended machine-local surface is a finding, and — bidirectionally — a
+  spurious/out-of-taxonomy marker, or an `operator-ratified-exception` citing no
+  machine-verifiable ref, is a finding too.
+- `scripts/lint-self-heal-fields.js` grades a spec's self-heal declaration (anchored on
+  the `remediation-actions` field): it requires the full P19 brake set, a non-empty
+  `remediation-actions` list (the anti-no-op floor), a units-carrying
+  `max-notification-latency`, and a well-formed severity class.
+
+Both ship REPORT-FIRST — they print findings and exit 0 by default (a non-blocking
+signal); a `--strict` flag is the FAIL capability used by their tests and available for a
+later CI graduation. Each is registered in `docs/STANDARDS-REGISTRY.md` so the
+Standards Enforcement-Coverage auditor now grades Standards A and B as enforced by a
+deterministic lint (verified: two more standards move from unenforced to lint-enforced).
+No constitutional text is minted or re-ratified; no runtime `src/` code changes.
+
+## What to Tell Your User
+
+Nothing proactive — this is instar-developing-agent tooling and nothing changes for a
+user. If a user asks how the constitution's "always multi-machine" and "self-heal before
+telling me" rules are actually enforced now: two small automatic checkers read a design
+document's plain text and flag when it forgets to say which machine a piece of state
+lives on, or writes a self-repair plan that would do nothing or never stop trying. For now
+these run in report-only mode — they point out the problem but do not block anything — and
+they sit underneath the smart reviewer that still makes the real judgment call, rather than
+replacing it.
+
+## Summary of New Capabilities
+
+- **Standard A marker floor** — a no-AI checker that flags an undefended machine-local
+  state surface in a spec, and also flags the reverse: a made-up justification key or an
+  operator-ratified claim with no verifiable proof.
+- **Standard B self-heal floor** — a no-AI checker that flags a watchdog self-heal plan
+  missing its brakes, listing no real repair actions, or writing a notification deadline
+  with no time units.
+- **Report-first rollout** — both checkers signal without blocking by default; a strict
+  mode exists for their tests and a future graduation.
+- **Constitution coverage** — Standards A and B are now graded as lint-enforced by the
+  Standards Enforcement-Coverage auditor, not merely documented.
+
+## Evidence
+
+- `tests/unit/lint-machine-local-justification.test.ts` + `tests/unit/lint-self-heal-fields.test.ts`
+  — 13 unit tests (7 A + 6 B): positive/defended cases pass; undefended (A1),
+  spurious-key (A2), and no-ref (A2) fail under strict; missing-brakes (B1), no-op +
+  unitless + unknown-class (B2/B3/B4) fail under strict; out-of-scope is clean; and report
+  mode exits 0 on every bad fixture.
+- `node scripts/standards-coverage.mjs` reports the lint-enforced standard count rising
+  from 0 to 2 with Standards A and B removed from the unenforced-gaps list and zero
+  dangling references; the coverage ratchet check passes.

package/upgrades/1.3.770.md

@@ -0,0 +1,40 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Fixed the final live-proven S7 gap: a Slack session that gets **respawned** (via `/sessions/refresh`,
+a quota-swap, a restart, or restart-all — all funnel through `SessionRefresh` → `slackRespawner`) now
+re-mints its conversation bind token. A **fresh** Slack spawn passes `bootstrapConversationIds` so the
+session gets `INSTAR_BIND_TOKEN` + `INSTAR_CONVERSATION_ID` and can open durable state (a commitment)
+bound to its minted conversation id; the respawn path **omitted** it, so a refreshed/quota-swapped Slack
+session came up token-less, its durable binds were refused (fail-closed), and the follow-through fell
+back to a fragile session-local timer that dies on the next restart. The respawn now resolves the
+conversation id from the routing key (idempotent get-or-create) and passes it, restoring parity with the
+fresh spawn. Telegram was unaffected (it has a `telegramTopicId` fallback; Slack had none).
+
+## What to Tell Your User
+
+Nothing proactive — this is an internal robustness fix. If a user ever asks why a Slack promise didn't
+survive a session swap or restart, the answer is that a restarted Slack session used to lose the small
+security key it needs to save a durable, restart-proof promise, so it fell back to a flimsy timer; now
+a restarted Slack session keeps that key, so the durable follow-through survives restarts.
+
+## Summary of New Capabilities
+
+- A refreshed / quota-swapped / restarted Slack session now registers durable, restart-surviving
+  follow-through (a commitment bound to the Slack conversation), matching a fresh spawn.
+- Fail-open: if the conversation-id lookup errors, the respawn proceeds (prior token-less behavior),
+  never blocked.
+- No config, no persistent state, no Telegram change.
+
+## Evidence
+
+- `tests/unit/slack-respawn-bootstrap-ids.test.ts` — 4 cases (id → `[id]`, full `channel:thread` key,
+  `null` → `undefined`, throwing registry → `undefined` / no rethrow).
+- Existing `tests/unit/sessionRefresh-slack.test.ts` (22) stay green; `tsc` clean.
+- Live proof it closes: `docs/investigations/s7-slack-delivery-repro-2026-07-04.md` §9 — Round-1
+  (already-running session) durable bind refused; Round-2 (fresh session) durable `CMT-1922` bound to
+  the minted id. This fix makes the respawn path behave like Round-2.

package/upgrades/eli16/act1174-lint-floors.eli16.md

@@ -0,0 +1,75 @@
+# ELI16 — Two deterministic lint floors for Standards A and B
+
+## The one-sentence version
+
+Two tiny no-AI checkers now read a design spec's plain text and flag when it forgets
+the "which machine does this live on?" tag (Standard A) or writes a broken
+"try to fix it yourself before bugging the operator" plan (Standard B) — cheap
+signals that back up the smart reviewer instead of replacing it.
+
+## Why this exists
+
+Instar's constitution has two rules that used to live only in prose and reviewer
+habit:
+
+- **Standard A — "always multi-machine":** every piece of state a feature adds should
+  be SHARED across all the agent's machines by default. Keeping it on one machine is
+  only allowed for a short list of concrete reasons (a login/key that physically sits
+  on one disk, a piece of hardware, or something the operator explicitly signed off on).
+  This rule was ratified *because* a spec once wrongly kept its memory on one machine
+  and it survived SEVEN review rounds — only the operator caught it.
+- **Standard B — "self-heal before notify":** a watchdog should try a bounded, logged
+  self-repair FIRST and only ping the operator when that repair genuinely runs out of
+  road. A repair plan that does nothing, or that can retry forever, is exactly the trap
+  the rule forbids.
+
+The smart `/spec-converge` reviewer already reads for these. But "a reviewer will
+notice" is willpower, and Instar's root rule is **structure beats willpower**. So each
+rule gets a cheap deterministic floor that runs first and never needs to remember.
+
+## What actually shipped
+
+Two small parser scripts (no AI, just text rules) plus their tests:
+
+- **`scripts/lint-machine-local-justification.js` (Standard A).** It looks in a spec's
+  `## Multi-machine posture` section. If the spec says a surface is "machine-local" but
+  carries no `machine-local-justification: <reason>` tag, that's a finding. It also
+  checks the OTHER direction: a tag with a made-up reason (not one of the three allowed),
+  or an "operator ratified it" claim that cites no checkable proof (a commit SHA, a URL,
+  or a registry key), is also a finding.
+- **`scripts/lint-self-heal-fields.js` (Standard B).** When a spec declares a watchdog's
+  self-heal, it must list all its brakes (max attempts, time limit, backoff, dedupe key,
+  a breaker, a notification deadline with real units like "300s", an audit location, and
+  the concrete repair actions), plus the severity class. An empty repair-actions list
+  (the fake heal that does nothing) or a deadline written as a bare "300" with no units
+  is a finding.
+
+Both are registered in `docs/STANDARDS-REGISTRY.md` so Instar's own conformance auditor
+now grades Standards A and B as enforced by a real deterministic `lint` on disk, not just
+"documented" (the auditor confirmed: 0 → 2 lint-enforced standards).
+
+## The important nuance: report-first
+
+These lints ship in **report mode** — they PRINT their findings but exit 0 (they do not
+block anything yet). A `--strict` flag makes them exit non-zero; that is the FAIL
+capability the tests exercise and the hook a future graduation can flip on. This is
+deliberate: the marker convention is brand new, existing specs predate it, and the spec's
+own honesty clause says the deterministic floor's grade is "inert until the registry
+ship." Shipping a brand-new blocking gate over the whole spec corpus would be a wall of
+false failures. Report-first is the graduated-rollout path Instar always takes with a new
+enforcement.
+
+## Signal vs. authority
+
+Neither lint decides the hard question. Standard A's lint cannot tell whether a
+justification is TRUE; Standard B's lint cannot tell whether a repair is genuinely
+SUBSTANTIVE or a severity label is HONEST. Those calls stay with the smart `/spec-converge`
+reviewer. The lint is the cheap body; the reviewer is the mind. Together they enforce the
+rule; neither alone does.
+
+## What did NOT change
+
+No constitutional text was written or re-ratified — Standards A and B were already
+ratified by the operator on 2026-07-03. This change is purely the enforcement machinery
+(two lints + tests + the registry rows that register them as guards). It touches no
+runtime server code and changes nothing for a user.

package/upgrades/side-effects/act1174-lint-floors.md

@@ -0,0 +1,124 @@
+# Side-Effects Review — ACT-1174: two deterministic lint floors (Standards A + B)
+
+**Version / slug:** `act1174-lint-floors`
+**Date:** `2026-07-04`
+**Author:** `echo (build hand)`
+**Second-pass reviewer:** `not required (Tier 1)`
+
+## Summary of the change
+
+Ships the two DEFERRED deterministic lint floors named in
+`docs/specs/three-standards-enforcement.md` (§178-202 for A, §256-289/§343-361 for B) —
+the "registry ship" the spec hard-sequences against each standard's registered guard.
+Two no-LLM parser scripts + their unit tests + fixtures, plus the STANDARDS-REGISTRY
+guard-registration rows that let the conformance auditor grade Standards A and B as
+enforced by a deterministic `lint`.
+
+Files touched:
+- `scripts/lint-machine-local-justification.js` — Standard A marker floor (no-LLM).
+- `scripts/lint-self-heal-fields.js` — Standard B self-heal field-schema floor (no-LLM).
+- `tests/unit/lint-machine-local-justification.test.ts`, `tests/unit/lint-self-heal-fields.test.ts` — self-tests.
+- `tests/fixtures/spec-lint/*.md` — positive / negative / bidirectional / out-of-scope fixtures.
+- `docs/STANDARDS-REGISTRY.md` — the two `**Applied through.**` rows now cite the lints (enforcement registration, NOT new ratification prose).
+- `upgrades/eli16/act1174-lint-floors.eli16.md`, `upgrades/side-effects/act1174-lint-floors.md`, `upgrades/next/act1174-lint-floors.md` — gate artifacts.
+
+No constitutional text is minted or re-ratified (the standard TEXTS were ratified by the operator 2026-07-03). No runtime `src/` code changes.
+
+## Decision-point inventory
+
+- `Standards Enforcement-Coverage auditor classification (StandardsEnforcementAuditor)` — pass-through — the audit reads the registry and now classifies A + B as `lint` because the two rows cite `scripts/lint-*.js` (verified: baseline lint 0 → 2, A/B out of the gaps list, dangling still 0).
+- `/spec-converge integration reviewer` — pass-through — the semantic authority is unchanged; these lints are the deterministic SIGNAL beneath it.
+
+---
+
+## 1. Over-block
+
+The lints DO have a block/allow surface, but ONLY under `--strict`. In report mode (the shipped default) they never block. Under `--strict` the plausible over-block is: a spec that legitimately mentions "machine-local" inside its `## Multi-machine posture` section as prose discussion (not a real surface) would trip A1. This is mitigated by scoping A1's trigger to the posture section AND skipping `<placeholder>` marker values, and by the report-first default — a false positive is a printed line, never a blocked commit. `--strict` is opt-in (tests + a future graduation), so no live over-block exists today.
+
+---
+
+## 2. Under-block
+
+The deterministic floor is PRESENCE + well-formedness only, by design (Signal vs. Authority). It misses: a marker whose key is valid but substantively WRONG (A), and a self-heal whose fields are all present but whose remediation is a plausible-but-ineffective no-op or whose severity class is dishonestly `recoverable` (B). Those are exactly the semantic calls left to the `/spec-converge` reviewer — the lint is not meant to catch them. A spec that omits a posture section entirely is also not flagged (that is the reviewer's §168 call).
+
+---
+
+## 3. Level-of-abstraction fit
+
+Correct layer: a cheap, brittle DETECTOR that produces a signal, explicitly paired with the existing high-context `/spec-converge` reviewer that owns the semantic authority. This is the constitutional Signal-vs-Authority / Body-and-Mind split the spec mandates (§87-95). The lint does NOT hold blocking authority over a merge in its shipped (report) mode.
+
+---
+
+## 4. Signal vs authority compliance
+
+**Required reference:** docs/signal-vs-authority.md
+
+- [x] No — this change produces a signal consumed by an existing smart gate (the `/spec-converge` integration reviewer), and in its shipped mode it does not block at all.
+
+The lints are deterministic signals. Their `--strict` FAIL capability exists for tests and a future, separately-decided CI graduation; it is not wired into the blocking `npm run lint` chain. The reviewer holds semantic authority.
+
+---
+
+## 5. Interactions
+
+- **Shadowing:** none. The lints are standalone scripts, not wired into the blocking lint `&&`-chain, so they cannot shadow an existing lint or be shadowed.
+- **Double-fire:** none. No runtime path invokes them; they are dev/CI tooling run explicitly or by their tests.
+- **Races:** none. Pure fs-read parsers, no shared state.
+- **Feedback loops:** none.
+
+The one real interaction is the Standards Enforcement-Coverage auditor: the registry rows now resolve to on-disk `lint` guards, which RAISES the enforced ratio (0.4429 → 0.4714). That is the intended effect, not a regression; the coverage ratchet (`standards-coverage.mjs --check`) passes (floors: ratio ≥ floor, dangling ≤ 0).
+
+---
+
+## 6. External surfaces
+
+- Other agents on the same machine? No.
+- Install base? These are instar-repo dev/CI tooling; they do not ship into agent homes as runtime behavior.
+- External systems? No.
+- Persistent state? No (the coverage script's `.instar/standards-coverage.json` output is untracked runtime state, never a committed baseline).
+- Operator surface (Mobile-Complete): No operator-facing actions — dev/CI tooling only.
+
+---
+
+## 6b. Operator-surface quality
+
+No operator surface — not applicable.
+
+---
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+**machine-local BY DESIGN — pure per-machine dev/CI tooling with no durable state.** These lint scripts + tests + fixtures are repo source, replicated to every machine via git like all source (so there is no per-machine divergence to reconcile). They emit no user-facing notices (no one-voice gating needed), hold no durable state (nothing to strand on a topic transfer), and generate no URLs. The registry rows they add are likewise git-replicated source. There is no runtime state surface introduced by this change, so the multi-machine posture question is satisfied structurally: source is uniform across machines by construction.
+
+---
+
+## 8. Rollback cost
+
+Pure additive dev/CI change — revert the commit and ship as the next patch. No persistent state, no data migration, no agent-state repair, no user-visible regression. The registry rows revert cleanly (the conformance auditor simply re-grades A/B back to their prior kind). Because the lints ship report-first and are not in the blocking chain, a rollback cannot un-block anything that was blocking.
+
+## Conclusion
+
+The review produced no design changes. The two lints are correctly scoped as deterministic signals beneath the existing reviewer authority, ship report-first per the spec's honesty / hard-sequencing clause, and are registered so the conformance auditor grades Standards A and B as `lint`-enforced. Clear to ship as a Tier-1 change.
+
+---
+
+## Second-pass review (if required)
+
+**Reviewer:** not required (Tier 1)
+**Independent read of the artifact: [concur]**
+
+Tier-1 low-risk additive tooling; no independent reviewer required per the tier policy.
+
+---
+
+## Evidence pointers
+
+- `npx vitest run tests/unit/lint-machine-local-justification.test.ts tests/unit/lint-self-heal-fields.test.ts` → 13 passed (7 A + 6 B).
+- `node scripts/standards-coverage.mjs` → `lint 2` (baseline 0), A/B absent from the gaps list, dangling 0, enforced-ratio 0.4429 → 0.4714.
+- Manual fixture runs: A good-defended/good-ratified pass `--strict`; A-bad-undefended (A1), A-bad-spurious-key (A2), A-bad-ratified-noref (A2) fail `--strict`; B-good-complete + B-out-of-scope pass; B-bad-missing-fields (B1), B-bad-noop-and-unitless (B2/B3/B4) fail `--strict`; report mode exits 0 on all bad fixtures.
+
+---
+
+## Class-Closure Declaration (display-only mirror)
+
+No agent-authored-artifact defect and no self-triggered controller — not applicable. This change adds enforcement lints; it does not fix a defect in an LLM prompt/hook/config/skill/standards-text, and it introduces no loop/monitor/sentinel/reaper/scheduler/recovery path.

package/upgrades/side-effects/slack-respawn-bind-token.eli16.md

@@ -0,0 +1,46 @@
+# ELI16 — when a Slack session restarts, it now keeps its "durable-memory key"
+
+## The story
+
+There's a safety feature: when you ask the agent (over Slack) to do something later — "post a note in
+5 minutes" — it writes that promise down as a **durable commitment** so it survives even if the agent's
+session restarts. To write it down, the session needs a small **security key** (a bind token) that
+proves it's allowed to save state for *that specific Slack conversation*. The key is handed to the
+session the moment it starts up.
+
+The bug: a Slack session gets restarted fairly often — when the agent swaps to a different account to
+avoid a rate limit, when it's refreshed, or after a crash. Every time a *fresh* session starts for a
+Slack channel, it correctly gets the key. But every time a session was *restarted*, the code forgot to
+hand it the key again. So a restarted Slack session came up **without** its key, couldn't write down the
+durable promise (the save was refused for safety), and fell back to a flimsy in-memory timer instead —
+one that vanishes if the session restarts again. That's exactly the failure we've been chasing: a Slack
+promise that quietly loses its restart-proof backup after the session gets swapped.
+
+We proved this live earlier today, as a real Slack user: a message to an *already-restarted* session →
+the durable save was refused → timer fallback ("if my session had died, this note would not have been
+delivered"); a message to a *fresh* session → durable save worked. Same code, one path missing the key.
+
+## What this change does
+
+It makes the restart path hand the session its key again — the same way the fresh-start path already
+does. When a Slack session restarts, the code now looks up which Slack conversation it belongs to (a
+cheap, repeatable lookup that returns the same id every time) and gives the new session a key scoped to
+that conversation. So a restarted Slack session can write down durable, restart-proof promises again,
+just like a fresh one.
+
+## Why it's safe
+
+- It only *restores* a capability that was accidentally dropped; it adds no new powers. The security
+  gate that checks the key is unchanged — this just makes sure the rightful session actually gets its
+  own key.
+- If the lookup ever fails, it quietly falls back to the old (keyless) behavior instead of crashing —
+  a restart must never be blocked.
+- Telegram was never affected (it had a different fallback); this only fixes the Slack restart path.
+- It's a plain code change with no saved data, so rolling it back is trivial.
+
+## How we know it works
+
+Four small tests check the key-lookup helper: it returns the right conversation id, it passes the full
+channel/thread key through, it returns "no key" when there's no id, and — importantly — it never throws
+even if the lookup blows up (so a refresh can't be blocked). The 22 existing Slack-refresh tests all
+still pass.

package/upgrades/side-effects/slack-respawn-bind-token.md

@@ -0,0 +1,121 @@
+# Side-Effects Review — Slack session respawn re-mints the conversation bind token
+
+**Version / slug:** `slack-respawn-bind-token`
+**Date:** `2026-07-04`
+**Author:** `Echo`
+**Second-pass reviewer:** `not required (Tier-1)`
+
+## Summary of the change
+
+A FRESH Slack channel spawn passes `bootstrapConversationIds: [conversationId]` to
+`spawnInteractiveSession`, so the session mints `INSTAR_BIND_TOKEN` + `INSTAR_CONVERSATION_ID`
+(durable-conversation-identity §7) and can open durable state — a commitment bound to its minted
+(negative) conversation id. The Slack session **respawn** closure (`slackRespawner` in
+`src/commands/server.ts`, used by `/sessions/refresh`, quota-swap, restart, and restart-all — all
+funnel through `SessionRefresh` → `slackRespawner`) **omitted** `bootstrapConversationIds`. So a
+refreshed/quota-swapped Slack session came up **token-less** (and without `INSTAR_CONVERSATION_ID`),
+its durable commitment binds were **refused fail-closed**, and the follow-through fell back to a
+fragile session-local timer that dies on the next restart. This is the live-proven S7 gap (Round-1 of
+the 2026-07-04 test-as-self proof: an already-running/refreshed Slack session couldn't register a
+durable commitment; a fresh spawn — Round-2 — could, registering `CMT-1922` bound to `-1734007126`).
+Telegram's respawn is unaffected because it passes `telegramTopicId`, which the bind-token env
+resolver uses as a fallback; Slack has no such fallback. Fix: the respawn closure resolves the
+conversation id from the routing key (`conversationRegistry.mintForInbound(routingKey).id`, idempotent
+get-or-create → the SAME id the fresh dispatch resolves) via a new unit-tested helper
+`slackRespawnBootstrapIds` and passes it as `bootstrapConversationIds` — restoring parity with the
+fresh spawn. Files: `src/commands/server.ts` (closure + import), `src/core/slackRefreshBinding.ts`
+(helper), + test.
+
+## Decision-point inventory
+
+- `slackRespawner` closure spawn options (`src/commands/server.ts`) — **modify** — now passes
+  `bootstrapConversationIds` resolved from the routing key.
+- `slackRespawnBootstrapIds` (`src/core/slackRefreshBinding.ts`) — **add** — the pure, tested resolver.
+
+## 1. Over-block / 2. Under-block
+
+No block/allow surface. This RESTORES a capability (durable bind on a respawned Slack session) that was
+mistakenly dropped. Over/under-block not applicable.
+
+## 3. Level-of-abstraction fit
+
+Right layer — the fix is a one-option addition at the respawn spawn site, mirroring the fresh-spawn
+site exactly; the resolution is a tiny pure helper in the existing `slackRefreshBinding` module. No new
+machinery, no new authority.
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] No — no runtime block/allow surface. The bind token it restores is enforced by the EXISTING §7
+  `conversationBindGate` (unchanged); this change only ensures the legitimately-authorized session
+  actually receives its own token on respawn.
+
+## 5. Interactions
+
+- **Shadowing:** none — additive spawn option, mirroring the fresh path.
+- **Double-fire:** none. `mintForInbound` is idempotent (get-or-create), so re-resolving on respawn
+  returns the same id the fresh dispatch used; no duplicate conversation is minted.
+- **Races:** none new — the respawn already spawned a session; this only adds one option to that call.
+- **Feedback loops:** none.
+- **Fail posture:** `slackRespawnBootstrapIds` FAILS TOWARD RESPAWN — any resolution error → `undefined`
+  (the prior token-less behavior), never throws, so a refresh can never be blocked by id resolution.
+
+## 6. External surfaces
+
+- **Install base / agents:** ships with the server; a refreshed Slack session now carries its bind
+  token. No config migration. No behavior change for a session that already had the token (fresh
+  spawns) or for Telegram (unaffected — separate fallback).
+- **External systems:** Slack unchanged (same channel session, same delivery). No new API.
+- **Persistent state:** none — `INSTAR_BIND_TOKEN` lives only in the tmux `-e` env at spawn (stateless,
+  self-authenticating). This change sets it correctly on respawn; nothing is persisted.
+
+## 6b. Operator-surface quality
+
+No operator surface — not applicable.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+**machine-local BY DESIGN** — `machine-local-justification: physical-credential-locality`. A Slack
+session is a tmux process on the machine that owns the Slack connection; its bind token is minted into
+that process's env at spawn on that machine (the token is a per-session, per-machine credential — the
+§7 secret is machine-local plaintext, same posture as authToken). The respawn happens on the owning
+machine. There is no cross-machine state, notice, durable record, or URL introduced; the fix only
+corrects a spawn-option omission on the local respawn path.
+
+## 8. Rollback cost
+
+Pure code change — revert the closure option, the helper, the import, and the test. No persistent
+state; a rollback returns to the (buggy) token-less respawn. Zero-cost back-out.
+
+## Conclusion
+
+Closes the final live-proven S7 gap: a refreshed/quota-swapped Slack session now re-mints its
+conversation bind token, so durable, restart-surviving follow-through works even after a session
+churn — matching the fresh-spawn path that the 2026-07-04 test-as-self proof showed already works.
+Minimal, parity-restoring, fail-open, unit-tested. Clear to ship.
+
+## Second-pass review (if required)
+
+**Reviewer:** not required (Tier-1)
+
+## Evidence pointers
+
+- `tests/unit/slack-respawn-bootstrap-ids.test.ts` — 4 cases: resolves id → `[id]`, passes the full
+  `channel:thread` routing key, `null` id → `undefined`, throwing registry → `undefined` (fails toward
+  respawn).
+- Existing `tests/unit/sessionRefresh-slack.test.ts` (22) stay green; `tsc` clean.
+- Live proof: `docs/investigations/s7-slack-delivery-repro-2026-07-04.md` §9 (Round-1 refused vs
+  Round-2 durable `CMT-1922`).
+
+## Class-Closure Declaration (display-only mirror)
+
+- **`defectClass`** — `spawn-option-asymmetry` (`novel`; nearestExistingClass: `feature-un-enablable`;
+  includes: a spawn/respawn path that omits an option the parallel fresh-spawn path passes, silently
+  degrading a capability; excludes: an intentionally-different respawn option). Enters
+  `status:"unconfirmed"`, so this fix carries `closure: gap`.
+- **`closure`** — `gap` — a class-level guard (a lint/test asserting respawn spawn-option parity with
+  the fresh-spawn site) is out of scope for this fix.
+- **`guardEvidence`** — n/a for `closure: gap`.
+- **`gap`** — tracked follow-up: "respawn/fresh-spawn option-parity guard — assert the Slack (and other
+  platform) respawn paths pass the same identity/bind options as their fresh-spawn counterparts."