instar 1.3.781 → 1.3.783

package/upgrades/1.3.783.md

@@ -0,0 +1,66 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+- **`MeteredSpendLedger`** (`src/core/MeteredSpendLedger.ts`): the authoritative, append-only,
+  booking-priced money ledger — fsync'd row-append FIRST, atomic totals-cache rewrite second,
+  boot-time refold (the fold is canon), high-water re-fold on external append, per-key async
+  mutex, reserve/settle/expire idempotent terminal state machine, expiry-aware late settle,
+  ATOMIC check-and-reserve (the cap comparison happens inside the booking critical section).
+- **`MeteredSpendGate`** (`src/core/MeteredSpendGate.ts`): the O(1) fail-closed admission gate —
+  refuses on not-live / frozen / no-cap-slice / lease-liveness-unconfirmed / unbounded-reservation /
+  unknown-price / implausible-price / stale-price policy / invalid-cap / cap-exceeded (strict `>`),
+  canonical-manifest-only pricing (an observed price is structurally not gate-eligible), code-defined
+  per-provider plausibility floors, conservative-max stale booking, and the per-door billed-token
+  mapping (`billedOutputTokens`) that errs HIGH (the Gemini thinking-token trap).
+- **`RoutingSpendCapsStore`** (`src/core/RoutingSpendCapsStore.ts`): the PIN-only money-authority
+  store (`state/routing-spend-caps.json`) — versioned (optimistic concurrency), schema-validated
+  independently of the plan machinery, before+after audited, freeze set-TRUE-only (Bearer),
+  cap-lowering bumps the lease epoch.
+- **`RenderedPlanStore`** (`src/core/RenderedPlanStore.ts`): the canonical rendered-plan machinery —
+  single-use nonce, TTL, version pins, commit-derives-solely-from-the-render (smuggled fields
+  structurally cannot land).
+- **`PinAttemptStore`** (`src/core/PinAttemptStore.ts`): durable per-IP PIN lockout shared by ALL
+  PIN routes — a restart no longer resets brute-force lockout (S2-1).
+- **`SpendAlertResolver`** (`src/core/SpendAlertResolver.ts`): the minimal alert-topic resolution
+  ladder (configured id → persisted record → fenced serving-lease-holder-only create-once) with
+  lifeline fallback + edge-latch-on-confirmed-delivery; stale-price alerts ride Increment B
+  (staleness changes admission behavior).
+- **Routes:** `POST /routing-spend/plan` (Bearer render), `POST /routing-spend/caps/adjust` /
+  `go-live` / `unfreeze` (PIN plan commits), `POST /routing-spend/freeze` (Bearer, set-true-only),
+  `GET /routing-spend/caps/log` (Bearer audit read). The caps VIEW now composes real committed
+  totals + go-live state when the money layer is enabled.
+- **Registry:** `routingSpend.money.enabled` documented in `DARK_GATE_EXCLUSIONS` (action-bearing).
+
+## What to Tell Your User
+
+Nothing yet — this ships dark and spends nothing. When your operator later enables the money
+layer and PIN-arms a paid door, your Spend tab gains real committed-spend figures and PIN-gated
+cap controls; every paid door stays off until that explicit arming. No paid door can route in
+this release regardless (the metered dispatch seam is not wired — FD-11's release gate).
+
+## Summary of New Capabilities
+
+- (⚗️ Experimental, dark) The money authority for metered LLM doors: booking ledger + fail-closed
+  cap gate + PIN-gated caps/arming with rendered-plan approval + instant Bearer freeze + durable
+  PIN lockout + stale-price alert foundation. Increment C (full alert channel), the Layer-1c
+  provider-report capture/reconciliation, and the operator's amortized-subscription display land
+  in the follow-on PRs of this increment train (tracked: CMT-1929).
+
+## Evidence
+
+- `tests/unit/metered-spend-ledger.test.ts` — 12 cases incl. both torn-write directions,
+  two-concurrent-reserves, expiry-aware late settle, fail-closed unwritable-path refusal.
+- `tests/unit/metered-spend-gate.test.ts` — the full fail-closed matrix (one case per refusal
+  reason) + the concurrent cap race (caught a real check-outside-mutex race during the build;
+  fixed by moving the comparison inside the booking critical section) + the billed-token mapping.
+- `tests/unit/routing-spend-money-stores.test.ts` — S-F2 structural regression (money state is
+  outside PATCH /config), C4-4 validator, S2-3 smuggle, nonce replay, version drift, durable
+  lockout across restarts, alert-ladder + lifeline fallback + edge latch.
+- `tests/integration/routing-spend-routes.test.ts` — the full HTTP PIN plan flow, dark-503s,
+  freeze/unfreeze asymmetry, smuggle-refusal over HTTP, audit log.
+- `tests/e2e/routing-spend-lifecycle.test.ts` — feature-alive on the REAL AgentServer boot path
+  (200 with the explicit enable; 503 on a dev agent WITHOUT it — FD-16 pinned both ways).

package/upgrades/nature-routing-a2.2-enforcing.eli16.md

@@ -0,0 +1,50 @@
+# ELI16 — Nature-Axis Routing, Increment A2.2 (enforcing selection)
+
+## The one-sentence version
+
+We took the nature-routing resolver that has been silently watching ("here's the model+door
+I *would* pick") and wired it so that, when an operator deliberately flips it on, it *actually*
+picks — the resolved model and access door become the real selection, and its fallback list
+drives the real failover.
+
+## Why
+
+Increment A2.1 shipped a resolver: given an internal check, it works out the *kind* of thinking
+the check does (a quick sort, a careful judgment, open-ended writing), walks an ordered list of
+`(door, model)` candidates, and returns the winner plus a fallback tail. But it was a spectator —
+it computed the plan, logged it, and then still did exactly today's routing. That was the honest,
+observe-first step. A2.2 is the step where the plan becomes the decision. Nothing about the
+resolver's *choice* changes; what changes is that the choice is now applied.
+
+## What already exists (and stays exactly as-is)
+
+- **The resolver** (`resolveRoute`) — the pure, side-effect-free fold with four honest outcomes:
+  a resolved route; "fall through to today's routing" (for an unmapped component); "no route —
+  use your own backup heuristic" (for a low-stakes sorter when every door is down); or **throw a
+  distinct fail-closed error** (for a safety gate when every door is down — a gate must fail shut).
+- **The safety clamps** — the deny-by-default allowlist that pins any Claude-door bounded/judgment
+  call to the single sanctioned Sonnet reserve id (so the measured-banned Opus-via-Claude-CLI route
+  can never open), the FD4 chain validators, and A1's always-on degrade clamp. None of these change.
+- **The failure-swap loop** — the existing machinery that, on a runtime failure, tries the next
+  door with per-target timeouts, a total budget, a rate-limit backoff, and honest degrade notes.
+
+## What this adds
+
+When the feature is enabled AND the operator has deliberately turned off dryRun, the resolved plan
+**replaces** today's selection: the primary `(door, model)` becomes the door and model the call runs
+on, and the resolved fallback tail feeds the *existing* failure-swap loop verbatim — each fallback
+position carrying its own concrete model. The four outcomes are honored on this real path: a fail-
+closed gate now actually throws (its caller blocks/denies, never falls open); a low-stakes empty set
+raises the ordinary "use your heuristic" error the caller already catches (never today's category
+routing, so the harness door can't sneak back in); an unmapped component falls through to today's
+routing unchanged. The old one-time "enforcing not yet wired" warning is retired — it is now real.
+
+## The safety promise
+
+When the feature is **off or unset** (the fleet default), the router is **bit-for-bit like today** —
+same door, same model, same options object passed through untouched. The named byte-identical test
+still guards this. In **dryRun** (the dev-agent default) it is still a spectator: it observes and logs,
+changes nothing. Only a deliberate operator flip of `dryRun:false` — after reviewing the dryRun plan —
+ever activates the re-routing. No defaults changed; the fleet stays dark; the metered paid doors stay
+skipped (that is Increment B, still deferred and PIN-gated). This change makes the switch *real*, but
+leaves it *off*.

package/upgrades/side-effects/nature-routing-a2.2-enforcing.md

@@ -0,0 +1,142 @@
+# Side-Effects Review — Nature-Axis Routing, Increment A2.2 (enforcing selection)
+
+**Spec:** docs/specs/nature-axis-routing.md (status: **converged — pending operator approval**;
+`review-convergence` tag, NOT `approved:true` — the operator's step). **Tier-1** change: the enforcing
+wiring for FD9's Increment A2, riding the same dev-gated dark / dryRun-defaulted ladder A2.1 shipped on.
+**Parent standards:** "Structure > Willpower", "No Silent Degradation to Brittle Fallback", benchmark-
+cited routing (INSTAR-Bench v3, rules R1/R2), the Maturation Path (dev-gated dark; the operator's
+deliberate `dryRun:false` flip is the only activation), Migration Parity (no new config, no default flip).
+
+**Date:** 2026-07-05
+**Author:** Echo (build hand, topic 29723)
+**Second-pass reviewer:** required (touches routing-of-safety-gates) — see §Second-pass.
+
+**Files:** src/core/IntelligenceRouter.ts, tests/unit/nature-routing-resolver.test.ts,
+upgrades/nature-routing-a2.2-enforcing.eli16.md, upgrades/side-effects/nature-routing-a2.2-enforcing.md,
+upgrades/next/nature-routing-a2.2-enforcing.md.
+
+## Summary of the change
+
+`IntelligenceRouter.evaluate()`'s nature block previously OBSERVED (logged the resolved plan) and then
+fell through to today's selection even with `dryRun:false`, guarded by a one-time "enforcing not yet
+wired" warning. This change makes `dryRun:false` ACTUALLY enforce (spec §Resolver steps 8-9): on outcome
+`route` the resolved primary `(door, model)` replaces `resolveFramework()`'s door + the caller's tier,
+and the resolved `swapTail` feeds the EXISTING failure-swap loop (each tail position carrying its own
+concrete model). On `no-route` it raises the ordinary non-gating heuristic error (never legacy routing);
+on a critical-gate empty set it re-throws `RouterFailClosedError`; on `fall-through` (unmapped) it uses
+today's routing untouched. The obsolete warning method + field are removed.
+
+## Decision-point inventory
+
+- `IntelligenceRouter.evaluate() — nature block` — modify — was observe-only; now, when
+  `enabled && !dryRun`, applies the resolved plan.
+- `IntelligenceRouter.evaluate() — framework/model selection` — modify — `framework`/`evalOptions`
+  now derive from the enforced primary when a plan is enforced, else today's category routing.
+- `IntelligenceRouter.evaluate() — failure-swap loop` — pass-through/extend — same loop, now driven by
+  either the resolved `swapTail` (per-position concrete model) or today's `cfg.failureSwap` frameworks.
+- `warnNatureEnforceNotWired()` + `warnedNatureEnforceNotWired` — remove — the no-op is now real wiring.
+- `resolveRoute` / `clampToReserveOnCleanDoor` / `mergeNatureRoutingChains` / the FD4/FD4.2 validators —
+  pass-through — UNCHANGED (A2.2 consumes them; it does not weaken them).
+
+---
+
+## 1. Over-block
+
+The only "block" surface is the critical-gate fail-closed throw. On the real path a mapped FD6 critical
+gate whose chain has NO available door throws `RouterFailClosedError` → the caller blocks/denies. This
+can only fire when EVERY door in the gate's chain is unreachable (metered doors are skipped in Increment
+A, so realistically all CLI doors down). That is the correct fail-closed direction for a safety gate; it
+is not an over-block of legitimate traffic — a reachable door always routes. In dryRun the same throw is
+swallowed (observe-only), so the enforcing throw only ever happens on the operator's deliberate flip.
+
+---
+
+## 2. Under-block
+
+`no-route` (low-stakes empty set) deliberately does NOT block — it raises the ordinary non-gating error
+the caller catches into its heuristic. This is spec-mandated (§573-581): a low-stakes sorter degrades to
+its own heuristic, exactly as it does today when its provider is down. It is NOT a safety gate, so not
+blocking is correct. An UNEXPECTED (non-`RouterFailClosedError`) resolver error also does not block — it
+is recorded and falls through to today's routing (fail-safe), because the pure fold only throws the typed
+error by design; a different throw is a bug and must not break routing.
+
+---
+
+## 3. Silent failure / silent degradation
+
+No silent path. `no-route` calls `onHeuristicFallthrough` before throwing (never-silent tracking). Every
+swap attempt emits an `onDegrade` note; a successful swap emits the served-by note; a fail-closed gate
+throws a distinct typed error the caller cannot mistake for a model failure. The enforcing primary always
+routes through `resolveProvider` (a real provider), never a heuristic pretending to be an answer. The
+retired warning was itself the only "honest no-op" scaffolding; removing it removes a now-false statement.
+
+---
+
+## 4. Byte-identical-when-off (THE safety case)
+
+When `sessions.natureRouting` is absent OR `enabled:false` (the fleet default), the nature block is
+skipped entirely: `enforced` stays undefined, `enforcedNoRoute` false, and `evalOptions` remains the SAME
+`options` object reference. Selection is bit-for-bit today's. In dryRun the plan is logged but `enforced`
+stays undefined (only set when `!dryRun`), so selection is still unchanged. Asserted by the named test
+`natureRouting UNSET ⇒ selection unchanged` (same options object) and the FD4.3 banned-chain-when-off
+test, both green. A new test (`dryRun:true still OBSERVES only`) proves enforcing changes nothing in
+dryRun even with a reachable alternate door.
+
+---
+
+## 5. Model-selection correctness (the concrete-id path)
+
+The resolved primary's CONCRETE model id (e.g. `gpt-5.4-mini`, `claude-sonnet-4-6`) is placed on
+`options.model` and rides verbatim to the provider — the CLI adapters (`resolveCliFlag` /
+`resolveCliModelFlag`) return a concrete id as-is and only map the three tier tokens, so a concrete id is
+honored. The claude-code reserve is already reserve-clamped by the resolver, so the caller's `capable`
+(→ Opus, the banned door) is replaced by the pinned Sonnet reserve id — asserted by the enforcing test
+`a JUDGE gate landing on claude-code enforces the CONCRETE reserve id`. Metered doors remain skipped
+(Increment A) — asserted by `a metered primary position is SKIPPED`.
+
+---
+
+## 6. Blast radius
+
+- **Scope of the real path:** only when `enabled && dryRun:false` — i.e. an operator's deliberate flip
+  after the dryRun soak. Dev agents default to dryRun; the fleet is dark. No default is changed.
+- **A1 / A2.1 untouched:** `clampClaudeCliSwapModel` (A1 tier clamp), `clampToReserveOnCleanDoor`,
+  `resolveRoute`, the FD4/FD4.2 validators are consumed as-is, not modified. All their tests stay green.
+- **The failure-swap loop:** reused verbatim, gated on `gating||deferrable` exactly as today; nature
+  positions ride the same per-target timeout / total-budget / backoff / degrade machinery. A legacy
+  swap (no nature plan) is byte-identical (base is `evalOptions`, which === `options` off the nature
+  path; no reference-equality assertion in the swap tests regresses).
+- **`cfg` nullability:** the `if (!cfg) return default` short-circuit now lives in the non-enforced
+  branch; downstream `cfg?.fallback` / `cfg?.failureSwap` use optional chaining so an enforced plan with
+  a null `cfg` (the common fleet shape) is safe. The enforced primary door is always reachable (the
+  resolver only emits reachable CLI doors), so the `!primary` degrade path is not reached under
+  enforcement.
+
+## Explicitly DEFERRED (tracked remainder — NOT dropped)
+
+- **FD6 critical-gate drift NOTICE + baseline** — depends on the durable `state/nature-routing-baseline.json`
+  store + N=3 debounce + aggregation, which the spec classifies as an "orthogonal surface AROUND the fold"
+  and whose PIN-approved baseline MUTATION is explicitly operator-only / out of this scope. The
+  `onNatureRoutePlan` hook already records the resolved plan for a future drift tracker to consume.
+- **R6 doc-tree refuse-to-author branch (FD5c)** — DORMANT in Increment A: no component in the shipped
+  nature map carries `claudeBanned`, and R6 chains are authored off-Claude, so a claudeBanned empty set
+  already resolves to `no-route` → the caller's heuristic (which for `CartographerSweepEngine` IS
+  refuse-rather-than-Claude). A dedicated refuse-to-author router branch is a separate concern.
+- **Increment B** — metered live routing + FD12 money/PIN go-live. Untouched; `metered.goLive` stays
+  false and unreferenced by this change.
+- **The durable audit log + `GET /intelligence/routing` enforced-diff surface** — the read surfaces are a
+  tracked follow-up; enforcement does not require them.
+
+## Second-pass review (Phase 5 — required: routes safety GATES)
+
+This change makes safety-gate routing REAL, so it triggers the high-risk second pass. Focus:
+(a) can the banned Opus-via-CLI route open under enforcement? — No: the resolved position is already
+reserve-clamped, and the enforced model is the concrete Sonnet reserve id, asserted by the JUDGE-reserve
+enforcing test. (b) can a critical gate fail OPEN under enforcement? — No: the empty-set critical gate
+re-throws `RouterFailClosedError` on the real path (asserted `rejects.toThrow(RouterFailClosedError)`,
+default provider NOT called), and `no-route` is reserved for non-critical low-stakes components only.
+(c) is "off" still truly inert? — Yes, the byte-identical-when-off tests remain green and a new
+dryRun-observes-only enforcing test proves the flip is the sole activation. **Reviewer focus verdict:
+the enforcing path preserves every safety invariant the resolver already guaranteed; the only new risk
+is the model-application boundary (concrete id on `options.model`), which is covered by the concrete-id
+enforcing tests and the pre-existing adapter tier-or-id resolution.**

package/upgrades/side-effects/routing-spend-increment-b.md

@@ -0,0 +1,44 @@
+# Side-Effects Review — Routing Control Room Increment B (money layer)
+
+**Spec:** `docs/specs/routing-control-room-spend-alerts.md` (review-convergence r7, approved 2026-07-07)
+**Worktree:** `echo/money-increment-b` off `JKHeadley/main` @ `4811c74bb` (v1.3.782) — remotes verified (`JKHeadley` = canonical, push target), version recorded per Phase 2.
+**Scope of this PR:** Increment B money core — `MeteredSpendLedger` (booking-priced, append-only, fold-is-canon), the O(1) fail-closed money gate, the PIN-only caps/go-live store (`state/routing-spend-caps.json`, versioned), rendered-plan machinery (nonce + TTL + version-pin), durable PIN-attempt store, Bearer freeze (set-true-only), caps-view wiring to real committed totals, and the stale-price/observed-drift alert emission on the minimal topic-resolver foundation (lifeline-fallback rails). Layer 1c provider_cost_report/reconciliation and the full Increment C channel abstraction land as the NEXT PRs in this sequence (tracked: CMT-1929).
+
+## Phase 1 — Principle check (signal-vs-authority)
+
+**Does this change involve a decision point?** YES — the money gate blocks metered LLM calls at cap.
+
+**Compliance:** The gate holds blocking authority with DETERMINISTIC ARITHMETIC over booked dollars (`committed + estCost > cap`, strict `>`), never brittle pattern-matching over meaning — the same class as the fork-bomb spawn cap and the test-runner semaphore, where deterministic authority is the CORRECT shape (docs/signal-vs-authority.md draws the line at brittle/semantic checks holding authority; arithmetic over money is neither brittle nor semantic). Authority is additionally BOUNDED: a cap refusal is a swap-tail ADVANCE (the chain falls to a free door), never a chain kill; `RouterFailClosedError` remains reserved for whole-chain exhaustion. Everything reporting-side (provider reports, drift, subsidies, credits) is SIGNAL-ONLY by structural exclusion — the gate's read set cannot reach those stores (unit-tested).
+
+## Phase 2 — Plan
+
+- **Decision points touched:** metered-call admission (new gate, fail-closed on every uncertainty); PIN plan-commit (S2-3 rendered-plan, single-use nonce, version drift refusal); Bearer freeze (set-true-only — halting money is cheap, releasing is the operator's).
+- **Existing detectors/authorities interacted with:** `checkMandatePin` (gains a durable attempt write-through, semantics unchanged); `PATCHABLE_CONFIG_KEYS` (regression-tested to NEVER reach the caps store or any gate-consumed price value — S-F2); `RoutingPriceAuthority` (gate consumes canonical-validated points ONLY, with code-defined per-provider plausibility floors); serving-lease staleness window (self-fence read); `DARK_GATE_EXCLUSIONS` (money authority documented as the action-bearing exclusion — dark everywhere until an explicit operator enable, FD-16).
+- **Rollback path:** every surface is additive + dark. `routingSpend.money.enabled` absent ⇒ routes 503, gate never constructed, ledger never written. Disabling reverts to Increment A behavior byte-for-byte. The caps store and ledger files are inert data at rest; no migration touches existing state.
+
+## Phase 4 — Side-effects review
+
+1. **Over-block:** The gate fails closed on unknown price / stale lease / unbounded reservation — this can refuse legitimate metered calls when the manifest is stale or the pool is partitioned. Accepted BY DESIGN (money safety over availability); the refusal is a swap-tail advance to free doors, so the JOB still completes — only the paid door is withheld. Stale-price default is `book-conservative-max` (spend continues, over-booked), so manifest staleness alone does not halt paid routing.
+2. **Under-block:** A crash between fsync'd row-append and totals update leaves totals STALE-LOW by at most one booking; the next gate read runs the row-count/high-water check and re-folds — bounded, tested both torn directions. Reserve sizing uses `max_tokens` worst-case; a provider that bills MORE than `max_tokens` output would under-reserve — mitigated by settle-books-actual (absolute row) and the billed-token per-door mapping erring HIGH. **Build-time finding worth recording:** the first gate implementation compared committed-vs-cap OUTSIDE the ledger's booking mutex; the two-concurrent-reserves test caught two $8 admits passing against a $12 cap. Fixed by moving the comparison INSIDE the per-key critical section (`admitOnlyUnderCaps` on `reserve()`), which is now the pinned shape — the check-and-reserve is atomic by construction.
+3. **Level-of-abstraction fit:** The ledger/gate live in `src/core/` beside `DriftSpendLedger` (whose write-discipline they adopt); the caps store is a dedicated PIN-only store OUTSIDE config, exactly where the spec pins it (S-F2). The gate is a library consumed at the (future) metered dispatch seam — it does NOT modify `IntelligenceRouter` selection (the seam is declared, not wired; metered doors still skip — FD-11).
+4. **Signal vs authority:** See Phase 1 — compliant; deterministic authority at the right layer, reporting side structurally excluded from the gate.
+5. **Interactions:** Freeze vs go-live: freeze halts NEW admissions only (in-flight settles land — A-Min11). The reserve-expiry sweep takes the per-key lock; the (future) provider-reconciliation sweep never does — named distinctly to keep them un-conflated. Plan commits refuse on store-version drift, so a concurrent PIN action or background change re-renders instead of silently composing. The alert resolver is serving-lease-holder-only for creation; everyone else falls back to the lifeline — no duplicate-topic race with the attention queue (which is never used for spend alerts — Amendment 2).
+6. **External surfaces:** New Bearer routes (plan render, freeze, caps log) and PIN routes (adjust, go-live, price promotion) — all 503 while dark. One new Telegram surface: the "💰 Routing & Spend Alerts" topic, created at most once by the serving-lease holder as a bounded create-once system topic; stale-price/drift alerts are edge-triggered + deduped. No third-party egress beyond Telegram.
+7. **Multi-machine posture:** Money truth is SINGLE-WRITER by design in B (the whole cap on one PIN-designated metered-lease machine; FD-20); the gate self-fences (`lease-liveness-unconfirmed`) on a staleness window pinned shorter than the mesh-death threshold, so a partitioned old holder is $0-fenced before any reclaim can be offered — dual money authority structurally impossible. Caps view: committed figures are holder-known; non-holder reads proxy to the holder (wired when the pool read lands; in B-single-machine the local read IS the holder read, stated in the response). Topic-creation authority follows the SERVING lease (exists in every topology). The ledger/caps files are machine-local BY DESIGN on the designated holder; Increment D replicates slices, not files.
+8. **Rollback cost:** Config-flag revert (dark) with zero data migration; ledger/caps files remain as inert audit history. A wrong booking can never be silently edited (append-only) — corrective action is a new row + the audit trail, never a rewrite.
+
+## Phase 5 — Second-pass review
+
+Required (money gate = "gate" class). Independent audit performed via a CROSS-MODEL reviewer — the gemini CLI (this build ran as a fork that cannot spawn subagents, so the skill's reviewer-subagent step was satisfied with a cross-model independent audit instead, which is stronger independence than a same-model subagent; codex is not installed on this machine and pi's non-interactive mode wedged on file attachments). Review scope: this artifact + `MeteredSpendGate.ts` in full, with the ledger/caps-store/plan-store contracts summarized; questions posed: fail-closed completeness, reporting-side reachability into the gate, Bearer-level money authority, signal-vs-authority compliance.
+
+**Reviewer verdict:** `VERDICT: Concur with the review` (gemini, 2026-07-08)
+
+## Self-action convergence (unbounded-self-action — closure: guard)
+
+This change adds two self-triggered cadences, both registered as convergence models in `src/testing/selfActionRegistry.ts` and proven to settle by `tests/unit/self-action-convergence.test.ts` (the ratchet — enforcement: ratchet):
+- **Reserve-expiry sweep** (`metered-reserve-expiry-sweep`): the idempotent terminal state machine IS the brake — an expired reserve can never re-expire and the sweep creates no reserves, so the steady-state emission bound is the finite stale pool (per-target 1, ever).
+- **Stale-price alert** (`spend-stale-price-alert`): the 24h edge latch is the brake — a declared **Eternal Sentinel** with a 24h rate floor (stale pricing changes money ADMISSION behavior, so the alarm must re-arm daily while the condition persists; never a flood).
+
+## No-deferrals accounting
+
+Work sequenced to later PRs in this increment train (Layer 1c capture/reconciliation, Increment C channel abstraction + full emitter set, amortized-subscription display, scheduled web-research price checks) is tracked under the durable commitment CMT-1929 <!-- tracked: CMT-1929 --> and enumerated in `.instar/plans/money-increment-b-brief.md`; nothing in THIS PR's claimed scope is partial.