instar 1.3.790 → 1.3.792

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.790",
+  "version": "1.3.792",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-09T08:14:40.654Z",
-  "instarVersion": "1.3.790",
+  "generatedAt": "2026-07-09T10:17:12.654Z",
+  "instarVersion": "1.3.792",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6dd6ca2f8912d7e60e3210bb2db055b72b3c1cbb816598cff9d6a00c43413606",
+      "contentHash": "59884e1700f28276bccbc65f34b578851dd90c50ecbeb784bf32e46dd2817fb8",
       "since": "2025-01-01"
     },
     "cli:init": {

package/upgrades/1.3.791.md

@@ -0,0 +1,21 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+- **The stale-worktree reaper no longer reaps a worktree that a builder started using between the reaper's check and its delete (AgentWorktreeReaper TOCTOU fix).** The reaper enumerates all worktrees, captures each one's branch, then reaps up to N of them in a later loop. A build worktree whose branch was merged at enumeration but which a builder then `git checkout -b`'d onto a NEW unmerged branch would still be judged "merged" against the STALE branch and deleted mid-build (this happened once tonight). The reaper now RE-READS each worktree's live state — current branch, clean, in-use, merged — immediately before the irreversible delete, and ABORTS (keeps) on any change since evaluation. It is a pure safety tightening: strictly FEWER reaps, never more; fail-closed on any unreadable signal.
+- **New belt-and-suspenders claim:** a `.instar-build-active` marker file at a worktree root is now honored as "in use" — an in-flight builder can drop it to be certain the reaper leaves the worktree alone.
+
+## What to Tell Your User
+
+If your agent's background cleanup ever removed a worktree while a build was actively using it, that race is closed — the cleanup now double-checks the live state right before deleting and backs off if anything changed. Nothing to enable; it lands with the release. It only ever makes the cleanup MORE cautious, never less.
+
+## Summary of New Capabilities
+
+- None user-facing — a safety hardening of the AgentWorktreeReaper. Two new injected signals (`currentBranch`, `hasActiveBuildMarker`) power an execution-time re-validation that closes the enumerate→reclaim time-of-check-to-time-of-use window. No config, no gate (a pure tightening, always on).
+
+## Evidence
+
+`tests/unit/agent-worktree-reaper.test.ts` — 6 new cases pin the guard: branch-changed-since-eval → keep; went-dirty → keep; became-in-use → keep; build-marker-present → keep; still-unchanged → reaps (happy path unchanged); currentBranch-read-error (null) → keep (fail-closed). All 53 reaper tests pass, including the real-git end-to-end reclaim test. The change is delete-safe by construction — every new branch of the guard resolves toward KEEP.

package/upgrades/1.3.792.md

@@ -0,0 +1,77 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+A signal-only **red-PR watchdog** on the existing green-PR auto-merge watcher. Green-PR
+auto-merge only ever acts on GREEN PRs, so a PR of mine that goes RED and *stays* red is
+invisible to it — which is exactly how PR #1399 sat red overnight on 2026-07-08 until the
+operator found it on his morning check-in (an operator-found escape). The watchdog closes
+that gap: after the merge logic runs each tick, it checks my own open PRs and raises ONE
+deduped, age-escalating attention line — `PR #N red for Xh — <failing check names>` — for
+any PR with a required check stuck RED past a threshold (default 2h). It is SIGNAL-ONLY:
+it never merges, closes, or blocks anything.
+
+- `src/monitoring/greenPrLogic.ts` — new pure helpers `latestRunPerCheck` (dedup a rollup
+  to the newest run per check name), `failingChecksFromRollup`, and `stuckRedChecks`; plus
+  a `failingChecks` field on `PrSummary`. **Correctness fix:** `deriveRollup` now dedups to
+  the latest run per check BEFORE collapsing — a stale FAILED run superseded by a passing
+  re-run previously still read `FAILURE` (the exact bug the overnight incident surfaced),
+  which also made the green-PR merger refuse an actually-green PR.
+- `src/monitoring/greenPrAutomergeWiring.ts` — `mapPr` populates `failingChecks` from the
+  same `statusCheckRollup` the list projection already fetches (no new gh call).
+- `src/monitoring/GreenPrAutoMerger.ts` — `tick()` runs `redPrWatchdogPass` after the merge
+  logic; a per-PR `redPrRaised` memory (in state) dedups to ONE item, re-raised only on age
+  escalation or a changed failing-check set, and cleared when the PR goes green / merges /
+  closes. New `redPrWatchdog` config (`{ enabled, redThresholdMs }`, default
+  `{ enabled: true, redThresholdMs: 7_200_000 }`).
+- `src/server/routes.ts` — `GET /green-pr-automerge` now returns `stuckRed[]` +
+  `redPrWatchdog` config so "why did I get a red-PR alert?" is answerable from state.
+- `src/config/ConfigDefaults.ts`, `src/core/types.ts`, `src/commands/server.ts` — the
+  config default, type, and constructor wiring.
+
+The watchdog runs only where the parent green-PR watcher already runs (a maintainer/dev
+agent with an analyzable instar repo + safe-merge); on every other install it is inert,
+exactly like the parent feature.
+
+## What to Tell Your User
+
+- **A pull request of mine that gets stuck RED now surfaces itself.** "If one of my own PRs
+  has a required check that keeps failing for more than a couple of hours, I'll raise a
+  single quiet heads-up in your attention queue — naming the PR, how long it has been red,
+  and which checks are failing — instead of it silently sitting there unmerged. You get one
+  item per stuck PR, not a stream; it updates as the PR ages, and it clears itself the moment
+  the PR goes green, merges, or closes." This only applies on the maintainer agent that runs
+  green-PR auto-merge; it never merges or closes anything on its own — it just tells you.
+- **A subtle merge bug got fixed too.** A PR whose failed check was later re-run green used
+  to still read as failed — which could stop it from auto-merging. Now the newest run of
+  each check wins, so a re-run-green PR is correctly seen as green.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| A self-authored PR stuck RED past 2h raises ONE deduped attention line | Automatic wherever `monitoring.greenPrAutoMerge` is enabled |
+| See which of my PRs are flagged red and for how long | `GET /green-pr-automerge` → `stuckRed[]` + `redPrWatchdog` |
+| Tune the "stuck" threshold or turn the watchdog off | `monitoring.greenPrAutoMerge.redPrWatchdog` = `{ enabled, redThresholdMs }` |
+| Re-run-green PRs are no longer misread as failed | Automatic (`deriveRollup` latest-run dedup) |
+
+## Evidence
+
+- Unit (`tests/unit/green-pr-red-watchdog.test.ts`, 24): the pure helpers on both sides —
+  `latestRunPerCheck` keeps the newest run per check; `failingChecksFromRollup` /
+  `stuckRedChecks` flag past-threshold failures and skip fresh / unknown-time ones; the
+  `deriveRollup` latest-run-dedup regression (stale FAILED + later passing re-run → SUCCESS,
+  not FAILURE); and the orchestrator pass cases (a) raises one line past threshold, (b) none
+  below threshold, (c) re-run-green not stuck, (d) same PR two ticks → ONE item, (e) green →
+  none, (f) not-authored-by-me skipped, plus recovery/close clears, age-escalation re-raise,
+  disabled no-op, and the `redPrWatchdogView` read surface.
+- Unit (existing `green-pr-logic` / `green-pr-automerger` / `green-pr-automerge-wiring` /
+  `green-pr-layer2`, 92): unchanged behavior for single-run rollups — no regression.
+- Integration (`tests/integration/green-pr-automerge-routes.test.ts`, +2): `GET
+  /green-pr-automerge` surfaces `redPrWatchdog` config + an empty `stuckRed[]` when nothing
+  is red (feature-alive), and populates `stuckRed[]` after a tick over a stuck-red PR.
+- `npx tsc --noEmit` clean; the dark-gate ConfigDefaults line-map snapshot updated for the
+  +4 line shift (no new/removed dark features).

package/upgrades/side-effects/reaper-toctou-fix.md

@@ -0,0 +1,19 @@
+# Side-Effects Review — AgentWorktreeReaper TOCTOU fix
+
+**Slug:** reaper-toctou-fix · **Tier:** 1 (small, pure safety tightening) · **Author:** echo · 2026-07-09
+
+## Phase 1 — Principle check (signal vs authority)
+The AgentWorktreeReaper IS a decision authority (it deletes worktrees). This change does NOT add new brittle blocking authority — it adds MORE signal re-checks (live branch/clean/in-use/merged + a build marker) BEFORE the existing authority acts, and only ever moves the verdict toward KEEP. It feeds the existing delete-authority with fresher signals; it never blocks anything new. Compliant — strictly safer.
+
+## Phase 4 — Side-effects review (all 8)
+1. **Over-block** — Could KEEP a genuinely-reapable worktree if a signal transiently flips (a momentary lock, a slow git read). Harmless + self-correcting: KEEP means "not deleted this pass"; it's re-evaluated next pass. No data loss, ever. This is the intended safe direction.
+2. **Under-block** — Residual: a builder that checks out the SAME branch name with NEW commits between eval and reclaim → currentBranch matches, but the isMerged RE-CHECK against the current branch catches the new (unmerged) commits → keep. A micro-window between the currentBranch read and `git worktree remove` remains, but `removeWorktree` is NON-forced (refuses a dirty/locked worktree) — a second, independent guard on the actual delete. Acceptable.
+3. **Level-of-abstraction fit** — Correct layer. The reaper owns the reap decision; the re-validation belongs exactly at its reclaim point (not a higher/lower layer). No smarter existing gate to feed.
+4. **Signal vs authority** — See Phase 1. The change adds signals to make an existing authority more conservative. No new brittle authority. Ref docs/signal-vs-authority.md.
+5. **Interactions** — Runs AFTER the per-path reclaim-failure breaker and the maxReapsPerPass cap, immediately BEFORE removeWorktree. Does not shadow or double-fire with them. Adds one `reclaim-raced` event (observability). The mutated evaluation (reap-eligible→keep on race) is the same object already pushed to `evaluations`, so the reap-log/pass event reports the honest raced verdict.
+6. **External surfaces** — No API/other-agent/other-user surface change. The verdict/reap-log gains new `raced-*` reasons (pure observability). New OPTIONAL file convention: a `.instar-build-active` marker a builder may drop at a worktree root to claim it; absence = today's behavior.
+7. **Multi-machine posture** — MACHINE-LOCAL BY DESIGN. Each machine's reaper operates only on ITS OWN `.worktrees/` (worktrees are physical checkouts on one disk); currentBranch (local git) and the marker (local fs) are inherently local. No replication needed or wanted — a worktree cannot exist on two machines.
+8. **Rollback cost** — Trivial. Additive change (2 injected deps + 1 guard method + the re-validation call). No config, no migration, no persisted state. Back-out = revert the commit.
+
+## Phase 5 — Second-pass (inline; this fork cannot spawn a subagent)
+Independent adversarial re-read: (a) Could the guard ever make the reaper MORE aggressive? No — every branch of `reclaimRaceGuard` returns a KEEP reason or null; it can only subtract reaps. (b) Could a throw in the guard cause a reap? No — the guard's try/catch returns `reclaim-recheck-error` (KEEP) on any throw. (c) Does the null-branch fail-closed hold? Yes — a null live branch ≠ a non-null info.branch (info.branch is always non-null at reclaim, since evaluate keeps on !info.branch) → raced → keep; test pins this. (d) Marker fail-closed: an fs error reading the marker returns true (KEEP). **Concur with the review** — the change is delete-safe by construction; no concern raised.