instar 1.3.804 → 1.3.806

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.804",
+  "version": "1.3.806",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-10T21:31:11.605Z",
-  "instarVersion": "1.3.804",
+  "generatedAt": "2026-07-10T22:01:40.007Z",
+  "instarVersion": "1.3.806",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "ebbf2d5b98d390b5b127cda84bc053b0ad9a0b551d59566dee002f4607f2d235",
+      "contentHash": "c24f3022b7d216daab5b517b55fae6da6d9ca04471c4fcf47ee18c9d1abb37a9",
       "since": "2025-01-01"
     },
     "cli:init": {

package/upgrades/1.3.805.md

@@ -0,0 +1,41 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Subscriptions "Set up" flow — the five topic-29836 operator-observed defects (screenshot-proven, 2026-07-10), fixed end to end:
+
+1. **D1 — a background refresh never clobbers an open interaction (new Dashboard UX Standard floor F9).** The tab's 30s poll used to rebuild the matrix/panel out from under the operator: the PIN input reverted to "Set up" mid-typing; the code-paste step was swapped for "◷ Signing in…" before the code could be pasted. New shared primitives in `dashboard/subscriptions.js` (`hasOpenInteraction`, `updateCountdowns`): a surface holding an open interaction (an episode marked `data-interaction-open`, a focused text-entry, or a dirty field) is never rebuilt — the poll merges server state around it (live TTL countdowns via `data-ttl-expires`) until the flow reaches a terminal state or the operator backs out (new Back affordance on PIN entry). Applied to the matrix, the pending panel, AND the follow-me Approve card (same defect class). Floor registered in `docs/specs/dashboard-ux-standard.md` (F9) + `docs/STANDARDS-REGISTRY.md`; enforcement: `tests/unit/dashboard-refresh-interaction-hold.test.ts` (with a negative control) + controller integration tests. Migrating the other polling tabs onto the primitives is tracked in the spec <!-- tracked: topic-29836 -->.
+2. **D2 — the matrix cell carries the COMPLETE flow.** Sign-in link, expected-account notice, code input + Submit, live link-expiry countdown, the two-codes heads-up, and Cancel all render IN the cell — from SERVER pending-login state (`appendCellSignInFlow`), so the step survives reloads and rebuilds and can never exist only in the bottom panel. start-cell responses pass through `expectedEmail`/`ttlExpiresAt`/`notice`/`kind`. The bottom panel stays as a mirror.
+3. **D3 — wrong-account hazard, both layers.** UI: the cell and the panel state prominently which account the provider's OAuth page MUST show ("the sign-in page must show headley.justin@gmail.com — if it shows a different account, tap “Switch account” first"), rendered from the enrollment record. Structural: the pre-existing fail-closed S7 email gate's held verdict now carries `expected`/`got` through `completeFollowMe` → the submit-code response → plain-language copy naming BOTH accounts ("that code signed in X — this slot needs Y; the account was NOT enrolled"). Oracle-unavailable keeps failing CLOSED, now with honest "couldn't confirm which account that was" copy.
+4. **D4 — unmistakable terminal states.** Validated → in-cell "✓ All set — <email> is signed in" with a transient `just-verified` highlight that bridges until the pool read shows Active (never a blink back to "Set up"); held/expired/dead-pane → explicit red states with a working Retry; the pending panel keeps durable ✓ Done / ✗ failed / expired cards (never a vanishing line).
+5. **D5 — the re-sign-in flow made honest (the 2026-07-10 justin-gmail incident).** (a) Record⟂pane liveness: pending-logins responses annotate each local login with `paneAlive` (tri-state, fail-toward-unknown; peers annotate their own in the pool merge); a dead-pane record renders an explicit "Sign-in needs a restart" state (no code input) and code-submit against it answers a machine-readable 409 `code:'pane-dead'` (live-but-not-ready → `pane-not-ready`). (b) Single-attempt discipline at the mint chokepoint: enroll/start returns the existing LIVE attempt on a re-request (one attempt, one URL — parallel-PKCE code crossing is structurally closed) and atomically supersedes a dead-pane zombie (abandon + fresh drive, record and pane replaced together); the start-cell reuse gate honors the same rule. (c) The already-authorized short-circuit ("You're all set up… close this window", no code ever shown): a new `EnrollmentWizard.sweepFollowMeCompletions` on the existing 5-min reissue timer detects the landed credential and completes through the SAME identity gate — making submit-code's "the reissue/complete sweep finishes it" contract true. (d) A validated completion UPSERTS an existing pool account back to active (re-auth previously crashed on `add()`'s duplicate-id refusal and stranded the flow at "finishing sign-in…" forever). (e) Wording floors: accounts by email, machines by nickname (the pool-scope pending merge now tags the SELF machine's nickname; a raw `m_<hex>` id is never shown), and error copy only references affordances that exist on its surface (no more "re-tap Approve" on surfaces with no Approve).
+
+All touched routes stay behind the existing `multiMachine.accountFollowMe` dev-gate — fleet installs keep 503ing exactly as before. API changes are additive response fields only; never a credential.
+
+## What to Tell Your User
+
+- Setting up an account on a machine from the Subscriptions grid no longer fights you: the page can't wipe your PIN or your pasted code while it refreshes, every step (link, code box, expiry countdown, warnings, Cancel) lives right in the grid cell, and finishing shows an unmistakable green "✓ All set" instead of a quiet text line.
+- Before you open a sign-in link, the cell now tells you exactly which account the sign-in page must show — and if you sign in with the wrong one, it's refused safely with a message naming both accounts. Nothing gets enrolled under the wrong identity.
+- Re-signing-in an account that expired ("Needs sign-in") actually works now: dead sign-in attempts announce themselves and restart cleanly, a second tap can't create two crossing sign-ins, and a sign-in that finishes without showing a code completes on its own within a few minutes.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|---|---|
+| Never-clobber refresh (Dashboard UX floor F9) | Automatic on the Subscriptions tab — type/tap freely; the poll merges around you |
+| Complete in-cell sign-in flow | Tap "Set up"/"Sign in"/"Retry" on a grid cell — every step stays in the cell |
+| Expected-account warning + both-accounts mismatch copy | Automatic — rendered from the enrollment record; held refusals name both emails |
+| Pane-liveness on pending logins | `GET /subscription-pool/pending-logins` → each local login carries `paneAlive: true\|false\|null` |
+| Machine-readable submit refusals | 409 `{ code: 'pane-dead' \| 'pane-not-ready' }` on `/follow-me/enroll/:id/submit-code` |
+| Single live attempt per slot | Automatic — enroll/start reuses the live attempt (`reused:true`) or supersedes a dead one |
+| No-code (short-circuit) completion sweep | Automatic — runs on the enrollment reissue timer; identity-gated like every completion |
+
+## Evidence
+
+- Tier 1: `tests/unit/dashboard-refresh-interaction-hold.test.ts` (16 — F9 predicate both sides, merge arm, NEGATIVE CONTROL proving a naive rebuild clobbers, wording floors, both-accounts copy); `tests/unit/subscriptions-render.test.ts` (48 — full in-cell flow, broken/expired/just-verified/held-detail states, expected-account notice, dead-pane card, outcome cards, wording floors, XSS-inertness); `tests/unit/enrollment-wizard.test.ts` (36 — held verdict carries expected/got both sides; completion sweep: match→validated+pool-add, mismatch→held+attention＋NOT added, not-ready→untouched, non-follow-me skipped, throwing probe safe).
+- Tier 2: `tests/integration/subscriptions-tab.test.ts` (16 — poll mid-PIN/mid-code/untyped-open never clobbers, Back releases, countdown merges on held DOM, validated→ceremony→active+just-verified→done card, held names both accounts and persists, pane-dead→needs-restart, vanished-episode→explicit expired, panel dead-pane not submittable, Approve-card PIN survives); `tests/integration/account-matrix-start-cell-route.test.ts` (7 — flow-detail passthrough, reuse carries same URL, dead-pane superseded not reused); `tests/integration/account-follow-me-submit-code-route.test.ts` (19 — pane-dead/pane-not-ready codes, wording floor, held carries both emails + parked-not-pooled, re-auth upsert); `tests/integration/account-follow-me-enroll-start-route.test.ts` (9 — healthy reuse: one URL/one drive; dead-pane supersede: exactly one live attempt); `tests/integration/subscription-enrollment-routes.test.ts` (paneAlive tri-state + live/dead annotation).
+- Tier 3: `tests/e2e/subscriptions-tab-lifecycle.test.ts` — the production route path + SHIPPED controller: the matrix cell renders the complete flow from the LIVE server (expected email, code=true link, code input, TTL, Cancel), `paneAlive` flows through the real read, and a REAL poll tick against the live server preserves a half-typed code. `tests/e2e/matrix-cell-cancel-alive.test.ts` re-run green (Cancel relay preserved).
+- Regression sweep: full subscription/follow-me/matrix suites + dashboard floor suites green.

package/upgrades/1.3.806.md

@@ -0,0 +1,30 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Replicated-store witness lookup now uses a derived in-memory index instead of scanning the journal streams on every emitted record. `ReplicatedPeerStreamReader` builds the index from own and peer replicated journal streams, then serves `loadWitness(store, recordKey)` from a `(store, recordKey) -> max HLC` map. `CoherenceJournal` and `JournalSyncApplier` update the index after replicated records are durably committed, so the index tracks fsynced bytes rather than queued writes.
+
+The journal remains authoritative. The index is not persisted and rebuilds from disk on startup or loss. Rebuild includes parity mode: the derived witness answer is compared with the legacy full-scan answer, and any mismatch logs loudly and falls back to the scan.
+
+## What to Tell Your User
+
+- Multi-machine replicated-store writes should do much less synchronous journal work. A surviving emit no longer has to rescan a large replicated-store journal just to find the latest witness for one key.
+- The optimization is conservative: it does not change merge rules, does not add a new data file, and does not make the index authoritative. If the derived answer ever disagrees with the legacy scan, Instar uses the old answer.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|---|---|
+| O(1) replicated witness lookup | No operator action; replicated-store emitters use the indexed `loadWitness` path automatically |
+| Derived witness index rebuild | Restart or index loss rebuilds from authoritative journal streams |
+| Witness parity fallback | A mismatch between index and legacy scan logs and falls back to legacy scan |
+
+## Evidence
+
+- Unit: `tests/unit/ReplicatedPeerStreamReader.test.ts` covers index correctness across own/peer updates, no journal-byte reads during emitter witness lookup, and rebuild after in-memory loss.
+- Integration: `tests/integration/replicated-witness-index.integration.test.ts` covers the real emitter path with a counted filesystem seam.
+- E2E: `tests/e2e/replicated-witness-index-lifecycle.test.ts` rebuilds from own + peer journal streams and preserves the union read shape.
+- Regression: `tests/unit/ReplicatedRecordEmitter.test.ts`, `tests/unit/evolution-manager-emit-wedge.test.ts`, and `npx tsc --noEmit` are green.

package/upgrades/eli16/replicated-witness-index.md

@@ -0,0 +1,19 @@
+# ELI16 — Replicated Witness Index
+
+## What Changed
+
+Replicated stores write their updates into append-only journal files. When one machine writes a new record, it also stamps an `observed` witness: the newest version of that same record key that this machine had already seen. That witness is what keeps two machines from silently overwriting each other when they edited the same thing at the same time.
+
+Before this change, the witness lookup was correct but expensive. Every emitted replicated record asked the peer-stream reader to find the latest witness for one `(store, recordKey)`, and the reader answered by scanning the journal streams again. On a small journal that was fine. On a real evolution-action journal with tens of megabytes and many keys, every surviving emit still paid a synchronous journal scan.
+
+This change keeps the journal as the source of truth but adds a derived in-memory witness index. When the reader attaches, it streams the journal files once in fixed-size chunks and builds a map from `(store, recordKey)` to the latest HLC witness. After that, `loadWitness()` reads the map directly instead of re-reading the journal. When the local journal or peer applier durably commits replicated records, they notify the reader after `fdatasync`, and the reader updates the map incrementally.
+
+## Why It Is Safe
+
+The index is derived and rebuildable. It is never more authoritative than the journal. A restart, missing index, or lost in-memory state simply rebuilds the map from the journal streams. The update hooks run only after durable append boundaries: local records after the journal flush has written and synced the batch, and peer records after the applier has written and synced the replica batch.
+
+The rollout also keeps a parity check. During rebuild, the derived map is compared with the legacy full-scan witness answer. If the answers ever disagree, the reader logs a loud warning and falls back to the legacy scan instead of trusting the index.
+
+## How To Verify
+
+The unit tests prove the index matches the legacy answer across local writes, peer writes, and later updates. They also prove an emitter using `loadWitness()` does not read journal bytes once the index is built. The integration test covers the real emitter path with a counted filesystem seam. The e2e lifecycle test proves a fresh reader rebuilds the witness from own and peer journal streams after the in-memory index is gone.

package/upgrades/side-effects/replicated-witness-index.md

@@ -0,0 +1,83 @@
+# Side-Effects Review — Replicated witness index
+
+**Version / slug:** `replicated-witness-index`
+**Date:** `2026-07-10`
+**Author:** `instar-codey`
+**Second-pass reviewer:** `not required`
+
+## Summary of the change
+
+This change makes the replicated-store `loadWitness(store, recordKey)` path use a derived in-memory index instead of rematerializing journal streams on every emit. The index is built by `ReplicatedPeerStreamReader` from the authoritative own and peer journal streams, then incrementally updated from two post-durability observers: `CoherenceJournal` notifies after a replicated local batch is written and `fdatasync` has returned, and `JournalSyncApplier` notifies after a peer replica batch is written and `fdatasync` has returned.
+
+The journal and replica files remain the only authority. The index is process memory only, can be rebuilt at any time, and is parity-checked against the legacy full-scan witness answer before it is trusted. If parity fails, `loadWitness` falls back to the legacy scan and logs a loud witness-index warning.
+
+## Decision-point inventory
+
+- `ReplicatedPeerStreamReader.rebuildWitnessIndex` — add — streams registered replicated journal files to build the derived `(store, recordKey) -> max HLC` map.
+- `ReplicatedPeerStreamReader.loadWitness` — modify — serves the derived map when parity is trusted; falls back to the old scan if parity is not trusted.
+- `ReplicatedPeerStreamReader.observeCommittedEntries` — add — folds durable local/peer append notifications into the derived map.
+- `CoherenceJournal.setReplicatedRecordCommitObserver` / notification — add — notifies only after local replicated records have crossed the flush/fdatasync boundary.
+- `JournalSyncApplier.setReplicatedRecordCommitObserver` / notification — add — notifies only after peer replica records have crossed the append/fdatasync boundary.
+- `server.ts` WS2 wiring — modify — attaches the two observers to the one `ReplicatedPeerStreamReader`.
+
+## 1. Over-block
+
+No user operation is newly blocked. The witness index is a read optimization for the replicated-store send path. If the index is wrong, the parity guard disables trust in it and serves the old scan result. If an observer callback throws, journal/apply durability is preserved and the index remains rebuildable from disk.
+
+## 2. Under-block
+
+The main under-detection risk is a stale derived index missing a witness. That would make a later emit omit `observed`, which is the safe merge direction: peers flag possible concurrency instead of silently clobbering. Production wiring reduces that risk by updating the index after every local and peer durable append. Restart/loss rebuilds from the journal streams.
+
+## 3. Level-of-abstraction fit
+
+Correct layer. `ReplicatedPeerStreamReader` already owns the witness seam and knows the registry, own streams, peer streams, schema validation, and HLC ordering. The journal and applier only expose post-fsync observations; they do not own witness semantics and do not persist an index. This keeps the optimization store-agnostic and avoids per-store caches.
+
+Claim-check note: `src/commands/server.ts` has several unrelated open PR claims in dashboard/update/messaging layers. This change touches only the WS2 replicated-store wiring block to attach observer callbacks. No sibling appears to own the witness-index layer.
+
+## 4. Signal vs authority compliance
+
+- [x] No new gate or authority surface.
+
+The new callbacks are informational derived-index updates. They cannot approve, block, mutate user-visible state, or make the journal authoritative in a new way. The existing journal/applier durability contracts remain the authority.
+
+## 5. Interactions
+
+- **Local journal flush:** the observer fires after the replicated batch is written and synced, so queued in-memory emits are never witnessed as durable.
+- **Peer replica apply:** the observer fires after durable replica append, matching the applier's ack-after-fsync contract.
+- **Parity mode:** rebuild compares the index answer with the legacy full-scan witness answer. A mismatch logs once and falls back to the scan.
+- **Crash/restart:** there is no persisted index to corrupt. A new reader rebuilds from own and peer streams.
+- **Existing union reads:** `loadOriginRecords`, `listRecordKeys`, and `loadOwnEntries` keep their existing behavior. This PR narrows the optimization to the hot witness lookup.
+
+## 6. External surfaces
+
+No new API route, config key, dashboard control, CLI, or persistent schema. Runtime logs may include a new `[ws2-witness-index]` parity mismatch line if the derived index ever disagrees with the legacy scan.
+
+## 6b. Operator-surface quality
+
+No operator surface. The only operator-visible change should be reduced synchronous work during replicated-store emission.
+
+## 7. Multi-machine posture
+
+This is explicitly multi-machine shared infrastructure and affects every replicated store, including PII replicated stores. The index is store-agnostic and uses the same `ReplicatedKindRegistry` and `validateReplicatedEnvelope` path as the existing reader. It does not replicate additional fields, does not write a new file, and does not expose more data to peers. It only changes how the local machine finds the max HLC it has already durably observed.
+
+## 8. Rollback cost
+
+Low to moderate. Reverting restores the legacy scan path and removes the observer callbacks. Because the index is not persisted, rollback has no data migration and cannot strand state. The cost is performance regression back to synchronous scan-per-witness on large journals.
+
+## Conclusion
+
+The change closes the performance residual without changing merge semantics: same witness answer, derived in memory, built from streamed journal reads, updated only after durable appends, and backed by parity fallback. The blast radius is shared infra, so coverage includes unit, integration, and e2e lifecycle tests.
+
+## Second-pass review (if required)
+
+**Reviewer:** not required
+**Independent read of the artifact:** not required for this Tier-1 performance optimization with no new authority, no schema migration, and parity fallback.
+
+## Evidence pointers
+
+- `npx tsc --noEmit`
+- `npx vitest run tests/unit/ReplicatedPeerStreamReader.test.ts tests/unit/ReplicatedRecordEmitter.test.ts tests/unit/evolution-manager-emit-wedge.test.ts tests/integration/replicated-witness-index.integration.test.ts tests/e2e/replicated-witness-index-lifecycle.test.ts`
+
+## Class-Closure Declaration
+
+No agent-authored-artifact defect. The recurring class was synchronous scan-per-emit after the #1414 emit-count fix. The closure is structural: witness lookup reads an O(1) derived map in the hot path, local/peer append sites update the map after fsync, and rebuild/parity keeps the journal authoritative.