instar 1.3.860 → 1.3.862

package/dist/core/SessionPoolLocalClaim.d.ts

@@ -0,0 +1,24 @@
+/** Minimal ownership row needed to decide whether local delivery may confirm. */
+export interface LocalClaimOwnershipRow {
+    ownerMachineId: string;
+    status: string;
+}
+/** Dependencies for the post-local-delivery placing → active transition. */
+export interface LocalClaimConfirmationDeps {
+    selfMachineId: string;
+    readOwnership: (sessionKey: string) => LocalClaimOwnershipRow | null | undefined;
+    claimOwnership: (sessionKey: string, machineId: string) => {
+        confirmed: boolean;
+        afterConfirm?: () => void;
+    };
+    onError?: (error: unknown) => void;
+}
+/**
+ * Confirm a local placement after the established local delivery tail succeeds.
+ *
+ * Active traffic and rows owned by another machine are strict no-ops. Keeping
+ * this decision separate from SessionRouter matters: its local handler is only
+ * a fall-through marker, not proof that injection or spawn succeeded.
+ */
+export declare function confirmLocalPlacementAfterDelivery(deps: LocalClaimConfirmationDeps, sessionKey: string): boolean;
+//# sourceMappingURL=SessionPoolLocalClaim.d.ts.map

package/dist/core/SessionPoolLocalClaim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionPoolLocalClaim.d.ts","sourceRoot":"","sources":["../../src/core/SessionPoolLocalClaim.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,4EAA4E;AAC5E,MAAM,WAAW,0BAA0B;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,sBAAsB,GAAG,IAAI,GAAG,SAAS,CAAC;IACjF,cAAc,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK;QACzD,SAAS,EAAE,OAAO,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,IAAI,CAAC;KAC3B,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACpC;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,0BAA0B,EAChC,UAAU,EAAE,MAAM,GACjB,OAAO,CAyBT"}

package/dist/core/SessionPoolLocalClaim.js

@@ -0,0 +1,38 @@
+/**
+ * Confirm a local placement after the established local delivery tail succeeds.
+ *
+ * Active traffic and rows owned by another machine are strict no-ops. Keeping
+ * this decision separate from SessionRouter matters: its local handler is only
+ * a fall-through marker, not proof that injection or spawn succeeded.
+ */
+export function confirmLocalPlacementAfterDelivery(deps, sessionKey) {
+    try {
+        const current = deps.readOwnership(sessionKey);
+        if (current?.status !== 'placing' || current.ownerMachineId !== deps.selfMachineId)
+            return false;
+        const outcome = deps.claimOwnership(sessionKey, deps.selfMachineId);
+        if (!outcome.confirmed)
+            return false;
+        try {
+            outcome.afterConfirm?.();
+        }
+        catch (error) {
+            // @silent-fallback-ok — observer failure is reported through onError;
+            // the authoritative ownership transition has already committed.
+            // The authoritative transition already committed. Observer emission is
+            // best-effort and cannot reverse or falsify the confirmed outcome.
+            deps.onError?.(error);
+        }
+        return true;
+    }
+    catch (error) {
+        // @silent-fallback-ok — registry failure is reported through onError;
+        // local message delivery has already succeeded and must not be falsified.
+        // Delivery already succeeded before this helper is called. Ownership
+        // confirmation is best-effort and never turns a registry failure into a
+        // false delivery failure. The exact row state is intentionally not claimed.
+        deps.onError?.(error);
+        return false;
+    }
+}
+//# sourceMappingURL=SessionPoolLocalClaim.js.map

package/dist/core/SessionPoolLocalClaim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionPoolLocalClaim.js","sourceRoot":"","sources":["../../src/core/SessionPoolLocalClaim.ts"],"names":[],"mappings":"AAiBA;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAChD,IAAgC,EAChC,UAAkB;IAElB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,OAAO,EAAE,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,cAAc,KAAK,IAAI,CAAC,aAAa;YAAE,OAAO,KAAK,CAAC;QACjG,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sEAAsE;YACtE,gEAAgE;YAChE,uEAAuE;YACvE,mEAAmE;YACnE,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sEAAsE;QACtE,0EAA0E;QAC1E,qEAAqE;QACrE,wEAAwE;QACxE,4EAA4E;QAC5E,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.860",
+  "version": "1.3.862",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-17T07:48:41.958Z",
-  "instarVersion": "1.3.860",
+  "generatedAt": "2026-07-17T09:43:05.701Z",
+  "instarVersion": "1.3.862",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/upgrades/1.3.861.md

@@ -0,0 +1,27 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Multi-machine agents now advertise and consume healthy LAN and Tailscale
+endpoints even when an optional Cloudflare tunnel is disabled or fails to
+start.
+
+## What to Tell Your User
+
+If one remote-access path is temporarily unavailable, paired machines can keep
+seeing and coordinating with each other through their other working paths.
+
+## Summary of New Capabilities
+
+No new setting. This fixes startup wiring for the existing multi-transport
+machine mesh.
+
+## Evidence
+
+- Live single-agent CROSS-MACHINE reproduction: LAN and Tailscale health checks
+  passed while a quick tunnel returned a rate limit.
+- Mesh advertisement and endpoint unit suites: 40/40 passed.
+- TypeScript `--noEmit` compilation passed.

package/upgrades/1.3.862.md

@@ -0,0 +1,27 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+When the session pool chooses the current machine for a new conversation, its
+ownership row now advances from `placing` to `active` after the established
+local injection or spawn path succeeds.
+
+## What to Tell Your User
+
+A conversation started on the machine that receives it no longer remains
+stuck in a “starting” ownership state after it is already running.
+
+## Summary of New Capabilities
+
+No new setting. This repairs the existing session-pool placement lifecycle.
+
+## Evidence
+
+- Unit and integration coverage verifies the guarded transition, idempotence,
+  and the no-confirm-on-failed-spawn ordering.
+- A live single-agent CROSS-MACHINE laptop/Mini test advanced a fresh Mini
+  placement from `placing` to `active` at epoch 2.
+- Focused tests and TypeScript build pass.

package/upgrades/side-effects/mesh-endpoint-advertisement-without-tunnel.md

@@ -0,0 +1,114 @@
+# Side-Effects Review — Mesh endpoint advertisement without tunnel success
+
+**Version / slug:** `mesh-endpoint-advertisement-without-tunnel`
+**Date:** `2026-07-16`
+**Author:** `Instar Agent (instar-codey)`
+**Second-pass reviewer:** `not required`
+
+## Summary
+
+The boot composition root now runs self endpoint discovery after the optional
+tunnel attempt rather than only inside its success branch. A resolved
+Cloudflare URL is still recorded as before; LAN and Tailscale ropes are now
+advertised when Cloudflare is unavailable. Pool-presence and session-routing
+calls select the first validated candidate from the existing shared endpoint
+resolver rather than reading only the legacy Cloudflare URL.
+
+## Decision-point inventory
+
+- Boot tunnel result — **modified** — no longer controls whether non-tunnel
+  mesh endpoints are advertised.
+
+## 1. Over-block
+
+No block/allow surface — over-block is not applicable. Advertisement remains
+gated by an enrolled machine identity and the existing
+`meshTransport.enabled` switch.
+
+## 2. Under-block
+
+Detection failures remain best-effort and omit only the failed rope. A machine
+with no working LAN, Tailscale, or Cloudflare path remains honestly
+unreachable. Tunnel recovery that happens later still relies on the existing
+TunnelManager/sleep-wake re-advertisement lifecycle; this boot fix does not add
+a competing recovery loop.
+
+## 3. Level-of-abstraction fit
+
+The boot composition root is the correct layer because it owns tunnel startup,
+endpoint advertisement, and the shared peer URL seam used by presence/session
+calls. The existing `PeerEndpointResolver` remains the sole validation and
+priority authority; no parallel endpoint-selection logic is added.
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] No — this change has no block/allow surface.
+
+This is transport discovery and idempotent registry wiring. It removes an
+accidental dependency; it does not interpret intent, filter information, or
+make a judgment decision.
+
+## 4b. Judgment-point check
+
+No new static heuristic at a competing-signals decision point. The enumerable
+rule is that every independently detected healthy transport may be advertised;
+one optional transport's startup outcome does not authorize the others.
+
+## 5. Interactions
+
+The endpoint write is idempotent. A successful tunnel contributes its URL; a
+failed quick tunnel contributes `null`, leaving LAN/Tailscale intact. Later
+tunnel recovery and sleep/wake re-advertisement use the existing idempotent
+path and can add or replace the Cloudflare rope. Callers receive one validated
+candidate exactly as before; the candidate may now be LAN or Tailscale when
+Cloudflare is absent.
+
+## 6. External surfaces
+
+`GET /pool` becomes more honest because reachable peers retain advertised
+ropes during a tunnel outage. Registry schema, authentication, mesh RPC, and
+operator actions are unchanged. The existing machine registry gains endpoint
+values it was already designed to carry; no new external request is introduced.
+
+## 6b. Operator-surface quality
+
+No operator surface — not applicable.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+**Replicated.** Each machine discovers its own physical endpoints and writes
+them to its self-owned registry row. The existing authenticated registry-sync
+path propagates that row to peers, which consume it through the endpoint
+resolver and pool heartbeat. There are no user-facing notices, no topic-bound
+durable state, and no generated user URL. Cloudflare URLs continue to cross
+machine boundaries through the existing `lastKnownUrl` and endpoint fields.
+
+## 8. Rollback cost
+
+Pure code rollback with no migration. Rolling back restores the failure where
+a tunnel outage suppresses every endpoint at the next boot.
+
+## Evidence
+
+- `tests/unit/mesh-url-advertisement-wiring.test.ts`
+- `tests/unit/MeshEndpointAdvertiser.test.ts`
+- `tests/unit/mesh-url-advertiser.test.ts`
+- Live single-agent CROSS-MACHINE laptop/Mini health probes.
+
+## Conclusion
+
+The fix is narrow and clear to ship. It restores the intended independence of
+the three existing mesh transports without changing their security, priority,
+or retry policies.
+
+## Second-pass review
+
+Not required: this does not touch messaging block/allow, session lifecycle,
+compaction, a coherence gate, trust, or a sentinel/guard/watchdog.
+
+## Class-Closure Declaration (display-only mirror)
+
+No agent-authored-artifact defect and no self-triggered controller is added or
+modified — not applicable.

package/upgrades/side-effects/session-pool-self-placement-confirmation.md

@@ -0,0 +1,99 @@
+# Side-Effects Review — Session-pool self-placement confirmation
+
+**Version / slug:** `session-pool-self-placement-confirmation`
+**Date:** `2026-07-17`
+**Author:** `Instar Agent (instar-codey)`
+**Second-pass reviewer:** `continuation_impl_review` (independent Codex reviewer) — CONCUR after two correction rounds
+
+## Summary
+
+Successful local session delivery now confirms a self-owned `placing` row as
+`active`. Confirmation remains outside `SessionRouter`, after the real local
+inject/spawn seam. Failed spawns do not confirm.
+
+## Decision-point inventory
+
+- Post-local-delivery ownership transition — **modified** — a successful local
+  tail may confirm only its own still-placing row.
+
+## 1. Over-block
+
+No message is newly blocked. Missing, active, or remotely-owned rows are no-ops.
+
+## 2. Under-block
+
+The transition cannot run before delivery because every callsite is after a
+synchronous injection that returned true or inside a spawn/respawn success
+continuation. A rejected injection or spawn does not confirm.
+Registry confirmation failure is diagnostic-only after delivery and cannot fall
+into the delivery-failure handler. If the transition commits but observer
+emission fails, the committed outcome remains true and diagnostics avoid
+claiming an unknowable row state.
+
+## 3. Level-of-abstraction fit
+
+The state predicate is a small pure core. Server wiring owns the timing because
+it alone knows when the legacy local delivery tail has actually succeeded.
+
+## 4. Signal vs authority compliance
+
+The ownership registry remains the sole transition authority. Local delivery
+success is evidence supplied to that authority, not a parallel ownership store.
+
+## 4b. Judgment-point check
+
+No heuristic is introduced. The enumerable rule is `status=placing AND
+owner=self AND local delivery succeeded`.
+
+## 5. Interactions
+
+Ordinary traffic to an active local session calls the helper but performs no
+write. Remote placement confirmation remains unchanged. SpawnAdmission still
+runs before every local spawn and a refusal cannot reach confirmation.
+
+## 6. External surfaces
+
+`GET /pool/ownership-view` now reports `active` after a successful self-placement.
+No schema, authentication, configuration, or user command changes.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+**Replicated.** The transition is written to the existing ownership registry
+and propagated by its existing replication path. A live laptop/Mini test proved
+the receiving Mini's row reached `active`.
+
+## 8. Rollback cost
+
+Pure code rollback with no migration. Rollback restores stuck `placing` rows
+for new self-placements.
+
+## Evidence
+
+- `tests/unit/SessionPoolLocalClaim.test.ts`
+- `tests/unit/session-pool-activation-wiring.test.ts`
+- `tests/integration/session-pool-local-claim.integration.test.ts`
+- `tests/unit/no-silent-fallbacks.test.ts` (both contained error paths are
+  explicitly annotated and continue to report through `onError`)
+- Live single-agent CROSS-MACHINE topic 3462 placement: owner Mini, epoch 2,
+  status `active`.
+
+## Conclusion
+
+The change is narrow and preserves honest failure semantics. It should ship
+with the independent session-lifecycle second pass concurred.
+
+## Second-pass review
+
+The first pass found that live injection's boolean result was ignored and that
+confirmation exceptions could falsely enter delivery-failure handling. Both
+were fixed and regression-tested. The second pass found a post-commit honesty
+edge: observer emission could throw after CAS committed while diagnostics
+claimed the row remained placing. The authoritative CAS result is now separate
+from best-effort observation; committed confirmation stays true, diagnostics
+make no unverified state claim, and the observer-failure regression is pinned.
+The reviewer then concurred with no remaining findings.
+
+## Class-Closure Declaration (display-only mirror)
+
+No agent-authored-artifact defect or self-triggered controller is added or
+modified — not applicable.