instar 1.3.861 → 1.3.862

package/dist/core/SessionPoolLocalClaim.d.ts

@@ -0,0 +1,24 @@
+/** Minimal ownership row needed to decide whether local delivery may confirm. */
+export interface LocalClaimOwnershipRow {
+    ownerMachineId: string;
+    status: string;
+}
+/** Dependencies for the post-local-delivery placing → active transition. */
+export interface LocalClaimConfirmationDeps {
+    selfMachineId: string;
+    readOwnership: (sessionKey: string) => LocalClaimOwnershipRow | null | undefined;
+    claimOwnership: (sessionKey: string, machineId: string) => {
+        confirmed: boolean;
+        afterConfirm?: () => void;
+    };
+    onError?: (error: unknown) => void;
+}
+/**
+ * Confirm a local placement after the established local delivery tail succeeds.
+ *
+ * Active traffic and rows owned by another machine are strict no-ops. Keeping
+ * this decision separate from SessionRouter matters: its local handler is only
+ * a fall-through marker, not proof that injection or spawn succeeded.
+ */
+export declare function confirmLocalPlacementAfterDelivery(deps: LocalClaimConfirmationDeps, sessionKey: string): boolean;
+//# sourceMappingURL=SessionPoolLocalClaim.d.ts.map

package/dist/core/SessionPoolLocalClaim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionPoolLocalClaim.d.ts","sourceRoot":"","sources":["../../src/core/SessionPoolLocalClaim.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,4EAA4E;AAC5E,MAAM,WAAW,0BAA0B;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,sBAAsB,GAAG,IAAI,GAAG,SAAS,CAAC;IACjF,cAAc,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK;QACzD,SAAS,EAAE,OAAO,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,IAAI,CAAC;KAC3B,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACpC;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,0BAA0B,EAChC,UAAU,EAAE,MAAM,GACjB,OAAO,CAyBT"}

package/dist/core/SessionPoolLocalClaim.js

@@ -0,0 +1,38 @@
+/**
+ * Confirm a local placement after the established local delivery tail succeeds.
+ *
+ * Active traffic and rows owned by another machine are strict no-ops. Keeping
+ * this decision separate from SessionRouter matters: its local handler is only
+ * a fall-through marker, not proof that injection or spawn succeeded.
+ */
+export function confirmLocalPlacementAfterDelivery(deps, sessionKey) {
+    try {
+        const current = deps.readOwnership(sessionKey);
+        if (current?.status !== 'placing' || current.ownerMachineId !== deps.selfMachineId)
+            return false;
+        const outcome = deps.claimOwnership(sessionKey, deps.selfMachineId);
+        if (!outcome.confirmed)
+            return false;
+        try {
+            outcome.afterConfirm?.();
+        }
+        catch (error) {
+            // @silent-fallback-ok — observer failure is reported through onError;
+            // the authoritative ownership transition has already committed.
+            // The authoritative transition already committed. Observer emission is
+            // best-effort and cannot reverse or falsify the confirmed outcome.
+            deps.onError?.(error);
+        }
+        return true;
+    }
+    catch (error) {
+        // @silent-fallback-ok — registry failure is reported through onError;
+        // local message delivery has already succeeded and must not be falsified.
+        // Delivery already succeeded before this helper is called. Ownership
+        // confirmation is best-effort and never turns a registry failure into a
+        // false delivery failure. The exact row state is intentionally not claimed.
+        deps.onError?.(error);
+        return false;
+    }
+}
+//# sourceMappingURL=SessionPoolLocalClaim.js.map

package/dist/core/SessionPoolLocalClaim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionPoolLocalClaim.js","sourceRoot":"","sources":["../../src/core/SessionPoolLocalClaim.ts"],"names":[],"mappings":"AAiBA;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAChD,IAAgC,EAChC,UAAkB;IAElB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,OAAO,EAAE,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,cAAc,KAAK,IAAI,CAAC,aAAa;YAAE,OAAO,KAAK,CAAC;QACjG,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sEAAsE;YACtE,gEAAgE;YAChE,uEAAuE;YACvE,mEAAmE;YACnE,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sEAAsE;QACtE,0EAA0E;QAC1E,qEAAqE;QACrE,wEAAwE;QACxE,4EAA4E;QAC5E,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.861",
+  "version": "1.3.862",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-17T08:25:10.761Z",
-  "instarVersion": "1.3.861",
+  "generatedAt": "2026-07-17T09:43:05.701Z",
+  "instarVersion": "1.3.862",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/upgrades/1.3.862.md

@@ -0,0 +1,27 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+When the session pool chooses the current machine for a new conversation, its
+ownership row now advances from `placing` to `active` after the established
+local injection or spawn path succeeds.
+
+## What to Tell Your User
+
+A conversation started on the machine that receives it no longer remains
+stuck in a “starting” ownership state after it is already running.
+
+## Summary of New Capabilities
+
+No new setting. This repairs the existing session-pool placement lifecycle.
+
+## Evidence
+
+- Unit and integration coverage verifies the guarded transition, idempotence,
+  and the no-confirm-on-failed-spawn ordering.
+- A live single-agent CROSS-MACHINE laptop/Mini test advanced a fresh Mini
+  placement from `placing` to `active` at epoch 2.
+- Focused tests and TypeScript build pass.

package/upgrades/side-effects/session-pool-self-placement-confirmation.md

@@ -0,0 +1,99 @@
+# Side-Effects Review — Session-pool self-placement confirmation
+
+**Version / slug:** `session-pool-self-placement-confirmation`
+**Date:** `2026-07-17`
+**Author:** `Instar Agent (instar-codey)`
+**Second-pass reviewer:** `continuation_impl_review` (independent Codex reviewer) — CONCUR after two correction rounds
+
+## Summary
+
+Successful local session delivery now confirms a self-owned `placing` row as
+`active`. Confirmation remains outside `SessionRouter`, after the real local
+inject/spawn seam. Failed spawns do not confirm.
+
+## Decision-point inventory
+
+- Post-local-delivery ownership transition — **modified** — a successful local
+  tail may confirm only its own still-placing row.
+
+## 1. Over-block
+
+No message is newly blocked. Missing, active, or remotely-owned rows are no-ops.
+
+## 2. Under-block
+
+The transition cannot run before delivery because every callsite is after a
+synchronous injection that returned true or inside a spawn/respawn success
+continuation. A rejected injection or spawn does not confirm.
+Registry confirmation failure is diagnostic-only after delivery and cannot fall
+into the delivery-failure handler. If the transition commits but observer
+emission fails, the committed outcome remains true and diagnostics avoid
+claiming an unknowable row state.
+
+## 3. Level-of-abstraction fit
+
+The state predicate is a small pure core. Server wiring owns the timing because
+it alone knows when the legacy local delivery tail has actually succeeded.
+
+## 4. Signal vs authority compliance
+
+The ownership registry remains the sole transition authority. Local delivery
+success is evidence supplied to that authority, not a parallel ownership store.
+
+## 4b. Judgment-point check
+
+No heuristic is introduced. The enumerable rule is `status=placing AND
+owner=self AND local delivery succeeded`.
+
+## 5. Interactions
+
+Ordinary traffic to an active local session calls the helper but performs no
+write. Remote placement confirmation remains unchanged. SpawnAdmission still
+runs before every local spawn and a refusal cannot reach confirmation.
+
+## 6. External surfaces
+
+`GET /pool/ownership-view` now reports `active` after a successful self-placement.
+No schema, authentication, configuration, or user command changes.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+**Replicated.** The transition is written to the existing ownership registry
+and propagated by its existing replication path. A live laptop/Mini test proved
+the receiving Mini's row reached `active`.
+
+## 8. Rollback cost
+
+Pure code rollback with no migration. Rollback restores stuck `placing` rows
+for new self-placements.
+
+## Evidence
+
+- `tests/unit/SessionPoolLocalClaim.test.ts`
+- `tests/unit/session-pool-activation-wiring.test.ts`
+- `tests/integration/session-pool-local-claim.integration.test.ts`
+- `tests/unit/no-silent-fallbacks.test.ts` (both contained error paths are
+  explicitly annotated and continue to report through `onError`)
+- Live single-agent CROSS-MACHINE topic 3462 placement: owner Mini, epoch 2,
+  status `active`.
+
+## Conclusion
+
+The change is narrow and preserves honest failure semantics. It should ship
+with the independent session-lifecycle second pass concurred.
+
+## Second-pass review
+
+The first pass found that live injection's boolean result was ignored and that
+confirmation exceptions could falsely enter delivery-failure handling. Both
+were fixed and regression-tested. The second pass found a post-commit honesty
+edge: observer emission could throw after CAS committed while diagnostics
+claimed the row remained placing. The authoritative CAS result is now separate
+from best-effort observation; committed confirmation stays true, diagnostics
+make no unverified state claim, and the observer-failure regression is pinned.
+The reviewer then concurred with no remaining findings.
+
+## Class-Closure Declaration (display-only mirror)
+
+No agent-authored-artifact defect or self-triggered controller is added or
+modified — not applicable.