instar 1.3.877 → 1.3.879

package/upgrades/1.3.878.md

@@ -0,0 +1,67 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Added one section to `docs/apprenticeship/PROGRAM-CONCEPTS.md`: "The
+Hidden-Test Battery (regression tripwires)" — the durable, generic record of
+the mechanism the operator approved on 2026-07-18. The battery is a set of
+undisclosed scenarios that each detect the LOSS of an already-valued behavior:
+passing means nothing broke, never that growth was achieved (growth stays with
+the overseer's judgment). Scenarios stay undisclosed during a drive and are
+scored retrospectively (pass / fail / not-triggered, with evidence pointers)
+as ONE necessary-not-sufficient input to ladder promotions — a failure can
+block a rung, no quantity of passes can earn one. The mechanism itself is
+disclosed to the mentee once (results appear in drive reports the mentee can
+read); only the scenario list stays hidden. The battery is disposable (a
+performed-for scenario is retired; the operator reviews the list at every rung
+change) and guardrailed: never a leaderboard, never a mid-drive threat, never
+a gate on day-to-day work, never scenarios that can harm real users, data, or
+services. Scenarios are preferentially captured from naturally-arising
+situations, manufactured only as a last resort and never on production
+surfaces.
+
+This is documentation only. No code, config, hook, job, template, or test
+changes; no runtime surface; no behavior change for any deployed agent.
+
+The second half of the stall-coverage standard: the apprenticeship transition gate now verifies each framework's stall-coverage matrix from LIVE state. At `pending→active` a provisional matrix (complete enumeration, hermetic checks) is required; at `active→complete` the full validation runs — resolvable detector/recovery symbols, closePath refs resolved against the live commitments ledger (a delivered or missing ref is a dead anchor), guard postures cross-checked against the guards inventory via each row's guardKey, and the whole verdict executed in a bounded worker (60s, timeout fails closed with a retryable reason distinct from invalidity). Every declared gap, N/A reason, and covered row is enumerated for a recorded operator acceptance: a single-use, content-hash-bound challenge accepted via the dashboard PIN or a verified-operator reply — the transition caller's own token can never self-accept. Install provenance (source-carrying vs fleet) is derived at init with a one-time migration backfill, so a fleet install gets the honest `matrix-unverifiable-no-source` verdict instead of a bogus refusal. A weekly `stall-matrix-live-check` job (ships off, silent no-op without source) re-validates the standing matrices and mints tracked refs for auto-seeded debt.
+
+The gate ships OBSERVE-FIRST: `apprenticeship.stallCoverageGate` defaults to `{enabled: true, dryRun: true}` — refusals are suppressed and logged as would-refuse verdicts until the operator flips enforcement on named evidence. The gate registers as a load-bearing-soaking row in the guards inventory (30-day soak) so an unflipped gate becomes visible debt, never silent rot.
+
+## What to Tell Your User
+
+Nothing changes in how your agent behaves. The apprenticeship program's
+documentation now records how regression tripwires work: a small, undisclosed
+set of checks that only ever fire when a learning agent LOSES a good habit it
+already had — never a score to chase, never a leaderboard, never a gate on
+daily work — with results reviewed openly after each drive as one input to
+promotion decisions a human still makes.
+
+No day-to-day behavior changes. When a new AI framework is onboarded onto your agent's platform, the onboarding sign-off now structurally requires an honest, verified answer for every known way a session can get stuck — and any gap needs your recorded approval, not a quiet checkbox.
+
+## Summary of New Capabilities
+
+- None (documentation only). New content: the "Hidden-Test Battery" section in
+  `docs/apprenticeship/PROGRAM-CONCEPTS.md`, recording the adopted
+  regression-tripwire discipline for the apprenticeship program.
+
+- Runtime stall-coverage gate on apprenticeship transitions (dry-run first, operator-owned enforcement flip).
+- PIN/verified-operator acceptance machinery with single-use, content-bound challenges.
+- Weekly matrix live-check job with tracked-ref minting for auto-seeded debt.
+
+## Evidence
+
+- `docs/apprenticeship/PROGRAM-CONCEPTS.md` — the new section (mechanism only;
+  deliberately no scenario, agent, or organization content).
+- `docs/specs/hidden-test-battery-adoption.eli16.md` — plain-English explainer.
+- `upgrades/side-effects/hidden-test-battery-adoption.md` — side-effects
+  review; every question resolves to "documentation-only, no runtime surface";
+  multi-machine posture unified-via-git; rollback = revert the doc.
+- Sanity: the whole-tree stall-coverage CI ratchet
+  (`tests/unit/stall-coverage-ratchet.test.ts`) runs green on this tree.
+
+- 290 tests across 11 suites green (gate unit boundaries both sides, acceptance authority incl. replay/self-acceptance/hash-mismatch refusals, real HTTP 409 + dry-run suppression integration, e2e lifecycle with contentHash + HEAD SHA + dirty-flag audit).
+- Full unit tier run: 37,533 passed (one silent-fallback ratchet trip resolved by annotating deliberate fallbacks; baseline unchanged).
+- tsc clean; guard-manifest lint clean; live-check script smoke-tested (no-source silent no-op; dead-server = named ledger-unreachable, zero partial mints).

package/upgrades/1.3.879.md

@@ -0,0 +1,62 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+- The outbound tone gate gains rule `B21_USER_TASK_SUBSTITUTION` — the gate's
+  FIRST ADVISORY-disposition rule (operator directive: sentinels nudge, the
+  agent decides, overrides are recorded). A message handing the USER a
+  multi-step procedure (portal click-paths, UI steps, command sequences) for
+  work the agent could do itself given at most a credential or an approval is
+  returned to the agent as a named nudge (422 tone-gate-advisory, notSent) —
+  never hard-blocked; the agent may revise, or resend unchanged with
+  `metadata.toneAdvisoryAck` (the override is recorded for the decision-quality
+  meter). A new `RULE_DISPOSITIONS` registry makes the advisory/blocking split
+  structural; the ack can never override a blocking rule. Explicit carve-outs keep
+  legitimate messages flowing: user-requested walkthroughs, structurally
+  human-reserved actions (dashboard-PIN, physical, payment/legal, CAPTCHA,
+  decisions), single one-tap links/codes, genuinely non-delegable personal
+  credentials, and a capability-uncertainty default-PASS.
+- The Self-Unblock checklist gains a tenth probe source, `owned-identities`:
+  a per-agent registry (`.instar/owned-identities.json`) of identities the
+  agent itself provisioned (test users, workspace owners, service accounts).
+  Entries advertise their scopes ONLY while their credential pointer resolves
+  (agent-home-jailed file stat / vault key-name presence — fail-closed), with
+  hard bounds (256 KB, 500 entries, 128-char strings) and no secret value ever
+  read or surfaced.
+- CLAUDE.md template + migration: agents learn Rung 0 includes identities they
+  created, the registration trigger, the canonical scope-tag form, and the
+  prune-stale-entries rule (append-only content-sniffed migration).
+
+## What to Tell Your User
+
+Two of your July 18 corrections are now built into the shared machinery. When
+I draft a message handing you step-by-step click work I could do myself, the
+gate now hands it BACK to me with the pitfall named — I make the final call,
+and if I consciously overrule the nudge, that decision is recorded and
+reviewable. This is the nudge-not-block sentinel architecture you asked for,
+applied to its first rule. And before I ever claim something
+"needs you," my blocked-task checker now also consults a registry of accounts
+and identities I myself created — so I can't again ask you about
+infrastructure I built.
+
+## Summary of New Capabilities
+
+- Outbound gate rule B21: no more click-lists handed to users for agent-doable
+  work.
+- Self-unblock now structurally consults agent-provisioned identities before
+  any "operator-only" escalation; register identities you create in
+  `.instar/owned-identities.json`.
+
+## Evidence
+
+- Spec: docs/specs/correction-derived-hardening.md (converged iter 2,
+  codex-cli:gpt-5.5 external both rounds; report in docs/specs/reports/).
+- Tests: tests/unit/messaging-tone-gate-b21.test.ts (7),
+  tests/unit/SelfUnblockProbeProviders.test.ts (+10 incl. founding-scenario
+  reproduction, jail, clamp, stale-exhausts, wiring ratchet),
+  tests/unit/SelfUnblockChecklist.test.ts (order updated),
+  tests/unit/PostUpdateMigrator-ownedIdentities.test.ts (4). All green with
+  the existing ratchets (rule-id contract, judge-by-meaning keyset).

package/upgrades/side-effects/correction-derived-hardening.md

@@ -0,0 +1,188 @@
+# Side-Effects Review — correction-derived-hardening
+
+Spec: `docs/specs/correction-derived-hardening.md` (B21_USER_TASK_SUBSTITUTION
+tone-gate rule + owned-identities self-unblock probe). CMT-904.
+
+## Phase 1 principle check (recorded)
+
+Both changes touch decision-point-adjacent surfaces, and both comply with
+signal-vs-authority by construction:
+
+- **Change A** adds a meaning-judged rule to the EXISTING single outbound
+  authority (the tone-gate LLM). No deterministic detector gains blocking
+  power; no new authority is created.
+- **Change B** adds an evidence-producing probe to a RECORDER
+  (SelfUnblockChecklist). The settle judgment stays with BlockerLedger's
+  injected Tier-1 authority; the probe cannot block anything.
+
+## 1. Over-block
+
+- **A:** the risk is citing B21 on legitimate walkthroughs. Mitigated by four
+  explicit carve-outs (user-asked, structurally-human-reserved incl.
+  dashboard-PIN actions, single one-tap link/code, discussion), a
+  false-negative severity bias, and the "the page the agent built IS the one
+  tap's destination" clarification so a Secret-Drop link + its form fields is
+  never counted as multi-step. Worst case remains a held message with a
+  concrete suggestion, visible in review history — recoverable in one resend.
+- **B:** the second-pass reviewer found the real risk here: a STALE entry
+  advertising a phantom credential would make every run non-exhausted, and
+  BlockerLedger's settle gate would then refuse a true-blocker settle FOREVER —
+  static declaration holding blocking authority over the escalation path.
+  Closed with the credentialRef LIVENESS GATE (file-stat / vault-key-presence
+  before any tag is advertised; unverifiable entries contribute nothing) plus
+  an explicit test that a fully-stale registry still EXHAUSTS. Residual: a
+  live-but-revoked credential (file exists, credential dead) still biases
+  toward a wasted self-attempt — that direction is recoverable (the attempt
+  fails, gets recorded, and the settle path accepts a failed attempt on an
+  exhausted re-run once the operator prunes or the ref is removed), and is the
+  same residual own-vault has for a revoked-but-present key.
+
+## 2. Under-block
+
+- **A:** a procedure phrased as pure narrative ("the fix lives in the app
+  config page under OAuth") without imperative steps may evade the rule; the
+  meaning-judged framing (not literal step-counting) is the mitigation, and the
+  severity bias accepts residual under-blocking as the safe direction.
+- **B:** an UNREGISTERED identity stays invisible — the registry only works if
+  agents register what they create. Addressed at the behavior layer (template
+  trigger + migrator section) rather than by scanning (a filesystem sweep for
+  credentials would violate the provider hard-safety rules).
+
+## 3. Level-of-abstraction fit
+
+- **A:** correct layer — the tone gate is the single outbound authority and
+  already owns the sibling anti-patterns (B17 deferral, B19 parking). A
+  PreToolUse hook or a deterministic phrase list would be the wrong layer
+  (string-matching an infinitely-rephrasable intent).
+- **B:** correct layer — the checklist is THE exhaustion oracle
+  (BlockerLedger's settle gate consumes its runs); a memory note or CLAUDE.md
+  prose alone would be willpower, not structure.
+
+## 4. Signal vs authority compliance
+
+Compliant (see Phase 1 above). Reference: `docs/signal-vs-authority.md`. The
+B21 rule text is judgment guidance to the existing authority; the
+owned-identities provider is a signal producer feeding a recorder whose
+authority lives elsewhere.
+
+## 5. Interactions
+
+- **A/B17-B19 overlap:** handled explicitly in the prompt — extended citation
+  precedence `B15 > B16 > B17 > B18 > B21` plus a RELATIONSHIP paragraph
+  (B17 = deferring claiming a person is required; B19 = passive parking;
+  B21 = actively supplying the procedure). The b18 test's substring assertion
+  on the old chain still passes (the new chain contains it).
+- **A/ratchets:** `gate-prompts-judge-by-meaning` (RULE_CLASSES keyset ==
+  VALID_RULES) and `tone-gate-rule-id-contract` pass with B21 in both
+  registries — verified green.
+- **B/runner:** the defensive full-coverage assert in
+  `buildProductionProbeProviders` holds (source + provider land together);
+  the canonical-order test updated for the new position (after own-vault).
+  Short-circuit semantics unchanged.
+- No double-fire: B21 has no deterministic detector, so no signal path exists
+  to race with; the owned-identities probe is read-only over one small file.
+
+## 6. External surfaces
+
+- **A:** visible to users only as (rarely) a held message + rewritten resend —
+  the same surface every gate rule already has. `/metrics/features` and the
+  review history show citations for observability.
+- **B:** a new optional per-agent file `.instar/owned-identities.json`
+  (agent-authored; absent = today's behavior). `/blockers/self-unblock-runs`
+  entries now include an `owned-identities` probe row. CLAUDE.md gains a
+  section on existing agents via the migrator (append-only, content-sniffed).
+- No timing/conversation-state dependence beyond the gate's existing review
+  flow.
+
+## 7. Multi-machine posture
+
+**Machine-local by design, both changes.** The gate rule is code shipped
+identically to every machine (version parity). The owned-identities registry is
+per-agent-home and machine-local like the vault and the playwright-profile
+registry: entries carry machine-local credential POINTERS, and an entry without
+its credential is a claim the checklist cannot act on. Cross-machine
+replication is deliberately excluded (documented in the spec); the probe's
+absence of a registry on a standby machine degrades to exactly today's
+behavior. No user-facing notices are emitted by either change (no one-voice
+concern); no durable state strands on topic transfer (the registry is not
+topic-scoped); no URLs are generated.
+
+## 8. Rollback cost
+
+- **A:** one commit removing B21 from the three registries; no data migration;
+  until then the worst failure is a false hold, immediately visible.
+- **B:** one commit removing the source + provider; the registry file becomes
+  inert data. The appended CLAUDE.md section is prose; the migration is
+  content-sniffed and simply stops matching. Hot-fix release suffices for
+  both; no agent state repair.
+
+## Class-Closure Declaration
+
+- `unbounded-self-action`: **n/a** — neither change performs or schedules any
+  self-triggered action. Change A adds prompt content to an existing gate's
+  single per-message review; Change B adds one bounded local file read inside
+  an existing on-demand checklist run. No loops, no cadences, no kill/spawn/
+  notify authority anywhere in the diff.
+
+## Spec-convergence hardening (round-1 findings folded in)
+
+Beyond the second-pass exchange below, the full /spec-converge run (2 rounds,
+six internal perspectives + codex-cli:gpt-5.5 external both rounds, conformance
+gate 0 flags both rounds) drove further hardening before commit: agent-home
+JAIL on file: refs (escape refused before any stat), 256 KB / 500-entry / 128-
+char bounds with a stat cache (rule-(b) compliance), loud server-log warning on
+a present-but-unparseable registry (the silent-recurrence trap), B21
+capability-uncertainty default-PASS + widened human-only carve-out, the
+wiring-integrity ratchet test, canonical scope-tag convention in the template +
+migrator text, and honest disclosure of the resolving-but-stale residual and
+the B21 token cost. Full catalog:
+`docs/specs/reports/correction-derived-hardening-convergence.md`.
+
+## Operator design redirect (2026-07-18 23:00 PDT, incorporated pre-merge)
+
+Mid-build the operator directed that B21 must NOT hold blocking authority:
+outbound sentinels nudge a drafted message once; the agent decides; overrides
+are recorded. Implemented as the structural `RULE_DISPOSITIONS` split (B21 as
+`advisory`; the seam returns `tone-gate-advisory`/notSent with the
+`toneAdvisoryAck` resend path; the override is logged as `advisoryOverridden`
+for the decision-quality meter; the ack can never override a blocking rule).
+This REDUCES Change A's authority below what the earlier sections review
+(their over-block analyses become strictly conservative). Migration of
+existing judgment rules to advisory is recorded in the spec as tracked intent
+(CMT-904).
+
+## Feature-delivery ratchet compliance (post-suite fix)
+
+The whole-tree feature-delivery-completeness ratchet caught that the new
+migrateClaudeMd section was untracked: registered `'owned-identities'` in
+featureSections and added the migrateFrameworkShadowCapabilities marker so
+Codex/Gemini agents (which provision identities too) also learn the registry —
+without the marker, the founding wrong-escalation would recur on non-Claude
+frameworks (the exact Secret-Drop/Commitments gap class the ratchet was built
+from).
+
+## Second-pass review
+
+Required (the change touches a gate). Performed as a REAL independent
+fresh-context reviewer run (claude one-shot over the artifact, spec, and full
+diff), 2026-07-18.
+
+**Round 1 — Concern raised:** "the owned-identities probe is the only one of
+the ten sources that can force `exhausted:false` on pure static declaration
+with no liveness check … a stale entry whose scopeTag matches the blocked
+target … means the agent cannot record a true-blocker and cannot escalate to
+the operator even after a genuine failed self-attempt — a self-perpetuating
+loop. This is precisely the 'brittle logic gaining blocking authority' pattern
+the audit targets." Recommended an existence check of the credentialRef
+pointer before advertising (a stat, not a value read).
+
+**Iteration:** the recommended design was adopted in full — the credentialRef
+liveness gate (file: stat with agent-home-relative resolution; vault: key-name
+presence via getVaultKeys; unknown/missing schemes advertise nothing), plus
+two new tests (stale registry advertises nothing; a full checklist run over a
+fully-stale registry still exhausts) and the spec/artifact text corrected to
+stop claiming the bias was purely toward wasted self-attempts.
+
+**Round 2 — Concur:** re-review of the updated diff confirmed the stranding
+path is closed and no new authority was created (the liveness check is a
+boolean stat feeding a recorder; the settle authority is unchanged).

package/upgrades/side-effects/stall-coverage-matrix-pr-b.md

@@ -0,0 +1,154 @@
+# Side-Effects Review — framework-stall-coverage-matrix PR-B
+
+**Change:** PR-B (second of the two staged PRs) of the framework-stall-coverage-matrix
+standard (spec: `docs/specs/framework-stall-coverage-matrix.md`, converged + approved
+2026-07-18; PR-A merged as #1512). Ships: the runtime apprenticeship gate
+(`src/core/ApprenticeshipStallGate.ts` + worker), the acceptance/override machinery
+(`src/core/ApprenticeshipMatrixAcceptance.ts` + two routes), the
+`stall-matrix-live-check` job (+ driver script), install-provenance derivation +
+one-time migrator backfill, the `/guards` load-bearing-soaking row, and the CLAUDE.md
+template/migration section. Gate ships behind `apprenticeship.stallCoverageGate` with
+inline default `{enabled: true, dryRun: true}` — observe-first, per the spec's
+graduated rollout.
+
+## Phase 1 principle check (recorded)
+
+This change IS a decision point: it can refuse apprenticeship transitions (409).
+Compliance shape: the gate's verdicts are the spec-classified INVARIANT half
+(deterministic structural validation — presence, tokens, symbol resolution, ref
+liveness, posture cross-check), executed in a bounded worker; every judgment call
+(whether a covered claim is TRUE, acceptance of gaps/N-A/covered rows, degraded-mode
+sign-off) is routed to an authenticated HUMAN principal via the challenge-bound
+acceptance machinery — requester ≠ acceptor structurally (a bearer principal is
+refused at bind). The fallback ladder ends deterministic: no valid acceptance → refuse
+(no acceptance is ever inferred). This is Judgment-Within-Floors compliant: the floor
+(schema/enumeration/liveness) is deterministic; the human holds the semantic choice.
+
+## 1. Over-block
+
+- The gate could refuse a legitimate completion on: a dead closePath ref (fix: reopen
+  or re-status the row), a renamed detector symbol (fix: update the row), a stale
+  acceptance after an edit (accept-then-edit voids by DESIGN — decision 20), a
+  validator timeout (named retryable reason, distinct from invalidity), or an
+  unreachable local server during liveness checks (named 'ledger-unreachable
+  (retry)' — never conflated with matrix-invalid).
+- Mitigations: ships dryRun (would-refuse logged, nothing blocked) until the operator
+  flips enforce on named evidence; refusal reasons name class id + rule; the
+  per-instance recorded override (row-scoped, content-bound, expiring) is the relief
+  valve for a flaky check; pre-ship instances are grandfathered (warning-only) until
+  the required-since minor.
+
+## 2. Under-block
+
+- Semantic truth of `covered` remains un-validated by machine — by explicit spec
+  design; the acceptance enumeration puts every row class in front of the acceptor.
+- The conversational acceptance arm binds on the operator's reply-anchor; a verified
+  operator absent-mindedly replying "yes" to the wrong enumeration message binds that
+  enumeration — bounded by the single-use challenge, the rendered set in the message,
+  and hash re-resolution at bind (a changed matrix invalidates).
+- While dryRun holds (the shipped state), NOTHING is enforced — the /guards
+  load-bearing-soaking row (30-day window, declared 2026-07-18) makes an unflipped
+  gate lapse into visible debt rather than rot ("A Dark Feature Guards Nothing"
+  applied to this gate itself).
+
+## 3. Level-of-abstraction fit
+
+The gate is a separate module consumed by ApprenticeshipProgram through a nullable
+seam — the transition chokepoint remains the single authority; the gate adds a branch
+there rather than a parallel path. Validation executes in a worker (never the event
+loop — instar#1069 posture); acceptance rides the existing challenge mechanics
+(ScopeAccretionRatifier pattern + checkMandatePin funnel) rather than inventing a new
+authority surface.
+
+## 4. Signal vs authority compliance
+
+The blocking surface is a deterministic invariant floor at a rare, human-paced,
+audited transition — the documented exemption class — and it holds NO authority over
+semantic meaning: those decisions belong to the PIN/verified-operator acceptor. No
+brittle check gained authority over message flow or session behavior; day-to-day
+sessions are untouched (Phase A cost boundary holds: gate work happens at transitions
+and in the weekly job only).
+
+## 5. Interactions
+
+- transition()/evaluateCompletionGate() became async — all callers updated; the routes'
+  409 mapping is unchanged in shape.
+- The gate consumes the PR-A validator through the same deps seam CI uses — no
+  double-fire (CI stays hermetic; gate adds only the non-hermetic checks).
+- The live-check job overlaps the gate's non-hermetic checks by DESIGN (the job covers
+  the standing seed matrices that never traverse a transition); both write distinct
+  audit rows. Its mint flow files idempotent dedupKeyed issues + ONE aggregated
+  commitment per pass — flood-safe by construction (aggregation, not per-element).
+- The provenance backfill appends at most one decisions-log record (presence-scan
+  idempotent); init and migrator cannot double-record.
+
+## 6. External surfaces
+
+Two new Bearer/PIN routes (CapabilityIndex updated); one Telegram enumeration message
+per acceptance request (operator-initiated, never spontaneous); the weekly job ships
+`enabled: false` fleet-wide with a silent no-op on no-source installs. No behavior
+change for running sessions; restart applies the new server surfaces.
+
+## 7. Multi-machine posture
+
+Matrix artifacts + gate code: unified-via-git. Gate verdicts: derived-on-read against
+the per-machine apprenticeship registry (the registry's declared machine-local
+posture, operator-ratified in the spec's Multi-machine section); acceptance artifacts
+and provenance records live in the gate machine's decisions log — coherent with
+closePath refs resolving on the gate machine. The live-check job is
+perMachineIndependent. No stranding: a topic transfer does not carry gate state
+because the registry itself is machine-local by declared design.
+
+## 8. Rollback cost
+
+Config flag off ⇒ gate branch inert (matrices remain docs + tracked issues); revert
+the PR for a full back-out — no data migration (decisions-log rows and acceptance
+records are append-only audit, harmless to retain). The always-overwrite job template
+un-ships with the revert; per-slug manifests preserve operator enabled-state
+semantics. Cheapest rollback class for a gate: a flag read live at the callsite.
+
+## Second-pass review
+
+REQUIRED (gate + session-lifecycle-adjacent + blocking surface). Dedicated reviewer
+subagent audits this artifact against the final diff independently.
+
+### Second-pass reviewer response
+
+**Concern raised (2026-07-18):** the row-scoped acceptance/override relief valve
+was UNREACHABLE in production — the only shipped mint surface produced
+whole-set/degraded challenges, so any row carrying an `acceptanceRef` (required
+to clear `unreviewed`) would have failed `acceptance-ref-invalid` at enforce
+time with no legitimate satisfaction path: a latent over-block behind the
+dry-run. All other load-bearing properties were verified: dryRun suppresses
+every refusal class through a single funnel; timeout and ledger-unreachable
+verdicts are distinct and fail closed; bearer principals structurally refused
+at bind; challenges single-use with replay refused; hashes re-resolved at
+bind; refusal hygiene holds; multi-machine claims match the spec's declared
+postures.
+
+**Resolution (same session, pre-commit):** (1) the enumerate route is now
+scope-aware (`rows` / `override` scopes mintable through the same PIN and
+reply-anchor paths, Decision-20 canonical row hashing, `acceptanceRef`
+excluded from row serialization to close the mint→bind→write-ref cycle) with
+both-sides production-shaped route tests; (2) HTTP-error conflation fixed —
+only 404/terminal means dead-ref, any other failure is ledger-unreachable
+(retryable), in the gate AND the live-check script; (3) the aggregated
+attention items now carry deterministic dedup ids (per matrix-state /
+per-findings-set) — fixing, en route, a latent missing-required-id 400 on both
+attention posts. Reviewer's remaining non-blocking observations (decisions-log
+fabrication surface consistent with the declared tamper-evident threat model;
+enumeration message formatting) accepted as noted. 296/296 tests green
+post-resolution.
+
+**Post-resolution status: concerns resolved; review concurs with the artifact
+as amended.**
+
+## Class-Closure Declaration
+
+`unbounded-self-action` — closure: **n/a** (negative declaration). The gate's
+actions are rare, human-paced, operator-driven transition evaluations — never a
+self-triggered loop: attention posts carry deterministic dedup ids (one item per
+matrix-state / per-findings-set; server-side dedup engages on retries), the
+live-check job is an operator-enabled weekly cadence emitting ONE aggregated
+attention item + ONE aggregated commitment per pass, and no respawn/kill/swap
+surface is touched by this change.

package/upgrades/1.3.877.md

@@ -1,53 +0,0 @@
-# Upgrade Guide — vNEXT
-
-<!-- assembled-by: assemble-next-md -->
-<!-- bump: patch -->
-
-## What Changed
-
-Added one section to `docs/apprenticeship/PROGRAM-CONCEPTS.md`: "The
-Hidden-Test Battery (regression tripwires)" — the durable, generic record of
-the mechanism the operator approved on 2026-07-18. The battery is a set of
-undisclosed scenarios that each detect the LOSS of an already-valued behavior:
-passing means nothing broke, never that growth was achieved (growth stays with
-the overseer's judgment). Scenarios stay undisclosed during a drive and are
-scored retrospectively (pass / fail / not-triggered, with evidence pointers)
-as ONE necessary-not-sufficient input to ladder promotions — a failure can
-block a rung, no quantity of passes can earn one. The mechanism itself is
-disclosed to the mentee once (results appear in drive reports the mentee can
-read); only the scenario list stays hidden. The battery is disposable (a
-performed-for scenario is retired; the operator reviews the list at every rung
-change) and guardrailed: never a leaderboard, never a mid-drive threat, never
-a gate on day-to-day work, never scenarios that can harm real users, data, or
-services. Scenarios are preferentially captured from naturally-arising
-situations, manufactured only as a last resort and never on production
-surfaces.
-
-This is documentation only. No code, config, hook, job, template, or test
-changes; no runtime surface; no behavior change for any deployed agent.
-
-## What to Tell Your User
-
-Nothing changes in how your agent behaves. The apprenticeship program's
-documentation now records how regression tripwires work: a small, undisclosed
-set of checks that only ever fire when a learning agent LOSES a good habit it
-already had — never a score to chase, never a leaderboard, never a gate on
-daily work — with results reviewed openly after each drive as one input to
-promotion decisions a human still makes.
-
-## Summary of New Capabilities
-
-- None (documentation only). New content: the "Hidden-Test Battery" section in
-  `docs/apprenticeship/PROGRAM-CONCEPTS.md`, recording the adopted
-  regression-tripwire discipline for the apprenticeship program.
-
-## Evidence
-
-- `docs/apprenticeship/PROGRAM-CONCEPTS.md` — the new section (mechanism only;
-  deliberately no scenario, agent, or organization content).
-- `docs/specs/hidden-test-battery-adoption.eli16.md` — plain-English explainer.
-- `upgrades/side-effects/hidden-test-battery-adoption.md` — side-effects
-  review; every question resolves to "documentation-only, no runtime surface";
-  multi-machine posture unified-via-git; rollback = revert the doc.
-- Sanity: the whole-tree stall-coverage CI ratchet
-  (`tests/unit/stall-coverage-ratchet.test.ts`) runs green on this tree.