instar 1.3.921 → 1.3.923

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.921",
+  "version": "1.3.923",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-23T23:04:10.011Z",
-  "instarVersion": "1.3.921",
+  "generatedAt": "2026-07-23T23:54:09.172Z",
+  "instarVersion": "1.3.923",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "d513840a029b00aff6c0a1143122d04d18a3b0d57c58c1d98827c8e54f6abe61",
+      "contentHash": "9c219b035529be742a55ec6c8aac5c1092b8169eeeccfac7624401408b2aed57",
       "since": "2025-01-01"
     },
     "cli:init": {
@@ -1546,7 +1546,7 @@
       "type": "subsystem",
       "domain": "updates",
       "sourcePath": "src/core/AutoUpdater.ts",
-      "contentHash": "05e6333268bc74c2acb3b8af1f95d0bd59852f2d4c683826713305922947783d",
+      "contentHash": "681bb17cab146554e7cbe9a193397bd2cf8203cf51e51d824762c5525bdd455b",
       "since": "2025-01-01"
     },
     "subsystem:auto-dispatcher": {

package/upgrades/1.3.922.md

@@ -0,0 +1,21 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Malformed Claude credential JSON now becomes an explicit re-auth-needed state
+instead of silently skipping quota collection. Per-account quota reads also
+report whether their measurement is stale and how old it is.
+
+## What to Tell Your User
+
+Quota status now says when its last reading is old, and a broken saved login
+asks for authentication again instead of quietly disappearing from polling.
+
+## Summary of New Capabilities
+
+- Classifies malformed credential JSON without exposing its contents.
+- Marks the affected subscription account `needs-reauth`.
+- Adds `staleSnapshot` and `snapshotAgeMs` to per-account quota reads.

package/upgrades/1.3.923.md

@@ -0,0 +1,22 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Installed updates that are waiting for an idle restart now restore their retry
+timer after server startup, repair a missing timer during periodic update
+checks, and continue retrying after transient retry errors.
+
+## What to Tell Your User
+
+Updates waiting for active work to finish will no longer get stuck if their
+retry alarm is interrupted. Instar restores the alarm and switches versions
+once the protected work becomes idle.
+
+## Summary of New Capabilities
+
+- Durable restart deferrals re-arm after server startup.
+- Periodic update checks repair missing deferral timers.
+- Transient retry failures schedule another bounded attempt.

package/upgrades/side-effects/auto-updater-deferral-retry.md

@@ -0,0 +1,133 @@
+# Side-Effects Review — Auto-Updater Deferral Retry Recovery
+
+**Version / slug:** `auto-updater-deferral-retry`
+**Date:** `2026-07-23`
+**Author:** `Instar Agent (instar-codey)`
+**Second-pass reviewer:** `updater_deferral_review`
+
+## Summary of the change
+
+`src/core/AutoUpdater.ts` now treats the persisted restart-deferral deadline as
+durable retry intent. Startup and the already-installed update-check path rebuild
+a missing timer, while rejected retry attempts retain the deferral and schedule
+another bounded five-minute attempt. `tests/unit/AutoUpdater.test.ts` exercises
+restart recovery, deliberate timer loss, and rejected attempts. The existing
+`UpdateGate` remains the sole authority over active-versus-idle session state.
+
+## Decision-point inventory
+
+- `UpdateGate.canRestart` — pass-through — still decides whether active work
+  permits a restart; its classification logic is unchanged.
+- `AutoUpdater.ensureDeferredRestartRetry` — add — mechanically restores a
+  timer from already-authorized durable retry intent.
+- `AutoUpdater.retryDeferredRestart` — add — handles transport/execution errors
+  without making an activity decision.
+
+## 1. Over-block
+
+No new block/allow surface. A future `nextRetryAt` remains respected rather than
+being pulled forward, so restart-window deferrals are not shortened. An invalid
+or missing deadline waits the standard five minutes.
+
+## 2. Under-block
+
+The fix does not repair a corrupted or missing `auto-updater.json`, nor can it
+restart when the supervisor cannot consume `restart-requested.json`. Those are
+separate integrity and supervisor boundaries. The periodic update tick provides
+a second re-arm path if startup re-arming itself is interrupted.
+
+## 3. Level-of-abstraction fit
+
+The change is at the AutoUpdater timer/durability layer. It does not duplicate
+session activity classification: every retry re-enters `gatedRestart`, which
+delegates to `UpdateGate`. The timer is replaceable mechanism; the persisted
+deferral row is durable intent.
+
+## 4. Signal vs authority compliance
+
+Required reference: [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] No — this change has no new block/allow surface.
+
+The existing context-rich session-health gate retains restart authority. The new
+code only ensures that gate is asked again at the persisted time.
+
+## 4b. Judgment-point check
+
+No new static heuristic at a competing-signals decision point. Deadline parsing
+is a structural timer operation; active-work judgment remains in `UpdateGate`.
+
+## 5. Interactions
+
+- **Shadowing:** the installed-version loop breaker still prevents reapplying
+  bytes, but now repairs retry machinery before returning.
+- **Double-fire:** one `deferralTimer` plus a `deferralRetryInFlight` latch form
+  the chokepoint. The watchdog refuses to schedule while an async retry is
+  unsettled, preventing duplicate attempts during notification/restart delays.
+- **Races:** startup is wired after session dependencies, so an overdue retry
+  reaches the real activity gate. A simultaneous periodic tick sees either the
+  live timer or in-flight latch and does not add another. `stop()` advances a
+  lifecycle generation, invalidating older callbacks without breaking valid
+  manually driven updater cycles that were never started periodically.
+- **Feedback loops:** blocked retries write a new deadline through the existing
+  path. Unexpected rejection retries use the same five-minute rate floor.
+
+## 6. External surfaces
+
+No API shape or operator action changes. Users may now observe an installed
+update activate after idle where it previously remained stuck. The existing
+restart request file and updater state schema are reused. No new URLs or
+external-service calls are introduced.
+
+## 6b. Operator-surface quality
+
+No operator surface — not applicable.
+
+## 7. Multi-machine posture
+
+Machine-local by design: update installation, running process version, session
+activity, timers, and restart requests are truths of one machine. Each machine
+owns its own `state/auto-updater.json` and must independently converge onto its
+installed version. This code emits no new user-facing notice, creates no URL,
+and does not move state with topic ownership.
+
+## 8. Rollback cost
+
+Pure code change using the existing state schema. Revert and ship a patch; no
+data migration or agent-state repair is required. Existing persisted deferrals
+remain readable by both old and new code.
+
+## Conclusion
+
+The change closes the lost-timer class without altering restart authority or
+activity detection. Durable intent is now reconnected to replaceable timers at
+startup, during normal polling, and after transient callback failures. The
+independent review additionally produced a single-flight latch and stop-safe
+rescheduling before shipment.
+
+## Second-pass review
+
+**Reviewer:** `updater_deferral_review`
+**Independent read of the artifact:** concur
+
+The single-flight latch closes the double-fire race, the lifecycle generation
+makes stop terminal for older callbacks, and the held-promise test exercises the
+real polling collision. Retry convergence and activity-gate authority are
+preserved.
+
+## Evidence pointers
+
+- `tests/unit/AutoUpdater.test.ts`
+- `tests/unit/UpdateGate.test.ts`
+- `tests/unit/auto-updater-failures.test.ts`
+- `tests/integration/auto-updater-lifeline-handshake.test.ts`
+
+## Class-Closure Declaration (display-only mirror)
+
+`defectClass: unbounded-self-action`, `closure: guard`,
+`guardEvidence: { enforcementType: ratchet, citation:
+tests/unit/AutoUpdater.test.ts, howCaught: the startup, timer-loss, and rejected
+retry tests exercise the control-loop edges; a single deferral timer is the
+chokepoint, the in-flight latch prevents concurrent actions, retries have a
+five-minute rate floor, and a successful or newly blocked evaluation settles
+through gatedRestart rather than accumulating parallel timers }`.

package/upgrades/side-effects/quota-snapshot-hardening.md

@@ -0,0 +1,46 @@
+# Quota snapshot hardening
+
+## 1. Behavioral change
+
+- Malformed Claude credential JSON now moves the matching subscription account
+  to `needs-reauth`.
+- Per-account quota reads now include `staleSnapshot` and `snapshotAgeMs`.
+
+## 2. Compatibility
+
+The response is additive. Existing consumers of `snapshot` and `burnRate`
+continue to work. The existing nullable token-resolver contract remains valid;
+injected resolvers may additionally return the typed re-auth result.
+
+## 3. Operational impact
+
+Quota snapshots become stale after 30 minutes, which is twice the default
+15-minute poll cadence. This does not delete a snapshot or prevent it from being
+displayed; it makes its age visible to consumers.
+
+## 4. Security
+
+Malformed credential contents never leave the credential reader. Logs and pool
+state receive only the closed reason `unparseable-credential-blob`.
+
+## 5. Rollback
+
+Reverting this change restores the previous silent-null resolver behavior and
+removes the additive freshness fields.
+
+## 6. Validation
+
+Unit coverage exercises detailed parsing and the re-auth transition. Integration
+coverage exercises fresh, old, and invalid `measuredAt` values through the HTTP
+route.
+
+## 6b. Operator-surface quality
+
+The read surface distinguishes three states directly: no snapshot, a current
+snapshot, and a stale snapshot. Operators no longer have to infer freshness by
+manually comparing timestamps.
+
+## Class closure
+
+This is a bounded read-path classification fix. It does not introduce a timer,
+retry loop, autonomous controller, or self-action emitter.