instar 1.3.939 → 1.3.941

package/dist/server/throughputRoutes.d.ts

@@ -21,7 +21,7 @@ export declare function buildThroughputSeries(opts: {
     weights?: Weights;
 }): Promise<{
     repo: string;
-    windowDays: 7 | 30 | 14;
+    windowDays: 7 | 14 | 30;
     generatedAt: string;
     weights: Weights;
     rows: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.939",
+  "version": "1.3.941",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-24T15:21:21.763Z",
-  "instarVersion": "1.3.939",
+  "generatedAt": "2026-07-24T17:59:21.918Z",
+  "instarVersion": "1.3.941",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "83742e771b7f07b061d96913c93857ab06120c9941c70a37302ca322d41cc3d4",
+      "contentHash": "ee76bbbb02789195a5062132e5b5d01fcee5f6afd812a2dcc4098ddac7ab5c03",
       "since": "2025-01-01"
     },
     "cli:init": {
@@ -1530,7 +1530,7 @@
       "type": "subsystem",
       "domain": "server",
       "sourcePath": "src/server/AgentServer.ts",
-      "contentHash": "212bac437dfd2ea5df615070a4956d6f3fbd892674913dbc9676aea8fd4a1ed6",
+      "contentHash": "ea0dc66773c8d591e0cb18352941826ef1dc3c03a749f72bb373e71db1bbded7",
       "since": "2025-01-01"
     },
     "subsystem:session-manager": {

package/upgrades/1.3.940.md

@@ -0,0 +1,36 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The tone gate's decision-quality provenance row can now record the candidate message BODY, alongside the sha256 identity it has always recorded. Off unless explicitly enabled (`recordCandidateBody` on the tone-gate config), and byte-identical to previous behaviour when absent.
+
+## What to Tell Your User
+
+Nothing changes unless you turn it on. When you do, held and allowed message text is stored in the local decision-quality record so its correctness can be reviewed later. The same text is already in the session transcript on disk; this is a second copy in a store only you and your agent read.
+
+## Summary of New Capabilities
+
+- A later bulk judging pass can read what a held message actually said, instead of a hash it cannot re-read.
+- Recorded bodies are credential-scrubbed (kinds recorded, never offsets or matched text) and clamped to a hard 4000-char ceiling that config cannot raise.
+
+## Evidence
+
+The quality meter exists to answer "was blocking this correct?" retrospectively. That question is not decidable from an identity-only row: a sha256 cannot be turned back into words, so a judge handed one has nothing to judge. The meter could measure latency and volume but never correctness — the thing it was built for.
+
+The prior no-plaintext discipline was deliberate and documented. It was also self-defeating: the gate inspects outbound text for leaks, so declining to store that text protects the store at the cost of making the review impossible.
+
+**Safety properties, and why each sits where it does:**
+
+- **Clamp BEFORE scrub.** Load-bearing ordering. Scrubbing first and truncating second can bisect a `[REDACTED:...]` marker and leave the tail of a real secret past the cut — the exact failure being prevented, reintroduced by sequencing two safe steps wrongly. A dedicated test places a credential beyond the clamp point and asserts its absence in every form.
+- **Ceiling, not default.** `maxBodyChars` clamps DOWN to `TONE_CANDIDATE_BODY_MAX_CHARS` and never up, so no config value can make the store an unbounded archive of outbound prose.
+- **Withheld is not the same as clean.** The scrubber replaces the whole field on its error/oversize paths; those set `bodyWithheld` to `scrub-error` or `oversize` rather than being conflated with "nothing sensitive found". A judge must be able to tell those apart, or every clean-looking row becomes untrustworthy.
+- **Identity preserved.** sha256/bytes/chars still describe the whole message even when the stored body is a fragment, so rows written either side of a flag flip stay correlatable.
+
+**Explicitly NOT authorized by this flag:** ingesting scenarios from other installs' agents. That needs an anonymisation layer that does not exist — identifier-stripping is not anonymisation (a conversation with names removed is still identifiable from its subject, and removing the subject destroys its value as a scenario), and external contributions are untrusted input a model will later read. Stated in the code comment so the flag cannot be mistaken for a green light on external ingest.
+
+**No config migration, deliberately.** The key is OMIT-REQUIRED: seeding it would write a content-retention decision into every deployed agent's config on update. Absence is the correct state.
+
+**Not changed:** the gate's verdict path, rule set, or fail-direction. This feeds an observe-only side write and cannot alter a block/allow decision.

package/upgrades/1.3.941.md

@@ -0,0 +1,22 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Recovery now owns accepted relay work across restarts, preserves stale evidence, keeps autonomous orphan observation active during queue pauses, and persists attention items before provider I/O.
+
+## What to Tell Your User
+
+Important replies and alerts are less likely to disappear during restarts or a slow Telegram connection. Autonomous runs also keep producing evidence when recovery actuation is paused.
+
+## Summary of New Capabilities
+
+- Always-on relay recovery by default.
+- Stale backlog is withheld instead of silently purged or sent late.
+- `/attention` acceptance is bounded independently of Telegram latency.
+
+## Evidence
+
+Focused pending-relay tests, TypeScript build, repository lint, and the instar-dev ceremony gate pass.

package/upgrades/side-effects/delivery-reliability-recovery-hardening.md

@@ -0,0 +1,22 @@
+# Side-effects review: delivery reliability recovery hardening
+
+1. Over-block: explicit `enabled:false` remains a supported operator opt-out; stale rows are withheld from redelivery, so only messages whose conversational context is no longer timely are held.
+2. Under-block: this stopping point prevents destructive purge and preserves stale evidence, but the aggregate queue-health attention drain remains the next bounded implementation slice.
+3. Level of abstraction: the sentinel remains the recovery signal/consumer; liveness pause is an actuation brake, not a detector; attention acceptance is durable before provider I/O.
+4. Signal vs authority: queue age and orphan observations produce state/evidence. The only authority retained here is the existing resume queue and outbound tone gate.
+5. Interactions: startup recovery, event kicks, and watchdogs remain idempotent; attention creation remains idempotent by item id, while the route timeout prevents provider latency from blocking HTTP acceptance.
+6. External surfaces: `/attention` now returns promptly with an accepted OPEN item when Telegram is slow; stale relay rows are not silently deleted or redelivered late.
+7. Multi-machine posture: relay state and attention persistence are machine-local by design, keyed by agent identity; liveness evidence is local to the owning machine and existing ownership/lease gates still prevent cross-machine actuation.
+8. Rollback cost: revert the commit; no schema migration or destructive data operation is introduced, and retained rows remain available for a later incident drain.
+
+Second-pass review: concur with the review. The pause gate is moved from classification to actuation, preserving dry-run evidence without weakening ownership, lease, or operator-stop checks.
+
+## Class-Closure Declaration
+
+- defect class: `unbounded-self-action`
+- closure: `guard`
+- enforcement: ratchet
+- citation: `tests/unit/self-action-convergence.test.ts`
+- how caught: queue watchdog, stale-age withholding, liveness debounce, and attention idempotency provide bounded convergence.
+
+Breaker regression repair preserves the existing suspend-on-five-failures and auth-hash resume contract.