instar 1.3.982 → 1.3.984

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.982",
+  "version": "1.3.984",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-26T05:44:21.337Z",
-  "instarVersion": "1.3.982",
+  "generatedAt": "2026-07-26T08:47:20.129Z",
+  "instarVersion": "1.3.984",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a3947b0ea121818f2c3424b7db10dcdd8e39c460dbbd4cd0c390804850b78462",
+      "contentHash": "3d7b20ccbe93ba5e4d23dbacbedfef0e66d8e97c44e0169a90cc21da36f2a5c3",
       "since": "2025-01-01"
     },
     "cli:init": {

package/upgrades/1.3.982.md

@@ -42,6 +42,17 @@ genuinely reads live state.
 
 ## What to Tell Your User
 
+> **CORRECTION (2026-07-26, after release).** The paragraph below over-claimed and is kept
+> visible rather than quietly rewritten. **The change is forward-only.** Promises about
+> behaviour recorded from now on stay open, and the runaway tally stopped for all of them —
+> but promises that already existed **keep the verdict they were last stamped with**, because
+> the fix works by declining to reach a verdict, which means it never revisits one. Measured
+> on a live install after deploy: 98 behavioural records still showed 74 "kept" and 24
+> "broken", unchanged. So if you had behavioural commitments before upgrading, their old and
+> untrustworthy verdicts are still on screen, and the health line will still count those 74 as
+> verified. Clearing them needs a deliberate decision (rewriting stored records, or having the
+> display refuse a verdict for anything unverifiable) and has not been made.
+
 If you track commitments, promises about behaviour now show as **pending** rather than
 verified or violated, with both counters at zero. That is more honest, not a regression:
 nothing was ever watching whether those promises were kept, so "verified" was reassurance
@@ -69,10 +80,14 @@ commitment"`. Live store corroboration: 74/74 with the field `verified`, 24/24 w
 
 **Observed after,** same scenarios against the built code:
 
+**Scope note added 2026-07-26:** every row below was measured on a **newly created** commitment.
+A row that already existed before the upgrade keeps its stored verdict — see the correction above.
+
 | scenario | before | after (25 sweeps) |
 |---|---|---|
-| behavioural, `behavioralRule` set | `verified`, +1 tick per sweep | `pending`, verifications 0, violations 0 |
-| behavioural, field absent | `violated`, +1 tick per sweep | `pending`, verifications 0, violations 0 |
+| behavioural, `behavioralRule` set (NEW row) | `verified`, +1 tick per sweep | `pending`, verifications 0, violations 0 |
+| behavioural, field absent (NEW row) | `violated`, +1 tick per sweep | `pending`, verifications 0, violations 0 |
+| behavioural row that PREDATES the change | `verified` or `violated`, ticking | ticking stops; **stored verdict unchanged** |
 | rules file deleted | produced a verdict | no verdict; file self-heals; status unchanged |
 | health, 1 behavioural row | `"1 commitment(s) tracked, all verified"` | `"1 commitment(s) tracked — 0 verified, 1 not automatically verifiable (no violations)"`, status `healthy` |
 

package/upgrades/1.3.983.md

@@ -0,0 +1,108 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+**A project item could read `merged` while carrying no record of what merged it — and
+the two regression detectors that read that record were therefore selecting nothing and
+reporting all clear.**
+
+`/projects/:id/advance` proves four things before it will move an item to `merged`: the
+PR state is `MERGED`, it has a format-valid merge commit sha, that sha is reachable from
+canonical main, and the CI rollup is green. It then persisted **only** `pipelineStage`
+and discarded the evidence. Measured on the live store: both Tier-1 children of the
+`convergence-towards-coherence` project read `pipelineStage: "merged"` with no
+`prNumber`, no `mergeCommitOid` and no `ciCheckedAt`.
+
+The cause was a type, not carelessness. `StageTransitionResult`'s success case was
+`{ ok: true }` — one bit — while every refusal carried `reason` + `code`. The validator
+explained itself when it said no and said nothing when it said yes, so the caller had
+nothing to write down. A passing verdict now carries a `MergedEvidence` record (PR
+number, merge sha, the canonical-main ref it was actually proven against, and an ISO
+timestamp), persisted in the **same** `update()` as the stage — so no window exists in
+which an item reads `merged` with nothing behind it.
+
+**The half that mattered more.** Two merged-state reconcilers find their candidates by
+looking for `mergeCommitOid`: the lazy reconciler on `GET /projects/:id` (documented
+"may mutate", running on every read) and `verifyMergedItemsViaGit`. Nothing ever wrote
+that field, so the candidate set was always empty and the git verification never ran.
+A regression detector that scans nothing and reports nothing is indistinguishable from
+one that scans everything and finds nothing wrong — so merged work that was later
+reverted or force-pushed off main would never have been noticed.
+
+Because that path had never executed, three defects sat in it unexercised, **all three
+already fixed in the advance path a few hundred lines away**: it called
+`SafeGitExecutor.run` without `sourceTreeReadOk`, so SourceTreeGuard refuses the read
+against an instar source tree; it hardcoded `origin/main`, which on a dev-agent home is
+the agent's fork rather than where merges land; and its `catch {}` meant the caller
+marked the item `regressed`, turning "I could not check" into "it was reverted". Any one
+of those would have produced false demotions the moment evidence started being written,
+so both halves ship together. `verifyMergedItemsViaGit` now returns three states —
+`verified`, `regressed` (git's documented exit 1, the only genuine negative) and
+`unverifiable` (everything else, with its reason) — and the reconciler demotes only on
+`regressed`; an unverifiable item keeps its stage and takes only the `ciCheckedAt`
+backoff, so the question is asked again later instead of answered wrongly now.
+
+**What this does not do:** it adds no new regression checking. It makes the existing
+reconcilers *possible*, by giving them the evidence they were written to read, and
+*safe*, by stopping them guessing. Items merged before this change carry no evidence and
+report honestly as `unverifiable` with the reason "no mergeCommitOid recorded on the
+item" — no backfill is attempted, because reconstructing which PR merged a historical
+item would mean fabricating evidence.
+
+## What to Tell Your User
+
+If you use project tracking, a finished item now records the pull request, the commit
+and the time it was checked — so "merged" can name what merged it. Previously it could
+not.
+
+More usefully: the checks that watch for finished work being undone were, in practice,
+examining an empty list and reporting no problems. They now have something to examine.
+And when one of them cannot answer — no permission, wrong branch, missing commit — it
+says so instead of declaring the work reverted, which is what it used to do.
+
+## Summary of New Capabilities
+
+- A passing stage-transition verdict carries the evidence it established, instead of a
+  bare success flag.
+- A merged item records its PR number, merge commit and check timestamp in the same
+  write as its stage.
+- The merged-state verifier distinguishes "reverted" from "could not check", and the
+  reconciler demotes only on the former.
+- The reconciler checks the canonical-main ref resolved for the install rather than
+  assuming `origin/main`, so a fork-origin agent home no longer reads every healthy item
+  as regressed.
+- `POST /projects/:id/advance` echoes the recorded evidence back, so a caller can confirm
+  it landed rather than trusting that it did.
+
+## Evidence
+
+**Reproduction (before):** read any merged child of a project —
+`GET /projects/convergence-towards-coherence` returned both Tier-1 children with
+`pipelineStage: "merged"` and an object whose keys contained no `prNumber`,
+`mergeCommitOid` or `ciCheckedAt`. `grep` for writers of `mergeCommitOid` found none
+outside `InitiativeTracker`'s own accessors, while two consumers select on it.
+
+**Observed after,** same scenarios against the built code:
+
+| scenario | before | after |
+|---|---|---|
+| passing `building → merged` verdict | `{ ok: true }` | carries `prNumber`, `mergeCommitOid`, `mergeBaseBranch`, `verifiedAt` |
+| the item record after a merged advance | stage only | stage + PR number + merge sha + check timestamp, one write |
+| verifier, git exit 0 | verified | verified |
+| verifier, git exit 1 | not verified → caller demotes | `regressed` → caller demotes |
+| verifier, git exit 128 / guard refusal | not verified → **caller demotes** | `unverifiable` with reason → **stage unchanged** |
+| verifier, child with no recorded evidence | silently skipped | `unverifiable`, "no mergeCommitOid recorded" |
+| verifier's branch | hardcoded `origin/main` | the caller-resolved canonical-main ref |
+
+**Tests:** `tests/unit/merged-record-carries-its-evidence.test.ts` (9 new) plus 2 added
+to `tests/unit/StageTransitionValidator.test.ts`. All 9 fail against pre-fix source with
+failures that name the defect — "expected undefined to be defined" for the evidence-free
+approval, "prNumber must be persisted alongside the stage, not discarded after
+validation: expected false to be true", "the verifier readSync must exist: expected +0
+to be 1" (it used `.run`, proving the missing source-tree declaration), and "an item is
+demoted only when git said exit 1, never merely because it was absent from `verified`".
+The 48 pre-existing validator tests and the 8 `ProjectRoundExecution` tests pass
+unchanged. `npx tsc --noEmit` clean.

package/upgrades/1.3.984.md

@@ -0,0 +1,116 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+**Thirty source files were invisible to `grep`. A search across them returned nothing,
+and nothing read as "there is nothing there."**
+
+`grep` classifies a file as binary if it contains a NUL (0x00) byte, and on a binary file
+it emits **nothing at all** — not a match, not a `Binary file X matches` line, not even a
+`0` under `-c`. Thirty tracked text files each carried one, so every grep-based audit over
+`src/` silently skipped them. A search that examined two-thirds of the tree was
+byte-for-byte indistinguishable from one that examined all of it and found nothing wrong.
+
+Twenty-two were live source. Among them: `blockerSettleAuthority.ts` (the gate that
+decides whether a blocker is genuinely unresolvable), `SessionOwnership.ts`,
+`GreenPrAutoMerger.ts`, `PermissionPromptAutoResolver.ts` (an always-on safety floor), all
+three `ExternalHog*` modules — and `StandardsEnforcementAuditor.ts`, the module that
+audits whether our standards carry structural guards. The auditor of guarantees was itself
+invisible to the standard search instrument.
+
+**A second consequence, worse in kind.** Git applies the same rule but only sniffs the
+first 8000 bytes. For the **11 files** whose NUL fell inside that window, `git diff`
+rendered `Bin 5407 -> 5412 bytes` instead of a line diff — so pull requests touching
+safety-critical authority code were reviewed **without the reviewer being shown the
+changed lines**. For the other 19, git saw text while `grep` did not. The two instruments
+disagreed on the same tree, which is exactly why this survived so long: whichever one you
+happened to reach for decided what you believed.
+
+**None of it was corruption.** Every byte was a deliberate composite-key or hash
+separator — the classic collision-proof choice, since a NUL cannot occur inside a model
+name or a framework name:
+
+```ts
+const key = `${row.model}<a literal 0x00 byte>${row.framework}`;
+```
+
+The delimiter is correct. Writing it as the byte rather than its escape is the entire
+defect. All thirty now use the six-character escape, which denotes the identical
+character — so runtime behaviour is unchanged, and every hash derived from these
+separators is byte-identical. Four sites feed them into digests
+(`relayContentDedup`, `blockerSettleAuthority`, `UnionReader`, `ExternalHogArmMarker`);
+this was the primary risk and it was verified rather than assumed. No migration, no cache
+invalidation, no re-keying.
+
+A new ratchet, `tests/unit/no-raw-nul-bytes-in-source.test.ts`, fails the build if one
+returns. It reads bytes via `readFileSync` and never shells out to a search tool, so it
+cannot be blinded by the defect it detects. It carries no exemption list, because no case
+needs one: any runtime NUL a program wants is expressible as an escape.
+
+**What this does not do:** it fixes one silent instrument, not the class. Other raw
+control bytes (ESC, BEL) remain in a few hostile-input test fixtures — deliberately, after
+verifying empirically that they do **not** cause the grep skip. Only 0x00 does. A lint
+should enforce exactly the failure it is named for, and widening this one for tidiness
+would have added churn while claiming safety it does not provide.
+
+## What to Tell Your User
+
+Nothing changes in how the agent behaves — this is a source-text and build-time fix with
+no route, setting, or visible surface.
+
+What it does change is trustworthiness of process: for months, searching the codebase for
+a given pattern could quietly skip thirty files and report a clean result, and for eleven
+of those files a code review showed "binary file changed" instead of the actual lines. Any
+past conclusion of the form "we don't do X anywhere" may have been drawn from an
+instrument that wasn't looking. Those files are readable again, and a check now fails the
+build if it recurs.
+
+## Summary of New Capabilities
+
+- Thirty text files that were invisible to `grep` — twenty-two of them live source,
+  including several safety-critical authority modules — are searchable again.
+- Eleven files that rendered as binary diffs in code review now show reviewable lines.
+- A build-time ratchet refuses any text file containing a raw NUL byte, naming the file
+  and the consequence rather than emitting a bare assertion failure.
+- The ratchet proves its own detector on every run, so a check that has gone dead is
+  distinguishable from one that has nothing to report.
+
+## Evidence
+
+**Reproduction (before):** `grep -c export src/monitoring/blockerSettleAuthority.ts`
+printed nothing — no count, no error, exit status indistinguishable from a clean miss.
+`file` reported the same TypeScript source as `data`, not text. Three one-line fixtures
+isolate the cause: a clean file and a file containing ESC + BEL both return 1 match; a
+file differing only by one NUL byte returns nothing at all.
+
+**Observed after,** same scenarios against the fixed tree:
+
+| scenario | before | after |
+|---|---|---|
+| `grep -c export` on `blockerSettleAuthority.ts` | *(silent)* | `1` |
+| `grep -c export` on `StandardsEnforcementAuditor.ts` | *(silent)* | `13` |
+| `grep -c export` on `FeatureMetricsLedger.ts` | *(silent)* | `20` |
+| `file` on those sources | `data` | `ASCII text` |
+| `git diff` on the 11 early-NUL files | `Bin NNNN -> NNNN bytes` | reviewable line diff |
+| runtime value of the separator | U+0000 | U+0000 (unchanged) |
+| digests derived from the separator | — | byte-identical, verified |
+| ratchet against a reintroduced NUL | *(no check existed)* | fails, names the file |
+
+**Tests:** `tests/unit/no-raw-nul-bytes-in-source.test.ts` (4 new). One asserts the
+detector flags a raw-byte file and clears an escaped one — a dead-check guard, since a
+lint that has never objected is output-identical to a lint that cannot object. One asserts
+the escape decodes to exactly the raw byte, so the behaviour-preserving claim is checked
+rather than stated. One scans the tree. One asserts the scan examined more than 500 files,
+so a scan that walked the wrong roots cannot pass forever by finding nothing.
+
+Verified by reintroducing a raw NUL into `FeatureMetricsLedger.ts`: the lint exits 1,
+names the file, and states the consequence. `npx tsc --noEmit` clean; the full unit suite
+runs 39,046 tests with no failure attributable to this change.
+
+**Provenance note.** This was found only because a *different* investigation produced a
+suspiciously empty search result that was about to be written up as "no such mechanism
+exists in the codebase." That search had skipped twenty-two files. The finding was
+manufactured by the defect, and has been retracted and superseded rather than deleted.