instar 1.3.993 → 1.3.994

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.993",
+  "version": "1.3.994",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-27T04:10:39.708Z",
-  "instarVersion": "1.3.993",
+  "generatedAt": "2026-07-27T05:39:31.180Z",
+  "instarVersion": "1.3.994",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "04867b0c6fddee94550cd94d065bc7e6789c03f2bbf01a9e162d2aeed09e9bf3",
+      "contentHash": "9b2c970297ce842acf784f15cd375d9a0cd009263b9c804f3f6a31b76f7e17e9",
       "since": "2025-01-01"
     },
     "cli:init": {

package/upgrades/1.3.994.md

@@ -0,0 +1,69 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+`runRound`'s `verifyMergedItems` seam defaulted to a no-op returning an empty set, documented in
+place as "production callers should pass a real one". No production caller ever did —
+`src/commands/server.ts` passes tracker, projectId, roundIndex and targetRepoPath, and nothing else.
+
+Consequences, all read from the code: the all-items-merged stop condition could never be true, so a
+round whose items were **all merged still spawned a child to redo them**; `outcome: 'complete'` was
+unreachable; and because the progress digest counts only completed rounds, a project could report
+`0 of 5 done` with its items merged and verified.
+
+The no-op default is deleted. The seam now defaults to the real `verifyMergedItemsViaGit`, carries
+the three-state `MergedVerificationResult`, and a new `unverifiable` outcome records **no** round
+status. `resolveCanonicalMainRef` moved from `src/server/routes.ts` into the core module both
+consumers share.
+
+## What to Tell Your User
+
+A round of project work can now actually be recorded as finished.
+
+The piece that checks "has this work landed?" was a placeholder that always answered "nothing has
+landed". Nothing failed visibly — it just quietly always said no. So a round could never be marked
+complete, your progress line could read "0 of 5 done" while the work sat merged, and asking the round
+to run again would start a fresh session to redo work already finished.
+
+It now uses the real check. And when the check genuinely cannot run, it says so rather than guessing:
+it will not start a session to redo work that may already be done, and it records no verdict at all
+rather than claiming the round failed.
+
+The distinction that took the most care: "no merge recorded yet" and "there is a merge but I couldn't
+check it" look identical in the data and mean opposite things. Read the first as unknown and every
+new round stalls forever; read the second as not-done and you are back to redoing finished work.
+
+## Summary of New Capabilities
+
+No new endpoint, command, or config key. An existing round runner gained a working merged-state check
+and an honest "could not determine" outcome that records nothing instead of inventing a verdict.
+
+## Evidence
+
+Live: project `convergence-towards-coherence` had items 1, 2 and 3 at `pipelineStage: merged`
+(item 3 verified against merge commit `3443efd1d`) while the session-start digest read `0 of 5 done`.
+
+Refusals, by falsification. Neutralising the evidence predicate:
+
+```
+× an item that RECORDS a merge commit but cannot be checked → no respawn, and NO round verdict
+× child exits 0 but the shortfall is entirely uncheckable → unverifiable, NOT partially-complete
+```
+
+Re-introducing a default that returns an unconditional empty verdict:
+
+```
+× the seam cannot default to silence again > has no default verifier that returns an unconditional empty set
+```
+
+Restored: 27/27 across the three affected files; `tsc --noEmit` exit 0.
+
+## Known limits
+
+Verification is still merge-base reachability of a recorded commit — an item merged with red CI
+verifies. Nothing here schedules rounds; it makes a run able to conclude. And
+`resolveCanonicalMainRef` remains best-effort: without `gh` it falls back to `origin/main`, which on
+a fork-origin home under-verifies toward spawning rather than toward a false complete.

package/upgrades/side-effects/round-completion-verifies-merged.md

@@ -0,0 +1,137 @@
+# Side-effects review — round completion verifies merged state
+
+**Change:** `runRound`'s `verifyMergedItems` seam no longer defaults to a no-op that reports nothing
+verified. It defaults to the real git-backed `verifyMergedItemsViaGit`, the seam carries the
+three-state `MergedVerificationResult`, and a new `unverifiable` outcome records **no** round status.
+
+**Decision point touched:** yes — two of them. (a) whether a round is complete; (b) whether to spawn
+an autonomous child. Both previously ran on a verifier that could only ever say "nothing verified".
+
+## 1. Over-block — what legitimate inputs does this reject that it shouldn't?
+
+The one real risk is stalling a round that should proceed. `verifyMergedItemsViaGit` reports
+`unverifiable` for an item with **no `mergeCommitOid`**, which is the ordinary state of a round nobody
+has worked yet. A naive "any unverifiable ⇒ don't spawn" would deadlock **every fresh round** — a far
+worse defect than the one being fixed.
+
+Handled by splitting on **evidence**: only an item that *records* a merge commit and cannot be checked
+counts as genuinely uncheckable. An item with no recorded commit is not-done, and the child spawns.
+Pinned by `an item with NO merge commit recorded is NOT-DONE, not unknown — the child still spawns`.
+
+This test earned its place: the first draft applied the evidence rule at the pre-spawn check only,
+and the post-exit check kept the old conflation. The test failed, and the predicate is now defined
+once and used at both sites.
+
+## 2. Under-block — what does it still miss?
+
+- **CI-green is still not checked.** Verification remains merge-base reachability of a recorded
+  commit. An item merged with red CI verifies. Unchanged by this PR; `StageTransitionValidator`
+  performs the stronger check on the `/advance` path.
+- **No scheduling.** Nothing here makes rounds run; it makes a run able to conclude.
+- **`resolveCanonicalMainRef` is best-effort.** If `gh` is absent it falls back to `origin/main`,
+  which on a fork-origin home under-verifies (items read as regressed → a spawn, i.e. redoing work).
+  That is the pre-existing conservative default, now applied to this path too rather than left to a
+  caller to remember.
+
+## 3. Level-of-abstraction fit
+
+`resolveCanonicalMainRef` moved from `src/server/routes.ts` into `src/core/ProjectRoundExecution.ts`
+and is imported back. Both consumers — the lazy reconciler and this runner — need identical
+resolution, and a core module must not import from `server/`. Net: one definition, two callers,
+correct direction. The two source-grep tests in `merged-record-carries-its-evidence.test.ts` assert
+the *call* in `routes.ts`, not the definition, and still pass.
+
+## 4. Signal vs authority
+
+The verifier stays a **signal** — it reports three states and holds no blocking authority. `runRound`
+is the authority and now consumes all three rather than flattening them. The specific improvement:
+the authority can no longer be handed a value ("empty set") that is indistinguishable from a real
+negative reading. Per `docs/signal-vs-authority.md`, the failure was not a brittle check holding
+authority; it was an authority whose input could not express uncertainty.
+
+## 5. Interactions
+
+- **`/projects/:id/advance`** — untouched. Item-level stage transitions still go through
+  `StageTransitionValidator`; this only affects round-level outcome.
+- **`ProjectAutoAdvancePoller`** — unchanged; it clears `autoAdvanceAt` and counts unacked advances.
+  It now sees rounds that can actually reach `complete`.
+- **`ProjectDigestCache`** — unchanged, and this is the visible effect: the session-start
+  `N of M done` line can move off zero for the first time via the poller path.
+- **Double-fire / races** — none added. `unverifiable` performs strictly *fewer* writes than any
+  other outcome (it writes nothing), so it cannot race the tracker's OCC.
+
+## 6. External surfaces
+
+`RoundOutcome` gains `'unverifiable'` — a TypeScript-level addition on an exported union. In-repo
+consumers are `ProjectRoundExecution` itself and the tests; `recordOutcome` maps
+`Exclude<RoundOutcome,'unverifiable'>` so the compiler enforces the exhaustiveness rather than a
+runtime default swallowing it. No route, no config key, no user-visible string.
+
+## 7. Multi-machine posture
+
+**Machine-local BY DESIGN**, `machine-local-justification: hardware-bound-resource` — the check runs
+`git merge-base` against a working checkout on local disk, and the round runner already holds a
+host-local `ProjectRoundLock` (`.instar/local/round-runner.lock`). Round execution is bound to the
+machine holding the checkout; nothing here introduces state another machine would need to read. No
+notice, no durable cross-machine record, no generated URL.
+
+## 8. Rollback cost
+
+Low and local. One file's behavior plus a moved helper; no data migration, no config, no persisted
+schema. Reverting restores the prior behavior exactly — including the defect. A round left in
+`pending` by an `unverifiable` outcome is a normal pending round; nothing to repair.
+
+## Refusals demonstrated (command + output)
+
+Falsification 1 — neutralise the evidence predicate (`ids.filter(() => false && …)`):
+
+```
+× an item that RECORDS a merge commit but cannot be checked → no respawn, and NO round verdict
+× child exits 0 but the shortfall is entirely uncheckable → unverifiable, NOT partially-complete
+  Tests  2 failed | 8 passed (10)
+```
+
+Falsification 2 — re-introduce a default returning an unconditional empty verdict:
+
+```
+× the seam cannot default to silence again > has no default verifier that returns an unconditional empty set
+  Tests  1 failed | 9 passed (10)
+```
+
+Restored: `Tests 36 passed (36)` across the four affected files, `tsc --noEmit` exit 0.
+
+Falsification 3 — **a guard I did not anticipate, which changed the code.** The full suite failed on
+`lint-sync-subprocess-chokepoint`:
+
+```
+src/core/ProjectRoundExecution.ts:569 — raw sync spawn (execFileSync('gh', …)).
+A sync blocking op must funnel through withSyncOp() so the in-flight marker sees it.
+lint-sync-subprocess-chokepoint: 1 new violation(s).
+```
+
+In `routes.ts` that callsite sat on the lint's **frozen baseline** — grandfathered, not blessed.
+Moving it into core made it a NEW violation. The refusal is the useful part: `runRound` is called
+from the server's auto-advance poller, so a blocking `gh repo view` there stalls the event loop.
+Now funnelled through `withSyncOp` so the in-flight marker classes the stall instead of it
+presenting as an unexplained freeze. Lint after: `clean — 97 raw sync spawn(s), all grandfathered
+(142 baselined)`.
+
+Worth noting the lint is a deliberately **lexical, same-line** matcher (`/\bwithSyncOp\s*\(/`) and
+says so in its own header — it cannot prove runtime wrapping, which is the marker's unit test's job.
+My first wrap was semantically correct across three lines and still flagged. That is signal-vs-
+authority working as designed: a cheap check that names a hazard, not a proof.
+
+## Known-failing locally, verified NOT caused by this change
+
+`tests/e2e/dev-preflight-cli.test.ts` fails in this worktree. The cause is inside preflight's lint
+step, which shells out to `pnpm install`; reproduced standalone:
+
+```
+pnpm install → PNPM_EXIT=1
+[ERR_PNPM_IGNORED_BUILDS] Ignored build scripts: baileys, better-sqlite3, esbuild, sharp, …
+```
+
+That is a dependency build-script approval issue in a worktree installed with `npm ci`, naming only
+third-party packages and reading none of the changed files. Not run to completion deliberately —
+`pnpm install` would restructure the `node_modules` the 36 passing tests were validated against. CI
+installs the project its own way and is the arbiter; flagged here rather than quietly omitted.