instar 1.3.995 → 1.3.997

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.995",
+  "version": "1.3.997",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-27T06:36:28.815Z",
-  "instarVersion": "1.3.995",
+  "generatedAt": "2026-07-27T07:30:21.063Z",
+  "instarVersion": "1.3.997",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "6da3409e8abed4586e60554113b75894f3fa573fc0ac4c6852d75c8f3fd81f1a",
+      "contentHash": "675cd3e00c868dcd0262d7964ec0ee503afc0e7436a46eda9af4aa3e9e93b990",
       "since": "2025-01-01"
     },
     "cli:init": {

package/upgrades/1.3.996.md

@@ -0,0 +1,38 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+`PATCH /evolution/actions/:id` now rejects unsupported request fields instead of acknowledging a write it will discard. The route accepts the documented update surface, `status` and `resolution`, validates those values before mutation, rejects bodies with no usable update, and passes only explicitly present supported fields into `updateAction`.
+
+Before this change, a caller could send a field such as `title`, receive `{ "ok": true }`, and still have the stored action title remain unchanged. That made a failed correction look recorded.
+
+## What to Tell Your User
+
+The action update API is now honest about what it can change.
+
+If an agent or script tries to change a field this route does not support, it now gets a clear error that names both what it sent and what is actually supported. That prevents the worst version of the bug: your agent being told the change was saved while it was quietly thrown away.
+
+The normal path is unchanged — updating an action's status, its resolution, or both, still works exactly as before. Anything that needs to edit a title, description, priority, tags, due date, or source belongs on a route that genuinely supports those, rather than one that used to pretend it had.
+
+## Summary of New Capabilities
+
+No new endpoint or config key. The existing evolution action patch route gained strict request-body validation and now fails loudly when a caller asks it to update fields it does not own.
+
+## Evidence
+
+Added integration coverage in `tests/integration/evolution-actions-patch-route.test.ts` for:
+
+- unsupported fields returning `400` while the stored record remains unchanged
+- valid `status` plus `resolution` updates still persisting
+- empty usable update bodies returning `400`
+- missing action IDs still returning `404` after a valid update body
+- invalid status values returning `400` before any write
+
+Typecheck evidence: `npx tsc --noEmit`.
+
+## Known Limits
+
+This is a breaking change for callers that were sending extra fields and depending on a `200` response. The documented callers send only `status` and `resolution`, so the known supported path is unchanged. The broken callers are the ones whose extra fields were already being ignored.

package/upgrades/1.3.997.md

@@ -0,0 +1,61 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The `threadline-relay` row in the channel registry reported `relay reports ready and connected`
+without naming the subject of that verdict. It reads `ctx.threadlineRelayClient` — the **server
+process's** relay client. The MCP tool path runs in a different process holding its own client, so
+`GET /channels` could report `working` while a send from the MCP path failed, and both readings were
+true at the same time.
+
+The verdicts are unchanged. Only the claims are scoped, following the `mutual-ssh` precedent already
+in the same file. The working branch now reports the server-process client explicitly and states that
+this is neither another process's client nor a guarantee that a given send will land; the broken
+branch is scoped the same way. `cost` is updated because it is user-visible registry prose, while
+`whenPreferred` is left alone because it describes channel preference rather than the runtime client
+whose state was measured.
+
+## What to Tell Your User
+
+When your agent tells you a channel is working, it now tells you which part of itself it checked.
+
+Your agent runs in more than one process, and they can hold different connection states at the same
+time. Previously it could report that the agent-to-agent relay was connected while a message sent by
+a different part of the agent quietly failed — and both statements were true, which is what made it
+confusing. The report now names what it actually measured, so a green reading cannot be misread as a
+promise about a path it never checked.
+
+## Summary of New Capabilities
+
+No new endpoint, command, or configuration. The threadline relay row in the channel registry now
+names the process whose relay state it reports, in both its working and its broken form.
+
+## Evidence
+
+Restoring the original unscoped claim fails the new test for the right reason:
+
+```
+× threadline-relay working detail scopes the verdict to the server-process relay client
+  → expected 'relay reports ready and connected' to contain 'server process relay client'
+  Tests  1 failed | 7 passed (8)
+```
+
+Removing the `mutual-ssh` caveat likewise fails, confirming the precedent test still bites:
+
+```
+× mutual-ssh reports construction WITHOUT claiming a completed round-trip
+  → expected 'runtime constructed and listening' to contain 'not a completed round-trip'
+  Tests  1 failed | 7 passed (8)
+```
+
+Both restored byte-identical. Green: `Test Files 3 passed (3) · Tests 36 passed (36)` across
+`channel-registry-claims`, `channel-registry` and `user-channel-liveness`; `tsc --noEmit` exit 0.
+
+## Known limits
+
+The row still reports a single measurement — the server process's relay client — and now says so.
+It does not probe the MCP tool's client, so it cannot tell you that path's state; it only stops
+implying it. Nor does a connected reading promise that any particular send will land.

package/upgrades/side-effects/patch-actions-strict.md

@@ -0,0 +1,131 @@
+# Side-Effects Review - PATCH actions strict body
+
+**Version / slug:** `patch-actions-strict`
+**Date:** `2026-07-26`
+**Author:** `Codex`
+**Second-pass reviewer:** `not required`
+
+## Summary of the change
+
+This change tightens `PATCH /evolution/actions/:id` in `src/server/routes.ts` so the route refuses request bodies containing fields outside the documented patch contract, currently `status` and `resolution`. It also rejects empty usable updates, validates the type and allowed values of supported fields before mutation, and passes `EvolutionManager.updateAction` only the fields actually present. The integration coverage in `tests/integration/evolution-actions-patch-route.test.ts` asserts both responses and stored records so the old "ok but discarded" behavior is caught.
+
+## Decision-point inventory
+
+- `PATCH /evolution/actions/:id` body validation in `src/server/routes.ts` - modify - deterministic API schema gate now rejects unsupported fields and empty usable updates before any store write.
+- `PATCH /evolution/actions/:id` supported field validation in `src/server/routes.ts` - modify - `status` and `resolution` are type-checked before constructing the update object.
+- `EvolutionManager.updateAction` call site in `src/server/routes.ts` - modify - receives only validated, explicitly present update keys instead of destructured possibly-undefined values.
+- Standby-write reconciliation via `refuseInadmissibleWrite(req, res)` - pass-through - still runs after body validation and before mutation, preserving the existing admission order.
+
+---
+
+## 1. Over-block
+
+The intentional over-block is that callers sending any extra field now receive `400` where they previously received `200`. Concrete examples: `{ "title": "Corrected title" }`, `{ "description": "Retract the false claim" }`, and `{ "status": "completed", "title": "Corrected title" }` are now rejected because `title` and `description` are not supported by this patch route. A caller that used extra fields as harmless client metadata in the same JSON body also gets a `400`; that caller must stop sending those fields or use a separate supported surface. This is acceptable because the old behavior silently ignored those fields while claiming success.
+
+---
+
+## 2. Under-block
+
+This still does not add support for changing action title, description, priority, tags, due date, or source. It also does not validate semantic transitions such as whether moving from `cancelled` back to `completed` is appropriate. A request with a syntactically valid but poor resolution like `{ "resolution": "done" }` still passes because the route only enforces a non-empty string, not quality or evidence. A request with `{ "status": "completed" }` and no resolution still passes, matching the existing documented surface.
+
+---
+
+## 3. Level-of-abstraction fit
+
+This is at the route schema layer, which is the right layer for an enumerable API contract. The route knows which fields it supports and can reject any other key before the persistence layer sees the request. This should not be an LLM authority or a higher-level intent gate because there are no competing contextual signals to weigh; the question is simply whether the JSON body matches the route's declared write surface. It still uses the existing lower-level `EvolutionManager.updateAction` primitive for the actual mutation instead of reimplementing persistence.
+
+---
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+**Does this change hold blocking authority with brittle logic?**
+
+- [ ] No - this change produces a signal consumed by an existing smart gate.
+- [ ] No - this change has no block/allow surface.
+- [ ] Yes - but the logic is a smart gate with full conversational context (LLM-backed with recent history or equivalent).
+- [ ] Warning: Yes, with brittle logic - STOP. Reshape the design. Brittle detectors must not own block authority. Either promote the logic to smart-gate level (with proper context) or demote it to a signal that feeds an existing smart gate.
+
+None of the predefined checkboxes exactly names deterministic API schema validation. The change does hold reject authority, but not over a brittle inferred signal. The supported field set is a finite invariant owned by the route, so refusing non-contract keys is ordinary request validation rather than a competing-signals judgment point. No signal-vs-authority issue identified.
+
+---
+
+## 4b. Judgment-point check (Judgment Within Floors standard)
+
+**Does this change add a static heuristic at a competing-signals decision point? If yes: why is it not a judgment point within a floor?**
+
+No new static heuristic at a competing-signals decision point. The body shape is enumerable: `status` and `resolution` are the only supported fields for this route. There is no live conflict between evidence, liveness, ownership, urgency, or operator intent that needs an arbiter.
+
+---
+
+## 5. Interactions
+
+**Shadowing:** The new schema validation runs before `refuseInadmissibleWrite`. It can shadow the standby-write reconciliation check for malformed requests, but only before any mutation and only for requests that the route should not admit. Valid requests still reach the existing reconciliation gate in the same relative position before `updateAction`.
+
+**Double-fire:** No issue identified. The new route validation returns one HTTP response and performs no side effect. It cannot double-submit an action update or duplicate a reconciliation event.
+
+**Races:** No issue identified. The change does not introduce shared state or asynchronous work. The same list-then-update pattern for the class-review completion side effect remains unchanged.
+
+**Feedback loops:** No issue identified. The only new feedback is a synchronous `400` response naming unsupported fields, which helps callers correct their request rather than feeding another automatic retry loop.
+
+---
+
+## 6. External surfaces
+
+This changes the HTTP API response for malformed `PATCH /evolution/actions/:id` requests. Other agents or scripts on the same machine that send unsupported fields now see `400` instead of `200`. Other users of the install base get the stricter behavior after upgrade. There is no direct Telegram, Slack, GitHub, Cloudflare, or other external-service call. Persistent state changes are reduced: unsupported writes now leave state untouched and visibly fail, where they previously left state untouched while claiming success. No timing or runtime condition is introduced.
+
+**Operator surface (Mobile-Complete Operator Actions):** No operator-facing action is added. The change touches an existing HTTP route, not a dashboard form or approval page, so no phone-completable operator surface is required.
+
+---
+
+## 6b. Operator-surface quality (Operator-Surface Quality standard)
+
+No operator surface - not applicable. This change does not touch dashboard markup, approval pages, grant/revoke forms, or secret-drop forms.
+
+---
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+**machine-local BY DESIGN** - the route validates a request body before mutating the local evolution store for the agent instance handling the request. The validation rule is code-level behavior that ships identically to every machine, but the action records themselves remain the existing local evolution state. The change emits no user-facing notices, so one-voice gating is not needed. It holds no new durable state, so there is nothing new to strand on topic transfer. It generates no URLs, so there is no cross-machine link survival concern.
+
+---
+
+## 8. Rollback cost
+
+**Hot-fix release:** Revert the route validation and test additions, then ship a patch release.
+
+**Data migration:** No data migration. The change creates no new files in runtime state and changes no schema.
+
+**Agent state repair:** No agent state repair is required. If a caller hit the new `400`, its prior ignored write still did not mutate state; the repair is to resend a supported patch or add a real route for the intended field.
+
+**User visibility:** During rollback propagation, malformed callers would go back to receiving `200` for ignored fields, which is the original defect. Documented callers sending only `status` and `resolution` should not notice rollback either way.
+
+---
+
+## Conclusion
+
+The review identifies one intentional compatibility break: callers sending extra unsupported fields now fail loudly. That is the point of the change because the previous behavior created false evidence of a correction. The change is small, route-local, deterministic, and does not add new persistent state or external side effects. Clear to ship with the explicit release note that extra fields now receive `400`.
+
+---
+
+## Second-pass review (if required)
+
+**Reviewer:** `not required`
+**Independent read of the artifact:** `concur`
+
+Tier 1 does not require a second-pass reviewer for this route-local schema hardening.
+
+---
+
+## Evidence pointers
+
+- `docs/specs/patch-actions-strict.eli16.md`
+- `tests/integration/evolution-actions-patch-route.test.ts`
+- `npx tsc --noEmit`
+
+---
+
+## Class-Closure Declaration (display-only mirror)
+
+No agent-authored-artifact defect - not applicable.