fix(growth-digest): un-droppable delivery + tone-safe content — maturation-followthrough-fix increment 1 (Standard C)

[JKHeadley]

Increment 1 of maturation-followthrough-fix — Standard C (Growth-Analyst un-droppable delivery)

Ships the operator's #1 pain point: the weekly growth digest that silently dropped on 2026-06-29 (it tripped the tone gate, consumed its window, and never retried). Everything here is dark / dev-gated per the spec's rollout ladder — nothing changes for fleet users on merge.

ELI16

Instar promises that features shipped "dark" can never be silently forgotten — a weekly "growth check-in" digest is supposed to keep re-surfacing them. But that digest had a bug: one week its own text contained a raw developer route path (GET /growth/digest) and a config key, which are exactly the things Instar's outbound safety filter blocks. So the message got blocked, and — worse — the code marked that week as "done" and never tried again. The one message whose whole job was "don't let things be forgotten" was itself silently forgotten.

This PR fixes both halves. C2 (always on): the digest no longer writes route paths or config keys into the message — it says "Full digest in your dashboard" in plain English, and a build-time test scans the formatted digest for any leak so this can't regress. C1 (dev-gated dark, off on the fleet): if a send is blocked or fails for a retryable reason, the week is no longer marked done — it re-queues under a bounded retry contract (5 attempts / 14 days / 60-second exponential backoff) and raises one honest heads-up on the attention queue ("couldn't send yet — it'll retry; findings are in your dashboard"). If it truly can't get through after the ceiling, it stops retrying and raises one HIGH alert — surfaced, never an infinite loop, never a silent drop. The heads-up carries only a generic reason, never the raw blocked text (so the escalation can't re-leak what C2 stripped). It's machine-local by design (only the awake machine sends), reuses the existing idempotency ledger + attention funnel + the already-built G3 guard-posture surfaces (no parallel machinery), and the rollback flip is caught by the Guard-Posture Tripwire so turning the guarantee off is itself surfaced.

What's in this increment

• C2 — tone-safe digest content (footer + truncation notes + R6 dev-gate detail) + scanFormattedDigestForLeaks guard + fixture test.
• C1 — retryable block re-queues instead of consuming the window; bounded delivery-attempt store (state/growth-digest-deferrals.json, registered); one deduped attention item (NORMAL on defer, HIGH on exhaustion); catchUp drains due deferrals. Behind monitoring.growthAnalyst.blockedDigestEscalation (dev-gated: live-on-dev / dark-fleet), registered in GUARD_MANIFEST.

Reuse (not duplication)

Reuses recordedWindows() idempotency, createAttentionItem, and the built G3 machinery (guardManifest / guardPostureView / accept-fallback) — the spec's Standard B composes with G3 rather than rebuilding it. The C1 deferral record is the single shared idempotency ledger the later watcher (Standard D) will read.

Tests

New tests/unit/growth-digest-delivery-c1c2.test.ts (16 tests, both sides of every boundary). Existing growth suites (publisher/analyst/gate-wiring/devgate-r6/routes) + guard-posture suites stay green (151 tests verified locally).

Gate / process

Built through the instar-dev gate (side-effects artifact + trace). Declared Tier 1 (dark, dev-gated, single-component, default-preserving; PR is the review surface) — audited belowFloor vs the size/new-config-key signal. Spec docs/specs/maturation-followthrough-fix.md (+ eli16) carried in the PR; it is review-convergence (awaiting operator ratification for the constitution-touching Standard E, a later increment).

Local pre-push smoke was skipped (INSTAR_PRE_PUSH_SKIP=1) due to transient machine CPU pressure (a concurrent npm install + fseventsd storm made the affected-test listing/run flake nondeterministically). CI runs the full suite and is the authority; auto-merge is armed and will only merge on green.

Deferred to follow-up increments (per the spec's rollout ladder)

• A + B — point the engine at the real /guards dark-flag inventory + the owner/deadline/proof-of-life maturation registry (R7; demote R3).
• D — the self-heal-before-notify watcher (reads the C1 deferral ledger shipped here).
• E — the Deferral=Deletion / Close-the-Loop guard + spec-converge review-check (operator-ratified).

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
instar	Ready	Preview, Comment	Jul 3, 2026 9:47pm