# Upgrade Guide — vNEXT

<!-- assembled-by: assemble-next-md -->
<!-- bump: patch -->

## What Changed

The (already-built, dark) multi-machine transfer CAPSTONE harness is now RUNNABLE behind
a dev-gated route. `POST /live-test/multi-machine-capstone` moves the seat FIRST (local
`/pool/transfer`), demands the honest `seatMoved` signal (records a `200 capstone:'aborted'`
on a non-move — never a misleading PASS), then drives the §7.5 risk-category matrix through
the REAL user surfaces and records a signed PASS/FAIL artifact (PASS only where the reply
came FROM the target machine). `GET /live-test/artifacts` lists the recorded artifacts.
A surface whose demo credential is absent is reported in `blockedSurfaces` and fails loudly
via the driver — never a fabricated reply. Ships DARK (`monitoring.liveTestRunner.enabled`
omitted → `resolveDevAgentGate`: live on dev, 503 on the fleet). Driven by the converged +
approved `live-user-channel-proof-standard` (§6 / §7.5).

## What to Tell Your User

Nothing user-facing yet — this is an experimental, developer-only self-test that ships
turned off on the fleet. It exists so the agent can prove a multi-machine conversation
move works end-to-end through the real channels (Telegram and Slack) before you ever have
to test it — the first application of the Live-User-Channel Proof standard. The payoff is
invisible reliability: features get caught failing in a live self-test instead of by you
on first use.

## Summary of New Capabilities

Internal / developer-only: a gated endpoint that runs the gold-standard live-test harness
over the cross-machine conversation move (it moves the seat first, asserts the reply comes
from the target machine, and records a signed pass/fail report), plus a read-only endpoint
to list those reports. No fleet-facing surface; off by default.

## Evidence

- `tests/unit/multiMachineCapstoneMatrix.test.ts` (8) — the §7.5 matrix builder.
- `tests/unit/LiveTestRunner-capstone.test.ts` (3) — seat-move-first + reply-from-target.
- `tests/integration/live-test-capstone-route.test.ts` (7) — route 200/400/aborted/auth +
  seatMoved:true→artifact / seatMoved:false→no artifact.
- `tests/e2e/live-test-capstone-alive.test.ts` (4) — feature-alive on the REAL AgentServer
  init path: wired→200, dark→503, Bearer-required, shared-store wiring-integrity.
- `tsc --noEmit` clean. Ratchets green: no-silent-fallbacks, CapabilityIndex,
  feature-delivery-completeness, docs-coverage (all class floors met).
