# Upgrade Guide — vNEXT

<!-- assembled-by: assemble-next-md -->
<!-- bump: minor -->

## What Changed

**Coherence Journal mesh transport (P1 closing step)** — the `journal-sync`
MeshCommand + receive handler + own-stream advert on the `session-status`
response + `PeerPresencePuller` delta-drive that runs the merged
`JournalSyncApplier` over the existing 30s machine check-in
(COHERENCE-JOURNAL-SPEC §3.4 rule 5). Adverts are O(kinds) integers on the
heartbeat; entry deltas ride separate size-capped requests. Ships DARK
everywhere (gated on explicit `multiMachine.coherenceJournal.replication.enabled
=== true`) — merge does not change live mesh traffic; cross-machine sync is
a deliberate flip (the live two-machine proof).

The MTP red-team harness resolver (`src/redteam/ScenarioPack.ts`) now states its
governance verdicts honestly. Every `ResolvedExpectation` carries a `method`
field (`keyword-heuristic`), and the `reason` strings name their keyword-overlap
basis instead of asserting the verdict as fact — an `ungoverned` result is now
framed as a candidate to verify semantically, not a proven intent gap. The
matching logic is unchanged; only the verdict's self-description.

## What to Tell Your User

This is the wire that lets your agent's machines actually exchange their
diaries — but it ships switched OFF. Turning it on (so the Laptop can answer
"where did this conversation live on the Mini?") is a deliberate, watched
step, not something a code update flips silently.

Nothing user-facing changes. This is an internal correctness fix to an
experimental capability: the red-team harness no longer overstates a crude
keyword-match result as a definitive finding.

## Summary of New Capabilities

- None user-invocable yet — the transport is dark until the replication
  switch is turned on. Internal: `journal-sync` mesh verb + advert-driven
  delta replication.

- `ResolvedExpectation.method` field for provenance of every governance verdict.
- Honest verdict `reason` strings (keyword-overlap basis named; `ungoverned`
  framed as candidate-to-verify).

## Evidence

- Integration round-trip (two in-process journal+applier pairs through a
  real signed MeshRpc envelope; forged-sender rejection) + gated-drive unit
  test (no-op when off, never throws). tsc + full lint chain clean.

Not a behavior change to classification — a truthfulness fix to the verdict
text + a provenance field, required by the Truthful Provenance standard (#896).
The brittleness it makes honest about was observed live: a false-negative
`ungoverned` verdict on the first boundary map. Verified by 26 unit tests
(one new, asserting method-provenance and that the as-fact phrasing is gone) and
a clean `tsc --noEmit`.
