# Upgrade Guide — vNEXT

<!-- assembled-by: assemble-next-md -->
<!-- bump: patch -->

## What Changed

**The Agent Carries the Loop (C1+C2)** — the structural enforcement of a new constitution standard (ratified by Justin, 2026-06-13/14): a commitment is the agent's obligation to *act*, never the user's to *remember*. The user is pulled in only for a usable result or a genuine authorization the agent lacks — never to be the agent's memory or to-do list.

Commitments now carry two orthogonal fields — `owner` (agent | user) ⟂ `blockedOn` (none | external | user-input | user-authorization). Agent-owned commitments drive the agent (the PromiseBeacon suppresses status pings to the user via a new `emitUserSend()` chokepoint); the user hears from the agent only on a result. Nothing can park silently forever: an external-blocked commitment must record falsifiable dependency-probes (`POST /commitments/:id/probe`), and a forever-wait raises ONE honest Attention dead-letter past a window/ceiling — never a nag, never silence. A terminal failure is rerouted to the dead-letter, never swallowed. Stale promises auto-close ONLY on objective evidence (a superseder reaching terminal-success); "abandoned" is never auto-closed (the CMT-1101 scar). Two signal-only detectors (B19 parked-on-user, B20 internal-id-leak) feed `MessagingToneGate`. A guarded `POST /commitments/:id/transition` allows in-place state changes that re-run the gate.

Ships **dark on the fleet / live-in-dry-run on the development agent** (`commitments.agentOwnedFollowthrough`): on a dev agent the owner-gate, governor, and reconciler run the full decision loop and *log* what they would do, but suppress/mutate nothing until a deliberate `dryRun:false` flip. The autonomy ratchet ("Blockers Are Autonomy Opportunities") is carved to a tracked follow-on (`agent-autonomy-ratchet`).

## What to Tell Your User

Nothing to announce for fleet users yet — this ships **dark** (off on the fleet) and runs in **dry-run only** on the development agent first (it watches and logs, changing no behavior). It is the groundwork for a real improvement: going forward, when the agent promises to do something, *the agent* owns following through — you'll never be asked to remember or chase it; you'll hear back only when there's a result or a genuine approval only you can give. The behavior change reaches you only after it has soaked safely in dry-run and is deliberately promoted.

## Summary of New Capabilities

- `POST /commitments/:id/probe` — record an external-dependency probe (resets the staleness window).
- `POST /commitments/:id/transition` — guarded in-place owner/blockedOn change (re-runs the well-formedness gate).
- `owner` / `blockedOn` / `actionClass` / `supersededBy` fields on commitments (back-filled for existing agents).
- Config: `commitments.agentOwnedFollowthrough` (dark-on-fleet / live-in-dry-run-on-dev; tuning dials for the staleness window/ceiling/sweep).

## Evidence

- 244 tests green across the C1+C2 suites: unit (state model, owner-gate chokepoint, external-block governor, evidence-gated reconciler, signal detectors, sync-clamp, transitions) + the E2E "feature is alive" test (probe/transition routes return real results through the production AgentServer; owner/blockedOn round-trip; forward gate returns 400 over HTTP).
- `npx tsc --noEmit`: 0 errors. Existing suites unaffected (beacon, tone-gate, CommitmentsSync, ConfigDefaults, dev-gate wiring, feature-completeness, standards-registry guards).
- Converged spec (`docs/specs/agent-owned-followthrough.md`, 5 rounds + cross-model codex/gemini) + side-effects review + independent second-pass concur.
