instar 1.3.1647 → 1.3.1649

package/src/data/feature-ladders.json

@@ -0,0 +1,191 @@
+{
+  "schema": "feature-ladders/1",
+  "entries": [
+    {"id": "apprenticeship.stallCoverageGate", "title": "Stall coverage gate", "flag": {"path": "apprenticeship.stallCoverageGate", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "tracking": {"state": "measured", "plan": "The gate writes a stall-matrix row to .instar/logs/apprenticeship-decisions.jsonl on each onboarding transition, none yet because no apprenticeship instance has run; the review grades whether each would-refuse was right through POST /maturation/evidence."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "stall-matrix-decisions", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/apprenticeship-decisions.jsonl", "where": {"gate": "stall-matrix"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "apprenticeship.stallCoverageGate", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "apprenticeship.stallCoverageGate", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "stall-matrix-decisions", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/apprenticeship-decisions.jsonl", "where": {"gate": "stall-matrix"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "apprenticeship.stallCoverageGate", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "apprenticeship.stallCoverageGate", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}, "aliases": []},
+    {"id": "autonomousSessions.codexTaskContinuation", "title": "Codex task continuation", "flag": {"path": "autonomousSessions.codexTaskContinuation"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "aliases": ["autonomousSessions.codexTaskContinuation.preparationCarrierEnabled"], "tracking": {"state": "needed", "plan": "Preference candidate: it spends model capacity on each continuation; its audit lives inside the CodexTaskContinuationStore ledger, so add featureEvidence.record at each allow or refuse in src/core/CodexTaskContinuationStore.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "autonomousSessions.codexTaskContinuation", "kind": "fired"}, "of": {"featureId": "autonomousSessions.codexTaskContinuation"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "autonomousSessions.codexTaskContinuation", "kind": "error"}, "of": {"featureId": "autonomousSessions.codexTaskContinuation"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}]}}},
+    {"id": "autonomousSessions.geminiLoopDriver", "title": "Gemini loop driver", "flag": {"path": "autonomousSessions.geminiLoopDriver"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "No loop has ever run and nothing is logged, so add featureEvidence.record at each run end and failure in src/monitoring/GeminiLoopRunner.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "autonomousSessions.geminiLoopDriver", "kind": "fired"}, "of": {"featureId": "autonomousSessions.geminiLoopDriver"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "autonomousSessions.geminiLoopDriver", "kind": "error"}, "of": {"featureId": "autonomousSessions.geminiLoopDriver"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}]}}, "aliases": []},
+    {"id": "cartographer", "title": "Code map", "flag": {"path": "cartographer"}, "disposition": "retire", "retire": {"reason": "Off on the development agent for 18 days with no user and two review extends; the review marked it retire-pending.", "ref": "feature-maturation-review row cartographer (verdict retire-pending)"}, "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "Nothing to log: the review retires this unless it finds a real user first."}, "rungs": {}, "aliases": ["cartographer.conformanceAudit.llmEnrichment + cartographer.subtreeNav.llmRerank"]},
+    {"id": "cartographer.conformanceAudit", "title": "Conformance audit", "flag": {"path": "cartographer.conformanceAudit"}, "disposition": "retire", "retire": {"reason": "Its route needs the cartographer root, so it cannot run while the parent is off and retiring.", "ref": "src/server/routes.ts conformanceGate; feature-maturation-review row cartographer (retire-pending)"}, "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "Nothing to log: the review retires this unless it finds a real user first."}, "rungs": {}, "aliases": []},
+    {"id": "cartographer.freshnessSweep", "title": "Freshness sweep", "flag": {"path": "cartographer.freshnessSweep"}, "disposition": "retire", "retire": {"reason": "Never enabled, costs third-party spend, and only refreshes the summaries of the retiring code map.", "ref": "feature-maturation-review rows cartographer (retire-pending) and cartographer.freshnessSweep"}, "final": "default-on", "risk": "sensitive", "tracking": {"state": "needed", "plan": "Nothing to log: the review retires this unless it finds a real user first."}, "rungs": {}, "aliases": []},
+    {"id": "commitments.agentOwnedFollowthrough", "title": "Agent owned followthrough", "flag": {"path": "commitments.agentOwnedFollowthrough"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "The aoft.* events have no listener and are lost, so persist them with a featureEvidence.record listener where PromiseBeacon is built in src/commands/server.ts, and the review grades whether each suppression hid something the user needed."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"commitments.agentOwnedFollowthrough.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "commitments.agentOwnedFollowthrough", "kind": "fired"}, "of": {"featureId": "commitments.agentOwnedFollowthrough"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "commitments.agentOwnedFollowthrough", "kind": "error"}, "of": {"featureId": "commitments.agentOwnedFollowthrough"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "commitments.agentOwnedFollowthrough", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "commitments.agentOwnedFollowthrough", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 30}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "commitments.agentOwnedFollowthrough", "kind": "fired"}, "of": {"featureId": "commitments.agentOwnedFollowthrough"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "commitments.agentOwnedFollowthrough", "kind": "error"}, "of": {"featureId": "commitments.agentOwnedFollowthrough"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "commitments.agentOwnedFollowthrough", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "commitments.agentOwnedFollowthrough", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 30}]}}, "aliases": []},
+    {"id": "commitments.autoExpiry", "title": "Old promise cleanup", "flag": {"path": "commitments.autoExpiry"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Each sweep writes a row to .instar/logs/commitments-auto-expiry.jsonl (about 72 KB a row, so the log holds only about 5 days and its windows stay short), and the review grades a sample of the would-expire list because the rule is no promise still in force."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"commitments.autoExpiry.dryRun": false}}, "metrics": [{"id": "sweeps", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/commitments-auto-expiry.jsonl", "where": {"dryRun": true}, "of": {"dryRun": true}, "value": "count"}, "direction": "at-least", "threshold": 6, "minSamples": 6, "windowDays": 3}, {"id": "capped-pass-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/logs/commitments-auto-expiry.jsonl", "where": {"capped": true}, "of": {"dryRun": true}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 6, "windowDays": 3}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "commitments.autoExpiry", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "commitments.autoExpiry", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 10, "windowDays": 30}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "live-sweeps", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/commitments-auto-expiry.jsonl", "where": {"dryRun": false}, "value": "count"}, "direction": "at-least", "threshold": 6, "minSamples": 6, "windowDays": 3}, {"id": "capped-pass-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/logs/commitments-auto-expiry.jsonl", "where": {"capped": true}, "of": {"dryRun": false}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 6, "windowDays": 3}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "commitments.autoExpiry", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "commitments.autoExpiry", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 10, "windowDays": 30}]}}, "aliases": []},
+    {"id": "conversationIdentity.followThrough", "title": "Slack promise delivery", "flag": {"path": "conversationIdentity.followThrough"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "No Slack conversation has been minted here, so delivery has never run and writes only a console line; add featureEvidence.record on each delivered and failed id<0 outcome in src/core/deliverToConversation.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "conversationIdentity.followThrough", "kind": "fired"}, "of": {"featureId": "conversationIdentity.followThrough"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "conversationIdentity.followThrough", "kind": "error"}, "of": {"featureId": "conversationIdentity.followThrough"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}]}}, "aliases": []},
+    {"id": "dashboard.liveInsights", "title": "Live dashboard insights", "flag": {"path": "dashboard.liveInsights"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Each insight is one DashboardInsightEngine call in the feature metrics, which gives real call counts and error rate."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "llm-calls", "role": "ran", "source": "feature-metrics", "ref": {"feature": "DashboardInsightEngine", "field": "realLlmCalls"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "feature-metrics", "ref": {"feature": "DashboardInsightEngine", "field": "errorRate"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []},
+    {"id": "ecosystemIdeas", "title": "Ecosystem idea pipeline", "flag": {"path": "ecosystemIdeas"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "measured", "plan": "Preference candidate: its spec keeps it opt-in on the fleet because it needs source roots and costs tokens; .instar/logs/ecosystem-ideas.jsonl has a run row per run, and a zero-token run did no review work, which is all 46 runs since 11-02 (stopped by the source-tree guard), so it reads as failing today."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "runs", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/ecosystem-ideas.jsonl", "where": {"event": "run"}, "of": {"event": "run"}, "value": "count"}, "direction": "at-least", "threshold": 4, "minSamples": 4, "windowDays": 30}, {"id": "review-calls", "role": "ran", "source": "feature-metrics", "ref": {"feature": "EcosystemIdeaReview", "field": "realLlmCalls"}, "direction": "at-least", "threshold": 4, "minSamples": 4, "windowDays": 30}, {"id": "graded-wrong", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "ecosystemIdeas", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "ecosystemIdeas", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.1, "minSamples": 5, "windowDays": 30}]}}, "aliases": []},
+    {"id": "evolutionActions.autoExpiry", "title": "Old action cleanup", "flag": {"path": "evolutionActions.autoExpiry"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Each sweep writes a row to .instar/logs/evolution-actions-auto-expiry.jsonl, and the review grades a sample of the would-expire list because the rule is no real unfinished work."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"evolutionActions.autoExpiry.dryRun": false}}, "metrics": [{"id": "sweeps", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/evolution-actions-auto-expiry.jsonl", "where": {"dryRun": true}, "of": {"dryRun": true}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "evolutionActions.autoExpiry", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "evolutionActions.autoExpiry", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 10, "windowDays": 30}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "live-sweeps", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/evolution-actions-auto-expiry.jsonl", "where": {"dryRun": false}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "evolutionActions.autoExpiry", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "evolutionActions.autoExpiry", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 10, "windowDays": 30}]}}, "aliases": []},
+    {"id": "evolutionActions.undatedResurfacer", "title": "Undated action resurfacer", "flag": {"path": "evolutionActions.undatedResurfacer"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Its ledger .instar/state/undated-action-resurfacer.jsonl has a run row per pass, but none since 08-28 because it is blocked on state-owner-unconfigured, so it reads no-data until that is fixed; the review grades each selection."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"evolutionActions.undatedResurfacer.dryRun": false}}, "metrics": [{"id": "runs", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/state/undated-action-resurfacer.jsonl", "where": {"type": "run"}, "of": {"type": "run"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "evolutionActions.undatedResurfacer", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "evolutionActions.undatedResurfacer", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 5, "windowDays": 30}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "runs", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/state/undated-action-resurfacer.jsonl", "where": {"type": "run"}, "of": {"type": "run"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "emit-failure-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/state/undated-action-resurfacer.jsonl", "where": {"type": "emit-failed"}, "of": {"type": "pending-emit"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}, "aliases": []},
+    {"id": "feedbackFactory.consumer", "title": "Feedback consumer", "flag": {"path": "feedbackFactory.consumer"}, "disposition": "composed", "composedInto": "feedbackFactory.drain", "final": "default-on", "risk": "standard", "tracking": {"state": "measured", "plan": "Moves with the drain, which it hands work to; the drain status and its readiness metrics carry the evidence."}, "rungs": {}, "aliases": []},
+    {"id": "feedbackFactory.drain", "title": "Feedback drain", "flag": {"path": "feedbackFactory.drain"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "subject": "feedback-factory-operating-drain", "aliases": ["feedbackFactory.processing + feedbackFactory.drain + feedbackFactory.consumer"], "restartNeeded": true, "tracking": {"state": "measured", "plan": "The spec contract reads the feedback-factory.completed-runs projection (last drain run succeeded or no-op), and the readiness arbiter metrics show its error rate."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "completed-drain-runs", "role": "ran", "source": "feature-summary", "ref": {"ref": "feedback-factory.completed-runs"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 1}, {"id": "readiness-error-rate", "role": "harm", "source": "feature-metrics", "ref": {"feature": "FeedbackReadinessArbiter", "field": "errorRate"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "feedbackFactory.execute", "title": "Feedback executor", "flag": {"path": "feedbackFactory.execute"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "tracking": {"state": "measured", "plan": "Preference candidate: its spec limits it to operated feedback hosts with a source checkout; execute:* rows in .instar/logs/feedback-triage.jsonl count spawns, failed prepares and PRs closed by review, and both rates are above the default bar today (39 of 137, 8 of 14)."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "spawned", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/feedback-triage.jsonl", "where": {"event": "execute:spawned"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "prepare-failure-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/logs/feedback-triage.jsonl", "where": {"event": "execute:prepare-failed"}, "of": {"event": "execute:claimed"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}, {"id": "review-closed-rate", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/feedback-triage.jsonl", "where": {"event": "execute:review-failed-closed"}, "of": {"event": "execute:independent-review"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 30}, {"id": "graded-wrong", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "feedbackFactory.execute", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "feedbackFactory.execute", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.1, "minSamples": 5, "windowDays": 30}]}}, "aliases": []},
+    {"id": "feedbackFactory.processing", "title": "Feedback clustering", "flag": {"path": "feedbackFactory.processing"}, "disposition": "composed", "composedInto": "feedbackFactory.drain", "final": "default-on", "risk": "standard", "tracking": {"state": "measured", "plan": "Moves with the drain, which reads the store this pass clusters; the review treats the three as one row."}, "rungs": {}, "aliases": []},
+    {"id": "feedbackFactory.triage", "title": "Feedback triage", "flag": {"path": "feedbackFactory.triage"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "decision rows in .instar/logs/feedback-triage.jsonl and FeedbackTriageArbiter metrics are real, while the spec bar (30+ medium or strong grades, 10% wrong or less) lives in the triage_grades table, so mirror it with featureEvidence.record in FeedbackTriageStore.recordGrade."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "decisions", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/feedback-triage.jsonl", "where": {"event": "decision"}, "value": "count"}, "direction": "at-least", "threshold": 200, "minSamples": 200, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "feature-metrics", "ref": {"feature": "FeedbackTriageArbiter", "field": "errorRate"}, "direction": "at-most", "threshold": 0.05, "minSamples": 50, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "feedbackFactory.triage", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "feedbackFactory.triage", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.1, "minSamples": 30, "windowDays": 30}]}}, "aliases": []},
+    {"id": "intelligence.degradationLadder.backoff", "title": "Rate limit backoff", "flag": {"path": "intelligence.degradationLadder.backoff"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Nothing records a backoff, so add featureEvidence.record in src/core/IntelligenceRouter.ts at each backoff wait, with fired on a retry that worked and error on one that did not."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "intelligence.degradationLadder.backoff", "kind": "fired"}, "of": {"featureId": "intelligence.degradationLadder.backoff"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "intelligence.degradationLadder.backoff", "kind": "error"}, "of": {"featureId": "intelligence.degradationLadder.backoff"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}]}}, "aliases": ["intelligence.degradationLadder (backoff, queue, neverSilent)"]},
+    {"id": "intelligence.degradationLadder.neverSilent", "title": "Degradation tracking", "flag": {"path": "intelligence.degradationLadder.neverSilent"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Open degradations live in an in-memory map, so add featureEvidence.record in DegradationReporter at each open, resolve and escalation, with error on an escalation."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "intelligence.degradationLadder.neverSilent", "kind": "fired"}, "of": {"featureId": "intelligence.degradationLadder.neverSilent"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "intelligence.degradationLadder.neverSilent", "kind": "error"}, "of": {"featureId": "intelligence.degradationLadder.neverSilent"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}, "rare": true, "aliases": []},
+    {"id": "intelligence.degradationLadder.queue", "title": "Deferred call queue", "flag": {"path": "intelligence.degradationLadder.queue"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Nothing records this rung, so add featureEvidence.record in src/core/IntelligenceRouter.ts where a deferrable call enters the queue, with error on an enqueue rejection or queued-call failure."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "intelligence.degradationLadder.queue", "kind": "fired"}, "of": {"featureId": "intelligence.degradationLadder.queue"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "intelligence.degradationLadder.queue", "kind": "error"}, "of": {"featureId": "intelligence.degradationLadder.queue"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}, "rare": true, "aliases": []},
+    {"id": "intelligence.jevCirclesShadow", "title": "Jev circles shadow", "flag": {"path": "intelligence.jevCirclesShadow"}, "disposition": "retire", "retire": {"reason": "Retired by the Jev review: about 1 in 10 would-nudges were real loops, nothing consumes it, and it cost about 10M Jev tokens a week.", "ref": "CMT-1035, Jev review 2026-10-29, recorded in Echo config changeReason"}, "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "Nothing to log: the review retires this unless it finds a real user first."}, "rungs": {}, "aliases": []},
+    {"id": "intelligence.jevCorrectionShadow", "title": "Jev correction shadow", "flag": {"path": "intelligence.jevCorrectionShadow"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "aliases": ["intelligence.jevCorrectionShadow (+ feedSentinel)"], "tracking": {"state": "measured", "plan": "logs/jev-correction-shadow.jsonl has a check row per inbound message and a skipped row per failure, and the jev-correction-shadow metric gives its error rate."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "checks", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/jev-correction-shadow.jsonl", "where": {"kind": "check"}, "value": "count"}, "direction": "at-least", "threshold": 100, "minSamples": 100, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "feature-metrics", "ref": {"feature": "jev-correction-shadow", "field": "errorRate"}, "direction": "at-most", "threshold": 0.05, "minSamples": 50, "windowDays": 14}]}}},
+    {"id": "intelligence.jevCorrectionShadow.feedSentinel", "title": "Jev correction feed", "flag": {"path": "intelligence.jevCorrectionShadow.feedSentinel"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "measured", "plan": "The correction sentinel writes each Jev-fed signal to .instar/logs/correction-learning-audit.jsonl with trigger jev, and its own noise verdict is an outside judgement of the feed."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fed-and-recorded", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/correction-learning-audit.jsonl", "where": {"trigger": "jev", "decision": "recorded"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "noise-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": ".instar/logs/correction-learning-audit.jsonl", "where": {"trigger": "jev", "decision": "noise"}, "of": {"trigger": "jev"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []},
+    {"id": "intelligence.jevLoadAssessment", "title": "Machine load second opinion", "flag": {"path": "intelligence.jevLoadAssessment"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "measured", "plan": "logs/machine-load-assessment.jsonl grades each label 15 minutes later as right, wrong or unknown; wrong is 52 of 272 outcomes today, above the default bar, so it holds until labels improve."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "checks", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/machine-load-assessment.jsonl", "where": {"kind": "check"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "wrong-grade-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/machine-load-assessment.jsonl", "where": {"kind": "outcome", "grade": "wrong"}, "of": {"kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 50, "windowDays": 14}]}}, "aliases": []},
+    {"id": "intelligence.jevMemoryPicker", "title": "Jev memory picker", "flag": {"path": "intelligence.jevMemoryPicker"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "measured", "plan": "logs/jev-memory-picker.jsonl has a row per session start and most skip because the index fits, so ran counts only ranked rows; it stays in shadow mode, and turning on inject is a separate decision for the review."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "ranked", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/jev-memory-picker.jsonl", "where": {"outcome": "ranked"}, "value": "count"}, "direction": "at-least", "threshold": 100, "minSamples": 100, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "feature-metrics", "ref": {"feature": "jev-memory-picker", "field": "errorRate"}, "direction": "at-most", "threshold": 0.05, "minSamples": 50, "windowDays": 14}]}}, "aliases": []},
+    {"id": "intelligence.jevSignalLive", "title": "Jev signal live", "flag": {"path": "intelligence.jevSignalLive"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "measured", "plan": "Preference candidate: its spec needs an operator decision for the fleet because every reviewed outbound message would go to TypeSafe; logs/jev-signal-shadow.jsonl has a compared or not-compared row per check, while the referee comparison in its spec is read from the report rather than a threshold here."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "compared", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/jev-signal-shadow.jsonl", "where": {"kind": "compared"}, "value": "count"}, "direction": "at-least", "threshold": 1000, "minSamples": 1000, "windowDays": 14}, {"id": "not-compared-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/jev-signal-shadow.jsonl", "where": {"kind": "not-compared"}, "of": {"kind": "compared"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1000, "windowDays": 14}]}}, "aliases": []},
+    {"id": "jobs.scriptRunners", "title": "Job script runners", "flag": {"path": "jobs.scriptRunners"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "aliases": ["jobs.scriptRunners + job supervision"], "tracking": {"state": "measured", "plan": "The must-fail canaries write to logs/job-anomaly.jsonl (at least 42 a week means all six variants daily, and the spec needs all passing), while the rest of its bar stays in the job-cost report because .instar/ledger/job-runs.jsonl is outside the readable paths."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "canary-runs", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/job-anomaly.jsonl", "where": {"kind": "script-canary"}, "value": "count"}, "direction": "at-least", "threshold": 42, "minSamples": 42, "windowDays": 7}, {"id": "canary-failure-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/job-anomaly.jsonl", "where": {"kind": "script-canary", "passed": false}, "of": {"kind": "script-canary"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 42, "windowDays": 7}]}}},
+    {"id": "jobs.scriptTriage.jev", "title": "Job result triage", "flag": {"path": "jobs.scriptTriage.jev"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "logs/job-triage.jsonl does not exist on this machine and job-result-triage has no metric rows yet, so add featureEvidence.record at each Jev verdict and failure in src/scheduler/JobResultTriage.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "jobs.scriptTriage.jev", "kind": "fired"}, "of": {"featureId": "jobs.scriptTriage.jev"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "jobs.scriptTriage.jev", "kind": "error"}, "of": {"featureId": "jobs.scriptTriage.jev"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "jobs.scriptTriage.jev", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "jobs.scriptTriage.jev", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 30}]}}, "aliases": []},
+    {"id": "machineMaintenance", "title": "Machine self maintenance", "flag": {"path": "machineMaintenance"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "measured", "plan": "logs/machine-drain.jsonl writes one closed row per paper drain (two so far, since 11-02), and the spec bar of 14 nights is the threshold; its other checks and the fleet phase stay with GET /machine-maintenance and the review."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "rehearsal-nights", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/machine-drain.jsonl", "where": {"type": "closed"}, "of": {"type": "closed"}, "value": "count"}, "direction": "at-least", "threshold": 14, "minSamples": 14, "windowDays": 30}, {"id": "opened-late-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/machine-drain.jsonl", "where": {"type": "closed", "openedLate": true}, "of": {"type": "closed"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 14, "windowDays": 30}]}}, "aliases": []},
+    {"id": "maturation.ladder", "title": "Measured path to default-on", "aliases": ["feature-maturation-ladder"], "flag": {"path": "maturation.ladder"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "measured", "plan": "Its audit log records each raise, rung change and move; the review grades moves through the evidence route."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "raises-and-moves", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/maturation-advances.jsonl", "where": {"action": "raise"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "failed-moves", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/maturation-advances.jsonl", "where": {"action": "move-failed"}, "value": "count"}, "direction": "at-most", "threshold": 0, "minSamples": 3, "windowDays": 14}, {"id": "wrong-graded-moves", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "maturation.ladder", "outcome": "wrong"}, "of": {"featureId": "maturation.ladder"}, "value": "count"}, "direction": "at-most", "threshold": 0, "minSamples": 1, "windowDays": 14}]}}},
+    {"id": "maturationBoard", "title": "Maturation board", "flag": {"path": "maturationBoard"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "The board stores nothing, so the weekly review records one fired row per run with the parity result through POST /maturation/evidence, and an error row when parity fails (the spec needs two clean reviews)."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "maturationBoard", "kind": "fired"}, "of": {"featureId": "maturationBoard"}, "value": "count"}, "direction": "at-least", "threshold": 2, "minSamples": 2, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "maturationBoard", "kind": "error"}, "of": {"featureId": "maturationBoard"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 2, "windowDays": 14}]}}, "aliases": []},
+    {"id": "mentee", "title": "Mentee receiver", "flag": {"path": "mentee"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Preference candidate: it needs a per-deployment mentor allowlist and stays inert without one; add featureEvidence.record in installMentorMessageHook in src/server/AgentServer.ts at each handled mentor message and failure."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentee", "kind": "fired"}, "of": {"featureId": "mentee"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentee", "kind": "error"}, "of": {"featureId": "mentee"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentee", "kind": "fired"}, "of": {"featureId": "mentee"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentee", "kind": "error"}, "of": {"featureId": "mentee"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}, "aliases": []},
+    {"id": "mentor", "title": "Agent mentor", "flag": {"path": "mentor"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Preference candidate: it spends on each round and needs per-deployment bot and mentee setup; add featureEvidence.record at each round end and failure in src/scheduler/MentorOnboardingRunner.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentor", "kind": "fired"}, "of": {"featureId": "mentor"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentor", "kind": "error"}, "of": {"featureId": "mentor"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentor", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "mentor", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 5, "windowDays": 30}]}}, "aliases": []},
+    {"id": "mentor.autonomousFix", "title": "Mentor autonomous fix", "flag": {"path": "mentor.autonomousFix"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Preference candidate: it starts full-tool Opus sessions with ongoing spend; add featureEvidence.record at each fix cycle end and failure in src/scheduler/MentorAutonomousGuardian.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentor.autonomousFix", "kind": "fired"}, "of": {"featureId": "mentor.autonomousFix"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentor.autonomousFix", "kind": "error"}, "of": {"featureId": "mentor.autonomousFix"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentor.autonomousFix", "kind": "fired"}, "of": {"featureId": "mentor.autonomousFix"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentor.autonomousFix", "kind": "error"}, "of": {"featureId": "mentor.autonomousFix"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}, "aliases": []},
+    {"id": "messaging.actionClaim.slack", "title": "Slack action claims", "flag": {"path": "messaging.actionClaim.slack"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "The route in src/server/routes.ts writes logs/action-claim-observe.jsonl but that file does not exist yet, and the route defaults slack.dryRun to true even when config omits it, so add featureEvidence.record beside that write."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"messaging.actionClaim.slack.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "messaging.actionClaim.slack", "kind": "fired"}, "of": {"featureId": "messaging.actionClaim.slack"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "messaging.actionClaim.slack", "kind": "error"}, "of": {"featureId": "messaging.actionClaim.slack"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "messaging.actionClaim.slack", "kind": "fired"}, "of": {"featureId": "messaging.actionClaim.slack"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "messaging.actionClaim.slack", "kind": "error"}, "of": {"featureId": "messaging.actionClaim.slack"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}]}}, "aliases": []},
+    {"id": "messaging.outboundAdvisory.timeClaim", "title": "Time claim advisory", "flag": {"path": "messaging.outboundAdvisory.timeClaim"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "logs/outbound-advisory.jsonl keeps the TIME_CLAIM code inside a nested advisories list that a flat match cannot read, so add featureEvidence.record in src/server/routes.ts where it advises, and the review grades false positives, which nothing records today."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "messaging.outboundAdvisory.timeClaim", "kind": "fired"}, "of": {"featureId": "messaging.outboundAdvisory.timeClaim"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "messaging.outboundAdvisory.timeClaim", "kind": "error"}, "of": {"featureId": "messaging.outboundAdvisory.timeClaim"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "messaging.outboundAdvisory.timeClaim", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "messaging.outboundAdvisory.timeClaim", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 5, "windowDays": 30}]}}, "aliases": []},
+    {"id": "mobilePairing", "title": "Mobile pairing", "flag": {"path": "mobilePairing"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "The device-key ledger sits outside the readable paths, so add featureEvidence.record in src/server/mobilePairingRoutes.ts at each pairing redeem, confirm, revoke and refusal, with no key material in the row."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mobilePairing", "kind": "fired"}, "of": {"featureId": "mobilePairing"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mobilePairing", "kind": "error"}, "of": {"featureId": "mobilePairing"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}]}}, "aliases": []},
+    {"id": "mobilePairing.multiRoute", "title": "Mobile multiple routes", "flag": {"path": "mobilePairing.multiRoute"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Spec bar is a week with no device-auth refusal on an own name, so add featureEvidence.record in src/server/mobilePairingRoutes.ts with fired per accepted signature by route and error per refusal; its Remote Desktop timing goes in that row context."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mobilePairing.multiRoute", "kind": "fired"}, "of": {"featureId": "mobilePairing.multiRoute"}, "value": "count"}, "direction": "at-least", "threshold": 7, "minSamples": 7, "windowDays": 7}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mobilePairing.multiRoute", "kind": "error"}, "of": {"featureId": "mobilePairing.multiRoute"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 7, "windowDays": 7}]}}, "aliases": []},
+    {"id": "mobilePairing.native", "title": "Native app conversations", "flag": {"path": "mobilePairing.native"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Spec bar is a week of daily use with no lost or duplicated message and no failed verdict on a genuine one, so add featureEvidence.record in src/server/mobileConversationRoutes.ts with fired per message and error per loss, duplicate or failed verdict."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mobilePairing.native", "kind": "fired"}, "of": {"featureId": "mobilePairing.native"}, "value": "count"}, "direction": "at-least", "threshold": 7, "minSamples": 7, "windowDays": 7}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mobilePairing.native", "kind": "error"}, "of": {"featureId": "mobilePairing.native"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 7, "windowDays": 7}]}}, "aliases": []},
+    {"id": "mobilePairing.native.media", "title": "Native app media", "flag": {"path": "mobilePairing.native.media"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Spec bar is a week of daily media use with no lost or corrupt file and no quarantined blob, so add featureEvidence.record in src/server/mobileMediaRoutes.ts with fired per file sent and error per failure of those."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mobilePairing.native.media", "kind": "fired"}, "of": {"featureId": "mobilePairing.native.media"}, "value": "count"}, "direction": "at-least", "threshold": 7, "minSamples": 7, "windowDays": 7}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mobilePairing.native.media", "kind": "error"}, "of": {"featureId": "mobilePairing.native.media"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 7, "windowDays": 7}]}}, "aliases": []},
+    {"id": "models.tierEscalation", "title": "Model tier escalation", "flag": {"path": "models.tierEscalation"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "aliases": ["models.tierEscalation (+ .dryRun)", "models.tierEscalation.ridesTopic", "models.tierEscalation.dryRun"], "tracking": {"state": "measured", "plan": "Preference candidate: turning it on raises cost; its audit log has a row per injected swap and whether it was confirmed, with no rows since 10-28, and 179 of 243 swaps went unconfirmed before that."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "swaps-confirmed", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/state/model-tier-escalation/audit.jsonl", "where": {"type": "swap-confirmed"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "swap-unconfirmed-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/state/model-tier-escalation/audit.jsonl", "where": {"type": "swap-unconfirmed"}, "of": {"type": "injected"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "swaps-confirmed", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/state/model-tier-escalation/audit.jsonl", "where": {"type": "swap-confirmed"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "swap-unconfirmed-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/state/model-tier-escalation/audit.jsonl", "where": {"type": "swap-unconfirmed"}, "of": {"type": "injected"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "monitoring.agentSleep", "title": "Agent sleep", "flag": {"path": "monitoring.agentSleep"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": ".instar/logs/agent-sleep-events.jsonl gets a row on each decision change when it runs (one so far, from 10-22), the sleep and respawn mechanism is still a later slice, and the review grades whether each would-sleep was safe."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "sleep-decision-changes", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/agent-sleep-events.jsonl", "where": {"dryRun": true}, "of": {"dryRun": true}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.agentSleep", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.agentSleep", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 5, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "live-sleep-decision-changes", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/agent-sleep-events.jsonl", "where": {"dryRun": false}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.agentSleep", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.agentSleep", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 5, "windowDays": 30}]}}, "aliases": []},
+    {"id": "monitoring.agentWorktreeReaper", "title": "Agent worktree reaper", "flag": {"path": "monitoring.agentWorktreeReaper"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "It only emits events and keeps a counter, and .instar/state/reclaimed-worktrees.jsonl belongs to another writer, so add featureEvidence.record per pass in src/monitoring/AgentWorktreeReaper.ts, and the review checks that no reaped worktree held wanted work."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.agentWorktreeReaper", "kind": "fired"}, "of": {"featureId": "monitoring.agentWorktreeReaper"}, "value": "count"}, "direction": "at-least", "threshold": 7, "minSamples": 7, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.agentWorktreeReaper", "kind": "error"}, "of": {"featureId": "monitoring.agentWorktreeReaper"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 7, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.agentWorktreeReaper", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.agentWorktreeReaper", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 5, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.agentWorktreeReaper", "kind": "fired"}, "of": {"featureId": "monitoring.agentWorktreeReaper"}, "value": "count"}, "direction": "at-least", "threshold": 7, "minSamples": 7, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.agentWorktreeReaper", "kind": "error"}, "of": {"featureId": "monitoring.agentWorktreeReaper"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 7, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.agentWorktreeReaper", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.agentWorktreeReaper", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 5, "windowDays": 30}]}}, "aliases": []},
+    {"id": "monitoring.apprenticeshipCycleSla", "title": "Apprenticeship cycle watch", "flag": {"path": "monitoring.apprenticeshipCycleSla"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "No cycle has ever been recorded and the monitor writes no log, so add featureEvidence.record in src/monitoring/ApprenticeshipCycleSlaMonitor.ts at each overdue raise and failure."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.apprenticeshipCycleSla", "kind": "fired"}, "of": {"featureId": "monitoring.apprenticeshipCycleSla"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.apprenticeshipCycleSla", "kind": "error"}, "of": {"featureId": "monitoring.apprenticeshipCycleSla"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.apprenticeshipCycleSla", "kind": "fired"}, "of": {"featureId": "monitoring.apprenticeshipCycleSla"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.apprenticeshipCycleSla", "kind": "error"}, "of": {"featureId": "monitoring.apprenticeshipCycleSla"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}, "aliases": []},
+    {"id": "monitoring.authorizationRequests", "title": "Authorization requests", "flag": {"path": "monitoring.authorizationRequests"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "It has never been used on this agent and writes no log, so add featureEvidence.record in the /authorization-requests routes in src/server/routes.ts at each create, approve and refusal, with no PIN or grant secret in the row."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.authorizationRequests", "kind": "fired"}, "of": {"featureId": "monitoring.authorizationRequests"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.authorizationRequests", "kind": "error"}, "of": {"featureId": "monitoring.authorizationRequests"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}, "aliases": []},
+    {"id": "monitoring.autonomousHeartbeat", "title": "Autonomous heartbeat", "flag": {"path": "monitoring.autonomousHeartbeat"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "start": {"set": {"monitoring.autonomousHeartbeat.enabled": true, "monitoring.autonomousHeartbeat.dryRun": true}}, "restartNeeded": true, "tracking": {"state": "needed", "plan": "It only emits would-emit, emitted and send-error events with no log, so add a featureEvidence.record listener where it is built in src/commands/server.ts, and the review grades each emit because its spec bar is 3 dry-run days with no false or wedge-class emit."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"monitoring.autonomousHeartbeat.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.autonomousHeartbeat", "kind": "fired"}, "of": {"featureId": "monitoring.autonomousHeartbeat"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.autonomousHeartbeat", "kind": "error"}, "of": {"featureId": "monitoring.autonomousHeartbeat"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}, {"id": "wrong-graded-count", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.autonomousHeartbeat", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.autonomousHeartbeat"}, "value": "count"}, "direction": "at-most", "threshold": 0, "minSamples": 1, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.autonomousHeartbeat", "kind": "fired"}, "of": {"featureId": "monitoring.autonomousHeartbeat"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.autonomousHeartbeat", "kind": "error"}, "of": {"featureId": "monitoring.autonomousHeartbeat"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}, {"id": "wrong-graded-count", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.autonomousHeartbeat", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.autonomousHeartbeat"}, "value": "count"}, "direction": "at-most", "threshold": 0, "minSamples": 1, "windowDays": 14}]}}, "aliases": []},
+    {"id": "monitoring.autonomousLivenessReconciler", "title": "Autonomous liveness reconciler", "aliases": [], "flag": {"path": "monitoring.autonomousLivenessReconciler"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads logs/autonomous-liveness.jsonl, counting only real respawned and respawn-failed rows; the 244 recent rows are debouncing and would-respawn-paused, and no real respawn has been logged yet."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "real-respawns", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/autonomous-liveness.jsonl", "where": {"event": "respawned"}, "of": {"event": "respawned"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "respawn-failure-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/autonomous-liveness.jsonl", "where": {"event": "respawn-failed"}, "of": {"event": "respawned"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
+    {"id": "monitoring.biasToAction", "title": "Bias to action signal", "aliases": [], "flag": {"path": "monitoring.biasToAction"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "measured", "plan": "Reads would-fire rows in logs/bias-to-action.jsonl (18 in 14 days); no false-positive labels exist, so the review must grade would-fires through POST /maturation/evidence before the quality bar can pass."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "would-fires", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/bias-to-action.jsonl", "where": {"kind": "bias-to-action-would-fire"}, "of": {"kind": "bias-to-action-would-fire"}, "value": "count", "timeField": "t"}, "direction": "at-least", "threshold": 10, "minSamples": 1, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.biasToAction", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.biasToAction", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 30}]}}},
+    {"id": "monitoring.blockerLedger", "title": "Blocker ledger", "aliases": ["monitoring.blockerLedger (+ .durableVaultSession, .selfUnblockChecklist)"], "flag": {"path": "monitoring.blockerLedger"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads open rows in logs/blocker-decisions.jsonl (273 in 14 days, all deferral-detector candidates); the log records nothing about resolution, so the review must grade opened blockers through POST /maturation/evidence."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "blockers-opened", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/blocker-decisions.jsonl", "where": {"event": "open"}, "of": {"event": "open"}, "value": "count"}, "direction": "at-least", "threshold": 100, "minSamples": 1, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.blockerLedger", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.blockerLedger", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 30}]}}},
+    {"id": "monitoring.blockerLedger.durableVaultSession", "title": "Durable vault session", "aliases": [], "flag": {"path": "monitoring.blockerLedger.durableVaultSession"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/monitoring/DurableVaultSession.ts: fired when the org-vault probe uses a warm session, error on a failed unlock or a session outliving its TTL; never log the session value."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.blockerLedger.durableVaultSession", "kind": "fired"}, "of": {"featureId": "monitoring.blockerLedger.durableVaultSession"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.blockerLedger.durableVaultSession", "kind": "error"}, "of": {"featureId": "monitoring.blockerLedger.durableVaultSession"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
+    {"id": "monitoring.blockerLedger.selfUnblockChecklist", "title": "Self-unblock checklist", "aliases": [], "flag": {"path": "monitoring.blockerLedger.selfUnblockChecklist"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads .instar/state/self-unblock-runs/runs.jsonl by completedAt (one run ever, none in 14 days); the review must grade whether an exhausted checklist really had no way forward."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "checklist-runs", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/state/self-unblock-runs/runs.jsonl", "value": "count", "timeField": "completedAt"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.blockerLedger.selfUnblockChecklist", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.blockerLedger.selfUnblockChecklist", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
+    {"id": "monitoring.blockerLifecycleLedger", "title": "Blocker lifecycle ledger", "aliases": [], "subject": "throughput-metrics", "flag": {"path": "monitoring.blockerLifecycleLedger"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Uses the throughput-metrics spec projection for completed transitions; add featureEvidence.record error rows at the ledger write in src/monitoring/BlockerLifecycleService.ts. Nothing reads its shipped dryRun, so that key should go in the fleet code change."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"monitoring.blockerLifecycleLedger.dryRun": false}}, "metrics": [{"id": "completed-lifecycle-transitions", "role": "ran", "source": "feature-summary", "ref": {"ref": "blocker-lifecycle.completed-transitions"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.blockerLifecycleLedger", "kind": "error"}, "of": {"featureId": "monitoring.blockerLifecycleLedger"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "completed-lifecycle-transitions", "role": "ran", "source": "feature-summary", "ref": {"ref": "blocker-lifecycle.completed-transitions"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.blockerLifecycleLedger", "kind": "error"}, "of": {"featureId": "monitoring.blockerLifecycleLedger"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 14}]}}},
+    {"id": "monitoring.bootHealthBeacon", "title": "Boot health beacon", "aliases": [], "flag": {"path": "monitoring.bootHealthBeacon"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/server/BootHealthBeacon.ts: fired once per boot phase when the responder starts, error if it cannot bind or fails to hand over; today it only answers HTTP and logs nothing."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.bootHealthBeacon", "kind": "fired"}, "of": {"featureId": "monitoring.bootHealthBeacon"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.bootHealthBeacon", "kind": "error"}, "of": {"featureId": "monitoring.bootHealthBeacon"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "monitoring.codexArmSessionSweeper", "title": "Codex arm session sweeper", "aliases": [], "flag": {"path": "monitoring.codexArmSessionSweeper", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record per sweep in src/monitoring/CodexArmSessionSweeper.ts: fired on a pass that kills, error on a failed kill. Its logs/codex-arm-sweeper.jsonl does not exist on this machine (0 kills in 8 passes), so no metric can cite it yet."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.codexArmSessionSweeper", "kind": "fired"}, "of": {"featureId": "monitoring.codexArmSessionSweeper"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.codexArmSessionSweeper", "kind": "error"}, "of": {"featureId": "monitoring.codexArmSessionSweeper"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
+    {"id": "monitoring.completionClaimVerification", "title": "Completion claim verification", "aliases": [], "subject": "claim-verification-sentinel", "flag": {"path": "monitoring.completionClaimVerification"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads the claim observation audit and failure ledger; the failure cap of 210 in 7 days is the 5% goal at about 600 calls a day, and false positives need review grades through POST /maturation/evidence."}, "rungs": {"dev-agent-live": {"soakDays": 7, "advance": {"kind": "config", "set": {"monitoring.completionClaimVerification.dryRun": false}}, "metrics": [{"id": "claims-evaluated", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/state/claim-verification/claim-observation-audit-v2.jsonl", "where": {"evaluated": true}, "of": {"evaluated": true}, "value": "count"}, "direction": "at-least", "threshold": 100, "minSamples": 1, "windowDays": 14}, {"id": "classified-completion-claims", "role": "ran", "source": "feature-summary", "ref": {"ref": "claim-verification.classified-claims"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 14}, {"id": "verifier-error-rate", "role": "harm", "source": "feature-metrics", "ref": {"feature": "completion-claim-verify", "field": "errorRate"}, "direction": "at-most", "threshold": 0.05, "minSamples": 100, "windowDays": 7}, {"id": "false-positive-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.completionClaimVerification", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.completionClaimVerification", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 30}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "claims-evaluated", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/state/claim-verification/claim-observation-audit-v2.jsonl", "where": {"evaluated": true}, "of": {"evaluated": true}, "value": "count"}, "direction": "at-least", "threshold": 100, "minSamples": 1, "windowDays": 14}, {"id": "classified-completion-claims", "role": "ran", "source": "feature-summary", "ref": {"ref": "claim-verification.classified-claims"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 14}, {"id": "verifier-error-rate", "role": "harm", "source": "feature-metrics", "ref": {"feature": "completion-claim-verify", "field": "errorRate"}, "direction": "at-most", "threshold": 0.05, "minSamples": 100, "windowDays": 7}, {"id": "false-positive-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.completionClaimVerification", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.completionClaimVerification", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 30}]}}},
+    {"id": "monitoring.contextWedgeSentinel.autoRecovery", "title": "Context wedge auto-recovery", "aliases": [], "subject": "context-wedge-sentinel", "flag": {"path": "monitoring.contextWedgeSentinel.autoRecovery", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads context-wedge rows in logs/sentinel-events.jsonl, written by the sentinel notifier; none exist yet, and the bar is the spec rule of 3 distinct recovered sessions with recovery errors under 5% of detections."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "distinct-sessions-recovered", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/sentinel-events.jsonl", "where": {"sentinel": "context-wedge", "kind": "recovered"}, "of": {"sentinel": "context-wedge", "kind": "recovered"}, "value": "count", "dedupe": "sessionName"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "recovery-error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/sentinel-events.jsonl", "where": {"sentinel": "context-wedge", "kind": "recovery-error"}, "of": {"sentinel": "context-wedge", "kind": "detected"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
+    {"id": "monitoring.correctionClassReview", "title": "Correction class review", "aliases": [], "flag": {"path": "monitoring.correctionClassReview"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads filled and shell-created rows in .instar/logs/correction-class-review.jsonl (79% filled today) and the correction-class-review LLM error rate."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "reviews-filled", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/correction-class-review.jsonl", "where": {"event": "filled"}, "of": {"event": "filled"}, "value": "count"}, "direction": "at-least", "threshold": 100, "minSamples": 1, "windowDays": 14}, {"id": "filled-share", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/correction-class-review.jsonl", "where": {"event": "filled"}, "of": {"event": "shell-created"}, "value": "ratio"}, "direction": "at-least", "threshold": 0.7, "minSamples": 50, "windowDays": 14}, {"id": "review-error-rate", "role": "harm", "source": "feature-metrics", "ref": {"feature": "correction-class-review", "field": "errorRate"}, "direction": "at-most", "threshold": 0.05, "minSamples": 50, "windowDays": 14}, {"id": "graded-wrong", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.correctionClassReview", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.correctionClassReview", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.1, "minSamples": 5, "windowDays": 30}]}}},
+    {"id": "monitoring.correctionLearning", "title": "Correction learning", "aliases": ["monitoring.correctionLearning (+ .selfViolationSignal)"], "subject": "correction-preference-learning-sentinel-spec", "flag": {"path": "monitoring.correctionLearning"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads recorded and dropped rows in .instar/logs/correction-learning-audit.jsonl; the spec rule of 3 correctly routed learnings in 4 weeks needs outcome rows graded right through POST /maturation/evidence, which nothing writes yet."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "corrections-recorded", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/correction-learning-audit.jsonl", "where": {"decision": "recorded"}, "of": {"decision": "recorded"}, "value": "count"}, "direction": "at-least", "threshold": 100, "minSamples": 1, "windowDays": 14}, {"id": "dropped-share", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/logs/correction-learning-audit.jsonl", "where": {"decision": "drain-failed-dropped"}, "of": {"decision": "recorded"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 50, "windowDays": 14}, {"id": "learning-error-rate", "role": "harm", "source": "feature-metrics", "ref": {"feature": "server:correction-learning", "field": "errorRate"}, "direction": "at-most", "threshold": 0.05, "minSamples": 50, "windowDays": 14}, {"id": "graded-wrong", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.correctionLearning", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.correctionLearning", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.1, "minSamples": 5, "windowDays": 30}]}}},
+    {"id": "monitoring.correctionLearning.meaningGrouping", "title": "Correction meaning grouping", "aliases": [], "flag": {"path": "monitoring.correctionLearning.meaningGrouping"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads logs/correction-meaning-grouping.jsonl, which holds one run (10-30, 604 pair checks); it needs repeat runs, so the bar counts run rows, with unsure answers and LLM errors as the quality checks."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "grouping-runs", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/correction-meaning-grouping.jsonl", "where": {"kind": "run"}, "of": {"kind": "run"}, "value": "count"}, "direction": "at-least", "threshold": 2, "minSamples": 1, "windowDays": 30}, {"id": "unsure-share", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/correction-meaning-grouping.jsonl", "where": {"kind": "jev", "v": "unsure"}, "of": {"kind": "jev"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.1, "minSamples": 100, "windowDays": 30}, {"id": "grouping-error-rate", "role": "harm", "source": "feature-metrics", "ref": {"feature": "correction-meaning-grouping", "field": "errorRate"}, "direction": "at-most", "threshold": 0.05, "minSamples": 100, "windowDays": 30}, {"id": "graded-wrong", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.correctionLearning.meaningGrouping", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.correctionLearning.meaningGrouping", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.1, "minSamples": 5, "windowDays": 30}]}}},
+    {"id": "monitoring.correctionLearning.selfViolationSignal", "title": "Self-violation signal", "aliases": [], "flag": {"path": "monitoring.correctionLearning.selfViolationSignal", "on": true}, "disposition": "composed", "composedInto": "monitoring.correctionLearning", "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "Observe-only signal inside correction learning; it moves with its parent and has no bar of its own."}, "rungs": {}},
+    {"id": "monitoring.crashLoopPauser", "title": "Crash loop pauser", "aliases": [], "flag": {"path": "monitoring.crashLoopPauser", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/monitoring/CrashLoopPauser.ts at the pause decision: fired per candidate, error on a failed pause. Would-pause lines reach only server.log, and crash-loop-pauses.jsonl is written only on a real pause. It has no shipped dryRun key, so the rung cannot see its code default."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.crashLoopPauser", "kind": "fired"}, "of": {"featureId": "monitoring.crashLoopPauser"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.crashLoopPauser", "kind": "error"}, "of": {"featureId": "monitoring.crashLoopPauser"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"monitoring.crashLoopPauser.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.crashLoopPauser", "kind": "fired"}, "of": {"featureId": "monitoring.crashLoopPauser"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.crashLoopPauser", "kind": "error"}, "of": {"featureId": "monitoring.crashLoopPauser"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "monitoring.degradedTmuxGuard", "title": "Degraded tmux guard", "aliases": [], "flag": {"path": "monitoring.degradedTmuxGuard"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/monitoring/DegradedTmuxGuard.ts where an episode is raised: fired per raised episode, error on a failed raise, and a graded outcome once the tmux server recovers. Today only attention items exist, with no durable ledger."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.degradedTmuxGuard", "kind": "fired"}, "of": {"featureId": "monitoring.degradedTmuxGuard"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.degradedTmuxGuard", "kind": "error"}, "of": {"featureId": "monitoring.degradedTmuxGuard"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
+    {"id": "monitoring.durableOutputScrub", "title": "Durable output scrub", "aliases": [], "flag": {"path": "monitoring.durableOutputScrub"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/monitoring/DurableOutputScrubber.ts: fired when a span is scrubbed, error on a scrub failure, with counts only. Its durable-output-scrub metric has 0 LLM calls, and that source reads samples from LLM calls, so it can never register."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.durableOutputScrub", "kind": "fired"}, "of": {"featureId": "monitoring.durableOutputScrub"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.durableOutputScrub", "kind": "error"}, "of": {"featureId": "monitoring.durableOutputScrub"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
+    {"id": "monitoring.enforcedTermination", "title": "Enforced termination", "aliases": [], "flag": {"path": "monitoring.enforcedTermination", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads logs/enforced-termination.jsonl by distinct topic, because one stuck run wrote most of the 6,026 recent rows; the review grades whether each would-stop was right. It has no shipped dryRun key, so the rung cannot see its code default."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "distinct-runs-would-stop", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/enforced-termination.jsonl", "where": {"event": "would-terminate"}, "of": {"event": "would-terminate"}, "value": "count", "dedupe": "topicId"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "wrong-stop-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.enforcedTermination", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.enforcedTermination", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 5, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "real-terminations", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/enforced-termination.jsonl", "where": {"event": "terminated"}, "of": {"event": "terminated"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "terminate-failure-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/enforced-termination.jsonl", "where": {"event": "terminate-failed"}, "of": {"event": "terminated"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}, {"id": "wrong-stop-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.enforcedTermination", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.enforcedTermination", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 5, "windowDays": 30}]}}},
+    {"id": "monitoring.externalHogSentinel", "title": "External hog sentinel", "aliases": [], "flag": {"path": "monitoring.externalHogSentinel"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/monitoring/ExternalHogSentinel.ts at the kill decision: fired per would-kill or kill, error on a failed kill or a kill-breaker trip. It has never seen a sustained hog, and its decisions file does not exist."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.externalHogSentinel", "kind": "fired"}, "of": {"featureId": "monitoring.externalHogSentinel"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.externalHogSentinel", "kind": "error"}, "of": {"featureId": "monitoring.externalHogSentinel"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.externalHogSentinel", "kind": "fired"}, "of": {"featureId": "monitoring.externalHogSentinel"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.externalHogSentinel", "kind": "error"}, "of": {"featureId": "monitoring.externalHogSentinel"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "monitoring.failureLearning", "title": "Failure learning", "aliases": [], "flag": {"path": "monitoring.failureLearning"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record where src/monitoring/FailureLedger.ts appends a failure and where a pattern surfaces: fired per attributed record, error on a failed write. Its data sits in SQLite (failure-ledger.db), and all 62 records are unattributed."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.failureLearning", "kind": "fired"}, "of": {"featureId": "monitoring.failureLearning"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.failureLearning", "kind": "error"}, "of": {"featureId": "monitoring.failureLearning"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "monitoring.geminiCapacityEscalation", "title": "Gemini capacity escalation", "aliases": [], "flag": {"path": "monitoring.geminiCapacityEscalation"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/monitoring/GeminiCapacityEscalationMonitor.ts tick: fired per escalation, error on a failed escalation. It is off and has no evidence surface; as a sensitive feature it stays dark until its operator enables it."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.geminiCapacityEscalation", "kind": "fired"}, "of": {"featureId": "monitoring.geminiCapacityEscalation"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.geminiCapacityEscalation", "kind": "error"}, "of": {"featureId": "monitoring.geminiCapacityEscalation"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.geminiCapacityEscalation", "kind": "fired"}, "of": {"featureId": "monitoring.geminiCapacityEscalation"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.geminiCapacityEscalation", "kind": "error"}, "of": {"featureId": "monitoring.geminiCapacityEscalation"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "monitoring.goalRealignment", "title": "Goal realignment", "aliases": [], "flag": {"path": "monitoring.goalRealignment"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads verdict rows in .instar/logs/goal-realignment.jsonl (84 in 14 days, 17% indeterminate) and the AlignmentReviewer error rate; the review grades drift verdicts through POST /maturation/evidence."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"monitoring.goalRealignment.dryRun": false}}, "metrics": [{"id": "reviews-run", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/goal-realignment.jsonl", "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 1, "windowDays": 14}, {"id": "indeterminate-share", "role": "quality", "source": "jsonl-log", "ref": {"file": ".instar/logs/goal-realignment.jsonl", "where": {"schemaVersion": 1, "verdict": "indeterminate"}, "of": {"schemaVersion": 1}, "value": "ratio"}, "direction": "at-most", "threshold": 0.25, "minSamples": 20, "windowDays": 14}, {"id": "reviewer-error-rate", "role": "harm", "source": "feature-metrics", "ref": {"feature": "AlignmentReviewer", "field": "errorRate"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}, {"id": "wrong-drift-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.goalRealignment", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.goalRealignment", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 30}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "reviews-run", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/goal-realignment.jsonl", "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 1, "windowDays": 14}, {"id": "indeterminate-share", "role": "quality", "source": "jsonl-log", "ref": {"file": ".instar/logs/goal-realignment.jsonl", "where": {"schemaVersion": 1, "verdict": "indeterminate"}, "of": {"schemaVersion": 1}, "value": "ratio"}, "direction": "at-most", "threshold": 0.25, "minSamples": 20, "windowDays": 14}, {"id": "reviewer-error-rate", "role": "harm", "source": "feature-metrics", "ref": {"feature": "AlignmentReviewer", "field": "errorRate"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}, {"id": "wrong-drift-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.goalRealignment", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.goalRealignment", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 30}]}}},
+    {"id": "monitoring.greenPrAutoMerge", "title": "Green PR auto-merge", "aliases": [], "flag": {"path": "monitoring.greenPrAutoMerge"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "tracking": {"state": "measured", "plan": "Reads logs/green-pr-automerge.jsonl: merged rows (195 in 14 days), merged out of attempted (70% today), and any merge at an unexpected head, which must stay at zero."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "prs-merged", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/green-pr-automerge.jsonl", "where": {"event": "merged"}, "of": {"event": "merged"}, "value": "count"}, "direction": "at-least", "threshold": 50, "minSamples": 1, "windowDays": 14}, {"id": "merge-success-share", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/green-pr-automerge.jsonl", "where": {"event": "merged"}, "of": {"event": "merge-attempted"}, "value": "ratio"}, "direction": "at-least", "threshold": 0.6, "minSamples": 50, "windowDays": 14}, {"id": "merged-at-unexpected-head", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/green-pr-automerge.jsonl", "where": {"event": "merged-at-unexpected-head"}, "value": "count"}, "direction": "at-most", "threshold": 0, "minSamples": 100, "windowDays": 14}]}}},
+    {"id": "monitoring.growthAnalyst", "title": "Growth analyst", "aliases": ["monitoring.growthAnalyst (+ .blockedDigestEscalation)"], "flag": {"path": "monitoring.growthAnalyst"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/monitoring/GrowthMilestoneAnalyst.ts when a milestone or digest is produced: fired per item, error on a failed analysis or send. Its state is JSON under growth-milestone-analyst, with no readable log."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.growthAnalyst", "kind": "fired"}, "of": {"featureId": "monitoring.growthAnalyst"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.growthAnalyst", "kind": "error"}, "of": {"featureId": "monitoring.growthAnalyst"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "monitoring.growthAnalyst.blockedDigestEscalation", "title": "Blocked digest escalation", "aliases": [], "flag": {"path": "monitoring.growthAnalyst.blockedDigestEscalation"}, "disposition": "composed", "composedInto": "monitoring.growthAnalyst", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Delivery retry for the growth digest; it makes no sense without the analyst and moves with it."}, "rungs": {}},
+    {"id": "monitoring.growthAnalyst.darkFlagInventory", "title": "Dark flag inventory", "aliases": [], "flag": {"path": "monitoring.growthAnalyst.darkFlagInventory"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/monitoring/GrowthMilestoneAnalyst.ts at each inventory pass: fired per pass, error on a failed scan. Check for overlap with the maturation ladder before moving it, since both track switched-off features."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.growthAnalyst.darkFlagInventory", "kind": "fired"}, "of": {"featureId": "monitoring.growthAnalyst.darkFlagInventory"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.growthAnalyst.darkFlagInventory", "kind": "error"}, "of": {"featureId": "monitoring.growthAnalyst.darkFlagInventory"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}, "dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"monitoring.growthAnalyst.darkFlagInventory.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.growthAnalyst.darkFlagInventory", "kind": "fired"}, "of": {"featureId": "monitoring.growthAnalyst.darkFlagInventory"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.growthAnalyst.darkFlagInventory", "kind": "error"}, "of": {"featureId": "monitoring.growthAnalyst.darkFlagInventory"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "monitoring.idleThrottleSettleGate", "title": "Idle throttle settle gate", "aliases": [], "flag": {"path": "monitoring.idleThrottleSettleGate"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/core/SessionManager.ts at the rateLimitedAtIdle hand-off: fired when the gate settles or holds it, error on a failed read. Source has no ledger and server.log has no mention."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.idleThrottleSettleGate", "kind": "fired"}, "of": {"featureId": "monitoring.idleThrottleSettleGate"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.idleThrottleSettleGate", "kind": "error"}, "of": {"featureId": "monitoring.idleThrottleSettleGate"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
+    {"id": "monitoring.liveTestGate", "title": "Live test gate", "aliases": [], "flag": {"path": "monitoring.liveTestGate"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record at the completion decision behind POST /autonomous/evaluate-completion: fired per would-veto or veto, error on an unreadable artifact. Mode stays dry-run until a separate move to veto; the rung cannot see that setting."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.liveTestGate", "kind": "fired"}, "of": {"featureId": "monitoring.liveTestGate"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.liveTestGate", "kind": "error"}, "of": {"featureId": "monitoring.liveTestGate"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
+    {"id": "monitoring.liveTestRunner", "title": "Live test runner", "aliases": [], "flag": {"path": "monitoring.liveTestRunner"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in the POST /live-test/multi-machine-capstone handler: fired per run, error on a failed run. The harness has never run and no ledger file exists on this machine."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.liveTestRunner", "kind": "fired"}, "of": {"featureId": "monitoring.liveTestRunner"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.liveTestRunner", "kind": "error"}, "of": {"featureId": "monitoring.liveTestRunner"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
+    {"id": "monitoring.machineCoherence", "title": "Machine coherence guard", "aliases": [], "flag": {"path": "monitoring.machineCoherence"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads episode rows in logs/machine-coherence.jsonl: opens, give-ups at the cap, and reopens (22% today), so flapping holds the feature until it drops below 20%."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "episodes-opened", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/machine-coherence.jsonl", "where": {"t": "open"}, "of": {"t": "open"}, "value": "count"}, "direction": "at-least", "threshold": 100, "minSamples": 1, "windowDays": 14}, {"id": "give-up-share", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/machine-coherence.jsonl", "where": {"t": "cap-giveup"}, "of": {"t": "open"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 50, "windowDays": 14}, {"id": "reopen-share", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/machine-coherence.jsonl", "where": {"t": "reopen"}, "of": {"t": "open"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.2, "minSamples": 50, "windowDays": 14}]}}},
+    {"id": "monitoring.mcpProcessReaper", "title": "MCP process reaper", "aliases": [], "flag": {"path": "monitoring.mcpProcessReaper"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/monitoring/McpProcessReaper.ts per reap pass: fired per would-reap or reap, error on a failed kill. Its logs/mcp-reaper-audit.jsonl has never been written, so no metric can cite it yet."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.mcpProcessReaper", "kind": "fired"}, "of": {"featureId": "monitoring.mcpProcessReaper"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.mcpProcessReaper", "kind": "error"}, "of": {"featureId": "monitoring.mcpProcessReaper"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}, "dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.mcpProcessReaper", "kind": "fired"}, "of": {"featureId": "monitoring.mcpProcessReaper"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.mcpProcessReaper", "kind": "error"}, "of": {"featureId": "monitoring.mcpProcessReaper"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "monitoring.meshCoherenceLiveCheck", "title": "Mesh coherence live check", "aliases": [], "flag": {"path": "monitoring.meshCoherenceLiveCheck"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record at the check in src/commands/server.ts: fired when a divergence is logged, error on a failed read. Its mesh-coherence-live metric has 0 LLM calls, and that source reads samples from LLM calls, so it can never register."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.meshCoherenceLiveCheck", "kind": "fired"}, "of": {"featureId": "monitoring.meshCoherenceLiveCheck"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.meshCoherenceLiveCheck", "kind": "error"}, "of": {"featureId": "monitoring.meshCoherenceLiveCheck"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
+    {"id": "monitoring.missingLoginSession", "title": "Missing login session", "aliases": [], "flag": {"path": "monitoring.missingLoginSession"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/monitoring/MissingLoginSessionDetector.ts at the raise: fired per raise, error on a failed check, with a graded outcome (a false-missing alert was seen once under CMT-170)."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.missingLoginSession", "kind": "fired"}, "of": {"featureId": "monitoring.missingLoginSession"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.missingLoginSession", "kind": "error"}, "of": {"featureId": "monitoring.missingLoginSession"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
+    {"id": "monitoring.orphanedWorkSentinel", "title": "Orphaned work sentinel", "aliases": [], "flag": {"path": "monitoring.orphanedWorkSentinel"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Switched off on Echo since 10-19 after 3,045 flag rows for 102 paths; .instar/state/orphaned-work.jsonl has no recent rows, so the bar counts distinct paths once it runs again, and the review grades flags. It needs per-path dedupe before re-enabling."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "code"}, "metrics": [{"id": "distinct-paths-flagged", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/state/orphaned-work.jsonl", "where": {"preserved": false}, "of": {"preserved": false}, "value": "count", "dedupe": "path"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.orphanedWorkSentinel", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.orphanedWorkSentinel", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "distinct-paths-flagged", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/state/orphaned-work.jsonl", "where": {"preserved": false}, "of": {"preserved": false}, "value": "count", "dedupe": "path"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.orphanedWorkSentinel", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.orphanedWorkSentinel", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 30}]}}},
+    {"id": "monitoring.overloadShed", "title": "Overload shed", "aliases": [], "flag": {"path": "monitoring.overloadShed", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/core/OverloadShedPlanner.ts at each evaluation: fired per would-move or proposal, error on an abort. logs/overload-shed.jsonl does not exist on this machine (0 would-move in 281 ticks). It has no shipped dryRun key, so the rung cannot see its code default."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.overloadShed", "kind": "fired"}, "of": {"featureId": "monitoring.overloadShed"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.overloadShed", "kind": "error"}, "of": {"featureId": "monitoring.overloadShed"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"monitoring.overloadShed.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.overloadShed", "kind": "fired"}, "of": {"featureId": "monitoring.overloadShed"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.overloadShed", "kind": "error"}, "of": {"featureId": "monitoring.overloadShed"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "monitoring.parallelWorkSentinel", "title": "Parallel work sentinel", "aliases": [], "flag": {"path": "monitoring.parallelWorkSentinel"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads nudged rows in .instar/logs/sentinel-events.jsonl (2,654 in 14 days); there are no false-positive labels, so the review must grade nudges through POST /maturation/evidence before it can pass."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "nudges-sent", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/sentinel-events.jsonl", "where": {"kind": "parallel-work:nudged"}, "of": {"kind": "parallel-work:nudged"}, "value": "count"}, "direction": "at-least", "threshold": 100, "minSamples": 1, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.parallelWorkSentinel", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.parallelWorkSentinel", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 30}]}}},
+    {"id": "monitoring.prHandLease", "title": "PR hand lease", "aliases": [], "flag": {"path": "monitoring.prHandLease", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record at the POST /pr-leases/evaluate decision: fired per evaluation, error on evaluate-error or fail-open. .instar/logs/pr-lease-decisions.jsonl has never been created despite the hook being installed, so check the wiring. It has no shipped dryRun key, so the rung cannot see its code default."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.prHandLease", "kind": "fired"}, "of": {"featureId": "monitoring.prHandLease"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.prHandLease", "kind": "error"}, "of": {"featureId": "monitoring.prHandLease"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}, "dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"monitoring.prHandLease.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.prHandLease", "kind": "fired"}, "of": {"featureId": "monitoring.prHandLease"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.prHandLease", "kind": "error"}, "of": {"featureId": "monitoring.prHandLease"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "monitoring.processFootprintMonitor", "title": "Process footprint monitor", "aliases": ["monitoring.processFootprintMonitor.alertEnabled"], "flag": {"path": "monitoring.processFootprintMonitor"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/monitoring/ProcessFootprintMonitor.ts per sample (bounded by the 60-a-minute limit): fired per persisted sample, error on a failed process listing. Samples are lost at restart today."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.processFootprintMonitor", "kind": "fired"}, "of": {"featureId": "monitoring.processFootprintMonitor"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.processFootprintMonitor", "kind": "error"}, "of": {"featureId": "monitoring.processFootprintMonitor"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "monitoring.promiseBeacon.escalation", "title": "Promise beacon escalation", "aliases": [], "flag": {"path": "monitoring.promiseBeacon.escalation"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record at the escalation attempt in the promise beacon wiring: fired per attempt or would-attempt, error on a refusal or double spawn. Totals are in memory only; the written goal is a week of practice-run evidence."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.promiseBeacon.escalation", "kind": "fired"}, "of": {"featureId": "monitoring.promiseBeacon.escalation"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.promiseBeacon.escalation", "kind": "error"}, "of": {"featureId": "monitoring.promiseBeacon.escalation"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "dev-agent-live": {"soakDays": 7, "advance": {"kind": "config", "set": {"monitoring.promiseBeacon.escalation.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.promiseBeacon.escalation", "kind": "fired"}, "of": {"featureId": "monitoring.promiseBeacon.escalation"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.promiseBeacon.escalation", "kind": "error"}, "of": {"featureId": "monitoring.promiseBeacon.escalation"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "monitoring.releaseReadiness", "title": "Release readiness sentinel", "aliases": [], "flag": {"path": "monitoring.releaseReadiness"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/monitoring/ReleaseReadinessSentinel.ts per tick: fired per evaluated tick, error on a failed check or rollback. It has no durable episode log, and the 6-hour tick gives about 56 rows in 14 days."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.releaseReadiness", "kind": "fired"}, "of": {"featureId": "monitoring.releaseReadiness"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.releaseReadiness", "kind": "error"}, "of": {"featureId": "monitoring.releaseReadiness"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "monitoring.resumeQueue", "title": "Mid-work resume queue", "aliases": [], "flag": {"path": "monitoring.resumeQueue", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads logs/resume-queue.jsonl: enqueued rows (76 in 14 days), runs that hit the resurrection cap (14, or 18%), and gave-up rows."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "resumes-enqueued", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/resume-queue.jsonl", "where": {"event": "enqueued"}, "of": {"event": "enqueued"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 1, "windowDays": 14}, {"id": "resurrection-cap-share", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/resume-queue.jsonl", "where": {"event": "resurrection-cap"}, "of": {"event": "enqueued"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.25, "minSamples": 20, "windowDays": 14}, {"id": "gave-up-share", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/resume-queue.jsonl", "where": {"event": "gave-up"}, "of": {"event": "enqueued"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "monitoring.ropeHealth", "title": "Rope health alerts", "aliases": [], "flag": {"path": "monitoring.ropeHealth"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/core/ropeHealth.ts: fired per urgent or classified episode, error on a failed evaluation, with graded outcomes on sleep misclassification. Its rope-health metric has 0 LLM calls, so it can never register. Echo runs urgentEnabled false against a shipped true."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.ropeHealth", "kind": "fired"}, "of": {"featureId": "monitoring.ropeHealth"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.ropeHealth", "kind": "error"}, "of": {"featureId": "monitoring.ropeHealth"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
+    {"id": "monitoring.selfDeferralGuard", "title": "Self-deferral guard", "aliases": [], "flag": {"path": "monitoring.selfDeferralGuard"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/core/UnjustifiedStopGate.ts where U_SELF_DEFERRAL is offered: fired per label, error on a parse failure. Its rows are spread across dated judgment-provenance files no metric can name, and an enforce bar is still unwritten."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.selfDeferralGuard", "kind": "fired"}, "of": {"featureId": "monitoring.selfDeferralGuard"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.selfDeferralGuard", "kind": "error"}, "of": {"featureId": "monitoring.selfDeferralGuard"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "monitoring.sentinelTelegramEscalation", "title": "Sentinel Telegram escalation", "aliases": [], "flag": {"path": "monitoring.sentinelTelegramEscalation", "on": true}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Preference candidate: opt-in delivery that some operators may keep off. Add featureEvidence.record in src/monitoring/SentinelNotifier.ts at escalate: fired per Telegram send, error on a failed send; hub escalation rows do not show Telegram behaviour."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.sentinelTelegramEscalation", "kind": "fired"}, "of": {"featureId": "monitoring.sentinelTelegramEscalation"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.sentinelTelegramEscalation", "kind": "error"}, "of": {"featureId": "monitoring.sentinelTelegramEscalation"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "dev-agent-live": {"soakDays": 3, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.sentinelTelegramEscalation", "kind": "fired"}, "of": {"featureId": "monitoring.sentinelTelegramEscalation"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.sentinelTelegramEscalation", "kind": "error"}, "of": {"featureId": "monitoring.sentinelTelegramEscalation"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "monitoring.sessionReaper", "title": "Session reaper", "aliases": ["monitoring.sessionReaper (+ closeoutLivenessGate)"], "flag": {"path": "monitoring.sessionReaper"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads real reaped rows in logs/reaper-audit.jsonl (38 in 14 days); whether a reap was right is not logged, so the review must grade reaps through POST /maturation/evidence before it can pass."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "sessions-reaped", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/reaper-audit.jsonl", "where": {"event": "reaped"}, "of": {"event": "reaped"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 1, "windowDays": 14}, {"id": "wrong-reap-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.sessionReaper", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.sessionReaper", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 30}]}}},
+    {"id": "monitoring.sessionReaper.closeoutLivenessGate", "title": "Closeout liveness gate", "aliases": [], "flag": {"path": "monitoring.sessionReaper.closeoutLivenessGate", "on": true}, "disposition": "composed", "composedInto": "monitoring.sessionReaper", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Safety gate inside the reaper closeout; the reaper should not reach the fleet without it, so it moves with its parent."}, "rungs": {}},
+    {"id": "monitoring.singleMachineFailoverGap", "title": "Single machine failover gap", "aliases": [], "flag": {"path": "monitoring.singleMachineFailoverGap"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/monitoring/SingleMachineFailoverGapDetector.ts at the raise: fired per raise or would-raise, error on a failed check. Today it holds only in-memory tick counters, with 0 raises."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.singleMachineFailoverGap", "kind": "fired"}, "of": {"featureId": "monitoring.singleMachineFailoverGap"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.singleMachineFailoverGap", "kind": "error"}, "of": {"featureId": "monitoring.singleMachineFailoverGap"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"monitoring.singleMachineFailoverGap.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.singleMachineFailoverGap", "kind": "fired"}, "of": {"featureId": "monitoring.singleMachineFailoverGap"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.singleMachineFailoverGap", "kind": "error"}, "of": {"featureId": "monitoring.singleMachineFailoverGap"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "monitoring.standDown", "title": "Duplicate-session stand-down", "aliases": [], "flag": {"path": "monitoring.standDown"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "tracking": {"state": "measured", "plan": "Its own log .instar/logs/standdown.jsonl shows registrations, and the review grades would-block rows through POST /maturation/evidence, since the spec requires zero false positives adjudicated against ownership records."}, "rungs": {"dev-agent-live": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "registered", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/standdown.jsonl", "where": {"transition": "registered"}, "of": {"transition": "registered"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.standDown", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.standDown", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0, "minSamples": 3, "windowDays": 30}, {"id": "graded-right", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.standDown", "kind": "outcome", "outcome": "right"}, "of": {"featureId": "monitoring.standDown", "kind": "outcome"}, "value": "count", "dedupe": "gradesEventId"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "registered", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/standdown.jsonl", "where": {"transition": "registered"}, "of": {"transition": "registered"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.standDown", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.standDown", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0, "minSamples": 3, "windowDays": 30}, {"id": "expired-share", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/logs/standdown.jsonl", "where": {"transition": "expired"}, "of": {"transition": "registered"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "monitoring.standbyHonestyTiers", "title": "Honest standby messages", "aliases": [], "flag": {"path": "monitoring.standbyHonestyTiers"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/monitoring/PresenceProxy.ts where Tier 1 or 2 uses classifyStuckSignature to change the message: fired with the signature, error if the classification throws."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.standbyHonestyTiers", "kind": "fired"}, "of": {"featureId": "monitoring.standbyHonestyTiers"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.standbyHonestyTiers", "kind": "error"}, "of": {"featureId": "monitoring.standbyHonestyTiers"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "monitoring.strandedTopicSentinel", "title": "Stranded topic detector", "aliases": [], "flag": {"path": "monitoring.strandedTopicSentinel"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Its only output is an attention item, so add featureEvidence.record in src/monitoring/StrandedTopicSentinel.ts where it emits the owner item (fired) and on tick-error (error); the review grades whether each stranding was real."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.strandedTopicSentinel", "kind": "fired"}, "of": {"featureId": "monitoring.strandedTopicSentinel"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.strandedTopicSentinel", "kind": "error"}, "of": {"featureId": "monitoring.strandedTopicSentinel"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "monitoring.throughputFloor", "title": "Autonomous throughput floor", "aliases": [], "flag": {"path": "monitoring.throughputFloor"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "subject": "autonomous-throughput-floor", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Its own log .instar/logs/autonomous-throughput-floor.jsonl records every observation, plus the spec-named projection autonomous-throughput.observed-runs; failed GitHub reads (decision unknown) and an open read breaker are the harm."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "healthy-observations", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/autonomous-throughput-floor.jsonl", "where": {"decision": "healthy"}, "of": {"decision": "healthy"}, "value": "count"}, "direction": "at-least", "threshold": 100, "minSamples": 100, "windowDays": 14}, {"id": "observed-throughput-runs", "role": "ran", "source": "feature-summary", "ref": {"ref": "autonomous-throughput.observed-runs"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 14}, {"id": "unknown-reads", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/logs/autonomous-throughput-floor.jsonl", "where": {"decision": "unknown"}, "value": "count"}, "direction": "at-most", "threshold": 48, "minSamples": 100, "windowDays": 14}, {"id": "breaker-open", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/logs/autonomous-throughput-floor.jsonl", "where": {"decision": "breaker-open"}, "value": "count"}, "direction": "at-most", "threshold": 0, "minSamples": 100, "windowDays": 14}]}}},
+    {"id": "monitoring.tmuxResilience.asyncHotPath", "title": "Async tmux hot path", "aliases": ["monitoring.tmuxResilience (asyncHotPath + inFlightMarker)"], "flag": {"path": "monitoring.tmuxResilience.asyncHotPath"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/core/SessionManager.ts at each bounded async tmux call that times out or classifies a session (fired), and error on a spurious reap, the spec promotion rule being zero spurious reaps."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.tmuxResilience.asyncHotPath", "kind": "fired"}, "of": {"featureId": "monitoring.tmuxResilience.asyncHotPath"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.tmuxResilience.asyncHotPath", "kind": "error"}, "of": {"featureId": "monitoring.tmuxResilience.asyncHotPath"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "monitoring.tmuxResilience.inFlightMarker", "title": "Tmux in-flight marker", "aliases": [], "flag": {"path": "monitoring.tmuxResilience.inFlightMarker"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/core/SleepWakeDetector.ts when the marker reclassifies a drift as a stall (fired) and when a stale marker self-heals (error), the spec promotion rule being zero false wakes."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.tmuxResilience.inFlightMarker", "kind": "fired"}, "of": {"featureId": "monitoring.tmuxResilience.inFlightMarker"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.tmuxResilience.inFlightMarker", "kind": "error"}, "of": {"featureId": "monitoring.tmuxResilience.inFlightMarker"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "monitoring.windowRunLiveness.cadenceExecutor", "title": "Window run cadence executor", "aliases": ["monitoring.windowRunLiveness"], "flag": {"path": "monitoring.windowRunLiveness.cadenceExecutor"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "The read route shows 0 intervals recorded and it writes no log, so add featureEvidence.record in the executor wired from src/server/AgentServer.ts for each receipt, report and checkpoint (fired) and each exhausted retry (error)."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.windowRunLiveness.cadenceExecutor", "kind": "fired"}, "of": {"featureId": "monitoring.windowRunLiveness.cadenceExecutor"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.windowRunLiveness.cadenceExecutor", "kind": "error"}, "of": {"featureId": "monitoring.windowRunLiveness.cadenceExecutor"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "monitoring.workAdmission", "title": "Overload work admission", "aliases": [], "flag": {"path": "monitoring.workAdmission"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Its own log logs/work-admission.jsonl records closes, reopens and refusals; closes must end in a reopen so a machine never stays shut, and the review grades refusals because no number is written in the spec."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"monitoring.workAdmission.dryRun": false}}, "metrics": [{"id": "would-refuse", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/work-admission.jsonl", "where": {"event": "would-refuse"}, "of": {"event": "would-refuse"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "reopen-share", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/work-admission.jsonl", "where": {"event": "reopened"}, "of": {"event": "closed"}, "value": "ratio"}, "direction": "at-least", "threshold": 0.9, "minSamples": 20, "windowDays": 14}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.workAdmission", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.workAdmission", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 5, "windowDays": 30}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "closes", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/work-admission.jsonl", "where": {"event": "closed"}, "of": {"event": "closed"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "reopen-share", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/work-admission.jsonl", "where": {"event": "reopened"}, "of": {"event": "closed"}, "value": "ratio"}, "direction": "at-least", "threshold": 0.9, "minSamples": 20, "windowDays": 14}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.workAdmission", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.workAdmission", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 5, "windowDays": 30}]}}},
+    {"id": "monitoring.yieldSafety", "title": "Build-session yield safety", "aliases": [], "flag": {"path": "monitoring.yieldSafety"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "It has no audit of its own, so add featureEvidence.record in src/monitoring/SessionReaper.ts when the pre-kill dirty check marks a session resume-eligible (fired) and when the check times out or work is lost (error)."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.yieldSafety", "kind": "fired"}, "of": {"featureId": "monitoring.yieldSafety"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.yieldSafety", "kind": "error"}, "of": {"featureId": "monitoring.yieldSafety"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "multiMachine.accountFollowMe", "title": "Account follow-me", "aliases": [], "flag": {"path": "multiMachine.accountFollowMe"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record, with no account identifiers, in src/core/SubscriptionAccountMetaReplicatedStore.ts where account metadata is projected to a peer (fired) and where a projection or re-mint fails (error)."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.accountFollowMe", "kind": "fired"}, "of": {"featureId": "multiMachine.accountFollowMe"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.accountFollowMe", "kind": "error"}, "of": {"featureId": "multiMachine.accountFollowMe"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "multiMachine.coherenceJournal", "title": "Coherence journal", "aliases": [], "flag": {"path": "multiMachine.coherenceJournal"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Its journal files carry a machine id in the name so no ladder metric can cite them; add featureEvidence.record in src/core/CoherenceJournal.ts for each replication batch applied (fired) and each flush or apply failure (error)."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.coherenceJournal", "kind": "fired"}, "of": {"featureId": "multiMachine.coherenceJournal"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.coherenceJournal", "kind": "error"}, "of": {"featureId": "multiMachine.coherenceJournal"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "multiMachine.coherenceJournal.replication.compaction", "title": "Journal compaction", "aliases": [], "flag": {"path": "multiMachine.coherenceJournal.replication.compaction.run"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "start": {"set": {"multiMachine.coherenceJournal.replication.compaction.run": true}}, "restartNeeded": true, "tracking": {"state": "needed", "plan": "The compactor is built only when run is true and has never run; add featureEvidence.record in src/core/CoherenceJournal.ts for each pass (fired) and failure (error). The rung reads run, so it cannot see the separate dryRun setting."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.coherenceJournal.replication.compaction", "kind": "fired"}, "of": {"featureId": "multiMachine.coherenceJournal.replication.compaction"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.coherenceJournal.replication.compaction", "kind": "error"}, "of": {"featureId": "multiMachine.coherenceJournal.replication.compaction"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.coherenceJournal.replication.compaction", "kind": "fired"}, "of": {"featureId": "multiMachine.coherenceJournal.replication.compaction"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.coherenceJournal.replication.compaction", "kind": "error"}, "of": {"featureId": "multiMachine.coherenceJournal.replication.compaction"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "multiMachine.durableOwnership", "title": "Durable session ownership", "aliases": [], "flag": {"path": "multiMachine.durableOwnership"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in the OwnershipApplier at src/core/OwnershipApplier.ts for each placement adopted from the journal (fired) and each refused or failed apply (error); today only server.log shows it."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.durableOwnership", "kind": "fired"}, "of": {"featureId": "multiMachine.durableOwnership"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.durableOwnership", "kind": "error"}, "of": {"featureId": "multiMachine.durableOwnership"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "multiMachine.identityReannounce", "title": "Machine identity reannounce", "aliases": ["multiMachine.identityReannounce.identityDivergenceMonitor", "multiMachine.identityReannounce (+ identityDivergenceMonitor)"], "flag": {"path": "multiMachine.identityReannounce"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "The divergence monitor runs on its own, so it cannot show reannouncing happened. Add featureEvidence.record at each reannounce attempt in src/core/ with the challenge result."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "reannounce-attempts", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.identityReannounce", "kind": "fired"}, "of": {"featureId": "multiMachine.identityReannounce"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.identityReannounce", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "multiMachine.identityReannounce", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "reannounce-attempts", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.identityReannounce", "kind": "fired"}, "of": {"featureId": "multiMachine.identityReannounce"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.identityReannounce", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "multiMachine.identityReannounce", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0, "minSamples": 1, "windowDays": 30}]}}, "rare": true},
+    {"id": "multiMachine.leaseSelfHeal.churnDetector", "title": "Lease churn detector", "aliases": [], "flag": {"path": "multiMachine.leaseSelfHeal.churnDetector"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "It writes only server.log lines; add featureEvidence.record in src/core/churnBreaker.ts at each latch or would-latch (fired) and at a latch later shown false (error)."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"multiMachine.leaseSelfHeal.churnDetector.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.churnDetector", "kind": "fired"}, "of": {"featureId": "multiMachine.leaseSelfHeal.churnDetector"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.churnDetector", "kind": "error"}, "of": {"featureId": "multiMachine.leaseSelfHeal.churnDetector"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.churnDetector", "kind": "fired"}, "of": {"featureId": "multiMachine.leaseSelfHeal.churnDetector"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.churnDetector", "kind": "error"}, "of": {"featureId": "multiMachine.leaseSelfHeal.churnDetector"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "multiMachine.leaseSelfHeal.preferredCaptainHandback", "title": "Lease hand-back", "aliases": [], "flag": {"path": "multiMachine.leaseSelfHeal.preferredCaptainHandback"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Heartbeats in logs/lease-handback.jsonl prove it runs, but all rows read self-is-preferred with zero episodes; the spec bar of one live verified hand-back and no episode-cap trips is graded through POST /maturation/evidence until its event rows exist."}, "rungs": {"dev-agent-live": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "heartbeats", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/lease-handback.jsonl", "where": {"kind": "heartbeat"}, "of": {"kind": "heartbeat"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "graded-right", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.preferredCaptainHandback", "kind": "outcome", "outcome": "right"}, "of": {"featureId": "multiMachine.leaseSelfHeal.preferredCaptainHandback", "kind": "outcome"}, "value": "count", "dedupe": "gradesEventId"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.preferredCaptainHandback", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "multiMachine.leaseSelfHeal.preferredCaptainHandback", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "heartbeats", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/lease-handback.jsonl", "where": {"kind": "heartbeat"}, "of": {"kind": "heartbeat"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "graded-right", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.preferredCaptainHandback", "kind": "outcome", "outcome": "right"}, "of": {"featureId": "multiMachine.leaseSelfHeal.preferredCaptainHandback", "kind": "outcome"}, "value": "count", "dedupe": "gradesEventId"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.preferredCaptainHandback", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "multiMachine.leaseSelfHeal.preferredCaptainHandback", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "multiMachine.leaseSelfHeal.silentStandbyRelinquish", "title": "Silent standby relinquish", "aliases": [], "flag": {"path": "multiMachine.leaseSelfHeal.silentStandbyRelinquish"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Dark, so it emits nothing; add featureEvidence.record in src/core/MultiMachineCoordinator.ts where a silent standby gives up the lease (fired) and where that leaves nobody serving (error)."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.silentStandbyRelinquish", "kind": "fired"}, "of": {"featureId": "multiMachine.leaseSelfHeal.silentStandbyRelinquish"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.silentStandbyRelinquish", "kind": "error"}, "of": {"featureId": "multiMachine.leaseSelfHeal.silentStandbyRelinquish"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.silentStandbyRelinquish", "kind": "fired"}, "of": {"featureId": "multiMachine.leaseSelfHeal.silentStandbyRelinquish"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.silentStandbyRelinquish", "kind": "error"}, "of": {"featureId": "multiMachine.leaseSelfHeal.silentStandbyRelinquish"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "multiMachine.leaseSelfHeal.soloCaptainHold", "title": "Solo captain hold", "aliases": [], "flag": {"path": "multiMachine.leaseSelfHeal.soloCaptainHold"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "It writes no rows and has no dry-run; add featureEvidence.record in src/core/LeaseCoordinator.ts where the sole captain holds the lease through a hold decision (fired) and where a hold blocks a healthy peer (error)."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.soloCaptainHold", "kind": "fired"}, "of": {"featureId": "multiMachine.leaseSelfHeal.soloCaptainHold"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.soloCaptainHold", "kind": "error"}, "of": {"featureId": "multiMachine.leaseSelfHeal.soloCaptainHold"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "multiMachine.leaseSelfHeal.staleHolderTakeover", "title": "Stale holder takeover", "aliases": [], "flag": {"path": "multiMachine.leaseSelfHeal.staleHolderTakeover"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Dark, so it emits nothing; add featureEvidence.record in src/core/LeaseCoordinator.ts where a stale holder is taken over (fired) and where the holder turns out to be alive (error)."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.staleHolderTakeover", "kind": "fired"}, "of": {"featureId": "multiMachine.leaseSelfHeal.staleHolderTakeover"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.staleHolderTakeover", "kind": "error"}, "of": {"featureId": "multiMachine.leaseSelfHeal.staleHolderTakeover"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.staleHolderTakeover", "kind": "fired"}, "of": {"featureId": "multiMachine.leaseSelfHeal.staleHolderTakeover"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.staleHolderTakeover", "kind": "error"}, "of": {"featureId": "multiMachine.leaseSelfHeal.staleHolderTakeover"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "multiMachine.meshTransport.recoveryProbeEnabled", "title": "Rope recovery probe", "aliases": [], "flag": {"path": "multiMachine.meshTransport.recoveryProbeEnabled", "dryRunPath": "multiMachine.meshTransport.recoveryProbeDryRun"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Rows with sentinel rope-recovery-probe in logs/sentinel-events.jsonl report exhausted episodes, not closes, so the spec bar of one live verified recovery and zero false closes is graded through POST /maturation/evidence."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "probe-episodes", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/sentinel-events.jsonl", "where": {"sentinel": "rope-recovery-probe"}, "of": {"sentinel": "rope-recovery-probe"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "graded-right", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.meshTransport.recoveryProbeEnabled", "kind": "outcome", "outcome": "right"}, "of": {"featureId": "multiMachine.meshTransport.recoveryProbeEnabled", "kind": "outcome"}, "value": "count", "dedupe": "gradesEventId"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.meshTransport.recoveryProbeEnabled", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "multiMachine.meshTransport.recoveryProbeEnabled", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "multiMachine.mutualSsh", "title": "Mutual SSH bootstrap", "aliases": [], "flag": {"path": "multiMachine.mutualSsh"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "subject": "mutual-ssh-autobootstrap", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Its own log .instar/logs/mutual-ssh.jsonl shows the dry-run cadence, which only computes would-probe; the spec criterion, one mutual peer pair, comes from the mutual-ssh.ready-peers projection once it probes for real."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "dry-run-ticks", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/mutual-ssh.jsonl", "where": {"type": "dry-run"}, "of": {"type": "dry-run"}, "value": "count"}, "direction": "at-least", "threshold": 5000, "minSamples": 5000, "windowDays": 7}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.mutualSsh", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "multiMachine.mutualSsh", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "ready-mutual-ssh-peers", "role": "ran", "source": "feature-summary", "ref": {"ref": "mutual-ssh.ready-peers"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 14}, {"id": "repair-exhausted", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/logs/mutual-ssh.jsonl", "where": {"type": "repair-exhausted"}, "value": "count"}, "direction": "at-most", "threshold": 0, "minSamples": 100, "windowDays": 7}]}}},
+    {"id": "multiMachine.nobodyPollingRecovery", "title": "Nobody-polling recovery", "aliases": [], "flag": {"path": "multiMachine.nobodyPollingRecovery"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Its ledger is in memory and 34 fail-closed rows were the only result; add featureEvidence.record in src/core/nobodyPollingActuator.ts for each claim or would-claim (fired) and each fail-closed that lacked visibility (error)."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.nobodyPollingRecovery", "kind": "fired"}, "of": {"featureId": "multiMachine.nobodyPollingRecovery"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.nobodyPollingRecovery", "kind": "error"}, "of": {"featureId": "multiMachine.nobodyPollingRecovery"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.nobodyPollingRecovery", "kind": "fired"}, "of": {"featureId": "multiMachine.nobodyPollingRecovery"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.nobodyPollingRecovery", "kind": "error"}, "of": {"featureId": "multiMachine.nobodyPollingRecovery"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "multiMachine.observedEndpoints", "title": "Observed peer endpoints", "aliases": [], "flag": {"path": "multiMachine.observedEndpoints"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "No durable ledger exists; add featureEvidence.record in src/core/ObservedEndpointTracker.ts for each corroborated or would-promote endpoint (fired) and each failed dial-back or quarantine (error)."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"multiMachine.observedEndpoints.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.observedEndpoints", "kind": "fired"}, "of": {"featureId": "multiMachine.observedEndpoints"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.observedEndpoints", "kind": "error"}, "of": {"featureId": "multiMachine.observedEndpoints"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.observedEndpoints", "kind": "fired"}, "of": {"featureId": "multiMachine.observedEndpoints"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.observedEndpoints", "kind": "error"}, "of": {"featureId": "multiMachine.observedEndpoints"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "multiMachine.ownershipFollowsLiveWork", "title": "Ownership follows live work", "aliases": [], "flag": {"path": "multiMachine.ownershipFollowsLiveWork"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/core/ownershipFollowsLiveWork.ts at the release-on-complete and claim-on-spawn compare-and-set calls (fired) and when one is refused (error)."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.ownershipFollowsLiveWork", "kind": "fired"}, "of": {"featureId": "multiMachine.ownershipFollowsLiveWork"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.ownershipFollowsLiveWork", "kind": "error"}, "of": {"featureId": "multiMachine.ownershipFollowsLiveWork"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "multiMachine.peerExecution", "title": "Peer execution keys", "aliases": [], "flag": {"path": "multiMachine.peerExecution"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Dark, depends on mutual SSH; add featureEvidence.record in src/core/MutualSshRuntime.ts where a verified peer key is installed or would be (fired) and where proof is refused (error)."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.peerExecution", "kind": "fired"}, "of": {"featureId": "multiMachine.peerExecution"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.peerExecution", "kind": "error"}, "of": {"featureId": "multiMachine.peerExecution"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.peerExecution", "kind": "fired"}, "of": {"featureId": "multiMachine.peerExecution"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.peerExecution", "kind": "error"}, "of": {"featureId": "multiMachine.peerExecution"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "multiMachine.pollFollowsLease", "title": "Polling follows lease", "aliases": [], "flag": {"path": "multiMachine.pollFollowsLease"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Only server.log shows it, and the last carried evidence was 279 would-stop to 0 would-start, so add featureEvidence.record in src/core/MultiMachineCoordinator.ts at each would-start or would-stop (fired), and error when one would leave nobody polling."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.pollFollowsLease", "kind": "fired"}, "of": {"featureId": "multiMachine.pollFollowsLease"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.pollFollowsLease", "kind": "error"}, "of": {"featureId": "multiMachine.pollFollowsLease"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.pollFollowsLease", "kind": "fired"}, "of": {"featureId": "multiMachine.pollFollowsLease"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.pollFollowsLease", "kind": "error"}, "of": {"featureId": "multiMachine.pollFollowsLease"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "multiMachine.recoveryKeyEscrow", "title": "Recovery key escrow", "aliases": [], "flag": {"path": "multiMachine.recoveryKeyEscrow"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "No recovery root exists on any machine yet; add featureEvidence.record, with no key material, in src/core/MachineIdentityBootRecovery.ts when escrow is minted or would be (fired) and when minting fails (error)."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.recoveryKeyEscrow", "kind": "fired"}, "of": {"featureId": "multiMachine.recoveryKeyEscrow"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.recoveryKeyEscrow", "kind": "error"}, "of": {"featureId": "multiMachine.recoveryKeyEscrow"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.recoveryKeyEscrow", "kind": "fired"}, "of": {"featureId": "multiMachine.recoveryKeyEscrow"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.recoveryKeyEscrow", "kind": "error"}, "of": {"featureId": "multiMachine.recoveryKeyEscrow"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "multiMachine.seamlessOrchestrator", "title": "Seamlessness orchestrator", "aliases": [], "flag": {"path": "multiMachine.seamlessOrchestrator"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Its audit logs/orchestrator-actions.jsonl has never been written because no tick has proposed anything; add featureEvidence.record in src/monitoring/OrchestratorPoller.ts for each tick (fired) and failure (error), then cite that audit once it has rows."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessOrchestrator", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessOrchestrator"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessOrchestrator", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessOrchestrator"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessOrchestrator", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessOrchestrator"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessOrchestrator", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessOrchestrator"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "multiMachine.seamlessness.ws13PinReplicate", "title": "Move pin replication", "aliases": ["multiMachine.seamlessness.ws13PinReplicate + ws13Reconcile"], "flag": {"path": "multiMachine.seamlessness.ws13PinReplicate"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/core/TopicPinReplicatedStore.ts when a pin record is written or applied (fired) and when one is rejected (error); the journal holds these rows but under per-machine file names."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws13PinReplicate", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessness.ws13PinReplicate"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws13PinReplicate", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessness.ws13PinReplicate"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "multiMachine.seamlessness.ws13Reconcile", "title": "Ownership reconcile loop", "aliases": [], "flag": {"path": "multiMachine.seamlessness.ws13Reconcile", "dryRunPath": "multiMachine.seamlessness.ws13DryRun"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/core/OwnershipReconciler.ts for each reconcile that acts (fired) and each failed or refused compare-and-set (error)."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws13Reconcile", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessness.ws13Reconcile"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws13Reconcile", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessness.ws13Reconcile"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "multiMachine.seamlessness.ws3OneVoice", "title": "One-voice speaker election", "aliases": [], "flag": {"path": "multiMachine.seamlessness.ws3OneVoice"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Only server.log shows its verdicts; add featureEvidence.record in src/monitoring/SpeakerElection.ts for each withheld send (fired) and for a double reply or a turn nobody answered (error)."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws3OneVoice", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessness.ws3OneVoice"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws3OneVoice", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessness.ws3OneVoice"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "multiMachine.seamlessness.ws41DurableAck", "title": "Durable remote acknowledgement", "aliases": [], "flag": {"path": "multiMachine.seamlessness.ws41DurableAck"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "tracking": {"state": "needed", "plan": "src/core/RemoteAckStore.ts has never written logs/remote-ack-queue.jsonl because no ack has queued; add featureEvidence.record there when an intent is persisted and applied (fired) and when apply fails (error)."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws41DurableAck", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessness.ws41DurableAck"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws41DurableAck", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessness.ws41DurableAck"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "multiMachine.seamlessness.ws43JournalLease", "title": "Journal lease cutover", "aliases": [], "flag": {"path": "multiMachine.seamlessness.ws43JournalLease"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "A code-owned readiness floor holds it on the legacy path, so it cannot pass until that lifts; add featureEvidence.record in src/scheduler/JobLeaseCutoverGate.ts for each cutover (fired) and each failure (error)."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws43JournalLease", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessness.ws43JournalLease"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws43JournalLease", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessness.ws43JournalLease"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "multiMachine.seamlessness.ws43RoleGuard", "title": "Role guard at spawn", "aliases": [], "flag": {"path": "multiMachine.seamlessness.ws43RoleGuard"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/scheduler/JobScheduler.ts where a state-writing job is refused on a non-holder (fired) and where a holder is wrongly refused (error)."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws43RoleGuard", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessness.ws43RoleGuard"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws43RoleGuard", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessness.ws43RoleGuard"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "multiMachine.seamlessness.ws44PoolCache", "title": "Shared pool cache", "aliases": [], "flag": {"path": "multiMachine.seamlessness.ws44PoolCache"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Its counters live in memory only; add featureEvidence.record in src/server/PoolPollCache.ts for a periodic summary of fetches, hits and load sheds (fired), and error when fetch failures pass a set share."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws44PoolCache", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessness.ws44PoolCache"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws44PoolCache", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessness.ws44PoolCache"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "multiMachine.seamlessness.ws44PoolLinks", "title": "Cross-machine view links", "aliases": [], "flag": {"path": "multiMachine.seamlessness.ws44PoolLinks"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "No proxy count or ledger exists; add featureEvidence.record in src/server/routes.ts where /view/:id is proxied to the holder (fired) and where the assertion or proxy fails (error)."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws44PoolLinks", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessness.ws44PoolLinks"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws44PoolLinks", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessness.ws44PoolLinks"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "multiMachine.secretSync", "title": "Cross-machine secret sync", "aliases": [], "flag": {"path": "multiMachine.secretSync"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Only boot lines show it; add featureEvidence.record, with no secret names or values, in the inbound handler started from src/commands/server.ts for each sync received (fired) and each failure to open or apply (error)."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.secretSync", "kind": "fired"}, "of": {"featureId": "multiMachine.secretSync"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.secretSync", "kind": "error"}, "of": {"featureId": "multiMachine.secretSync"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "multiMachine.sessionPool", "title": "Session pool master switch", "aliases": [], "flag": {"path": "multiMachine.sessionPool"}, "disposition": "composed", "composedInto": "multiMachine.sessionPool.stage", "final": "default-on", "risk": "sensitive", "tracking": {"state": "needed", "plan": "The master switch moves with the stage, which StageAdvancer alone writes; the stage entry holds the evidence plan."}, "rungs": {}},
+    {"id": "multiMachine.sessionPool.commitmentCustodyTransfer", "title": "Commitment custody transfer", "aliases": [], "flag": {"path": "multiMachine.sessionPool.commitmentCustodyTransfer"}, "disposition": "retire", "retire": {"reason": "No runtime code reads this flag, so it can never take effect.", "ref": "grep commitmentCustodyTransfer in src: only ConfigDefaults, types, devGatedFeatures, machineCoherenceManifest; review row 2026-10-22"}, "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "Nothing to log: no runtime code reads this flag, so it can never fire."}, "rungs": {}},
+    {"id": "multiMachine.sessionPool.duplicateReconciler", "title": "Duplicate session reconciler", "aliases": [], "flag": {"path": "multiMachine.sessionPool.duplicateReconciler"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Its own log .instar/logs/duplicate-reconciler.jsonl; breaker trips and escalations against opened episodes are the harm, because each one means convergence failed and a person or a later pass has to clear it."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "episodes-opened", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/duplicate-reconciler.jsonl", "where": {"kind": "duplicate-episode-opened"}, "of": {"kind": "duplicate-episode-opened"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "breaker-trip-share", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/logs/duplicate-reconciler.jsonl", "where": {"kind": "breaker-tripped"}, "of": {"kind": "duplicate-episode-opened"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}, {"id": "escalated-share", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/logs/duplicate-reconciler.jsonl", "where": {"kind": "escalated"}, "of": {"kind": "duplicate-episode-opened"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "multiMachine.sessionPool.failoverRunner", "title": "Failover check runner", "aliases": [], "flag": {"path": "multiMachine.sessionPool.failoverRunner"}, "disposition": "composed", "composedInto": "multiMachine.sessionPool.stage", "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "It exists to produce the signed green that promotes the stage, so it moves with the stage; its result rows are that entry's evidence."}, "rungs": {}},
+    {"id": "multiMachine.sessionPool.holdForStability", "title": "Hold for stability", "aliases": [], "flag": {"path": "multiMachine.sessionPool.holdForStability"}, "disposition": "composed", "composedInto": "multiMachine.sessionPool.inboundQueue", "final": "default-on", "risk": "sensitive", "tracking": {"state": "needed", "plan": "Same spec as the inbound queue, and it trails that queue by one stage on every step; the queue entry records its holds and recoveries."}, "rungs": {}},
+    {"id": "multiMachine.sessionPool.inboundQueue", "title": "Durable inbound queue", "aliases": [], "flag": {"path": "multiMachine.sessionPool.inboundQueue"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "subject": "durable-inbound-message-queue", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Its counters are read from GET /pool/queue and no log exists; add featureEvidence.record in the drain behind src/core/inboundQueueConfig.ts for each delivery (fired), each hold recovered in place (held), and each unexplained drop, expiry or ordering violation (error)."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.sessionPool.inboundQueue", "kind": "fired"}, "of": {"featureId": "multiMachine.sessionPool.inboundQueue"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 7}, {"id": "holds-recovered", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.sessionPool.inboundQueue", "kind": "held"}, "of": {"featureId": "multiMachine.sessionPool.inboundQueue"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 20, "windowDays": 7}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.sessionPool.inboundQueue", "kind": "error"}, "of": {"featureId": "multiMachine.sessionPool.inboundQueue"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 20, "windowDays": 7}]}}},
+    {"id": "multiMachine.sessionPool.judgmentArbiters", "title": "Judgment arbiters", "aliases": [], "flag": {"path": "multiMachine.sessionPool.judgmentArbiters"}, "disposition": "retire", "retire": {"reason": "No runtime code reads this flag; 106 survivor decisions in the review window were all deterministic.", "ref": "grep judgmentArbiters in src: only ConfigDefaults, types, devGatedFeatures, machineCoherenceManifest; review row 2026-10-22"}, "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "Nothing to log: no runtime code reads this flag, so it can never fire."}, "rungs": {}},
+    {"id": "multiMachine.sessionPool.ownershipCheckedSpawn", "title": "Ownership-checked spawn", "aliases": [], "flag": {"path": "multiMachine.sessionPool.ownershipCheckedSpawn"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Its own log logs/mesh-selfheal.jsonl records binding-would-clear in dry-run and binding-cleared when live; the review grades a sample of rows, because a wrongly cleared binding only shows when read against ownership."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "would-clear", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/mesh-selfheal.jsonl", "where": {"event": "binding-would-clear"}, "of": {"event": "binding-would-clear"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.sessionPool.ownershipCheckedSpawn", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "multiMachine.sessionPool.ownershipCheckedSpawn", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 5, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "cleared", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/mesh-selfheal.jsonl", "where": {"event": "binding-cleared"}, "of": {"event": "binding-cleared"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.sessionPool.ownershipCheckedSpawn", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "multiMachine.sessionPool.ownershipCheckedSpawn", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 5, "windowDays": 30}]}}},
+    {"id": "multiMachine.sessionPool.ownershipGatedSpawn", "title": "Ownership-gated spawn", "aliases": [], "flag": {"path": "multiMachine.sessionPool.ownershipGatedSpawn"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Its own log .instar/logs/owner-dark-ladder.jsonl holds one admission row in 14 days, because it binds only a verified live other owner; the review grades each row."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "admission-decisions", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/owner-dark-ladder.jsonl", "where": {"kind": "spawn-admission-decision"}, "of": {"kind": "spawn-admission-decision"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.sessionPool.ownershipGatedSpawn", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "multiMachine.sessionPool.ownershipGatedSpawn", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "multiMachine.sessionPool.stage", "title": "Conversations across machines", "aliases": [], "flag": {"path": "multiMachine.sessionPool.stage", "on": "live-transfer"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "tracking": {"state": "needed", "plan": "The signed results sit in .instar/session-pool-e2e-results.json, which the reader refuses by name; add featureEvidence.record in src/core/SessionPoolFailoverRunner.ts for each signed green (fired) and red (error), inconclusive runs not counting."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "owner-driver", "driver": "StageAdvancer"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.sessionPool.stage", "kind": "fired"}, "of": {"featureId": "multiMachine.sessionPool.stage"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.sessionPool.stage", "kind": "error"}, "of": {"featureId": "multiMachine.sessionPool.stage"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "multiMachine.sessionPool.staleOwnerRelease", "title": "Stale owner release", "aliases": [], "flag": {"path": "multiMachine.sessionPool.staleOwnerRelease"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Its own decision trace logs/stale-owner-release.jsonl shows real claims and give-ups; the spec demands zero wrong claims, which the review grades through POST /maturation/evidence against whether the owner was really dead."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "claims", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/stale-owner-release.jsonl", "where": {"type": "claim"}, "of": {"type": "claim"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "giveup-share", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/stale-owner-release.jsonl", "where": {"type": "p19-giveup"}, "of": {"type": "claim"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.sessionPool.staleOwnerRelease", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "multiMachine.sessionPool.staleOwnerRelease", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0, "minSamples": 3, "windowDays": 30}]}}},
+    {"id": "multiMachine.stateSync.classReview", "title": "Class review sync", "flag": {"path": "multiMachine.stateSync.classReview"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Today only a boot line reports it; record fired per merged peer lifecycle record and error per refused or failed merge in src/core/ClassReviewReplicatedStore.ts, including the would-merge decision while dry-run."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"multiMachine.stateSync.classReview.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.classReview", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.classReview"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.classReview", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.classReview"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.classReview", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.classReview"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.classReview", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.classReview"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
+    {"id": "multiMachine.stateSync.evolutionActions", "title": "Evolution action sync", "flag": {"path": "multiMachine.stateSync.evolutionActions"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Replication rows live in the machine-named coherence journal (<machineId>.evolution-action-record.jsonl), so no fixed path can cite them; record fired per applied peer record and error per failed apply in src/core/EvolutionActionsReplicatedStore.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.evolutionActions", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.evolutionActions"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.evolutionActions", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.evolutionActions"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
+    {"id": "multiMachine.stateSync.knowledge", "title": "Knowledge catalog sync", "flag": {"path": "multiMachine.stateSync.knowledge"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "No fixed-path log; the review goal is one real record copied across. Record fired per applied peer catalog record and error per failed apply in src/core/KnowledgeReplicatedStore.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.knowledge", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.knowledge"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.knowledge", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.knowledge"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
+    {"id": "multiMachine.stateSync.learnings", "title": "Learnings sync", "aliases": ["multiMachine.stateSync.learnings+evolutionActions+topicOperator"], "flag": {"path": "multiMachine.stateSync.learnings"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Replication rows live in the machine-named coherence journal (<machineId>.learning-record.jsonl), so no fixed path can cite them; record fired per applied peer record and error per failed apply in src/core/LearningsReplicatedStore.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.learnings", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.learnings"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.learnings", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.learnings"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "multiMachine.stateSync.preferences", "title": "Preferences sync", "aliases": ["multiMachine.stateSync.preferences+relationships+knowledge+userRegistry"], "flag": {"path": "multiMachine.stateSync.preferences"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "No fixed-path log; the review goal is one real record copied across. Record fired per applied peer preference and error per failed apply in the preferences replicated store (src/core/PreferencesReplicatedStore.ts)."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.preferences", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.preferences"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.preferences", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.preferences"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "multiMachine.stateSync.relationships", "title": "Relationships sync", "flag": {"path": "multiMachine.stateSync.relationships"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "No fixed-path log; the review goal is one real record copied across. Record fired per applied peer relationship and error per clamp refusal or failed apply in the relationships replicated store, with no personal data in the row."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.relationships", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.relationships"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.relationships", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.relationships"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
+    {"id": "multiMachine.stateSync.threadlinePairing", "title": "Pairing result sync", "flag": {"path": "multiMachine.stateSync.threadlinePairing"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Hard-dark, so nothing writes today; record fired per inherited pairing result and error per key-pin mismatch or failed apply in src/core/ThreadlinePairingReplicatedStore.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.threadlinePairing", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.threadlinePairing"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.threadlinePairing", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.threadlinePairing"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.threadlinePairing", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.threadlinePairing"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.threadlinePairing", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.threadlinePairing"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}, "aliases": []},
+    {"id": "multiMachine.stateSync.topicOperator", "title": "Topic operator sync", "flag": {"path": "multiMachine.stateSync.topicOperator"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Replication rows live in the machine-named coherence journal (<machineId>.topic-operator-record.jsonl), so no fixed path can cite them; record fired per applied peer record and error per failed apply in src/core/TopicOperatorReplicatedStore.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.topicOperator", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.topicOperator"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.topicOperator", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.topicOperator"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
+    {"id": "multiMachine.stateSync.userRegistry", "title": "User registry sync", "flag": {"path": "multiMachine.stateSync.userRegistry"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "No fixed-path log; the review goal is one real record copied across. Record fired per applied peer user record and error per clamp refusal or failed apply in src/core/UserRegistryReplicatedStore.ts, with no personal data in the row."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.userRegistry", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.userRegistry"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.userRegistry", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.userRegistry"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
+    {"id": "multiMachine.writeAdmission", "title": "Standby write admission", "flag": {"path": "multiMachine.writeAdmission"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Its verdict log shows it ran; a refusal is not harm in itself, so the review grades sampled verdicts as wrongly refused or wrongly admitted."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "verdict-rows", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/write-admission.jsonl", "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "graded-wrong", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.writeAdmission", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "multiMachine.writeAdmission", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.1, "minSamples": 5, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "verdict-rows", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/write-admission.jsonl", "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "graded-wrong", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.writeAdmission", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "multiMachine.writeAdmission", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.1, "minSamples": 5, "windowDays": 30}]}}, "aliases": []},
+    {"id": "multiMachine.zombieRelinquish", "title": "Zombie holder relinquish", "flag": {"path": "multiMachine.zombieRelinquish"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Its ledger is process memory and its only trace is a [g1-relinquish] console line; record fired per would-relinquish or relinquish and error per failed relinquish at the decision in src/core/MultiMachineCoordinator.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.zombieRelinquish", "kind": "fired"}, "of": {"featureId": "multiMachine.zombieRelinquish"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.zombieRelinquish", "kind": "error"}, "of": {"featureId": "multiMachine.zombieRelinquish"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.zombieRelinquish", "kind": "fired"}, "of": {"featureId": "multiMachine.zombieRelinquish"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.zombieRelinquish", "kind": "error"}, "of": {"featureId": "multiMachine.zombieRelinquish"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}, "aliases": []},
+    {"id": "passkeys", "title": "Agent-held passkeys", "flag": {"path": "passkeys"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "passkey-legacy-reads.jsonl records old secret reads, not this feature, and no grant exists yet; record fired per grant, enrollment and passkey sign-in and error per failure, in the grant routes and passkey-cell mandate receiver."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "passkeys", "kind": "fired"}, "of": {"featureId": "passkeys"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "passkeys", "kind": "error"}, "of": {"featureId": "passkeys"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
+    {"id": "playwrightRegistry", "title": "Playwright profile registry", "flag": {"path": "playwrightRegistry"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads its own profile action rows (none since 09-25, so it reads no-data until used again); it logs no failures, so also record error rows when an activate or assign fails in src/server/routes.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "profile-actions", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/playwright-profiles.jsonl", "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "playwrightRegistry", "kind": "error"}, "of": {"featureId": "playwrightRegistry"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}, "aliases": []},
+    {"id": "prGate.classClosure", "title": "Class closure gate", "flag": {"path": "prGate.classClosure"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "tracking": {"state": "needed", "plan": "CI-only report-only lint with no machine ledger; report through POST /maturation/evidence from scripts/class-closure-lint.mjs: fired per fix with the class block populated, error per fix missing it or pipeline breakage (written bar: 10 fixes, 100% populated, zero breakage)."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "prGate.classClosure", "kind": "fired"}, "of": {"featureId": "prGate.classClosure"}, "value": "count"}, "direction": "at-least", "threshold": 10, "minSamples": 10, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "prGate.classClosure", "kind": "error"}, "of": {"featureId": "prGate.classClosure"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 10, "windowDays": 14}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "prGate.classClosure", "kind": "fired"}, "of": {"featureId": "prGate.classClosure"}, "value": "count"}, "direction": "at-least", "threshold": 10, "minSamples": 10, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "prGate.classClosure", "kind": "error"}, "of": {"featureId": "prGate.classClosure"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 10, "windowDays": 14}]}}, "aliases": []},
+    {"id": "provenance.uniformSeam", "title": "Uniform decision provenance", "flag": {"path": "provenance.uniformSeam"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Its rows go to dated judgment-provenance/<date>.jsonl files and decision_quality, which a fixed-path metric cannot read; record an hourly fired summary and error per failed side write in src/core/DecisionQualityRecorderImpl.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "provenance.uniformSeam", "kind": "fired"}, "of": {"featureId": "provenance.uniformSeam"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "provenance.uniformSeam", "kind": "error"}, "of": {"featureId": "provenance.uniformSeam"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []},
+    {"id": "queuePace", "title": "Queue pace ledger", "flag": {"path": "queuePace"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads its own hourly interval rows (about 96 a day across four live queues, time field `to`); count drift is its own honesty signal, and it reads 6.6% today, so it holds until that drops."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "hourly-intervals", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/queue-pace.jsonl", "where": {"kind": "interval"}, "of": {"kind": "interval"}, "value": "count", "timeField": "to"}, "direction": "at-least", "threshold": 1000, "minSamples": 1000, "windowDays": 14}, {"id": "intervals-ok", "role": "quality", "source": "jsonl-log", "ref": {"file": ".instar/logs/queue-pace.jsonl", "where": {"kind": "interval", "ok": true}, "of": {"kind": "interval"}, "value": "ratio", "timeField": "to"}, "direction": "at-least", "threshold": 0.9, "minSamples": 100, "windowDays": 14}, {"id": "count-drift-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/logs/queue-pace.jsonl", "where": {"kind": "interval", "reason": "count-drift"}, "of": {"kind": "interval"}, "value": "ratio", "timeField": "to"}, "direction": "at-most", "threshold": 0.05, "minSamples": 100, "windowDays": 14}]}}, "aliases": []},
+    {"id": "remoteDesktop", "title": "Remote desktop", "flag": {"path": "remoteDesktop"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "tracking": {"state": "needed", "plan": "Preference candidate: full display and input access may stay an explicit per-machine opt-in. Its access rows are dated desktop-access-<date>.jsonl files a fixed-path metric cannot read; record fired per session start and error per failed start in src/server/routes.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "remoteDesktop", "kind": "fired"}, "of": {"featureId": "remoteDesktop"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "remoteDesktop", "kind": "error"}, "of": {"featureId": "remoteDesktop"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
+    {"id": "remoteDesktop.guidedSetup", "title": "Guided desktop setup", "flag": {"path": "remoteDesktop.guidedSetup"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads its own setup rows, only 2 so far; the written bar is each operator machine taken from off to a working session with no config edit and no defect, which the review confirms; turn-on rows show the flow finishing."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "setup-actions", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/desktop-setup.jsonl", "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "turn-ons", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/desktop-setup.jsonl", "where": {"action": "turn-on"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "failed-actions", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/logs/desktop-setup.jsonl", "where": {"outcome": "failed"}, "value": "count"}, "direction": "at-most", "threshold": 0, "minSamples": 1, "windowDays": 30}, {"id": "graded-wrong", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "remoteDesktop.guidedSetup", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "remoteDesktop.guidedSetup", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.1, "minSamples": 5, "windowDays": 30}]}}, "aliases": []},
+    {"id": "routingSpend.money", "title": "Metered spend authority", "aliases": ["routingSpend (.money)"], "flag": {"path": "routingSpend.money"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Preference candidate: real-dollar authority may stay an explicit operator enable. routing-spend-alerts only says the door is dark, so record fired per metered call admitted and error per cap breach or ledger failure at src/core/meteredCallEntry.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "routingSpend.money", "kind": "fired"}, "of": {"featureId": "routingSpend.money"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "routingSpend.money", "kind": "error"}, "of": {"featureId": "routingSpend.money"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "routingSpend.money", "kind": "fired"}, "of": {"featureId": "routingSpend.money"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "routingSpend.money", "kind": "error"}, "of": {"featureId": "routingSpend.money"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "selfKnowledge.sessionContext", "title": "Session self-knowledge", "flag": {"path": "selfKnowledge.sessionContext"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "No serve-audit log exists; record fired per block served and error per failed build at the session-context route in src/server/routes.ts, with fact counts in context since 49 of 50 stored facts reportedly never reach a session."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "selfKnowledge.sessionContext", "kind": "fired"}, "of": {"featureId": "selfKnowledge.sessionContext"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "selfKnowledge.sessionContext", "kind": "error"}, "of": {"featureId": "selfKnowledge.sessionContext"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []},
+    {"id": "sessions.respawnBuildContext", "title": "Respawn build context", "flag": {"path": "sessions.respawnBuildContext"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Writes only a state map (5.1 MB, 20,820 entries, never pruned); record fired per restart that uses a captured context and error per capture failure in src/core/SessionManager.ts, and bound the map before fleet."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "sessions.respawnBuildContext", "kind": "fired"}, "of": {"featureId": "sessions.respawnBuildContext"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "sessions.respawnBuildContext", "kind": "error"}, "of": {"featureId": "sessions.respawnBuildContext"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []},
+    {"id": "subscriptionPool.assistedRelogin", "title": "Assisted account relogin", "aliases": ["subscriptionPool.assistedRelogin.slowRetry"], "flag": {"path": "subscriptionPool.assistedRelogin"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Preference candidate: submitting provider credentials may stay opt-in. Attempts live in SQLite (subscription-relogin/repairs.db); record fired per successful repair and error per failed one in src/core/SubscriptionReloginRuntime.ts (written bar: 10 repairs over 30 days)."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.assistedRelogin", "kind": "fired"}, "of": {"featureId": "subscriptionPool.assistedRelogin"}, "value": "count"}, "direction": "at-least", "threshold": 10, "minSamples": 10, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.assistedRelogin", "kind": "error"}, "of": {"featureId": "subscriptionPool.assistedRelogin"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 30}]}}},
+    {"id": "subscriptionPool.codexDeviceLimit", "title": "Codex device-limit tripwire", "flag": {"path": "subscriptionPool.codexDeviceLimit"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "tracking": {"state": "needed", "plan": "It logs to codex-device-limit.jsonl only when a verdict happens, and that file does not exist here yet; record fired per bench or release decision and error per failed judgement in src/core/codexDeviceLimitWiring.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.codexDeviceLimit", "kind": "fired"}, "of": {"featureId": "subscriptionPool.codexDeviceLimit"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.codexDeviceLimit", "kind": "error"}, "of": {"featureId": "subscriptionPool.codexDeviceLimit"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}, "aliases": []},
+    {"id": "subscriptionPool.credentialRepointing", "title": "Credential repointing", "flag": {"path": "subscriptionPool.credentialRepointing"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Its audit credential-swaps.jsonl is a refused path by name, and most steps were preflight-refused on identity unavailable; record fired per swap or dry-run swap and error per preflight refusal in src/core/CredentialSwapExecutor.ts, with no token material."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.credentialRepointing", "kind": "fired"}, "of": {"featureId": "subscriptionPool.credentialRepointing"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.credentialRepointing", "kind": "error"}, "of": {"featureId": "subscriptionPool.credentialRepointing"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.credentialRepointing", "kind": "fired"}, "of": {"featureId": "subscriptionPool.credentialRepointing"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.credentialRepointing", "kind": "error"}, "of": {"featureId": "subscriptionPool.credentialRepointing"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []},
+    {"id": "subscriptionPool.proactiveSwap.antiThrash", "title": "Swap anti-thrash brakes", "flag": {"path": "subscriptionPool.proactiveSwap.antiThrash", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads the swap ledger: brake refusals show it ran, and proactive swaps stay a small share of proactive decisions (5.6% over 14 days; a thrash day would push that up)."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "brake-refusals", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/state/swap-ledger.jsonl", "where": {"kind": "proactive", "decision": "refused"}, "of": {"kind": "proactive"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "proactive-failure-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/state/swap-ledger.jsonl", "where": {"kind": "proactive", "decision": "failed"}, "of": {"kind": "proactive"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}, {"id": "graded-wrong", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.proactiveSwap.antiThrash", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "subscriptionPool.proactiveSwap.antiThrash", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.1, "minSamples": 5, "windowDays": 30}]}}, "aliases": []},
+    {"id": "subscriptionPool.proactiveSwap.defaultSlotRepoint", "title": "Default slot repoint", "flag": {"path": "subscriptionPool.proactiveSwap.defaultSlotRepoint"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Its would-repoint record goes to the credential audit, a refused path by name; record fired once per distinct intended flip, not per tick, and error per failed flip at the audit call in src/core/ProactiveSwapMonitor.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.proactiveSwap.defaultSlotRepoint", "kind": "fired"}, "of": {"featureId": "subscriptionPool.proactiveSwap.defaultSlotRepoint"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.proactiveSwap.defaultSlotRepoint", "kind": "error"}, "of": {"featureId": "subscriptionPool.proactiveSwap.defaultSlotRepoint"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.proactiveSwap.defaultSlotRepoint", "kind": "fired"}, "of": {"featureId": "subscriptionPool.proactiveSwap.defaultSlotRepoint"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.proactiveSwap.defaultSlotRepoint", "kind": "error"}, "of": {"featureId": "subscriptionPool.proactiveSwap.defaultSlotRepoint"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
+    {"id": "subscriptionPool.proactiveSwap.loginLoss", "title": "Login-loss swap", "flag": {"path": "subscriptionPool.proactiveSwap.loginLoss"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads swap-ledger rows with sourceTrigger login-loss (one ever, 09-12), so idle is healthy; failed rows carry no sourceTrigger, so harm reads the failure rate of the same proactive funnel it swaps through."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "login-loss-swaps", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/state/swap-ledger.jsonl", "where": {"sourceTrigger": "login-loss"}, "of": {"sourceTrigger": "login-loss"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "login-loss-failure-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/state/swap-ledger.jsonl", "where": {"sourceTrigger": "login-loss", "decision": "failed"}, "of": {"sourceTrigger": "login-loss"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}, "aliases": []},
+    {"id": "subscriptionPool.swapContinuity", "title": "Swap continuity gate", "flag": {"path": "subscriptionPool.swapContinuity", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads the swap ledger: in-flight deferrals show the gate ran; reactive swap failures read 6.7% over 14 days (not-telegram-bound), so it holds until fixed; ceiling drops measure proactive swaps it cost."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "work-deferrals", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/state/swap-ledger.jsonl", "where": {"callerClass": "proactive-swap", "decision": "deferred"}, "of": {"callerClass": "proactive-swap"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "ceiling-drop-share", "role": "quality", "source": "jsonl-log", "ref": {"file": ".instar/state/swap-ledger.jsonl", "where": {"kind": "proactive", "decision": "dropped"}, "of": {"kind": "proactive"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.15, "minSamples": 20, "windowDays": 14}, {"id": "reactive-failure-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/state/swap-ledger.jsonl", "where": {"kind": "reactive", "decision": "failed"}, "of": {"kind": "reactive"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []},
+    {"id": "telegramIngress.lifelineSecret.enforce", "title": "Lifeline ingress secret", "aliases": ["telegramIngress.lifelineSecret"], "flag": {"path": "telegramIngress.lifelineSecret.enforce"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "tracking": {"state": "needed", "plan": "Its verified and would-refuse counts are only on /health; record fired per hourly verified count and error per message refused from the real lifeline in src/server/LifelineIngressGuard.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "telegramIngress.lifelineSecret.enforce", "kind": "fired"}, "of": {"featureId": "telegramIngress.lifelineSecret.enforce"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "telegramIngress.lifelineSecret.enforce", "kind": "error"}, "of": {"featureId": "telegramIngress.lifelineSecret.enforce"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "threadline.a2aCheckIn", "title": "A2A check-in summaries", "flag": {"path": "threadline.a2aCheckIn"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Preference candidate: unbounded heartbeat summaries may stay opt-in so the operator is not flooded. Dark with no log; record fired per summary sent and error per failed one in the check-in scheduler in src/commands/server.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.a2aCheckIn", "kind": "fired"}, "of": {"featureId": "threadline.a2aCheckIn"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.a2aCheckIn", "kind": "error"}, "of": {"featureId": "threadline.a2aCheckIn"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.a2aCheckIn", "kind": "fired"}, "of": {"featureId": "threadline.a2aCheckIn"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.a2aCheckIn", "kind": "error"}, "of": {"featureId": "threadline.a2aCheckIn"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
+    {"id": "threadline.backupRoutes", "title": "A2A backup routes", "flag": {"path": "threadline.backupRoutes"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "tracking": {"state": "needed", "plan": "Only [a2a-backup] console lines and /health counters exist; record fired per marked fall-through and fingerprint local delivery and error per failed one in src/threadline/backupRoutes.ts (written bar: at least one of each, zero is not a pass)."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.backupRoutes", "kind": "fired"}, "of": {"featureId": "threadline.backupRoutes"}, "value": "count"}, "direction": "at-least", "threshold": 2, "minSamples": 2, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.backupRoutes", "kind": "error"}, "of": {"featureId": "threadline.backupRoutes"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 2, "windowDays": 30}]}}, "aliases": []},
+    {"id": "threadline.canonicalHistory.conversationDiscipline", "title": "Conversation discipline", "flag": {"path": "threadline.canonicalHistory.conversationDiscipline"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads its own resolver rows; a minted no-binding row is the fork it exists to close (2.9% over 14 days). Would-join rows are too rare to bar on (three, all on 10-08)."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"threadline.canonicalHistory.conversationDiscipline.dryRun": false}}, "metrics": [{"id": "resolver-decisions", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/threadline-canonical-history.jsonl", "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "fork-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": ".instar/logs/threadline-canonical-history.jsonl", "where": {"dryRun": true, "decision": "minted:no-binding"}, "of": {"dryRun": true}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "resolver-decisions", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/threadline-canonical-history.jsonl", "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "fork-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": ".instar/logs/threadline-canonical-history.jsonl", "where": {"dryRun": false, "decision": "minted:no-binding"}, "of": {"dryRun": false}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []},
+    {"id": "threadline.hubIntent", "title": "Hub intent recognizer", "flag": {"path": "threadline.hubIntent"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "logs/hub-intent.jsonl does not exist yet, as no hub message has reached the classifier here; record fired per would-swallow or would-pass verdict and error per classifier failure beside that append in src/commands/server.ts."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"threadline.hubIntent.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.hubIntent", "kind": "fired"}, "of": {"featureId": "threadline.hubIntent"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.hubIntent", "kind": "error"}, "of": {"featureId": "threadline.hubIntent"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.hubIntent", "kind": "fired"}, "of": {"featureId": "threadline.hubIntent"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.hubIntent", "kind": "error"}, "of": {"featureId": "threadline.hubIntent"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}, "aliases": []},
+    {"id": "threadline.inboundIdLedger", "title": "Inbound id ledger", "flag": {"path": "threadline.inboundIdLedger"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Machine-local SQLite plus /health counters; record fired per ledgered id and error per ledgerError in src/threadline/InboundIdLedger.ts (written bar: zero ledgerError for seven days; every dedupById explained stays for the review)."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.inboundIdLedger", "kind": "fired"}, "of": {"featureId": "threadline.inboundIdLedger"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.inboundIdLedger", "kind": "error"}, "of": {"featureId": "threadline.inboundIdLedger"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 3, "windowDays": 7}]}}, "aliases": []},
+    {"id": "threadline.localRouteSignature", "title": "Local route signature", "flag": {"path": "threadline.localRouteSignature", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "measured", "plan": "Its signature log shows it ran; the review grades sampled verdicts, since refusing a bad signature is correct and accepting everything would look clean."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"threadline.localRouteSignature.dryRun": false}}, "metrics": [{"id": "signature-verdicts", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/relay-agent-signature.jsonl", "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "graded-wrong", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.localRouteSignature", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "threadline.localRouteSignature", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.1, "minSamples": 5, "windowDays": 30}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "signature-verdicts", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/relay-agent-signature.jsonl", "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "graded-wrong", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.localRouteSignature", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "threadline.localRouteSignature", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.1, "minSamples": 5, "windowDays": 30}]}}, "aliases": []},
+    {"id": "threadline.localRouteTrust", "title": "Same-machine agent trust", "flag": {"path": "threadline.localRouteTrust", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "Only /health counters, which reset on restart; record fired per evaluated sender and error per would-refuse of a sender that should pass in src/threadline/localRouteTrust.ts."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"threadline.localRouteTrust.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.localRouteTrust", "kind": "fired"}, "of": {"featureId": "threadline.localRouteTrust"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.localRouteTrust", "kind": "error"}, "of": {"featureId": "threadline.localRouteTrust"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.localRouteTrust", "kind": "fired"}, "of": {"featureId": "threadline.localRouteTrust"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.localRouteTrust", "kind": "error"}, "of": {"featureId": "threadline.localRouteTrust"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
+    {"id": "threadline.peerDarkNotice", "title": "Peer dark notice", "flag": {"path": "threadline.peerDarkNotice"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "tracking": {"state": "measured", "plan": "Reads its own dark-pass rows, which come only when a peer goes dark; would-raise on a peer the presence map shows connected is a false alarm (21 of 30, none since 10-25), so it holds until those age out; live rows are raised, not would-raise."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"threadline.peerDarkNotice.dryRun": false}}, "metrics": [{"id": "would-raises", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/a2a-peer-dark.jsonl", "where": {"kind": "would-raise"}, "of": {"kind": "would-raise"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "false-alarm-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": ".instar/logs/a2a-peer-dark.jsonl", "where": {"kind": "would-raise", "connectedNow": true}, "of": {"kind": "would-raise"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.1, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/logs/a2a-peer-dark.jsonl", "where": {"dryRun": true, "kind": "error"}, "of": {"dryRun": true}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "raises", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/a2a-peer-dark.jsonl", "where": {"kind": "raised"}, "of": {"kind": "raised"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "false-alarm-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": ".instar/logs/a2a-peer-dark.jsonl", "where": {"kind": "raised", "connectedNow": true}, "of": {"kind": "raised"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.1, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/logs/a2a-peer-dark.jsonl", "where": {"dryRun": false, "kind": "error"}, "of": {"dryRun": false}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []},
+    {"id": "threadline.relayForward", "title": "A2A relay forward", "flag": {"path": "threadline.relayForward"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "Only /health counters, which reset on restart; record fired per forward executed and per reply injected and error per failed forward in src/threadline/relayForward.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.relayForward", "kind": "fired"}, "of": {"featureId": "threadline.relayForward"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.relayForward", "kind": "error"}, "of": {"featureId": "threadline.relayForward"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
+    {"id": "threadline.relayUnknownSenderTrust", "title": "Unknown agent trust", "flag": {"path": "threadline.relayUnknownSenderTrust", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "Only /health counters, which reset on restart; record fired per evaluated unknown sender and error per would-refuse of a sender that should pass in src/threadline/relayUnknownSenderTrust.ts."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"threadline.relayUnknownSenderTrust.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.relayUnknownSenderTrust", "kind": "fired"}, "of": {"featureId": "threadline.relayUnknownSenderTrust"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.relayUnknownSenderTrust", "kind": "error"}, "of": {"featureId": "threadline.relayUnknownSenderTrust"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.relayUnknownSenderTrust", "kind": "fired"}, "of": {"featureId": "threadline.relayUnknownSenderTrust"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.relayUnknownSenderTrust", "kind": "error"}, "of": {"featureId": "threadline.relayUnknownSenderTrust"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
+    {"id": "threadline.singleNegotiator", "title": "Single negotiator lease", "flag": {"path": "threadline.singleNegotiator"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Its verdicts go to dated threadline-negotiator-<date>.jsonl files a fixed-path metric cannot read; record fired per lease verdict and error per would-hold shown wrong or fail-open in src/threadline/NegotiatorGate.ts."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"threadline.singleNegotiator.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.singleNegotiator", "kind": "fired"}, "of": {"featureId": "threadline.singleNegotiator"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.singleNegotiator", "kind": "error"}, "of": {"featureId": "threadline.singleNegotiator"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.singleNegotiator", "kind": "fired"}, "of": {"featureId": "threadline.singleNegotiator"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.singleNegotiator", "kind": "error"}, "of": {"featureId": "threadline.singleNegotiator"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []},
+    {"id": "threadline.verifiedPairing", "title": "Verified agent pairing", "flag": {"path": "threadline.verifiedPairing"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Pairing state is in stores and it authorises credential sharing; record fired per completed pairing and error per failed verification at the pairing routes in src/server/routes.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.verifiedPairing", "kind": "fired"}, "of": {"featureId": "threadline.verifiedPairing"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.verifiedPairing", "kind": "error"}, "of": {"featureId": "threadline.verifiedPairing"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.verifiedPairing", "kind": "fired"}, "of": {"featureId": "threadline.verifiedPairing"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.verifiedPairing", "kind": "error"}, "of": {"featureId": "threadline.verifiedPairing"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}, "aliases": []},
+    {"id": "threadline.warmSessionA2A", "title": "Warm A2A sessions", "flag": {"path": "threadline.warmSessionA2A"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "No dedicated ledger; record fired per A2A delivery served by a warm session and error per failed warm delivery in the warm-session wiring in src/commands/server.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.warmSessionA2A", "kind": "fired"}, "of": {"featureId": "threadline.warmSessionA2A"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.warmSessionA2A", "kind": "error"}, "of": {"featureId": "threadline.warmSessionA2A"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []},
+    {"id": "toneGate.advisoryMigration", "title": "Tone gate advisory", "flag": {"path": "toneGate.advisoryMigration"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "Grades sit in dated judgment-provenance files; record fired per self-report tone grade (overrides and compliances, both must appear) and error per credential-wall false positive, near src/core/MessagingToneGate.ts (written bar: 50 grades in 14 days, zero false positives; never a quality rate)."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "toneGate.advisoryMigration", "kind": "fired"}, "of": {"featureId": "toneGate.advisoryMigration"}, "value": "count"}, "direction": "at-least", "threshold": 50, "minSamples": 50, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "toneGate.advisoryMigration", "kind": "error"}, "of": {"featureId": "toneGate.advisoryMigration"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 50, "windowDays": 14}]}}, "aliases": []},
+    {"id": "topicProfiles", "title": "Topic profiles", "flag": {"path": "topicProfiles"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads its own change log: applied respawns show the write path ran (27 in 14 days, none reverted), and a breaker revert means a pin broke a session; deferred-busy rows are ignored as noise."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "respawns-applied", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/topic-profile-changes.jsonl", "where": {"type": "respawn-applied"}, "of": {"type": "respawn-applied"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "breaker-revert-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/topic-profile-changes.jsonl", "where": {"type": "respawn-applied", "breakerRevert": true}, "of": {"type": "respawn-applied"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []}
+  ]
+}