instar 1.3.1649 → 1.3.1650

package/src/data/feature-ladders.json

@@ -2,14 +2,14 @@
   "schema": "feature-ladders/1",
   "entries": [
     {"id": "apprenticeship.stallCoverageGate", "title": "Stall coverage gate", "flag": {"path": "apprenticeship.stallCoverageGate", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "tracking": {"state": "measured", "plan": "The gate writes a stall-matrix row to .instar/logs/apprenticeship-decisions.jsonl on each onboarding transition, none yet because no apprenticeship instance has run; the review grades whether each would-refuse was right through POST /maturation/evidence."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "stall-matrix-decisions", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/apprenticeship-decisions.jsonl", "where": {"gate": "stall-matrix"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "apprenticeship.stallCoverageGate", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "apprenticeship.stallCoverageGate", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "stall-matrix-decisions", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/apprenticeship-decisions.jsonl", "where": {"gate": "stall-matrix"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "apprenticeship.stallCoverageGate", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "apprenticeship.stallCoverageGate", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}, "aliases": []},
-    {"id": "autonomousSessions.codexTaskContinuation", "title": "Codex task continuation", "flag": {"path": "autonomousSessions.codexTaskContinuation"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "aliases": ["autonomousSessions.codexTaskContinuation.preparationCarrierEnabled"], "tracking": {"state": "needed", "plan": "Preference candidate: it spends model capacity on each continuation; its audit lives inside the CodexTaskContinuationStore ledger, so add featureEvidence.record at each allow or refuse in src/core/CodexTaskContinuationStore.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "autonomousSessions.codexTaskContinuation", "kind": "fired"}, "of": {"featureId": "autonomousSessions.codexTaskContinuation"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "autonomousSessions.codexTaskContinuation", "kind": "error"}, "of": {"featureId": "autonomousSessions.codexTaskContinuation"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}]}}},
-    {"id": "autonomousSessions.geminiLoopDriver", "title": "Gemini loop driver", "flag": {"path": "autonomousSessions.geminiLoopDriver"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "No loop has ever run and nothing is logged, so add featureEvidence.record at each run end and failure in src/monitoring/GeminiLoopRunner.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "autonomousSessions.geminiLoopDriver", "kind": "fired"}, "of": {"featureId": "autonomousSessions.geminiLoopDriver"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "autonomousSessions.geminiLoopDriver", "kind": "error"}, "of": {"featureId": "autonomousSessions.geminiLoopDriver"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}]}}, "aliases": []},
+    {"id": "autonomousSessions.codexTaskContinuation", "title": "Codex task continuation", "flag": {"path": "autonomousSessions.codexTaskContinuation"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "aliases": ["autonomousSessions.codexTaskContinuation.preparationCarrierEnabled"], "tracking": {"state": "measured", "plan": "Preference candidate. Records its decisions to the shared evidence log from src/core/CodexTaskContinuationStore.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "autonomousSessions.codexTaskContinuation", "kind": "fired"}, "of": {"featureId": "autonomousSessions.codexTaskContinuation"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "autonomousSessions.codexTaskContinuation", "kind": "error"}, "of": {"featureId": "autonomousSessions.codexTaskContinuation"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}]}}},
+    {"id": "autonomousSessions.geminiLoopDriver", "title": "Gemini loop driver", "flag": {"path": "autonomousSessions.geminiLoopDriver"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/monitoring/GeminiLoopRunner.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "autonomousSessions.geminiLoopDriver", "kind": "fired"}, "of": {"featureId": "autonomousSessions.geminiLoopDriver"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "autonomousSessions.geminiLoopDriver", "kind": "error"}, "of": {"featureId": "autonomousSessions.geminiLoopDriver"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}]}}, "aliases": []},
     {"id": "cartographer", "title": "Code map", "flag": {"path": "cartographer"}, "disposition": "retire", "retire": {"reason": "Off on the development agent for 18 days with no user and two review extends; the review marked it retire-pending.", "ref": "feature-maturation-review row cartographer (verdict retire-pending)"}, "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "Nothing to log: the review retires this unless it finds a real user first."}, "rungs": {}, "aliases": ["cartographer.conformanceAudit.llmEnrichment + cartographer.subtreeNav.llmRerank"]},
     {"id": "cartographer.conformanceAudit", "title": "Conformance audit", "flag": {"path": "cartographer.conformanceAudit"}, "disposition": "retire", "retire": {"reason": "Its route needs the cartographer root, so it cannot run while the parent is off and retiring.", "ref": "src/server/routes.ts conformanceGate; feature-maturation-review row cartographer (retire-pending)"}, "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "Nothing to log: the review retires this unless it finds a real user first."}, "rungs": {}, "aliases": []},
     {"id": "cartographer.freshnessSweep", "title": "Freshness sweep", "flag": {"path": "cartographer.freshnessSweep"}, "disposition": "retire", "retire": {"reason": "Never enabled, costs third-party spend, and only refreshes the summaries of the retiring code map.", "ref": "feature-maturation-review rows cartographer (retire-pending) and cartographer.freshnessSweep"}, "final": "default-on", "risk": "sensitive", "tracking": {"state": "needed", "plan": "Nothing to log: the review retires this unless it finds a real user first."}, "rungs": {}, "aliases": []},
-    {"id": "commitments.agentOwnedFollowthrough", "title": "Agent owned followthrough", "flag": {"path": "commitments.agentOwnedFollowthrough"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "The aoft.* events have no listener and are lost, so persist them with a featureEvidence.record listener where PromiseBeacon is built in src/commands/server.ts, and the review grades whether each suppression hid something the user needed."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"commitments.agentOwnedFollowthrough.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "commitments.agentOwnedFollowthrough", "kind": "fired"}, "of": {"featureId": "commitments.agentOwnedFollowthrough"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "commitments.agentOwnedFollowthrough", "kind": "error"}, "of": {"featureId": "commitments.agentOwnedFollowthrough"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "commitments.agentOwnedFollowthrough", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "commitments.agentOwnedFollowthrough", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 30}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "commitments.agentOwnedFollowthrough", "kind": "fired"}, "of": {"featureId": "commitments.agentOwnedFollowthrough"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "commitments.agentOwnedFollowthrough", "kind": "error"}, "of": {"featureId": "commitments.agentOwnedFollowthrough"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "commitments.agentOwnedFollowthrough", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "commitments.agentOwnedFollowthrough", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 30}]}}, "aliases": []},
+    {"id": "commitments.agentOwnedFollowthrough", "title": "Agent owned followthrough", "flag": {"path": "commitments.agentOwnedFollowthrough"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/commands/server.ts."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"commitments.agentOwnedFollowthrough.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "commitments.agentOwnedFollowthrough", "kind": "fired"}, "of": {"featureId": "commitments.agentOwnedFollowthrough"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "commitments.agentOwnedFollowthrough", "kind": "error"}, "of": {"featureId": "commitments.agentOwnedFollowthrough"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "commitments.agentOwnedFollowthrough", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "commitments.agentOwnedFollowthrough", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 30}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "commitments.agentOwnedFollowthrough", "kind": "fired"}, "of": {"featureId": "commitments.agentOwnedFollowthrough"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "commitments.agentOwnedFollowthrough", "kind": "error"}, "of": {"featureId": "commitments.agentOwnedFollowthrough"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "commitments.agentOwnedFollowthrough", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "commitments.agentOwnedFollowthrough", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 30}]}}, "aliases": []},
     {"id": "commitments.autoExpiry", "title": "Old promise cleanup", "flag": {"path": "commitments.autoExpiry"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Each sweep writes a row to .instar/logs/commitments-auto-expiry.jsonl (about 72 KB a row, so the log holds only about 5 days and its windows stay short), and the review grades a sample of the would-expire list because the rule is no promise still in force."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"commitments.autoExpiry.dryRun": false}}, "metrics": [{"id": "sweeps", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/commitments-auto-expiry.jsonl", "where": {"dryRun": true}, "of": {"dryRun": true}, "value": "count"}, "direction": "at-least", "threshold": 6, "minSamples": 6, "windowDays": 3}, {"id": "capped-pass-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/logs/commitments-auto-expiry.jsonl", "where": {"capped": true}, "of": {"dryRun": true}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 6, "windowDays": 3}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "commitments.autoExpiry", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "commitments.autoExpiry", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 10, "windowDays": 30}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "live-sweeps", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/commitments-auto-expiry.jsonl", "where": {"dryRun": false}, "value": "count"}, "direction": "at-least", "threshold": 6, "minSamples": 6, "windowDays": 3}, {"id": "capped-pass-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/logs/commitments-auto-expiry.jsonl", "where": {"capped": true}, "of": {"dryRun": false}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 6, "windowDays": 3}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "commitments.autoExpiry", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "commitments.autoExpiry", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 10, "windowDays": 30}]}}, "aliases": []},
-    {"id": "conversationIdentity.followThrough", "title": "Slack promise delivery", "flag": {"path": "conversationIdentity.followThrough"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "No Slack conversation has been minted here, so delivery has never run and writes only a console line; add featureEvidence.record on each delivered and failed id<0 outcome in src/core/deliverToConversation.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "conversationIdentity.followThrough", "kind": "fired"}, "of": {"featureId": "conversationIdentity.followThrough"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "conversationIdentity.followThrough", "kind": "error"}, "of": {"featureId": "conversationIdentity.followThrough"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}]}}, "aliases": []},
+    {"id": "conversationIdentity.followThrough", "title": "Slack promise delivery", "flag": {"path": "conversationIdentity.followThrough"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/deliverToConversation.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "conversationIdentity.followThrough", "kind": "fired"}, "of": {"featureId": "conversationIdentity.followThrough"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "conversationIdentity.followThrough", "kind": "error"}, "of": {"featureId": "conversationIdentity.followThrough"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}]}}, "aliases": []},
     {"id": "dashboard.liveInsights", "title": "Live dashboard insights", "flag": {"path": "dashboard.liveInsights"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Each insight is one DashboardInsightEngine call in the feature metrics, which gives real call counts and error rate."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "llm-calls", "role": "ran", "source": "feature-metrics", "ref": {"feature": "DashboardInsightEngine", "field": "realLlmCalls"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "feature-metrics", "ref": {"feature": "DashboardInsightEngine", "field": "errorRate"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []},
     {"id": "ecosystemIdeas", "title": "Ecosystem idea pipeline", "flag": {"path": "ecosystemIdeas"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "measured", "plan": "Preference candidate: its spec keeps it opt-in on the fleet because it needs source roots and costs tokens; .instar/logs/ecosystem-ideas.jsonl has a run row per run, and a zero-token run did no review work, which is all 46 runs since 11-02 (stopped by the source-tree guard), so it reads as failing today."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "runs", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/ecosystem-ideas.jsonl", "where": {"event": "run"}, "of": {"event": "run"}, "value": "count"}, "direction": "at-least", "threshold": 4, "minSamples": 4, "windowDays": 30}, {"id": "review-calls", "role": "ran", "source": "feature-metrics", "ref": {"feature": "EcosystemIdeaReview", "field": "realLlmCalls"}, "direction": "at-least", "threshold": 4, "minSamples": 4, "windowDays": 30}, {"id": "graded-wrong", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "ecosystemIdeas", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "ecosystemIdeas", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.1, "minSamples": 5, "windowDays": 30}]}}, "aliases": []},
     {"id": "evolutionActions.autoExpiry", "title": "Old action cleanup", "flag": {"path": "evolutionActions.autoExpiry"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Each sweep writes a row to .instar/logs/evolution-actions-auto-expiry.jsonl, and the review grades a sample of the would-expire list because the rule is no real unfinished work."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"evolutionActions.autoExpiry.dryRun": false}}, "metrics": [{"id": "sweeps", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/evolution-actions-auto-expiry.jsonl", "where": {"dryRun": true}, "of": {"dryRun": true}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "evolutionActions.autoExpiry", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "evolutionActions.autoExpiry", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 10, "windowDays": 30}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "live-sweeps", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/evolution-actions-auto-expiry.jsonl", "where": {"dryRun": false}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "evolutionActions.autoExpiry", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "evolutionActions.autoExpiry", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 10, "windowDays": 30}]}}, "aliases": []},
@@ -19,9 +19,9 @@
     {"id": "feedbackFactory.execute", "title": "Feedback executor", "flag": {"path": "feedbackFactory.execute"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "tracking": {"state": "measured", "plan": "Preference candidate: its spec limits it to operated feedback hosts with a source checkout; execute:* rows in .instar/logs/feedback-triage.jsonl count spawns, failed prepares and PRs closed by review, and both rates are above the default bar today (39 of 137, 8 of 14)."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "spawned", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/feedback-triage.jsonl", "where": {"event": "execute:spawned"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "prepare-failure-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/logs/feedback-triage.jsonl", "where": {"event": "execute:prepare-failed"}, "of": {"event": "execute:claimed"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}, {"id": "review-closed-rate", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/feedback-triage.jsonl", "where": {"event": "execute:review-failed-closed"}, "of": {"event": "execute:independent-review"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 30}, {"id": "graded-wrong", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "feedbackFactory.execute", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "feedbackFactory.execute", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.1, "minSamples": 5, "windowDays": 30}]}}, "aliases": []},
     {"id": "feedbackFactory.processing", "title": "Feedback clustering", "flag": {"path": "feedbackFactory.processing"}, "disposition": "composed", "composedInto": "feedbackFactory.drain", "final": "default-on", "risk": "standard", "tracking": {"state": "measured", "plan": "Moves with the drain, which reads the store this pass clusters; the review treats the three as one row."}, "rungs": {}, "aliases": []},
     {"id": "feedbackFactory.triage", "title": "Feedback triage", "flag": {"path": "feedbackFactory.triage"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "decision rows in .instar/logs/feedback-triage.jsonl and FeedbackTriageArbiter metrics are real, while the spec bar (30+ medium or strong grades, 10% wrong or less) lives in the triage_grades table, so mirror it with featureEvidence.record in FeedbackTriageStore.recordGrade."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "decisions", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/feedback-triage.jsonl", "where": {"event": "decision"}, "value": "count"}, "direction": "at-least", "threshold": 200, "minSamples": 200, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "feature-metrics", "ref": {"feature": "FeedbackTriageArbiter", "field": "errorRate"}, "direction": "at-most", "threshold": 0.05, "minSamples": 50, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "feedbackFactory.triage", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "feedbackFactory.triage", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.1, "minSamples": 30, "windowDays": 30}]}}, "aliases": []},
-    {"id": "intelligence.degradationLadder.backoff", "title": "Rate limit backoff", "flag": {"path": "intelligence.degradationLadder.backoff"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Nothing records a backoff, so add featureEvidence.record in src/core/IntelligenceRouter.ts at each backoff wait, with fired on a retry that worked and error on one that did not."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "intelligence.degradationLadder.backoff", "kind": "fired"}, "of": {"featureId": "intelligence.degradationLadder.backoff"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "intelligence.degradationLadder.backoff", "kind": "error"}, "of": {"featureId": "intelligence.degradationLadder.backoff"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}]}}, "aliases": ["intelligence.degradationLadder (backoff, queue, neverSilent)"]},
-    {"id": "intelligence.degradationLadder.neverSilent", "title": "Degradation tracking", "flag": {"path": "intelligence.degradationLadder.neverSilent"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Open degradations live in an in-memory map, so add featureEvidence.record in DegradationReporter at each open, resolve and escalation, with error on an escalation."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "intelligence.degradationLadder.neverSilent", "kind": "fired"}, "of": {"featureId": "intelligence.degradationLadder.neverSilent"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "intelligence.degradationLadder.neverSilent", "kind": "error"}, "of": {"featureId": "intelligence.degradationLadder.neverSilent"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}, "rare": true, "aliases": []},
-    {"id": "intelligence.degradationLadder.queue", "title": "Deferred call queue", "flag": {"path": "intelligence.degradationLadder.queue"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Nothing records this rung, so add featureEvidence.record in src/core/IntelligenceRouter.ts where a deferrable call enters the queue, with error on an enqueue rejection or queued-call failure."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "intelligence.degradationLadder.queue", "kind": "fired"}, "of": {"featureId": "intelligence.degradationLadder.queue"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "intelligence.degradationLadder.queue", "kind": "error"}, "of": {"featureId": "intelligence.degradationLadder.queue"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}, "rare": true, "aliases": []},
+    {"id": "intelligence.degradationLadder.backoff", "title": "Rate limit backoff", "flag": {"path": "intelligence.degradationLadder.backoff"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/IntelligenceRouter.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "intelligence.degradationLadder.backoff", "kind": "fired"}, "of": {"featureId": "intelligence.degradationLadder.backoff"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "intelligence.degradationLadder.backoff", "kind": "error"}, "of": {"featureId": "intelligence.degradationLadder.backoff"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}]}}, "aliases": ["intelligence.degradationLadder (backoff, queue, neverSilent)"]},
+    {"id": "intelligence.degradationLadder.neverSilent", "title": "Degradation tracking", "flag": {"path": "intelligence.degradationLadder.neverSilent"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/monitoring/DegradationReporter.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "intelligence.degradationLadder.neverSilent", "kind": "fired"}, "of": {"featureId": "intelligence.degradationLadder.neverSilent"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "intelligence.degradationLadder.neverSilent", "kind": "error"}, "of": {"featureId": "intelligence.degradationLadder.neverSilent"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}, "rare": true, "aliases": []},
+    {"id": "intelligence.degradationLadder.queue", "title": "Deferred call queue", "flag": {"path": "intelligence.degradationLadder.queue"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/IntelligenceRouter.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "intelligence.degradationLadder.queue", "kind": "fired"}, "of": {"featureId": "intelligence.degradationLadder.queue"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "intelligence.degradationLadder.queue", "kind": "error"}, "of": {"featureId": "intelligence.degradationLadder.queue"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}, "rare": true, "aliases": []},
     {"id": "intelligence.jevCirclesShadow", "title": "Jev circles shadow", "flag": {"path": "intelligence.jevCirclesShadow"}, "disposition": "retire", "retire": {"reason": "Retired by the Jev review: about 1 in 10 would-nudges were real loops, nothing consumes it, and it cost about 10M Jev tokens a week.", "ref": "CMT-1035, Jev review 2026-10-29, recorded in Echo config changeReason"}, "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "Nothing to log: the review retires this unless it finds a real user first."}, "rungs": {}, "aliases": []},
     {"id": "intelligence.jevCorrectionShadow", "title": "Jev correction shadow", "flag": {"path": "intelligence.jevCorrectionShadow"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "aliases": ["intelligence.jevCorrectionShadow (+ feedSentinel)"], "tracking": {"state": "measured", "plan": "logs/jev-correction-shadow.jsonl has a check row per inbound message and a skipped row per failure, and the jev-correction-shadow metric gives its error rate."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "checks", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/jev-correction-shadow.jsonl", "where": {"kind": "check"}, "value": "count"}, "direction": "at-least", "threshold": 100, "minSamples": 100, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "feature-metrics", "ref": {"feature": "jev-correction-shadow", "field": "errorRate"}, "direction": "at-most", "threshold": 0.05, "minSamples": 50, "windowDays": 14}]}}},
     {"id": "intelligence.jevCorrectionShadow.feedSentinel", "title": "Jev correction feed", "flag": {"path": "intelligence.jevCorrectionShadow.feedSentinel"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "measured", "plan": "The correction sentinel writes each Jev-fed signal to .instar/logs/correction-learning-audit.jsonl with trigger jev, and its own noise verdict is an outside judgement of the feed."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fed-and-recorded", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/correction-learning-audit.jsonl", "where": {"trigger": "jev", "decision": "recorded"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "noise-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": ".instar/logs/correction-learning-audit.jsonl", "where": {"trigger": "jev", "decision": "noise"}, "of": {"trigger": "jev"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []},
@@ -29,163 +29,163 @@
     {"id": "intelligence.jevMemoryPicker", "title": "Jev memory picker", "flag": {"path": "intelligence.jevMemoryPicker"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "measured", "plan": "logs/jev-memory-picker.jsonl has a row per session start and most skip because the index fits, so ran counts only ranked rows; it stays in shadow mode, and turning on inject is a separate decision for the review."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "ranked", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/jev-memory-picker.jsonl", "where": {"outcome": "ranked"}, "value": "count"}, "direction": "at-least", "threshold": 100, "minSamples": 100, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "feature-metrics", "ref": {"feature": "jev-memory-picker", "field": "errorRate"}, "direction": "at-most", "threshold": 0.05, "minSamples": 50, "windowDays": 14}]}}, "aliases": []},
     {"id": "intelligence.jevSignalLive", "title": "Jev signal live", "flag": {"path": "intelligence.jevSignalLive"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "measured", "plan": "Preference candidate: its spec needs an operator decision for the fleet because every reviewed outbound message would go to TypeSafe; logs/jev-signal-shadow.jsonl has a compared or not-compared row per check, while the referee comparison in its spec is read from the report rather than a threshold here."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "compared", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/jev-signal-shadow.jsonl", "where": {"kind": "compared"}, "value": "count"}, "direction": "at-least", "threshold": 1000, "minSamples": 1000, "windowDays": 14}, {"id": "not-compared-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/jev-signal-shadow.jsonl", "where": {"kind": "not-compared"}, "of": {"kind": "compared"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1000, "windowDays": 14}]}}, "aliases": []},
     {"id": "jobs.scriptRunners", "title": "Job script runners", "flag": {"path": "jobs.scriptRunners"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "aliases": ["jobs.scriptRunners + job supervision"], "tracking": {"state": "measured", "plan": "The must-fail canaries write to logs/job-anomaly.jsonl (at least 42 a week means all six variants daily, and the spec needs all passing), while the rest of its bar stays in the job-cost report because .instar/ledger/job-runs.jsonl is outside the readable paths."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "canary-runs", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/job-anomaly.jsonl", "where": {"kind": "script-canary"}, "value": "count"}, "direction": "at-least", "threshold": 42, "minSamples": 42, "windowDays": 7}, {"id": "canary-failure-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/job-anomaly.jsonl", "where": {"kind": "script-canary", "passed": false}, "of": {"kind": "script-canary"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 42, "windowDays": 7}]}}},
-    {"id": "jobs.scriptTriage.jev", "title": "Job result triage", "flag": {"path": "jobs.scriptTriage.jev"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "logs/job-triage.jsonl does not exist on this machine and job-result-triage has no metric rows yet, so add featureEvidence.record at each Jev verdict and failure in src/scheduler/JobResultTriage.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "jobs.scriptTriage.jev", "kind": "fired"}, "of": {"featureId": "jobs.scriptTriage.jev"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "jobs.scriptTriage.jev", "kind": "error"}, "of": {"featureId": "jobs.scriptTriage.jev"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "jobs.scriptTriage.jev", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "jobs.scriptTriage.jev", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 30}]}}, "aliases": []},
+    {"id": "jobs.scriptTriage.jev", "title": "Job result triage", "flag": {"path": "jobs.scriptTriage.jev"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/scheduler/JobResultTriage.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "jobs.scriptTriage.jev", "kind": "fired"}, "of": {"featureId": "jobs.scriptTriage.jev"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "jobs.scriptTriage.jev", "kind": "error"}, "of": {"featureId": "jobs.scriptTriage.jev"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "jobs.scriptTriage.jev", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "jobs.scriptTriage.jev", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 30}]}}, "aliases": []},
     {"id": "machineMaintenance", "title": "Machine self maintenance", "flag": {"path": "machineMaintenance"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "measured", "plan": "logs/machine-drain.jsonl writes one closed row per paper drain (two so far, since 11-02), and the spec bar of 14 nights is the threshold; its other checks and the fleet phase stay with GET /machine-maintenance and the review."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "rehearsal-nights", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/machine-drain.jsonl", "where": {"type": "closed"}, "of": {"type": "closed"}, "value": "count"}, "direction": "at-least", "threshold": 14, "minSamples": 14, "windowDays": 30}, {"id": "opened-late-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/machine-drain.jsonl", "where": {"type": "closed", "openedLate": true}, "of": {"type": "closed"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 14, "windowDays": 30}]}}, "aliases": []},
     {"id": "maturation.ladder", "title": "Measured path to default-on", "aliases": ["feature-maturation-ladder"], "flag": {"path": "maturation.ladder"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "measured", "plan": "Its audit log records each raise, rung change and move; the review grades moves through the evidence route."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "raises-and-moves", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/maturation-advances.jsonl", "where": {"action": "raise"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "failed-moves", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/maturation-advances.jsonl", "where": {"action": "move-failed"}, "value": "count"}, "direction": "at-most", "threshold": 0, "minSamples": 3, "windowDays": 14}, {"id": "wrong-graded-moves", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "maturation.ladder", "outcome": "wrong"}, "of": {"featureId": "maturation.ladder"}, "value": "count"}, "direction": "at-most", "threshold": 0, "minSamples": 1, "windowDays": 14}]}}},
     {"id": "maturationBoard", "title": "Maturation board", "flag": {"path": "maturationBoard"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "The board stores nothing, so the weekly review records one fired row per run with the parity result through POST /maturation/evidence, and an error row when parity fails (the spec needs two clean reviews)."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "maturationBoard", "kind": "fired"}, "of": {"featureId": "maturationBoard"}, "value": "count"}, "direction": "at-least", "threshold": 2, "minSamples": 2, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "maturationBoard", "kind": "error"}, "of": {"featureId": "maturationBoard"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 2, "windowDays": 14}]}}, "aliases": []},
-    {"id": "mentee", "title": "Mentee receiver", "flag": {"path": "mentee"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Preference candidate: it needs a per-deployment mentor allowlist and stays inert without one; add featureEvidence.record in installMentorMessageHook in src/server/AgentServer.ts at each handled mentor message and failure."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentee", "kind": "fired"}, "of": {"featureId": "mentee"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentee", "kind": "error"}, "of": {"featureId": "mentee"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentee", "kind": "fired"}, "of": {"featureId": "mentee"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentee", "kind": "error"}, "of": {"featureId": "mentee"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}, "aliases": []},
-    {"id": "mentor", "title": "Agent mentor", "flag": {"path": "mentor"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Preference candidate: it spends on each round and needs per-deployment bot and mentee setup; add featureEvidence.record at each round end and failure in src/scheduler/MentorOnboardingRunner.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentor", "kind": "fired"}, "of": {"featureId": "mentor"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentor", "kind": "error"}, "of": {"featureId": "mentor"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentor", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "mentor", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 5, "windowDays": 30}]}}, "aliases": []},
-    {"id": "mentor.autonomousFix", "title": "Mentor autonomous fix", "flag": {"path": "mentor.autonomousFix"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Preference candidate: it starts full-tool Opus sessions with ongoing spend; add featureEvidence.record at each fix cycle end and failure in src/scheduler/MentorAutonomousGuardian.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentor.autonomousFix", "kind": "fired"}, "of": {"featureId": "mentor.autonomousFix"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentor.autonomousFix", "kind": "error"}, "of": {"featureId": "mentor.autonomousFix"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentor.autonomousFix", "kind": "fired"}, "of": {"featureId": "mentor.autonomousFix"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentor.autonomousFix", "kind": "error"}, "of": {"featureId": "mentor.autonomousFix"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}, "aliases": []},
-    {"id": "messaging.actionClaim.slack", "title": "Slack action claims", "flag": {"path": "messaging.actionClaim.slack"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "The route in src/server/routes.ts writes logs/action-claim-observe.jsonl but that file does not exist yet, and the route defaults slack.dryRun to true even when config omits it, so add featureEvidence.record beside that write."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"messaging.actionClaim.slack.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "messaging.actionClaim.slack", "kind": "fired"}, "of": {"featureId": "messaging.actionClaim.slack"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "messaging.actionClaim.slack", "kind": "error"}, "of": {"featureId": "messaging.actionClaim.slack"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "messaging.actionClaim.slack", "kind": "fired"}, "of": {"featureId": "messaging.actionClaim.slack"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "messaging.actionClaim.slack", "kind": "error"}, "of": {"featureId": "messaging.actionClaim.slack"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}]}}, "aliases": []},
-    {"id": "messaging.outboundAdvisory.timeClaim", "title": "Time claim advisory", "flag": {"path": "messaging.outboundAdvisory.timeClaim"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "logs/outbound-advisory.jsonl keeps the TIME_CLAIM code inside a nested advisories list that a flat match cannot read, so add featureEvidence.record in src/server/routes.ts where it advises, and the review grades false positives, which nothing records today."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "messaging.outboundAdvisory.timeClaim", "kind": "fired"}, "of": {"featureId": "messaging.outboundAdvisory.timeClaim"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "messaging.outboundAdvisory.timeClaim", "kind": "error"}, "of": {"featureId": "messaging.outboundAdvisory.timeClaim"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "messaging.outboundAdvisory.timeClaim", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "messaging.outboundAdvisory.timeClaim", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 5, "windowDays": 30}]}}, "aliases": []},
-    {"id": "mobilePairing", "title": "Mobile pairing", "flag": {"path": "mobilePairing"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "The device-key ledger sits outside the readable paths, so add featureEvidence.record in src/server/mobilePairingRoutes.ts at each pairing redeem, confirm, revoke and refusal, with no key material in the row."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mobilePairing", "kind": "fired"}, "of": {"featureId": "mobilePairing"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mobilePairing", "kind": "error"}, "of": {"featureId": "mobilePairing"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}]}}, "aliases": []},
-    {"id": "mobilePairing.multiRoute", "title": "Mobile multiple routes", "flag": {"path": "mobilePairing.multiRoute"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Spec bar is a week with no device-auth refusal on an own name, so add featureEvidence.record in src/server/mobilePairingRoutes.ts with fired per accepted signature by route and error per refusal; its Remote Desktop timing goes in that row context."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mobilePairing.multiRoute", "kind": "fired"}, "of": {"featureId": "mobilePairing.multiRoute"}, "value": "count"}, "direction": "at-least", "threshold": 7, "minSamples": 7, "windowDays": 7}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mobilePairing.multiRoute", "kind": "error"}, "of": {"featureId": "mobilePairing.multiRoute"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 7, "windowDays": 7}]}}, "aliases": []},
-    {"id": "mobilePairing.native", "title": "Native app conversations", "flag": {"path": "mobilePairing.native"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Spec bar is a week of daily use with no lost or duplicated message and no failed verdict on a genuine one, so add featureEvidence.record in src/server/mobileConversationRoutes.ts with fired per message and error per loss, duplicate or failed verdict."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mobilePairing.native", "kind": "fired"}, "of": {"featureId": "mobilePairing.native"}, "value": "count"}, "direction": "at-least", "threshold": 7, "minSamples": 7, "windowDays": 7}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mobilePairing.native", "kind": "error"}, "of": {"featureId": "mobilePairing.native"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 7, "windowDays": 7}]}}, "aliases": []},
-    {"id": "mobilePairing.native.media", "title": "Native app media", "flag": {"path": "mobilePairing.native.media"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Spec bar is a week of daily media use with no lost or corrupt file and no quarantined blob, so add featureEvidence.record in src/server/mobileMediaRoutes.ts with fired per file sent and error per failure of those."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mobilePairing.native.media", "kind": "fired"}, "of": {"featureId": "mobilePairing.native.media"}, "value": "count"}, "direction": "at-least", "threshold": 7, "minSamples": 7, "windowDays": 7}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mobilePairing.native.media", "kind": "error"}, "of": {"featureId": "mobilePairing.native.media"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 7, "windowDays": 7}]}}, "aliases": []},
+    {"id": "mentee", "title": "Mentee receiver", "flag": {"path": "mentee"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Preference candidate. Records its decisions to the shared evidence log from src/server/AgentServer.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentee", "kind": "fired"}, "of": {"featureId": "mentee"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentee", "kind": "error"}, "of": {"featureId": "mentee"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentee", "kind": "fired"}, "of": {"featureId": "mentee"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentee", "kind": "error"}, "of": {"featureId": "mentee"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}, "aliases": []},
+    {"id": "mentor", "title": "Agent mentor", "flag": {"path": "mentor"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Preference candidate. Records its decisions to the shared evidence log from src/scheduler/MentorOnboardingRunner.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentor", "kind": "fired"}, "of": {"featureId": "mentor"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentor", "kind": "error"}, "of": {"featureId": "mentor"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentor", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "mentor", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 5, "windowDays": 30}]}}, "aliases": []},
+    {"id": "mentor.autonomousFix", "title": "Mentor autonomous fix", "flag": {"path": "mentor.autonomousFix"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Preference candidate. Records its decisions to the shared evidence log from src/scheduler/MentorOnboardingRunner.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentor.autonomousFix", "kind": "fired"}, "of": {"featureId": "mentor.autonomousFix"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentor.autonomousFix", "kind": "error"}, "of": {"featureId": "mentor.autonomousFix"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentor.autonomousFix", "kind": "fired"}, "of": {"featureId": "mentor.autonomousFix"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mentor.autonomousFix", "kind": "error"}, "of": {"featureId": "mentor.autonomousFix"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}, "aliases": []},
+    {"id": "messaging.actionClaim.slack", "title": "Slack action claims", "flag": {"path": "messaging.actionClaim.slack"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/server/routes.ts."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"messaging.actionClaim.slack.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "messaging.actionClaim.slack", "kind": "fired"}, "of": {"featureId": "messaging.actionClaim.slack"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "messaging.actionClaim.slack", "kind": "error"}, "of": {"featureId": "messaging.actionClaim.slack"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "messaging.actionClaim.slack", "kind": "fired"}, "of": {"featureId": "messaging.actionClaim.slack"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "messaging.actionClaim.slack", "kind": "error"}, "of": {"featureId": "messaging.actionClaim.slack"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}]}}, "aliases": []},
+    {"id": "messaging.outboundAdvisory.timeClaim", "title": "Time claim advisory", "flag": {"path": "messaging.outboundAdvisory.timeClaim"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/server/routes.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "messaging.outboundAdvisory.timeClaim", "kind": "fired"}, "of": {"featureId": "messaging.outboundAdvisory.timeClaim"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "messaging.outboundAdvisory.timeClaim", "kind": "error"}, "of": {"featureId": "messaging.outboundAdvisory.timeClaim"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "messaging.outboundAdvisory.timeClaim", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "messaging.outboundAdvisory.timeClaim", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 5, "windowDays": 30}]}}, "aliases": []},
+    {"id": "mobilePairing", "title": "Mobile pairing", "flag": {"path": "mobilePairing"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/server/mobilePairingRoutes.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mobilePairing", "kind": "fired"}, "of": {"featureId": "mobilePairing"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mobilePairing", "kind": "error"}, "of": {"featureId": "mobilePairing"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 14}]}}, "aliases": []},
+    {"id": "mobilePairing.multiRoute", "title": "Mobile multiple routes", "flag": {"path": "mobilePairing.multiRoute"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/server/mobilePairingRoutes.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mobilePairing.multiRoute", "kind": "fired"}, "of": {"featureId": "mobilePairing.multiRoute"}, "value": "count"}, "direction": "at-least", "threshold": 7, "minSamples": 7, "windowDays": 7}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mobilePairing.multiRoute", "kind": "error"}, "of": {"featureId": "mobilePairing.multiRoute"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 7, "windowDays": 7}]}}, "aliases": []},
+    {"id": "mobilePairing.native", "title": "Native app conversations", "flag": {"path": "mobilePairing.native"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/server/mobileConversationRoutes.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mobilePairing.native", "kind": "fired"}, "of": {"featureId": "mobilePairing.native"}, "value": "count"}, "direction": "at-least", "threshold": 7, "minSamples": 7, "windowDays": 7}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mobilePairing.native", "kind": "error"}, "of": {"featureId": "mobilePairing.native"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 7, "windowDays": 7}]}}, "aliases": []},
+    {"id": "mobilePairing.native.media", "title": "Native app media", "flag": {"path": "mobilePairing.native.media"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/server/mobileConversationRoutes.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mobilePairing.native.media", "kind": "fired"}, "of": {"featureId": "mobilePairing.native.media"}, "value": "count"}, "direction": "at-least", "threshold": 7, "minSamples": 7, "windowDays": 7}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "mobilePairing.native.media", "kind": "error"}, "of": {"featureId": "mobilePairing.native.media"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 7, "windowDays": 7}]}}, "aliases": []},
     {"id": "models.tierEscalation", "title": "Model tier escalation", "flag": {"path": "models.tierEscalation"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "aliases": ["models.tierEscalation (+ .dryRun)", "models.tierEscalation.ridesTopic", "models.tierEscalation.dryRun"], "tracking": {"state": "measured", "plan": "Preference candidate: turning it on raises cost; its audit log has a row per injected swap and whether it was confirmed, with no rows since 10-28, and 179 of 243 swaps went unconfirmed before that."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "swaps-confirmed", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/state/model-tier-escalation/audit.jsonl", "where": {"type": "swap-confirmed"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "swap-unconfirmed-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/state/model-tier-escalation/audit.jsonl", "where": {"type": "swap-unconfirmed"}, "of": {"type": "injected"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "swaps-confirmed", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/state/model-tier-escalation/audit.jsonl", "where": {"type": "swap-confirmed"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "swap-unconfirmed-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/state/model-tier-escalation/audit.jsonl", "where": {"type": "swap-unconfirmed"}, "of": {"type": "injected"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
     {"id": "monitoring.agentSleep", "title": "Agent sleep", "flag": {"path": "monitoring.agentSleep"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": ".instar/logs/agent-sleep-events.jsonl gets a row on each decision change when it runs (one so far, from 10-22), the sleep and respawn mechanism is still a later slice, and the review grades whether each would-sleep was safe."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "sleep-decision-changes", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/agent-sleep-events.jsonl", "where": {"dryRun": true}, "of": {"dryRun": true}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.agentSleep", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.agentSleep", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 5, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "live-sleep-decision-changes", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/agent-sleep-events.jsonl", "where": {"dryRun": false}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.agentSleep", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.agentSleep", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 5, "windowDays": 30}]}}, "aliases": []},
-    {"id": "monitoring.agentWorktreeReaper", "title": "Agent worktree reaper", "flag": {"path": "monitoring.agentWorktreeReaper"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "It only emits events and keeps a counter, and .instar/state/reclaimed-worktrees.jsonl belongs to another writer, so add featureEvidence.record per pass in src/monitoring/AgentWorktreeReaper.ts, and the review checks that no reaped worktree held wanted work."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.agentWorktreeReaper", "kind": "fired"}, "of": {"featureId": "monitoring.agentWorktreeReaper"}, "value": "count"}, "direction": "at-least", "threshold": 7, "minSamples": 7, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.agentWorktreeReaper", "kind": "error"}, "of": {"featureId": "monitoring.agentWorktreeReaper"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 7, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.agentWorktreeReaper", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.agentWorktreeReaper", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 5, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.agentWorktreeReaper", "kind": "fired"}, "of": {"featureId": "monitoring.agentWorktreeReaper"}, "value": "count"}, "direction": "at-least", "threshold": 7, "minSamples": 7, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.agentWorktreeReaper", "kind": "error"}, "of": {"featureId": "monitoring.agentWorktreeReaper"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 7, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.agentWorktreeReaper", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.agentWorktreeReaper", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 5, "windowDays": 30}]}}, "aliases": []},
-    {"id": "monitoring.apprenticeshipCycleSla", "title": "Apprenticeship cycle watch", "flag": {"path": "monitoring.apprenticeshipCycleSla"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "No cycle has ever been recorded and the monitor writes no log, so add featureEvidence.record in src/monitoring/ApprenticeshipCycleSlaMonitor.ts at each overdue raise and failure."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.apprenticeshipCycleSla", "kind": "fired"}, "of": {"featureId": "monitoring.apprenticeshipCycleSla"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.apprenticeshipCycleSla", "kind": "error"}, "of": {"featureId": "monitoring.apprenticeshipCycleSla"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.apprenticeshipCycleSla", "kind": "fired"}, "of": {"featureId": "monitoring.apprenticeshipCycleSla"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.apprenticeshipCycleSla", "kind": "error"}, "of": {"featureId": "monitoring.apprenticeshipCycleSla"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}, "aliases": []},
-    {"id": "monitoring.authorizationRequests", "title": "Authorization requests", "flag": {"path": "monitoring.authorizationRequests"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "It has never been used on this agent and writes no log, so add featureEvidence.record in the /authorization-requests routes in src/server/routes.ts at each create, approve and refusal, with no PIN or grant secret in the row."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.authorizationRequests", "kind": "fired"}, "of": {"featureId": "monitoring.authorizationRequests"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.authorizationRequests", "kind": "error"}, "of": {"featureId": "monitoring.authorizationRequests"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}, "aliases": []},
-    {"id": "monitoring.autonomousHeartbeat", "title": "Autonomous heartbeat", "flag": {"path": "monitoring.autonomousHeartbeat"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "start": {"set": {"monitoring.autonomousHeartbeat.enabled": true, "monitoring.autonomousHeartbeat.dryRun": true}}, "restartNeeded": true, "tracking": {"state": "needed", "plan": "It only emits would-emit, emitted and send-error events with no log, so add a featureEvidence.record listener where it is built in src/commands/server.ts, and the review grades each emit because its spec bar is 3 dry-run days with no false or wedge-class emit."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"monitoring.autonomousHeartbeat.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.autonomousHeartbeat", "kind": "fired"}, "of": {"featureId": "monitoring.autonomousHeartbeat"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.autonomousHeartbeat", "kind": "error"}, "of": {"featureId": "monitoring.autonomousHeartbeat"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}, {"id": "wrong-graded-count", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.autonomousHeartbeat", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.autonomousHeartbeat"}, "value": "count"}, "direction": "at-most", "threshold": 0, "minSamples": 1, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.autonomousHeartbeat", "kind": "fired"}, "of": {"featureId": "monitoring.autonomousHeartbeat"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.autonomousHeartbeat", "kind": "error"}, "of": {"featureId": "monitoring.autonomousHeartbeat"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}, {"id": "wrong-graded-count", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.autonomousHeartbeat", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.autonomousHeartbeat"}, "value": "count"}, "direction": "at-most", "threshold": 0, "minSamples": 1, "windowDays": 14}]}}, "aliases": []},
+    {"id": "monitoring.agentWorktreeReaper", "title": "Agent worktree reaper", "flag": {"path": "monitoring.agentWorktreeReaper"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/monitoring/AgentWorktreeReaper.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.agentWorktreeReaper", "kind": "fired"}, "of": {"featureId": "monitoring.agentWorktreeReaper"}, "value": "count"}, "direction": "at-least", "threshold": 7, "minSamples": 7, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.agentWorktreeReaper", "kind": "error"}, "of": {"featureId": "monitoring.agentWorktreeReaper"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 7, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.agentWorktreeReaper", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.agentWorktreeReaper", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 5, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.agentWorktreeReaper", "kind": "fired"}, "of": {"featureId": "monitoring.agentWorktreeReaper"}, "value": "count"}, "direction": "at-least", "threshold": 7, "minSamples": 7, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.agentWorktreeReaper", "kind": "error"}, "of": {"featureId": "monitoring.agentWorktreeReaper"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 7, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.agentWorktreeReaper", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.agentWorktreeReaper", "kind": "outcome"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 5, "windowDays": 30}]}}, "aliases": []},
+    {"id": "monitoring.apprenticeshipCycleSla", "title": "Apprenticeship cycle watch", "flag": {"path": "monitoring.apprenticeshipCycleSla"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/monitoring/ApprenticeshipCycleSlaMonitor.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.apprenticeshipCycleSla", "kind": "fired"}, "of": {"featureId": "monitoring.apprenticeshipCycleSla"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.apprenticeshipCycleSla", "kind": "error"}, "of": {"featureId": "monitoring.apprenticeshipCycleSla"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.apprenticeshipCycleSla", "kind": "fired"}, "of": {"featureId": "monitoring.apprenticeshipCycleSla"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.apprenticeshipCycleSla", "kind": "error"}, "of": {"featureId": "monitoring.apprenticeshipCycleSla"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}, "aliases": []},
+    {"id": "monitoring.authorizationRequests", "title": "Authorization requests", "flag": {"path": "monitoring.authorizationRequests"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/server/routes.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.authorizationRequests", "kind": "fired"}, "of": {"featureId": "monitoring.authorizationRequests"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.authorizationRequests", "kind": "error"}, "of": {"featureId": "monitoring.authorizationRequests"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}, "aliases": []},
+    {"id": "monitoring.autonomousHeartbeat", "title": "Autonomous heartbeat", "flag": {"path": "monitoring.autonomousHeartbeat"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "start": {"set": {"monitoring.autonomousHeartbeat.enabled": true, "monitoring.autonomousHeartbeat.dryRun": true}}, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/commands/server.ts."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"monitoring.autonomousHeartbeat.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.autonomousHeartbeat", "kind": "fired"}, "of": {"featureId": "monitoring.autonomousHeartbeat"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.autonomousHeartbeat", "kind": "error"}, "of": {"featureId": "monitoring.autonomousHeartbeat"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}, {"id": "wrong-graded-count", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.autonomousHeartbeat", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.autonomousHeartbeat"}, "value": "count"}, "direction": "at-most", "threshold": 0, "minSamples": 1, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.autonomousHeartbeat", "kind": "fired"}, "of": {"featureId": "monitoring.autonomousHeartbeat"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.autonomousHeartbeat", "kind": "error"}, "of": {"featureId": "monitoring.autonomousHeartbeat"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}, {"id": "wrong-graded-count", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.autonomousHeartbeat", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.autonomousHeartbeat"}, "value": "count"}, "direction": "at-most", "threshold": 0, "minSamples": 1, "windowDays": 14}]}}, "aliases": []},
     {"id": "monitoring.autonomousLivenessReconciler", "title": "Autonomous liveness reconciler", "aliases": [], "flag": {"path": "monitoring.autonomousLivenessReconciler"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads logs/autonomous-liveness.jsonl, counting only real respawned and respawn-failed rows; the 244 recent rows are debouncing and would-respawn-paused, and no real respawn has been logged yet."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "real-respawns", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/autonomous-liveness.jsonl", "where": {"event": "respawned"}, "of": {"event": "respawned"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "respawn-failure-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/autonomous-liveness.jsonl", "where": {"event": "respawn-failed"}, "of": {"event": "respawned"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
     {"id": "monitoring.biasToAction", "title": "Bias to action signal", "aliases": [], "flag": {"path": "monitoring.biasToAction"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "measured", "plan": "Reads would-fire rows in logs/bias-to-action.jsonl (18 in 14 days); no false-positive labels exist, so the review must grade would-fires through POST /maturation/evidence before the quality bar can pass."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "would-fires", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/bias-to-action.jsonl", "where": {"kind": "bias-to-action-would-fire"}, "of": {"kind": "bias-to-action-would-fire"}, "value": "count", "timeField": "t"}, "direction": "at-least", "threshold": 10, "minSamples": 1, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.biasToAction", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.biasToAction", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 30}]}}},
     {"id": "monitoring.blockerLedger", "title": "Blocker ledger", "aliases": ["monitoring.blockerLedger (+ .durableVaultSession, .selfUnblockChecklist)"], "flag": {"path": "monitoring.blockerLedger"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads open rows in logs/blocker-decisions.jsonl (273 in 14 days, all deferral-detector candidates); the log records nothing about resolution, so the review must grade opened blockers through POST /maturation/evidence."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "blockers-opened", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/blocker-decisions.jsonl", "where": {"event": "open"}, "of": {"event": "open"}, "value": "count"}, "direction": "at-least", "threshold": 100, "minSamples": 1, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.blockerLedger", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.blockerLedger", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 30}]}}},
-    {"id": "monitoring.blockerLedger.durableVaultSession", "title": "Durable vault session", "aliases": [], "flag": {"path": "monitoring.blockerLedger.durableVaultSession"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/monitoring/DurableVaultSession.ts: fired when the org-vault probe uses a warm session, error on a failed unlock or a session outliving its TTL; never log the session value."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.blockerLedger.durableVaultSession", "kind": "fired"}, "of": {"featureId": "monitoring.blockerLedger.durableVaultSession"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.blockerLedger.durableVaultSession", "kind": "error"}, "of": {"featureId": "monitoring.blockerLedger.durableVaultSession"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
+    {"id": "monitoring.blockerLedger.durableVaultSession", "title": "Durable vault session", "aliases": [], "flag": {"path": "monitoring.blockerLedger.durableVaultSession"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/monitoring/DurableVaultSession.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.blockerLedger.durableVaultSession", "kind": "fired"}, "of": {"featureId": "monitoring.blockerLedger.durableVaultSession"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.blockerLedger.durableVaultSession", "kind": "error"}, "of": {"featureId": "monitoring.blockerLedger.durableVaultSession"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
     {"id": "monitoring.blockerLedger.selfUnblockChecklist", "title": "Self-unblock checklist", "aliases": [], "flag": {"path": "monitoring.blockerLedger.selfUnblockChecklist"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads .instar/state/self-unblock-runs/runs.jsonl by completedAt (one run ever, none in 14 days); the review must grade whether an exhausted checklist really had no way forward."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "checklist-runs", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/state/self-unblock-runs/runs.jsonl", "value": "count", "timeField": "completedAt"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.blockerLedger.selfUnblockChecklist", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.blockerLedger.selfUnblockChecklist", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
     {"id": "monitoring.blockerLifecycleLedger", "title": "Blocker lifecycle ledger", "aliases": [], "subject": "throughput-metrics", "flag": {"path": "monitoring.blockerLifecycleLedger"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Uses the throughput-metrics spec projection for completed transitions; add featureEvidence.record error rows at the ledger write in src/monitoring/BlockerLifecycleService.ts. Nothing reads its shipped dryRun, so that key should go in the fleet code change."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"monitoring.blockerLifecycleLedger.dryRun": false}}, "metrics": [{"id": "completed-lifecycle-transitions", "role": "ran", "source": "feature-summary", "ref": {"ref": "blocker-lifecycle.completed-transitions"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.blockerLifecycleLedger", "kind": "error"}, "of": {"featureId": "monitoring.blockerLifecycleLedger"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "completed-lifecycle-transitions", "role": "ran", "source": "feature-summary", "ref": {"ref": "blocker-lifecycle.completed-transitions"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.blockerLifecycleLedger", "kind": "error"}, "of": {"featureId": "monitoring.blockerLifecycleLedger"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 14}]}}},
-    {"id": "monitoring.bootHealthBeacon", "title": "Boot health beacon", "aliases": [], "flag": {"path": "monitoring.bootHealthBeacon"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/server/BootHealthBeacon.ts: fired once per boot phase when the responder starts, error if it cannot bind or fails to hand over; today it only answers HTTP and logs nothing."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.bootHealthBeacon", "kind": "fired"}, "of": {"featureId": "monitoring.bootHealthBeacon"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.bootHealthBeacon", "kind": "error"}, "of": {"featureId": "monitoring.bootHealthBeacon"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
-    {"id": "monitoring.codexArmSessionSweeper", "title": "Codex arm session sweeper", "aliases": [], "flag": {"path": "monitoring.codexArmSessionSweeper", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record per sweep in src/monitoring/CodexArmSessionSweeper.ts: fired on a pass that kills, error on a failed kill. Its logs/codex-arm-sweeper.jsonl does not exist on this machine (0 kills in 8 passes), so no metric can cite it yet."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.codexArmSessionSweeper", "kind": "fired"}, "of": {"featureId": "monitoring.codexArmSessionSweeper"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.codexArmSessionSweeper", "kind": "error"}, "of": {"featureId": "monitoring.codexArmSessionSweeper"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
+    {"id": "monitoring.bootHealthBeacon", "title": "Boot health beacon", "aliases": [], "flag": {"path": "monitoring.bootHealthBeacon"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/server/BootHealthBeacon.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.bootHealthBeacon", "kind": "fired"}, "of": {"featureId": "monitoring.bootHealthBeacon"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.bootHealthBeacon", "kind": "error"}, "of": {"featureId": "monitoring.bootHealthBeacon"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "monitoring.codexArmSessionSweeper", "title": "Codex arm session sweeper", "aliases": [], "flag": {"path": "monitoring.codexArmSessionSweeper", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/monitoring/CodexArmSessionSweeper.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.codexArmSessionSweeper", "kind": "fired"}, "of": {"featureId": "monitoring.codexArmSessionSweeper"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.codexArmSessionSweeper", "kind": "error"}, "of": {"featureId": "monitoring.codexArmSessionSweeper"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
     {"id": "monitoring.completionClaimVerification", "title": "Completion claim verification", "aliases": [], "subject": "claim-verification-sentinel", "flag": {"path": "monitoring.completionClaimVerification"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads the claim observation audit and failure ledger; the failure cap of 210 in 7 days is the 5% goal at about 600 calls a day, and false positives need review grades through POST /maturation/evidence."}, "rungs": {"dev-agent-live": {"soakDays": 7, "advance": {"kind": "config", "set": {"monitoring.completionClaimVerification.dryRun": false}}, "metrics": [{"id": "claims-evaluated", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/state/claim-verification/claim-observation-audit-v2.jsonl", "where": {"evaluated": true}, "of": {"evaluated": true}, "value": "count"}, "direction": "at-least", "threshold": 100, "minSamples": 1, "windowDays": 14}, {"id": "classified-completion-claims", "role": "ran", "source": "feature-summary", "ref": {"ref": "claim-verification.classified-claims"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 14}, {"id": "verifier-error-rate", "role": "harm", "source": "feature-metrics", "ref": {"feature": "completion-claim-verify", "field": "errorRate"}, "direction": "at-most", "threshold": 0.05, "minSamples": 100, "windowDays": 7}, {"id": "false-positive-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.completionClaimVerification", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.completionClaimVerification", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 30}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "claims-evaluated", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/state/claim-verification/claim-observation-audit-v2.jsonl", "where": {"evaluated": true}, "of": {"evaluated": true}, "value": "count"}, "direction": "at-least", "threshold": 100, "minSamples": 1, "windowDays": 14}, {"id": "classified-completion-claims", "role": "ran", "source": "feature-summary", "ref": {"ref": "claim-verification.classified-claims"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 14}, {"id": "verifier-error-rate", "role": "harm", "source": "feature-metrics", "ref": {"feature": "completion-claim-verify", "field": "errorRate"}, "direction": "at-most", "threshold": 0.05, "minSamples": 100, "windowDays": 7}, {"id": "false-positive-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.completionClaimVerification", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.completionClaimVerification", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 30}]}}},
     {"id": "monitoring.contextWedgeSentinel.autoRecovery", "title": "Context wedge auto-recovery", "aliases": [], "subject": "context-wedge-sentinel", "flag": {"path": "monitoring.contextWedgeSentinel.autoRecovery", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads context-wedge rows in logs/sentinel-events.jsonl, written by the sentinel notifier; none exist yet, and the bar is the spec rule of 3 distinct recovered sessions with recovery errors under 5% of detections."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "distinct-sessions-recovered", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/sentinel-events.jsonl", "where": {"sentinel": "context-wedge", "kind": "recovered"}, "of": {"sentinel": "context-wedge", "kind": "recovered"}, "value": "count", "dedupe": "sessionName"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "recovery-error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/sentinel-events.jsonl", "where": {"sentinel": "context-wedge", "kind": "recovery-error"}, "of": {"sentinel": "context-wedge", "kind": "detected"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
     {"id": "monitoring.correctionClassReview", "title": "Correction class review", "aliases": [], "flag": {"path": "monitoring.correctionClassReview"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads filled and shell-created rows in .instar/logs/correction-class-review.jsonl (79% filled today) and the correction-class-review LLM error rate."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "reviews-filled", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/correction-class-review.jsonl", "where": {"event": "filled"}, "of": {"event": "filled"}, "value": "count"}, "direction": "at-least", "threshold": 100, "minSamples": 1, "windowDays": 14}, {"id": "filled-share", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/correction-class-review.jsonl", "where": {"event": "filled"}, "of": {"event": "shell-created"}, "value": "ratio"}, "direction": "at-least", "threshold": 0.7, "minSamples": 50, "windowDays": 14}, {"id": "review-error-rate", "role": "harm", "source": "feature-metrics", "ref": {"feature": "correction-class-review", "field": "errorRate"}, "direction": "at-most", "threshold": 0.05, "minSamples": 50, "windowDays": 14}, {"id": "graded-wrong", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.correctionClassReview", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.correctionClassReview", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.1, "minSamples": 5, "windowDays": 30}]}}},
     {"id": "monitoring.correctionLearning", "title": "Correction learning", "aliases": ["monitoring.correctionLearning (+ .selfViolationSignal)"], "subject": "correction-preference-learning-sentinel-spec", "flag": {"path": "monitoring.correctionLearning"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads recorded and dropped rows in .instar/logs/correction-learning-audit.jsonl; the spec rule of 3 correctly routed learnings in 4 weeks needs outcome rows graded right through POST /maturation/evidence, which nothing writes yet."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "corrections-recorded", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/correction-learning-audit.jsonl", "where": {"decision": "recorded"}, "of": {"decision": "recorded"}, "value": "count"}, "direction": "at-least", "threshold": 100, "minSamples": 1, "windowDays": 14}, {"id": "dropped-share", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/logs/correction-learning-audit.jsonl", "where": {"decision": "drain-failed-dropped"}, "of": {"decision": "recorded"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 50, "windowDays": 14}, {"id": "learning-error-rate", "role": "harm", "source": "feature-metrics", "ref": {"feature": "server:correction-learning", "field": "errorRate"}, "direction": "at-most", "threshold": 0.05, "minSamples": 50, "windowDays": 14}, {"id": "graded-wrong", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.correctionLearning", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.correctionLearning", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.1, "minSamples": 5, "windowDays": 30}]}}},
     {"id": "monitoring.correctionLearning.meaningGrouping", "title": "Correction meaning grouping", "aliases": [], "flag": {"path": "monitoring.correctionLearning.meaningGrouping"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads logs/correction-meaning-grouping.jsonl, which holds one run (10-30, 604 pair checks); it needs repeat runs, so the bar counts run rows, with unsure answers and LLM errors as the quality checks."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "grouping-runs", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/correction-meaning-grouping.jsonl", "where": {"kind": "run"}, "of": {"kind": "run"}, "value": "count"}, "direction": "at-least", "threshold": 2, "minSamples": 1, "windowDays": 30}, {"id": "unsure-share", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/correction-meaning-grouping.jsonl", "where": {"kind": "jev", "v": "unsure"}, "of": {"kind": "jev"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.1, "minSamples": 100, "windowDays": 30}, {"id": "grouping-error-rate", "role": "harm", "source": "feature-metrics", "ref": {"feature": "correction-meaning-grouping", "field": "errorRate"}, "direction": "at-most", "threshold": 0.05, "minSamples": 100, "windowDays": 30}, {"id": "graded-wrong", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.correctionLearning.meaningGrouping", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.correctionLearning.meaningGrouping", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.1, "minSamples": 5, "windowDays": 30}]}}},
     {"id": "monitoring.correctionLearning.selfViolationSignal", "title": "Self-violation signal", "aliases": [], "flag": {"path": "monitoring.correctionLearning.selfViolationSignal", "on": true}, "disposition": "composed", "composedInto": "monitoring.correctionLearning", "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "Observe-only signal inside correction learning; it moves with its parent and has no bar of its own."}, "rungs": {}},
-    {"id": "monitoring.crashLoopPauser", "title": "Crash loop pauser", "aliases": [], "flag": {"path": "monitoring.crashLoopPauser", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/monitoring/CrashLoopPauser.ts at the pause decision: fired per candidate, error on a failed pause. Would-pause lines reach only server.log, and crash-loop-pauses.jsonl is written only on a real pause. It has no shipped dryRun key, so the rung cannot see its code default."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.crashLoopPauser", "kind": "fired"}, "of": {"featureId": "monitoring.crashLoopPauser"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.crashLoopPauser", "kind": "error"}, "of": {"featureId": "monitoring.crashLoopPauser"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"monitoring.crashLoopPauser.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.crashLoopPauser", "kind": "fired"}, "of": {"featureId": "monitoring.crashLoopPauser"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.crashLoopPauser", "kind": "error"}, "of": {"featureId": "monitoring.crashLoopPauser"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
-    {"id": "monitoring.degradedTmuxGuard", "title": "Degraded tmux guard", "aliases": [], "flag": {"path": "monitoring.degradedTmuxGuard"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/monitoring/DegradedTmuxGuard.ts where an episode is raised: fired per raised episode, error on a failed raise, and a graded outcome once the tmux server recovers. Today only attention items exist, with no durable ledger."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.degradedTmuxGuard", "kind": "fired"}, "of": {"featureId": "monitoring.degradedTmuxGuard"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.degradedTmuxGuard", "kind": "error"}, "of": {"featureId": "monitoring.degradedTmuxGuard"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
-    {"id": "monitoring.durableOutputScrub", "title": "Durable output scrub", "aliases": [], "flag": {"path": "monitoring.durableOutputScrub"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/monitoring/DurableOutputScrubber.ts: fired when a span is scrubbed, error on a scrub failure, with counts only. Its durable-output-scrub metric has 0 LLM calls, and that source reads samples from LLM calls, so it can never register."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.durableOutputScrub", "kind": "fired"}, "of": {"featureId": "monitoring.durableOutputScrub"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.durableOutputScrub", "kind": "error"}, "of": {"featureId": "monitoring.durableOutputScrub"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
+    {"id": "monitoring.crashLoopPauser", "title": "Crash loop pauser", "aliases": [], "flag": {"path": "monitoring.crashLoopPauser", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/monitoring/CrashLoopPauser.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.crashLoopPauser", "kind": "fired"}, "of": {"featureId": "monitoring.crashLoopPauser"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.crashLoopPauser", "kind": "error"}, "of": {"featureId": "monitoring.crashLoopPauser"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"monitoring.crashLoopPauser.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.crashLoopPauser", "kind": "fired"}, "of": {"featureId": "monitoring.crashLoopPauser"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.crashLoopPauser", "kind": "error"}, "of": {"featureId": "monitoring.crashLoopPauser"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "monitoring.degradedTmuxGuard", "title": "Degraded tmux guard", "aliases": [], "flag": {"path": "monitoring.degradedTmuxGuard"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/monitoring/DegradedTmuxGuard.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.degradedTmuxGuard", "kind": "fired"}, "of": {"featureId": "monitoring.degradedTmuxGuard"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.degradedTmuxGuard", "kind": "error"}, "of": {"featureId": "monitoring.degradedTmuxGuard"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
+    {"id": "monitoring.durableOutputScrub", "title": "Durable output scrub", "aliases": [], "flag": {"path": "monitoring.durableOutputScrub"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/monitoring/DurableOutputScrubber.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.durableOutputScrub", "kind": "fired"}, "of": {"featureId": "monitoring.durableOutputScrub"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.durableOutputScrub", "kind": "error"}, "of": {"featureId": "monitoring.durableOutputScrub"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
     {"id": "monitoring.enforcedTermination", "title": "Enforced termination", "aliases": [], "flag": {"path": "monitoring.enforcedTermination", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads logs/enforced-termination.jsonl by distinct topic, because one stuck run wrote most of the 6,026 recent rows; the review grades whether each would-stop was right. It has no shipped dryRun key, so the rung cannot see its code default."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "distinct-runs-would-stop", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/enforced-termination.jsonl", "where": {"event": "would-terminate"}, "of": {"event": "would-terminate"}, "value": "count", "dedupe": "topicId"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "wrong-stop-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.enforcedTermination", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.enforcedTermination", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 5, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "real-terminations", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/enforced-termination.jsonl", "where": {"event": "terminated"}, "of": {"event": "terminated"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "terminate-failure-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/enforced-termination.jsonl", "where": {"event": "terminate-failed"}, "of": {"event": "terminated"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}, {"id": "wrong-stop-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.enforcedTermination", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.enforcedTermination", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 5, "windowDays": 30}]}}},
-    {"id": "monitoring.externalHogSentinel", "title": "External hog sentinel", "aliases": [], "flag": {"path": "monitoring.externalHogSentinel"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/monitoring/ExternalHogSentinel.ts at the kill decision: fired per would-kill or kill, error on a failed kill or a kill-breaker trip. It has never seen a sustained hog, and its decisions file does not exist."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.externalHogSentinel", "kind": "fired"}, "of": {"featureId": "monitoring.externalHogSentinel"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.externalHogSentinel", "kind": "error"}, "of": {"featureId": "monitoring.externalHogSentinel"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.externalHogSentinel", "kind": "fired"}, "of": {"featureId": "monitoring.externalHogSentinel"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.externalHogSentinel", "kind": "error"}, "of": {"featureId": "monitoring.externalHogSentinel"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
-    {"id": "monitoring.failureLearning", "title": "Failure learning", "aliases": [], "flag": {"path": "monitoring.failureLearning"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record where src/monitoring/FailureLedger.ts appends a failure and where a pattern surfaces: fired per attributed record, error on a failed write. Its data sits in SQLite (failure-ledger.db), and all 62 records are unattributed."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.failureLearning", "kind": "fired"}, "of": {"featureId": "monitoring.failureLearning"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.failureLearning", "kind": "error"}, "of": {"featureId": "monitoring.failureLearning"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
-    {"id": "monitoring.geminiCapacityEscalation", "title": "Gemini capacity escalation", "aliases": [], "flag": {"path": "monitoring.geminiCapacityEscalation"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/monitoring/GeminiCapacityEscalationMonitor.ts tick: fired per escalation, error on a failed escalation. It is off and has no evidence surface; as a sensitive feature it stays dark until its operator enables it."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.geminiCapacityEscalation", "kind": "fired"}, "of": {"featureId": "monitoring.geminiCapacityEscalation"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.geminiCapacityEscalation", "kind": "error"}, "of": {"featureId": "monitoring.geminiCapacityEscalation"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.geminiCapacityEscalation", "kind": "fired"}, "of": {"featureId": "monitoring.geminiCapacityEscalation"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.geminiCapacityEscalation", "kind": "error"}, "of": {"featureId": "monitoring.geminiCapacityEscalation"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "monitoring.externalHogSentinel", "title": "External hog sentinel", "aliases": [], "flag": {"path": "monitoring.externalHogSentinel"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/monitoring/ExternalHogSentinel.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.externalHogSentinel", "kind": "fired"}, "of": {"featureId": "monitoring.externalHogSentinel"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.externalHogSentinel", "kind": "error"}, "of": {"featureId": "monitoring.externalHogSentinel"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.externalHogSentinel", "kind": "fired"}, "of": {"featureId": "monitoring.externalHogSentinel"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.externalHogSentinel", "kind": "error"}, "of": {"featureId": "monitoring.externalHogSentinel"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "monitoring.failureLearning", "title": "Failure learning", "aliases": [], "flag": {"path": "monitoring.failureLearning"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/monitoring/FailureLedger.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.failureLearning", "kind": "fired"}, "of": {"featureId": "monitoring.failureLearning"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.failureLearning", "kind": "error"}, "of": {"featureId": "monitoring.failureLearning"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "monitoring.geminiCapacityEscalation", "title": "Gemini capacity escalation", "aliases": [], "flag": {"path": "monitoring.geminiCapacityEscalation"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/monitoring/GeminiCapacityEscalationMonitor.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.geminiCapacityEscalation", "kind": "fired"}, "of": {"featureId": "monitoring.geminiCapacityEscalation"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.geminiCapacityEscalation", "kind": "error"}, "of": {"featureId": "monitoring.geminiCapacityEscalation"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.geminiCapacityEscalation", "kind": "fired"}, "of": {"featureId": "monitoring.geminiCapacityEscalation"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.geminiCapacityEscalation", "kind": "error"}, "of": {"featureId": "monitoring.geminiCapacityEscalation"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
     {"id": "monitoring.goalRealignment", "title": "Goal realignment", "aliases": [], "flag": {"path": "monitoring.goalRealignment"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads verdict rows in .instar/logs/goal-realignment.jsonl (84 in 14 days, 17% indeterminate) and the AlignmentReviewer error rate; the review grades drift verdicts through POST /maturation/evidence."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"monitoring.goalRealignment.dryRun": false}}, "metrics": [{"id": "reviews-run", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/goal-realignment.jsonl", "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 1, "windowDays": 14}, {"id": "indeterminate-share", "role": "quality", "source": "jsonl-log", "ref": {"file": ".instar/logs/goal-realignment.jsonl", "where": {"schemaVersion": 1, "verdict": "indeterminate"}, "of": {"schemaVersion": 1}, "value": "ratio"}, "direction": "at-most", "threshold": 0.25, "minSamples": 20, "windowDays": 14}, {"id": "reviewer-error-rate", "role": "harm", "source": "feature-metrics", "ref": {"feature": "AlignmentReviewer", "field": "errorRate"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}, {"id": "wrong-drift-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.goalRealignment", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.goalRealignment", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 30}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "reviews-run", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/goal-realignment.jsonl", "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 1, "windowDays": 14}, {"id": "indeterminate-share", "role": "quality", "source": "jsonl-log", "ref": {"file": ".instar/logs/goal-realignment.jsonl", "where": {"schemaVersion": 1, "verdict": "indeterminate"}, "of": {"schemaVersion": 1}, "value": "ratio"}, "direction": "at-most", "threshold": 0.25, "minSamples": 20, "windowDays": 14}, {"id": "reviewer-error-rate", "role": "harm", "source": "feature-metrics", "ref": {"feature": "AlignmentReviewer", "field": "errorRate"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}, {"id": "wrong-drift-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.goalRealignment", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.goalRealignment", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 30}]}}},
     {"id": "monitoring.greenPrAutoMerge", "title": "Green PR auto-merge", "aliases": [], "flag": {"path": "monitoring.greenPrAutoMerge"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "tracking": {"state": "measured", "plan": "Reads logs/green-pr-automerge.jsonl: merged rows (195 in 14 days), merged out of attempted (70% today), and any merge at an unexpected head, which must stay at zero."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "prs-merged", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/green-pr-automerge.jsonl", "where": {"event": "merged"}, "of": {"event": "merged"}, "value": "count"}, "direction": "at-least", "threshold": 50, "minSamples": 1, "windowDays": 14}, {"id": "merge-success-share", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/green-pr-automerge.jsonl", "where": {"event": "merged"}, "of": {"event": "merge-attempted"}, "value": "ratio"}, "direction": "at-least", "threshold": 0.6, "minSamples": 50, "windowDays": 14}, {"id": "merged-at-unexpected-head", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/green-pr-automerge.jsonl", "where": {"event": "merged-at-unexpected-head"}, "value": "count"}, "direction": "at-most", "threshold": 0, "minSamples": 100, "windowDays": 14}]}}},
-    {"id": "monitoring.growthAnalyst", "title": "Growth analyst", "aliases": ["monitoring.growthAnalyst (+ .blockedDigestEscalation)"], "flag": {"path": "monitoring.growthAnalyst"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/monitoring/GrowthMilestoneAnalyst.ts when a milestone or digest is produced: fired per item, error on a failed analysis or send. Its state is JSON under growth-milestone-analyst, with no readable log."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.growthAnalyst", "kind": "fired"}, "of": {"featureId": "monitoring.growthAnalyst"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.growthAnalyst", "kind": "error"}, "of": {"featureId": "monitoring.growthAnalyst"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "monitoring.growthAnalyst", "title": "Growth analyst", "aliases": ["monitoring.growthAnalyst (+ .blockedDigestEscalation)"], "flag": {"path": "monitoring.growthAnalyst"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/monitoring/GrowthMilestoneAnalyst.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.growthAnalyst", "kind": "fired"}, "of": {"featureId": "monitoring.growthAnalyst"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.growthAnalyst", "kind": "error"}, "of": {"featureId": "monitoring.growthAnalyst"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
     {"id": "monitoring.growthAnalyst.blockedDigestEscalation", "title": "Blocked digest escalation", "aliases": [], "flag": {"path": "monitoring.growthAnalyst.blockedDigestEscalation"}, "disposition": "composed", "composedInto": "monitoring.growthAnalyst", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Delivery retry for the growth digest; it makes no sense without the analyst and moves with it."}, "rungs": {}},
-    {"id": "monitoring.growthAnalyst.darkFlagInventory", "title": "Dark flag inventory", "aliases": [], "flag": {"path": "monitoring.growthAnalyst.darkFlagInventory"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/monitoring/GrowthMilestoneAnalyst.ts at each inventory pass: fired per pass, error on a failed scan. Check for overlap with the maturation ladder before moving it, since both track switched-off features."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.growthAnalyst.darkFlagInventory", "kind": "fired"}, "of": {"featureId": "monitoring.growthAnalyst.darkFlagInventory"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.growthAnalyst.darkFlagInventory", "kind": "error"}, "of": {"featureId": "monitoring.growthAnalyst.darkFlagInventory"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}, "dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"monitoring.growthAnalyst.darkFlagInventory.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.growthAnalyst.darkFlagInventory", "kind": "fired"}, "of": {"featureId": "monitoring.growthAnalyst.darkFlagInventory"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.growthAnalyst.darkFlagInventory", "kind": "error"}, "of": {"featureId": "monitoring.growthAnalyst.darkFlagInventory"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
-    {"id": "monitoring.idleThrottleSettleGate", "title": "Idle throttle settle gate", "aliases": [], "flag": {"path": "monitoring.idleThrottleSettleGate"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/core/SessionManager.ts at the rateLimitedAtIdle hand-off: fired when the gate settles or holds it, error on a failed read. Source has no ledger and server.log has no mention."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.idleThrottleSettleGate", "kind": "fired"}, "of": {"featureId": "monitoring.idleThrottleSettleGate"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.idleThrottleSettleGate", "kind": "error"}, "of": {"featureId": "monitoring.idleThrottleSettleGate"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
-    {"id": "monitoring.liveTestGate", "title": "Live test gate", "aliases": [], "flag": {"path": "monitoring.liveTestGate"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record at the completion decision behind POST /autonomous/evaluate-completion: fired per would-veto or veto, error on an unreadable artifact. Mode stays dry-run until a separate move to veto; the rung cannot see that setting."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.liveTestGate", "kind": "fired"}, "of": {"featureId": "monitoring.liveTestGate"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.liveTestGate", "kind": "error"}, "of": {"featureId": "monitoring.liveTestGate"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
-    {"id": "monitoring.liveTestRunner", "title": "Live test runner", "aliases": [], "flag": {"path": "monitoring.liveTestRunner"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in the POST /live-test/multi-machine-capstone handler: fired per run, error on a failed run. The harness has never run and no ledger file exists on this machine."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.liveTestRunner", "kind": "fired"}, "of": {"featureId": "monitoring.liveTestRunner"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.liveTestRunner", "kind": "error"}, "of": {"featureId": "monitoring.liveTestRunner"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
+    {"id": "monitoring.growthAnalyst.darkFlagInventory", "title": "Dark flag inventory", "aliases": [], "flag": {"path": "monitoring.growthAnalyst.darkFlagInventory"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/monitoring/GrowthMilestoneAnalyst.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.growthAnalyst.darkFlagInventory", "kind": "fired"}, "of": {"featureId": "monitoring.growthAnalyst.darkFlagInventory"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.growthAnalyst.darkFlagInventory", "kind": "error"}, "of": {"featureId": "monitoring.growthAnalyst.darkFlagInventory"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}, "dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"monitoring.growthAnalyst.darkFlagInventory.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.growthAnalyst.darkFlagInventory", "kind": "fired"}, "of": {"featureId": "monitoring.growthAnalyst.darkFlagInventory"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.growthAnalyst.darkFlagInventory", "kind": "error"}, "of": {"featureId": "monitoring.growthAnalyst.darkFlagInventory"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "monitoring.idleThrottleSettleGate", "title": "Idle throttle settle gate", "aliases": [], "flag": {"path": "monitoring.idleThrottleSettleGate"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/SessionManager.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.idleThrottleSettleGate", "kind": "fired"}, "of": {"featureId": "monitoring.idleThrottleSettleGate"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.idleThrottleSettleGate", "kind": "error"}, "of": {"featureId": "monitoring.idleThrottleSettleGate"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
+    {"id": "monitoring.liveTestGate", "title": "Live test gate", "aliases": [], "flag": {"path": "monitoring.liveTestGate"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/server/routes.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.liveTestGate", "kind": "fired"}, "of": {"featureId": "monitoring.liveTestGate"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.liveTestGate", "kind": "error"}, "of": {"featureId": "monitoring.liveTestGate"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
+    {"id": "monitoring.liveTestRunner", "title": "Live test runner", "aliases": [], "flag": {"path": "monitoring.liveTestRunner"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/server/routes.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.liveTestRunner", "kind": "fired"}, "of": {"featureId": "monitoring.liveTestRunner"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.liveTestRunner", "kind": "error"}, "of": {"featureId": "monitoring.liveTestRunner"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
     {"id": "monitoring.machineCoherence", "title": "Machine coherence guard", "aliases": [], "flag": {"path": "monitoring.machineCoherence"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads episode rows in logs/machine-coherence.jsonl: opens, give-ups at the cap, and reopens (22% today), so flapping holds the feature until it drops below 20%."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "episodes-opened", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/machine-coherence.jsonl", "where": {"t": "open"}, "of": {"t": "open"}, "value": "count"}, "direction": "at-least", "threshold": 100, "minSamples": 1, "windowDays": 14}, {"id": "give-up-share", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/machine-coherence.jsonl", "where": {"t": "cap-giveup"}, "of": {"t": "open"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 50, "windowDays": 14}, {"id": "reopen-share", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/machine-coherence.jsonl", "where": {"t": "reopen"}, "of": {"t": "open"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.2, "minSamples": 50, "windowDays": 14}]}}},
-    {"id": "monitoring.mcpProcessReaper", "title": "MCP process reaper", "aliases": [], "flag": {"path": "monitoring.mcpProcessReaper"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/monitoring/McpProcessReaper.ts per reap pass: fired per would-reap or reap, error on a failed kill. Its logs/mcp-reaper-audit.jsonl has never been written, so no metric can cite it yet."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.mcpProcessReaper", "kind": "fired"}, "of": {"featureId": "monitoring.mcpProcessReaper"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.mcpProcessReaper", "kind": "error"}, "of": {"featureId": "monitoring.mcpProcessReaper"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}, "dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.mcpProcessReaper", "kind": "fired"}, "of": {"featureId": "monitoring.mcpProcessReaper"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.mcpProcessReaper", "kind": "error"}, "of": {"featureId": "monitoring.mcpProcessReaper"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
-    {"id": "monitoring.meshCoherenceLiveCheck", "title": "Mesh coherence live check", "aliases": [], "flag": {"path": "monitoring.meshCoherenceLiveCheck"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record at the check in src/commands/server.ts: fired when a divergence is logged, error on a failed read. Its mesh-coherence-live metric has 0 LLM calls, and that source reads samples from LLM calls, so it can never register."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.meshCoherenceLiveCheck", "kind": "fired"}, "of": {"featureId": "monitoring.meshCoherenceLiveCheck"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.meshCoherenceLiveCheck", "kind": "error"}, "of": {"featureId": "monitoring.meshCoherenceLiveCheck"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
-    {"id": "monitoring.missingLoginSession", "title": "Missing login session", "aliases": [], "flag": {"path": "monitoring.missingLoginSession"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/monitoring/MissingLoginSessionDetector.ts at the raise: fired per raise, error on a failed check, with a graded outcome (a false-missing alert was seen once under CMT-170)."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.missingLoginSession", "kind": "fired"}, "of": {"featureId": "monitoring.missingLoginSession"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.missingLoginSession", "kind": "error"}, "of": {"featureId": "monitoring.missingLoginSession"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
-    {"id": "monitoring.orphanedWorkSentinel", "title": "Orphaned work sentinel", "aliases": [], "flag": {"path": "monitoring.orphanedWorkSentinel"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Switched off on Echo since 10-19 after 3,045 flag rows for 102 paths; .instar/state/orphaned-work.jsonl has no recent rows, so the bar counts distinct paths once it runs again, and the review grades flags. It needs per-path dedupe before re-enabling."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "code"}, "metrics": [{"id": "distinct-paths-flagged", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/state/orphaned-work.jsonl", "where": {"preserved": false}, "of": {"preserved": false}, "value": "count", "dedupe": "path"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.orphanedWorkSentinel", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.orphanedWorkSentinel", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "distinct-paths-flagged", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/state/orphaned-work.jsonl", "where": {"preserved": false}, "of": {"preserved": false}, "value": "count", "dedupe": "path"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.orphanedWorkSentinel", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.orphanedWorkSentinel", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 30}]}}},
-    {"id": "monitoring.overloadShed", "title": "Overload shed", "aliases": [], "flag": {"path": "monitoring.overloadShed", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/core/OverloadShedPlanner.ts at each evaluation: fired per would-move or proposal, error on an abort. logs/overload-shed.jsonl does not exist on this machine (0 would-move in 281 ticks). It has no shipped dryRun key, so the rung cannot see its code default."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.overloadShed", "kind": "fired"}, "of": {"featureId": "monitoring.overloadShed"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.overloadShed", "kind": "error"}, "of": {"featureId": "monitoring.overloadShed"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"monitoring.overloadShed.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.overloadShed", "kind": "fired"}, "of": {"featureId": "monitoring.overloadShed"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.overloadShed", "kind": "error"}, "of": {"featureId": "monitoring.overloadShed"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "monitoring.mcpProcessReaper", "title": "MCP process reaper", "aliases": [], "flag": {"path": "monitoring.mcpProcessReaper"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/monitoring/McpProcessReaper.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.mcpProcessReaper", "kind": "fired"}, "of": {"featureId": "monitoring.mcpProcessReaper"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.mcpProcessReaper", "kind": "error"}, "of": {"featureId": "monitoring.mcpProcessReaper"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}, "dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.mcpProcessReaper", "kind": "fired"}, "of": {"featureId": "monitoring.mcpProcessReaper"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.mcpProcessReaper", "kind": "error"}, "of": {"featureId": "monitoring.mcpProcessReaper"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "monitoring.meshCoherenceLiveCheck", "title": "Mesh coherence live check", "aliases": [], "flag": {"path": "monitoring.meshCoherenceLiveCheck"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/commands/server.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.meshCoherenceLiveCheck", "kind": "fired"}, "of": {"featureId": "monitoring.meshCoherenceLiveCheck"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.meshCoherenceLiveCheck", "kind": "error"}, "of": {"featureId": "monitoring.meshCoherenceLiveCheck"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
+    {"id": "monitoring.missingLoginSession", "title": "Missing login session", "aliases": [], "flag": {"path": "monitoring.missingLoginSession"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/monitoring/MissingLoginSessionDetector.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.missingLoginSession", "kind": "fired"}, "of": {"featureId": "monitoring.missingLoginSession"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.missingLoginSession", "kind": "error"}, "of": {"featureId": "monitoring.missingLoginSession"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
+    {"id": "monitoring.orphanedWorkSentinel", "title": "Orphaned work sentinel", "aliases": [], "flag": {"path": "monitoring.orphanedWorkSentinel"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/monitoring/OrphanedWorkSentinel.ts."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "code"}, "metrics": [{"id": "distinct-paths-flagged", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/state/orphaned-work.jsonl", "where": {"preserved": false}, "of": {"preserved": false}, "value": "count", "dedupe": "path"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.orphanedWorkSentinel", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.orphanedWorkSentinel", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "distinct-paths-flagged", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/state/orphaned-work.jsonl", "where": {"preserved": false}, "of": {"preserved": false}, "value": "count", "dedupe": "path"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.orphanedWorkSentinel", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.orphanedWorkSentinel", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 30}]}}},
+    {"id": "monitoring.overloadShed", "title": "Overload shed", "aliases": [], "flag": {"path": "monitoring.overloadShed", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/OverloadShedPlanner.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.overloadShed", "kind": "fired"}, "of": {"featureId": "monitoring.overloadShed"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.overloadShed", "kind": "error"}, "of": {"featureId": "monitoring.overloadShed"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"monitoring.overloadShed.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.overloadShed", "kind": "fired"}, "of": {"featureId": "monitoring.overloadShed"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.overloadShed", "kind": "error"}, "of": {"featureId": "monitoring.overloadShed"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
     {"id": "monitoring.parallelWorkSentinel", "title": "Parallel work sentinel", "aliases": [], "flag": {"path": "monitoring.parallelWorkSentinel"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads nudged rows in .instar/logs/sentinel-events.jsonl (2,654 in 14 days); there are no false-positive labels, so the review must grade nudges through POST /maturation/evidence before it can pass."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "nudges-sent", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/sentinel-events.jsonl", "where": {"kind": "parallel-work:nudged"}, "of": {"kind": "parallel-work:nudged"}, "value": "count"}, "direction": "at-least", "threshold": 100, "minSamples": 1, "windowDays": 14}, {"id": "graded-wrong-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.parallelWorkSentinel", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.parallelWorkSentinel", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 30}]}}},
-    {"id": "monitoring.prHandLease", "title": "PR hand lease", "aliases": [], "flag": {"path": "monitoring.prHandLease", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record at the POST /pr-leases/evaluate decision: fired per evaluation, error on evaluate-error or fail-open. .instar/logs/pr-lease-decisions.jsonl has never been created despite the hook being installed, so check the wiring. It has no shipped dryRun key, so the rung cannot see its code default."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.prHandLease", "kind": "fired"}, "of": {"featureId": "monitoring.prHandLease"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.prHandLease", "kind": "error"}, "of": {"featureId": "monitoring.prHandLease"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}, "dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"monitoring.prHandLease.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.prHandLease", "kind": "fired"}, "of": {"featureId": "monitoring.prHandLease"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.prHandLease", "kind": "error"}, "of": {"featureId": "monitoring.prHandLease"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
-    {"id": "monitoring.processFootprintMonitor", "title": "Process footprint monitor", "aliases": ["monitoring.processFootprintMonitor.alertEnabled"], "flag": {"path": "monitoring.processFootprintMonitor"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/monitoring/ProcessFootprintMonitor.ts per sample (bounded by the 60-a-minute limit): fired per persisted sample, error on a failed process listing. Samples are lost at restart today."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.processFootprintMonitor", "kind": "fired"}, "of": {"featureId": "monitoring.processFootprintMonitor"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.processFootprintMonitor", "kind": "error"}, "of": {"featureId": "monitoring.processFootprintMonitor"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
-    {"id": "monitoring.promiseBeacon.escalation", "title": "Promise beacon escalation", "aliases": [], "flag": {"path": "monitoring.promiseBeacon.escalation"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record at the escalation attempt in the promise beacon wiring: fired per attempt or would-attempt, error on a refusal or double spawn. Totals are in memory only; the written goal is a week of practice-run evidence."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.promiseBeacon.escalation", "kind": "fired"}, "of": {"featureId": "monitoring.promiseBeacon.escalation"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.promiseBeacon.escalation", "kind": "error"}, "of": {"featureId": "monitoring.promiseBeacon.escalation"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "dev-agent-live": {"soakDays": 7, "advance": {"kind": "config", "set": {"monitoring.promiseBeacon.escalation.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.promiseBeacon.escalation", "kind": "fired"}, "of": {"featureId": "monitoring.promiseBeacon.escalation"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.promiseBeacon.escalation", "kind": "error"}, "of": {"featureId": "monitoring.promiseBeacon.escalation"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
-    {"id": "monitoring.releaseReadiness", "title": "Release readiness sentinel", "aliases": [], "flag": {"path": "monitoring.releaseReadiness"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/monitoring/ReleaseReadinessSentinel.ts per tick: fired per evaluated tick, error on a failed check or rollback. It has no durable episode log, and the 6-hour tick gives about 56 rows in 14 days."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.releaseReadiness", "kind": "fired"}, "of": {"featureId": "monitoring.releaseReadiness"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.releaseReadiness", "kind": "error"}, "of": {"featureId": "monitoring.releaseReadiness"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "monitoring.prHandLease", "title": "PR hand lease", "aliases": [], "flag": {"path": "monitoring.prHandLease", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/server/routes.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.prHandLease", "kind": "fired"}, "of": {"featureId": "monitoring.prHandLease"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.prHandLease", "kind": "error"}, "of": {"featureId": "monitoring.prHandLease"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}, "dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"monitoring.prHandLease.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.prHandLease", "kind": "fired"}, "of": {"featureId": "monitoring.prHandLease"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.prHandLease", "kind": "error"}, "of": {"featureId": "monitoring.prHandLease"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "monitoring.processFootprintMonitor", "title": "Process footprint monitor", "aliases": ["monitoring.processFootprintMonitor.alertEnabled"], "flag": {"path": "monitoring.processFootprintMonitor"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/monitoring/ProcessFootprintMonitor.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.processFootprintMonitor", "kind": "fired"}, "of": {"featureId": "monitoring.processFootprintMonitor"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.processFootprintMonitor", "kind": "error"}, "of": {"featureId": "monitoring.processFootprintMonitor"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "monitoring.promiseBeacon.escalation", "title": "Promise beacon escalation", "aliases": [], "flag": {"path": "monitoring.promiseBeacon.escalation"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/monitoring/PromiseBeacon.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.promiseBeacon.escalation", "kind": "fired"}, "of": {"featureId": "monitoring.promiseBeacon.escalation"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.promiseBeacon.escalation", "kind": "error"}, "of": {"featureId": "monitoring.promiseBeacon.escalation"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "dev-agent-live": {"soakDays": 7, "advance": {"kind": "config", "set": {"monitoring.promiseBeacon.escalation.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.promiseBeacon.escalation", "kind": "fired"}, "of": {"featureId": "monitoring.promiseBeacon.escalation"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.promiseBeacon.escalation", "kind": "error"}, "of": {"featureId": "monitoring.promiseBeacon.escalation"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "monitoring.releaseReadiness", "title": "Release readiness sentinel", "aliases": [], "flag": {"path": "monitoring.releaseReadiness"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/monitoring/ReleaseReadinessSentinel.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.releaseReadiness", "kind": "fired"}, "of": {"featureId": "monitoring.releaseReadiness"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.releaseReadiness", "kind": "error"}, "of": {"featureId": "monitoring.releaseReadiness"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
     {"id": "monitoring.resumeQueue", "title": "Mid-work resume queue", "aliases": [], "flag": {"path": "monitoring.resumeQueue", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads logs/resume-queue.jsonl: enqueued rows (76 in 14 days), runs that hit the resurrection cap (14, or 18%), and gave-up rows."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "resumes-enqueued", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/resume-queue.jsonl", "where": {"event": "enqueued"}, "of": {"event": "enqueued"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 1, "windowDays": 14}, {"id": "resurrection-cap-share", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/resume-queue.jsonl", "where": {"event": "resurrection-cap"}, "of": {"event": "enqueued"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.25, "minSamples": 20, "windowDays": 14}, {"id": "gave-up-share", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/resume-queue.jsonl", "where": {"event": "gave-up"}, "of": {"event": "enqueued"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
-    {"id": "monitoring.ropeHealth", "title": "Rope health alerts", "aliases": [], "flag": {"path": "monitoring.ropeHealth"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/core/ropeHealth.ts: fired per urgent or classified episode, error on a failed evaluation, with graded outcomes on sleep misclassification. Its rope-health metric has 0 LLM calls, so it can never register. Echo runs urgentEnabled false against a shipped true."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.ropeHealth", "kind": "fired"}, "of": {"featureId": "monitoring.ropeHealth"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.ropeHealth", "kind": "error"}, "of": {"featureId": "monitoring.ropeHealth"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
-    {"id": "monitoring.selfDeferralGuard", "title": "Self-deferral guard", "aliases": [], "flag": {"path": "monitoring.selfDeferralGuard"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/core/UnjustifiedStopGate.ts where U_SELF_DEFERRAL is offered: fired per label, error on a parse failure. Its rows are spread across dated judgment-provenance files no metric can name, and an enforce bar is still unwritten."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.selfDeferralGuard", "kind": "fired"}, "of": {"featureId": "monitoring.selfDeferralGuard"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.selfDeferralGuard", "kind": "error"}, "of": {"featureId": "monitoring.selfDeferralGuard"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
-    {"id": "monitoring.sentinelTelegramEscalation", "title": "Sentinel Telegram escalation", "aliases": [], "flag": {"path": "monitoring.sentinelTelegramEscalation", "on": true}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Preference candidate: opt-in delivery that some operators may keep off. Add featureEvidence.record in src/monitoring/SentinelNotifier.ts at escalate: fired per Telegram send, error on a failed send; hub escalation rows do not show Telegram behaviour."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.sentinelTelegramEscalation", "kind": "fired"}, "of": {"featureId": "monitoring.sentinelTelegramEscalation"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.sentinelTelegramEscalation", "kind": "error"}, "of": {"featureId": "monitoring.sentinelTelegramEscalation"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "dev-agent-live": {"soakDays": 3, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.sentinelTelegramEscalation", "kind": "fired"}, "of": {"featureId": "monitoring.sentinelTelegramEscalation"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.sentinelTelegramEscalation", "kind": "error"}, "of": {"featureId": "monitoring.sentinelTelegramEscalation"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "monitoring.ropeHealth", "title": "Rope health alerts", "aliases": [], "flag": {"path": "monitoring.ropeHealth"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/monitoring/RopeHealthMonitor.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.ropeHealth", "kind": "fired"}, "of": {"featureId": "monitoring.ropeHealth"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.ropeHealth", "kind": "error"}, "of": {"featureId": "monitoring.ropeHealth"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}},
+    {"id": "monitoring.selfDeferralGuard", "title": "Self-deferral guard", "aliases": [], "flag": {"path": "monitoring.selfDeferralGuard"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/UnjustifiedStopGate.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.selfDeferralGuard", "kind": "fired"}, "of": {"featureId": "monitoring.selfDeferralGuard"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.selfDeferralGuard", "kind": "error"}, "of": {"featureId": "monitoring.selfDeferralGuard"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "monitoring.sentinelTelegramEscalation", "title": "Sentinel Telegram escalation", "aliases": [], "flag": {"path": "monitoring.sentinelTelegramEscalation", "on": true}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Preference candidate. Records its decisions to the shared evidence log from src/monitoring/SentinelNotifier.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.sentinelTelegramEscalation", "kind": "fired"}, "of": {"featureId": "monitoring.sentinelTelegramEscalation"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.sentinelTelegramEscalation", "kind": "error"}, "of": {"featureId": "monitoring.sentinelTelegramEscalation"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "dev-agent-live": {"soakDays": 3, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.sentinelTelegramEscalation", "kind": "fired"}, "of": {"featureId": "monitoring.sentinelTelegramEscalation"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.sentinelTelegramEscalation", "kind": "error"}, "of": {"featureId": "monitoring.sentinelTelegramEscalation"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
     {"id": "monitoring.sessionReaper", "title": "Session reaper", "aliases": ["monitoring.sessionReaper (+ closeoutLivenessGate)"], "flag": {"path": "monitoring.sessionReaper"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads real reaped rows in logs/reaper-audit.jsonl (38 in 14 days); whether a reap was right is not logged, so the review must grade reaps through POST /maturation/evidence before it can pass."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "sessions-reaped", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/reaper-audit.jsonl", "where": {"event": "reaped"}, "of": {"event": "reaped"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 1, "windowDays": 14}, {"id": "wrong-reap-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.sessionReaper", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.sessionReaper", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 30}]}}},
     {"id": "monitoring.sessionReaper.closeoutLivenessGate", "title": "Closeout liveness gate", "aliases": [], "flag": {"path": "monitoring.sessionReaper.closeoutLivenessGate", "on": true}, "disposition": "composed", "composedInto": "monitoring.sessionReaper", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Safety gate inside the reaper closeout; the reaper should not reach the fleet without it, so it moves with its parent."}, "rungs": {}},
-    {"id": "monitoring.singleMachineFailoverGap", "title": "Single machine failover gap", "aliases": [], "flag": {"path": "monitoring.singleMachineFailoverGap"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/monitoring/SingleMachineFailoverGapDetector.ts at the raise: fired per raise or would-raise, error on a failed check. Today it holds only in-memory tick counters, with 0 raises."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.singleMachineFailoverGap", "kind": "fired"}, "of": {"featureId": "monitoring.singleMachineFailoverGap"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.singleMachineFailoverGap", "kind": "error"}, "of": {"featureId": "monitoring.singleMachineFailoverGap"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"monitoring.singleMachineFailoverGap.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.singleMachineFailoverGap", "kind": "fired"}, "of": {"featureId": "monitoring.singleMachineFailoverGap"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.singleMachineFailoverGap", "kind": "error"}, "of": {"featureId": "monitoring.singleMachineFailoverGap"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "monitoring.singleMachineFailoverGap", "title": "Single machine failover gap", "aliases": [], "flag": {"path": "monitoring.singleMachineFailoverGap"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/monitoring/SingleMachineFailoverGapDetector.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.singleMachineFailoverGap", "kind": "fired"}, "of": {"featureId": "monitoring.singleMachineFailoverGap"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.singleMachineFailoverGap", "kind": "error"}, "of": {"featureId": "monitoring.singleMachineFailoverGap"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"monitoring.singleMachineFailoverGap.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.singleMachineFailoverGap", "kind": "fired"}, "of": {"featureId": "monitoring.singleMachineFailoverGap"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.singleMachineFailoverGap", "kind": "error"}, "of": {"featureId": "monitoring.singleMachineFailoverGap"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
     {"id": "monitoring.standDown", "title": "Duplicate-session stand-down", "aliases": [], "flag": {"path": "monitoring.standDown"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "tracking": {"state": "measured", "plan": "Its own log .instar/logs/standdown.jsonl shows registrations, and the review grades would-block rows through POST /maturation/evidence, since the spec requires zero false positives adjudicated against ownership records."}, "rungs": {"dev-agent-live": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "registered", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/standdown.jsonl", "where": {"transition": "registered"}, "of": {"transition": "registered"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.standDown", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.standDown", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0, "minSamples": 3, "windowDays": 30}, {"id": "graded-right", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.standDown", "kind": "outcome", "outcome": "right"}, "of": {"featureId": "monitoring.standDown", "kind": "outcome"}, "value": "count", "dedupe": "gradesEventId"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "registered", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/standdown.jsonl", "where": {"transition": "registered"}, "of": {"transition": "registered"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.standDown", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.standDown", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0, "minSamples": 3, "windowDays": 30}, {"id": "expired-share", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/logs/standdown.jsonl", "where": {"transition": "expired"}, "of": {"transition": "registered"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
-    {"id": "monitoring.standbyHonestyTiers", "title": "Honest standby messages", "aliases": [], "flag": {"path": "monitoring.standbyHonestyTiers"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/monitoring/PresenceProxy.ts where Tier 1 or 2 uses classifyStuckSignature to change the message: fired with the signature, error if the classification throws."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.standbyHonestyTiers", "kind": "fired"}, "of": {"featureId": "monitoring.standbyHonestyTiers"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.standbyHonestyTiers", "kind": "error"}, "of": {"featureId": "monitoring.standbyHonestyTiers"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
-    {"id": "monitoring.strandedTopicSentinel", "title": "Stranded topic detector", "aliases": [], "flag": {"path": "monitoring.strandedTopicSentinel"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Its only output is an attention item, so add featureEvidence.record in src/monitoring/StrandedTopicSentinel.ts where it emits the owner item (fired) and on tick-error (error); the review grades whether each stranding was real."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.strandedTopicSentinel", "kind": "fired"}, "of": {"featureId": "monitoring.strandedTopicSentinel"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.strandedTopicSentinel", "kind": "error"}, "of": {"featureId": "monitoring.strandedTopicSentinel"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "monitoring.standbyHonestyTiers", "title": "Honest standby messages", "aliases": [], "flag": {"path": "monitoring.standbyHonestyTiers"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/monitoring/PresenceProxy.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.standbyHonestyTiers", "kind": "fired"}, "of": {"featureId": "monitoring.standbyHonestyTiers"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.standbyHonestyTiers", "kind": "error"}, "of": {"featureId": "monitoring.standbyHonestyTiers"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "monitoring.strandedTopicSentinel", "title": "Stranded topic detector", "aliases": [], "flag": {"path": "monitoring.strandedTopicSentinel"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/monitoring/StrandedTopicSentinel.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.strandedTopicSentinel", "kind": "fired"}, "of": {"featureId": "monitoring.strandedTopicSentinel"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.strandedTopicSentinel", "kind": "error"}, "of": {"featureId": "monitoring.strandedTopicSentinel"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
     {"id": "monitoring.throughputFloor", "title": "Autonomous throughput floor", "aliases": [], "flag": {"path": "monitoring.throughputFloor"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "subject": "autonomous-throughput-floor", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Its own log .instar/logs/autonomous-throughput-floor.jsonl records every observation, plus the spec-named projection autonomous-throughput.observed-runs; failed GitHub reads (decision unknown) and an open read breaker are the harm."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "healthy-observations", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/autonomous-throughput-floor.jsonl", "where": {"decision": "healthy"}, "of": {"decision": "healthy"}, "value": "count"}, "direction": "at-least", "threshold": 100, "minSamples": 100, "windowDays": 14}, {"id": "observed-throughput-runs", "role": "ran", "source": "feature-summary", "ref": {"ref": "autonomous-throughput.observed-runs"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 14}, {"id": "unknown-reads", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/logs/autonomous-throughput-floor.jsonl", "where": {"decision": "unknown"}, "value": "count"}, "direction": "at-most", "threshold": 48, "minSamples": 100, "windowDays": 14}, {"id": "breaker-open", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/logs/autonomous-throughput-floor.jsonl", "where": {"decision": "breaker-open"}, "value": "count"}, "direction": "at-most", "threshold": 0, "minSamples": 100, "windowDays": 14}]}}},
-    {"id": "monitoring.tmuxResilience.asyncHotPath", "title": "Async tmux hot path", "aliases": ["monitoring.tmuxResilience (asyncHotPath + inFlightMarker)"], "flag": {"path": "monitoring.tmuxResilience.asyncHotPath"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/core/SessionManager.ts at each bounded async tmux call that times out or classifies a session (fired), and error on a spurious reap, the spec promotion rule being zero spurious reaps."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.tmuxResilience.asyncHotPath", "kind": "fired"}, "of": {"featureId": "monitoring.tmuxResilience.asyncHotPath"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.tmuxResilience.asyncHotPath", "kind": "error"}, "of": {"featureId": "monitoring.tmuxResilience.asyncHotPath"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 20, "windowDays": 14}]}}},
-    {"id": "monitoring.tmuxResilience.inFlightMarker", "title": "Tmux in-flight marker", "aliases": [], "flag": {"path": "monitoring.tmuxResilience.inFlightMarker"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/core/SleepWakeDetector.ts when the marker reclassifies a drift as a stall (fired) and when a stale marker self-heals (error), the spec promotion rule being zero false wakes."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.tmuxResilience.inFlightMarker", "kind": "fired"}, "of": {"featureId": "monitoring.tmuxResilience.inFlightMarker"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.tmuxResilience.inFlightMarker", "kind": "error"}, "of": {"featureId": "monitoring.tmuxResilience.inFlightMarker"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 1, "windowDays": 30}]}}},
-    {"id": "monitoring.windowRunLiveness.cadenceExecutor", "title": "Window run cadence executor", "aliases": ["monitoring.windowRunLiveness"], "flag": {"path": "monitoring.windowRunLiveness.cadenceExecutor"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "The read route shows 0 intervals recorded and it writes no log, so add featureEvidence.record in the executor wired from src/server/AgentServer.ts for each receipt, report and checkpoint (fired) and each exhausted retry (error)."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.windowRunLiveness.cadenceExecutor", "kind": "fired"}, "of": {"featureId": "monitoring.windowRunLiveness.cadenceExecutor"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.windowRunLiveness.cadenceExecutor", "kind": "error"}, "of": {"featureId": "monitoring.windowRunLiveness.cadenceExecutor"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "monitoring.tmuxResilience.asyncHotPath", "title": "Async tmux hot path", "aliases": ["monitoring.tmuxResilience (asyncHotPath + inFlightMarker)"], "flag": {"path": "monitoring.tmuxResilience.asyncHotPath"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/SessionManager.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.tmuxResilience.asyncHotPath", "kind": "fired"}, "of": {"featureId": "monitoring.tmuxResilience.asyncHotPath"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.tmuxResilience.asyncHotPath", "kind": "error"}, "of": {"featureId": "monitoring.tmuxResilience.asyncHotPath"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "monitoring.tmuxResilience.inFlightMarker", "title": "Tmux in-flight marker", "aliases": [], "flag": {"path": "monitoring.tmuxResilience.inFlightMarker"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/SleepWakeDetector.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.tmuxResilience.inFlightMarker", "kind": "fired"}, "of": {"featureId": "monitoring.tmuxResilience.inFlightMarker"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.tmuxResilience.inFlightMarker", "kind": "error"}, "of": {"featureId": "monitoring.tmuxResilience.inFlightMarker"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "monitoring.windowRunLiveness.cadenceExecutor", "title": "Window run cadence executor", "aliases": ["monitoring.windowRunLiveness"], "flag": {"path": "monitoring.windowRunLiveness.cadenceExecutor"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/WindowRunCadenceExecutor.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.windowRunLiveness.cadenceExecutor", "kind": "fired"}, "of": {"featureId": "monitoring.windowRunLiveness.cadenceExecutor"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.windowRunLiveness.cadenceExecutor", "kind": "error"}, "of": {"featureId": "monitoring.windowRunLiveness.cadenceExecutor"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
     {"id": "monitoring.workAdmission", "title": "Overload work admission", "aliases": [], "flag": {"path": "monitoring.workAdmission"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Its own log logs/work-admission.jsonl records closes, reopens and refusals; closes must end in a reopen so a machine never stays shut, and the review grades refusals because no number is written in the spec."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"monitoring.workAdmission.dryRun": false}}, "metrics": [{"id": "would-refuse", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/work-admission.jsonl", "where": {"event": "would-refuse"}, "of": {"event": "would-refuse"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "reopen-share", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/work-admission.jsonl", "where": {"event": "reopened"}, "of": {"event": "closed"}, "value": "ratio"}, "direction": "at-least", "threshold": 0.9, "minSamples": 20, "windowDays": 14}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.workAdmission", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.workAdmission", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 5, "windowDays": 30}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "closes", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/work-admission.jsonl", "where": {"event": "closed"}, "of": {"event": "closed"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "reopen-share", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/work-admission.jsonl", "where": {"event": "reopened"}, "of": {"event": "closed"}, "value": "ratio"}, "direction": "at-least", "threshold": 0.9, "minSamples": 20, "windowDays": 14}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.workAdmission", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "monitoring.workAdmission", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 5, "windowDays": 30}]}}},
-    {"id": "monitoring.yieldSafety", "title": "Build-session yield safety", "aliases": [], "flag": {"path": "monitoring.yieldSafety"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "It has no audit of its own, so add featureEvidence.record in src/monitoring/SessionReaper.ts when the pre-kill dirty check marks a session resume-eligible (fired) and when the check times out or work is lost (error)."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.yieldSafety", "kind": "fired"}, "of": {"featureId": "monitoring.yieldSafety"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.yieldSafety", "kind": "error"}, "of": {"featureId": "monitoring.yieldSafety"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
-    {"id": "multiMachine.accountFollowMe", "title": "Account follow-me", "aliases": [], "flag": {"path": "multiMachine.accountFollowMe"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record, with no account identifiers, in src/core/SubscriptionAccountMetaReplicatedStore.ts where account metadata is projected to a peer (fired) and where a projection or re-mint fails (error)."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.accountFollowMe", "kind": "fired"}, "of": {"featureId": "multiMachine.accountFollowMe"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.accountFollowMe", "kind": "error"}, "of": {"featureId": "multiMachine.accountFollowMe"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
-    {"id": "multiMachine.coherenceJournal", "title": "Coherence journal", "aliases": [], "flag": {"path": "multiMachine.coherenceJournal"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Its journal files carry a machine id in the name so no ladder metric can cite them; add featureEvidence.record in src/core/CoherenceJournal.ts for each replication batch applied (fired) and each flush or apply failure (error)."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.coherenceJournal", "kind": "fired"}, "of": {"featureId": "multiMachine.coherenceJournal"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.coherenceJournal", "kind": "error"}, "of": {"featureId": "multiMachine.coherenceJournal"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
-    {"id": "multiMachine.coherenceJournal.replication.compaction", "title": "Journal compaction", "aliases": [], "flag": {"path": "multiMachine.coherenceJournal.replication.compaction.run"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "start": {"set": {"multiMachine.coherenceJournal.replication.compaction.run": true}}, "restartNeeded": true, "tracking": {"state": "needed", "plan": "The compactor is built only when run is true and has never run; add featureEvidence.record in src/core/CoherenceJournal.ts for each pass (fired) and failure (error). The rung reads run, so it cannot see the separate dryRun setting."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.coherenceJournal.replication.compaction", "kind": "fired"}, "of": {"featureId": "multiMachine.coherenceJournal.replication.compaction"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.coherenceJournal.replication.compaction", "kind": "error"}, "of": {"featureId": "multiMachine.coherenceJournal.replication.compaction"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.coherenceJournal.replication.compaction", "kind": "fired"}, "of": {"featureId": "multiMachine.coherenceJournal.replication.compaction"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.coherenceJournal.replication.compaction", "kind": "error"}, "of": {"featureId": "multiMachine.coherenceJournal.replication.compaction"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
-    {"id": "multiMachine.durableOwnership", "title": "Durable session ownership", "aliases": [], "flag": {"path": "multiMachine.durableOwnership"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in the OwnershipApplier at src/core/OwnershipApplier.ts for each placement adopted from the journal (fired) and each refused or failed apply (error); today only server.log shows it."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.durableOwnership", "kind": "fired"}, "of": {"featureId": "multiMachine.durableOwnership"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.durableOwnership", "kind": "error"}, "of": {"featureId": "multiMachine.durableOwnership"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
-    {"id": "multiMachine.identityReannounce", "title": "Machine identity reannounce", "aliases": ["multiMachine.identityReannounce.identityDivergenceMonitor", "multiMachine.identityReannounce (+ identityDivergenceMonitor)"], "flag": {"path": "multiMachine.identityReannounce"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "The divergence monitor runs on its own, so it cannot show reannouncing happened. Add featureEvidence.record at each reannounce attempt in src/core/ with the challenge result."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "reannounce-attempts", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.identityReannounce", "kind": "fired"}, "of": {"featureId": "multiMachine.identityReannounce"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.identityReannounce", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "multiMachine.identityReannounce", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "reannounce-attempts", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.identityReannounce", "kind": "fired"}, "of": {"featureId": "multiMachine.identityReannounce"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.identityReannounce", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "multiMachine.identityReannounce", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0, "minSamples": 1, "windowDays": 30}]}}, "rare": true},
-    {"id": "multiMachine.leaseSelfHeal.churnDetector", "title": "Lease churn detector", "aliases": [], "flag": {"path": "multiMachine.leaseSelfHeal.churnDetector"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "It writes only server.log lines; add featureEvidence.record in src/core/churnBreaker.ts at each latch or would-latch (fired) and at a latch later shown false (error)."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"multiMachine.leaseSelfHeal.churnDetector.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.churnDetector", "kind": "fired"}, "of": {"featureId": "multiMachine.leaseSelfHeal.churnDetector"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.churnDetector", "kind": "error"}, "of": {"featureId": "multiMachine.leaseSelfHeal.churnDetector"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.churnDetector", "kind": "fired"}, "of": {"featureId": "multiMachine.leaseSelfHeal.churnDetector"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.churnDetector", "kind": "error"}, "of": {"featureId": "multiMachine.leaseSelfHeal.churnDetector"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "monitoring.yieldSafety", "title": "Build-session yield safety", "aliases": [], "flag": {"path": "monitoring.yieldSafety"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/monitoring/SessionReaper.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.yieldSafety", "kind": "fired"}, "of": {"featureId": "monitoring.yieldSafety"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "monitoring.yieldSafety", "kind": "error"}, "of": {"featureId": "monitoring.yieldSafety"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "multiMachine.accountFollowMe", "title": "Account follow-me", "aliases": [], "flag": {"path": "multiMachine.accountFollowMe"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/commands/server.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.accountFollowMe", "kind": "fired"}, "of": {"featureId": "multiMachine.accountFollowMe"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.accountFollowMe", "kind": "error"}, "of": {"featureId": "multiMachine.accountFollowMe"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "multiMachine.coherenceJournal", "title": "Coherence journal", "aliases": [], "flag": {"path": "multiMachine.coherenceJournal"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/JournalSyncApplier.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.coherenceJournal", "kind": "fired"}, "of": {"featureId": "multiMachine.coherenceJournal"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.coherenceJournal", "kind": "error"}, "of": {"featureId": "multiMachine.coherenceJournal"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "multiMachine.coherenceJournal.replication.compaction", "title": "Journal compaction", "aliases": [], "flag": {"path": "multiMachine.coherenceJournal.replication.compaction.run"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "start": {"set": {"multiMachine.coherenceJournal.replication.compaction.run": true}}, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/commands/server.ts."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.coherenceJournal.replication.compaction", "kind": "fired"}, "of": {"featureId": "multiMachine.coherenceJournal.replication.compaction"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.coherenceJournal.replication.compaction", "kind": "error"}, "of": {"featureId": "multiMachine.coherenceJournal.replication.compaction"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.coherenceJournal.replication.compaction", "kind": "fired"}, "of": {"featureId": "multiMachine.coherenceJournal.replication.compaction"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.coherenceJournal.replication.compaction", "kind": "error"}, "of": {"featureId": "multiMachine.coherenceJournal.replication.compaction"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "multiMachine.durableOwnership", "title": "Durable session ownership", "aliases": [], "flag": {"path": "multiMachine.durableOwnership"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/OwnershipApplier.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.durableOwnership", "kind": "fired"}, "of": {"featureId": "multiMachine.durableOwnership"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.durableOwnership", "kind": "error"}, "of": {"featureId": "multiMachine.durableOwnership"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "multiMachine.identityReannounce", "title": "Machine identity reannounce", "aliases": ["multiMachine.identityReannounce.identityDivergenceMonitor", "multiMachine.identityReannounce (+ identityDivergenceMonitor)"], "flag": {"path": "multiMachine.identityReannounce"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/server/machineRoutes.ts, src/core/IdentityReannounceClaimant.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "reannounce-attempts", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.identityReannounce", "kind": "fired"}, "of": {"featureId": "multiMachine.identityReannounce"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.identityReannounce", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "multiMachine.identityReannounce", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "reannounce-attempts", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.identityReannounce", "kind": "fired"}, "of": {"featureId": "multiMachine.identityReannounce"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.identityReannounce", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "multiMachine.identityReannounce", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0, "minSamples": 1, "windowDays": 30}]}}, "rare": true},
+    {"id": "multiMachine.leaseSelfHeal.churnDetector", "title": "Lease churn detector", "aliases": [], "flag": {"path": "multiMachine.leaseSelfHeal.churnDetector"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/MultiMachineCoordinator.ts."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"multiMachine.leaseSelfHeal.churnDetector.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.churnDetector", "kind": "fired"}, "of": {"featureId": "multiMachine.leaseSelfHeal.churnDetector"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.churnDetector", "kind": "error"}, "of": {"featureId": "multiMachine.leaseSelfHeal.churnDetector"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.churnDetector", "kind": "fired"}, "of": {"featureId": "multiMachine.leaseSelfHeal.churnDetector"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.churnDetector", "kind": "error"}, "of": {"featureId": "multiMachine.leaseSelfHeal.churnDetector"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
     {"id": "multiMachine.leaseSelfHeal.preferredCaptainHandback", "title": "Lease hand-back", "aliases": [], "flag": {"path": "multiMachine.leaseSelfHeal.preferredCaptainHandback"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Heartbeats in logs/lease-handback.jsonl prove it runs, but all rows read self-is-preferred with zero episodes; the spec bar of one live verified hand-back and no episode-cap trips is graded through POST /maturation/evidence until its event rows exist."}, "rungs": {"dev-agent-live": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "heartbeats", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/lease-handback.jsonl", "where": {"kind": "heartbeat"}, "of": {"kind": "heartbeat"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "graded-right", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.preferredCaptainHandback", "kind": "outcome", "outcome": "right"}, "of": {"featureId": "multiMachine.leaseSelfHeal.preferredCaptainHandback", "kind": "outcome"}, "value": "count", "dedupe": "gradesEventId"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.preferredCaptainHandback", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "multiMachine.leaseSelfHeal.preferredCaptainHandback", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "heartbeats", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/lease-handback.jsonl", "where": {"kind": "heartbeat"}, "of": {"kind": "heartbeat"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "graded-right", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.preferredCaptainHandback", "kind": "outcome", "outcome": "right"}, "of": {"featureId": "multiMachine.leaseSelfHeal.preferredCaptainHandback", "kind": "outcome"}, "value": "count", "dedupe": "gradesEventId"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.preferredCaptainHandback", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "multiMachine.leaseSelfHeal.preferredCaptainHandback", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0, "minSamples": 1, "windowDays": 30}]}}},
-    {"id": "multiMachine.leaseSelfHeal.silentStandbyRelinquish", "title": "Silent standby relinquish", "aliases": [], "flag": {"path": "multiMachine.leaseSelfHeal.silentStandbyRelinquish"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Dark, so it emits nothing; add featureEvidence.record in src/core/MultiMachineCoordinator.ts where a silent standby gives up the lease (fired) and where that leaves nobody serving (error)."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.silentStandbyRelinquish", "kind": "fired"}, "of": {"featureId": "multiMachine.leaseSelfHeal.silentStandbyRelinquish"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.silentStandbyRelinquish", "kind": "error"}, "of": {"featureId": "multiMachine.leaseSelfHeal.silentStandbyRelinquish"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.silentStandbyRelinquish", "kind": "fired"}, "of": {"featureId": "multiMachine.leaseSelfHeal.silentStandbyRelinquish"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.silentStandbyRelinquish", "kind": "error"}, "of": {"featureId": "multiMachine.leaseSelfHeal.silentStandbyRelinquish"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
-    {"id": "multiMachine.leaseSelfHeal.soloCaptainHold", "title": "Solo captain hold", "aliases": [], "flag": {"path": "multiMachine.leaseSelfHeal.soloCaptainHold"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "It writes no rows and has no dry-run; add featureEvidence.record in src/core/LeaseCoordinator.ts where the sole captain holds the lease through a hold decision (fired) and where a hold blocks a healthy peer (error)."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.soloCaptainHold", "kind": "fired"}, "of": {"featureId": "multiMachine.leaseSelfHeal.soloCaptainHold"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.soloCaptainHold", "kind": "error"}, "of": {"featureId": "multiMachine.leaseSelfHeal.soloCaptainHold"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
-    {"id": "multiMachine.leaseSelfHeal.staleHolderTakeover", "title": "Stale holder takeover", "aliases": [], "flag": {"path": "multiMachine.leaseSelfHeal.staleHolderTakeover"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Dark, so it emits nothing; add featureEvidence.record in src/core/LeaseCoordinator.ts where a stale holder is taken over (fired) and where the holder turns out to be alive (error)."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.staleHolderTakeover", "kind": "fired"}, "of": {"featureId": "multiMachine.leaseSelfHeal.staleHolderTakeover"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.staleHolderTakeover", "kind": "error"}, "of": {"featureId": "multiMachine.leaseSelfHeal.staleHolderTakeover"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.staleHolderTakeover", "kind": "fired"}, "of": {"featureId": "multiMachine.leaseSelfHeal.staleHolderTakeover"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.staleHolderTakeover", "kind": "error"}, "of": {"featureId": "multiMachine.leaseSelfHeal.staleHolderTakeover"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "multiMachine.leaseSelfHeal.silentStandbyRelinquish", "title": "Silent standby relinquish", "aliases": [], "flag": {"path": "multiMachine.leaseSelfHeal.silentStandbyRelinquish"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/MultiMachineCoordinator.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.silentStandbyRelinquish", "kind": "fired"}, "of": {"featureId": "multiMachine.leaseSelfHeal.silentStandbyRelinquish"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.silentStandbyRelinquish", "kind": "error"}, "of": {"featureId": "multiMachine.leaseSelfHeal.silentStandbyRelinquish"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.silentStandbyRelinquish", "kind": "fired"}, "of": {"featureId": "multiMachine.leaseSelfHeal.silentStandbyRelinquish"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.silentStandbyRelinquish", "kind": "error"}, "of": {"featureId": "multiMachine.leaseSelfHeal.silentStandbyRelinquish"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "multiMachine.leaseSelfHeal.soloCaptainHold", "title": "Solo captain hold", "aliases": [], "flag": {"path": "multiMachine.leaseSelfHeal.soloCaptainHold"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/LeaseCoordinator.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.soloCaptainHold", "kind": "fired"}, "of": {"featureId": "multiMachine.leaseSelfHeal.soloCaptainHold"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.soloCaptainHold", "kind": "error"}, "of": {"featureId": "multiMachine.leaseSelfHeal.soloCaptainHold"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "multiMachine.leaseSelfHeal.staleHolderTakeover", "title": "Stale holder takeover", "aliases": [], "flag": {"path": "multiMachine.leaseSelfHeal.staleHolderTakeover"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/LeaseCoordinator.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.staleHolderTakeover", "kind": "fired"}, "of": {"featureId": "multiMachine.leaseSelfHeal.staleHolderTakeover"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.staleHolderTakeover", "kind": "error"}, "of": {"featureId": "multiMachine.leaseSelfHeal.staleHolderTakeover"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.staleHolderTakeover", "kind": "fired"}, "of": {"featureId": "multiMachine.leaseSelfHeal.staleHolderTakeover"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.leaseSelfHeal.staleHolderTakeover", "kind": "error"}, "of": {"featureId": "multiMachine.leaseSelfHeal.staleHolderTakeover"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
     {"id": "multiMachine.meshTransport.recoveryProbeEnabled", "title": "Rope recovery probe", "aliases": [], "flag": {"path": "multiMachine.meshTransport.recoveryProbeEnabled", "dryRunPath": "multiMachine.meshTransport.recoveryProbeDryRun"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Rows with sentinel rope-recovery-probe in logs/sentinel-events.jsonl report exhausted episodes, not closes, so the spec bar of one live verified recovery and zero false closes is graded through POST /maturation/evidence."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "probe-episodes", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/sentinel-events.jsonl", "where": {"sentinel": "rope-recovery-probe"}, "of": {"sentinel": "rope-recovery-probe"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "graded-right", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.meshTransport.recoveryProbeEnabled", "kind": "outcome", "outcome": "right"}, "of": {"featureId": "multiMachine.meshTransport.recoveryProbeEnabled", "kind": "outcome"}, "value": "count", "dedupe": "gradesEventId"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.meshTransport.recoveryProbeEnabled", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "multiMachine.meshTransport.recoveryProbeEnabled", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0, "minSamples": 1, "windowDays": 30}]}}},
     {"id": "multiMachine.mutualSsh", "title": "Mutual SSH bootstrap", "aliases": [], "flag": {"path": "multiMachine.mutualSsh"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "subject": "mutual-ssh-autobootstrap", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Its own log .instar/logs/mutual-ssh.jsonl shows the dry-run cadence, which only computes would-probe; the spec criterion, one mutual peer pair, comes from the mutual-ssh.ready-peers projection once it probes for real."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "dry-run-ticks", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/mutual-ssh.jsonl", "where": {"type": "dry-run"}, "of": {"type": "dry-run"}, "value": "count"}, "direction": "at-least", "threshold": 5000, "minSamples": 5000, "windowDays": 7}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.mutualSsh", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "multiMachine.mutualSsh", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "ready-mutual-ssh-peers", "role": "ran", "source": "feature-summary", "ref": {"ref": "mutual-ssh.ready-peers"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 14}, {"id": "repair-exhausted", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/logs/mutual-ssh.jsonl", "where": {"type": "repair-exhausted"}, "value": "count"}, "direction": "at-most", "threshold": 0, "minSamples": 100, "windowDays": 7}]}}},
-    {"id": "multiMachine.nobodyPollingRecovery", "title": "Nobody-polling recovery", "aliases": [], "flag": {"path": "multiMachine.nobodyPollingRecovery"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Its ledger is in memory and 34 fail-closed rows were the only result; add featureEvidence.record in src/core/nobodyPollingActuator.ts for each claim or would-claim (fired) and each fail-closed that lacked visibility (error)."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.nobodyPollingRecovery", "kind": "fired"}, "of": {"featureId": "multiMachine.nobodyPollingRecovery"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.nobodyPollingRecovery", "kind": "error"}, "of": {"featureId": "multiMachine.nobodyPollingRecovery"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.nobodyPollingRecovery", "kind": "fired"}, "of": {"featureId": "multiMachine.nobodyPollingRecovery"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.nobodyPollingRecovery", "kind": "error"}, "of": {"featureId": "multiMachine.nobodyPollingRecovery"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
-    {"id": "multiMachine.observedEndpoints", "title": "Observed peer endpoints", "aliases": [], "flag": {"path": "multiMachine.observedEndpoints"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "No durable ledger exists; add featureEvidence.record in src/core/ObservedEndpointTracker.ts for each corroborated or would-promote endpoint (fired) and each failed dial-back or quarantine (error)."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"multiMachine.observedEndpoints.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.observedEndpoints", "kind": "fired"}, "of": {"featureId": "multiMachine.observedEndpoints"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.observedEndpoints", "kind": "error"}, "of": {"featureId": "multiMachine.observedEndpoints"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.observedEndpoints", "kind": "fired"}, "of": {"featureId": "multiMachine.observedEndpoints"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.observedEndpoints", "kind": "error"}, "of": {"featureId": "multiMachine.observedEndpoints"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
-    {"id": "multiMachine.ownershipFollowsLiveWork", "title": "Ownership follows live work", "aliases": [], "flag": {"path": "multiMachine.ownershipFollowsLiveWork"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/core/ownershipFollowsLiveWork.ts at the release-on-complete and claim-on-spawn compare-and-set calls (fired) and when one is refused (error)."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.ownershipFollowsLiveWork", "kind": "fired"}, "of": {"featureId": "multiMachine.ownershipFollowsLiveWork"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.ownershipFollowsLiveWork", "kind": "error"}, "of": {"featureId": "multiMachine.ownershipFollowsLiveWork"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
-    {"id": "multiMachine.peerExecution", "title": "Peer execution keys", "aliases": [], "flag": {"path": "multiMachine.peerExecution"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Dark, depends on mutual SSH; add featureEvidence.record in src/core/MutualSshRuntime.ts where a verified peer key is installed or would be (fired) and where proof is refused (error)."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.peerExecution", "kind": "fired"}, "of": {"featureId": "multiMachine.peerExecution"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.peerExecution", "kind": "error"}, "of": {"featureId": "multiMachine.peerExecution"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.peerExecution", "kind": "fired"}, "of": {"featureId": "multiMachine.peerExecution"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.peerExecution", "kind": "error"}, "of": {"featureId": "multiMachine.peerExecution"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
-    {"id": "multiMachine.pollFollowsLease", "title": "Polling follows lease", "aliases": [], "flag": {"path": "multiMachine.pollFollowsLease"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Only server.log shows it, and the last carried evidence was 279 would-stop to 0 would-start, so add featureEvidence.record in src/core/MultiMachineCoordinator.ts at each would-start or would-stop (fired), and error when one would leave nobody polling."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.pollFollowsLease", "kind": "fired"}, "of": {"featureId": "multiMachine.pollFollowsLease"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.pollFollowsLease", "kind": "error"}, "of": {"featureId": "multiMachine.pollFollowsLease"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.pollFollowsLease", "kind": "fired"}, "of": {"featureId": "multiMachine.pollFollowsLease"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.pollFollowsLease", "kind": "error"}, "of": {"featureId": "multiMachine.pollFollowsLease"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
-    {"id": "multiMachine.recoveryKeyEscrow", "title": "Recovery key escrow", "aliases": [], "flag": {"path": "multiMachine.recoveryKeyEscrow"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "No recovery root exists on any machine yet; add featureEvidence.record, with no key material, in src/core/MachineIdentityBootRecovery.ts when escrow is minted or would be (fired) and when minting fails (error)."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.recoveryKeyEscrow", "kind": "fired"}, "of": {"featureId": "multiMachine.recoveryKeyEscrow"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.recoveryKeyEscrow", "kind": "error"}, "of": {"featureId": "multiMachine.recoveryKeyEscrow"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.recoveryKeyEscrow", "kind": "fired"}, "of": {"featureId": "multiMachine.recoveryKeyEscrow"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.recoveryKeyEscrow", "kind": "error"}, "of": {"featureId": "multiMachine.recoveryKeyEscrow"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
-    {"id": "multiMachine.seamlessOrchestrator", "title": "Seamlessness orchestrator", "aliases": [], "flag": {"path": "multiMachine.seamlessOrchestrator"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Its audit logs/orchestrator-actions.jsonl has never been written because no tick has proposed anything; add featureEvidence.record in src/monitoring/OrchestratorPoller.ts for each tick (fired) and failure (error), then cite that audit once it has rows."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessOrchestrator", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessOrchestrator"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessOrchestrator", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessOrchestrator"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessOrchestrator", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessOrchestrator"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessOrchestrator", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessOrchestrator"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
-    {"id": "multiMachine.seamlessness.ws13PinReplicate", "title": "Move pin replication", "aliases": ["multiMachine.seamlessness.ws13PinReplicate + ws13Reconcile"], "flag": {"path": "multiMachine.seamlessness.ws13PinReplicate"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/core/TopicPinReplicatedStore.ts when a pin record is written or applied (fired) and when one is rejected (error); the journal holds these rows but under per-machine file names."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws13PinReplicate", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessness.ws13PinReplicate"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws13PinReplicate", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessness.ws13PinReplicate"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
-    {"id": "multiMachine.seamlessness.ws13Reconcile", "title": "Ownership reconcile loop", "aliases": [], "flag": {"path": "multiMachine.seamlessness.ws13Reconcile", "dryRunPath": "multiMachine.seamlessness.ws13DryRun"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/core/OwnershipReconciler.ts for each reconcile that acts (fired) and each failed or refused compare-and-set (error)."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws13Reconcile", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessness.ws13Reconcile"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws13Reconcile", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessness.ws13Reconcile"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
-    {"id": "multiMachine.seamlessness.ws3OneVoice", "title": "One-voice speaker election", "aliases": [], "flag": {"path": "multiMachine.seamlessness.ws3OneVoice"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Only server.log shows its verdicts; add featureEvidence.record in src/monitoring/SpeakerElection.ts for each withheld send (fired) and for a double reply or a turn nobody answered (error)."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws3OneVoice", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessness.ws3OneVoice"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws3OneVoice", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessness.ws3OneVoice"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
-    {"id": "multiMachine.seamlessness.ws41DurableAck", "title": "Durable remote acknowledgement", "aliases": [], "flag": {"path": "multiMachine.seamlessness.ws41DurableAck"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "tracking": {"state": "needed", "plan": "src/core/RemoteAckStore.ts has never written logs/remote-ack-queue.jsonl because no ack has queued; add featureEvidence.record there when an intent is persisted and applied (fired) and when apply fails (error)."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws41DurableAck", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessness.ws41DurableAck"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws41DurableAck", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessness.ws41DurableAck"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
-    {"id": "multiMachine.seamlessness.ws43JournalLease", "title": "Journal lease cutover", "aliases": [], "flag": {"path": "multiMachine.seamlessness.ws43JournalLease"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "A code-owned readiness floor holds it on the legacy path, so it cannot pass until that lifts; add featureEvidence.record in src/scheduler/JobLeaseCutoverGate.ts for each cutover (fired) and each failure (error)."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws43JournalLease", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessness.ws43JournalLease"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws43JournalLease", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessness.ws43JournalLease"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
-    {"id": "multiMachine.seamlessness.ws43RoleGuard", "title": "Role guard at spawn", "aliases": [], "flag": {"path": "multiMachine.seamlessness.ws43RoleGuard"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Add featureEvidence.record in src/scheduler/JobScheduler.ts where a state-writing job is refused on a non-holder (fired) and where a holder is wrongly refused (error)."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws43RoleGuard", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessness.ws43RoleGuard"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws43RoleGuard", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessness.ws43RoleGuard"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
-    {"id": "multiMachine.seamlessness.ws44PoolCache", "title": "Shared pool cache", "aliases": [], "flag": {"path": "multiMachine.seamlessness.ws44PoolCache"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Its counters live in memory only; add featureEvidence.record in src/server/PoolPollCache.ts for a periodic summary of fetches, hits and load sheds (fired), and error when fetch failures pass a set share."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws44PoolCache", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessness.ws44PoolCache"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws44PoolCache", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessness.ws44PoolCache"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
-    {"id": "multiMachine.seamlessness.ws44PoolLinks", "title": "Cross-machine view links", "aliases": [], "flag": {"path": "multiMachine.seamlessness.ws44PoolLinks"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "No proxy count or ledger exists; add featureEvidence.record in src/server/routes.ts where /view/:id is proxied to the holder (fired) and where the assertion or proxy fails (error)."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws44PoolLinks", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessness.ws44PoolLinks"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws44PoolLinks", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessness.ws44PoolLinks"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
-    {"id": "multiMachine.secretSync", "title": "Cross-machine secret sync", "aliases": [], "flag": {"path": "multiMachine.secretSync"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Only boot lines show it; add featureEvidence.record, with no secret names or values, in the inbound handler started from src/commands/server.ts for each sync received (fired) and each failure to open or apply (error)."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.secretSync", "kind": "fired"}, "of": {"featureId": "multiMachine.secretSync"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.secretSync", "kind": "error"}, "of": {"featureId": "multiMachine.secretSync"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "multiMachine.nobodyPollingRecovery", "title": "Nobody-polling recovery", "aliases": [], "flag": {"path": "multiMachine.nobodyPollingRecovery"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/nobodyPollingActuator.ts, src/core/MultiMachineCoordinator.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.nobodyPollingRecovery", "kind": "fired"}, "of": {"featureId": "multiMachine.nobodyPollingRecovery"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.nobodyPollingRecovery", "kind": "error"}, "of": {"featureId": "multiMachine.nobodyPollingRecovery"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.nobodyPollingRecovery", "kind": "fired"}, "of": {"featureId": "multiMachine.nobodyPollingRecovery"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.nobodyPollingRecovery", "kind": "error"}, "of": {"featureId": "multiMachine.nobodyPollingRecovery"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "multiMachine.observedEndpoints", "title": "Observed peer endpoints", "aliases": [], "flag": {"path": "multiMachine.observedEndpoints"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/ObservedEndpointTracker.ts."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"multiMachine.observedEndpoints.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.observedEndpoints", "kind": "fired"}, "of": {"featureId": "multiMachine.observedEndpoints"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.observedEndpoints", "kind": "error"}, "of": {"featureId": "multiMachine.observedEndpoints"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.observedEndpoints", "kind": "fired"}, "of": {"featureId": "multiMachine.observedEndpoints"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.observedEndpoints", "kind": "error"}, "of": {"featureId": "multiMachine.observedEndpoints"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "multiMachine.ownershipFollowsLiveWork", "title": "Ownership follows live work", "aliases": [], "flag": {"path": "multiMachine.ownershipFollowsLiveWork"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/ownershipFollowsLiveWork.ts, src/commands/server.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.ownershipFollowsLiveWork", "kind": "fired"}, "of": {"featureId": "multiMachine.ownershipFollowsLiveWork"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.ownershipFollowsLiveWork", "kind": "error"}, "of": {"featureId": "multiMachine.ownershipFollowsLiveWork"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "multiMachine.peerExecution", "title": "Peer execution keys", "aliases": [], "flag": {"path": "multiMachine.peerExecution"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/MutualSshRuntime.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.peerExecution", "kind": "fired"}, "of": {"featureId": "multiMachine.peerExecution"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.peerExecution", "kind": "error"}, "of": {"featureId": "multiMachine.peerExecution"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.peerExecution", "kind": "fired"}, "of": {"featureId": "multiMachine.peerExecution"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.peerExecution", "kind": "error"}, "of": {"featureId": "multiMachine.peerExecution"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "multiMachine.pollFollowsLease", "title": "Polling follows lease", "aliases": [], "flag": {"path": "multiMachine.pollFollowsLease"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/MultiMachineCoordinator.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.pollFollowsLease", "kind": "fired"}, "of": {"featureId": "multiMachine.pollFollowsLease"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.pollFollowsLease", "kind": "error"}, "of": {"featureId": "multiMachine.pollFollowsLease"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.pollFollowsLease", "kind": "fired"}, "of": {"featureId": "multiMachine.pollFollowsLease"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.pollFollowsLease", "kind": "error"}, "of": {"featureId": "multiMachine.pollFollowsLease"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "multiMachine.recoveryKeyEscrow", "title": "Recovery key escrow", "aliases": [], "flag": {"path": "multiMachine.recoveryKeyEscrow"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/commands/server.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.recoveryKeyEscrow", "kind": "fired"}, "of": {"featureId": "multiMachine.recoveryKeyEscrow"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.recoveryKeyEscrow", "kind": "error"}, "of": {"featureId": "multiMachine.recoveryKeyEscrow"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.recoveryKeyEscrow", "kind": "fired"}, "of": {"featureId": "multiMachine.recoveryKeyEscrow"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.recoveryKeyEscrow", "kind": "error"}, "of": {"featureId": "multiMachine.recoveryKeyEscrow"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "multiMachine.seamlessOrchestrator", "title": "Seamlessness orchestrator", "aliases": [], "flag": {"path": "multiMachine.seamlessOrchestrator"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/monitoring/OrchestratorPoller.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessOrchestrator", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessOrchestrator"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessOrchestrator", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessOrchestrator"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessOrchestrator", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessOrchestrator"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessOrchestrator", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessOrchestrator"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "multiMachine.seamlessness.ws13PinReplicate", "title": "Move pin replication", "aliases": ["multiMachine.seamlessness.ws13PinReplicate + ws13Reconcile"], "flag": {"path": "multiMachine.seamlessness.ws13PinReplicate"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/TopicPinMutation.ts, src/core/JournalSyncApplier.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws13PinReplicate", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessness.ws13PinReplicate"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws13PinReplicate", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessness.ws13PinReplicate"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "multiMachine.seamlessness.ws13Reconcile", "title": "Ownership reconcile loop", "aliases": [], "flag": {"path": "multiMachine.seamlessness.ws13Reconcile", "dryRunPath": "multiMachine.seamlessness.ws13DryRun"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/OwnershipReconciler.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws13Reconcile", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessness.ws13Reconcile"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws13Reconcile", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessness.ws13Reconcile"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "multiMachine.seamlessness.ws3OneVoice", "title": "One-voice speaker election", "aliases": [], "flag": {"path": "multiMachine.seamlessness.ws3OneVoice"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/monitoring/SpeakerElection.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws3OneVoice", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessness.ws3OneVoice"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws3OneVoice", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessness.ws3OneVoice"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "multiMachine.seamlessness.ws41DurableAck", "title": "Durable remote acknowledgement", "aliases": [], "flag": {"path": "multiMachine.seamlessness.ws41DurableAck"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/RemoteAckStore.ts, src/server/routes.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws41DurableAck", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessness.ws41DurableAck"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws41DurableAck", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessness.ws41DurableAck"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "multiMachine.seamlessness.ws43JournalLease", "title": "Journal lease cutover", "aliases": [], "flag": {"path": "multiMachine.seamlessness.ws43JournalLease"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/scheduler/JobScheduler.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws43JournalLease", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessness.ws43JournalLease"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws43JournalLease", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessness.ws43JournalLease"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "multiMachine.seamlessness.ws43RoleGuard", "title": "Role guard at spawn", "aliases": [], "flag": {"path": "multiMachine.seamlessness.ws43RoleGuard"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/scheduler/JobScheduler.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws43RoleGuard", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessness.ws43RoleGuard"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws43RoleGuard", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessness.ws43RoleGuard"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}},
+    {"id": "multiMachine.seamlessness.ws44PoolCache", "title": "Shared pool cache", "aliases": [], "flag": {"path": "multiMachine.seamlessness.ws44PoolCache"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/server/PoolPollCache.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws44PoolCache", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessness.ws44PoolCache"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws44PoolCache", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessness.ws44PoolCache"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "multiMachine.seamlessness.ws44PoolLinks", "title": "Cross-machine view links", "aliases": [], "flag": {"path": "multiMachine.seamlessness.ws44PoolLinks"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/server/routes.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws44PoolLinks", "kind": "fired"}, "of": {"featureId": "multiMachine.seamlessness.ws44PoolLinks"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.seamlessness.ws44PoolLinks", "kind": "error"}, "of": {"featureId": "multiMachine.seamlessness.ws44PoolLinks"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "multiMachine.secretSync", "title": "Cross-machine secret sync", "aliases": [], "flag": {"path": "multiMachine.secretSync"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/SecretSync.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.secretSync", "kind": "fired"}, "of": {"featureId": "multiMachine.secretSync"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.secretSync", "kind": "error"}, "of": {"featureId": "multiMachine.secretSync"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
     {"id": "multiMachine.sessionPool", "title": "Session pool master switch", "aliases": [], "flag": {"path": "multiMachine.sessionPool"}, "disposition": "composed", "composedInto": "multiMachine.sessionPool.stage", "final": "default-on", "risk": "sensitive", "tracking": {"state": "needed", "plan": "The master switch moves with the stage, which StageAdvancer alone writes; the stage entry holds the evidence plan."}, "rungs": {}},
     {"id": "multiMachine.sessionPool.commitmentCustodyTransfer", "title": "Commitment custody transfer", "aliases": [], "flag": {"path": "multiMachine.sessionPool.commitmentCustodyTransfer"}, "disposition": "retire", "retire": {"reason": "No runtime code reads this flag, so it can never take effect.", "ref": "grep commitmentCustodyTransfer in src: only ConfigDefaults, types, devGatedFeatures, machineCoherenceManifest; review row 2026-10-22"}, "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "Nothing to log: no runtime code reads this flag, so it can never fire."}, "rungs": {}},
     {"id": "multiMachine.sessionPool.duplicateReconciler", "title": "Duplicate session reconciler", "aliases": [], "flag": {"path": "multiMachine.sessionPool.duplicateReconciler"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Its own log .instar/logs/duplicate-reconciler.jsonl; breaker trips and escalations against opened episodes are the harm, because each one means convergence failed and a person or a later pass has to clear it."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "episodes-opened", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/duplicate-reconciler.jsonl", "where": {"kind": "duplicate-episode-opened"}, "of": {"kind": "duplicate-episode-opened"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "breaker-trip-share", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/logs/duplicate-reconciler.jsonl", "where": {"kind": "breaker-tripped"}, "of": {"kind": "duplicate-episode-opened"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}, {"id": "escalated-share", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/logs/duplicate-reconciler.jsonl", "where": {"kind": "escalated"}, "of": {"kind": "duplicate-episode-opened"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
     {"id": "multiMachine.sessionPool.failoverRunner", "title": "Failover check runner", "aliases": [], "flag": {"path": "multiMachine.sessionPool.failoverRunner"}, "disposition": "composed", "composedInto": "multiMachine.sessionPool.stage", "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "It exists to produce the signed green that promotes the stage, so it moves with the stage; its result rows are that entry's evidence."}, "rungs": {}},
     {"id": "multiMachine.sessionPool.holdForStability", "title": "Hold for stability", "aliases": [], "flag": {"path": "multiMachine.sessionPool.holdForStability"}, "disposition": "composed", "composedInto": "multiMachine.sessionPool.inboundQueue", "final": "default-on", "risk": "sensitive", "tracking": {"state": "needed", "plan": "Same spec as the inbound queue, and it trails that queue by one stage on every step; the queue entry records its holds and recoveries."}, "rungs": {}},
-    {"id": "multiMachine.sessionPool.inboundQueue", "title": "Durable inbound queue", "aliases": [], "flag": {"path": "multiMachine.sessionPool.inboundQueue"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "subject": "durable-inbound-message-queue", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Its counters are read from GET /pool/queue and no log exists; add featureEvidence.record in the drain behind src/core/inboundQueueConfig.ts for each delivery (fired), each hold recovered in place (held), and each unexplained drop, expiry or ordering violation (error)."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.sessionPool.inboundQueue", "kind": "fired"}, "of": {"featureId": "multiMachine.sessionPool.inboundQueue"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 7}, {"id": "holds-recovered", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.sessionPool.inboundQueue", "kind": "held"}, "of": {"featureId": "multiMachine.sessionPool.inboundQueue"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 20, "windowDays": 7}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.sessionPool.inboundQueue", "kind": "error"}, "of": {"featureId": "multiMachine.sessionPool.inboundQueue"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 20, "windowDays": 7}]}}},
+    {"id": "multiMachine.sessionPool.inboundQueue", "title": "Durable inbound queue", "aliases": [], "flag": {"path": "multiMachine.sessionPool.inboundQueue"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "subject": "durable-inbound-message-queue", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/QueueDrainLoop.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.sessionPool.inboundQueue", "kind": "fired"}, "of": {"featureId": "multiMachine.sessionPool.inboundQueue"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 7}, {"id": "holds-recovered", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.sessionPool.inboundQueue", "kind": "held"}, "of": {"featureId": "multiMachine.sessionPool.inboundQueue"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 20, "windowDays": 7}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.sessionPool.inboundQueue", "kind": "error"}, "of": {"featureId": "multiMachine.sessionPool.inboundQueue"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 20, "windowDays": 7}]}}},
     {"id": "multiMachine.sessionPool.judgmentArbiters", "title": "Judgment arbiters", "aliases": [], "flag": {"path": "multiMachine.sessionPool.judgmentArbiters"}, "disposition": "retire", "retire": {"reason": "No runtime code reads this flag; 106 survivor decisions in the review window were all deterministic.", "ref": "grep judgmentArbiters in src: only ConfigDefaults, types, devGatedFeatures, machineCoherenceManifest; review row 2026-10-22"}, "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "Nothing to log: no runtime code reads this flag, so it can never fire."}, "rungs": {}},
     {"id": "multiMachine.sessionPool.ownershipCheckedSpawn", "title": "Ownership-checked spawn", "aliases": [], "flag": {"path": "multiMachine.sessionPool.ownershipCheckedSpawn"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Its own log logs/mesh-selfheal.jsonl records binding-would-clear in dry-run and binding-cleared when live; the review grades a sample of rows, because a wrongly cleared binding only shows when read against ownership."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "would-clear", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/mesh-selfheal.jsonl", "where": {"event": "binding-would-clear"}, "of": {"event": "binding-would-clear"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.sessionPool.ownershipCheckedSpawn", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "multiMachine.sessionPool.ownershipCheckedSpawn", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 5, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "cleared", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/mesh-selfheal.jsonl", "where": {"event": "binding-cleared"}, "of": {"event": "binding-cleared"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.sessionPool.ownershipCheckedSpawn", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "multiMachine.sessionPool.ownershipCheckedSpawn", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.05, "minSamples": 5, "windowDays": 30}]}}},
     {"id": "multiMachine.sessionPool.ownershipGatedSpawn", "title": "Ownership-gated spawn", "aliases": [], "flag": {"path": "multiMachine.sessionPool.ownershipGatedSpawn"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Its own log .instar/logs/owner-dark-ladder.jsonl holds one admission row in 14 days, because it binds only a verified live other owner; the review grades each row."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "admission-decisions", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/owner-dark-ladder.jsonl", "where": {"kind": "spawn-admission-decision"}, "of": {"kind": "spawn-admission-decision"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.sessionPool.ownershipGatedSpawn", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "multiMachine.sessionPool.ownershipGatedSpawn", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0, "minSamples": 1, "windowDays": 30}]}}},
-    {"id": "multiMachine.sessionPool.stage", "title": "Conversations across machines", "aliases": [], "flag": {"path": "multiMachine.sessionPool.stage", "on": "live-transfer"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "tracking": {"state": "needed", "plan": "The signed results sit in .instar/session-pool-e2e-results.json, which the reader refuses by name; add featureEvidence.record in src/core/SessionPoolFailoverRunner.ts for each signed green (fired) and red (error), inconclusive runs not counting."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "owner-driver", "driver": "StageAdvancer"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.sessionPool.stage", "kind": "fired"}, "of": {"featureId": "multiMachine.sessionPool.stage"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.sessionPool.stage", "kind": "error"}, "of": {"featureId": "multiMachine.sessionPool.stage"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "multiMachine.sessionPool.stage", "title": "Conversations across machines", "aliases": [], "flag": {"path": "multiMachine.sessionPool.stage", "on": "live-transfer"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/SessionPoolFailoverRunner.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "owner-driver", "driver": "StageAdvancer"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.sessionPool.stage", "kind": "fired"}, "of": {"featureId": "multiMachine.sessionPool.stage"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.sessionPool.stage", "kind": "error"}, "of": {"featureId": "multiMachine.sessionPool.stage"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
     {"id": "multiMachine.sessionPool.staleOwnerRelease", "title": "Stale owner release", "aliases": [], "flag": {"path": "multiMachine.sessionPool.staleOwnerRelease"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Its own decision trace logs/stale-owner-release.jsonl shows real claims and give-ups; the spec demands zero wrong claims, which the review grades through POST /maturation/evidence against whether the owner was really dead."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "claims", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/stale-owner-release.jsonl", "where": {"type": "claim"}, "of": {"type": "claim"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "giveup-share", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/stale-owner-release.jsonl", "where": {"type": "p19-giveup"}, "of": {"type": "claim"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}, {"id": "graded-wrong", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.sessionPool.staleOwnerRelease", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "multiMachine.sessionPool.staleOwnerRelease", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0, "minSamples": 3, "windowDays": 30}]}}},
-    {"id": "multiMachine.stateSync.classReview", "title": "Class review sync", "flag": {"path": "multiMachine.stateSync.classReview"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Today only a boot line reports it; record fired per merged peer lifecycle record and error per refused or failed merge in src/core/ClassReviewReplicatedStore.ts, including the would-merge decision while dry-run."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"multiMachine.stateSync.classReview.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.classReview", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.classReview"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.classReview", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.classReview"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.classReview", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.classReview"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.classReview", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.classReview"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
-    {"id": "multiMachine.stateSync.evolutionActions", "title": "Evolution action sync", "flag": {"path": "multiMachine.stateSync.evolutionActions"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Replication rows live in the machine-named coherence journal (<machineId>.evolution-action-record.jsonl), so no fixed path can cite them; record fired per applied peer record and error per failed apply in src/core/EvolutionActionsReplicatedStore.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.evolutionActions", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.evolutionActions"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.evolutionActions", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.evolutionActions"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
-    {"id": "multiMachine.stateSync.knowledge", "title": "Knowledge catalog sync", "flag": {"path": "multiMachine.stateSync.knowledge"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "No fixed-path log; the review goal is one real record copied across. Record fired per applied peer catalog record and error per failed apply in src/core/KnowledgeReplicatedStore.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.knowledge", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.knowledge"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.knowledge", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.knowledge"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
-    {"id": "multiMachine.stateSync.learnings", "title": "Learnings sync", "aliases": ["multiMachine.stateSync.learnings+evolutionActions+topicOperator"], "flag": {"path": "multiMachine.stateSync.learnings"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Replication rows live in the machine-named coherence journal (<machineId>.learning-record.jsonl), so no fixed path can cite them; record fired per applied peer record and error per failed apply in src/core/LearningsReplicatedStore.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.learnings", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.learnings"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.learnings", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.learnings"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
-    {"id": "multiMachine.stateSync.preferences", "title": "Preferences sync", "aliases": ["multiMachine.stateSync.preferences+relationships+knowledge+userRegistry"], "flag": {"path": "multiMachine.stateSync.preferences"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "No fixed-path log; the review goal is one real record copied across. Record fired per applied peer preference and error per failed apply in the preferences replicated store (src/core/PreferencesReplicatedStore.ts)."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.preferences", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.preferences"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.preferences", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.preferences"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
-    {"id": "multiMachine.stateSync.relationships", "title": "Relationships sync", "flag": {"path": "multiMachine.stateSync.relationships"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "No fixed-path log; the review goal is one real record copied across. Record fired per applied peer relationship and error per clamp refusal or failed apply in the relationships replicated store, with no personal data in the row."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.relationships", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.relationships"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.relationships", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.relationships"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
-    {"id": "multiMachine.stateSync.threadlinePairing", "title": "Pairing result sync", "flag": {"path": "multiMachine.stateSync.threadlinePairing"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Hard-dark, so nothing writes today; record fired per inherited pairing result and error per key-pin mismatch or failed apply in src/core/ThreadlinePairingReplicatedStore.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.threadlinePairing", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.threadlinePairing"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.threadlinePairing", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.threadlinePairing"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.threadlinePairing", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.threadlinePairing"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.threadlinePairing", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.threadlinePairing"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}, "aliases": []},
-    {"id": "multiMachine.stateSync.topicOperator", "title": "Topic operator sync", "flag": {"path": "multiMachine.stateSync.topicOperator"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Replication rows live in the machine-named coherence journal (<machineId>.topic-operator-record.jsonl), so no fixed path can cite them; record fired per applied peer record and error per failed apply in src/core/TopicOperatorReplicatedStore.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.topicOperator", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.topicOperator"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.topicOperator", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.topicOperator"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
-    {"id": "multiMachine.stateSync.userRegistry", "title": "User registry sync", "flag": {"path": "multiMachine.stateSync.userRegistry"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "No fixed-path log; the review goal is one real record copied across. Record fired per applied peer user record and error per clamp refusal or failed apply in src/core/UserRegistryReplicatedStore.ts, with no personal data in the row."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.userRegistry", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.userRegistry"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.userRegistry", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.userRegistry"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
+    {"id": "multiMachine.stateSync.classReview", "title": "Class review sync", "flag": {"path": "multiMachine.stateSync.classReview"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/JournalSyncApplier.ts."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"multiMachine.stateSync.classReview.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.classReview", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.classReview"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.classReview", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.classReview"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.classReview", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.classReview"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.classReview", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.classReview"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
+    {"id": "multiMachine.stateSync.evolutionActions", "title": "Evolution action sync", "flag": {"path": "multiMachine.stateSync.evolutionActions"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/JournalSyncApplier.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.evolutionActions", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.evolutionActions"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.evolutionActions", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.evolutionActions"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
+    {"id": "multiMachine.stateSync.knowledge", "title": "Knowledge catalog sync", "flag": {"path": "multiMachine.stateSync.knowledge"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/JournalSyncApplier.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.knowledge", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.knowledge"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.knowledge", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.knowledge"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
+    {"id": "multiMachine.stateSync.learnings", "title": "Learnings sync", "aliases": ["multiMachine.stateSync.learnings+evolutionActions+topicOperator"], "flag": {"path": "multiMachine.stateSync.learnings"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/JournalSyncApplier.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.learnings", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.learnings"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.learnings", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.learnings"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "multiMachine.stateSync.preferences", "title": "Preferences sync", "aliases": ["multiMachine.stateSync.preferences+relationships+knowledge+userRegistry"], "flag": {"path": "multiMachine.stateSync.preferences"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/JournalSyncApplier.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.preferences", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.preferences"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.preferences", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.preferences"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "multiMachine.stateSync.relationships", "title": "Relationships sync", "flag": {"path": "multiMachine.stateSync.relationships"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/JournalSyncApplier.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.relationships", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.relationships"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.relationships", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.relationships"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
+    {"id": "multiMachine.stateSync.threadlinePairing", "title": "Pairing result sync", "flag": {"path": "multiMachine.stateSync.threadlinePairing"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/threadline/pairingReplicationWiring.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.threadlinePairing", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.threadlinePairing"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.threadlinePairing", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.threadlinePairing"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.threadlinePairing", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.threadlinePairing"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.threadlinePairing", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.threadlinePairing"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}, "aliases": []},
+    {"id": "multiMachine.stateSync.topicOperator", "title": "Topic operator sync", "flag": {"path": "multiMachine.stateSync.topicOperator"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/JournalSyncApplier.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.topicOperator", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.topicOperator"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.topicOperator", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.topicOperator"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
+    {"id": "multiMachine.stateSync.userRegistry", "title": "User registry sync", "flag": {"path": "multiMachine.stateSync.userRegistry"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/JournalSyncApplier.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.userRegistry", "kind": "fired"}, "of": {"featureId": "multiMachine.stateSync.userRegistry"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.stateSync.userRegistry", "kind": "error"}, "of": {"featureId": "multiMachine.stateSync.userRegistry"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
     {"id": "multiMachine.writeAdmission", "title": "Standby write admission", "flag": {"path": "multiMachine.writeAdmission"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Its verdict log shows it ran; a refusal is not harm in itself, so the review grades sampled verdicts as wrongly refused or wrongly admitted."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "verdict-rows", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/write-admission.jsonl", "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "graded-wrong", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.writeAdmission", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "multiMachine.writeAdmission", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.1, "minSamples": 5, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "verdict-rows", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/write-admission.jsonl", "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "graded-wrong", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.writeAdmission", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "multiMachine.writeAdmission", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.1, "minSamples": 5, "windowDays": 30}]}}, "aliases": []},
-    {"id": "multiMachine.zombieRelinquish", "title": "Zombie holder relinquish", "flag": {"path": "multiMachine.zombieRelinquish"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Its ledger is process memory and its only trace is a [g1-relinquish] console line; record fired per would-relinquish or relinquish and error per failed relinquish at the decision in src/core/MultiMachineCoordinator.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.zombieRelinquish", "kind": "fired"}, "of": {"featureId": "multiMachine.zombieRelinquish"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.zombieRelinquish", "kind": "error"}, "of": {"featureId": "multiMachine.zombieRelinquish"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.zombieRelinquish", "kind": "fired"}, "of": {"featureId": "multiMachine.zombieRelinquish"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.zombieRelinquish", "kind": "error"}, "of": {"featureId": "multiMachine.zombieRelinquish"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}, "aliases": []},
-    {"id": "passkeys", "title": "Agent-held passkeys", "flag": {"path": "passkeys"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "passkey-legacy-reads.jsonl records old secret reads, not this feature, and no grant exists yet; record fired per grant, enrollment and passkey sign-in and error per failure, in the grant routes and passkey-cell mandate receiver."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "passkeys", "kind": "fired"}, "of": {"featureId": "passkeys"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "passkeys", "kind": "error"}, "of": {"featureId": "passkeys"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
+    {"id": "multiMachine.zombieRelinquish", "title": "Zombie holder relinquish", "flag": {"path": "multiMachine.zombieRelinquish"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/MultiMachineCoordinator.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.zombieRelinquish", "kind": "fired"}, "of": {"featureId": "multiMachine.zombieRelinquish"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.zombieRelinquish", "kind": "error"}, "of": {"featureId": "multiMachine.zombieRelinquish"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.zombieRelinquish", "kind": "fired"}, "of": {"featureId": "multiMachine.zombieRelinquish"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "multiMachine.zombieRelinquish", "kind": "error"}, "of": {"featureId": "multiMachine.zombieRelinquish"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}, "aliases": []},
+    {"id": "passkeys", "title": "Agent-held passkeys", "flag": {"path": "passkeys"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/server/routes.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "passkeys", "kind": "fired"}, "of": {"featureId": "passkeys"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "passkeys", "kind": "error"}, "of": {"featureId": "passkeys"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
     {"id": "playwrightRegistry", "title": "Playwright profile registry", "flag": {"path": "playwrightRegistry"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads its own profile action rows (none since 09-25, so it reads no-data until used again); it logs no failures, so also record error rows when an activate or assign fails in src/server/routes.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "profile-actions", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/playwright-profiles.jsonl", "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "playwrightRegistry", "kind": "error"}, "of": {"featureId": "playwrightRegistry"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}, "aliases": []},
     {"id": "prGate.classClosure", "title": "Class closure gate", "flag": {"path": "prGate.classClosure"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "tracking": {"state": "needed", "plan": "CI-only report-only lint with no machine ledger; report through POST /maturation/evidence from scripts/class-closure-lint.mjs: fired per fix with the class block populated, error per fix missing it or pipeline breakage (written bar: 10 fixes, 100% populated, zero breakage)."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "prGate.classClosure", "kind": "fired"}, "of": {"featureId": "prGate.classClosure"}, "value": "count"}, "direction": "at-least", "threshold": 10, "minSamples": 10, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "prGate.classClosure", "kind": "error"}, "of": {"featureId": "prGate.classClosure"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 10, "windowDays": 14}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "prGate.classClosure", "kind": "fired"}, "of": {"featureId": "prGate.classClosure"}, "value": "count"}, "direction": "at-least", "threshold": 10, "minSamples": 10, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "prGate.classClosure", "kind": "error"}, "of": {"featureId": "prGate.classClosure"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 10, "windowDays": 14}]}}, "aliases": []},
-    {"id": "provenance.uniformSeam", "title": "Uniform decision provenance", "flag": {"path": "provenance.uniformSeam"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Its rows go to dated judgment-provenance/<date>.jsonl files and decision_quality, which a fixed-path metric cannot read; record an hourly fired summary and error per failed side write in src/core/DecisionQualityRecorderImpl.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "provenance.uniformSeam", "kind": "fired"}, "of": {"featureId": "provenance.uniformSeam"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "provenance.uniformSeam", "kind": "error"}, "of": {"featureId": "provenance.uniformSeam"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []},
+    {"id": "provenance.uniformSeam", "title": "Uniform decision provenance", "flag": {"path": "provenance.uniformSeam"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/DecisionQualityRecorderImpl.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "provenance.uniformSeam", "kind": "fired"}, "of": {"featureId": "provenance.uniformSeam"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "provenance.uniformSeam", "kind": "error"}, "of": {"featureId": "provenance.uniformSeam"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []},
     {"id": "queuePace", "title": "Queue pace ledger", "flag": {"path": "queuePace"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads its own hourly interval rows (about 96 a day across four live queues, time field `to`); count drift is its own honesty signal, and it reads 6.6% today, so it holds until that drops."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "hourly-intervals", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/queue-pace.jsonl", "where": {"kind": "interval"}, "of": {"kind": "interval"}, "value": "count", "timeField": "to"}, "direction": "at-least", "threshold": 1000, "minSamples": 1000, "windowDays": 14}, {"id": "intervals-ok", "role": "quality", "source": "jsonl-log", "ref": {"file": ".instar/logs/queue-pace.jsonl", "where": {"kind": "interval", "ok": true}, "of": {"kind": "interval"}, "value": "ratio", "timeField": "to"}, "direction": "at-least", "threshold": 0.9, "minSamples": 100, "windowDays": 14}, {"id": "count-drift-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/logs/queue-pace.jsonl", "where": {"kind": "interval", "reason": "count-drift"}, "of": {"kind": "interval"}, "value": "ratio", "timeField": "to"}, "direction": "at-most", "threshold": 0.05, "minSamples": 100, "windowDays": 14}]}}, "aliases": []},
-    {"id": "remoteDesktop", "title": "Remote desktop", "flag": {"path": "remoteDesktop"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "tracking": {"state": "needed", "plan": "Preference candidate: full display and input access may stay an explicit per-machine opt-in. Its access rows are dated desktop-access-<date>.jsonl files a fixed-path metric cannot read; record fired per session start and error per failed start in src/server/routes.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "remoteDesktop", "kind": "fired"}, "of": {"featureId": "remoteDesktop"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "remoteDesktop", "kind": "error"}, "of": {"featureId": "remoteDesktop"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
+    {"id": "remoteDesktop", "title": "Remote desktop", "flag": {"path": "remoteDesktop"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "tracking": {"state": "measured", "plan": "Preference candidate. Records its decisions to the shared evidence log from src/server/routes.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "remoteDesktop", "kind": "fired"}, "of": {"featureId": "remoteDesktop"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "remoteDesktop", "kind": "error"}, "of": {"featureId": "remoteDesktop"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
     {"id": "remoteDesktop.guidedSetup", "title": "Guided desktop setup", "flag": {"path": "remoteDesktop.guidedSetup"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads its own setup rows, only 2 so far; the written bar is each operator machine taken from off to a working session with no config edit and no defect, which the review confirms; turn-on rows show the flow finishing."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "setup-actions", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/desktop-setup.jsonl", "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "turn-ons", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/desktop-setup.jsonl", "where": {"action": "turn-on"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "failed-actions", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/logs/desktop-setup.jsonl", "where": {"outcome": "failed"}, "value": "count"}, "direction": "at-most", "threshold": 0, "minSamples": 1, "windowDays": 30}, {"id": "graded-wrong", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "remoteDesktop.guidedSetup", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "remoteDesktop.guidedSetup", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.1, "minSamples": 5, "windowDays": 30}]}}, "aliases": []},
-    {"id": "routingSpend.money", "title": "Metered spend authority", "aliases": ["routingSpend (.money)"], "flag": {"path": "routingSpend.money"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Preference candidate: real-dollar authority may stay an explicit operator enable. routing-spend-alerts only says the door is dark, so record fired per metered call admitted and error per cap breach or ledger failure at src/core/meteredCallEntry.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "routingSpend.money", "kind": "fired"}, "of": {"featureId": "routingSpend.money"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "routingSpend.money", "kind": "error"}, "of": {"featureId": "routingSpend.money"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "routingSpend.money", "kind": "fired"}, "of": {"featureId": "routingSpend.money"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "routingSpend.money", "kind": "error"}, "of": {"featureId": "routingSpend.money"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
-    {"id": "selfKnowledge.sessionContext", "title": "Session self-knowledge", "flag": {"path": "selfKnowledge.sessionContext"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "No serve-audit log exists; record fired per block served and error per failed build at the session-context route in src/server/routes.ts, with fact counts in context since 49 of 50 stored facts reportedly never reach a session."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "selfKnowledge.sessionContext", "kind": "fired"}, "of": {"featureId": "selfKnowledge.sessionContext"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "selfKnowledge.sessionContext", "kind": "error"}, "of": {"featureId": "selfKnowledge.sessionContext"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []},
-    {"id": "sessions.respawnBuildContext", "title": "Respawn build context", "flag": {"path": "sessions.respawnBuildContext"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Writes only a state map (5.1 MB, 20,820 entries, never pruned); record fired per restart that uses a captured context and error per capture failure in src/core/SessionManager.ts, and bound the map before fleet."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "sessions.respawnBuildContext", "kind": "fired"}, "of": {"featureId": "sessions.respawnBuildContext"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "sessions.respawnBuildContext", "kind": "error"}, "of": {"featureId": "sessions.respawnBuildContext"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []},
-    {"id": "subscriptionPool.assistedRelogin", "title": "Assisted account relogin", "aliases": ["subscriptionPool.assistedRelogin.slowRetry"], "flag": {"path": "subscriptionPool.assistedRelogin"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Preference candidate: submitting provider credentials may stay opt-in. Attempts live in SQLite (subscription-relogin/repairs.db); record fired per successful repair and error per failed one in src/core/SubscriptionReloginRuntime.ts (written bar: 10 repairs over 30 days)."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.assistedRelogin", "kind": "fired"}, "of": {"featureId": "subscriptionPool.assistedRelogin"}, "value": "count"}, "direction": "at-least", "threshold": 10, "minSamples": 10, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.assistedRelogin", "kind": "error"}, "of": {"featureId": "subscriptionPool.assistedRelogin"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 30}]}}},
-    {"id": "subscriptionPool.codexDeviceLimit", "title": "Codex device-limit tripwire", "flag": {"path": "subscriptionPool.codexDeviceLimit"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "tracking": {"state": "needed", "plan": "It logs to codex-device-limit.jsonl only when a verdict happens, and that file does not exist here yet; record fired per bench or release decision and error per failed judgement in src/core/codexDeviceLimitWiring.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.codexDeviceLimit", "kind": "fired"}, "of": {"featureId": "subscriptionPool.codexDeviceLimit"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.codexDeviceLimit", "kind": "error"}, "of": {"featureId": "subscriptionPool.codexDeviceLimit"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}, "aliases": []},
-    {"id": "subscriptionPool.credentialRepointing", "title": "Credential repointing", "flag": {"path": "subscriptionPool.credentialRepointing"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Its audit credential-swaps.jsonl is a refused path by name, and most steps were preflight-refused on identity unavailable; record fired per swap or dry-run swap and error per preflight refusal in src/core/CredentialSwapExecutor.ts, with no token material."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.credentialRepointing", "kind": "fired"}, "of": {"featureId": "subscriptionPool.credentialRepointing"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.credentialRepointing", "kind": "error"}, "of": {"featureId": "subscriptionPool.credentialRepointing"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.credentialRepointing", "kind": "fired"}, "of": {"featureId": "subscriptionPool.credentialRepointing"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.credentialRepointing", "kind": "error"}, "of": {"featureId": "subscriptionPool.credentialRepointing"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []},
+    {"id": "routingSpend.money", "title": "Metered spend authority", "aliases": ["routingSpend (.money)"], "flag": {"path": "routingSpend.money"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Preference candidate. Records its decisions to the shared evidence log from src/core/meteredCallEntry.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "routingSpend.money", "kind": "fired"}, "of": {"featureId": "routingSpend.money"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "routingSpend.money", "kind": "error"}, "of": {"featureId": "routingSpend.money"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "routingSpend.money", "kind": "fired"}, "of": {"featureId": "routingSpend.money"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "routingSpend.money", "kind": "error"}, "of": {"featureId": "routingSpend.money"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}},
+    {"id": "selfKnowledge.sessionContext", "title": "Session self-knowledge", "flag": {"path": "selfKnowledge.sessionContext"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/server/routes.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "selfKnowledge.sessionContext", "kind": "fired"}, "of": {"featureId": "selfKnowledge.sessionContext"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "selfKnowledge.sessionContext", "kind": "error"}, "of": {"featureId": "selfKnowledge.sessionContext"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []},
+    {"id": "sessions.respawnBuildContext", "title": "Respawn build context", "flag": {"path": "sessions.respawnBuildContext"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/SessionManager.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "sessions.respawnBuildContext", "kind": "fired"}, "of": {"featureId": "sessions.respawnBuildContext"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "sessions.respawnBuildContext", "kind": "error"}, "of": {"featureId": "sessions.respawnBuildContext"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []},
+    {"id": "subscriptionPool.assistedRelogin", "title": "Assisted account relogin", "aliases": ["subscriptionPool.assistedRelogin.slowRetry"], "flag": {"path": "subscriptionPool.assistedRelogin"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Preference candidate. Records its decisions to the shared evidence log from src/core/SubscriptionReloginStore.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.assistedRelogin", "kind": "fired"}, "of": {"featureId": "subscriptionPool.assistedRelogin"}, "value": "count"}, "direction": "at-least", "threshold": 10, "minSamples": 10, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.assistedRelogin", "kind": "error"}, "of": {"featureId": "subscriptionPool.assistedRelogin"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 10, "windowDays": 30}]}}},
+    {"id": "subscriptionPool.codexDeviceLimit", "title": "Codex device-limit tripwire", "flag": {"path": "subscriptionPool.codexDeviceLimit"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/codexDeviceLimitWiring.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.codexDeviceLimit", "kind": "fired"}, "of": {"featureId": "subscriptionPool.codexDeviceLimit"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.codexDeviceLimit", "kind": "error"}, "of": {"featureId": "subscriptionPool.codexDeviceLimit"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}, "aliases": []},
+    {"id": "subscriptionPool.credentialRepointing", "title": "Credential repointing", "flag": {"path": "subscriptionPool.credentialRepointing"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/CredentialSwapExecutor.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.credentialRepointing", "kind": "fired"}, "of": {"featureId": "subscriptionPool.credentialRepointing"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.credentialRepointing", "kind": "error"}, "of": {"featureId": "subscriptionPool.credentialRepointing"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.credentialRepointing", "kind": "fired"}, "of": {"featureId": "subscriptionPool.credentialRepointing"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.credentialRepointing", "kind": "error"}, "of": {"featureId": "subscriptionPool.credentialRepointing"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []},
     {"id": "subscriptionPool.proactiveSwap.antiThrash", "title": "Swap anti-thrash brakes", "flag": {"path": "subscriptionPool.proactiveSwap.antiThrash", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads the swap ledger: brake refusals show it ran, and proactive swaps stay a small share of proactive decisions (5.6% over 14 days; a thrash day would push that up)."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "brake-refusals", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/state/swap-ledger.jsonl", "where": {"kind": "proactive", "decision": "refused"}, "of": {"kind": "proactive"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "proactive-failure-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/state/swap-ledger.jsonl", "where": {"kind": "proactive", "decision": "failed"}, "of": {"kind": "proactive"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}, {"id": "graded-wrong", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.proactiveSwap.antiThrash", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "subscriptionPool.proactiveSwap.antiThrash", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.1, "minSamples": 5, "windowDays": 30}]}}, "aliases": []},
-    {"id": "subscriptionPool.proactiveSwap.defaultSlotRepoint", "title": "Default slot repoint", "flag": {"path": "subscriptionPool.proactiveSwap.defaultSlotRepoint"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Its would-repoint record goes to the credential audit, a refused path by name; record fired once per distinct intended flip, not per tick, and error per failed flip at the audit call in src/core/ProactiveSwapMonitor.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.proactiveSwap.defaultSlotRepoint", "kind": "fired"}, "of": {"featureId": "subscriptionPool.proactiveSwap.defaultSlotRepoint"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.proactiveSwap.defaultSlotRepoint", "kind": "error"}, "of": {"featureId": "subscriptionPool.proactiveSwap.defaultSlotRepoint"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.proactiveSwap.defaultSlotRepoint", "kind": "fired"}, "of": {"featureId": "subscriptionPool.proactiveSwap.defaultSlotRepoint"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.proactiveSwap.defaultSlotRepoint", "kind": "error"}, "of": {"featureId": "subscriptionPool.proactiveSwap.defaultSlotRepoint"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
+    {"id": "subscriptionPool.proactiveSwap.defaultSlotRepoint", "title": "Default slot repoint", "flag": {"path": "subscriptionPool.proactiveSwap.defaultSlotRepoint"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/core/ProactiveSwapMonitor.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.proactiveSwap.defaultSlotRepoint", "kind": "fired"}, "of": {"featureId": "subscriptionPool.proactiveSwap.defaultSlotRepoint"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.proactiveSwap.defaultSlotRepoint", "kind": "error"}, "of": {"featureId": "subscriptionPool.proactiveSwap.defaultSlotRepoint"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.proactiveSwap.defaultSlotRepoint", "kind": "fired"}, "of": {"featureId": "subscriptionPool.proactiveSwap.defaultSlotRepoint"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "subscriptionPool.proactiveSwap.defaultSlotRepoint", "kind": "error"}, "of": {"featureId": "subscriptionPool.proactiveSwap.defaultSlotRepoint"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
     {"id": "subscriptionPool.proactiveSwap.loginLoss", "title": "Login-loss swap", "flag": {"path": "subscriptionPool.proactiveSwap.loginLoss"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads swap-ledger rows with sourceTrigger login-loss (one ever, 09-12), so idle is healthy; failed rows carry no sourceTrigger, so harm reads the failure rate of the same proactive funnel it swaps through."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "login-loss-swaps", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/state/swap-ledger.jsonl", "where": {"sourceTrigger": "login-loss"}, "of": {"sourceTrigger": "login-loss"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "login-loss-failure-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/state/swap-ledger.jsonl", "where": {"sourceTrigger": "login-loss", "decision": "failed"}, "of": {"sourceTrigger": "login-loss"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}, "aliases": []},
     {"id": "subscriptionPool.swapContinuity", "title": "Swap continuity gate", "flag": {"path": "subscriptionPool.swapContinuity", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads the swap ledger: in-flight deferrals show the gate ran; reactive swap failures read 6.7% over 14 days (not-telegram-bound), so it holds until fixed; ceiling drops measure proactive swaps it cost."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "work-deferrals", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/state/swap-ledger.jsonl", "where": {"callerClass": "proactive-swap", "decision": "deferred"}, "of": {"callerClass": "proactive-swap"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "ceiling-drop-share", "role": "quality", "source": "jsonl-log", "ref": {"file": ".instar/state/swap-ledger.jsonl", "where": {"kind": "proactive", "decision": "dropped"}, "of": {"kind": "proactive"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.15, "minSamples": 20, "windowDays": 14}, {"id": "reactive-failure-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/state/swap-ledger.jsonl", "where": {"kind": "reactive", "decision": "failed"}, "of": {"kind": "reactive"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []},
-    {"id": "telegramIngress.lifelineSecret.enforce", "title": "Lifeline ingress secret", "aliases": ["telegramIngress.lifelineSecret"], "flag": {"path": "telegramIngress.lifelineSecret.enforce"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "tracking": {"state": "needed", "plan": "Its verified and would-refuse counts are only on /health; record fired per hourly verified count and error per message refused from the real lifeline in src/server/LifelineIngressGuard.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "telegramIngress.lifelineSecret.enforce", "kind": "fired"}, "of": {"featureId": "telegramIngress.lifelineSecret.enforce"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "telegramIngress.lifelineSecret.enforce", "kind": "error"}, "of": {"featureId": "telegramIngress.lifelineSecret.enforce"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
-    {"id": "threadline.a2aCheckIn", "title": "A2A check-in summaries", "flag": {"path": "threadline.a2aCheckIn"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Preference candidate: unbounded heartbeat summaries may stay opt-in so the operator is not flooded. Dark with no log; record fired per summary sent and error per failed one in the check-in scheduler in src/commands/server.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.a2aCheckIn", "kind": "fired"}, "of": {"featureId": "threadline.a2aCheckIn"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.a2aCheckIn", "kind": "error"}, "of": {"featureId": "threadline.a2aCheckIn"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.a2aCheckIn", "kind": "fired"}, "of": {"featureId": "threadline.a2aCheckIn"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.a2aCheckIn", "kind": "error"}, "of": {"featureId": "threadline.a2aCheckIn"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
-    {"id": "threadline.backupRoutes", "title": "A2A backup routes", "flag": {"path": "threadline.backupRoutes"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "tracking": {"state": "needed", "plan": "Only [a2a-backup] console lines and /health counters exist; record fired per marked fall-through and fingerprint local delivery and error per failed one in src/threadline/backupRoutes.ts (written bar: at least one of each, zero is not a pass)."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.backupRoutes", "kind": "fired"}, "of": {"featureId": "threadline.backupRoutes"}, "value": "count"}, "direction": "at-least", "threshold": 2, "minSamples": 2, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.backupRoutes", "kind": "error"}, "of": {"featureId": "threadline.backupRoutes"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 2, "windowDays": 30}]}}, "aliases": []},
+    {"id": "telegramIngress.lifelineSecret.enforce", "title": "Lifeline ingress secret", "aliases": ["telegramIngress.lifelineSecret"], "flag": {"path": "telegramIngress.lifelineSecret.enforce"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/server/LifelineIngressGuard.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "telegramIngress.lifelineSecret.enforce", "kind": "fired"}, "of": {"featureId": "telegramIngress.lifelineSecret.enforce"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "telegramIngress.lifelineSecret.enforce", "kind": "error"}, "of": {"featureId": "telegramIngress.lifelineSecret.enforce"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}},
+    {"id": "threadline.a2aCheckIn", "title": "A2A check-in summaries", "flag": {"path": "threadline.a2aCheckIn"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Preference candidate. Records its decisions to the shared evidence log from src/threadline/A2ACheckInProxy.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.a2aCheckIn", "kind": "fired"}, "of": {"featureId": "threadline.a2aCheckIn"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.a2aCheckIn", "kind": "error"}, "of": {"featureId": "threadline.a2aCheckIn"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.a2aCheckIn", "kind": "fired"}, "of": {"featureId": "threadline.a2aCheckIn"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.a2aCheckIn", "kind": "error"}, "of": {"featureId": "threadline.a2aCheckIn"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
+    {"id": "threadline.backupRoutes", "title": "A2A backup routes", "flag": {"path": "threadline.backupRoutes"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/server/routes.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.backupRoutes", "kind": "fired"}, "of": {"featureId": "threadline.backupRoutes"}, "value": "count"}, "direction": "at-least", "threshold": 2, "minSamples": 2, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.backupRoutes", "kind": "error"}, "of": {"featureId": "threadline.backupRoutes"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 2, "windowDays": 30}]}}, "aliases": []},
     {"id": "threadline.canonicalHistory.conversationDiscipline", "title": "Conversation discipline", "flag": {"path": "threadline.canonicalHistory.conversationDiscipline"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads its own resolver rows; a minted no-binding row is the fork it exists to close (2.9% over 14 days). Would-join rows are too rare to bar on (three, all on 10-08)."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"threadline.canonicalHistory.conversationDiscipline.dryRun": false}}, "metrics": [{"id": "resolver-decisions", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/threadline-canonical-history.jsonl", "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "fork-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": ".instar/logs/threadline-canonical-history.jsonl", "where": {"dryRun": true, "decision": "minted:no-binding"}, "of": {"dryRun": true}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "resolver-decisions", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/threadline-canonical-history.jsonl", "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "fork-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": ".instar/logs/threadline-canonical-history.jsonl", "where": {"dryRun": false, "decision": "minted:no-binding"}, "of": {"dryRun": false}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []},
-    {"id": "threadline.hubIntent", "title": "Hub intent recognizer", "flag": {"path": "threadline.hubIntent"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "logs/hub-intent.jsonl does not exist yet, as no hub message has reached the classifier here; record fired per would-swallow or would-pass verdict and error per classifier failure beside that append in src/commands/server.ts."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"threadline.hubIntent.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.hubIntent", "kind": "fired"}, "of": {"featureId": "threadline.hubIntent"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.hubIntent", "kind": "error"}, "of": {"featureId": "threadline.hubIntent"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.hubIntent", "kind": "fired"}, "of": {"featureId": "threadline.hubIntent"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.hubIntent", "kind": "error"}, "of": {"featureId": "threadline.hubIntent"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}, "aliases": []},
-    {"id": "threadline.inboundIdLedger", "title": "Inbound id ledger", "flag": {"path": "threadline.inboundIdLedger"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Machine-local SQLite plus /health counters; record fired per ledgered id and error per ledgerError in src/threadline/InboundIdLedger.ts (written bar: zero ledgerError for seven days; every dedupById explained stays for the review)."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.inboundIdLedger", "kind": "fired"}, "of": {"featureId": "threadline.inboundIdLedger"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.inboundIdLedger", "kind": "error"}, "of": {"featureId": "threadline.inboundIdLedger"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 3, "windowDays": 7}]}}, "aliases": []},
+    {"id": "threadline.hubIntent", "title": "Hub intent recognizer", "flag": {"path": "threadline.hubIntent"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/commands/server.ts."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"threadline.hubIntent.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.hubIntent", "kind": "fired"}, "of": {"featureId": "threadline.hubIntent"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.hubIntent", "kind": "error"}, "of": {"featureId": "threadline.hubIntent"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.hubIntent", "kind": "fired"}, "of": {"featureId": "threadline.hubIntent"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.hubIntent", "kind": "error"}, "of": {"featureId": "threadline.hubIntent"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 30}]}}, "aliases": []},
+    {"id": "threadline.inboundIdLedger", "title": "Inbound id ledger", "flag": {"path": "threadline.inboundIdLedger"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/threadline/InboundIdLedger.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.inboundIdLedger", "kind": "fired"}, "of": {"featureId": "threadline.inboundIdLedger"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.inboundIdLedger", "kind": "error"}, "of": {"featureId": "threadline.inboundIdLedger"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 3, "windowDays": 7}]}}, "aliases": []},
     {"id": "threadline.localRouteSignature", "title": "Local route signature", "flag": {"path": "threadline.localRouteSignature", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "measured", "plan": "Its signature log shows it ran; the review grades sampled verdicts, since refusing a bad signature is correct and accepting everything would look clean."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"threadline.localRouteSignature.dryRun": false}}, "metrics": [{"id": "signature-verdicts", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/relay-agent-signature.jsonl", "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "graded-wrong", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.localRouteSignature", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "threadline.localRouteSignature", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.1, "minSamples": 5, "windowDays": 30}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "signature-verdicts", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/relay-agent-signature.jsonl", "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "graded-wrong", "role": "quality", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.localRouteSignature", "kind": "outcome", "outcome": "wrong"}, "of": {"featureId": "threadline.localRouteSignature", "kind": "outcome"}, "value": "ratio", "dedupe": "gradesEventId"}, "direction": "at-most", "threshold": 0.1, "minSamples": 5, "windowDays": 30}]}}, "aliases": []},
-    {"id": "threadline.localRouteTrust", "title": "Same-machine agent trust", "flag": {"path": "threadline.localRouteTrust", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "Only /health counters, which reset on restart; record fired per evaluated sender and error per would-refuse of a sender that should pass in src/threadline/localRouteTrust.ts."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"threadline.localRouteTrust.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.localRouteTrust", "kind": "fired"}, "of": {"featureId": "threadline.localRouteTrust"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.localRouteTrust", "kind": "error"}, "of": {"featureId": "threadline.localRouteTrust"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.localRouteTrust", "kind": "fired"}, "of": {"featureId": "threadline.localRouteTrust"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.localRouteTrust", "kind": "error"}, "of": {"featureId": "threadline.localRouteTrust"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
+    {"id": "threadline.localRouteTrust", "title": "Same-machine agent trust", "flag": {"path": "threadline.localRouteTrust", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/server/routes.ts."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"threadline.localRouteTrust.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.localRouteTrust", "kind": "fired"}, "of": {"featureId": "threadline.localRouteTrust"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.localRouteTrust", "kind": "error"}, "of": {"featureId": "threadline.localRouteTrust"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.localRouteTrust", "kind": "fired"}, "of": {"featureId": "threadline.localRouteTrust"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.localRouteTrust", "kind": "error"}, "of": {"featureId": "threadline.localRouteTrust"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
     {"id": "threadline.peerDarkNotice", "title": "Peer dark notice", "flag": {"path": "threadline.peerDarkNotice"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "rare": true, "tracking": {"state": "measured", "plan": "Reads its own dark-pass rows, which come only when a peer goes dark; would-raise on a peer the presence map shows connected is a false alarm (21 of 30, none since 10-25), so it holds until those age out; live rows are raised, not would-raise."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"threadline.peerDarkNotice.dryRun": false}}, "metrics": [{"id": "would-raises", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/a2a-peer-dark.jsonl", "where": {"kind": "would-raise"}, "of": {"kind": "would-raise"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "false-alarm-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": ".instar/logs/a2a-peer-dark.jsonl", "where": {"kind": "would-raise", "connectedNow": true}, "of": {"kind": "would-raise"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.1, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/logs/a2a-peer-dark.jsonl", "where": {"dryRun": true, "kind": "error"}, "of": {"dryRun": true}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "raises", "role": "ran", "source": "jsonl-log", "ref": {"file": ".instar/logs/a2a-peer-dark.jsonl", "where": {"kind": "raised"}, "of": {"kind": "raised"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "false-alarm-rate", "role": "quality", "source": "jsonl-log", "ref": {"file": ".instar/logs/a2a-peer-dark.jsonl", "where": {"kind": "raised", "connectedNow": true}, "of": {"kind": "raised"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.1, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": ".instar/logs/a2a-peer-dark.jsonl", "where": {"dryRun": false, "kind": "error"}, "of": {"dryRun": false}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []},
-    {"id": "threadline.relayForward", "title": "A2A relay forward", "flag": {"path": "threadline.relayForward"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "Only /health counters, which reset on restart; record fired per forward executed and per reply injected and error per failed forward in src/threadline/relayForward.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.relayForward", "kind": "fired"}, "of": {"featureId": "threadline.relayForward"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.relayForward", "kind": "error"}, "of": {"featureId": "threadline.relayForward"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
-    {"id": "threadline.relayUnknownSenderTrust", "title": "Unknown agent trust", "flag": {"path": "threadline.relayUnknownSenderTrust", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "Only /health counters, which reset on restart; record fired per evaluated unknown sender and error per would-refuse of a sender that should pass in src/threadline/relayUnknownSenderTrust.ts."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"threadline.relayUnknownSenderTrust.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.relayUnknownSenderTrust", "kind": "fired"}, "of": {"featureId": "threadline.relayUnknownSenderTrust"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.relayUnknownSenderTrust", "kind": "error"}, "of": {"featureId": "threadline.relayUnknownSenderTrust"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.relayUnknownSenderTrust", "kind": "fired"}, "of": {"featureId": "threadline.relayUnknownSenderTrust"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.relayUnknownSenderTrust", "kind": "error"}, "of": {"featureId": "threadline.relayUnknownSenderTrust"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
-    {"id": "threadline.singleNegotiator", "title": "Single negotiator lease", "flag": {"path": "threadline.singleNegotiator"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "Its verdicts go to dated threadline-negotiator-<date>.jsonl files a fixed-path metric cannot read; record fired per lease verdict and error per would-hold shown wrong or fail-open in src/threadline/NegotiatorGate.ts."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"threadline.singleNegotiator.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.singleNegotiator", "kind": "fired"}, "of": {"featureId": "threadline.singleNegotiator"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.singleNegotiator", "kind": "error"}, "of": {"featureId": "threadline.singleNegotiator"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.singleNegotiator", "kind": "fired"}, "of": {"featureId": "threadline.singleNegotiator"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.singleNegotiator", "kind": "error"}, "of": {"featureId": "threadline.singleNegotiator"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []},
-    {"id": "threadline.verifiedPairing", "title": "Verified agent pairing", "flag": {"path": "threadline.verifiedPairing"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "needed", "plan": "Pairing state is in stores and it authorises credential sharing; record fired per completed pairing and error per failed verification at the pairing routes in src/server/routes.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.verifiedPairing", "kind": "fired"}, "of": {"featureId": "threadline.verifiedPairing"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.verifiedPairing", "kind": "error"}, "of": {"featureId": "threadline.verifiedPairing"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.verifiedPairing", "kind": "fired"}, "of": {"featureId": "threadline.verifiedPairing"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.verifiedPairing", "kind": "error"}, "of": {"featureId": "threadline.verifiedPairing"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}, "aliases": []},
-    {"id": "threadline.warmSessionA2A", "title": "Warm A2A sessions", "flag": {"path": "threadline.warmSessionA2A"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "needed", "plan": "No dedicated ledger; record fired per A2A delivery served by a warm session and error per failed warm delivery in the warm-session wiring in src/commands/server.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.warmSessionA2A", "kind": "fired"}, "of": {"featureId": "threadline.warmSessionA2A"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.warmSessionA2A", "kind": "error"}, "of": {"featureId": "threadline.warmSessionA2A"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []},
-    {"id": "toneGate.advisoryMigration", "title": "Tone gate advisory", "flag": {"path": "toneGate.advisoryMigration"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "needed", "plan": "Grades sit in dated judgment-provenance files; record fired per self-report tone grade (overrides and compliances, both must appear) and error per credential-wall false positive, near src/core/MessagingToneGate.ts (written bar: 50 grades in 14 days, zero false positives; never a quality rate)."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "toneGate.advisoryMigration", "kind": "fired"}, "of": {"featureId": "toneGate.advisoryMigration"}, "value": "count"}, "direction": "at-least", "threshold": 50, "minSamples": 50, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "toneGate.advisoryMigration", "kind": "error"}, "of": {"featureId": "toneGate.advisoryMigration"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 50, "windowDays": 14}]}}, "aliases": []},
+    {"id": "threadline.relayForward", "title": "A2A relay forward", "flag": {"path": "threadline.relayForward"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/threadline/relayForward.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.relayForward", "kind": "fired"}, "of": {"featureId": "threadline.relayForward"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.relayForward", "kind": "error"}, "of": {"featureId": "threadline.relayForward"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
+    {"id": "threadline.relayUnknownSenderTrust", "title": "Unknown agent trust", "flag": {"path": "threadline.relayUnknownSenderTrust", "dryRunDefault": true}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/threadline/relayUnknownSenderTrust.ts."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"threadline.relayUnknownSenderTrust.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.relayUnknownSenderTrust", "kind": "fired"}, "of": {"featureId": "threadline.relayUnknownSenderTrust"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.relayUnknownSenderTrust", "kind": "error"}, "of": {"featureId": "threadline.relayUnknownSenderTrust"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.relayUnknownSenderTrust", "kind": "fired"}, "of": {"featureId": "threadline.relayUnknownSenderTrust"}, "value": "count"}, "direction": "at-least", "threshold": 3, "minSamples": 3, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.relayUnknownSenderTrust", "kind": "error"}, "of": {"featureId": "threadline.relayUnknownSenderTrust"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 3, "windowDays": 14}]}}, "aliases": []},
+    {"id": "threadline.singleNegotiator", "title": "Single negotiator lease", "flag": {"path": "threadline.singleNegotiator"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/threadline/NegotiatorGate.ts."}, "rungs": {"dev-agent-live": {"soakDays": 3, "advance": {"kind": "config", "set": {"threadline.singleNegotiator.dryRun": false}}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.singleNegotiator", "kind": "fired"}, "of": {"featureId": "threadline.singleNegotiator"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.singleNegotiator", "kind": "error"}, "of": {"featureId": "threadline.singleNegotiator"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}, "fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.singleNegotiator", "kind": "fired"}, "of": {"featureId": "threadline.singleNegotiator"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.singleNegotiator", "kind": "error"}, "of": {"featureId": "threadline.singleNegotiator"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []},
+    {"id": "threadline.verifiedPairing", "title": "Verified agent pairing", "flag": {"path": "threadline.verifiedPairing"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "rare": true, "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/threadline/AgentTrustManager.ts."}, "rungs": {"dev-agent-live": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.verifiedPairing", "kind": "fired"}, "of": {"featureId": "threadline.verifiedPairing"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.verifiedPairing", "kind": "error"}, "of": {"featureId": "threadline.verifiedPairing"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}, "fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.verifiedPairing", "kind": "fired"}, "of": {"featureId": "threadline.verifiedPairing"}, "value": "count"}, "direction": "at-least", "threshold": 1, "minSamples": 1, "windowDays": 30}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.verifiedPairing", "kind": "error"}, "of": {"featureId": "threadline.verifiedPairing"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 1, "windowDays": 30}]}}, "aliases": []},
+    {"id": "threadline.warmSessionA2A", "title": "Warm A2A sessions", "flag": {"path": "threadline.warmSessionA2A"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/threadline/ThreadlineRouter.ts."}, "rungs": {"fleet": {"soakDays": 7, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.warmSessionA2A", "kind": "fired"}, "of": {"featureId": "threadline.warmSessionA2A"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "threadline.warmSessionA2A", "kind": "error"}, "of": {"featureId": "threadline.warmSessionA2A"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []},
+    {"id": "toneGate.advisoryMigration", "title": "Tone gate advisory", "flag": {"path": "toneGate.advisoryMigration"}, "disposition": "ladder", "final": "default-on", "risk": "standard", "tracking": {"state": "measured", "plan": "Records its decisions to the shared evidence log from src/server/routes.ts."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "fired", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "toneGate.advisoryMigration", "kind": "fired"}, "of": {"featureId": "toneGate.advisoryMigration"}, "value": "count"}, "direction": "at-least", "threshold": 50, "minSamples": 50, "windowDays": 14}, {"id": "error-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/feature-evidence.jsonl", "where": {"featureId": "toneGate.advisoryMigration", "kind": "error"}, "of": {"featureId": "toneGate.advisoryMigration"}, "value": "ratio"}, "direction": "at-most", "threshold": 0, "minSamples": 50, "windowDays": 14}]}}, "aliases": []},
     {"id": "topicProfiles", "title": "Topic profiles", "flag": {"path": "topicProfiles"}, "disposition": "ladder", "final": "default-on", "risk": "sensitive", "restartNeeded": true, "tracking": {"state": "measured", "plan": "Reads its own change log: applied respawns show the write path ran (27 in 14 days, none reverted), and a breaker revert means a pin broke a session; deferred-busy rows are ignored as noise."}, "rungs": {"fleet": {"soakDays": 14, "advance": {"kind": "code"}, "metrics": [{"id": "respawns-applied", "role": "ran", "source": "jsonl-log", "ref": {"file": "logs/topic-profile-changes.jsonl", "where": {"type": "respawn-applied"}, "of": {"type": "respawn-applied"}, "value": "count"}, "direction": "at-least", "threshold": 20, "minSamples": 20, "windowDays": 14}, {"id": "breaker-revert-rate", "role": "harm", "source": "jsonl-log", "ref": {"file": "logs/topic-profile-changes.jsonl", "where": {"type": "respawn-applied", "breakerRevert": true}, "of": {"type": "respawn-applied"}, "value": "ratio"}, "direction": "at-most", "threshold": 0.05, "minSamples": 20, "windowDays": 14}]}}, "aliases": []}
   ]
 }