instar 1.3.538 → 1.3.540

package/dist/core/CredentialRestoreEnrollment.js

@@ -0,0 +1,76 @@
+/**
+ * CredentialRestoreEnrollment — the teardown lever (spec §2.8, build-plan §7).
+ *
+ * `POST /credentials/restore-enrollment` moves every slot back to its enrollment layout (N
+ * ordinary §2.3 swaps back), then the operator darks the feature — at which point ledger ==
+ * enrollment and raw `configHome` reads are truthful again (the ordered-rollback the spec names).
+ *
+ * This module owns the ONE piece the plain swap executor does not: the per-slot DECISION of
+ * whether a slot's current blob may be EXCHANGED back into a healthy enrollment slot, or must be
+ * PARKED ONE-DIRECTIONALLY (moved out / the slot vacated for operator re-auth, NEVER exchanged in).
+ *
+ * ── Why a quarantine bypass that retains everything else (spec §0.g + §2.8) ──
+ * restore-enrollment is a TEARDOWN, not a balancing move, so it carries a QUARANTINE BYPASS — it
+ * must operate ON quarantined slots (the degraded state rollback exists for), or §2.3 step-1 would
+ * hard-block it exactly when it is needed. Per §0.g a bypass drops ONLY the named guard: it RETAINS
+ *   1. parse                       (an unparseable blob is parked, never exchanged)
+ *   2. refresh-token-present       (a refresh-token-less blob is parked, never exchanged)
+ *   3. IDENTITY-COHERENCE          (access-tenant == refresh-lineage; the §2.7 Frankenstein gap)
+ *
+ * ── The Frankenstein gap (spec §2.8 round-4) ──
+ * "Parses + has a refresh token" is NOT sufficient. A legacy `AccountSwitcher` slip can leave
+ * B's access token grafted onto A's PRESERVED refresh token: the blob parses, carries a refresh
+ * token, and the oracle (on B's still-valid access token) resolves it to B — yet on first refresh
+ * the client exchanges A's refresh token and silently resurrects A (a §0.d violation). So before
+ * any exchange, the blob's access-token identity (oracle) MUST equal its refresh-token lineage's
+ * expected account. A blob that fails coherence — Frankenstein, revoked-grant, access/refresh
+ * tenant mismatch — is parked ONE-DIRECTIONALLY exactly like an unparseable one, NEVER exchanged
+ * into a healthy slot (a teardown that exchanges garbage into a good slot, then post-commit-verify
+ * quarantines THAT slot, would spread corruption during the exact degraded state rollback is for).
+ *
+ * This module is the DECISION (coherence classification + the park plan). It performs NO keychain
+ * writes itself — the route drives the actual exchange through the §2.3 CredentialSwapExecutor and
+ * the actual park through the ledger quarantine + an attention item. Pure + injectable.
+ */
+/**
+ * Classify a slot's current blob for restore-enrollment. Returns a COHERENT verdict (safe to
+ * EXCHANGE back to its enrollment slot) ONLY when ALL THREE retained preconditions hold:
+ *   parse + refresh-token-present + identity-coherence (accessTenant === refreshLineage).
+ * Any failure → an INCOHERENT verdict with `park: 'one-directional'` and a named reason — the
+ * caller must vacate the slot for operator re-auth and NEVER exchange this blob into a healthy slot.
+ *
+ * The oracle-down cheap proxy is the caller's job: it supplies `refreshLineage` from the ledger's
+ * expected tenant for the slot, and `accessTenant` may be null (oracle unavailable). When BOTH are
+ * known and equal → coherent; when the oracle is down (accessTenant null) we CANNOT certify
+ * coherence → one-directional park (the safe direction: never exchange an unverifiable blob).
+ */
+export function classifyRestoreCoherence(blob, probe) {
+    // 1. Parse — an unparseable/absent oauth is parked one-directionally.
+    if (!blob.oauth || typeof blob.oauth !== 'object') {
+        return { coherent: false, reason: 'blob is unparseable or has no claudeAiOauth — parked for re-auth', park: 'one-directional' };
+    }
+    // 2. Refresh-token-present — a refresh-token-less blob cannot be a healthy lineage.
+    if (typeof blob.oauth.refreshToken !== 'string' || !blob.oauth.refreshToken) {
+        return { coherent: false, reason: 'blob carries no refresh token — parked for re-auth', park: 'one-directional' };
+    }
+    // 3. Identity-coherence — access-tenant MUST equal refresh-lineage (the Frankenstein gap).
+    if (!probe.accessTenant) {
+        // Oracle could not confirm the access-token identity → CANNOT certify coherence. Park (safe
+        // direction): never exchange a blob we cannot identity-verify back into a healthy slot.
+        return { coherent: false, reason: 'access-token identity unavailable (oracle down) — cannot certify coherence, parked', park: 'one-directional' };
+    }
+    if (!probe.refreshLineage) {
+        return { coherent: false, reason: 'no expected refresh-lineage for slot — cannot certify coherence, parked', park: 'one-directional' };
+    }
+    if (probe.accessTenant !== probe.refreshLineage) {
+        // The §2.7 Frankenstein blob: access resolves to one account, refresh lineage belongs to
+        // another. Exchanging it would resurrect the refresh-lineage account on first refresh.
+        return {
+            coherent: false,
+            reason: `identity-incoherent: access-tenant != refresh-lineage — parked one-directionally, never exchanged into a healthy slot`,
+            park: 'one-directional',
+        };
+    }
+    return { coherent: true, tenant: probe.accessTenant };
+}
+//# sourceMappingURL=CredentialRestoreEnrollment.js.map

package/dist/core/CredentialRestoreEnrollment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialRestoreEnrollment.js","sourceRoot":"","sources":["../../src/core/CredentialRestoreEnrollment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AA6BH;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAiB,EAAE,KAAqB;IAC/E,sEAAsE;IACtE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,kEAAkE,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;IAClI,CAAC;IACD,oFAAoF;IACpF,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAC5E,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oDAAoD,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;IACpH,CAAC;IACD,2FAA2F;IAC3F,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACxB,4FAA4F;QAC5F,wFAAwF;QACxF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oFAAoF,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;IACpJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,yEAAyE,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;IACzI,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;QAChD,yFAAyF;QACzF,uFAAuF;QACvF,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,uHAAuH;YAC/H,IAAI,EAAE,iBAAiB;SACxB,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;AACxD,CAAC"}

package/dist/core/PostUpdateMigrator.d.ts

@@ -118,6 +118,7 @@ export declare class PostUpdateMigrator {
     private migrateCommitmentOwnerBackfill;
     private migrateMultiMachinePostureReviewDimension;
     private migrateCartographerDevGate;
+    private migrateDevGateTeethStrip;
     private migrateHonestProgressMessagingDefaults;
     /**
      * Seed the interactive first-launch onboarding flags into every EXISTING

package/dist/core/PostUpdateMigrator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PostUpdateMigrator.d.ts","sourceRoot":"","sources":["../../src/core/PostUpdateMigrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAwCH,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAyBjC,MAAM,WAAW,eAAe;IAC9B,wBAAwB;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,kCAAkC;IAClC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAYnF;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAiB;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU,CAAiC;gBAEvC,MAAM,EAAE,cAAc;IAIlC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IA0B5B;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAItC;;;;;;OAMG;IACG,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAIjC,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,kBAAkB;IAO1B;;;;OAIG;IACH,OAAO,CAAC,YAAY;IASpB;;;OAGG;IACH,OAAO,IAAI,eAAe;IAsE1B,OAAO,CAAC,gCAAgC;IAwCxC,OAAO,CAAC,8BAA8B;IAoFtC,OAAO,CAAC,yCAAyC;IA8DjD,OAAO,CAAC,0BAA0B;IAiFlC,OAAO,CAAC,sCAAsC;IAmE9C;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,uCAAuC;IAqC/C;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,0BAA0B;IAmFlC,OAAO,CAAC,0BAA0B;IAmDlC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kCAAkC;IAwH1C;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,kCAAkC;IA8C1C;;;;;;;;OAQG;IACH,OAAO,CAAC,kCAAkC;IA2B1C,OAAO,CAAC,uBAAuB;IAwE/B,OAAO,CAAC,4CAA4C;IA+CpD;;;;;;;OAOG;IACH,OAAO,CAAC,iCAAiC;IA0BzC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oCAAoC;IAmB5C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yCAAyC;IAWjD;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,kCAAkC;IAW1C,OAAO,CAAC,yBAAyB;IA6FjC;;;;;;;;;;OAUG;IACG,YAAY,IAAI,OAAO,CAAC,eAAe,CAAC;YA4BhC,uBAAuB;IAkGrC,OAAO,CAAC,0BAA0B;IAkGlC,OAAO,CAAC,0BAA0B;IAoElC,OAAO,CAAC,oBAAoB;IAuH5B,OAAO,CAAC,8BAA8B;IA2EtC;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,0BAA0B;IA8BlC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,4BAA4B;IAwBpC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,sBAAsB;IAwB9B;;;;;;;;;OASG;IACH,OAAO,CAAC,wCAAwC;IAuBhD;;;;;;;;OAQG;IACH,OAAO,CAAC,2CAA2C;IAuBnD;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,kCAAkC;IAuB1C;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,mCAAmC;IAmK3C;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;IA2B1B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,yBAAyB;IA4HjC;6EACyE;IACzE,OAAO,CAAC,wBAAwB;IAShC;sDACkD;IAClD,OAAO,CAAC,wBAAwB;IAQhC;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAkQpB;;;;;;;;OAQG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI;IA6CvE;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAkEzB;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAkChC;;;;;;;;;OASG;IACH,OAAO,CAAC,wBAAwB;IAoEhC;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAiE5B;;;;;OAKG;IACH,OAAO,CAAC,2BAA2B;IA8BnC;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAyIhC;;;;;;OAMG;IACH,OAAO,CAAC,8BAA8B;IAwDtC,OAAO,CAAC,0BAA0B;IAiElC;;;OAGG;IACH,OAAO,CAAC,eAAe;IAmjFvB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,kCAAkC;IAuN1C;;;OAGG;IACH,OAAO,CAAC,cAAc;IAmLtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,OAAO,CAAC,yCAAyC;IAyDjD;;;OAGG;IACH,OAAO,CAAC,eAAe;IAqWvB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAsGrB;;;OAGG;IACH;;;OAGG;IACH;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,wBAAwB;IAmEhC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,6BAA6B;IAwDrC;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAsDjC,OAAO,CAAC,wBAAwB;IAqChC,OAAO,CAAC,gBAAgB;IAuBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACH,OAAO,CAAC,qBAAqB;IAsG7B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,0BAA0B;IAgDlC;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAkC5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kBAAkB;IA2C1B;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IA+BzB,OAAO,CAAC,oBAAoB;IAgC5B;;;OAGG;IACH,OAAO,CAAC,aAAa;IAyBrB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAqC9B;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,wBAAwB,GAAG,qBAAqB,GAAG,yBAAyB,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,8BAA8B,GAAG,2BAA2B,GAAG,4BAA4B,GAAG,iBAAiB,GAAG,0BAA0B,GAAG,wBAAwB,GAAG,iBAAiB,GAAG,kBAAkB,GAAG,0BAA0B,GAAG,uBAAuB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,uBAAuB,GAAG,MAAM;IA0BxiB,oFAAoF;IACpF,iCAAiC,IAAI,MAAM;IAI3C,6EAA6E;IAC7E,yBAAyB,IAAI,MAAM;IAInC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,2BAA2B;IAmFnC,OAAO,CAAC,mBAAmB;IAuf3B,OAAO,CAAC,wBAAwB;IA6JhC,OAAO,CAAC,2BAA2B;IAwEnC,OAAO,CAAC,yBAAyB;IA8IjC,OAAO,CAAC,2BAA2B;IAqKnC,OAAO,CAAC,qBAAqB;IAyU7B,OAAO,CAAC,uBAAuB;IAmS/B,OAAO,CAAC,oBAAoB;IAgG5B,OAAO,CAAC,qBAAqB;IA8H7B,OAAO,CAAC,2BAA2B;IAoHnC,OAAO,CAAC,iCAAiC;IA6DzC,OAAO,CAAC,4BAA4B;IA+MpC;;;;;;;;;;OAUG;IACH;;;;;;;;;;;OAWG;IAEH,gBAAuB,iCAAiC,EAAE,WAAW,CAAC,MAAM,CAAC,CA2C1E;IAEH;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,8BAA8B;IAiHtC,OAAO,CAAC,uBAAuB;IAwD/B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,sBAAsB;IAwC9B,OAAO,CAAC,iBAAiB;IAwBzB,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,8BAA8B;IA6HtC,OAAO,CAAC,+BAA+B;IAuKvC,OAAO,CAAC,oBAAoB;IAY5B,OAAO,CAAC,qBAAqB;IAqO7B,OAAO,CAAC,qBAAqB;IAwI7B,OAAO,CAAC,qBAAqB;IA2O7B,OAAO,CAAC,6BAA6B;IAkLrC,OAAO,CAAC,0BAA0B;IAiClC,OAAO,CAAC,0BAA0B;IA8ElC,OAAO,CAAC,0BAA0B;IA8IlC,OAAO,CAAC,gBAAgB;IAmJxB,OAAO,CAAC,6BAA6B;CAoCtC"}
+{"version":3,"file":"PostUpdateMigrator.d.ts","sourceRoot":"","sources":["../../src/core/PostUpdateMigrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAwCH,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAyBjC,MAAM,WAAW,eAAe;IAC9B,wBAAwB;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,kCAAkC;IAClC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAYnF;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAiB;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU,CAAiC;gBAEvC,MAAM,EAAE,cAAc;IAIlC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IA0B5B;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAItC;;;;;;OAMG;IACG,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAIjC,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,kBAAkB;IAO1B;;;;OAIG;IACH,OAAO,CAAC,YAAY;IASpB;;;OAGG;IACH,OAAO,IAAI,eAAe;IAuE1B,OAAO,CAAC,gCAAgC;IAwCxC,OAAO,CAAC,8BAA8B;IAoFtC,OAAO,CAAC,yCAAyC;IA8DjD,OAAO,CAAC,0BAA0B;IAsFlC,OAAO,CAAC,wBAAwB;IAiFhC,OAAO,CAAC,sCAAsC;IAmE9C;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,uCAAuC;IAqC/C;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,0BAA0B;IAmFlC,OAAO,CAAC,0BAA0B;IAmDlC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kCAAkC;IAwH1C;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,kCAAkC;IA8C1C;;;;;;;;OAQG;IACH,OAAO,CAAC,kCAAkC;IA2B1C,OAAO,CAAC,uBAAuB;IAwE/B,OAAO,CAAC,4CAA4C;IA+CpD;;;;;;;OAOG;IACH,OAAO,CAAC,iCAAiC;IA0BzC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oCAAoC;IAmB5C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yCAAyC;IAWjD;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,kCAAkC;IAW1C,OAAO,CAAC,yBAAyB;IA6FjC;;;;;;;;;;OAUG;IACG,YAAY,IAAI,OAAO,CAAC,eAAe,CAAC;YA4BhC,uBAAuB;IAkGrC,OAAO,CAAC,0BAA0B;IAkGlC,OAAO,CAAC,0BAA0B;IAoElC,OAAO,CAAC,oBAAoB;IAuH5B,OAAO,CAAC,8BAA8B;IA2EtC;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,0BAA0B;IA8BlC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,4BAA4B;IAwBpC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,sBAAsB;IAwB9B;;;;;;;;;OASG;IACH,OAAO,CAAC,wCAAwC;IAuBhD;;;;;;;;OAQG;IACH,OAAO,CAAC,2CAA2C;IAuBnD;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,kCAAkC;IAuB1C;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,mCAAmC;IAmK3C;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;IA2B1B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,yBAAyB;IA4HjC;6EACyE;IACzE,OAAO,CAAC,wBAAwB;IAShC;sDACkD;IAClD,OAAO,CAAC,wBAAwB;IAQhC;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAkQpB;;;;;;;;OAQG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI;IA6CvE;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAkEzB;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAkChC;;;;;;;;;OASG;IACH,OAAO,CAAC,wBAAwB;IAoEhC;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAiE5B;;;;;OAKG;IACH,OAAO,CAAC,2BAA2B;IA8BnC;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAyIhC;;;;;;OAMG;IACH,OAAO,CAAC,8BAA8B;IAwDtC,OAAO,CAAC,0BAA0B;IAiElC;;;OAGG;IACH,OAAO,CAAC,eAAe;IAmjFvB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,kCAAkC;IAuN1C;;;OAGG;IACH,OAAO,CAAC,cAAc;IAmLtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,OAAO,CAAC,yCAAyC;IAyDjD;;;OAGG;IACH,OAAO,CAAC,eAAe;IAqWvB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAsGrB;;;OAGG;IACH;;;OAGG;IACH;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,wBAAwB;IAmEhC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,6BAA6B;IAwDrC;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAsDjC,OAAO,CAAC,wBAAwB;IAqChC,OAAO,CAAC,gBAAgB;IAuBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACH,OAAO,CAAC,qBAAqB;IAsG7B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,0BAA0B;IAgDlC;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAkC5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kBAAkB;IA2C1B;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IA+BzB,OAAO,CAAC,oBAAoB;IAgC5B;;;OAGG;IACH,OAAO,CAAC,aAAa;IAyBrB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAqC9B;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,wBAAwB,GAAG,qBAAqB,GAAG,yBAAyB,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,8BAA8B,GAAG,2BAA2B,GAAG,4BAA4B,GAAG,iBAAiB,GAAG,0BAA0B,GAAG,wBAAwB,GAAG,iBAAiB,GAAG,kBAAkB,GAAG,0BAA0B,GAAG,uBAAuB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,uBAAuB,GAAG,MAAM;IA0BxiB,oFAAoF;IACpF,iCAAiC,IAAI,MAAM;IAI3C,6EAA6E;IAC7E,yBAAyB,IAAI,MAAM;IAInC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,2BAA2B;IAmFnC,OAAO,CAAC,mBAAmB;IAuf3B,OAAO,CAAC,wBAAwB;IA6JhC,OAAO,CAAC,2BAA2B;IAwEnC,OAAO,CAAC,yBAAyB;IA8IjC,OAAO,CAAC,2BAA2B;IAqKnC,OAAO,CAAC,qBAAqB;IAyU7B,OAAO,CAAC,uBAAuB;IAmS/B,OAAO,CAAC,oBAAoB;IAgG5B,OAAO,CAAC,qBAAqB;IA8H7B,OAAO,CAAC,2BAA2B;IAoHnC,OAAO,CAAC,iCAAiC;IA6DzC,OAAO,CAAC,4BAA4B;IA+MpC;;;;;;;;;;OAUG;IACH;;;;;;;;;;;OAWG;IAEH,gBAAuB,iCAAiC,EAAE,WAAW,CAAC,MAAM,CAAC,CA2C1E;IAEH;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,8BAA8B;IAiHtC,OAAO,CAAC,uBAAuB;IAwD/B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,sBAAsB;IAwC9B,OAAO,CAAC,iBAAiB;IAwBzB,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,8BAA8B;IA6HtC,OAAO,CAAC,+BAA+B;IAuKvC,OAAO,CAAC,oBAAoB;IAY5B,OAAO,CAAC,qBAAqB;IAqO7B,OAAO,CAAC,qBAAqB;IAwI7B,OAAO,CAAC,qBAAqB;IA2O7B,OAAO,CAAC,6BAA6B;IAkLrC,OAAO,CAAC,0BAA0B;IAiClC,OAAO,CAAC,0BAA0B;IA8ElC,OAAO,CAAC,0BAA0B;IA8IlC,OAAO,CAAC,gBAAgB;IAmJxB,OAAO,CAAC,6BAA6B;CAoCtC"}

package/dist/core/PostUpdateMigrator.js

@@ -258,6 +258,7 @@ export class PostUpdateMigrator {
         this.migrateWorktreeMisplacedFloodItems(result);
         this.migrateSubscriptionPoolInteractiveReady(result);
         this.migrateCartographerDevGate(result);
+        this.migrateDevGateTeethStrip(result);
         this.migrateCommitmentOwnerBackfill(result);
         this.migrateMultiMachinePostureReviewDimension(result);
         this.migrateConformanceGateAutoInvoke(result);
@@ -531,6 +532,88 @@ export class PostUpdateMigrator {
             result.skipped.push('cartographer-dev-gate: no default-shaped false to strip (marker set)');
         }
     }
+    // ── DEV-AGENT-DARK-GATE-TEETH (CMT-1438): strip stale persisted `enabled: false`
+    // for the 4 features moved out of the retired `deliberate-fleet-default` bucket
+    // into DEV_GATED_FEATURES. Same mechanism + rationale as migrateCartographerDevGate:
+    // removing the ConfigDefaults literal only lets the gate decide when `enabled` is
+    // ABSENT, but applyDefaults is add-missing-only — so an agent (e.g. Echo) that
+    // already persisted the old default `false` keeps it and the feature stays DARK on
+    // the very dev agent meant to dogfood it. This one-shot, dev-agent-only strip frees
+    // a DEFAULT-SHAPED `false` at exactly the 4 allowlisted, D4-code-grounded-safe paths.
+    //
+    // Lossy-but-precedented (D5): the `false` value alone can't distinguish a stale
+    // default from a deliberate pre-migration operator choice; the run-once marker means
+    // each path's `false` is touched at most ONCE — a LATER operator-set `false` is never
+    // re-stripped (re-add it to deliberately keep a flag off). Same accepted tradeoff as
+    // the cartographer strip. Allowlist is HARDCODED (never "the dev-gated ones"
+    // dynamically) and deliberately EXCLUDES the 3 D4-held exclusions
+    // (correctionLearning / apprenticeshipCycleSla / geminiCapacityEscalation), which
+    // keep their persisted `false`. Idempotent, existence-checked, dev-agent-only.
+    migrateDevGateTeethStrip(result) {
+        const configPath = path.join(this.config.stateDir, 'config.json');
+        if (!fs.existsSync(configPath)) {
+            result.skipped.push('dev-gate-teeth: config.json not found');
+            return;
+        }
+        let config;
+        try {
+            config = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
+        }
+        catch (err) {
+            result.errors.push(`dev-gate-teeth: config.json read failed: ${err instanceof Error ? err.message : String(err)}`);
+            return;
+        }
+        const migrations = (config._instar_migrations ?? []);
+        const marker = 'dev-gate-teeth-strip';
+        if (migrations.some(m => m.startsWith(marker))) {
+            result.skipped.push('dev-gate-teeth: already migrated');
+            return;
+        }
+        // Dev-agent-only: a fleet agent's `false` is the correct dark default and is left
+        // untouched (marker NOT set here, so a later promotion can still run once).
+        if (config.developmentAgent !== true) {
+            result.skipped.push('dev-gate-teeth: not a development agent');
+            return;
+        }
+        // The 4 newly-DEV_GATED leaf flags, all under config.monitoring. HARDCODED — the
+        // 3 D4-held exclusion paths are deliberately NOT in this list.
+        const monitoring = config.monitoring;
+        const stripped = [];
+        if (monitoring && typeof monitoring === 'object' && !Array.isArray(monitoring)) {
+            const mon = monitoring;
+            const allowlist = ['parallelWorkSentinel', 'failureLearning', 'releaseReadiness', 'bootHealthBeacon'];
+            for (const key of allowlist) {
+                const sub = mon[key];
+                if (sub && typeof sub === 'object' && !Array.isArray(sub)) {
+                    const subObj = sub;
+                    if (subObj.enabled === false) {
+                        delete subObj.enabled;
+                        stripped.push(`monitoring.${key}.enabled`);
+                    }
+                }
+            }
+        }
+        // Record the marker even when nothing was stripped, so it runs exactly once
+        // (value-already-absent / operator-set-true cases are terminal too).
+        const now = new Date().toISOString();
+        migrations.push(`${marker}-${now}`);
+        config._instar_migrations = migrations;
+        try {
+            fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
+        }
+        catch (err) {
+            result.errors.push(`dev-gate-teeth: config.json write failed: ${err instanceof Error ? err.message : String(err)}`);
+            return;
+        }
+        if (stripped.length > 0) {
+            // Report each stripped path (CMT-1438 round-3 finding): a non-Echo dev operator
+            // sees exactly which flags were freed and can deliberately re-disable any.
+            result.upgraded.push(`dev-gate-teeth: stripped default-shaped \`enabled: false\` at ${stripped.join(', ')} so the developmentAgent gate resolves them live (CMT-1438; re-add \`enabled: false\` to deliberately keep one off — it will not be re-stripped)`);
+        }
+        else {
+            result.skipped.push('dev-gate-teeth: no default-shaped false to strip (marker set)');
+        }
+    }
     // ── HONEST-PROGRESS-MESSAGING D (Config surface + migration parity) ──
     //
     // The honest-messaging behavior reaches every agent via the monitors' code