instar 1.3.751 → 1.3.753

package/dist/providers/adapters/gemini-cli/models.js

@@ -8,10 +8,11 @@
  * `~/.gemini` OAuth):
  *   - `gemini -m gemini-2.5-flash "<prompt>"` → clean stdout, exit 0. This
  *     is the verified-working default and the `fast`/`balanced` tier.
- *   - `gemini-2.5-pro` is the capable/heavy tier (the `route.ts` KNOWN_MODELS
- *     list already names it). It is NOT re-probed here — the exact ids beyond
- *     the verified `gemini-2.5-flash` are a §6 build-time discovery item, kept
- *     in sync with `resolveModelForFramework('gemini-cli', …)`.
+ *   - `gemini-3.1-pro-preview` is the capable/heavy tier (current top usable Pro,
+ *     verified reachable 2026-07-03 via the gemini CLI / OpenRouter / paid key).
+ *     `gemini-2.5-pro` remains a recognized model id — still spawnable and a
+ *     capacity fallback — kept in sync with the model-registry freshness manifest
+ *     and `resolveModelForFramework('gemini-cli', …)`.
  *
  * Drift risk: model availability changes per Gemini version. This map is a
  * Rule-3 surface; the authoritative-name check belongs in a dedicated canary
@@ -20,6 +21,7 @@
 export const KNOWN_GEMINI_MODELS = [
     'gemini-2.5-flash',
     'gemini-2.5-pro',
+    'gemini-3.1-pro-preview',
 ];
 export function isKnownGeminiModel(model) {
     return typeof model === 'string' && KNOWN_GEMINI_MODELS.includes(model);
@@ -30,7 +32,7 @@ const TIER_TO_MODEL = {
     // medium — balanced; same flash model (verified one-shot path).
     balanced: 'gemini-2.5-flash',
     // heavy — frontier; the pro tier for hard problems + main chat.
-    capable: 'gemini-2.5-pro',
+    capable: 'gemini-3.1-pro-preview',
 };
 /** The default model when no tier or id is supplied. */
 export const GEMINI_DEFAULT_MODEL = 'gemini-2.5-flash';

package/dist/providers/adapters/gemini-cli/models.js.map

@@ -1 +1 @@
-{"version":3,"file":"models.js","sourceRoot":"","sources":["../../../../src/providers/adapters/gemini-cli/models.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,kBAAkB;IAClB,gBAAgB;CACR,CAAC;AAIX,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC1D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,mBAAyC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACjG,CAAC;AAED,MAAM,aAAa,GAAwC;IACzD,sDAAsD;IACtD,IAAI,EAAE,kBAAkB;IACxB,gEAAgE;IAChE,QAAQ,EAAE,kBAAkB;IAC5B,gEAAgE;IAChE,OAAO,EAAE,gBAAgB;CAC1B,CAAC;AAEF,wDAAwD;AACxD,MAAM,CAAC,MAAM,oBAAoB,GAAqB,kBAAkB,CAAC;AAEzE;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAA2C;IAC7E,IAAI,CAAC,WAAW;QAAE,OAAO,oBAAoB,CAAC;IAC9C,IAAI,WAAW,IAAI,aAAa,EAAE,CAAC;QACjC,OAAO,aAAa,CAAC,WAAwB,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}
+{"version":3,"file":"models.js","sourceRoot":"","sources":["../../../../src/providers/adapters/gemini-cli/models.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,kBAAkB;IAClB,gBAAgB;IAChB,wBAAwB;CAChB,CAAC;AAIX,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC1D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,mBAAyC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACjG,CAAC;AAED,MAAM,aAAa,GAAwC;IACzD,sDAAsD;IACtD,IAAI,EAAE,kBAAkB;IACxB,gEAAgE;IAChE,QAAQ,EAAE,kBAAkB;IAC5B,gEAAgE;IAChE,OAAO,EAAE,wBAAwB;CAClC,CAAC;AAEF,wDAAwD;AACxD,MAAM,CAAC,MAAM,oBAAoB,GAAqB,kBAAkB,CAAC;AAEzE;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAA2C;IAC7E,IAAI,CAAC,WAAW;QAAE,OAAO,oBAAoB,CAAC;IAC9C,IAAI,WAAW,IAAI,aAAa,EAAE,CAAC;QACjC,OAAO,aAAa,CAAC,WAAwB,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.751",
+  "version": "1.3.753",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/scripts/model-registry-freshness.manifest.json

@@ -23,7 +23,7 @@
     "gemini-cli": {
       "accessMethod": "gemini -m <model> (Homebrew formula, OAuth)",
       "status": "alive-but-deprecated-formula",
-      "note": "Homebrew gemini-cli formula DEPRECATED (upstream-unsupported, disabled 2026-12-18). CLI v0.25.2 still runs. Default model still gemini-2.5-pro; CLI already knows gemini-3-pro-preview / gemini-3-flash-preview. Migrate off the deprecated formula (npm @google/gemini-cli, or an OpenRouter/pi door)."
+      "note": "Homebrew gemini-cli formula DEPRECATED (upstream-unsupported, disabled 2026-12-18). CLI v0.25.2 still runs. capable tier now pinned to gemini-3.1-pro-preview (verified reachable 2026-07-03 via the gemini CLI / OpenRouter / paid Gemini key); gemini-2.5-pro remains a recognized/spawnable model + capacity fallback. Migrate off the deprecated formula (npm @google/gemini-cli, or an OpenRouter/pi door)."
     },
     "pi-cli": {
       "accessMethod": "pi --model <provider>/<id> (multi-provider: openai-codex, openrouter, ...)",
@@ -38,7 +38,7 @@
       "claude-fable-5"
     ],
     "anthropic-headless": [
-      "claude-opus-4-6",
+      "claude-opus-4-8",
       "claude-sonnet-4-6",
       "claude-haiku-4-5"
     ],
@@ -46,7 +46,7 @@
       "gpt-5.5"
     ],
     "gemini-cli": [
-      "gemini-2.5-pro"
+      "gemini-3.1-pro-preview"
     ]
   },
   "pins": [
@@ -83,22 +83,6 @@
       "note": "DEFAULT_TIER_ESCALATION.frameworks['claude-code'] default + escalated ids."
     }
   ],
-  "flaggedStale": [
-    {
-      "door": "gemini-cli",
-      "pin": "gemini-capable-tier",
-      "currentId": "gemini-2.5-pro",
-      "suspectedFrontier": "gemini-3-pro-preview",
-      "evidence": "gemini CLI v0.25.2 accepts gemini-3-pro-preview / gemini-3-flash-preview (in gemini-cli-core known-models); operator referenced 'Gemini 3-class'. Homebrew formula also deprecated (disabled 2026-12-18).",
-      "note": "OPERATOR TO CONFIRM exact frontier id before the pin+allowlist are updated. Also present at src/core/frameworkSessionLaunch.ts, src/commands/route.ts (KNOWN_MODELS), src/server/routes.ts."
-    },
-    {
-      "door": "codex-cli",
-      "pin": "codex-capable-tier",
-      "currentId": "gpt-5.5",
-      "suspectedFrontier": "gpt-5.6 (Sol) — UNVERIFIED",
-      "evidence": "codex CLI NOT installed on this machine, so newer accepted ids could NOT be probed. Operator referenced 'GPT-5.6 Sol'.",
-      "note": "OPERATOR TO CONFIRM. Cannot verify from a live probe (codex door not installed)."
-    }
-  ]
+  "$flaggedStaleNote": "Both prior flagged pins RESOLVED (operator-confirmed 2026-07-03): gemini capable swapped gemini-2.5-pro -> gemini-3.1-pro-preview (pin + allowlist updated in the same change); codex capable stays gpt-5.5 (GA flagship — gpt-5.6-sol is preview-only/gov-gated/unreachable, NOT pinned). Nothing pending confirmation.",
+  "flaggedStale": []
 }

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-04T05:23:37.602Z",
-  "instarVersion": "1.3.751",
+  "generatedAt": "2026-07-04T06:27:29.789Z",
+  "instarVersion": "1.3.753",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/src/data/llmBenchCoverage.ts

@@ -48,6 +48,10 @@ export const LLM_BENCH_COVERAGE: Readonly<Record<string, BenchCoverage>> = {
     exempt:
       'judges a FIXED known-answer canary probe — the canary is its own benchmark; a bench task would re-test the same constant',
   },
+  MoveIntentClassifier: {
+    exempt:
+      'ships its OWN dedicated discrimination benchmark — tests/unit/move-intent-discrimination.test.ts, a committed command-vs-discussion corpus run deterministically in CI PLUS an opt-in INSTAR_LIVE_MOVE_INTENT=1 real-model accuracy benchmark (the graduation gate before dryRun:false). A generic bench-harness task would re-test the same judgment less precisely (same rationale as InteractivePoolCanaryJudge: the co-located benchmark IS the benchmark). Spec: docs/specs/nickname-move-intent-llm-rebuild.md §Tests.',
+  },
 
   // ── Covered by Wave 2 (authored 2026-07-02; tasks-wave2/ in the bench harness) ──
   InputGuard: { task: 'input-guard-coherence' },
@@ -169,6 +173,7 @@ export const LLM_UNTRUSTED_INPUT: Readonly<Record<string, UntrustedInputFlag>> =
   WarrantsReplyGate: true,
   UnjustifiedStopGate: true,
   MessagingToneGate: true, // reviews a draft that routinely quotes untrusted user/tool content
+  MoveIntentClassifier: true, // classifies an untrusted inbound user message + recent conversation context
   CoherenceReviewer: true,
   LLMSanitizer: true, // definitionally judges untrusted inbound content
   OverrideDetector: true,
@@ -331,6 +336,7 @@ export const LLM_JUDGES_CLAIMS: Readonly<Record<string, JudgesClaimsFlag>> = {
   IntegrationGate: false, // delegates to JobReflector.reflect(), no own callsite
   ExternalOperationGate: false, // classifies operation mutability/reversibility, not a completion claim
   WarrantsReplyGate: false, // "should I reply?" — not a completion/health claim
+  MoveIntentClassifier: false, // classifies a USER's move/pin intent over a message, not an agent/session claim of completion/health/credit
   CoherenceGate: false, // no own callsite — flows through CoherenceReviewer
   MessagingToneGate: false, // reviews outbound tone/leaks
   CoherenceReviewer: false, // reviews outbound coherence
@@ -423,6 +429,7 @@ export const LLM_PARSER_CONTRACT: Readonly<Record<string, ParserContractFlag>> =
   MessageSentinel: { pending: 'contract-wave-2' }, // closed intent set (pause / emergency / normal)
   LLMSanitizer: { pending: 'contract-wave-2' }, // parses a closed sanitize verdict/decision
   WarrantsReplyGate: { pending: 'contract-wave-2' }, // closed should-reply yes/no verdict
+  MoveIntentClassifier: { pending: 'contract-wave-2' }, // parses a closed move-intent verdict (isCommand + intent enum + targetNickname enum + confidence)
   InputGuard: { pending: 'contract-wave-2' }, // closed input-coherence verdict
   StallTriageNurse: { pending: 'contract-wave-2' }, // closed stall-triage diagnosis label
   CommitmentSentinel: { pending: 'contract-wave-2' }, // closed commitment-detected verdict + structured envelope

package/upgrades/1.3.752.md

@@ -0,0 +1,27 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Corrected the stale "most capable" model-tier pins in the internal routing registry to the current, live-verified model IDs, and marked the model-registry freshness guard's two flagged items as resolved:
+
+- **Gemini capable tier:** `gemini-2.5-pro` → `gemini-3.1-pro-preview` (the current top usable Gemini Pro; verified reachable via the Gemini CLI, OpenRouter, and a paid Gemini key). `gemini-2.5-pro` stays a recognized/spawnable model and a capacity fallback.
+- **Claude Opus tier:** reconciled to `claude-opus-4-8` across both internal maps that had drifted apart (`src/core/models.ts` and the anthropic-headless adapter) — matching the running default and `ModelTierEscalation`.
+- **OpenAI/Codex capable tier:** left unchanged at `gpt-5.5` (the GA flagship). The preview-only `gpt-5.6-sol` is intentionally not pinned.
+- **Freshness manifest + routing doc:** the frontier allowlist now matches the corrected pins, the `flaggedStale` block is emptied (both prior pending items resolved), and `docs/LLM-ROUTING-REGISTRY.md` (capable row, Opus caveat, freshness note) is updated. The freshness lint now passes cleanly in both report and strict mode.
+
+## What to Tell Your User
+
+Your agent's heavy/"capable" internal work — spec review, cross-model review, and heavy-work model escalation — now points at current models (Gemini 3.1 Pro, Claude Opus 4.8) instead of older IDs that had quietly gone out of date. Nothing about how you interact with your agent changes; it just uses better-current models for the demanding internal jobs, and the built-in freshness check that watches for this kind of drift is now green.
+
+## Summary of New Capabilities
+
+No new capability or API. This is a maintenance correction of model-ID pins plus the matching freshness-manifest/doc updates. The model-registry freshness guard (report-only) reports zero findings after the change.
+
+## Evidence
+
+- `scripts/lint-model-registry-freshness.mjs` passes with zero findings and zero warnings in both report and strict mode after the change (all four pins drift-OK and in-allowlist; staleness OK).
+- `tsc --noEmit` clean.
+- Affected unit suites green: `geminiCapacityPolicy`, `gemini-cli-adapter`, `crossModelReviewer-piece3`, `model-registry-freshness` (incl. the shipped-manifest self-consistency test), `Models`, `routing-registry-freshness`, `frameworkSessionLaunch`, `modelTierEscalation-resolver` (185 tests total across the touched paths).

package/upgrades/1.3.753.md

@@ -0,0 +1,44 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The "move/run/pin this on `<machine-nickname>`" recognizer — the thing that decides whether a
+mid-conversation message is a command to move the session to another machine — was rebuilt from a keyword
+verb-list into an LLM classifier (`src/core/MoveIntentClassifier.ts`). The old code (`TRANSFER_VERBS =
+[move, transfer, run, continue, resume, keep, …]` × a preposition × a known nickname) hijacked the
+operator's plain discussion **"keep the work on the laptop"** on 2026-07-03 — it matched the verb `keep`
+and swallowed the message before the agent ever saw it. The new classifier infers move/pin intent from the
+message **and** a bounded window of recent conversation, and constrains the target machine to a
+known-nickname enum via **code-side validation of the model's emitted field** (never string-matching the
+model's prose). It is the exemplar conversion under the constitutional standard *"Intelligence Infers,
+Keywords Only Guard"* (parent: *"Intelligent Prompts — An LLM Gate Must Not String-Match"*). It **fails
+open**: on any uncertainty — no provider, circuit-breaker open, timeout, unparseable/schema-violating
+output, target-not-in-enum, or low confidence — the message passes straight through to the agent, never
+hijacked. It ships **dev-gated dark on the fleet + dry-run first on a development agent** (it logs
+would-hijack vs would-pass to `logs/move-intent.jsonl` and actuates nothing until a deliberate
+`dryRun:false`). The keyword decision is removed from `NicknameCommand.ts` (only the `NicknameCommand` type,
+consumed by the unchanged `TransferByNickname` planner, remains). Ships with a committed discrimination
+corpus (command vs discussion both ways + guardrail + fail-open) — deterministic in CI plus an opt-in
+`INSTAR_LIVE_MOVE_INTENT=1` real-model benchmark used as the graduation gate before actuation.
+
+## What to Tell Your User
+
+Nothing user-facing right now — this ships dark on the fleet and dry-run on a development agent, so no
+behavior changes until it's deliberately graduated. If asked why the agent used to grab a message like
+"keep the work on the laptop" as a machine-move command: that was a brittle keyword list, now replaced by
+an LLM that judges intent from the message and its conversation context and errs toward *not* grabbing your
+message when unsure. The move-by-nickname capability itself is a dev-only experimental feature (part of the
+dark multi-machine session pool); only *how it recognizes your intent* changed.
+
+## Summary of New Capabilities
+
+- `src/core/MoveIntentClassifier.ts` — LLM-with-context move-intent recognizer (`classifyRelocationIntent`
+  + `toNicknameCommand`); structured-output enum guardrail validated in code; fail-open on all uncertainty.
+- Config `multiMachine.sessionPool.moveIntent` (`enabled` dev-gated; `dryRun:true`, `minConfidence:0.85`,
+  `timeoutMs:4000`, `contextWindowTurns:6`, `modelTier:'fast'`); registered in `DEV_GATED_FEATURES`.
+- `logs/move-intent.jsonl` — machine-local dry-run soak log (LLM-engaged decisions only; 80-char preview).
+- Committed discrimination corpus + opt-in real-model benchmark (`INSTAR_LIVE_MOVE_INTENT=1`), the
+  graduation gate before `dryRun:false`.

package/upgrades/side-effects/model-registry-current-pins.md

@@ -0,0 +1,81 @@
+# Side-Effects Review — Model-registry current-pins correction
+
+**Version / slug:** `model-registry-current-pins`
+**Date:** 2026-07-03
+**Author:** Echo (autonomous, instar-dev)
+**Second-pass reviewer:** not-required (Tier 1 — value-only pin correction; no decision-point surface added)
+
+## Summary of the change
+
+Corrects stale "capable/frontier" model-tier pins to the current, live-verified IDs, and marks the model-registry freshness guard's two flagged-stale items as resolved. Concretely: the Gemini `capable` tier moves `gemini-2.5-pro` → `gemini-3.1-pro-preview` (`src/providers/adapters/gemini-cli/models.ts` TIER_TO_MODEL + the mirroring Gemini branch in `src/core/frameworkSessionLaunch.ts`); the Claude Opus tier is reconciled to `claude-opus-4-8` in the two disagreeing maps (`src/core/models.ts` ANTHROPIC_MODELS.opus and `src/providers/adapters/anthropic-headless/models.ts` API_MODEL_MAP.capable) — `ModelTierEscalation` already used `claude-opus-4-8`; the freshness manifest (`scripts/model-registry-freshness.manifest.json`) frontier allowlist is updated to match both new pins and its `flaggedStale` array is emptied; and the routing doc (`docs/LLM-ROUTING-REGISTRY.md`) capable row, opus caveat, and freshness note are updated. The Codex/OpenAI `capable` pin was already `gpt-5.5` (GA flagship) and is left unchanged — `gpt-5.6-sol` (preview-only/gov-gated) is intentionally NOT pinned. Three test files that asserted the old IDs are updated. No decision-point surface is added.
+
+## Decision-point inventory
+
+This change touches no gate/block/filter/dispatch decision point. It edits the concrete model ID that abstract tier lookups return, and the metadata the (report-only, non-gating) freshness lint reads.
+
+- Gemini `capable` tier pin — modify — `gemini-2.5-pro` → `gemini-3.1-pro-preview` (adapter map + frameworkSessionLaunch mirror).
+- Claude Opus tier pin — modify — reconciled to `claude-opus-4-8` in `models.ts` + anthropic-headless adapter.
+- Codex `capable` tier pin — pass-through — already `gpt-5.5`, unchanged.
+- Freshness manifest allowlist + flaggedStale — modify — allowlist matched to new pins; flaggedStale emptied (both prior pending items resolved).
+
+---
+
+## 1. Over-block
+
+No block/allow surface — over-block not applicable. The change edits model-ID values returned by tier lookups; it does not accept/reject any input.
+
+---
+
+## 2. Under-block
+
+No block/allow surface — under-block not applicable.
+
+---
+
+## 3. Level-of-abstraction fit
+
+Correct layer. The tier→ID maps are the documented single source of truth for "which concrete model a tier resolves to" per provider door (the routing doc row #8 explicitly says "changing Claude models = edit this file, not config"). The freshness manifest is the intended single human-edit surface for the frontier allowlist. This change edits exactly those surfaces and nothing lower (no call-site hardcoding) or higher (no config/gate). The `KNOWN_GEMINI_MODELS` closed enum is the type domain for the Gemini tier map, so the new ID is added there (required for type-safety) rather than loosening the type.
+
+---
+
+## 4. Signal vs authority compliance
+
+**Required reference:** [docs/signal-vs-authority.md](../../docs/signal-vs-authority.md)
+
+- [x] No — this change has no block/allow surface.
+
+It adds no authority. It changes which model ID a lookup returns. The freshness lint that reads the manifest remains a report-only signal (non-gating); this change resolves its flagged items rather than granting it any new authority.
+
+---
+
+## 5. Interactions
+
+- **Shadowing:** none. The pins are read the same way before and after.
+- **crossModelReviewer coupling (intended):** `src/core/crossModelReviewer.ts` resolves its Gemini reviewer model via the shared `resolveCliModelFlag('capable')` (it has no independent hardcoded ID). So its Gemini reviewer now automatically uses `gemini-3.1-pro-preview` — which is precisely the freshness-guard's stated intent ("`gemini-2.5-pro` kept routing spec-review/converge work long after Gemini 3-class shipped"). The reviewer's *door* (framework = gemini-cli, tier = capable) is unchanged; only the concrete ID the capable tier resolves to is corrected. The reviewer's risk-item doc row (`docs/LLM-ROUTING-REGISTRY.md` line ~216) is intentionally left unchanged per the operator's scope boundary for this change — its model value follows the pin automatically.
+- **Capacity fallback pool:** `KNOWN_GEMINI_MODELS` grows from 2 to 3 entries, so the Gemini capacity-exhaustion fallback picker now has `gemini-3.1-pro-preview` as an additional candidate; `gemini-2.5-pro` remains ordered ahead of it, so the default fallback-from-flash target is unchanged. The capacity/adapter/reviewer tests that encoded the 2-model world (and the old capable ID) are updated to match. The three unit tests (`crossModelReviewer-piece3`, `gemini-cli-adapter`, `geminiCapacityPolicy`) were updated in the original pin commit; a follow-up commit updates the two model-set-size assertions that were missed in `tests/integration/gemini-capacity-policy-integration.test.ts` and `tests/e2e/gemini-capacity-policy-lifecycle.test.ts` — the account-wide-defer spawn count moves 2→3 (flash→pro→`gemini-3.1-pro-preview` before the genuine account-wide defer) and the recorded last-exhausted stop-state model moves `gemini-2.5-pro`→`gemini-3.1-pro-preview` (the new final entry of the fallback iteration). No product-source change; these are pure test-expectation corrections tracking the model-set growth.
+- **Spawn allowlist:** `src/server/routes.ts` uses `KNOWN_GEMINI_MODELS` as the accepted-model allowlist for explicitly spawning a Gemini session — keeping `gemini-2.5-pro` in the set (append, not replace) avoids rejecting a still-working model, and adds `gemini-3.1-pro-preview` as spawnable.
+- **Double-fire / races:** none.
+
+---
+
+## 6. External surfaces
+
+Internal model selection only. Other agents/users/systems do not read these IDs directly. The change alters which model runs internal capable-tier work (spec review/converge, heavy-work escalation baseline, background headless calls) — a quality improvement, not a protocol/interface change. No timing or conversation-state dependence.
+
+## 6b. Operator-surface quality
+
+Not applicable — no operator surface (dashboard/CLI form/authorization surface) is touched by this change.
+
+---
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+Machine-local BY DESIGN, and identical on every machine. These pins are compiled source constants shipped in the release artifact (`dist/`), not per-machine state — so every machine running the same instar version resolves the same IDs. There is no per-machine divergence to replicate, no durable state to strand on topic transfer, and no generated URL involved. Not an agent-installed file (CLAUDE.md template / `.instar/config.json` default / hook), so the Migration Parity Standard imposes no migration: existing agents pick up the corrected pins on their normal version update, and no on-disk agent state carries the stale ID (the config default `DEFAULT_TIER_ESCALATION_CONFIG` and the CLAUDE.md template already reference `claude-opus-4-8`).
+
+## 8. Rollback cost
+
+Trivial. A plain `git revert` of the single commit restores the prior IDs, allowlist, and flaggedStale block; no data migration, no agent-state repair. The freshness manifest change is reversible in the same revert. Because the guard ships report-only (non-gating), even a mistaken pin cannot break CI on its own.
+
+## Framework generality
+
+This change is per-framework by construction: each provider door's `capable` pin is corrected independently in that door's own map (Gemini adapter, anthropic-headless adapter, Claude `models.ts`), and the touched `src/core/frameworkSessionLaunch.ts` edit is confined to the `gemini-cli` branch — mirroring the Gemini adapter's single source of truth — while the `claude-code`, `codex-cli`, and `pi-cli` branches are untouched. The abstraction (tier → concrete ID per framework) is preserved; no Claude-specific assumption is introduced, and codex-cli / gemini-cli remain correct (codex `capable` stays `gpt-5.5`; gemini `capable` becomes `gemini-3.1-pro-preview`). Standard: docs/STANDARDS-REGISTRY.md → "Framework-Agnostic — and Framework-Optimizing".

package/upgrades/side-effects/nickname-move-intent-llm-rebuild.md

@@ -0,0 +1,160 @@
+# Side-Effects Review — Move-Intent Recognizer: Keyword List → LLM-With-Context
+
+**Version / slug:** `nickname-move-intent-llm-rebuild`
+**Date:** `2026-07-04`
+**Author:** `echo`
+**Second-pass reviewer:** `spec-converge round (codex-cli:gpt-5.5 + gemini-cli:gemini-2.5-pro + 4 internal reviewers)`
+
+## Summary of the change
+
+Replaces the keyword verb-list decision in `NicknameCommand.recognizeNicknameCommand`
+(`TRANSFER_VERBS = [move,…,run,continue,resume,keep]`) — which hijacked the operator's discussion message
+"keep the work on the laptop" on 2026-07-03 — with an LLM classifier (`src/core/MoveIntentClassifier.ts`)
+that infers "is this a move/pin command to <known machine>?" over the message + a bounded window of recent
+conversation, guardrailed by code-side enum validation of the model-emitted `targetNickname`. Fail-OPEN on
+any uncertainty (never hijack). Wired at `server.ts` `_tryNicknameRelocation` behind a dev-agent dark gate +
+dry-run. The keyword decision is removed from `NicknameCommand.ts` (only the `NicknameCommand` type, consumed
+by the unchanged `TransferByNickname` planner, remains). Files: `src/core/MoveIntentClassifier.ts` (new),
+`src/core/NicknameCommand.ts`, `src/commands/server.ts`, `src/config/ConfigDefaults.ts`,
+`src/core/devGatedFeatures.ts`, `src/core/componentCategories.ts`, `src/core/machineCoherenceManifest.ts`,
+`docs/LLM-ROUTING-REGISTRY.md`, three test files + the wiring/line-map test updates.
+
+## Decision-point inventory
+
+- `_tryNicknameRelocation` (server.ts) — **modify** — the "is this a move command?" decision changes from
+  keyword-match to LLM classifier; the downstream `planTransferByNickname` actuator is pass-through (unchanged).
+- `NicknameCommand.recognizeNicknameCommand` — **remove** — the keyword verb-list decision is deleted.
+- `MoveIntentClassifier.classifyRelocationIntent` — **add** — the new LLM decision + code-side enum guardrail.
+- `multiMachine.sessionPool.moveIntent` config — **add** — dev-gated dark, dry-run-first knobs.
+
+---
+
+## 1. Over-block
+
+The "block" surface here = hijacking a message (treating it as a move command, swallowing it). Over-block =
+falsely hijacking discussion. This change's entire purpose is to REDUCE over-block: the classifier fails
+open (only a high-confidence command with a resolved enum target hijacks), and ships dry-run so it hijacks
+NOTHING during the soak. The residual over-block risk is a confidently-wrong model returning
+`isCommand:true, confidence≥0.85` on discussion — bounded by the graduation-gate live benchmark (must pass
+before `dryRun:false`) and the conservative threshold. Strictly less over-block than the keyword list, which
+hijacked on any verb×preposition×nickname co-occurrence.
+
+## 2. Under-block
+
+Under-block = missing a genuine move command (it passes through to the agent). By design this is the SAFE
+direction (fail-open). Known misses: (a) a purely deictic target with no nickname anywhere in the window
+("send it to my desktop") — the prefilter skips → pass-through; (b) any fail-open path (provider down,
+timeout, low confidence, malformed output). All are cheap (the user re-phrases); none cause harm. The old
+keyword list ALSO under-blocked ("let's have the mini take this one" was missed) — this reduces it via
+context-aware inference.
+
+## 3. Level-of-abstraction fit
+
+Correct layer. It is a smart AUTHORITY (LLM reasoning over message + conversation context), not a brittle
+detector — exactly what the "Intelligence Infers, Keywords Only Guard" standard requires for a
+what-did-they-mean judgment. The cheap deterministic prefilter is a genuine *pre-filter* (drops toward
+pass-through only, never decides a command), matching `TopicIntentCapture`. It USES existing primitives
+(shared `IntelligenceProvider`, `RelocationNicknameSet`, `TransferByNickname`) rather than re-implementing
+them; it FEEDS the unchanged planner rather than running parallel to it.
+
+## 4. Signal vs authority compliance
+
+**Required reference:** docs/signal-vs-authority.md
+
+- [x] Yes — but the logic is a smart gate with full conversational context (LLM-backed with recent history).
+
+The decision is an LLM reasoning over the message + a bounded conversation window — a smart gate, not a
+brittle detector holding block authority. It replaces exactly the brittle-detector-with-authority
+anti-pattern the standard forbids. It fails open, so even under provider failure it never asserts authority
+it can't back.
+
+## 5. Interactions
+
+- **Shadowing:** `_tryNicknameRelocation` runs BEFORE `_sessionRouter.route()` (unchanged ordering) and only
+  when `_sessionPoolStage() !== 'dark'`. When it returns `handled:false` (the common case, and ALWAYS during
+  dry-run), routing proceeds normally — it cannot shadow the router. Verified by `transfer-activation-wiring.test.ts`.
+- **Double-fire:** no. A message is classified once per inbound; a positive hijack returns early (`return`),
+  a pass-through continues to the router exactly once.
+- **Races:** none new. The classifier is stateless; the only write is an append to `logs/move-intent.jsonl`
+  (best-effort, wrapped, never throws into the message path).
+- **Feedback loops:** none. The classifier reads recent history but never writes conversation turns.
+
+## 6. External surfaces
+
+- **Other agents on the machine:** none — internal message-path classifier.
+- **Install base:** dark on the fleet (dev-agent gate + the whole relocation path is already gated behind
+  `sessionPool != dark`, which ships dark). No fleet behavior change.
+- **External systems:** one bounded fast-tier LLM call per nickname-mentioning candidate message, via the
+  shared `IntelligenceProvider` (spawn-cap + circuit-breaker + attribution). No new network dependency.
+- **Persistent state:** `logs/move-intent.jsonl` — a new machine-local append-only observability log
+  (LLM-engaged decisions only; 80-char truncated preview; local, never synced). Consistent with all other
+  `logs/*.jsonl`.
+- **Timing:** `timeoutMs` default 4000 bounds the worst-case pass-through delay for a candidate message.
+- **Operator surface (Mobile-Complete):** No operator-facing actions added. The only operator interaction is
+  flipping `dryRun:false` / `modelTier` in config (already a standard config edit), plus reading the
+  dashboard **LLM Activity** tab (`/metrics/features`, already phone-accessible). N/A.
+
+## 6b. Operator-surface quality
+
+No operator surface — not applicable. This change touches no dashboard renderer, approval page, or
+grant/revoke/secret-drop form (no `dashboard/*` or form files staged).
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+**Posture: machine-local BY DESIGN** — the classifier is stateless request-locality COMPUTE. It runs on the
+machine that holds the topic (the lifeline forwards inbound to the holder), is a pure function of the
+message + the live nickname registry + the provider, and has no durable cross-machine state to replicate.
+The only durable artifact is `logs/move-intent.jsonl`, a machine-local observability log identical in
+posture to `logs/sentinel-events.jsonl` / `logs/reaper-audit.jsonl` (pure per-machine observability).
+
+- **User-facing notices / one-voice gating?** No — during dry-run it emits nothing to the user; when live it
+  produces the same single "Moving…" reply the existing keyword path did (unchanged), routed by the existing
+  single-owner path.
+- **Durable state / strands on topic transfer?** The soak log is per-machine; a topic that transfers mid-soak
+  splits its would-hijack/would-pass evidence across machines. This is graduation-decision EVIDENCE, not user
+  data — at `dryRun:false` graduation the operator aggregates the per-machine logs (or scopes the soak to a
+  non-moving topic). No user data strands.
+- **Generated URLs?** None.
+
+Multi-dev note: the dev-agent gate resolves per-machine, so a multi-dev setup should activate
+pool-consistently (documented in the spec Rollout §4) to avoid divergent behavior across topic-holding machines.
+
+---
+
+## Migration parity
+
+Config default `multiMachine.sessionPool.moveIntent` is added under the existing `sessionPool` block in
+`ConfigDefaults.ts`; `applyDefaults`/`getMigrationDefaults` deep-merges it add-missing onto existing agents
+(the documented sessionPool migration-parity path — verified: the whole config/migration test family, 1191
+tests, stays green). `enabled` is OMITTED so `resolveDevAgentGate` decides (dark fleet / live dev);
+registered in `DEV_GATED_FEATURES` (both-sides wiring test green). No hook/CLAUDE.md-template/skill changes
+(the move-by-nickname capability is dev-only experimental behind the dark session pool, so no
+Agent-Awareness template surface is added).
+
+## Rollback
+
+Pure revert. No schema/data migration to unwind. To disable without reverting: set
+`multiMachine.sessionPool.moveIntent.enabled: false` in config (force-dark even on a dev agent), or leave the
+session pool at `stage: dark` (the default) — either fully inerts the path. `logs/move-intent.jsonl` is
+append-only observability and safe to delete.
+
+## Risk
+
+Low. Ships dark on the fleet AND dry-run-first on dev (logs would-hijack/would-pass, actuates nothing). The
+change strictly REDUCES risk versus the shipped keyword recognizer (fail-open replaces false-positive
+hijack). The residual risk (a confidently-wrong model once `dryRun:false`) is gated by the graduation-gate
+live benchmark + user-role Live-Channel proof + the soak, all required before actuation. tsc clean; lint
+clean; all three test tiers green including the discrimination corpus.
+
+## Post-rebase addendum (2026-07-04)
+
+Rebased onto current `main` (clean). The new LLM component `MoveIntentClassifier` was registered across the
+LLM-coverage ratchets that landed on main (#1366 and the bench family): `src/data/llmBenchCoverage.ts` —
+`LLM_UNTRUSTED_INPUT: true` (it reads untrusted user message + context), `LLM_JUDGES_CLAIMS: false` (it
+classifies a USER's move intent, not an agent/session completion/health/credit claim), `LLM_PARSER_CONTRACT:
+{ pending: 'contract-wave-2' }` (it parses a closed verdict), and `LLM_BENCH_COVERAGE: { exempt }` (it ships
+its own discrimination benchmark). The keyword-intent-decision ratchet's baseline was decremented 6→5 and
+`NicknameCommand.ts` removed from its `EXPECTED_OFFENDERS` (offender #2 converted — exactly what that ratchet
+tracks). The `parseMoveIntentResponse` fail-open catch carries an `@silent-fallback-ok` marker (the
+documented fail-open, surfaced via `result.source`/`reason` + the audit log, never a silent swallow). No
+behavior change from these — they are the coverage/observability registrations a new LLM component requires.