instar 1.3.752 → 1.3.754

package/src/data/llmBenchCoverage.ts

@@ -48,6 +48,14 @@ export const LLM_BENCH_COVERAGE: Readonly<Record<string, BenchCoverage>> = {
     exempt:
       'judges a FIXED known-answer canary probe — the canary is its own benchmark; a bench task would re-test the same constant',
   },
+  MoveIntentClassifier: {
+    exempt:
+      'ships its OWN dedicated discrimination benchmark — tests/unit/move-intent-discrimination.test.ts, a committed command-vs-discussion corpus run deterministically in CI PLUS an opt-in INSTAR_LIVE_MOVE_INTENT=1 real-model accuracy benchmark (the graduation gate before dryRun:false). A generic bench-harness task would re-test the same judgment less precisely (same rationale as InteractivePoolCanaryJudge: the co-located benchmark IS the benchmark). Spec: docs/specs/nickname-move-intent-llm-rebuild.md §Tests.',
+  },
+  HubIntentClassifier: {
+    exempt:
+      'ships its OWN dedicated discrimination benchmark — tests/unit/hub-intent-discrimination.test.ts, a committed command-vs-discussion corpus (open/tie vs question/mention + unknown-target guardrail + fail-open) run deterministically in CI PLUS an opt-in INSTAR_LIVE_HUB_INTENT=1 real-model accuracy benchmark (the graduation gate before dryRun:false). Same rationale as MoveIntentClassifier: the co-located benchmark IS the benchmark; a generic harness task would re-test the same judgment less precisely. Spec: docs/specs/keyword-intent-conversions-1-and-3.md §Tests.',
+  },
 
   // ── Covered by Wave 2 (authored 2026-07-02; tasks-wave2/ in the bench harness) ──
   InputGuard: { task: 'input-guard-coherence' },
@@ -164,11 +172,13 @@ export const LLM_UNTRUSTED_INPUT: Readonly<Record<string, UntrustedInputFlag>> =
   TelegramAdapter: true,
 
   // ── Gates judging user/session/operation content → true ──
+  HubIntentClassifier: true, // judges an inbound hub message's bind-intent (untrusted user text)
   PromptGate: true,
   ExternalOperationGate: true, // the motivating callsite: credited in-content "user already approved"
   WarrantsReplyGate: true,
   UnjustifiedStopGate: true,
   MessagingToneGate: true, // reviews a draft that routinely quotes untrusted user/tool content
+  MoveIntentClassifier: true, // classifies an untrusted inbound user message + recent conversation context
   CoherenceReviewer: true,
   LLMSanitizer: true, // definitionally judges untrusted inbound content
   OverrideDetector: true,
@@ -331,6 +341,8 @@ export const LLM_JUDGES_CLAIMS: Readonly<Record<string, JudgesClaimsFlag>> = {
   IntegrationGate: false, // delegates to JobReflector.reflect(), no own callsite
   ExternalOperationGate: false, // classifies operation mutability/reversibility, not a completion claim
   WarrantsReplyGate: false, // "should I reply?" — not a completion/health claim
+  MoveIntentClassifier: false, // classifies a USER's move/pin intent over a message, not an agent/session claim of completion/health/credit
+  HubIntentClassifier: false, // classifies a USER's hub bind-intent (open/tie) over a message, not an agent/session claim of completion/health/credit
   CoherenceGate: false, // no own callsite — flows through CoherenceReviewer
   MessagingToneGate: false, // reviews outbound tone/leaks
   CoherenceReviewer: false, // reviews outbound coherence
@@ -423,6 +435,8 @@ export const LLM_PARSER_CONTRACT: Readonly<Record<string, ParserContractFlag>> =
   MessageSentinel: { pending: 'contract-wave-2' }, // closed intent set (pause / emergency / normal)
   LLMSanitizer: { pending: 'contract-wave-2' }, // parses a closed sanitize verdict/decision
   WarrantsReplyGate: { pending: 'contract-wave-2' }, // closed should-reply yes/no verdict
+  MoveIntentClassifier: { pending: 'contract-wave-2' }, // parses a closed move-intent verdict (isCommand + intent enum + targetNickname enum + confidence)
+  HubIntentClassifier: { pending: 'contract-wave-2' }, // parses a closed hub-intent verdict (intent enum open/tie/null + targetTopicId enum + confidence)
   InputGuard: { pending: 'contract-wave-2' }, // closed input-coherence verdict
   StallTriageNurse: { pending: 'contract-wave-2' }, // closed stall-triage diagnosis label
   CommitmentSentinel: { pending: 'contract-wave-2' }, // closed commitment-detected verdict + structured envelope

package/upgrades/1.3.753.md

@@ -0,0 +1,44 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The "move/run/pin this on `<machine-nickname>`" recognizer — the thing that decides whether a
+mid-conversation message is a command to move the session to another machine — was rebuilt from a keyword
+verb-list into an LLM classifier (`src/core/MoveIntentClassifier.ts`). The old code (`TRANSFER_VERBS =
+[move, transfer, run, continue, resume, keep, …]` × a preposition × a known nickname) hijacked the
+operator's plain discussion **"keep the work on the laptop"** on 2026-07-03 — it matched the verb `keep`
+and swallowed the message before the agent ever saw it. The new classifier infers move/pin intent from the
+message **and** a bounded window of recent conversation, and constrains the target machine to a
+known-nickname enum via **code-side validation of the model's emitted field** (never string-matching the
+model's prose). It is the exemplar conversion under the constitutional standard *"Intelligence Infers,
+Keywords Only Guard"* (parent: *"Intelligent Prompts — An LLM Gate Must Not String-Match"*). It **fails
+open**: on any uncertainty — no provider, circuit-breaker open, timeout, unparseable/schema-violating
+output, target-not-in-enum, or low confidence — the message passes straight through to the agent, never
+hijacked. It ships **dev-gated dark on the fleet + dry-run first on a development agent** (it logs
+would-hijack vs would-pass to `logs/move-intent.jsonl` and actuates nothing until a deliberate
+`dryRun:false`). The keyword decision is removed from `NicknameCommand.ts` (only the `NicknameCommand` type,
+consumed by the unchanged `TransferByNickname` planner, remains). Ships with a committed discrimination
+corpus (command vs discussion both ways + guardrail + fail-open) — deterministic in CI plus an opt-in
+`INSTAR_LIVE_MOVE_INTENT=1` real-model benchmark used as the graduation gate before actuation.
+
+## What to Tell Your User
+
+Nothing user-facing right now — this ships dark on the fleet and dry-run on a development agent, so no
+behavior changes until it's deliberately graduated. If asked why the agent used to grab a message like
+"keep the work on the laptop" as a machine-move command: that was a brittle keyword list, now replaced by
+an LLM that judges intent from the message and its conversation context and errs toward *not* grabbing your
+message when unsure. The move-by-nickname capability itself is a dev-only experimental feature (part of the
+dark multi-machine session pool); only *how it recognizes your intent* changed.
+
+## Summary of New Capabilities
+
+- `src/core/MoveIntentClassifier.ts` — LLM-with-context move-intent recognizer (`classifyRelocationIntent`
+  + `toNicknameCommand`); structured-output enum guardrail validated in code; fail-open on all uncertainty.
+- Config `multiMachine.sessionPool.moveIntent` (`enabled` dev-gated; `dryRun:true`, `minConfidence:0.85`,
+  `timeoutMs:4000`, `contextWindowTurns:6`, `modelTier:'fast'`); registered in `DEV_GATED_FEATURES`.
+- `logs/move-intent.jsonl` — machine-local dry-run soak log (LLM-engaged decisions only; 80-char preview).
+- Committed discrimination corpus + opt-in real-model benchmark (`INSTAR_LIVE_MOVE_INTENT=1`), the
+  graduation gate before `dryRun:false`.

package/upgrades/1.3.754.md

@@ -0,0 +1,46 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The Threadline hub's "open this" / "tie this to `<topic>`" recognizer — the thing that decides whether a
+message in the hub topic is a bind command — was rebuilt from anchored whole-message regexes into an LLM
+classifier (`src/threadline/HubIntentClassifier.ts`). The old regexes
+(`/^open(?:\s+this)?…/`, `/^(?:tie|bind)\s+this\s+to\s+(.+?)…/`) were wired at the `onTopicMessage` seam,
+where a positive match **SWALLOWS the message before the agent ever sees it** and performs a bind — so a
+misread silently EATS a real message (e.g. "should I open this?" or "open this in a new tab"). The new
+classifier infers open/tie intent from the message **and** a bounded window of recent conversation, and
+constrains a `tie` target to a structured enum of the real existing topics via **code-side validation of
+the model's emitted topic-id** (never string-matching the model's prose). It is Conversion #3 under the
+constitutional standard *"Intelligence Infers, Keywords Only Guard"*, following the proven move-intent
+exemplar (PR #1367). It **fails open**: on any uncertainty — no provider, circuit-breaker open, timeout,
+unparseable/schema-violating output, tie-target-not-in-enum, or low confidence — the message passes
+straight through to the agent, never swallowed. It ships **dev-gated dark on the fleet + dry-run first on
+a development agent** (it logs would-swallow vs would-pass to `logs/hub-intent.jsonl` and swallows nothing
+until a deliberate `dryRun:false`). The keyword decision (`parseHubCommand`) is removed from
+`hubCommands.ts`; the `HubCommand` type + the authoritative `bindHubConversation` binder are unchanged.
+Ships with a committed discrimination corpus (command vs discussion both ways + guardrail + fail-open) —
+deterministic in CI plus an opt-in `INSTAR_LIVE_HUB_INTENT=1` real-model benchmark used as the graduation
+gate before actuation.
+
+## What to Tell Your User
+
+Nothing user-facing right now — this ships dark on the fleet and dry-run on a development agent, so no
+behavior changes until it's deliberately graduated. If asked why the agent used to grab a hub message
+like "should I open this?" as a bind command: that was a brittle regex that ate the message before the
+agent saw it, now replaced by an LLM that judges intent from the message and its conversation context and
+errs toward not grabbing your message when unsure. While dark on the fleet, the hub's automatic
+"open this" grabbing simply does not fire, and everything else about the hub works exactly as before.
+
+## Summary of New Capabilities
+
+- `src/threadline/HubIntentClassifier.ts` — LLM-with-context hub-intent recognizer (`classifyHubIntent`
+  + `toHubCommand`); structured-output topic-id enum guardrail validated in code; fail-open on all
+  uncertainty.
+- Config `threadline.hubIntent` (`enabled` dev-gated; `dryRun:true`, `minConfidence:0.85`,
+  `timeoutMs:4000`, `contextWindowTurns:6`, `modelTier:'fast'`); registered in `DEV_GATED_FEATURES`.
+- `logs/hub-intent.jsonl` — machine-local dry-run soak log (LLM-engaged decisions only; 80-char preview).
+- Committed discrimination corpus + opt-in real-model benchmark (`INSTAR_LIVE_HUB_INTENT=1`), the
+  graduation gate before `dryRun:false`.

package/upgrades/side-effects/keyword-intent-conversion-3-hubcommands.md

@@ -0,0 +1,170 @@
+# Side-Effects Review — Hub-intent recognizer: regex → LLM-with-context (Conversion #3)
+
+**Version / slug:** `keyword-intent-conversion-3-hubcommands`
+**Date:** `2026-07-03`
+**Author:** `echo`
+**Second-pass reviewer:** `subagent (fresh reviewer) — see appended verdict`
+
+## Summary of the change
+
+Replaces the keyword/regex DECISION in `src/threadline/hubCommands.ts` `parseHubCommand()` (anchored
+whole-message regexes for "open this" / "tie this to <topic>") with an LLM-with-context classifier,
+`src/threadline/HubIntentClassifier.ts`. The recognizer runs at the `telegram.onTopicMessage` hub
+intercept in `src/commands/server.ts`, where a positive decision SWALLOWS the message before the agent
+sees it and performs a bind — so a misread silently EATS a real message. The new classifier infers
+open/tie intent from the message + a bounded recent-conversation window, constrains a `tie` target to a
+structured enum of real existing topics (validated in code by numeric id membership, never prose-match),
+and FAILS OPEN on every uncertainty (message passes through, never swallowed). The authoritative binder
+`bindHubConversation` is unchanged. Ships dev-gated dark (config `threadline.hubIntent`, `enabled` omitted
+→ `resolveDevAgentGate`) + dry-run first (`logs/hub-intent.jsonl`). Files: `HubIntentClassifier.ts` (new),
+`hubCommands.ts` (regex removed), `server.ts` (wiring + `resolveHubClassifierDeps`), `ConfigDefaults.ts`,
+`devGatedFeatures.ts`, `componentCategories.ts`, `LLM-ROUTING-REGISTRY.md`, three test tiers + updated
+`hubCommands.test.ts` + recomputed dark-gate line-map. Follows the proven `MoveIntentClassifier` exemplar
+(PR #1367).
+
+## Decision-point inventory
+
+- `hubCommands.parseHubCommand` (`src/threadline/hubCommands.ts`) — **remove** — the anchored-regex "is
+  this a hub bind command?" decision is deleted.
+- `HubIntentClassifier.classifyHubIntent` (`src/threadline/HubIntentClassifier.ts`) — **add** — the LLM
+  decision that replaces it (open/tie/null + enum-validated target + confidence).
+- `onTopicMessage` hub intercept (`src/commands/server.ts`) — **modify** — swaps regex call for classifier
+  + dev-gate + dry-run gate + audit; still returns (swallows) only on a real, non-dry-run command.
+- `bindHubConversation` (`src/threadline/hubCommands.ts`) — **pass-through** — unchanged binder.
+
+---
+
+## 1. Over-block
+
+Over-block here = wrongly SWALLOWING a legitimate message the user did not mean as a bind command (the
+exact harm the old regex caused, e.g. "should I open this?" / "open this in a new tab"). The new decision
+is LLM-with-context, so these are correctly classified as discussion (covered by the discrimination
+corpus). Structural protections against over-block: (a) FAIL-OPEN — any uncertainty passes through;
+(b) a high confidence bar (0.85) to swallow; (c) a `tie` whose target isn't a real topic id passes
+through; (d) the whole path is DARK on the fleet and DRY-RUN on dev, so nothing is swallowed until a
+deliberate `dryRun:false` gated on a live accuracy benchmark. Net: over-block strictly decreases vs the
+shipped regex.
+
+## 2. Under-block
+
+Under-block = failing to recognize a genuine bind command (message reaches the agent instead of
+auto-binding). This is the SAFE direction here (a missed auto-bind costs a restate; the agent can still
+bind via the API). Sources: (a) the cheap pre-filter skips messages with no bind-ish stem word, so a
+paraphrase like "put this under the roadmap topic" is not auto-bound; (b) fail-open passes through on
+provider failure; (c) while dark/dry-run nothing is bound. All acceptable — the design deliberately trades
+missed auto-binds for never eating a message.
+
+## 3. Level-of-abstraction fit
+
+Correct layer: an AUTHORITY (context-rich LLM reasoning), not a brittle detector. It replaces a brittle
+detector (regex) that wrongly held swallow authority. It routes through the shared `IntelligenceProvider`
+(the same smart-gate substrate `CoherenceGate` uses) rather than re-implementing an LLM path, and reuses
+the existing `bindHubConversation` binder rather than duplicating bind logic. The cheap pre-filter is a
+low-level primitive used ONLY to drop toward pass-through (never to decide a positive), exactly as the
+standard permits.
+
+## 4. Signal vs authority compliance
+
+**Required reference:** docs/signal-vs-authority.md
+
+- [x] Yes — the logic is a smart gate with full conversational context (LLM-backed with recent history).
+
+The classifier holds the swallow decision, but it is an LLM reasoning over the message + a bounded recent
+conversation window (not brittle logic), and it fails open. The only string-matching in the module is the
+pre-filter, which can never DECIDE a positive command — it only drops obvious non-commands toward
+pass-through. Enum validation of the model's emitted `targetTopicId` is numeric-id membership, not
+prose-matching.
+
+## 5. Interactions
+
+- **Shadowing:** the hub intercept runs inside `onTopicMessage` before normal session routing, exactly
+  where the regex ran. When dark/dry-run OR fail-open OR not-a-command, it returns `handled:false`
+  (falls through) so downstream routing (fix-commands, session dispatch) is unaffected — it can only
+  shadow routing when it genuinely swallows a real command, which was the old behavior too.
+- **Double-fire:** only one intercept owns hub-command recognition; there is no second recognizer to
+  double-fire with. The `POST /threadline/hub/bind` API route is a separate, explicit caller (no text
+  decision) and is unchanged.
+- **Races:** none new — the classifier is stateless; the audit append is best-effort and wrapped so it
+  never gates the message. `bindHubConversation`'s existing CAS mutate is unchanged.
+- **Feedback loops:** none — the classifier reads recent history but does not write to it.
+
+## 6. External surfaces
+
+- **Other agents / users:** none while dark on the fleet. On a dev agent (dry-run) the only new surface is
+  the machine-local `logs/hub-intent.jsonl` (80-char scrubbed preview, LLM-engaged decisions only).
+- **External systems:** one bounded fast-tier LLM call per candidate hub message through the shared
+  provider (spawn-cap + breaker), attributed `HubIntentClassifier`. No new network egress beyond that.
+- **Persistent state:** none beyond the append-only dry-run log.
+- **Operator surface (Mobile-Complete):** no operator-facing actions added — the only control is a config
+  flag (`threadline.hubIntent.dryRun/enabled`), same as every dev-gated feature. Not applicable.
+
+## 6b. Operator-surface quality
+
+No operator surface — not applicable. This change touches no dashboard renderer, approval page, or
+grant/revoke/secret form.
+
+## 7. Multi-machine posture
+
+**machine-local BY DESIGN.** The hub intercept and its dry-run log are per-machine inbound-message
+processing on whichever machine owns the hub conversation; there is no cross-machine state to replicate
+and no URL generated. It emits NO user-facing notices (it either swallows a command and lets the existing
+binder post the hub confirmation, or passes through), so no one-voice gating is needed. It holds no durable
+state that could strand on topic transfer (the audit log is local observability). The config flag resolves
+per-machine via `resolveDevAgentGate`, consistent with every other dev-gated feature; on the fleet it is
+uniformly dark.
+
+## 8. Rollback cost
+
+Pure code change — revert and ship a patch. No persistent state needing cleanup (the dry-run log is
+append-only machine-local observability that can be ignored/deleted). No agent-state repair, no
+user-visible regression during the rollback window (the feature is dark on the fleet, so a revert is a
+no-op for fleet agents). The rollback lever short of a revert is `threadline.hubIntent` staying
+dark/dry-run, or `enabled:false` to force-dark even a dev agent.
+
+---
+
+## Second-pass review (Phase 5)
+
+**Reviewer:** fresh subagent (independent audit). **Verdict: Concur with the review.**
+
+The reviewer independently traced every `return` in `classifyHubIntent` and confirmed only two paths
+yield `isCommand:true` (a high-confidence `open`, or a high-confidence `tie` with an enum-resolved
+target), both behind the confidence gate; every other path (empty text, no bind signal, no provider,
+throw/timeout, unparseable/schema-violation, intent null, below confidence, tie-target-not-in-enum)
+returns pass-through. The wiring's `willAct = isCommand && !dryRun` gate means the message is swallowed
+ONLY on a real command with a resolved target and `dryRun:false`; the dark gate (`if clsDeps?.enabled`)
+and dry-run default both skip swallowing; the audit write is wrapped so it can never break the path, and
+the outer try/catch fails open to normal routing. Enum validation is numeric-id membership (never
+prose-match); the pre-filter can only drop toward pass-through. The classifier never throws.
+
+**One non-blocking observation:** while dark on the fleet, the "open this"/"tie this" structural
+interception no longer fires (no regex fallback), so those messages reach the agent — whereas the fleet
+CLAUDE.md still says the agent will NOT see "open this." This is the intentional dark-rollout tradeoff
+already recorded in §2 (Under-block) / §5 (Shadowing); it is the SAFE direction (pass-through, never
+swallow) and not a safety concern. It is a product-completeness item to close at graduation (flip the
+gate, or update the fleet CLAUDE.md guidance for the dark window) — not a blocker for this change.
+
+---
+
+**CI follow-up (2026-07-04):** the new `HubIntentClassifier` gate is registered in
+`COMPONENT_CATEGORY`, which the untrusted-input-classification ratchet requires to carry an explicit
+`LLM_UNTRUSTED_INPUT` classification. It judges an inbound hub message's bind-intent (untrusted user
+text), so it is classified `true` in `src/data/llmBenchCoverage.ts`. Mechanical consequence of the
+component registration; no behavior change.
+
+---
+
+## Post-rebase addendum (main now carries #1367)
+
+After the move-intent exemplar (PR #1367) merged, `main` gained the keyword-intent classification-ratchet family. Rebasing this branch onto it required registering `HubIntentClassifier` (a new `COMPONENT_CATEGORY` key) across every classification map, exactly mirroring how #1367 registered `MoveIntentClassifier`:
+
+- `src/data/llmBenchCoverage.ts`:
+  - `LLM_BENCH_COVERAGE`: `{ exempt }` — ships its own discrimination benchmark (`tests/unit/hub-intent-discrimination.test.ts` + opt-in `INSTAR_LIVE_HUB_INTENT=1`), the co-located benchmark IS the benchmark (same argument as MoveIntentClassifier / InteractivePoolCanaryJudge).
+  - `LLM_JUDGES_CLAIMS`: bare `false` — classifies a USER's bind-intent, not an agent/session completion/health/credit claim.
+  - `LLM_PARSER_CONTRACT`: `{ pending: 'contract-wave-2' }` — parses a closed intent(open/tie/null) + targetTopicId-enum + confidence verdict.
+  - `LLM_UNTRUSTED_INPUT`: `true` — judges untrusted inbound hub text (landed in the prior fix commit).
+- Pinned shrink-only baselines updated (each a visible, reviewed act): `EXEMPT_BASELINE` (`tests/unit/llm-bench-coverage-ratchet.test.ts`) and `PENDING_BASELINE` (`tests/unit/parser-contract-classification-ratchet.test.ts`) each gain `HubIntentClassifier`.
+- `tests/unit/keyword-intent-decision-ratchet.test.ts`: `threadline/hubCommands.ts` removed from `EXPECTED_OFFENDERS` and `BASELINE` dropped 5→4 (the converted file no longer keyword-decides intent; the detector confirms exactly 4 remaining offenders). `topicProfileIngress` #1 remains for its own conversion.
+- Merge conflicts in `componentCategories.ts`, `devGatedFeatures.ts`, `LLM-ROUTING-REGISTRY.md`, and `lint-dev-agent-dark-gate.test.ts` resolved keeping BOTH #1367's and this change's registrations; the dark-gate line-map recomputed against the merged `ConfigDefaults` (hubIntent +20 lines and moveIntent +18 lines both present, neither adds an attributed path).
+
+No behavior change from this addendum — all registrations are ratchet metadata / test baselines. The classifier, wiring, config, and fail-open contract are unchanged from the reviewed version above.

package/upgrades/side-effects/nickname-move-intent-llm-rebuild.md

@@ -0,0 +1,160 @@
+# Side-Effects Review — Move-Intent Recognizer: Keyword List → LLM-With-Context
+
+**Version / slug:** `nickname-move-intent-llm-rebuild`
+**Date:** `2026-07-04`
+**Author:** `echo`
+**Second-pass reviewer:** `spec-converge round (codex-cli:gpt-5.5 + gemini-cli:gemini-2.5-pro + 4 internal reviewers)`
+
+## Summary of the change
+
+Replaces the keyword verb-list decision in `NicknameCommand.recognizeNicknameCommand`
+(`TRANSFER_VERBS = [move,…,run,continue,resume,keep]`) — which hijacked the operator's discussion message
+"keep the work on the laptop" on 2026-07-03 — with an LLM classifier (`src/core/MoveIntentClassifier.ts`)
+that infers "is this a move/pin command to <known machine>?" over the message + a bounded window of recent
+conversation, guardrailed by code-side enum validation of the model-emitted `targetNickname`. Fail-OPEN on
+any uncertainty (never hijack). Wired at `server.ts` `_tryNicknameRelocation` behind a dev-agent dark gate +
+dry-run. The keyword decision is removed from `NicknameCommand.ts` (only the `NicknameCommand` type, consumed
+by the unchanged `TransferByNickname` planner, remains). Files: `src/core/MoveIntentClassifier.ts` (new),
+`src/core/NicknameCommand.ts`, `src/commands/server.ts`, `src/config/ConfigDefaults.ts`,
+`src/core/devGatedFeatures.ts`, `src/core/componentCategories.ts`, `src/core/machineCoherenceManifest.ts`,
+`docs/LLM-ROUTING-REGISTRY.md`, three test files + the wiring/line-map test updates.
+
+## Decision-point inventory
+
+- `_tryNicknameRelocation` (server.ts) — **modify** — the "is this a move command?" decision changes from
+  keyword-match to LLM classifier; the downstream `planTransferByNickname` actuator is pass-through (unchanged).
+- `NicknameCommand.recognizeNicknameCommand` — **remove** — the keyword verb-list decision is deleted.
+- `MoveIntentClassifier.classifyRelocationIntent` — **add** — the new LLM decision + code-side enum guardrail.
+- `multiMachine.sessionPool.moveIntent` config — **add** — dev-gated dark, dry-run-first knobs.
+
+---
+
+## 1. Over-block
+
+The "block" surface here = hijacking a message (treating it as a move command, swallowing it). Over-block =
+falsely hijacking discussion. This change's entire purpose is to REDUCE over-block: the classifier fails
+open (only a high-confidence command with a resolved enum target hijacks), and ships dry-run so it hijacks
+NOTHING during the soak. The residual over-block risk is a confidently-wrong model returning
+`isCommand:true, confidence≥0.85` on discussion — bounded by the graduation-gate live benchmark (must pass
+before `dryRun:false`) and the conservative threshold. Strictly less over-block than the keyword list, which
+hijacked on any verb×preposition×nickname co-occurrence.
+
+## 2. Under-block
+
+Under-block = missing a genuine move command (it passes through to the agent). By design this is the SAFE
+direction (fail-open). Known misses: (a) a purely deictic target with no nickname anywhere in the window
+("send it to my desktop") — the prefilter skips → pass-through; (b) any fail-open path (provider down,
+timeout, low confidence, malformed output). All are cheap (the user re-phrases); none cause harm. The old
+keyword list ALSO under-blocked ("let's have the mini take this one" was missed) — this reduces it via
+context-aware inference.
+
+## 3. Level-of-abstraction fit
+
+Correct layer. It is a smart AUTHORITY (LLM reasoning over message + conversation context), not a brittle
+detector — exactly what the "Intelligence Infers, Keywords Only Guard" standard requires for a
+what-did-they-mean judgment. The cheap deterministic prefilter is a genuine *pre-filter* (drops toward
+pass-through only, never decides a command), matching `TopicIntentCapture`. It USES existing primitives
+(shared `IntelligenceProvider`, `RelocationNicknameSet`, `TransferByNickname`) rather than re-implementing
+them; it FEEDS the unchanged planner rather than running parallel to it.
+
+## 4. Signal vs authority compliance
+
+**Required reference:** docs/signal-vs-authority.md
+
+- [x] Yes — but the logic is a smart gate with full conversational context (LLM-backed with recent history).
+
+The decision is an LLM reasoning over the message + a bounded conversation window — a smart gate, not a
+brittle detector holding block authority. It replaces exactly the brittle-detector-with-authority
+anti-pattern the standard forbids. It fails open, so even under provider failure it never asserts authority
+it can't back.
+
+## 5. Interactions
+
+- **Shadowing:** `_tryNicknameRelocation` runs BEFORE `_sessionRouter.route()` (unchanged ordering) and only
+  when `_sessionPoolStage() !== 'dark'`. When it returns `handled:false` (the common case, and ALWAYS during
+  dry-run), routing proceeds normally — it cannot shadow the router. Verified by `transfer-activation-wiring.test.ts`.
+- **Double-fire:** no. A message is classified once per inbound; a positive hijack returns early (`return`),
+  a pass-through continues to the router exactly once.
+- **Races:** none new. The classifier is stateless; the only write is an append to `logs/move-intent.jsonl`
+  (best-effort, wrapped, never throws into the message path).
+- **Feedback loops:** none. The classifier reads recent history but never writes conversation turns.
+
+## 6. External surfaces
+
+- **Other agents on the machine:** none — internal message-path classifier.
+- **Install base:** dark on the fleet (dev-agent gate + the whole relocation path is already gated behind
+  `sessionPool != dark`, which ships dark). No fleet behavior change.
+- **External systems:** one bounded fast-tier LLM call per nickname-mentioning candidate message, via the
+  shared `IntelligenceProvider` (spawn-cap + circuit-breaker + attribution). No new network dependency.
+- **Persistent state:** `logs/move-intent.jsonl` — a new machine-local append-only observability log
+  (LLM-engaged decisions only; 80-char truncated preview; local, never synced). Consistent with all other
+  `logs/*.jsonl`.
+- **Timing:** `timeoutMs` default 4000 bounds the worst-case pass-through delay for a candidate message.
+- **Operator surface (Mobile-Complete):** No operator-facing actions added. The only operator interaction is
+  flipping `dryRun:false` / `modelTier` in config (already a standard config edit), plus reading the
+  dashboard **LLM Activity** tab (`/metrics/features`, already phone-accessible). N/A.
+
+## 6b. Operator-surface quality
+
+No operator surface — not applicable. This change touches no dashboard renderer, approval page, or
+grant/revoke/secret-drop form (no `dashboard/*` or form files staged).
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+**Posture: machine-local BY DESIGN** — the classifier is stateless request-locality COMPUTE. It runs on the
+machine that holds the topic (the lifeline forwards inbound to the holder), is a pure function of the
+message + the live nickname registry + the provider, and has no durable cross-machine state to replicate.
+The only durable artifact is `logs/move-intent.jsonl`, a machine-local observability log identical in
+posture to `logs/sentinel-events.jsonl` / `logs/reaper-audit.jsonl` (pure per-machine observability).
+
+- **User-facing notices / one-voice gating?** No — during dry-run it emits nothing to the user; when live it
+  produces the same single "Moving…" reply the existing keyword path did (unchanged), routed by the existing
+  single-owner path.
+- **Durable state / strands on topic transfer?** The soak log is per-machine; a topic that transfers mid-soak
+  splits its would-hijack/would-pass evidence across machines. This is graduation-decision EVIDENCE, not user
+  data — at `dryRun:false` graduation the operator aggregates the per-machine logs (or scopes the soak to a
+  non-moving topic). No user data strands.
+- **Generated URLs?** None.
+
+Multi-dev note: the dev-agent gate resolves per-machine, so a multi-dev setup should activate
+pool-consistently (documented in the spec Rollout §4) to avoid divergent behavior across topic-holding machines.
+
+---
+
+## Migration parity
+
+Config default `multiMachine.sessionPool.moveIntent` is added under the existing `sessionPool` block in
+`ConfigDefaults.ts`; `applyDefaults`/`getMigrationDefaults` deep-merges it add-missing onto existing agents
+(the documented sessionPool migration-parity path — verified: the whole config/migration test family, 1191
+tests, stays green). `enabled` is OMITTED so `resolveDevAgentGate` decides (dark fleet / live dev);
+registered in `DEV_GATED_FEATURES` (both-sides wiring test green). No hook/CLAUDE.md-template/skill changes
+(the move-by-nickname capability is dev-only experimental behind the dark session pool, so no
+Agent-Awareness template surface is added).
+
+## Rollback
+
+Pure revert. No schema/data migration to unwind. To disable without reverting: set
+`multiMachine.sessionPool.moveIntent.enabled: false` in config (force-dark even on a dev agent), or leave the
+session pool at `stage: dark` (the default) — either fully inerts the path. `logs/move-intent.jsonl` is
+append-only observability and safe to delete.
+
+## Risk
+
+Low. Ships dark on the fleet AND dry-run-first on dev (logs would-hijack/would-pass, actuates nothing). The
+change strictly REDUCES risk versus the shipped keyword recognizer (fail-open replaces false-positive
+hijack). The residual risk (a confidently-wrong model once `dryRun:false`) is gated by the graduation-gate
+live benchmark + user-role Live-Channel proof + the soak, all required before actuation. tsc clean; lint
+clean; all three test tiers green including the discrimination corpus.
+
+## Post-rebase addendum (2026-07-04)
+
+Rebased onto current `main` (clean). The new LLM component `MoveIntentClassifier` was registered across the
+LLM-coverage ratchets that landed on main (#1366 and the bench family): `src/data/llmBenchCoverage.ts` —
+`LLM_UNTRUSTED_INPUT: true` (it reads untrusted user message + context), `LLM_JUDGES_CLAIMS: false` (it
+classifies a USER's move intent, not an agent/session completion/health/credit claim), `LLM_PARSER_CONTRACT:
+{ pending: 'contract-wave-2' }` (it parses a closed verdict), and `LLM_BENCH_COVERAGE: { exempt }` (it ships
+its own discrimination benchmark). The keyword-intent-decision ratchet's baseline was decremented 6→5 and
+`NicknameCommand.ts` removed from its `EXPECTED_OFFENDERS` (offender #2 converted — exactly what that ratchet
+tracks). The `parseMoveIntentResponse` fail-open catch carries an `@silent-fallback-ok` marker (the
+documented fail-open, surfaced via `result.source`/`reason` + the audit log, never a silent swallow). No
+behavior change from these — they are the coverage/observability registrations a new LLM component requires.