instar 1.3.772 → 1.3.774

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.772",
+  "version": "1.3.774",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",
@@ -28,9 +28,10 @@
     "test:contract": "node scripts/run-contract-tests.js",
     "test:contract:raw": "vitest run --config vitest.contract.config.ts",
     "test:all": "vitest run && vitest run --config vitest.integration.config.ts && vitest run --config vitest.e2e.config.ts",
-    "lint": "tsc --noEmit && node scripts/lint-no-direct-destructive.js && node scripts/lint-no-direct-llm-http.js && node scripts/lint-no-direct-url-log.js && node scripts/lint-no-unfunneled-topic-creation.js && node scripts/lint-no-unfunneled-headless-launch.js && node scripts/lint-no-unbounded-llm-spawn.js && node scripts/lint-no-unregistered-self-action.js && node scripts/lint-no-unfunneled-credential-write.js && node scripts/lint-state-registry.js && node scripts/lint-store-retention-declared.js && node scripts/lint-no-wholefile-sync-read.js && node scripts/lint-cas-emit-placement.js && node scripts/lint-journal-actuation-ban.js && node scripts/lint-no-blocking-process-scans.js && node scripts/lint-sync-subprocess-chokepoint.js && node scripts/lint-dev-agent-dark-gate.js && node scripts/lint-guard-manifest.js && node scripts/lint-llm-attribution.js && node scripts/lint-no-mainthread-cartographer-walk.js && node scripts/lint-scrape-fixture-realness.js && node scripts/check-codex-rule1-drift.js && node scripts/lint-routing-registry-freshness.js && node scripts/lint-no-opus-claude-cli-gating.js && node scripts/lint-model-registry-freshness.mjs && node scripts/lint-no-unreachable-messaging-gate.js",
+    "lint": "tsc --noEmit && node scripts/lint-no-direct-destructive.js && node scripts/lint-no-direct-llm-http.js && node scripts/lint-no-direct-url-log.js && node scripts/lint-no-unfunneled-topic-creation.js && node scripts/lint-no-unfunneled-headless-launch.js && node scripts/lint-no-unbounded-llm-spawn.js && node scripts/lint-no-unregistered-self-action.js && node scripts/lint-no-unfunneled-credential-write.js && node scripts/lint-state-registry.js && node scripts/lint-store-retention-declared.js && node scripts/lint-no-wholefile-sync-read.js && node scripts/lint-cas-emit-placement.js && node scripts/lint-journal-actuation-ban.js && node scripts/lint-no-blocking-process-scans.js && node scripts/lint-sync-subprocess-chokepoint.js && node scripts/lint-dev-agent-dark-gate.js && node scripts/lint-guard-manifest.js && node scripts/lint-llm-attribution.js && node scripts/lint-no-mainthread-cartographer-walk.js && node scripts/lint-scrape-fixture-realness.js && node scripts/check-codex-rule1-drift.js && node scripts/lint-routing-registry-freshness.js && node scripts/lint-no-opus-claude-cli-gating.js && node scripts/lint-model-registry-freshness.mjs && node scripts/lint-no-unreachable-messaging-gate.js && node scripts/lint-nature-chains.mjs",
     "lint:routing-registry": "node scripts/lint-routing-registry-freshness.js",
     "lint:no-opus-claude-cli-gating": "node scripts/lint-no-opus-claude-cli-gating.js",
+    "lint:nature-chains": "node scripts/lint-nature-chains.mjs",
     "lint:model-freshness": "node scripts/lint-model-registry-freshness.mjs",
     "lint:model-freshness:strict": "INSTAR_MODEL_FRESHNESS_STRICT=1 node scripts/lint-model-registry-freshness.mjs",
     "lint:no-unbounded-llm-spawn": "node scripts/lint-no-unbounded-llm-spawn.js",

package/scripts/lint-nature-chains.mjs

@@ -0,0 +1,203 @@
+#!/usr/bin/env node
+/**
+ * lint-nature-chains.mjs — the FD4 HARNESS-DOOR BAN, enforced at BUILD time.
+ *
+ * Spec: docs/specs/nature-axis-routing.md — FD4 (§188-232, "The harness-door ban"),
+ * FD4.1 (§205, the pinned-concrete-id reserve), FD8 (§393, no-Fable).
+ *
+ * THE INVARIANT (structurally unbreakable, enforced in THREE places — §202):
+ *   No FAST/SORT/JUDGE (bounded/gating) chain position may resolve to a NON-reserve
+ *   model on the `claude-code` harness door. The ONE permitted claude-code position in
+ *   a bounded/gating chain is the single sanctioned reserve — pinned to a CONCRETE model
+ *   id (via ROUTING_LABEL_TO_MODEL_ID['claude-code']), NEVER a bare tier label (a label
+ *   could resolve differently under a future CLI alias/tier remap — the Adv3 class). It is
+ *   a deny-by-default ALLOWLIST, not a denylist: any claude-code id that is not the reserve
+ *   fails, so a future/unrecognized capable Claude id can never slip past. WRITE is exempt —
+ *   open-ended writing is the sole legitimate Opus-via-CLI lane. Additionally (FD8 §393):
+ *   NO chain position (incl. WRITE) may resolve to a Fable model.
+ *
+ * THIS is the compile-time place of the three (§202). The other two are RUNTIME, in
+ * src/core/IntelligenceRouter.ts: the resolve-time/config-load validator
+ * (`validateNatureRoutingChains`) and the per-position allowlist clamp
+ * (`clampToReserveOnCleanDoor` + A1's always-on `clampClaudeCliSwapModel`). The companion
+ * ratchet test (tests/unit/llm-routing-nature-ratchet.test.ts) pins this SAME invariant
+ * over the real imported TS symbols and asserts this lint agrees with the TS validator
+ * (drift guard) — Structure > Willpower.
+ *
+ * This is a build RATCHET: it exits 1 on any violation (the authored v3 defaults are clean,
+ * so it passes today). It reads SOURCE TEXT (the house pattern — lints run pre-compile), and
+ * it hard-codes NOTHING about which id is "right": it derives the reserve id and the label→id
+ * map from src/data/llmBenchCoverage.ts, so swapping the sanctioned reserve is a data edit
+ * there, never a change here.
+ *
+ * Exit codes: 0 — every chain position clean; 1 — at least one ban violation, or a
+ * parse/read error (fail-closed: an unparseable map is a build failure, not a silent pass).
+ *
+ * Usage:
+ *   node scripts/lint-nature-chains.mjs
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const ROOT = path.resolve(__dirname, '..');
+const COVERAGE_SRC = path.join(ROOT, 'src', 'data', 'llmBenchCoverage.ts');
+
+const BOUNDED_GATING_CHAINS = new Set(['FAST', 'SORT', 'JUDGE']);
+const KNOWN_TIER_LABELS = new Set(['fast', 'balanced', 'capable', 'ultra', 'reasoning']);
+
+/** Slice a top-level `export const NAME ...= {` … `\n};` block body from source. */
+function sliceConstBlock(src, name) {
+  const start = src.indexOf(`export const ${name}`);
+  if (start < 0) throw new Error(`${name} not found in ${path.basename(COVERAGE_SRC)}`);
+  const braceOpen = src.indexOf('{', start);
+  if (braceOpen < 0) throw new Error(`${name}: opening brace not found`);
+  const end = src.indexOf('\n};', braceOpen);
+  if (end < 0) throw new Error(`${name}: terminating '\\n};' not found`);
+  return src.slice(braceOpen, end);
+}
+
+/**
+ * Extract ROUTING_LABEL_TO_MODEL_ID as { [door]: { [label]: concreteId } }.
+ * Each door entry is `'door': { 'label': 'id', label2: 'id2' }`.
+ */
+export function extractLabelMap(src) {
+  const body = sliceConstBlock(src, 'ROUTING_LABEL_TO_MODEL_ID');
+  const map = {};
+  const doorRe = /'([^']+)':\s*\{([^}]*)\}/g;
+  let dm;
+  while ((dm = doorRe.exec(body)) !== null) {
+    const door = dm[1];
+    const inner = dm[2];
+    const pairRe = /(?:'([^']+)'|([A-Za-z][\w.\-]*))\s*:\s*'([^']+)'/g;
+    const labels = {};
+    let pm;
+    while ((pm = pairRe.exec(inner)) !== null) {
+      const label = pm[1] || pm[2];
+      labels[label] = pm[3];
+    }
+    map[door] = labels;
+  }
+  if (Object.keys(map).length === 0) throw new Error('ROUTING_LABEL_TO_MODEL_ID parsed empty');
+  return map;
+}
+
+/**
+ * Extract NATURE_ROUTING_DEFAULT_CHAINS as { FAST:[{door,model}], SORT:[...], ... }.
+ * Positions are `{ door: 'x', model: 'y', ...flags }` inside each chain's `[ ... ]`.
+ */
+export function extractChains(src) {
+  const body = sliceConstBlock(src, 'NATURE_ROUTING_DEFAULT_CHAINS');
+  const chains = {};
+  for (const chain of ['FAST', 'SORT', 'JUDGE', 'WRITE']) {
+    const chainRe = new RegExp(`${chain}:\\s*\\[([\\s\\S]*?)\\],`);
+    const m = chainRe.exec(body);
+    if (!m) throw new Error(`chain ${chain} not found in NATURE_ROUTING_DEFAULT_CHAINS`);
+    const posRe = /\{\s*door:\s*'([^']+)'\s*,\s*model:\s*'([^']+)'/g;
+    const positions = [];
+    let pm;
+    while ((pm = posRe.exec(m[1])) !== null) positions.push({ door: pm[1], model: pm[2] });
+    chains[chain] = positions;
+  }
+  return chains;
+}
+
+const isFableModel = (s) => /fable/i.test(s);
+
+/**
+ * The FD4 ban predicate over one authored position — MIRRORS
+ * IntelligenceRouter.validateChainPosition. Returns a violation object or null.
+ */
+export function banViolationForPosition(chain, pos, index, labelMap, reserveId) {
+  const resolvedModelId = labelMap[pos.door]?.[pos.model] ?? pos.model;
+  if (isFableModel(resolvedModelId) || isFableModel(pos.model)) {
+    return {
+      chain,
+      index,
+      door: pos.door,
+      model: pos.model,
+      resolvedModelId,
+      rule: 'fable-banned',
+      detail: `${chain}[${index}] ${pos.door}/'${pos.model}' resolves to a Fable model ('${resolvedModelId}') — no nature chain may emit Fable (FD8 §393).`,
+    };
+  }
+  if (!BOUNDED_GATING_CHAINS.has(chain)) return null; // WRITE exempt
+  if (pos.door !== 'claude-code') return null;
+  if (resolvedModelId === reserveId) return null; // allowlisted — the sanctioned pinned reserve
+  const pinnedInRegistry = labelMap['claude-code']?.[pos.model] !== undefined;
+  if (!pinnedInRegistry && KNOWN_TIER_LABELS.has(pos.model)) {
+    return {
+      chain,
+      index,
+      door: pos.door,
+      model: pos.model,
+      resolvedModelId,
+      rule: 'claude-code-tier-label',
+      detail: `${chain}[${index}] is claude-code/'${pos.model}' — an UNPINNED tier label; the one permitted claude-code position must be the PINNED concrete reserve id '${reserveId}' (FD4 §205).`,
+    };
+  }
+  return {
+    chain,
+    index,
+    door: pos.door,
+    model: pos.model,
+    resolvedModelId,
+    rule: 'claude-code-non-reserve',
+    detail: `${chain}[${index}] resolves claude-code → '${resolvedModelId}', which is NOT the sanctioned reserve '${reserveId}' (deny-by-default allowlist ban, FD4 §202-217).`,
+  };
+}
+
+/** Run the full lint over source text. Returns { violations, reserveId, chains, labelMap }. */
+export function runNatureChainsLint(src) {
+  const labelMap = extractLabelMap(src);
+  const reserveId = labelMap['claude-code']?.balanced;
+  if (!reserveId) throw new Error("ROUTING_LABEL_TO_MODEL_ID['claude-code'].balanced (the reserve id) not found");
+  const chains = extractChains(src);
+  const violations = [];
+  for (const chain of ['FAST', 'SORT', 'JUDGE', 'WRITE']) {
+    chains[chain].forEach((pos, i) => {
+      const v = banViolationForPosition(chain, pos, i, labelMap, reserveId);
+      if (v) violations.push(v);
+    });
+  }
+  return { violations, reserveId, chains, labelMap };
+}
+
+function main() {
+  let src;
+  try {
+    src = fs.readFileSync(COVERAGE_SRC, 'utf8');
+  } catch (err) {
+    console.error(`lint-nature-chains: cannot read ${COVERAGE_SRC} — ${err.message}`);
+    process.exit(1);
+  }
+  let result;
+  try {
+    result = runNatureChainsLint(src);
+  } catch (err) {
+    console.error(`lint-nature-chains: parse error (fail-closed — an unparseable map is a build failure) — ${err.message}`);
+    process.exit(1);
+  }
+  if (result.violations.length === 0) {
+    console.log(
+      `lint-nature-chains: OK — every FAST/SORT/JUDGE claude-code position is the pinned reserve ` +
+        `'${result.reserveId}', and no chain emits Fable (FD4 harness-door ban clean).`,
+    );
+    process.exit(0);
+  }
+  console.error(
+    'lint-nature-chains: FD4 HARNESS-DOOR BAN VIOLATION(S) in NATURE_ROUTING_DEFAULT_CHAINS ' +
+      '(src/data/llmBenchCoverage.ts):\n' +
+      result.violations.map((v) => `  - [${v.rule}] ${v.detail}`).join('\n') +
+      `\n\nThe one permitted claude-code FAST/SORT/JUDGE position is the pinned reserve id ` +
+      `'${result.reserveId}' (author it as the registry-pinned 'balanced' label or the concrete id). ` +
+      `WRITE is exempt for Opus-via-CLI, but NO chain may emit Fable. Spec: docs/specs/nature-axis-routing.md FD4/FD8.`,
+  );
+  process.exit(1);
+}
+
+const isDirectRun = process.argv[1] && path.resolve(process.argv[1]) === __filename;
+if (isDirectRun) main();

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-05T06:15:12.528Z",
-  "instarVersion": "1.3.772",
+  "generatedAt": "2026-07-05T07:42:29.724Z",
+  "instarVersion": "1.3.774",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -1538,7 +1538,7 @@
       "type": "subsystem",
       "domain": "sessions",
       "sourcePath": "src/core/SessionManager.ts",
-      "contentHash": "fa7570cfad6454faed57c41435475136946b7801a6e1d32b01d2b34fcea8b66f",
+      "contentHash": "2f186c89e86c60d54d6c786a66d7370ed926e30a806a5643ceacd4a88211f867",
       "since": "2025-01-01"
     },
     "subsystem:auto-updater": {

package/upgrades/1.3.773.md

@@ -0,0 +1,27 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Completes two of the three enforcement places for the FD4 "harness-door ban" in the (still-dark) nature-axis router (spec: docs/specs/nature-axis-routing.md). The third place — the always-on runtime clamp — already shipped in A1 (#1386) and A2.1 (#1387).
+
+- **Build-time lint** (scripts/lint-nature-chains.mjs, wired into `npm run lint`): fails the build if any FAST/SORT/JUDGE chain position resolves to a non-reserve model on the claude-code harness door, if the one permitted claude-code position is an unpinned tier label instead of the pinned concrete reserve id, or if any chain (including WRITE) resolves to a Fable model. Deny-by-default allowlist; the reserve id and label map are derived from src/data/llmBenchCoverage.ts, so nothing is hard-coded.
+- **Resolve-time + config-load validator** (validateNatureRoutingChains, a pure predicate in src/core/IntelligenceRouter.ts): the same rule run on live config. It rejects a banned chain both when config is loaded (mergeNatureRoutingChains) and when a route is resolved (resolveRoute), falling back to the built-in defaults and warning once — so an operator config edit can never open the banned route.
+
+Dev-gated / dark: both new checks only run when sessions.natureRouting is enabled; when it is unset/off the resolve path is byte-identical to before (asserted in tests). This is enforcement hardening only — NOT the metered-door Increment B, and NOT the go-live flip.
+
+## What to Tell Your User
+
+This is internal safety plumbing for how I pick which model answers my own background checks — there is nothing for you to turn on or change, and nothing about our conversations changes. In plain terms: I added two guards that make it structurally impossible for one of my quick safety checks to be routed to an expensive model in a way that a bench found makes it easier to fool. One guard runs when my code is built; the other runs if the routing feature is ever switched on. The routing feature itself is still off by default, so today this is invisible — it just means that when it does get turned on, the unsafe route is already sealed shut in two more places.
+
+## Summary of New Capabilities
+
+- **FD4 harness-door ban — build-lint**: a new build check refuses any routing chain that would send a bounded safety check to a non-reserve model on the Claude CLI, or emit a Fable model.
+- **FD4 harness-door ban — runtime validator**: a live config/resolve-time guard rejects a banned routing chain and falls back to the safe built-in defaults, so a config edit can never re-open the banned route.
+
+## Evidence
+
+- scripts/lint-nature-chains.mjs runs clean over the real chain map; full `npm run lint` is green.
+- tests/unit/llm-routing-nature-ratchet.test.ts and tests/unit/nature-routing-resolver.test.ts (54 tests) green, covering positive/negative lint cases, config-load and resolve-time rejection, the build-lint/validator drift guard, and byte-identical-when-off with a banned override present.

package/upgrades/1.3.774.md

@@ -0,0 +1,39 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Fixed a retention bug in the idle-zombie veto-backoff (the follow-up to the
+session-respawn-thrash-elimination work). On a standby machine, the pre-check that decides
+"have I already backed off cleaning up this session?" keyed the cooldown on the reap-guard's
+reason, while the record step stored the terminate path's reason (`not-lease-holder`). The two
+never matched, so the ledger entry was deleted and rebuilt every tick and the 30-minute cooldown
+never held — the cleanup re-fired every 5 seconds (2,523 consecutive warnings observed live). The
+pre-check now mirrors the terminate path's skip-reason precedence (`protected` → lease gate →
+reap-guard), so both halves key on the same reason and the cooldown actually holds.
+
+## What to Tell Your User
+
+Nothing user-facing. This is an internal reliability fix — it stops a wasteful background loop on
+multi-machine setups. No behavior a user interacts with changes.
+
+## Summary of New Capabilities
+
+None — this is a correctness fix to existing behavior (the idle-zombie veto-backoff introduced in
+`session-respawn-thrash-elimination`). It ships behind the same `monitoring.idleKillVetoBackoff`
+config knob and is a strict no-op on a single-machine agent.
+
+## Evidence
+
+- Root cause confirmed against source (`SessionManager.computeIdleZombieReapVerdict` keyed on the
+  reap-guard reason; `terminateSessionInternal` stores `not-lease-holder` on standby) and proven by
+  a live 5-second-cadence WARN flood (2,523 lines).
+- 3 new Tier-1 tests in `tests/unit/session-manager-idle-veto-backoff.test.ts`: a load-bearing
+  standby-spin repro (fails on the buggy code, passes on the fix — cooldown holds, one terminate
+  attempt across 12 ticks), an equivalence PROPERTY test using the REAL `terminateSessionInternal`
+  as the oracle (the structural guard against future drift), and an `isAwakeMachine`-unset guard.
+- Full suite: 18/18 in the veto-backoff file, 31/31 across the reaper/veto family, `tsc --noEmit`
+  clean. Review-converged (5 internal reviewers + a codex GPT-5.5 external pass) — see
+  `docs/specs/reports/idle-zombie-veto-key-consistency-convergence.md`.

package/upgrades/side-effects/idle-zombie-veto-key-consistency.md

@@ -0,0 +1,67 @@
+# Side-Effects Review — Idle-Zombie Veto-Backoff Key Consistency
+
+Spec: `docs/specs/idle-zombie-veto-key-consistency.md` (converged, approved)
+Change: `src/core/SessionManager.ts` — `computeIdleZombieReapVerdict` now mirrors
+`terminateSessionInternal`'s skip-reason precedence (`protected` → lease-gate `not-lease-holder`
+→ reapGuard) so the veto-backoff pre-check keys the cooldown on the SAME reason `recordVeto`
+stores. Plus 3 Tier-1 tests in `tests/unit/session-manager-idle-veto-backoff.test.ts` (a
+load-bearing standby-spin repro, a real-`terminateSessionInternal`-as-oracle equivalence property
+test, and an `isAwakeMachine`-unset guard test).
+
+**Decision point?** Yes — this touches the idle-zombie kill-eligibility DECISION path. It is a
+SIGNAL fix: it corrects which reason KEY the veto-backoff ledger uses; it does NOT change the kill
+AUTHORITY (that stays entirely in `terminateSessionInternal`, which independently re-applies the
+lease gate). The pre-check only decides "have I already backed off?" — never "may I kill?".
+
+1. **Over-block** — Does it reject a legitimate kill it shouldn't? No. On the awake machine the
+   standby branch is skipped (`!this.isAwakeMachine()` is false) and behavior is byte-identical to
+   today; a session with no keep-reason is still killed on the first attempt (existing test 2 still
+   green). The fix only makes a STANDBY machine's cooldown actually HOLD — it was already declining
+   to kill (a standby never reaps another machine's sessions); the fix stops the wasteful re-attempt
+   spin, not a legitimate kill.
+
+2. **Under-block** — Failure modes it still misses? The residual transient reasons `in-flight` and
+   `already-<status>` are deliberately NOT mirrored (they are non-recurring by construction — a
+   one-tick mismatch re-evaluates once, never a sustained spin; both are absent from
+   `IDLE_ZOMBIE_ESCALATION_REASONS`, so no false P19 escalation). The `in-flight`-flap bound is
+   asserted by a Tier-1 test. A future terminate skip-reason added BEFORE the lease gate is caught
+   by the equivalence property test's classification-completeness assertion (it forces a
+   mirrored-or-residual decision rather than silently going green).
+
+3. **Level-of-abstraction fit** — Right layer? Yes. The fix lives in the pre-check that already owns
+   the reason-key derivation. A "single source of truth" shared helper (extract
+   `computeAutonomousSkipReason` and have both paths call it) was considered in convergence and
+   rejected as an unclean pure extraction — `terminateSessionInternal`'s skip logic interleaves with
+   `origin` bypass, a five-flag bypass set, `knownDead`, CAS `already-*`, and the live
+   `this.terminating` Set — a wide refactor of the most safety-critical method for a cooldown-key
+   fix. The equivalence property test gives the shared-helper's drift-guarantee without the blast
+   radius.
+
+4. **Signal vs authority** — Compliant. The change produces/uses a SIGNAL (the cooldown key); the
+   blocking AUTHORITY (kill vs skip) remains in `terminateSessionInternal`, unchanged and
+   independently re-evaluated. `blocked` stays the raw reapGuard verdict; only `reasonKey` is
+   overridden, preserving the C2/R4-2 single-guard-eval threading.
+
+5. **Interactions** — Does it shadow/double-fire/race? No new race (the monitor tick is
+   single-threaded; the fix adds a synchronous branch before the existing await point). It does NOT
+   change the age-gate `VetoedKillBackoff` instance (that keys via its own 2-arg callsites). The
+   escalation gate keys on `vetoKey` (= the stored terminate reason), same source as `recordVeto` —
+   no divergence introduced.
+
+6. **External surfaces** — None. No API route, no config schema change, no dashboard surface, no
+   agent-facing message. The only observable behavior change is FEWER log lines / terminate attempts
+   on a standby machine (the spin stops).
+
+7. **Multi-machine posture (Cross-Machine Coherence)** — `machine-local BY DESIGN`
+   (`machine-local-justification: hardware-bound-resource`). The `VetoedKillBackoff` ledger is a
+   per-process in-memory Map guarding THIS machine's own tmux/session inventory (hardware-bound); no
+   replication, no proxied read, no cross-machine surface. On a single-machine agent
+   `isAwakeMachine()` returns awake → the standby branch is skipped → strict no-op.
+
+8. **Rollback cost** — Trivial. Revert the one method (three-branch → one-line). No data migration,
+   no state repair. The parent config knob `monitoring.idleKillVetoBackoff.enabled` still gates the
+   whole ledger; when disabled the corrected key is never consulted. No hot-fix coupling.
+
+**Migration Parity:** N/A — pure runtime code fix to one private method; changes no installed file
+(no `.claude/settings.json`, config default, CLAUDE.md template, hook, or skill). Existing agents
+receive it via the normal version bump.

package/upgrades/side-effects/nature-axis-routing-fd4-lints.md

@@ -0,0 +1,75 @@
+# Side-Effects Review — FD4 harness-door ban: enforcement lints (build-lint + resolve-time/config-load validator)
+
+**Version / slug:** `nature-axis-routing-fd4-lints`
+**Date:** `2026-07-04`
+**Author:** `echo (build hand, 24h autonomous run, topic 29723)`
+**Second-pass reviewer:** `not required (Tier 1 — deterministic, dark/dev-gated, byte-identical when off)`
+
+## Summary of the change
+
+Completes the FD4 "harness-door ban" from `docs/specs/nature-axis-routing.md` by adding the two enforcement places that were still prose (the third place — the always-on runtime clamp — already shipped in A1 #1386 / A2.1 #1387). Files touched: `src/core/IntelligenceRouter.ts` (pure validator predicate `validateNatureRoutingChains`/`validateChainPosition`/`isNatureRoutingChainsValid` + wiring into `mergeNatureRoutingChains` config-load and `resolveRoute` resolve-time + a deduped rejection warning), `scripts/lint-nature-chains.mjs` (new build-lint), `package.json` (wire the lint into `npm run lint` + a `lint:nature-chains` alias), and two unit test files (`tests/unit/llm-routing-nature-ratchet.test.ts`, `tests/unit/nature-routing-resolver.test.ts`). The change interacts with the nature-axis routing decision surface only; it adds NO new routing behavior when the feature is off.
+
+## Decision-point inventory
+
+- `FD4 harness-door ban (compile-time place)` — add — the build-lint `lint-nature-chains.mjs` fails the build on a banned authored chain position.
+- `FD4.3 resolve-time / config-load validator` — add — the pure predicate that rejects a banned live chain → built-in defaults + warn-once, consulted in `resolveRoute` and `mergeNatureRoutingChains`.
+- `FD4 place-3 runtime clamp (clampToReserveOnCleanDoor / clampClaudeCliSwapModel)` — pass-through — unchanged; the new validator is belt-and-suspenders ahead of it.
+- `sessions.natureRouting enable/dryRun gate` — pass-through — the whole nature block (and therefore the new validator) still runs ONLY when enabled.
+
+## 1. Over-block
+
+**What legitimate inputs does this change reject that it shouldn't?**
+
+The build-lint could in principle reject a legitimate authored chain. It does not: the registry-pinned `balanced` label on claude-code (which resolves to the concrete reserve id) is accepted in FAST/SORT/JUDGE, the literal concrete reserve id is accepted, WRITE's `capable`/`fast` (Opus/Haiku) are accepted, and clean non-claude-code doors (incl. the openrouter Opus API door) are accepted. Verified: the real authored v3 defaults pass with zero violations (positive ratchet test). The runtime validator only rejects a chain that violates the static ban, and it falls back to the built-in defaults rather than failing the call, so a rejected operator override degrades to the safe default, never to a hard denial.
+
+## 2. Under-block
+
+**What failure modes does this still miss?**
+
+The lint's model-id resolution is scoped to `ROUTING_LABEL_TO_MODEL_ID` + a literal Fable substring scan — it does not follow a claude-code *tier label* through the downstream per-adapter tier map (e.g. `frameworkDefaultModels.claude-code`). That is deliberate: the claude-code FAST/SORT/JUDGE allowlist forces the pinned reserve id regardless, and WRITE tier resolution is the FD8 companion config concern (a tracked, restart-gated remainder), not this slice. The FD4.2 R-rule lints (R3–R8: doc-tree Claude-ban, Flash-Lite pin, injection-exposed JUDGE bans) are NOT built here — they depend on an injection-exposure map that does not yet exist; tracked as a remainder.
+
+## 3. Level-of-abstraction fit
+
+The validator is a pure, side-effect-free predicate over the static chain data (mirrors `validateChainPosition`), placed beside the existing FD4 functions in `IntelligenceRouter.ts`. The build-lint follows the house pattern (`lint-routing-registry-freshness.js` / `lint-no-opus-claude-cli-gating.js`): read source text pre-compile, export a pure function, exit 1 on violation. Correct altitude — no new engine, no new config language.
+
+## 4. Signal vs authority compliance
+
+The build-lint is a CI gate (a build ratchet — its natural authority is to fail the build on a real violation; the authored defaults are clean so it passes today). The resolve-time/config-load validator does exercise authority — it REJECTS a banned chain → built-in defaults — but this is a safety clamp on a MODEL-ROUTING decision, not a principal/operator authority decision: it never blocks a user message, never grants or credits anyone, and only ever narrows toward the sanctioned-safe default (the same safe direction as the existing runtime clamp). It emits a deduped warn-once so the rejection is never silent. No principal identity is read or asserted anywhere.
+
+## 5. Interactions
+
+Interacts with `resolveRoute` (adds a validation step before the availability walk) and `mergeNatureRoutingChains` (rejects a banned override chain at load). Both run only under `natureRouting.enabled`. Existing resolver tests (which pass valid default chains / valid overrides) are unaffected — validation returns empty and the positions are unchanged. The place-3 clamp still runs downstream; the two layers coexist as designed (three-place enforcement). The A1 `clampClaudeCliSwapModel` degrade-path clamp is untouched (its byte-identical-when-off behavior is preserved).
+
+## 6. External surfaces
+
+No external surface. No new HTTP route, no CLI command, no MCP tool, no Telegram/Slack path, no network egress. The build-lint reads a local source file; the validator reads in-memory config already loaded by the router.
+
+## 6b. Operator-surface quality (Operator-Surface Quality standard)
+
+No operator-facing surface added or changed. The warn-once rejection message names the offending chain + the human-readable violation detail (which position, which rule, the sanctioned reserve id) so an operator who mis-edits a chain via `PATCH /config` sees exactly why it was rejected. No raw secrets, tokens, or file paths are emitted.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+No cross-machine state. The validator is a pure function over per-call config; the build-lint is a repo build gate. The chain config is read live per call on each machine independently (existing `resolveConfig()` behavior). No replication, no shared ledger, no lease interaction. A per-machine operator override that is banned is rejected identically and independently on each machine.
+
+## 8. Rollback cost
+
+Low and clean. Revert the PR: the build-lint line drops out of `npm run lint`, the validator functions are removed, and `resolveRoute`/`mergeNatureRoutingChains` return to passing chains through unvalidated (the place-3 runtime clamp still guarantees safety). No migration, no persisted state, no config schema change, no data-format change. Because the validator only runs when `natureRouting.enabled`, a rollback is invisible to every fleet agent (feature dark).
+
+## Conclusion
+
+A deterministic, dark/dev-gated, byte-identical-when-off hardening slice that closes two of the three FD4 enforcement places. No block/allow surface on user traffic, no external surface, no multi-machine state, trivial rollback. Tier 1.
+
+## Second-pass review (if required)
+
+Not required — Tier 1 (deterministic enforcement lints; byte-identical when off; no operator/user-facing surface). Full `npm run lint` green and both affected test files green (54 tests) at authoring time.
+
+## Evidence pointers
+
+- `scripts/lint-nature-chains.mjs` runs clean over the real chain map (`lint-nature-chains: OK`).
+- `tests/unit/llm-routing-nature-ratchet.test.ts` — positive (real chains pass) + negative (Opus / tier-label / Fable fail) + drift guard (lint predicate agrees with the TS validator).
+- `tests/unit/nature-routing-resolver.test.ts` — validator both-sides, config-load rejection, resolve-time rejection, and byte-identical-when-off with a banned override present.
+
+## Class-Closure Declaration (display-only mirror)
+
+This closes the compile-time + resolve-time/config-load places of the FD4 ban as a class over the whole chain map (all four chains, every position), not a single spot fix. Tracked remainders (out of this slice by design): the FD4.2 R-rule lints (need the injection-exposure map), the full FD6 aggregated attention-item on rejection (warn-once here), and the FD8 `frameworkDefaultModels` companion config change (restart-gated).