Disambiguate Claude wake routes by instance address

Context

Operator-observed wake routing on 2026-06-18 exposed a same-app Claude routing gap:

• @neo-opus-ada was the first Claude harness and has a generic Claude wake route without a custom data dir.
• When that instance is not running, A2A messages to Ada can land as wakeups inside a different online Claude instance, currently Vega.
• Several later Claude identities are supposed to use distinct userDataDir addressing, but live subscription data shows some addressType:userDataDir rows without a non-empty userDataDir value.

This is not just an operator-run L3 proof issue. It is a route-identity correctness problem in the wake substrate.

Release classification: post-release Agent Harness reliability; high operational priority for same-app multi-instance correctness.

Evidence

V-B-A sweep before filing:

• Open duplicate search found #12402, but #12402 is an operator-run validation ticket for a specific two-instance proof after #12399. It does not own generic-route fallback, incomplete userDataDir metadata, or route-collapse keys.
• Memory Core prior-art search found the design rule from prior Claude onboarding: distinct --user-data-dir per Claude instance is the robust fix for sibling-Claude wake cross-leak.
• Live active wake subscription data showed:
  • @neo-opus-ada on WAKE_SUB:1b7cdb3a... using generic app route Claude.
  • @neo-opus-vega on WAKE_SUB:b19c01e8... with addressType:userDataDir but missing/empty userDataDir metadata.
  • @neo-opus-grace with a populated userDataDir route, plus other sibling routes with failures when the instance is not running.
• Wake-daemon logs show userDataDir-specific routes failing closed when no matching running instance is found, while the generic Ada route can still deliver to any active Claude.app target.
• Source inspection found collapseDuplicateShapeCRoutes() in ai/daemons/wake/queries.mjs deduplicates routes by agentIdentity, trigger, filters, harnessTarget, and routeMetadata.appName, but not by adapter, addressType, instanceAddress, or userDataDir.

The Problem

A generic same-app route is unsafe once multiple named Claude maintainers can run in parallel. In that world, appName:Claude is not a stable identity address. It can mean whichever Claude instance macOS targets, which breaks A2A ownership and can wake the wrong peer.

There are two related correctness gaps:

1. Metadata validation permits or preserves incomplete instance-addressed routes, for example addressType:userDataDir with an empty userDataDir.
2. Route collapse/deduplication ignores instance address fields, so distinct same-app routes can be treated as the same shape.

Both gaps make wake delivery look successful while violating the agent identity boundary.

Architectural Reality

Relevant surfaces:

• ai/services/memory-core/WakeSubscriptionService.mjs owns wake subscription validation and metadata defaulting.
• ai/daemons/wake/daemon.mjs resolves GUI instance targets, including userDataDir, and fails closed when a requested instance is not running.
• ai/daemons/wake/queries.mjs owns wake-daemon route collection and duplicate Shape C collapse.
• ai/graph/identityRoots.mjs seeds identity wake templates and is where static generic routes can outlive the single-Claude era.
• #12402 remains useful as an operator-run validation ticket, but it is not a code hardening owner for the gaps above.

The Fix

Harden same-app wake routing so named Claude peers either target an explicit instance address or fail closed with actionable diagnostics.

Candidate implementation shape:

1. Tighten wake subscription metadata validation: addressType:userDataDir must require a non-empty userDataDir or normalized instanceAddress value.
2. Include adapter, addressType, instanceAddress, and userDataDir in the duplicate-route collapse key where those fields affect the delivery target.
3. Add a diagnostic or migration helper for existing active rows that are unsafe in a multi-Claude environment: generic Claude routes for named peers and empty userDataDir rows.
4. Decide whether legacy generic Claude routes should be allowed only under an explicit defaultInstance marker, or whether named Claude peers must always use instance-addressed routes.
5. Add focused tests that prove same-app sibling routes do not collapse and that incomplete userDataDir metadata fails validation.

Contract Ledger

Acceptance Criteria

• addressType:userDataDir wake metadata with no non-empty address fails validation or is reported as invalid by a diagnostic.
• Duplicate route collapse preserves two same-app routes when their instance address metadata differs.
• Existing generic Claude routes for named peers are surfaced by a diagnostic or migration path so they cannot masquerade as correct same-peer routing.
• A wake targeting one named Claude identity either lands in that addressed instance or fails closed; it must not fall through to a different online Claude instance.
• #12402 remains free to own the operator-run L3 proof, while this ticket owns the code/diagnostic hardening.

Out of Scope

• Proving every current Claude desktop instance works live; that remains operator-run validation where needed.
• Changing A2A mailbox storage semantics.
• General harness fleet management beyond wake route address correctness.

Related

• #12402: post-merge L3 validation for live two-instance Claude sibling wake delivery.
• #12399 / #11822: instance-addressable wake routing prior work.
• #12913: isolated-instance onboarding pattern and same-family sibling wake negative proof.
• #13012: Agent Harness parent epic.

Retrieval Hint: "Claude multi instance wake route Ada generic Claude Vega wrong instance userDataDir empty collapseDuplicateShapeCRoutes"