Wake routes: instance-address-aware validation, collapse + read-only audit

Context

The deliverable code-hardening slice of #13481 (Disambiguate Claude wake routes by instance address). This leaf is the prevention + distinction + detection mechanism — shipped and tested. #13481 (parent) retains the live-remediation of existing generic routes and the defaultInstance seed policy (identityRoots domain — pending @neo-gpt), which need a policy decision + live coordination.

Live latest-open sweep: checked latest 20 open issues at 2026-06-19T01:24Z — this is the hardening sub of #13481, no separate duplicate.

Release classification: post-release Agent Harness reliability (boardless; same lineage as #13481).

The Problem (from #13481)

A same-app appName-only wake route collapses onto the wrong instance once multiple named Claude peers run in parallel, and incomplete addressType:userDataDir rows (empty address) pass validation while failing closed at delivery.

The Fix (shipped — commit 858d769d4)

• WakeSubscriptionService.validateHarnessTargetMetadata — resolver-consistent Shape C validation (addressType + instanceAddress / legacy userDataDir), replacing the rigid pairing check.
• queries.collapseDuplicateShapeCRoutes — collapse key now includes the instance-address fields, so distinct instances stay distinct and a generic appName-only route no longer collapses onto an instance-addressed one.
• migrateWakeSubscriptions — read-only auditWakeRoutes() + --audit flag surfacing pre-existing unsafe routes (emptyAddress, genericNamedPeer).

Acceptance Criteria (maps #13481 AC1–AC3 + AC4 new-route portion)

• addressType:userDataDir with no non-empty address fails validation. (#13481 AC1)
• Duplicate collapse preserves two same-app routes when instance addresses differ. (#13481 AC2)
• Existing generic routes for named peers are surfaced by a read-only audit. (#13481 AC3)
• NEW generic-for-named routes are blocked at registration (prevents new fall-through). (#13481 AC4 — new-route portion)
• 88 unit specs green (queries + migrateWakeSubscriptions + WakeSubscriptionService).

Out of Scope (remains in #13481)

• Live remediation of EXISTING generic routes (applying a migration) + any daemon fail-closed on generic-named delivery — needs the policy decision and live coordination (changing Ada's current generic route's delivery is live-impacting).
• The defaultInstance seed policy (identityRoots — @neo-gpt's domain).

Related

• Parent: #13481 (retains AC4 live-remediation + defaultInstance policy).
• #12402 (operator-run L3 two-instance proof).

Origin Session ID

045a6048-1e1d-44c1-9738-7f09b62cc998