fix(kiloclaw): derive upgrade banner rollout subject

[evanjacobson]

Summary

The upgrade banner could evaluate rollout eligibility with a different subject than the actual KiloClaw restart path, so users could see stale or incorrect upgrade availability. This change makes the banner resolve the rollout subject server-side from the authoritative instance row, matching the same legacy-vs-instance-keyed sandbox behavior used by restartMachine({ imageTag: 'latest' }).

It also keeps anonymous/latest-version lookups separate from instance-scoped rollout lookups, so callers cannot spoof Early Access state while existing non-instance consumers still get the public :latest result.

Details

• Centralizes image rollout subject derivation for legacy user-keyed rows and ki_ instance-keyed rows.
• Resolves Early Access and rollout subject together from the instance row on the Worker side.
• Updates personal and org banner paths to pass active instance rows through the instance-scoped lookup.
• Renames the selector boundary to rolloutSubject so the internal API matches the new semantics.
• Adds coverage for anonymous lookups, missing Hyperdrive fallback, server-derived rollout subjects, and DO restart behavior.

Verification

No manual testing performed; this is a backend rollout-selection and internal API-contract change with no visual/manual flow changes.

Visual Changes

N/A

Reviewer Notes

The important review path is consistency between the banner endpoint and restartMachine({ imageTag: 'latest' }): both should bucket by userId for legacy sandbox IDs and by instance UUID for ki_ sandbox IDs. The HTTP query params remain backward-compatible; only the internal selector option was renamed to reflect that it now receives a rollout subject rather than always receiving an instance ID.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The incremental commit (3c6098d0b) is a clean mechanical rename of the instanceId parameter to rolloutSubject in the SelectImageVersionOptions interface and all its call sites — no logic changes, no new issues introduced. All previously flagged issues remain resolved.

Incremental Changes (commit 3c6098d)

Pure rename of SelectImageVersionOptions.instanceId → rolloutSubject across:

• services/kiloclaw/src/lib/version-rollout.ts — interface definition and usage
• services/kiloclaw/src/routes/platform.ts — call site updated to shorthand property
• services/kiloclaw/src/durable-objects/kiloclaw-instance/index.ts — two call sites and parameter name
• services/kiloclaw/src/lib/version-rollout.test.ts — all test call sites
• services/kiloclaw/src/durable-objects/kiloclaw-instance.test.ts — expect.objectContaining assertions
• services/kiloclaw/src/routes/platform-versions-latest.test.ts — toHaveBeenCalledWith assertions

The rename is complete and consistent. The remaining instanceId usages in these files refer to distinct database/DO-key concepts, not the rollout selector parameter.

Previously Flagged Issues — Still Resolved

File	Issue	Status
apps/web/src/routers/kiloclaw-router.test.ts:533	Missing no-instance fallback test (anonymous path calling getLatestVersion())	✅ Fixed in commit 9b52cabad
services/kiloclaw/src/routes/platform-versions-latest.test.ts:116	Missing degraded path (no HYPERDRIVE + instanceId) and anonymous path (no params) tests	✅ Fixed in commit a101f2c81

Files Reviewed (13 files total)

• apps/web/src/lib/kiloclaw/kiloclaw-internal-client.ts
• apps/web/src/routers/kiloclaw-router.ts
• apps/web/src/routers/kiloclaw-router.test.ts
• apps/web/src/routers/organizations/organization-kiloclaw-router.ts
• apps/web/src/routers/organizations/organization-kiloclaw-router.test.ts
• packages/worker-utils/src/instance-id.ts
• packages/worker-utils/src/instance-id.test.ts
• services/kiloclaw/src/lib/user-flags.ts
• services/kiloclaw/src/routes/platform.ts
• services/kiloclaw/src/routes/platform-versions-latest.test.ts
• services/kiloclaw/src/lib/version-rollout.ts
• services/kiloclaw/src/lib/version-rollout.test.ts
• services/kiloclaw/src/durable-objects/kiloclaw-instance/index.ts
• services/kiloclaw/src/durable-objects/kiloclaw-instance.test.ts

---

_{Reviewed by claude-sonnet-4.6 · 316,050 tokens}

_{Review guidance: REVIEW.md from base branch main}