fix(kiloclaw): derive upgrade banner rollout subject

[evanjacobson]

Summary

The upgrade banner could evaluate rollout eligibility with a different subject than the actual KiloClaw restart path, so users could see stale or incorrect upgrade availability. This change makes the banner resolve the rollout subject server-side from the authoritative instance row, matching the same legacy-vs-instance-keyed sandbox behavior used by restartMachine({ imageTag: 'latest' }).

It also keeps anonymous/latest-version lookups separate from instance-scoped rollout lookups, so callers cannot spoof Early Access state while existing non-instance consumers still get the public :latest result.

Details

• Centralizes image rollout subject derivation for legacy user-keyed rows and ki_ instance-keyed rows.
• Resolves Early Access and rollout subject together from the instance row on the Worker side.
• Updates personal and org banner paths to pass active instance rows through the instance-scoped lookup.
• Renames the selector boundary to rolloutSubject so the internal API matches the new semantics.
• Adds coverage for anonymous lookups, missing Hyperdrive fallback, server-derived rollout subjects, and DO restart behavior.

Verification

No manual testing performed; this is a backend rollout-selection and internal API-contract change with no visual/manual flow changes.

Visual Changes

N/A

Reviewer Notes

The important review path is consistency between the banner endpoint and restartMachine({ imageTag: 'latest' }): both should bucket by userId for legacy sandbox IDs and by instance UUID for ki_ sandbox IDs. The HTTP query params remain backward-compatible; only the internal selector option was renamed to reflect that it now receives a rollout subject rather than always receiving an instance ID.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

All previously-flagged issues are resolved; the final commit removes the dead _instanceId parameter from applyPinnedVersion and cleans up the call site in platform.ts.

Resolved Issues (all fixed)

File	Issue	Status
services/kiloclaw/src/durable-objects/kiloclaw-instance/index.ts	applyPinnedVersion(null, instanceId) always using the wrong rollout subject (instanceId rather than sandbox-derived subject for legacy instances)	✅ Fixed in commit 33134ff95
services/kiloclaw/src/durable-objects/kiloclaw-instance/index.ts	Dead _instanceId parameter masked with _ instead of removed; call site in platform.ts:4624 also passing it redundantly	✅ Fixed in commit 37213e530
apps/web/src/routers/kiloclaw-router.test.ts:533	Missing no-instance fallback test	✅ Fixed in commit 9b52cabad
services/kiloclaw/src/routes/platform-versions-latest.test.ts:116	Missing degraded path and anonymous path tests	✅ Fixed in commit a101f2c81

Files Reviewed (15 files total)

• apps/web/src/lib/kiloclaw/kiloclaw-internal-client.ts
• apps/web/src/routers/kiloclaw-router.ts
• apps/web/src/routers/kiloclaw-router.test.ts
• apps/web/src/routers/organizations/organization-kiloclaw-router.ts
• apps/web/src/routers/organizations/organization-kiloclaw-router.test.ts
• packages/worker-utils/src/instance-id.ts
• packages/worker-utils/src/instance-id.test.ts
• services/kiloclaw/src/lib/user-flags.ts
• services/kiloclaw/src/routes/platform.ts
• services/kiloclaw/src/routes/platform-versions-latest.test.ts
• services/kiloclaw/src/lib/version-rollout.ts
• services/kiloclaw/src/lib/version-rollout.test.ts
• services/kiloclaw/src/durable-objects/kiloclaw-instance/index.ts
• services/kiloclaw/src/durable-objects/kiloclaw-instance.test.ts

---

_{Reviewed by claude-sonnet-4.6 · 173,592 tokens}

_{Review guidance: REVIEW.md from base branch main}

[pandemicsyn]

Found one must-fix issue in the pin-clear rollout subject path.