ops/decision: canary-enable the self-learning loops on self-host (review memory, self-tune, knob autotunes)

[JSONbored]

Context

Parent: #8757. The audit confirmed the self-improvement machinery is fully built and rigorously guarded (shadow-soak 24h + strictly-tightening-only promotion in src/review/auto-apply.ts:399-448 with re-verification :155-183; held-out Pareto-floor validation in loosening-knobs; review-memory advisory-only by construction) — and ALL of it ships flag-OFF: LOOPOVER_REVIEW_SELFTUNE, LOOPOVER_REVIEW_MEMORY, SATISFACTION_FLOOR_AUTOTUNE_ENABLED, AI_REVIEW_CLOSE_CONFIDENCE_AUTOTUNE_ENABLED, AI_REVIEW_CLOSE_CONFIDENCE_TIGHTEN_ENABLED (wrangler.jsonc:43-45,160,173). The only live loop today is the merge/close precision circuit breaker (auto-tune.ts, always on).

Requirements

• Canary on the self-host deployment first (not live-hosted for customers yet — natural canary surface).
• Order: (1) LOOPOVER_REVIEW_MEMORY (advisory-rendering only, lowest risk); (2) LOOPOVER_REVIEW_SELFTUNE in its shadow-soak observe window; (3) knob autotune flags last, only after the corpus fixes land (see blocked-by) so decisions are not made from the biased block-mode-only sample.
• Define the watch criteria BEFORE enabling: what soak output/metrics get reviewed after one week, and the explicit rollback (flags back to false; overrides table cleared) path.
• Record the decision + observations as issue comments, not just config edits.

Deliverables

• Written canary plan (order, watch window, rollback) as the issue's first comment.
• Phase 1 + 2 enablement with observations.
• Phase 3 go/no-go decision recorded with evidence.

Boundaries

Blocked by the corpus fixes (advisory-mode recording + implicit confirmations): knob decisions from the current biased corpus are exactly the failure the audit warned about. Self-host config changes only — no hosted/wrangler.jsonc flag flips in this issue.

[linear-code]

JSO-6052

[JSONbored]

Resolved — with an important correction to the premise. The audit's "every self-improvement flag ships OFF in production" was true of wrangler.jsonc only (the hosted Worker, which no longer executes reviews post-convergence). The live self-host deployment already ran with LOOPOVER_REVIEW_SELFTUNE=true, SATISFACTION_FLOOR_AUTOTUNE_ENABLED=true, AI_REVIEW_CLOSE_CONFIDENCE_AUTOTUNE_ENABLED=true, and AI_REVIEW_CLOSE_CONFIDENCE_TIGHTEN_ENABLED=true — phases 2 and 3 were effectively already enabled before this issue existed.

Change made (2026-07-26): the one genuinely-off flag, LOOPOVER_REVIEW_MEMORY, is now enabled (.env backup taken per the standard pattern; container recreated; boot healthy, flag confirmed in-container). The @loopover resolve → advisory-suppression loop is live; it is advisory-rendering-only by construction and inert until resolve commands accumulate suppression rows.

Corpus caveat now addressed: the knob autotunes had been running against the block-mode-only biased corpus this issue warned about — #8760 (gateMode-tagged advisory recording) and #8761 (implicit confirmations) merged today, so evidence accumulating from now on is representative. Existing promoted overrides remain valid (tightening-only, so bias could only have made them over-cautious, never unsafe).

Watch criteria (next ~1 week):

• Self-tune tick: the rec list now includes the selftune: fold the REGRESSED-verdict track-record rollup into the self-tune cron tick #8763 track-record line (PR feat(selftune): fold the REGRESSED-verdict track record into the self-tune tick's rec list #8788) — watch for any REGRESSED-rate movement.
• override_audit: any shadow-soak promotion should show ≥10 decided samples and strictly-tightening movement; anything else is a rollback trigger.
• Review memory: suppressions must only ever hit advisory findings (blockers untouched, by construction — verify the first few live suppressions anyway).

Rollback: flip the flag(s) back in .env + docker compose up -d loopover; clear tunables_overrides / review_suppression rows if a bad promotion/suppression is found.