[Dream Cycle 2026-09-15] performance: MoE gate load-balance loss computed but never applied to weights + security,hive-mind scan

## 1. Tonight's Rotation

```
DATE=2026-09-15
DEEP=performance
SCAN=security,hive-mind
SLOT=0
SESSION_COMMIT=2602b642d92234c710ffbe96bfb33007d481ceab
```

## 2. Ledger Check

Inspected the full ledger (110+ backfill rows + all v2 live entries since 2026-08-14). **Trailing 7 nights' PRs all MERGED** (#3086, #3139, #3152, #3160, #3232, #3243, #3266, #3291, #3302 — the entire prior backlog cleared in a batch merge 2026-09-14, reversing the earlier "0 of last 14 merged" signal). Prior gist (2026-09-12, intelligence) scored **9/10** (grade A/B benchmark evidence, 7 competitor rows, 5 specific recommendations, valid witness, genuinely novel finding; lost 1 point for exceeding the 1500-word target). No 3x-repeated duplicate direction found on `performance`; no bias-toward-tiny-patch needed given the high recent merge rate.

## 3. Deep Dive Findings

`v3/@claude-flow/neural/src/moe-router.ts`'s `MoERouter.route()` computes a Switch-Transformer-style load-balance auxiliary loss every call and returns it in `RoutingResult.loadBalanceLoss`, but `updateExpertWeights()` — the sole mutator of the gating network's weights — never read that loss or its coefficient in its REINFORCE gradient math. The regularizer the file's own header claims ("Load balancing with auxiliary loss") had zero actual training effect. Full research (5 parallel roles: deep researcher, 2 scan researchers, competitor analyst, architecture reviewer), competitor comparison, and additional scored candidates: see the gist.

## 4. Hypothesis

> Given `MoERouter.route()` computing `L = NUM_EXPERTS · loadBalanceCoef · Σᵢ(fᵢ·Pᵢ)` and returning it in `RoutingResult`, when `updateExpertWeights()` is changed to compute this loss's analytic gradient (`∂L/∂logit_k = NUM_EXPERTS·coef·P_k·(f_k − Σᵢ fᵢPᵢ)`, using a per-`route()` fraction snapshot) and subtract it from the existing REINFORCE ascent gradient, then a reward=0 update on a skewed routing history should measurably reduce the over-represented expert's future probability — relative to baseline, where reward=0 is a complete no-op — subject to: (1) `loadBalanceCoef=0` stays byte-identical to today's no-op; (2) genuine reward still dominates; (3) existing tests remain green; (4) $0, deterministic, no LLM calls.

Frozen before evaluation; not modified after seeing results.

## 5. Evaluation Receipt

**evaluated: accepted (ACCEPT-scoped).** Vitest 4.1.8, deterministic, $0. New file `v3/@claude-flow/neural/__tests__/moe-router-load-balance.test.ts` (4 tests). Stash-isolated: primary discriminating test fails against real baseline (byte-identical pre/post probability vectors) and passes against candidate; other 3 tests pass both ways (not fix-dependent). Re-run 25+ times with zero flakiness despite `xavierInit()`'s unseeded RNG. Full `@claude-flow/neural` suite: **136/136 passing** (132 pre-existing + 4 new), 0 regressions. `tsc --noEmit`: clean.

## 6. Darwin Results

Skipped — confirmed via `npx ruvector@0.3.0 harness darwin --help`: real interface evolves genome *parameters* against a fitness corpus. This restores an already-decided, already-parameterized mechanism to function; it's not a parameter search. Same skip class as #3110/#3160/#3184/#3221/#3243/#3266/#3302.

## 7. Flywheel Evidence

No `.claude-flow/flywheel/` state or signed bundle exists (confirmed via `npx ruvector harness flywheel --help`). Evidence retained as: 4 new tests, gist, stash-isolated comparison (independently reproduced by the critic), full critique transcript.

## 8. Reward Hack Check

No standalone reward-hack CLI reachable. Manual checklist, independently re-verified by the adversarial critic: no test weakened, no gold data touched, no cherry-picking, no seed manipulation (test specifically designed robust to unseeded `Math.random()`, confirmed via 25+ runs), $0 cost.

## 9. Security Review

Not security-sensitive: pure in-process numeric array arithmetic, no I/O/network/credential surface. Checked NaN/Infinity paths (none possible — fractions bounded [0,1], probs are valid softmax with stability guard) and balance-term-dominates-reward risk (bounded ≤0.08 at default coef=0.01 vs REINFORCE's ≤1 magnitude).

## 10. Scan Findings: security

`http-fetch-tools.ts`'s `validateUrl()` blocks private/loopback hosts by string-matching hostname but never resolves DNS, and `fetch()` keeps default `redirect:'follow'` with validation running once pre-connection — a TOCTOU SSRF bypass (DNS rebinding + unrevalidated redirects) of the tool's own documented "DEFAULT-REFUSES private addresses" contract. `http_fetch` is agent-invokable (ADR-164 §5.1.8), so reachable via normal tool use. Not selected as tonight's candidate (SCAN, lighter-weight); flagged for a future `security` DEEP night.

## 11. Scan Findings: hive-mind

Two previously-flagged gaps re-verified still live: (1) "consensus-strategy-discard" (flagged 09-10) — `hive-mind_init`'s `state.consensusStrategy` never reaches `hive-mind_consensus`'s actual vote-resolution path (grep-confirmed, only init/status refs). (2) `byzantine.ts`'s `handleCommit()` dead-PBFT-path (flagged 08-24) — still only unit-test-reachable, no production transport wiring. Recommend fixing both together in a future `hive-mind` night.

## 12. Competitors Reviewed

LangGraph, Microsoft Agent Framework/AutoGen, CrewAI, OpenAI Agents SDK; Qdrant, Weaviate, Milvus, LanceDB, Vespa; OWASP SSRF Prevention Cheat Sheet pattern.

## 13. Gist

`docs/dream-cycle/dream-gist-2026-09-15.md` (this branch) — full SOTA report, 5-role research, competitor comparison, all scored candidates, adversarial critique summary.

## 14. Witness

| Field | Value |
|---|---|
| Session commit | `2602b642d92234c710ffbe96bfb33007d481ceab` |
| Gist SHA-256 (pre-witness content) | `34faf6710b82b1477af9b6088329dedcff622ad90f22f37728c9083f928a0e21` |
| Witness stamp | `5e719b96e5bb13905960609266cebaf61d5979dc0b7c5f105f953eee30f4599b` |

## 15. Recommendation

Merge the linked draft PR (human review required). Follow-ups: wire a real production caller to `updateExpertWeights()`; fix `UnifiedSwarmCoordinator`'s busy-poll task-completion wait (close second candidate tonight); harden `http_fetch` against SSRF; fix hive-mind consensus-strategy dispatch + byzantine dead-PBFT-path together.

Start with v3/@claude-flow/neural/src/moe-router.ts, reading MoERouter.route() and updateExpertWeights() together to trace the returned loss and weight update. Run v3/@claude-flow/neural/__tests__/moe-router-load-balance.test.ts and the full neural suite. Done means the skewed reward=0 case changes as specified, zero coefficient behavior is preserved, and all 136 tests plus tsc --noEmit pass.

Written by the indexing model from the issue text.