[smart-ssh-coder]

Closes #928

Summary

Replaces the fixed Tier enum with an opaque TierId (TierId::FREE the only core constant, plain-string wire format) and Tier in TS becomes string. Editions register tier labels via registerTier; unknown tiers show their id.

Acceptance Criteria

• No tier list beyond free: met — tierListGuard.test.ts (both tests)
• Extension registers tier + label: met — tiers.test.tsx 'uses the registered label…' and 'the locked dialog shows the registered tier label'
• Unknown tier deserialises/generic label: met — entitlements.rs:test_every_former_tier_value_still_round_trips_and_unknown_is_kept, tiers.test.tsx 'falls back to a generic label…'
• Former values + payload shapes unchanged: met — same Rust test, test_wire_format_is_unchanged, test_feature_locked_carries_the_tier…
• Community unchanged: met — test_free_entitlements_has_free_tier…
• Automated tests pass: core entitlements tests + frontend vitest/lint/tsc run locally; CI is the gate.

Tests

No counter-proof run for the guard beyond it asserting the new shape.

Assumptions

• Registration is frontend-only (labels are presentation); no Wiring field (ADR 0155).
• Tier ids are not pattern-validated, unknown ones kept.
• No changelog fragment: no user-visible change in Community.
• Comments naming other tiers no longer exist in the core (already removed by Entitlements: open feature ids that editions register, no unused feature list in the core #876).

Spec: updated 0037. ADR 0155.
Threat model: no change – tier is display-only; gating still depends on features, fail-closed.

Manual test steps

None.

Follow-ups

None.

🤖 Generated with Claude Code

[smart-ssh-reviewer]

Review

Verdict: approved
Review level: normal

Blocking

None.

Non-blocking

• FeatureLocked's Display still uses {tier:?}, so the fallback message now reads TierId("free") instead of Free (fixture updated). The structured payload is what the UI uses; cosmetic only.

Verified

• counter-proof: not applicable (feature, not a bug fix); the guard and label tests assert the new shape and would fail against the old enum/union (read: tierListGuard.test.ts, tiers.test.tsx)
• edge cases: unknown tier id → kept and shown as id (read + executed); all six former values round-trip (read: entitlements.rs test, CI green); unregistered/free label → id fallback → ok
• callers checked: Tier/.tier in crates and frontend (rg, no remaining users besides the dialog) → ok
• tests run locally: npx vitest run src/extensions/tiers.test.tsx src/tierListGuard.test.ts → 6 passed (executed). Rust tests could not run locally (toolchain install not permitted in the container); covered by CI (Ubuntu/macOS/Windows all green, executed by CI).
• UI: only the locked dialog text changes; vitest covers it, Playwright suite green in CI
• data: wire format unchanged, no migration (read)

Timing analysis

• 3 test files analysed by reading: no timing dependency (synchronous, no waits).

Spec

• visible behaviour changed: tier shown in the feature-locked dialog uses a registered label or the id
• spec searched (entitlement, tier, Stufe, Edition): 0037 §2 updated
• verdict: spec change present and matches the code

Security checks

• Gating remains feature-based and fail-closed; tier is display-only; FilterEngine untouched. THREAT-MODEL.md note present. No loosening.

Follow-ups

None.