instar 1.3.392 → 1.3.393

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.392",
+  "version": "1.3.393",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-07T04:29:47.456Z",
-  "instarVersion": "1.3.392",
+  "generatedAt": "2026-06-07T05:09:34.741Z",
+  "instarVersion": "1.3.393",
   "entryCount": 199,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "7569713fc8f4f6a3bb9400bc1b5907d6de329c338ab9309ade25bca9b72a2363",
+      "contentHash": "bce83fb8dba34c44b81c7004721ee69b1435b30480193636055cde9be625a7a3",
       "since": "2025-01-01"
     },
     "cli:init": {
@@ -1506,7 +1506,7 @@
       "type": "subsystem",
       "domain": "server",
       "sourcePath": "src/server/AgentServer.ts",
-      "contentHash": "c01cfb05a7caab04511cfc2bf92247879981a848e0e49724f164e543f0b9189b",
+      "contentHash": "8aa0f3b0aea74733e61654b60be82b404954da5c41c53ccb0d411afb82fcdfc6",
       "since": "2025-01-01"
     },
     "subsystem:session-manager": {

package/upgrades/1.3.393.md

@@ -0,0 +1,53 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: minor -->
+
+## What Changed
+
+Added `SubscriptionPool` — a new file-backed registry that records an operator's
+subscription accounts, the first building block of the Subscription & Auth
+Standard (multi-account quota-aware load balancing). Each account entry carries a
+nickname, its provider and framework, a lifecycle status, and — by design — only
+the LOCATION of its login (its config home, e.g. the per-account
+`CLAUDE_CONFIG_DIR`), never any tokens. A structural guard rejects any attempt to
+store a credential-bearing field, so "store the location, not the secret" is
+enforced in code rather than by convention.
+
+A CRUD API was added behind the new `/subscription-pool` route family
+(GET / POST / PATCH / DELETE), wired through the server, AgentServer, and route
+context. The registry is file-backed (atomic write, per-record version counter),
+mirroring the existing CommitmentTracker durable-registry pattern.
+
+This ships DARK and ADDITIVE: an empty pool is a pure no-op, so single-account
+agents are unaffected. The route is deliberately classified agent-internal for
+now (it does not appear in the capabilities self-discovery surface and is not yet
+mentioned in the agent template), because a bare registry with no enrollment
+wizard or quota-aware scheduler is not a finished capability to advertise. It
+graduates to a surfaced capability when those later phases land.
+
+Coverage: 27 tests across all three tiers — unit (both sides of every validation
+boundary, the credential-rejection guard, corruption resilience), integration
+(full CRUD over real HTTP), and an e2e feature-alive check (the route answers 200
+in the dark state and supports live enroll / read-back / persisted-to-disk).
+
+## What to Tell Your User
+
+I've started building the system that lets me manage several of your
+subscriptions at once. The first piece just remembers each account by a friendly
+nickname and where it logs in — never its passwords or tokens, which stay where
+your real login tool keeps them. Nothing changes for you yet: it's switched off
+until the later pieces (logging in from your phone, and automatically switching
+accounts before one hits its limit) are ready. When you ask me to set that up, I
+can walk you through it then.
+
+## Summary of New Capabilities
+
+- **Subscription account registry** — records each subscription account (nickname,
+  provider, framework, login location, status). Stores the login location only,
+  never credentials; a structural guard rejects credential-bearing fields.
+- **Account management API** — list, add, rename/re-status, and remove accounts
+  via the new `/subscription-pool` routes (operator/internal for now).
+- **Dark + additive** — an empty pool is a no-op; existing single-account agents
+  are unaffected, and the capability stays agent-invisible until the enrollment
+  wizard and quota-aware scheduler make it user-usable.

package/upgrades/side-effects/subscription-pool-registry.md

@@ -0,0 +1,43 @@
+# Side-Effects Review — SubscriptionPool Registry (P1.1)
+
+## Scope of change
+
+New self-contained registry + CRUD routes + wiring. Files:
+- `src/core/SubscriptionPool.ts` (new) — the registry class + types.
+- `src/server/routes.ts` — 5 new `/subscription-pool` routes + RouteContext field.
+- `src/server/AgentServer.ts` — threads `subscriptionPool` option → RouteContext.
+- `src/commands/server.ts` — instantiates the pool, passes it to AgentServer.
+- `src/server/CapabilityIndex.ts` — classifies the prefix as INTERNAL.
+- tests (unit/integration/e2e).
+
+## Mutability / authority analysis
+
+- **No new authority.** The registry is passive metadata. It does not gate, block, spawn, kill, message, or call any external service. It cannot influence routing, session lifecycle, or any existing behavior. Nothing reads the pool yet (the scheduler that will is P1.3).
+- **Filesystem writes** are confined to a single file, `<stateDir>/subscription-pool.json`, via atomic tmp+rename. No deletes of anything pre-existing; no writes outside the agent state dir.
+- **No network calls.** P1.1 does not poll the quota endpoint or contact any provider. (That is P1.2.)
+- **No process/session effects.** Does not touch tmux, sessions, the reaper, or spawning.
+
+## Credential-handling threat model (the load-bearing concern)
+
+- The registry **must never store tokens.** Enforced structurally: `add()` and `update()` scan input (including the raw request body) for credential-bearing field names (accessToken/refreshToken/token/apiKey/secret/password/oauth/credential[s]) and throw `ValidationError` → HTTP 400. Verified from both sides by unit + integration tests.
+- Only the login **location** (config home path) is persisted. A leaked `subscription-pool.json` therefore leaks nicknames + config-home paths, never a usable credential.
+- This aligns with Anthropic's enforced ToS position (Claude OAuth tokens may only be used by the official Claude Code client): instar will drive each account through its real client pointed at the config home — it never extracts a token. The registry storing only the location keeps that invariant structural.
+
+## Failure modes considered
+
+- **Corrupt store file** → `load()` starts fresh (no credentials are lost because none are stored). Covered by a test.
+- **Concurrent writes** → per-record `version` counter supports optimistic CAS for the later scheduler; P1.1 is single-writer (server process) so no contention today.
+- **Persist failure** (disk full / EPERM) → `@silent-fallback-ok`: in-memory store remains authoritative, next write retries. Matches the CommitmentTracker pattern.
+- **Unknown/duplicate/empty inputs** → rejected with 400 + a specific message; covered both sides.
+
+## Blast radius if this is wrong
+
+Minimal. Dark + additive + agent-invisible + no authority. Worst realistic case: a malformed account row in one JSON file, which the operator can delete; no live behavior depends on the pool until later phases wire a consumer.
+
+## Migration / parity
+
+None required. No config defaults, hooks, skills, or CLAUDE.md template changes. The route ships via dist on update. The capability is deliberately not surfaced to agents yet (graduates with P1.3/P2.1).
+
+## Tier rationale
+
+Declared Tier 1 despite the structural risk-floor signal (new route + new exported class). The signals are present but the *actual* risk is low: ships dark, adds no authority, mutates no existing behavior, single confined state file, full three-tier test coverage, and the design was reviewed + decided by the operator (topic 20905) before build. The below-floor declaration is recorded for audit per the gate's design (the mind holds authority).