instar 1.3.414 → 1.3.415

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.414",
+  "version": "1.3.415",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-07T22:18:32.589Z",
-  "instarVersion": "1.3.414",
+  "generatedAt": "2026-06-07T22:53:21.489Z",
+  "instarVersion": "1.3.415",
   "entryCount": 199,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "0f4f281893adb0a91ef6033338c8ed90d06df98703aa151902311747aca56624",
+      "contentHash": "2bf82e93f63457aac6d519878ce016271a27af12cda01791d632fd594ff73092",
       "since": "2025-01-01"
     },
     "cli:init": {

package/upgrades/1.3.415.md

@@ -0,0 +1,32 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Each subscription account now carries an optional `email`, alongside its nickname,
+so same-org accounts are distinguishable (e.g. "SageMind - Justin" vs
+"SageMind - Adriana"). The email is **auto-populated from the account's own login
+record** (`oauthAccount.emailAddress` in its config home) on each quota poll — so
+the stored email always reflects which account actually authenticated, and a login
+into the wrong account surfaces instead of hiding. Added: `email` on
+`SubscriptionAccount` / add / update (additive-optional), a `readAccountEmail`
+helper + poll-time auto-fill in `QuotaPoller`, pass-through on the POST/PATCH
+`/subscription-pool` routes, and the email rendered under the nickname on the
+dashboard Subscriptions tab. The email is a public identifier — never a token.
+
+## What to Tell Your User
+
+Your subscription accounts now show their email next to the nickname, so when you
+have several on the same org you can tell them apart at a glance. I fill the email
+in automatically from the real login, so it always matches the account that
+actually signed in.
+
+## Summary of New Capabilities
+
+- **Account email** — each pool account stores its email (the disambiguator across
+  same-org accounts), shown on the dashboard.
+- **Auto-filled from reality** — the email comes from the account's own login
+  record on each poll, so it reflects the truly-authenticated account (catches a
+  wrong-account login rather than hiding it).

package/upgrades/side-effects/subscription-account-email.md

@@ -0,0 +1,58 @@
+# Side-Effects Review — per-account email on the Subscription Pool
+
+## Scope of change
+
+- `src/core/SubscriptionPool.ts` — add optional `email` to `SubscriptionAccount`,
+  `AddAccountInput`, `UpdateAccountInput`; `add()`/`update()` store/patch it.
+- `src/core/QuotaPoller.ts` — new exported `readAccountEmail(configHome)` (reads the
+  PUBLIC `oauthAccount.emailAddress` from the config home's `.claude.json`); `pollAll()`
+  auto-populates `account.email` from it on each poll.
+- `src/server/routes.ts` — POST/PATCH `/subscription-pool` pass `email` through.
+- `dashboard/subscriptions.js` + `dashboard/index.html` — render the email under the
+  account nickname. Tests (unit + render assertion).
+
+## Why
+
+Operator requirement (Justin, topic 20905): accounts must be identified by nickname
+AND email — e.g. "SageMind - Justin" vs "SageMind - Adriana" vs "SageMind - Dawn"
+are the same org, so the email is the disambiguator. The pool previously stored only
+nickname + login location.
+
+## The safety property (load-bearing)
+
+The email is **auto-populated from the account's own login record** (`oauthAccount.
+emailAddress` in the config home), not just operator-typed. So the stored email
+always reflects WHICH account actually authenticated under that config home — a
+login into the wrong account *surfaces* (the email won't match the nickname's intent)
+instead of hiding. This directly serves the operator's stated worry about mislabeling
+accounts. The email is a PUBLIC identifier — never a token/secret.
+
+## What does NOT change
+
+- Additive-optional everywhere: `email` is optional; existing accounts and existing
+  add/update calls (no email) behave exactly as before (`email` stays undefined).
+- No new route, no new authority, no behavior change to selection/swap/poll beyond
+  writing one extra public field. The credential-field guard is unaffected (`email`
+  is not a forbidden field name).
+
+## Framework generality
+
+`readAccountEmail` reads claude-code's `oauthAccount.emailAddress` (the Claude config
+layout), matching the standard's Claude-first scope. The `email` field itself is
+framework-agnostic (any provider's account can carry one); only the auto-populate
+reader is claude-code-specific today. A non-claude account simply gets no auto-filled
+email (operators can still set one via the route) — no behavior regression, and the
+reader extends per-framework when those logins are wired.
+
+## Failure modes considered
+
+- Config home has no `.claude.json` / no `oauthAccount` → `readAccountEmail` returns
+  null → poll leaves `email` unchanged (no throw).
+- Operator passes `email` at add time → stored as-is; a later poll overwrites it with
+  the real logged-in email (reality wins — the safety property).
+- `update({ email: '' })` clears the email (explicit unset).
+
+## Migration / parity
+
+Additive-optional field on an existing store — no migration needed (old records load
+with `email` undefined; the next poll fills it). Ships via dist.