instar 1.3.537 → 1.3.538

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.537",
+  "version": "1.3.538",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-13T20:04:42.567Z",
-  "instarVersion": "1.3.537",
+  "generatedAt": "2026-06-13T20:08:21.445Z",
+  "instarVersion": "1.3.538",
   "entryCount": 201,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "f74833db7b0f1aa8bb9af7e23a789462915024158adbadaceb1c06e891b447dd",
       "since": "2025-01-01"
     },
     "cli:init": {
@@ -1530,7 +1530,7 @@
       "type": "subsystem",
       "domain": "sessions",
       "sourcePath": "src/core/SessionManager.ts",
-      "contentHash": "49e13cb91286150019351a47f1200d0c086c2c2bba27e29023d3a5253024191f",
+      "contentHash": "c505368755a51f57c461447eae1b32da1815444b25060d985ab2381779bd6311",
       "since": "2025-01-01"
     },
     "subsystem:auto-updater": {

package/upgrades/1.3.538.md

@@ -0,0 +1,51 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: minor -->
+
+## What Changed
+
+A new dev-gated monitoring capability — **Build-Session Yield Safety** (ACT-839) — closes the "a background build died standing-by-for-tests with its work uncommitted" gap. R1: a session reaped while its worktree holds real uncommitted work is now resume-eligible on that alone — the killer (`SessionReaper`) runs a bounded, cached, fail-open `worktreeDirtyCheck` on the session's worktree PRE-kill (never a synchronous git call on the terminate chokepoint) and tags a new `uncommitted-worktree-work` STRONG `WorkEvidence` value. R2 (Close-the-Loop, signal not block): the revived session's continuation prompt leads with a verbatim commit-first directive, and `ResumeQueueDrainer` fires `onWorktreeRevival`, which registers a deduped, beacon-enabled `CommitmentTracker` obligation so a *stalled* revived session is re-surfaced by PromiseBeacon. The *die-again* case reuses the already-shipped, dev-live `OrphanedWorkSentinel` (#1113) for detect+preserve+surface — no duplicate scanner. An explicit operator/user/emergency kill is never auto-revived on a dirty worktree alone (the origin veto is final). Ships ENABLED on developer agents, dark on the fleet, per the new **Maturation Path** constitutional standard.
+
+audience: agent-only
+maturity: experimental
+
+Wires the merged credential-location ledger into the live read paths (spec §2.2 — the 12-row consumer census). Every place that today treats a subscription account's enrollment config home as the live LOCATION of its credential now resolves through one chokepoint, the new `CredentialLocationGate`, when the feature is enabled — so once a credential is moved between homes, a poll/spawn/badge reads the home the credential ACTUALLY lives in now, instead of being silently invalidated.
+
+- **One re-route chokepoint** — `CredentialLocationGate` (src/core/CredentialLocationGate.ts) reads the ledger via sync in-memory `slotForAccount`/`tenantForSlot`. Flag-gated: with the feature OFF (the only shipped state) every read returns today's enrollment-home value. Back-compat: a never-seeded ledger ALSO returns today's value. Fail-open-loud: an UNKNOWN-mode (corrupt) ledger returns the fallback AND raises ONE HIGH attention item — it never throws into a poll or spawn.
+- **QuotaPoller (census #1–#4)** — the per-account token read, the 401-refresh exchange, and the needs-reauth attribution all target the account's LIVE slot; the email auto-patch is SUPPRESSED while enabled (it would otherwise cross-contaminate pool emails after a move).
+- **Spawn placement (census #5/#6)** — a pinned pool account's session launches under its CURRENT slot, not its stale enrollment home. An explicit caller-supplied home (the account-swap path) still wins unchanged.
+- **In-use badge (census #8, the lying-oracle fix)** — the dashboard "which account am I on" badge reads the ledger's default-home tenant instead of re-probing the client status command, which lags during the post-move window and would re-cache the wrong account. The badge cache is busted the moment a default-home move commits.
+- **Competing-writer refusal (census #9)** — a manual account switch / auto-migrate that would write a moved home is refused at the MANAGER (the single credential-write funnel), not just on a route, with a plain-English message pointing at the correct replacement. The refusal is non-destructive — nothing is written.
+- **Config-home edit lock (census #10/#11)** — editing an account's config-home field via the pool API is refused (409) while enabled — that field is enrollment metadata, not the live location.
+- **Dark** — gated by the existing `subscriptionPool.credentialRepointing` flag (`enabled:false`). With the feature off (the fleet + dev default) every consumer is byte-for-byte today's behavior; the refusal surfaces refuse nothing; the config-home lock never fires.
+
+The HTTP routes and the audit-scrub chokepoint that expose this to the operator are Step 7 (a later increment).
+
+## What to Tell Your User
+
+Nothing to announce proactively — it's an experimental safety net that runs on developer agents. If anyone asks: a background build that gets shut down before it saves its work now gets brought back and reminded to commit, instead of the work quietly vanishing.
+
+This is internal plumbing that ships turned off, so day to day nothing changes for you. What it builds toward: when I hold more than one of your subscription accounts and move a credential between them under the hood, all the parts of me that read your accounts now agree on where each one actually lives — the quota poller checks the right account, a new session launches on the right account, the dashboard badge shows the right account, and a stale background process can no longer silently overwrite a moved account and resurrect an old one. Before this, those readers each trusted a separate, easily-outdated note about where an account lived, so a move could quietly make them disagree. It is off by default and does nothing until it is deliberately turned on after a review window. If something does go wrong while it is on, it fails toward today's behavior and tells me loudly, rather than guessing.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Revive a session reaped with a dirty worktree | Automatic (dev-enabled, dark on fleet) |
+| Durable "commit your worktree" obligation | `GET /commitments` (beacon re-surfaces a stalled revive) |
+| Tune the dirty-check / residue denylist | `monitoring.yieldSafety.*` config |
+
+New exported `CredentialLocationGate` (src/core/CredentialLocationGate.ts) — the spec §2.2 census re-routing chokepoint of live credential re-pointing. Gated by the existing `subscriptionPool.credentialRepointing` flag; no new config flag, no new HTTP route (routes are Step 7). Re-routes QuotaPoller, SessionManager spawn placement, InUseAccountResolver, the credential-write funnel (manager-level competing-writer refusal), and the pool config-home PATCH through the merged Step 2 location ledger.
+
+## Evidence
+
+Not a bug fix — a new dark, dev-gated feature; "not reproducible in dev" in the bug-fix sense. Verified by the 3-tier test plan: 19 unit tests for the shared `worktreeDirtyCheck` (both sides of every boundary + fail-open + cache), 5 reaper tests (dirty → evidence, clean → empty, feature-dark → empty, throw → fail-open, no-cwd → not-consulted), 7 drainer tests (the directive + the revival-obligation hook), and an e2e wired-pipeline test (a reaped dirty-worktree session is revived → the directive appears → a real beacon-enabled commitment is registered + deduped). tsc clean; full lint + dark-gate golden line-map + docs-coverage green.
+
+- `tests/unit/credential-location-gate.test.ts` (19) — the gate (flag-off/on-known/on-unknown, fail-open-loud, dedup attention, throwing-emitter safety); QuotaPoller census #1/#2 slot re-route + #3 email-suppress (both sides); InUseAccountResolver census #8 (E4a-liar: never re-probes when enabled, ledger-known short-circuit, never-seeded fall-through, bustCache); competing-writer refusal #9 (manager refuse + non-owned write-through + no-gate inertness).
+- `tests/unit/credential-swap-executor.test.ts` (+2) — census #8 `onSlotsChanged` fires at commit with both swapped slots; a throwing cache-bust never rolls back the committed swap.
+- `tests/unit/interactive-session-pin.test.ts` (+3) — census #6 spawn re-route (flag-on-known → live slot; flag-off → enrollment home; never-seeded → enrollment home).
+- `tests/unit/account-switcher-provider.test.ts` (+2) — census #9 AccountSwitcher manager-refusal (refused switch, no write, active account unchanged) + no-gate proceeds.
+- `tests/integration/credential-repointing-census-routes.test.ts` (3) — PATCH config-home → 409 when enabled, 200 when off, non-config-home field still PATCHes when enabled.
+- `tests/e2e/credential-repointing-census-lifecycle.test.ts` (2) — feature-alive: flag-OFF strict no-op end-to-end (badge re-probes, poll reads enrollment home, PATCH allowed) + flag-ON ledger short-circuit (badge no re-probe, PATCH 409).
+- tsc clean; full `npm run lint` clean; dark-gate unchanged (no ConfigDefaults touched); docs-coverage green.

package/upgrades/side-effects/ws52-step6-census-rerouting.md

@@ -0,0 +1,143 @@
+# Side-Effects Review — WS5.2 Step 6: census consumer re-routing (live credential re-pointing, dark)
+
+**Version / slug:** `ws52-step6-census-rerouting`
+**Date:** `2026-06-13`
+**Author:** `Echo`
+**Second-pass reviewer:** `4-adversarial-lens self-review (folded as named tests)`
+
+## Summary of the change
+
+Step 6 of live credential re-pointing (spec §2.2). Every place in the live code that today treats a
+pool account's enrollment `configHome` as the LIVE location of its credential is re-routed through a
+single new chokepoint, `CredentialLocationGate`, which reads the `CredentialLocationLedger` (Steps
+1–5, merged). The gate is FLAG-GATED on the EXISTING `subscriptionPool.credentialRepointing.enabled`
+(no new config flag → the dark-gate line-map is UNCHANGED), back-compat-on-unknown (a never-seeded /
+UNKNOWN ledger falls back to today's enrollment-home behavior), and fail-open-loud (an UNKNOWN-mode
+read returns the fallback + ONE HIGH attention, never throws into a hot path). Files touched:
+`src/core/CredentialLocationGate.ts` (new), `src/core/QuotaPoller.ts` (census #1–#4),
+`src/core/InUseAccountResolver.ts` (census #8, the E4a liar), `src/core/SessionManager.ts` (census
+#5/#6 spawn placement), `src/monitoring/CredentialProvider.ts` (census #9 manager-level refusal gate),
+`src/monitoring/AccountSwitcher.ts` (surfaces the #9 refusal cleanly),
+`src/core/CredentialSwapExecutor.ts` (an `onSlotsChanged` commit hook for the #8 cache-bust),
+`src/server/routes.ts` (census #10/#11 PATCH configHome → 409), `src/commands/server.ts` (the wiring
+chain: ledger + gate + consumers + the process-shared refusal gate).
+
+## Decision-point inventory
+
+- `CredentialLocationGate.slotForAccount/tenantForSlot` — add — the single re-route chokepoint; flag-gated, back-compat-on-unknown, fail-open-loud.
+- `QuotaPoller.accountForReads` — add — resolves each account's live slot for token read / 401-refresh / needs-reauth; email auto-patch SUPPRESSED while enabled.
+- `InUseAccountResolver.resolve` — modify — when enabled + ledger-known, resolves the default badge from the ledger instead of a `claude auth status` re-probe; `bustCache()` added.
+- `SessionManager.resolvePinnedSpawnHome` — add — a pinned account's spawn home resolves through the ledger; an explicit caller home (account-swap path) still wins.
+- `writeCredentialsSerialized` refusal gate — add — a manager-level competing-writer refusal at the funnel chokepoint (not only the route).
+- `PATCH /subscription-pool/:id` configHome — modify — refused 409 while enabled.
+- `CredentialSwapExecutor.onSlotsChanged` — add — a best-effort commit hook that busts the in-use badge on a default-slot swap.
+
+---
+
+## 1. Over-block
+
+The only block surfaces are: (a) the PATCH-409 on `configHome` — refuses ONLY when the flag is
+enabled (always off while dark), and ONLY the `configHome` field (every other field still PATCHes);
+(b) the manager-level competing-writer refusal — refuses ONLY when the flag is enabled AND the ledger
+holds a tenant for the (canonicalized) slot. A legitimate switch to a slot the ledger does NOT own is
+not refused. With the flag off (the shipped dark state) neither block fires: no over-block surface
+exists in the shipped configuration.
+
+---
+
+## 2. Under-block
+
+The competing-writer refusal keys on "the ledger holds a tenant for this canonical slot." If a writer
+targets a slot the ledger has never recorded (a brand-new enrollment home not yet seeded), it is NOT
+refused — but that slot is not repointing-owned, so writing it cannot clobber a ledger tenant; this is
+correct back-compat, not an under-block. The refusal is at the SOLE manager funnel
+(`writeCredentialsSerialized`), so a non-route caller cannot dodge it — the spec §2.7 "every item a
+unique source dodge" is closed by construction.
+
+---
+
+## 3. Level-of-abstraction fit
+
+`CredentialLocationGate` is a thin DETECTOR/router (sync in-memory ledger read + a flag check), not an
+authority — it never decides policy, it answers "where does account X live now?" The single authority
+in the change is the manager-level refusal, which is a deterministic ownership check (does the ledger
+own this slot?) — the correct altitude per spec §2.7 (manager chokepoint, not a brittle route guard).
+The gate FEEDS the existing consumers; it does not run parallel to them. The ledger (Step 2) is the
+lower-level primitive the gate USES; nothing is re-implemented.
+
+---
+
+## 4. Signal vs authority compliance
+
+**Reference:** docs/signal-vs-authority.md
+
+- [x] No — the re-routing reads are SIGNAL (advisory location resolution feeding existing consumers);
+      the two block surfaces (PATCH-409, competing-writer refusal) are deterministic OWNERSHIP checks
+      over durable ledger state, not brittle heuristics — they have full structural context (the
+      ledger is the single source of truth), so they are smart-gate-equivalent, not brittle detectors.
+
+The gate reads never own block authority: an UNKNOWN-mode read fails OPEN (returns the enrollment
+fallback + an attention item), so a corrupt ledger degrades to today's behavior, never blocks a poll
+or a spawn.
+
+---
+
+## 5. Interactions
+
+- **Shadowing:** the PATCH-409 runs BEFORE `subscriptionPool.update` in `/subscription-pool/:id` — when it fires the update never runs (intended; the field-edit must not land). Other fields are unaffected. The competing-writer refusal runs BEFORE the funnel lock in `writeCredentialsSerialized` — when it fires no lock is taken and no write occurs (intended, non-destructive).
+- **Double-fire:** the swap-commit `onSlotsChanged` fires exactly once per committed swap; it is best-effort and a throwing consumer is swallowed (the commit is the load-bearing op and is never rolled back by a cache-bust failure — proven by a named test).
+- **Races:** the gate reads are sync in-memory (no shared mutable state); the refusal gate reads the ledger's in-memory assignments (single-writer process). The InUseAccountResolver cache-bust is idempotent.
+- **Feedback loops:** the email auto-patch SUPPRESSION removes a feedback loop that previously cross-contaminated pool emails after a swap (spec §2.2 #3) — a net REDUCTION in a feedback path.
+
+---
+
+## 6. External surfaces
+
+- **Other agents on the same machine:** none — the ledger/gate are per-machine and read-only over the local ledger.
+- **Install base:** none while dark (flag off → byte-identical behavior; proven by the E2E strict-no-op test + per-consumer flag-off unit tests).
+- **External systems:** none — no new network calls; the gate is a pure in-memory read-router.
+- **Persistent state:** reads the existing `state/credential-locations.json` (Step 2); writes nothing new (Step 6 is read re-routing + two refusal surfaces — neither adds a credential write; the `lint-no-unfunneled-credential-write` lint is clean).
+- **Operator surface:** the PATCH-409 changes a `/subscription-pool/:id` response (409 with a plain-English message pointing at `POST /credentials/set-default`) ONLY when the flag is enabled. The AccountSwitcher refusal returns a `SwitchResult` with a plain-English message — phone-surfaced via the existing `/switch-account` Telegram command path. No new operator-only API action is introduced.
+
+## 6b. Operator-surface quality
+
+No operator surface (no dashboard renderer / approval page / grant form) is added or touched — the
+dashboard Subscriptions-tab `/credentials/locations` fetch is census #11, which Step 7 owns per the
+build plan §6/§7 sequencing. Not applicable to this step.
+
+---
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+**machine-local BY DESIGN.** The reason it SHOULD differ per machine: each machine's
+`CredentialLocationLedger` is the truth for ITS OWN slots (`SubscriptionPool` decision 1A —
+per-machine enrollment = independent grant lineages). An N-machine pool has N independent ledgers and
+this step adds NO cross-machine read. A swap on machine A never needs to bust machine B's in-use cache
+(B's `~/.claude` is a different physical slot with a different credential). Degrades safely:
+ledger-unknown on any machine → that machine shows today's (re-probed) badge / enrollment-home reads.
+No user-facing notice is emitted by the re-routing (the only notice is the UNKNOWN-mode HIGH attention,
+which is a per-machine local degradation surface — correct as machine-local). No durable cross-machine
+state is created; no URLs are generated. (Phase C of the build prompt, answered explicitly.)
+
+---
+
+## Rollback
+
+Pure dark-ship: the feature is gated on `subscriptionPool.credentialRepointing.enabled` (default
+false). With the flag off — the only shipped state — every census consumer is byte-for-byte today's
+behavior, the refusal gate refuses nothing, the PATCH-409 never fires. To roll back the code entirely,
+revert this commit; nothing persists (no migration, no new state file — the ledger file predates this
+step). No two-flag flip is part of this step.
+
+## 4-adversarial-lens verdict
+
+1. **E4a-liar resurrection (THE blocker) — PASS.** `InUseAccountResolver` does NOT re-probe `claude auth status` for the default badge when enabled + ledger-known; it reads `ledger.tenantOf('~/.claude')`. `bustCache()` clears the cache, fired at swap-commit by `onSlotsChanged` for any `~/.claude` swap. Named tests: "resolves from the ledger, NEVER re-probes auth status" (`probe` spy asserted `.not.toHaveBeenCalled()`) + "bustCache clears a cached probe result" + the E2E flag-on `probeCalls() === 0`.
+2. **Competing-writer clobber — PASS.** The refusal lives at the MANAGER (`writeCredentialsSerialized`), before the funnel lock; a non-route caller inherits it. Named tests: "REFUSES at the manager when the slot is repointing-owned (no write occurs)" + AccountSwitcher "REFUSES the switch (no write) … active account unchanged."
+3. **Hot-path safety — PASS.** A ledger UNKNOWN-mode read returns the enrollment fallback + ONE deduped HIGH attention, never throws. Named tests: "UNKNOWN mode → fallback + ONE deduped HIGH attention, never throws" + "a THROWING attention emitter never escapes the read."
+4. **Dark-ship inertness — PASS.** Flag off → every consumer byte-for-byte today. Named tests: the per-consumer flag-OFF unit tests (every census row) + the E2E "FLAG OFF: the full wiring is alive AND strictly inert" (in-use re-probes, quota reads enrollment home, PATCH allowed).
+
+## Test tiers
+
+- Unit: `tests/unit/credential-location-gate.test.ts` (19), additions to `credential-swap-executor.test.ts` (#8 cache-bust + throw-safety), `interactive-session-pin.test.ts` (#6 spawn re-route ×3), `account-switcher-provider.test.ts` (#9 refusal ×2).
+- Integration: `tests/integration/credential-repointing-census-routes.test.ts` (PATCH-409 live, flag-off 200, non-configHome field still PATCHes).
+- E2E: `tests/e2e/credential-repointing-census-lifecycle.test.ts` (feature-alive: flag-off strict no-op end-to-end + flag-on ledger short-circuit).

package/upgrades/1.3.537.md

@@ -1,27 +0,0 @@
-# Upgrade Guide — vNEXT
-
-<!-- assembled-by: assemble-next-md -->
-<!-- bump: minor -->
-
-## What Changed
-
-A new dev-gated monitoring capability — **Build-Session Yield Safety** (ACT-839) — closes the "a background build died standing-by-for-tests with its work uncommitted" gap. R1: a session reaped while its worktree holds real uncommitted work is now resume-eligible on that alone — the killer (`SessionReaper`) runs a bounded, cached, fail-open `worktreeDirtyCheck` on the session's worktree PRE-kill (never a synchronous git call on the terminate chokepoint) and tags a new `uncommitted-worktree-work` STRONG `WorkEvidence` value. R2 (Close-the-Loop, signal not block): the revived session's continuation prompt leads with a verbatim commit-first directive, and `ResumeQueueDrainer` fires `onWorktreeRevival`, which registers a deduped, beacon-enabled `CommitmentTracker` obligation so a *stalled* revived session is re-surfaced by PromiseBeacon. The *die-again* case reuses the already-shipped, dev-live `OrphanedWorkSentinel` (#1113) for detect+preserve+surface — no duplicate scanner. An explicit operator/user/emergency kill is never auto-revived on a dirty worktree alone (the origin veto is final). Ships ENABLED on developer agents, dark on the fleet, per the new **Maturation Path** constitutional standard.
-
-audience: agent-only
-maturity: experimental
-
-## What to Tell Your User
-
-Nothing to announce proactively — it's an experimental safety net that runs on developer agents. If anyone asks: a background build that gets shut down before it saves its work now gets brought back and reminded to commit, instead of the work quietly vanishing.
-
-## Summary of New Capabilities
-
-| Capability | How to Use |
-|-----------|-----------|
-| Revive a session reaped with a dirty worktree | Automatic (dev-enabled, dark on fleet) |
-| Durable "commit your worktree" obligation | `GET /commitments` (beacon re-surfaces a stalled revive) |
-| Tune the dirty-check / residue denylist | `monitoring.yieldSafety.*` config |
-
-## Evidence
-
-Not a bug fix — a new dark, dev-gated feature; "not reproducible in dev" in the bug-fix sense. Verified by the 3-tier test plan: 19 unit tests for the shared `worktreeDirtyCheck` (both sides of every boundary + fail-open + cache), 5 reaper tests (dirty → evidence, clean → empty, feature-dark → empty, throw → fail-open, no-cwd → not-consulted), 7 drainer tests (the directive + the revival-obligation hook), and an e2e wired-pipeline test (a reaped dirty-worktree session is revived → the directive appears → a real beacon-enabled commitment is registered + deduped). tsc clean; full lint + dark-gate golden line-map + docs-coverage green.