instar 1.3.537 → 1.3.539

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.537",
+  "version": "1.3.539",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-13T20:04:42.567Z",
-  "instarVersion": "1.3.537",
+  "generatedAt": "2026-06-13T20:40:05.218Z",
+  "instarVersion": "1.3.539",
   "entryCount": 201,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "4d92fe68ea368764c5d14cc9020ce71deed8b5e407776443186ab2cdcd908d61",
+      "contentHash": "664e8fc82415ef692376c937deb21d4fc9a848f2ae581702993246e8e6e3406e",
       "since": "2025-01-01"
     },
     "cli:init": {
@@ -1522,7 +1522,7 @@
       "type": "subsystem",
       "domain": "server",
       "sourcePath": "src/server/AgentServer.ts",
-      "contentHash": "97c5a029357f46d71c531d0e519dd817e00a91f3129e6c7b01a96d94015e2c13",
+      "contentHash": "9b9dc8bf6dc2a28591c8559e286f9a7799fbf5c253e094935a7b6f7d5edb7975",
       "since": "2025-01-01"
     },
     "subsystem:session-manager": {
@@ -1530,7 +1530,7 @@
       "type": "subsystem",
       "domain": "sessions",
       "sourcePath": "src/core/SessionManager.ts",
-      "contentHash": "49e13cb91286150019351a47f1200d0c086c2c2bba27e29023d3a5253024191f",
+      "contentHash": "c505368755a51f57c461447eae1b32da1815444b25060d985ab2381779bd6311",
       "since": "2025-01-01"
     },
     "subsystem:auto-updater": {

package/upgrades/1.3.538.md

@@ -0,0 +1,51 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: minor -->
+
+## What Changed
+
+A new dev-gated monitoring capability — **Build-Session Yield Safety** (ACT-839) — closes the "a background build died standing-by-for-tests with its work uncommitted" gap. R1: a session reaped while its worktree holds real uncommitted work is now resume-eligible on that alone — the killer (`SessionReaper`) runs a bounded, cached, fail-open `worktreeDirtyCheck` on the session's worktree PRE-kill (never a synchronous git call on the terminate chokepoint) and tags a new `uncommitted-worktree-work` STRONG `WorkEvidence` value. R2 (Close-the-Loop, signal not block): the revived session's continuation prompt leads with a verbatim commit-first directive, and `ResumeQueueDrainer` fires `onWorktreeRevival`, which registers a deduped, beacon-enabled `CommitmentTracker` obligation so a *stalled* revived session is re-surfaced by PromiseBeacon. The *die-again* case reuses the already-shipped, dev-live `OrphanedWorkSentinel` (#1113) for detect+preserve+surface — no duplicate scanner. An explicit operator/user/emergency kill is never auto-revived on a dirty worktree alone (the origin veto is final). Ships ENABLED on developer agents, dark on the fleet, per the new **Maturation Path** constitutional standard.
+
+audience: agent-only
+maturity: experimental
+
+Wires the merged credential-location ledger into the live read paths (spec §2.2 — the 12-row consumer census). Every place that today treats a subscription account's enrollment config home as the live LOCATION of its credential now resolves through one chokepoint, the new `CredentialLocationGate`, when the feature is enabled — so once a credential is moved between homes, a poll/spawn/badge reads the home the credential ACTUALLY lives in now, instead of being silently invalidated.
+
+- **One re-route chokepoint** — `CredentialLocationGate` (src/core/CredentialLocationGate.ts) reads the ledger via sync in-memory `slotForAccount`/`tenantForSlot`. Flag-gated: with the feature OFF (the only shipped state) every read returns today's enrollment-home value. Back-compat: a never-seeded ledger ALSO returns today's value. Fail-open-loud: an UNKNOWN-mode (corrupt) ledger returns the fallback AND raises ONE HIGH attention item — it never throws into a poll or spawn.
+- **QuotaPoller (census #1–#4)** — the per-account token read, the 401-refresh exchange, and the needs-reauth attribution all target the account's LIVE slot; the email auto-patch is SUPPRESSED while enabled (it would otherwise cross-contaminate pool emails after a move).
+- **Spawn placement (census #5/#6)** — a pinned pool account's session launches under its CURRENT slot, not its stale enrollment home. An explicit caller-supplied home (the account-swap path) still wins unchanged.
+- **In-use badge (census #8, the lying-oracle fix)** — the dashboard "which account am I on" badge reads the ledger's default-home tenant instead of re-probing the client status command, which lags during the post-move window and would re-cache the wrong account. The badge cache is busted the moment a default-home move commits.
+- **Competing-writer refusal (census #9)** — a manual account switch / auto-migrate that would write a moved home is refused at the MANAGER (the single credential-write funnel), not just on a route, with a plain-English message pointing at the correct replacement. The refusal is non-destructive — nothing is written.
+- **Config-home edit lock (census #10/#11)** — editing an account's config-home field via the pool API is refused (409) while enabled — that field is enrollment metadata, not the live location.
+- **Dark** — gated by the existing `subscriptionPool.credentialRepointing` flag (`enabled:false`). With the feature off (the fleet + dev default) every consumer is byte-for-byte today's behavior; the refusal surfaces refuse nothing; the config-home lock never fires.
+
+The HTTP routes and the audit-scrub chokepoint that expose this to the operator are Step 7 (a later increment).
+
+## What to Tell Your User
+
+Nothing to announce proactively — it's an experimental safety net that runs on developer agents. If anyone asks: a background build that gets shut down before it saves its work now gets brought back and reminded to commit, instead of the work quietly vanishing.
+
+This is internal plumbing that ships turned off, so day to day nothing changes for you. What it builds toward: when I hold more than one of your subscription accounts and move a credential between them under the hood, all the parts of me that read your accounts now agree on where each one actually lives — the quota poller checks the right account, a new session launches on the right account, the dashboard badge shows the right account, and a stale background process can no longer silently overwrite a moved account and resurrect an old one. Before this, those readers each trusted a separate, easily-outdated note about where an account lived, so a move could quietly make them disagree. It is off by default and does nothing until it is deliberately turned on after a review window. If something does go wrong while it is on, it fails toward today's behavior and tells me loudly, rather than guessing.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Revive a session reaped with a dirty worktree | Automatic (dev-enabled, dark on fleet) |
+| Durable "commit your worktree" obligation | `GET /commitments` (beacon re-surfaces a stalled revive) |
+| Tune the dirty-check / residue denylist | `monitoring.yieldSafety.*` config |
+
+New exported `CredentialLocationGate` (src/core/CredentialLocationGate.ts) — the spec §2.2 census re-routing chokepoint of live credential re-pointing. Gated by the existing `subscriptionPool.credentialRepointing` flag; no new config flag, no new HTTP route (routes are Step 7). Re-routes QuotaPoller, SessionManager spawn placement, InUseAccountResolver, the credential-write funnel (manager-level competing-writer refusal), and the pool config-home PATCH through the merged Step 2 location ledger.
+
+## Evidence
+
+Not a bug fix — a new dark, dev-gated feature; "not reproducible in dev" in the bug-fix sense. Verified by the 3-tier test plan: 19 unit tests for the shared `worktreeDirtyCheck` (both sides of every boundary + fail-open + cache), 5 reaper tests (dirty → evidence, clean → empty, feature-dark → empty, throw → fail-open, no-cwd → not-consulted), 7 drainer tests (the directive + the revival-obligation hook), and an e2e wired-pipeline test (a reaped dirty-worktree session is revived → the directive appears → a real beacon-enabled commitment is registered + deduped). tsc clean; full lint + dark-gate golden line-map + docs-coverage green.
+
+- `tests/unit/credential-location-gate.test.ts` (19) — the gate (flag-off/on-known/on-unknown, fail-open-loud, dedup attention, throwing-emitter safety); QuotaPoller census #1/#2 slot re-route + #3 email-suppress (both sides); InUseAccountResolver census #8 (E4a-liar: never re-probes when enabled, ledger-known short-circuit, never-seeded fall-through, bustCache); competing-writer refusal #9 (manager refuse + non-owned write-through + no-gate inertness).
+- `tests/unit/credential-swap-executor.test.ts` (+2) — census #8 `onSlotsChanged` fires at commit with both swapped slots; a throwing cache-bust never rolls back the committed swap.
+- `tests/unit/interactive-session-pin.test.ts` (+3) — census #6 spawn re-route (flag-on-known → live slot; flag-off → enrollment home; never-seeded → enrollment home).
+- `tests/unit/account-switcher-provider.test.ts` (+2) — census #9 AccountSwitcher manager-refusal (refused switch, no write, active account unchanged) + no-gate proceeds.
+- `tests/integration/credential-repointing-census-routes.test.ts` (3) — PATCH config-home → 409 when enabled, 200 when off, non-config-home field still PATCHes when enabled.
+- `tests/e2e/credential-repointing-census-lifecycle.test.ts` (2) — feature-alive: flag-OFF strict no-op end-to-end (badge re-probes, poll reads enrollment home, PATCH allowed) + flag-ON ledger short-circuit (badge no re-probe, PATCH 409).
+- tsc clean; full `npm run lint` clean; dark-gate unchanged (no ConfigDefaults touched); docs-coverage green.

package/upgrades/1.3.539.md

@@ -0,0 +1,29 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Makes the staged credential-swap executor (Step 5) reachable as live operator levers, and adds the single place every credential-feature surface passes through so a token can never leak into a log, an HTTP response, or a notification.
+
+- **The secret-scrub chokepoint** — a new `CredentialAuditEmit` (src/core/CredentialAuditEmit.ts) with one `scrub(record)` funnel. Every credential-swaps.jsonl audit write, every /credentials/* response body, and every attention-item routes through it; it deep-walks the record and redacts any token-shaped run (reusing the existing `redactToken`). The no-token-material invariant is structural, not "remember to scrub at each callsite".
+- **Manual levers (Bearer-authed, detective controls)** — `POST /credentials/swap` constructs and runs the live staged exchange (the Step-5 residual "nothing constructs the executor live yet" closes here); `POST /credentials/set-default` flips which account ~/.claude serves (the zero-touch default flip); `POST /credentials/restore-enrollment` tears down to the enrollment layout. Each lever param-validates against known ledger slots (400 otherwise), respects a per-pair cooldown (force:true overrides it, bounded by its own per-window budget), emits an operator notification + audit on every invocation.
+- **restore-enrollment never poisons a healthy slot** — `CredentialRestoreEnrollment.classifyRestoreCoherence` (src/core/CredentialRestoreEnrollment.ts) checks identity-coherence (the blob's access-token account must equal its refresh-token lineage). An incoherent blob — a "Frankenstein" graft of one account's access token onto another's refresh token, an unparseable blob, a refresh-token-less blob, or one the oracle can't confirm — is parked one-directionally (the slot is vacated for re-auth) and is NEVER exchanged into a healthy slot.
+- **Read surfaces** — `GET /credentials/locations` is the ledger census read (slot to account, since, lastVerifiedAt, quarantine, journal tail, mode); `GET /credentials/rebalancer` is the autonomous-balancer surface and returns 503 in Increment A (the balancer is Increment B).
+- **Dark** — gated by the existing `subscriptionPool.credentialRepointing` flag (enabled:false). With the feature off (the fleet + dev default) every lever returns 503/no-op and the executor is a strict no-op — byte-for-byte today's behavior.
+
+## What to Tell Your User
+
+This is internal plumbing that ships turned off, so nothing changes for you day to day. What it builds toward: when I hold more than one of your subscription accounts, I will be able to move a credential between them under the hood without restarting your sessions, flip which account your plain terminal lands on, or tear the whole arrangement back down to the original layout — all as deliberate, audited actions. The most important part is a safety guarantee: there is now one place every one of those actions passes through that strips out any secret before it could reach a log, a status page, or a notification, so a token can never leak out that way. And the teardown is hardened so a corrupted or mismatched credential is set aside for you to re-authenticate rather than being shuffled into a healthy account. It is off by default and does nothing until it is deliberately turned on after a review window.
+
+## Summary of New Capabilities
+
+Three new exported classes — `CredentialAuditEmit` (the single secret-scrub chokepoint), `CredentialManualLevers` (per-pair cooldown + the force-swap budget), and `CredentialRestoreEnrollment` (the identity-coherence one-directional-park decision) — plus five /credentials/* HTTP routes (swap, set-default, restore-enrollment, locations, rebalancer), all gated by the existing `subscriptionPool.credentialRepointing` flag. No new gate flag, no new unfunneled credential write path. Registered in CapabilityIndex; CredentialAuditEmit documented under-the-hood.
+
+## Evidence
+
+- `tests/unit/credential-audit-emit.test.ts` (12) — scrub redacts on all three surfaces (jsonl/response/attention) with a real-shaped sk-ant token, deep-scrubs nested objects/arrays, leaves ids/paths/timestamps intact, never throws on a failing sink/delivery; manual levers (per-pair cooldown, force:true override, §0.g force-budget exhaustion + non-forced exemption + window roll); restore coherence (coherent exchange, Frankenstein park, unparseable park, refresh-token-less park, oracle-down park).
+- `tests/integration/credential-routes.test.ts` (6) — dark=503 on every lever + rebalancer 503; live POST /credentials/swap executes the executor with NO token in the response or audit; param-validate unknown slot → 400; manualLeversEnabled:false → 403; restore-enrollment parks an incoherent slot; Bearer-401 on every lever.
+- `tests/e2e/credential-repointing-routes-alive.test.ts` (4) — feature-alive on the real AgentServer factory: ENABLED swap executes (dry-run) + locations reports active; DARK strict no-op (503 on every lever, rebalancer 503, locations reports dark); every lever requires Bearer; rebalancer 503 even when enabled (Increment A).
+- tsc clean; full `npm run lint` clean (dark-gate unchanged — no ConfigDefaults touched); docs-coverage green; repo-invariants hold.