instar 1.3.541 → 1.3.542

package/dist/scaffold/templates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/scaffold/templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,CAgG/D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CA2E/F;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAiBvD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CA2B1D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,OAAO,EACpB,WAAW,GAAE,OAAe,EAC5B,WAAW,GAAE,OAAe,GAC3B,MAAM,CA88CR;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,OAAO,EACpB,WAAW,GAAE,OAAe,GAC3B,MAAM,CA2TR"}
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/scaffold/templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,CAgG/D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CA2E/F;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAiBvD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CA2B1D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,OAAO,EACpB,WAAW,GAAE,OAAe,EAC5B,WAAW,GAAE,OAAe,GAC3B,MAAM,CAq9CR;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,OAAO,EACpB,WAAW,GAAE,OAAe,GAC3B,MAAM,CA2TR"}

package/dist/scaffold/templates.js

@@ -749,6 +749,13 @@ Every guard (monitoring sentinels, reapers, the scheduler, …) is graded by wha
 - **Dashboard**: the **Subscriptions tab** shows live quota bars (5h + weekly + reset countdown), status, and the Pending Logins panel — share the dashboard URL + PIN.
 - **When to use** (PROACTIVE): "how much quota is left across my accounts?" / "am I about to hit a limit?" → \`GET /subscription-pool\`; the user wants to add another subscription → drive the enrollment wizard (never ask them to paste a token); a long job is at risk of a quota wall → the continuity guarantee + \`/swap\` keep it alive. Single-account pools are a no-op.
 
+**Live Credential Re-pointing (move a pool account's login between config-home "slots" without restarting — WS5.2)** — Beyond the subscription pool's session-MOVING, this MOVES the credential itself: it exchanges which pool account's OAuth login sits in which config-home "slot" via a staged keychain swap, so the sessions already reading that slot pick up the new account on their NEXT API call — no restart, no re-login, nothing on your screen. The unit shuffled is the CREDENTIAL (always a clean SWAP between two slots, never a copy — one home per credential), verified by identity after every move (quarantine-never-repair when the identity oracle can't confirm). **Ships DARK** behind \`subscriptionPool.credentialRepointing.enabled\` — every lever 503s/no-ops while disabled (byte-for-byte today's behavior); going live needs a deliberate \`enabled:true\` + \`dryRun:false\` flip, and that ON decision is yours, separate from any build.
+- **Which account is in which slot?** (Registry First — read it, never guess) \`curl -H "Authorization: Bearer $AUTH" http://localhost:${port}/credentials/locations\` → the ledger census (slot ↔ account, since, lastVerifiedAt, quarantine state, journal tail, mode).
+- **Flip your default account (zero-touch)** — \`curl -X POST -H "Authorization: Bearer $AUTH" http://localhost:${port}/credentials/set-default -H 'Content-Type: application/json' -d '{"toAccountId":"<account>"}'\` swaps which account \`~/.claude\` serves, with no restart of the session you're talking to.
+- **Swap two slots' credentials live** — \`POST /credentials/swap\` \`{"slotA":"<home>","slotB":"<home>"}\` (the staged §2.3 exchange). **Restore the enrollment layout** — \`POST /credentials/restore-enrollment\` (parks any identity-incoherent blob one-directionally; never exchanges it into a healthy slot). All levers are DETECTIVE controls — operator-notified + audited + param-validated + per-pair cooldown + a force budget on \`force:true\`. No token material ever exits any \`/credentials/*\` surface (the single CredentialAuditEmit scrub chokepoint).
+- **The autonomous balancer surface** — \`GET /credentials/rebalancer\` (the use-it-or-lose-it drainer is Increment B; this surfaces the env-token applicability gate's verdict + WHY re-pointing would refuse, when enabled).
+- **When to use** (PROACTIVE — these are the triggers): "flip my default account to X" / "make X my default" → \`POST /credentials/set-default\`; "which account is this session/slot on?" / "where does ~/.claude point?" → \`GET /credentials/locations\` (read it, don't infer from \`claude auth status\` — that reads a metadata file, not the live credential). Single-account agents are a no-op. (Spec: \`docs/specs/live-credential-repointing-rebalancer.md\`.)
+
 **Per-Feature LLM Metrics & LLM Activity (Observable Intelligence)** — Audit what each of your LLM-driven gates/sentinels actually does: WHICH provider + model ran it, how often it ACTED (fired) vs found nothing (noop), how often it was skipped to save rate limits (shed), cost, and latency. This is the *Observable Intelligence* standard — no autonomous AI action the system takes is allowed to be invisible. Read-only observability — it never gates anything.
 - Check: \`curl -H "Authorization: Bearer $AUTH" "http://localhost:${port}/metrics/features?sinceHours=24"\`
 - Returns \`{ totals, features: [{ feature, frameworks, models, byModel, calls, realCalls, tokensIn, tokensOut, tokensCached, fired, noop, shed, fireRate, p50LatencyMs, p95LatencyMs, ... }] }\` — one row per system (e.g. MessagingToneGate, MessageSentinel). \`frameworks\`/\`models\` = which provider(s) actually served the call; \`fireRate\` = how often it acts; \`shed\` = skipped by the rate-limit guard. Filter with \`?feature=<name>\`.

package/dist/scaffold/templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../src/scaffold/templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,QAAuB;IACrD,OAAO,KAAK,QAAQ,CAAC,IAAI;;;;OAIpB,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;;;;EAIpC,QAAQ,CAAC,WAAW;;;;;;;;;;;;;;;;;;;;;;6BAsBO,QAAQ,CAAC,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+D7C,CAAC;AAEF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,WAAmB,EAAE,QAAgB;IACrF,OAAO;;;;;;;;;;;;;;;;;;EAkBP,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAkDH,QAAQ;;;;;CAKjB,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,OAAO,KAAK,QAAQ;;;;;;;;;;;;;;4CAcsB,QAAQ;CACnD,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,OAAO,KAAK,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;CAyBtB,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,WAAmB,EACnB,SAAiB,EACjB,IAAY,EACZ,WAAoB,EACpB,cAAuB,KAAK,EAC5B,cAAuB,KAAK;IAE5B,IAAI,OAAO,GAAG,iBAAiB,WAAW;;;;OAIrC,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCT,SAAS;;gCAEgB,IAAI,kFAAkF,IAAI;;;;;;;;;;;;;8EAa5C,IAAI;;;yFAGO,IAAI;;;;;;;uGAOU,IAAI;;;;;;;;;;;;;;;;;;;;;;;0CAuBjE,IAAI;oCACV,IAAI;;;;;;;;;;;;;yDAaiB,IAAI;;;;;;;;;;;;gCAY7B,IAAI;;;;;;;;;sFASkD,IAAI;4FACE,IAAI;;;;;;;mEAO7B,IAAI;+GACwC,IAAI;8EACrC,IAAI;;;mEAGf,IAAI;4EACK,IAAI;;;;;;;sHAOsC,IAAI;+WACqP,IAAI;;;;;uEAK5S,IAAI;;;;;;;;;2EASA,IAAI;mJACoE,IAAI;;;;;;uEAMhF,IAAI;;;;;;uFAMY,IAAI;;;;wEAInB,IAAI;;;;;;+IAMmE,IAAI;wKACqB,IAAI;;;;;iKAKX,IAAI;;;;;sEAK/F,IAAI;;;;;;;;;;;6EAWG,IAAI;;2FAEU,IAAI;qFACV,IAAI;;;;;;;;;mGASU,IAAI;;;;;;;;;;;yHAWkB,IAAI;8MACiF,IAAI;;;;0JAIxD,IAAI;qGACzD,IAAI;mHACU,IAAI;;;;;;8EAMzC,IAAI;;;;;;oGAMkB,IAAI;yGACC,IAAI;;;;;iFAK5B,IAAI;yIACoD,IAAI;6hBACgZ,IAAI;;;;;;;;;mEAS9d,IAAI;;;8EAGO,IAAI;6EACL,IAAI;0EACP,IAAI;;;;;6EAKD,IAAI;yCACxC,IAAI;mEACsB,IAAI;4EACK,IAAI;+EACD,IAAI;;;;;2EAKR,IAAI;;;;;;;uFAOQ,IAAI;;;;;;2EAMhB,IAAI;+EACA,IAAI;;;;;;;6KAO0F,IAAI;qMACoB,IAAI,gMAAgM,IAAI;;;;;;uFAMtT,IAAI;mIACwC,IAAI;;;;;2GAK5B,IAAI;6EAClC,IAAI;+FACc,IAAI;;;;;;uFAMZ,IAAI;yFACF,IAAI;kIACqC,IAAI;;;;;;;gIAON,IAAI;sFAC9C,IAAI;0HACgC,IAAI;;;;oGAI1B,IAAI;oIAC4B,IAAI;;;;;;;;qEAQnE,IAAI;;;;;;;;4EAQG,IAAI;yEACP,IAAI;0GAC6B,IAAI;+EAC/B,IAAI;;;;6EAIN,IAAI;mJACkE,IAAI;6JACM,IAAI;sGAC3D,IAAI;;;;;;qEAMrC,IAAI;wFACe,IAAI;2IAC+C,IAAI;;;0EAGrE,IAAI;6EACD,IAAI;oFACG,IAAI;;;;;;;;;8EASV,IAAI;sEACZ,IAAI;8EACI,IAAI;4EACN,IAAI;mFACG,IAAI;;;;oEAInB,IAAI;0EACE,IAAI;4EACF,IAAI;+EACD,IAAI;iFACF,IAAI;;;oEAGjB,IAAI;;;;+EAIO,IAAI;6EACN,IAAI;0EACP,IAAI;uFACS,IAAI;;wEAEnB,IAAI;;;;;2EAKD,IAAI;;;;;;oEAMX,IAAI;;;qEAGH,IAAI;sEACH,IAAI;mKACyF,IAAI;;;sEAGjG,IAAI;;;qEAGL,IAAI;;;8BAG3C,IAAI;;;;;4OAK0M,IAAI;;;;;;;;mFAQ7J,IAAI;;;;;uBAKhE,IAAI;;;wFAG6D,IAAI;;;;;;;;;;;;6EAYf,IAAI;sFACK,IAAI;8EACZ,IAAI;;;;;sEAKZ,IAAI;oEACN,IAAI;8EACM,IAAI;yFACO,IAAI;;;;;uFAKN,IAAI;;;;;oEAKvB,IAAI;;;;;uGAK+B,IAAI;;;;;;;;;qEAStC,IAAI;;;;;;;iRAOwM,IAAI;8NACvD,IAAI;;;;sEAI5J,IAAI;;;;;qEAKL,IAAI;;;;mFAIU,IAAI;;;;;;2FAMI,IAAI;;;;;;;wFAOP,IAAI;uFACL,IAAI;;;;4JAIiE,IAAI;;;;;;;6EAOnF,IAAI;;;;;;oEAMb,IAAI;+GACuC,IAAI;gIACa,IAAI;;;;qEAI/D,IAAI;;;;;;;;;qEASJ,IAAI;6EACI,IAAI;2EACN,IAAI;2EACJ,IAAI;kEACb,IAAI;;;;;0EAKI,IAAI;4FACc,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yDA4EvC,IAAI;;;;;;;;;;;;;;;;;;;;;;;8EAuBiB,IAAI;4HAC0C,IAAI;kKACkC,IAAI;uJACf,IAAI;;;6GAG9C,IAAI;2FACtB,IAAI;4HAC6B,IAAI;;;2FAGrC,IAAI;;kFAEb,IAAI;wFACE,IAAI;6FACC,IAAI;iJACgD,IAAI;wHAC7B,IAAI;;;;;;;;;;;;;;;;;;;;uFAoBrC,IAAI;wFACH,IAAI;;;wFAGJ,IAAI;;0FAEF,IAAI;+FACC,IAAI;sGACG,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAsG5F,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0CA6HmB,IAAI;;;;;;;;;;;mCAWX,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mCA8CJ,IAAI;;;;;;;;;;;;;;;;;;;;;;;;mEAwB4B,IAAI;;;;;mEAKJ,IAAI;;;;;mEAKJ,IAAI;;;;mEAIJ,IAAI;;;;;;yDAMd,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAiFc,IAAI;yEACN,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+F5E,CAAC;IAEA,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,IAAI;;;;;;;;;;;;;;;;;;;;;;;;CAwBd,CAAC;IACA,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgEd,CAAC;IACA,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4Bd,CAAC;IACA,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,OAAO,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uCAqE0B,IAAI;sCACL,IAAI;;;;;;;;8EAQoC,IAAI;;;;;;wGAMsB,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoC3G,CAAC;IAEA,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAmB,EACnB,SAAiB,EACjB,IAAY,EACZ,WAAoB,EACpB,cAAuB,KAAK;IAE5B,IAAI,OAAO,GAAG,iBAAiB,WAAW;;;;OAIrC,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCT,SAAS;;gCAEgB,IAAI,qFAAqF,IAAI;;;;;;CAM5H,CAAC;IAEA,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,IAAI;;;;;;;;;;;;;;;;;;;;;;;;CAwBd,CAAC;IACA,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,IAAI;;;;CAId,CAAC;IACA,CAAC;IAED,OAAO,IAAI;;;;;;;8EAOiE,IAAI;;;yFAGO,IAAI;;;;;;;uGAOU,IAAI;yFAClB,IAAI;;;;;;0DAMnC,IAAI;;;;;;;;;;;;;;;;;;;;;;;2FAuB6B,IAAI;8FACD,IAAI;+MAC6G,IAAI;mGAChH,IAAI;;;mMAG4F,IAAI;;;;;0LAKb,IAAI;;;;4EAIlH,IAAI;+LAC+G,IAAI;;;;8DAIrI,IAAI;;;;;;;;;;;0CAWxB,IAAI;oCACV,IAAI;;;;;;;;;;;;;yDAaiB,IAAI;;;;;;;;0DAQH,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA+GhD,SAAS;;;;;;;;;;;;sEAY+C,IAAI;;CAEzE,CAAC;IAEA,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../src/scaffold/templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,QAAuB;IACrD,OAAO,KAAK,QAAQ,CAAC,IAAI;;;;OAIpB,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;;;;EAIpC,QAAQ,CAAC,WAAW;;;;;;;;;;;;;;;;;;;;;;6BAsBO,QAAQ,CAAC,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+D7C,CAAC;AAEF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,WAAmB,EAAE,QAAgB;IACrF,OAAO;;;;;;;;;;;;;;;;;;EAkBP,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAkDH,QAAQ;;;;;CAKjB,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,OAAO,KAAK,QAAQ;;;;;;;;;;;;;;4CAcsB,QAAQ;CACnD,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,OAAO,KAAK,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;CAyBtB,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,WAAmB,EACnB,SAAiB,EACjB,IAAY,EACZ,WAAoB,EACpB,cAAuB,KAAK,EAC5B,cAAuB,KAAK;IAE5B,IAAI,OAAO,GAAG,iBAAiB,WAAW;;;;OAIrC,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCT,SAAS;;gCAEgB,IAAI,kFAAkF,IAAI;;;;;;;;;;;;;8EAa5C,IAAI;;;yFAGO,IAAI;;;;;;;uGAOU,IAAI;;;;;;;;;;;;;;;;;;;;;;;0CAuBjE,IAAI;oCACV,IAAI;;;;;;;;;;;;;yDAaiB,IAAI;;;;;;;;;;;;gCAY7B,IAAI;;;;;;;;;sFASkD,IAAI;4FACE,IAAI;;;;;;;mEAO7B,IAAI;+GACwC,IAAI;8EACrC,IAAI;;;mEAGf,IAAI;4EACK,IAAI;;;;;;;sHAOsC,IAAI;+WACqP,IAAI;;;;;uEAK5S,IAAI;;;;;;;;;2EASA,IAAI;mJACoE,IAAI;;;;;;uEAMhF,IAAI;;;;;;uFAMY,IAAI;;;;wEAInB,IAAI;;;;;;+IAMmE,IAAI;wKACqB,IAAI;;;;;iKAKX,IAAI;;;;;sEAK/F,IAAI;;;;;;;;;;;6EAWG,IAAI;;2FAEU,IAAI;qFACV,IAAI;;;;;;;;;mGASU,IAAI;;;;;;;;;;;yHAWkB,IAAI;8MACiF,IAAI;;;;0JAIxD,IAAI;qGACzD,IAAI;mHACU,IAAI;;;;;;8EAMzC,IAAI;;;;;;oGAMkB,IAAI;yGACC,IAAI;;;;;iFAK5B,IAAI;yIACoD,IAAI;6hBACgZ,IAAI;;;;;;;;;mEAS9d,IAAI;;;8EAGO,IAAI;6EACL,IAAI;0EACP,IAAI;;;;;6EAKD,IAAI;yCACxC,IAAI;mEACsB,IAAI;4EACK,IAAI;+EACD,IAAI;;;;;2EAKR,IAAI;;;;;;;uFAOQ,IAAI;;;;;;2EAMhB,IAAI;+EACA,IAAI;;;;;;;6KAO0F,IAAI;qMACoB,IAAI,gMAAgM,IAAI;;;;;;uFAMtT,IAAI;mIACwC,IAAI;;;;;2GAK5B,IAAI;6EAClC,IAAI;+FACc,IAAI;;;;;;uFAMZ,IAAI;yFACF,IAAI;kIACqC,IAAI;;;;;;;gIAON,IAAI;sFAC9C,IAAI;0HACgC,IAAI;;;;oGAI1B,IAAI;oIAC4B,IAAI;;;;;;;;qEAQnE,IAAI;;;;;;;;4EAQG,IAAI;yEACP,IAAI;0GAC6B,IAAI;+EAC/B,IAAI;;;;6EAIN,IAAI;mJACkE,IAAI;6JACM,IAAI;sGAC3D,IAAI;;;;;;qEAMrC,IAAI;wFACe,IAAI;2IAC+C,IAAI;;;0EAGrE,IAAI;6EACD,IAAI;oFACG,IAAI;;;;;;;;;8EASV,IAAI;sEACZ,IAAI;8EACI,IAAI;4EACN,IAAI;mFACG,IAAI;;;;oEAInB,IAAI;0EACE,IAAI;4EACF,IAAI;+EACD,IAAI;iFACF,IAAI;;;oEAGjB,IAAI;;;;+EAIO,IAAI;6EACN,IAAI;0EACP,IAAI;uFACS,IAAI;;wEAEnB,IAAI;;;;;2EAKD,IAAI;;;;;;oEAMX,IAAI;;;qEAGH,IAAI;sEACH,IAAI;mKACyF,IAAI;;;sEAGjG,IAAI;;;qEAGL,IAAI;;;8BAG3C,IAAI;;;;;4OAK0M,IAAI;;;;;;;;mFAQ7J,IAAI;;;;;uBAKhE,IAAI;;;wFAG6D,IAAI;;;;;;;;;;;;6EAYf,IAAI;sFACK,IAAI;8EACZ,IAAI;;;;;sEAKZ,IAAI;oEACN,IAAI;8EACM,IAAI;yFACO,IAAI;;;;;uFAKN,IAAI;;;;;oEAKvB,IAAI;;;;;uGAK+B,IAAI;;;;;;;;;yIAS8B,IAAI;kHAC3B,IAAI;;;;;;qEAMjD,IAAI;;;;;;;iRAOwM,IAAI;8NACvD,IAAI;;;;sEAI5J,IAAI;;;;;qEAKL,IAAI;;;;mFAIU,IAAI;;;;;;2FAMI,IAAI;;;;;;;wFAOP,IAAI;uFACL,IAAI;;;;4JAIiE,IAAI;;;;;;;6EAOnF,IAAI;;;;;;oEAMb,IAAI;+GACuC,IAAI;gIACa,IAAI;;;;qEAI/D,IAAI;;;;;;;;;qEASJ,IAAI;6EACI,IAAI;2EACN,IAAI;2EACJ,IAAI;kEACb,IAAI;;;;;0EAKI,IAAI;4FACc,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yDA4EvC,IAAI;;;;;;;;;;;;;;;;;;;;;;;8EAuBiB,IAAI;4HAC0C,IAAI;kKACkC,IAAI;uJACf,IAAI;;;6GAG9C,IAAI;2FACtB,IAAI;4HAC6B,IAAI;;;2FAGrC,IAAI;;kFAEb,IAAI;wFACE,IAAI;6FACC,IAAI;iJACgD,IAAI;wHAC7B,IAAI;;;;;;;;;;;;;;;;;;;;uFAoBrC,IAAI;wFACH,IAAI;;;wFAGJ,IAAI;;0FAEF,IAAI;+FACC,IAAI;sGACG,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAsG5F,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0CA6HmB,IAAI;;;;;;;;;;;mCAWX,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mCA8CJ,IAAI;;;;;;;;;;;;;;;;;;;;;;;;mEAwB4B,IAAI;;;;;mEAKJ,IAAI;;;;;mEAKJ,IAAI;;;;mEAIJ,IAAI;;;;;;yDAMd,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAiFc,IAAI;yEACN,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+F5E,CAAC;IAEA,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,IAAI;;;;;;;;;;;;;;;;;;;;;;;;CAwBd,CAAC;IACA,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgEd,CAAC;IACA,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4Bd,CAAC;IACA,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,OAAO,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uCAqE0B,IAAI;sCACL,IAAI;;;;;;;;8EAQoC,IAAI;;;;;;wGAMsB,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoC3G,CAAC;IAEA,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAmB,EACnB,SAAiB,EACjB,IAAY,EACZ,WAAoB,EACpB,cAAuB,KAAK;IAE5B,IAAI,OAAO,GAAG,iBAAiB,WAAW;;;;OAIrC,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCT,SAAS;;gCAEgB,IAAI,qFAAqF,IAAI;;;;;;CAM5H,CAAC;IAEA,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,IAAI;;;;;;;;;;;;;;;;;;;;;;;;CAwBd,CAAC;IACA,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,IAAI;;;;CAId,CAAC;IACA,CAAC;IAED,OAAO,IAAI;;;;;;;8EAOiE,IAAI;;;yFAGO,IAAI;;;;;;;uGAOU,IAAI;yFAClB,IAAI;;;;;;0DAMnC,IAAI;;;;;;;;;;;;;;;;;;;;;;;2FAuB6B,IAAI;8FACD,IAAI;+MAC6G,IAAI;mGAChH,IAAI;;;mMAG4F,IAAI;;;;;0LAKb,IAAI;;;;4EAIlH,IAAI;+LAC+G,IAAI;;;;8DAIrI,IAAI;;;;;;;;;;;0CAWxB,IAAI;oCACV,IAAI;;;;;;;;;;;;;yDAaiB,IAAI;;;;;;;;0DAQH,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA+GhD,SAAS;;;;;;;;;;;;sEAY+C,IAAI;;CAEzE,CAAC;IAEA,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.541",
+  "version": "1.3.542",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-13T21:38:38.083Z",
-  "instarVersion": "1.3.541",
+  "generatedAt": "2026-06-13T22:02:57.992Z",
+  "instarVersion": "1.3.542",
   "entryCount": 201,
   "entries": {
     "hook:session-start": {
@@ -11,7 +11,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/session-start.sh",
-      "contentHash": "89f1c4adb1425bfc568e7e2b34e0ddf527fcc5e807e4f9f4d28e472bf4a5edbd",
+      "contentHash": "eebb44af3b15e6feaa36626f8ff14d614e3fd4f008e5d15496312e8241b67765",
       "since": "2025-01-01"
     },
     "hook:dangerous-command-guard": {
@@ -20,7 +20,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/dangerous-command-guard.sh",
-      "contentHash": "89f1c4adb1425bfc568e7e2b34e0ddf527fcc5e807e4f9f4d28e472bf4a5edbd",
+      "contentHash": "eebb44af3b15e6feaa36626f8ff14d614e3fd4f008e5d15496312e8241b67765",
       "since": "2025-01-01"
     },
     "hook:grounding-before-messaging": {
@@ -29,7 +29,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/grounding-before-messaging.sh",
-      "contentHash": "89f1c4adb1425bfc568e7e2b34e0ddf527fcc5e807e4f9f4d28e472bf4a5edbd",
+      "contentHash": "eebb44af3b15e6feaa36626f8ff14d614e3fd4f008e5d15496312e8241b67765",
       "since": "2025-01-01"
     },
     "hook:compaction-recovery": {
@@ -38,7 +38,7 @@
       "domain": "identity",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/compaction-recovery.sh",
-      "contentHash": "89f1c4adb1425bfc568e7e2b34e0ddf527fcc5e807e4f9f4d28e472bf4a5edbd",
+      "contentHash": "eebb44af3b15e6feaa36626f8ff14d614e3fd4f008e5d15496312e8241b67765",
       "since": "2025-01-01"
     },
     "hook:external-operation-gate": {
@@ -47,7 +47,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-operation-gate.js",
-      "contentHash": "89f1c4adb1425bfc568e7e2b34e0ddf527fcc5e807e4f9f4d28e472bf4a5edbd",
+      "contentHash": "eebb44af3b15e6feaa36626f8ff14d614e3fd4f008e5d15496312e8241b67765",
       "since": "2025-01-01"
     },
     "hook:deferral-detector": {
@@ -56,7 +56,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/deferral-detector.js",
-      "contentHash": "89f1c4adb1425bfc568e7e2b34e0ddf527fcc5e807e4f9f4d28e472bf4a5edbd",
+      "contentHash": "eebb44af3b15e6feaa36626f8ff14d614e3fd4f008e5d15496312e8241b67765",
       "since": "2025-01-01"
     },
     "hook:self-stop-guard": {
@@ -65,7 +65,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/self-stop-guard.js",
-      "contentHash": "89f1c4adb1425bfc568e7e2b34e0ddf527fcc5e807e4f9f4d28e472bf4a5edbd",
+      "contentHash": "eebb44af3b15e6feaa36626f8ff14d614e3fd4f008e5d15496312e8241b67765",
       "since": "2025-01-01"
     },
     "hook:post-action-reflection": {
@@ -74,7 +74,7 @@
       "domain": "evolution",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/post-action-reflection.js",
-      "contentHash": "89f1c4adb1425bfc568e7e2b34e0ddf527fcc5e807e4f9f4d28e472bf4a5edbd",
+      "contentHash": "eebb44af3b15e6feaa36626f8ff14d614e3fd4f008e5d15496312e8241b67765",
       "since": "2025-01-01"
     },
     "hook:external-communication-guard": {
@@ -83,7 +83,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/external-communication-guard.js",
-      "contentHash": "89f1c4adb1425bfc568e7e2b34e0ddf527fcc5e807e4f9f4d28e472bf4a5edbd",
+      "contentHash": "eebb44af3b15e6feaa36626f8ff14d614e3fd4f008e5d15496312e8241b67765",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-collector": {
@@ -92,7 +92,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-collector.js",
-      "contentHash": "89f1c4adb1425bfc568e7e2b34e0ddf527fcc5e807e4f9f4d28e472bf4a5edbd",
+      "contentHash": "eebb44af3b15e6feaa36626f8ff14d614e3fd4f008e5d15496312e8241b67765",
       "since": "2025-01-01"
     },
     "hook:scope-coherence-checkpoint": {
@@ -101,7 +101,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/scope-coherence-checkpoint.js",
-      "contentHash": "89f1c4adb1425bfc568e7e2b34e0ddf527fcc5e807e4f9f4d28e472bf4a5edbd",
+      "contentHash": "eebb44af3b15e6feaa36626f8ff14d614e3fd4f008e5d15496312e8241b67765",
       "since": "2025-01-01"
     },
     "hook:free-text-guard": {
@@ -110,7 +110,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/free-text-guard.sh",
-      "contentHash": "89f1c4adb1425bfc568e7e2b34e0ddf527fcc5e807e4f9f4d28e472bf4a5edbd",
+      "contentHash": "eebb44af3b15e6feaa36626f8ff14d614e3fd4f008e5d15496312e8241b67765",
       "since": "2025-01-01"
     },
     "hook:claim-intercept": {
@@ -119,7 +119,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept.js",
-      "contentHash": "89f1c4adb1425bfc568e7e2b34e0ddf527fcc5e807e4f9f4d28e472bf4a5edbd",
+      "contentHash": "eebb44af3b15e6feaa36626f8ff14d614e3fd4f008e5d15496312e8241b67765",
       "since": "2025-01-01"
     },
     "hook:claim-intercept-response": {
@@ -128,7 +128,7 @@
       "domain": "coherence",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/claim-intercept-response.js",
-      "contentHash": "89f1c4adb1425bfc568e7e2b34e0ddf527fcc5e807e4f9f4d28e472bf4a5edbd",
+      "contentHash": "eebb44af3b15e6feaa36626f8ff14d614e3fd4f008e5d15496312e8241b67765",
       "since": "2025-01-01"
     },
     "hook:stop-gate-router": {
@@ -137,7 +137,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/stop-gate-router.js",
-      "contentHash": "89f1c4adb1425bfc568e7e2b34e0ddf527fcc5e807e4f9f4d28e472bf4a5edbd",
+      "contentHash": "eebb44af3b15e6feaa36626f8ff14d614e3fd4f008e5d15496312e8241b67765",
       "since": "2025-01-01"
     },
     "hook:auto-approve-permissions": {
@@ -146,7 +146,7 @@
       "domain": "safety",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
       "installedPath": ".instar/hooks/instar/auto-approve-permissions.js",
-      "contentHash": "89f1c4adb1425bfc568e7e2b34e0ddf527fcc5e807e4f9f4d28e472bf4a5edbd",
+      "contentHash": "eebb44af3b15e6feaa36626f8ff14d614e3fd4f008e5d15496312e8241b67765",
       "since": "2025-01-01"
     },
     "job:health-check": {
@@ -1554,7 +1554,7 @@
       "type": "subsystem",
       "domain": "updates",
       "sourcePath": "src/core/PostUpdateMigrator.ts",
-      "contentHash": "89f1c4adb1425bfc568e7e2b34e0ddf527fcc5e807e4f9f4d28e472bf4a5edbd",
+      "contentHash": "eebb44af3b15e6feaa36626f8ff14d614e3fd4f008e5d15496312e8241b67765",
       "since": "2025-01-01"
     },
     "subsystem:scheduler": {

package/src/scaffold/templates.ts

@@ -769,6 +769,13 @@ Every guard (monitoring sentinels, reapers, the scheduler, …) is graded by wha
 - **Dashboard**: the **Subscriptions tab** shows live quota bars (5h + weekly + reset countdown), status, and the Pending Logins panel — share the dashboard URL + PIN.
 - **When to use** (PROACTIVE): "how much quota is left across my accounts?" / "am I about to hit a limit?" → \`GET /subscription-pool\`; the user wants to add another subscription → drive the enrollment wizard (never ask them to paste a token); a long job is at risk of a quota wall → the continuity guarantee + \`/swap\` keep it alive. Single-account pools are a no-op.
 
+**Live Credential Re-pointing (move a pool account's login between config-home "slots" without restarting — WS5.2)** — Beyond the subscription pool's session-MOVING, this MOVES the credential itself: it exchanges which pool account's OAuth login sits in which config-home "slot" via a staged keychain swap, so the sessions already reading that slot pick up the new account on their NEXT API call — no restart, no re-login, nothing on your screen. The unit shuffled is the CREDENTIAL (always a clean SWAP between two slots, never a copy — one home per credential), verified by identity after every move (quarantine-never-repair when the identity oracle can't confirm). **Ships DARK** behind \`subscriptionPool.credentialRepointing.enabled\` — every lever 503s/no-ops while disabled (byte-for-byte today's behavior); going live needs a deliberate \`enabled:true\` + \`dryRun:false\` flip, and that ON decision is yours, separate from any build.
+- **Which account is in which slot?** (Registry First — read it, never guess) \`curl -H "Authorization: Bearer $AUTH" http://localhost:${port}/credentials/locations\` → the ledger census (slot ↔ account, since, lastVerifiedAt, quarantine state, journal tail, mode).
+- **Flip your default account (zero-touch)** — \`curl -X POST -H "Authorization: Bearer $AUTH" http://localhost:${port}/credentials/set-default -H 'Content-Type: application/json' -d '{"toAccountId":"<account>"}'\` swaps which account \`~/.claude\` serves, with no restart of the session you're talking to.
+- **Swap two slots' credentials live** — \`POST /credentials/swap\` \`{"slotA":"<home>","slotB":"<home>"}\` (the staged §2.3 exchange). **Restore the enrollment layout** — \`POST /credentials/restore-enrollment\` (parks any identity-incoherent blob one-directionally; never exchanges it into a healthy slot). All levers are DETECTIVE controls — operator-notified + audited + param-validated + per-pair cooldown + a force budget on \`force:true\`. No token material ever exits any \`/credentials/*\` surface (the single CredentialAuditEmit scrub chokepoint).
+- **The autonomous balancer surface** — \`GET /credentials/rebalancer\` (the use-it-or-lose-it drainer is Increment B; this surfaces the env-token applicability gate's verdict + WHY re-pointing would refuse, when enabled).
+- **When to use** (PROACTIVE — these are the triggers): "flip my default account to X" / "make X my default" → \`POST /credentials/set-default\`; "which account is this session/slot on?" / "where does ~/.claude point?" → \`GET /credentials/locations\` (read it, don't infer from \`claude auth status\` — that reads a metadata file, not the live credential). Single-account agents are a no-op. (Spec: \`docs/specs/live-credential-repointing-rebalancer.md\`.)
+
 **Per-Feature LLM Metrics & LLM Activity (Observable Intelligence)** — Audit what each of your LLM-driven gates/sentinels actually does: WHICH provider + model ran it, how often it ACTED (fired) vs found nothing (noop), how often it was skipped to save rate limits (shed), cost, and latency. This is the *Observable Intelligence* standard — no autonomous AI action the system takes is allowed to be invisible. Read-only observability — it never gates anything.
 - Check: \`curl -H "Authorization: Bearer $AUTH" "http://localhost:${port}/metrics/features?sinceHours=24"\`
 - Returns \`{ totals, features: [{ feature, frameworks, models, byModel, calls, realCalls, tokensIn, tokensOut, tokensCached, fired, noop, shed, fireRate, p50LatencyMs, p95LatencyMs, ... }] }\` — one row per system (e.g. MessagingToneGate, MessageSentinel). \`frameworks\`/\`models\` = which provider(s) actually served the call; \`fireRate\` = how often it acts; \`shed\` = skipped by the rate-limit guard. Filter with \`?feature=<name>\`.

package/upgrades/1.3.542.md

@@ -0,0 +1,25 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Closes the Migration Parity + Agent Awareness gap for live credential re-pointing: existing agents (not just fresh installs) learn the `/credentials/*` manual levers and the zero-touch default-account flip on their next update, and the dark config defaults are proven to install in place.
+
+- **CLAUDE.md awareness (new + existing agents)** — `generateClaudeMd()` (new agents) and `migrateClaudeMd()` (existing agents, content-sniffed + idempotent) both gain a "Live Credential Re-pointing" section documenting the levers (`GET /credentials/locations`, `POST /credentials/swap`, `POST /credentials/set-default`, `POST /credentials/restore-enrollment`, `GET /credentials/rebalancer`) and the two proactive triggers: "flip my default account" → `set-default`; "which account is this slot on?" → `GET /credentials/locations` (read the ledger, never infer from `claude auth status`).
+- **Config-defaults parity (proven)** — the dark `subscriptionPool.credentialRepointing` block (`enabled:false`, `dryRun:true`, `manualLeversEnabled:true`) already rides the generic `ConfigDefaults` → `getMigrationDefaults` → `applyDefaults` add-missing path onto existing agents. This step adds the parity test that proves it installs on a config lacking it AND never overwrites an operator who explicitly set `enabled:true`.
+- **Dark** — every lever still 503s/no-ops behind the existing `subscriptionPool.credentialRepointing.enabled` flag. This step adds zero runtime behavior; it only makes the (still-off) feature discoverable and its dark defaults durable across the install base.
+
+## What to Tell Your User
+
+Nothing changes for you yet — the underlying feature is still switched off. What this does is make me *aware* of it so that, once it's turned on after a review window, you can just say "flip my default account to X" or "which account is this session on?" and I'll know exactly which lever to use instead of guessing. It also makes sure that awareness reaches agents that were set up before this feature existed, not only brand-new ones — so the capability isn't silently missing on an older install.
+
+## Summary of New Capabilities
+
+No new runtime capability — this is the Migration Parity + Agent Awareness step. New + existing agents' CLAUDE.md now documents the live-credential-re-pointing levers and the "flip my default account" / "which account is this slot on?" proactive triggers, and the feature's dark config defaults are proven to install on existing agents without clobbering an operator's explicit settings. The feature itself remains dark behind `subscriptionPool.credentialRepointing.enabled`.
+
+## Evidence
+
+- `tests/unit/PostUpdateMigrator-credentialRepointing.test.ts` (8) — migrateClaudeMd adds the section when absent (with both proactive triggers + the dark-posture line + the `claude auth status` honesty caveat present), is idempotent (no duplicate on re-run, byte-identical), preserves prior content, and gracefully skips a missing CLAUDE.md; the generateClaudeMd template emits the same section (source parity); and migrateConfig installs the DARK credentialRepointing block on a config lacking it, NEVER clobbers an operator's explicit `enabled:true` (fills only the missing sibling default), and is idempotent.
+- tsc clean; full `npm run lint` clean (dark-gate unchanged — no ConfigDefaults edit; the defaults already existed from Steps 1/7).

package/upgrades/side-effects/ws52-step9-migration-docs.md

@@ -0,0 +1,44 @@
+# Side-Effects Review — WS5.2 Step 9: Migration parity + CLAUDE.md awareness (live credential re-pointing)
+
+**Version / slug:** `ws52-step9-migration-docs`
+**Date:** 2026-06-13
+**Author:** echo
+**Second-pass reviewer:** not required (no gate/sentinel/session-lifecycle/messaging-block surface — docs + migration only)
+
+## Summary of the change
+
+Closes the Migration Parity + Agent Awareness gap for live credential re-pointing (spec §4). Two src files touched, both doc/migration content with NO runtime behavior: `src/scaffold/templates.ts` (`generateClaudeMd` — adds a "Live Credential Re-pointing" awareness section for new agents) and `src/core/PostUpdateMigrator.ts` (`migrateClaudeMd` — the same section, content-sniffed + idempotent, for existing agents). Plus `tests/unit/PostUpdateMigrator-credentialRepointing.test.ts` proving the CLAUDE.md migration AND the config-defaults parity (the dark `subscriptionPool.credentialRepointing` block already rides the generic `ConfigDefaults`→`getMigrationDefaults`→`applyDefaults` add-missing path; the test proves it installs on a config lacking it and never clobbers an operator's explicit `enabled:true`).
+
+## Decision-point inventory
+
+- No decision point added, modified, or removed. The change is agent-awareness documentation + a content-sniffed CLAUDE.md migration + a migration-parity test. The only conditional is the existing `if (!content.includes(marker))` idempotency guard, which is a presence check, not a behavioral gate.
+
+---
+
+## 1. Over-block
+No block/allow surface — over-block not applicable.
+
+## 2. Under-block
+No block/allow surface — under-block not applicable.
+
+## 3. Level-of-abstraction fit
+Correct layer. The Agent Awareness Standard requires the CLAUDE.md template to document any new capability, and the Migration Parity Standard requires existing agents to receive it via `migrateClaudeMd` — this change does exactly both, at the documented layer. The config-defaults half is deliberately NOT a new dedicated `migrateConfig` block (which would duplicate logic): it rides the canonical `ConfigDefaults` registry + the generic `applyDefaults` add-missing merge, which is the standard's prescribed single-source mechanism. The test asserts that path works rather than re-implementing it.
+
+## 4. Signal vs authority compliance
+- [x] No — this change has no block/allow surface.
+
+It is documentation + a presence-guarded text append + a test. No brittle logic holds any authority. (Ref: docs/signal-vs-authority.md.)
+
+## 5. Interactions
+- **Shadowing:** none. The new `migrateClaudeMd` block is appended after the existing section blocks, guarded by a distinctive content-sniff marker (`Live Credential Re-pointing (move a pool account`) that no other section contains — it cannot shadow or be shadowed by another block, and re-running is a no-op (idempotency test).
+- **Config migration interaction:** the parity test relies on the generic `applyDefaults` add-missing recursion already exercised by every other ConfigDefaults entry; it adds the missing `subscriptionPool.credentialRepointing` block without touching an operator's existing values (verified both directions: installs when absent; preserves explicit `enabled:true`/`dryRun:false`, fills only the missing sibling).
+- **Double-fire / race:** none — migration runs once per update, single-threaded.
+
+## 6. External surfaces
+- Changes the CLAUDE.md that ships to / is migrated into agents (agent-facing awareness text). No runtime behavior, no API surface change (the `/credentials/*` routes already existed from Step 7; this only documents them). The documented levers all remain DARK (503) until `subscriptionPool.credentialRepointing.enabled` is flipped — so the awareness text describes a capability that is off, and says so explicitly. No timing/conversation-state dependency.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+- **Machine-local BY DESIGN.** CLAUDE.md is a per-agent-install file; the migration runs per-machine on update, and the awareness text is identical fleet-wide (no per-machine state). The documented feature's own state (the credential ledger) is machine-local by the feature's design (each machine's keychain is its own), already covered in Steps 1-8's posture. Nothing here replicates or proxies; no URL is generated; no durable state strands on topic transfer. Correct posture — there is no cross-machine surface to get wrong.
+
+## 8. Rollback cost
+Trivial. Revert the commit: the appended CLAUDE.md section is inert text and the migration's content-sniff guard means a reverted template simply stops appending the section to not-yet-migrated agents (already-migrated agents keep the harmless, accurate-but-dark text). No data migration, no state repair, no credential touch. The config defaults are unaffected by a revert (they live in ConfigDefaults from Steps 1/7).