instar 1.3.619 → 1.3.620

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.619",
+  "version": "1.3.620",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-18T02:58:23.805Z",
-  "instarVersion": "1.3.619",
+  "generatedAt": "2026-06-18T04:21:02.177Z",
+  "instarVersion": "1.3.620",
   "entryCount": 201,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "8a6b6b22d35c2b9a2e19ad98e71d1403302971274b3d66c911953215672a1f20",
+      "contentHash": "ed6959d356dbd711b482bd419caac9ee35407454b547fe9d26e3b6d00a4bbcd4",
       "since": "2025-01-01"
     },
     "cli:init": {

package/upgrades/1.3.620.md

@@ -0,0 +1,22 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Fixes the WS5.2 one-tap Approve card so it actually appears and works on the live dashboard. The previous release shipped the card's parts (renderers, payload builder, connector, enforcement) but never wired them into the dashboard controller, and the scan offer was missing the fields/agents the card needs — so the card never rendered on the real Subscriptions tab. This connects the pieces end-to-end: the scan offer is enriched server-side with the card fields + the FD2 agent pair (operator never types a fingerprint); the controller now POSTs the scan, renders the card as the Subscriptions panel's lead section, and wires the Approve tap → PIN-gated `issue-for-machine`. A new controller integration test drives the real flow (fetch scan → render → Approve → POST).
+
+## What to Tell Your User
+
+The one-tap "let another machine use this subscription" Approve card now actually shows up on your dashboard's Subscriptions tab and works with a single tap + PIN — no codes, no JSON. (It was missing its final wiring before, so it never appeared.)
+
+## Summary of New Capabilities
+
+- The WS5.2 one-tap account-follow-me Approve card is now live on the Subscriptions tab (renders from the scan offer, Approve issues the PIN-gated mandate). Dark on fleet / live on the dev agent, as before.
+
+## Evidence
+
+- `tests/unit/follow-me-controller-wiring.test.ts` — NEW; drives the real controller: POSTs the scan, renders the card into `els.followMe`, and on Approve-with-PIN POSTs `/mandate/issue-for-machine` with the server-resolved FD2 agents + PIN; refuses to POST with no PIN. 4/4 pass.
+- Existing card + payload unit tests still green (47 tests total across the follow-me suite).
+- `npx tsc --noEmit` clean.

package/upgrades/side-effects/ws52-operator-card-wiring.md

@@ -0,0 +1,60 @@
+# Side-Effects Review — WS5.2 one-tap card: live wiring (the missing integration)
+
+**Version / slug:** `ws52-operator-card-wiring`
+**Date:** `2026-06-18`
+**Author:** `Echo (instar-dev agent)`
+**Second-pass reviewer:** `not required (completion of an already-approved + second-pass-concurred design; no new decision surface)`
+
+## Summary of the change
+
+Completes the live wiring of the WS5.2 one-tap Approve card (approved spec `docs/specs/ws52-operator-tap-not-text.md`). The prior PR (#1223) shipped the card render functions, the payload builder, the connector, and the enforcement — but the render functions were never invoked by the live dashboard controller, and the scan offer lacked the fields/agents the card needs, so the card never appeared on the real Subscriptions tab (a Live-User-Channel-Proof failure caught while driving the actual proof). This change connects the pieces: (1) `src/server/routes.ts` — the `/subscription-pool/follow-me/scan` handler now enriches each consent offer with the card fields (`machineNickname`, `accountLabel`, `expiryText`) and the FD2 `agents` pair, resolved SERVER-SIDE (`resolveAgentFingerprint`) so the operator never types a fingerprint; (2) `dashboard/subscriptions.js` — the controller now POSTs the scan, renders the offers via `renderFollowMeOffers` into `els.followMe`, and wires the Approve tap (delegated, once) → `buildFollowMeIssuePayload` → POST `/mandate/issue-for-machine`; (3) `dashboard/index.html` — adds the `#subFollowMe` container as the panel's lead section + passes `els.followMe` + widens the subscriptions `fetchImpl` to pass method/body (for the POST scan + issue). A new integration test (`tests/unit/follow-me-controller-wiring.test.ts`) drives the real controller end-to-end.
+
+## Decision-point inventory
+
+- `/subscription-pool/follow-me/scan` offer shape — **modify** — adds card fields + FD2 agents (server-resolved); no gating change.
+- Approve → `/mandate/issue-for-machine` — **pass-through** — unchanged PIN-gated route; the client now calls it with a server-resolved agents pair instead of nothing.
+- No new block/allow gate is introduced.
+
+## 1. Over-block
+No block/allow surface — over-block not applicable. (The card renders only when the scan offers a candidate; the Approve POST is the existing PIN-gated route, unchanged.)
+
+## 2. Under-block
+No block/allow surface — under-block not applicable. The PIN gate, deny-by-default mandate gate, and R4a delivered-mandate re-verify are all unchanged and still authoritative at enroll time.
+
+## 3. Level-of-abstraction fit
+Correct layer — pure presentation/wiring. The card is a dashboard view that reads a server-built offer and calls an existing authority (the PIN-gated issue route). No decision logic moved into the client; the agents pair is resolved server-side (the client never composes authority data).
+
+## 4. Signal vs authority compliance
+**Required reference:** docs/signal-vs-authority.md
+- [x] No — this change has no block/allow surface. It renders an offer and calls the existing PIN-gated mandate route; all authority (PIN, deny-by-default gate, R4a bounds+signature) is unchanged and server-side. The client holds zero authority — a forged client payload still hits the PIN gate + the mandate gate + the enroll-time bounds/signature re-verify.
+
+## 5. Interactions
+- **Shadowing:** the scan POST is added to the existing best-effort `Promise.all` in the controller tick, caught independently (a scan failure degrades to "no card", never blanks the accounts list). No shadowing of accounts/pending.
+- **Double-fire:** the Approve listener is delegated and wired ONCE (`state.approveWired`), so re-renders never stack listeners or double-POST; the button disables on submit.
+- **Races:** the scan rides the same aborted-controller guard as the other fetches.
+- **Feedback loops:** none.
+
+## 6. External surfaces
+- **Operator (phone):** the one-tap card now actually appears on the Subscriptions tab and is the panel's lead section. Mobile-complete: tap Approve + PIN; the device-code login link surfaces in the existing Pending Logins panel.
+- **Server:** the scan response gains fields (additive; existing consumers unaffected). No token/fingerprint leaves the server in operator-facing text (agents stay out of the DOM by the card's construction).
+- **No** change to other agents/users or persistent state shapes.
+
+## 6b. Operator-surface quality (Operator-Surface Quality standard)
+This change touches an operator surface (`dashboard/index.html`, `dashboard/subscriptions.js`), so this section is required.
+1. **Leads with the primary action?** Yes — `#subFollowMe` is inserted as the FIRST section of the Subscriptions panel (above Accounts), so the Approve card is the first thing seen when a follow-me offer exists.
+2. **Zero raw internals as primary content?** Yes — the card shows plain language ("Let Mac Mini use your … subscription") + a PIN box + Approve; the FD2 agent fingerprints are resolved server-side and never enter the DOM (verified by the card test); only non-sensitive account/target ids ride as `data-*`.
+3. **Destructive actions de-emphasized?** N/A — the card is constructive (Approve) only.
+4. **Plain language + phone width?** Yes — single-column card, plain labels, password PIN field, one button; status messages are plain English ("Approved — the machine is logging in now…").
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+**Proxied/served from the fronting machine, by construction.** The scan runs on the machine serving the dashboard (the operator's single dashboard) and offers to enroll OTHER machines that lack the account (peer-views). The Approve issues a cross-machine mandate (`issue-for-machine`) delivered to the target; the FD2 agents are this Echo identity's fingerprint (issuer === target identity). The login link surfaces on the fronting machine's existing Pending Logins panel. No machine-local stranding (the mandate + delivery are the existing durable cross-machine path); the dashboard is the single operator surface (honors one-dashboard).
+
+## 8. Rollback cost
+Pure dashboard/route-shape change behind the existing dev-agent gate (dark on fleet). Back-out = revert; no persistent state, no migration. Reverting removes the card wiring (back to the render functions being unused) and the scan's extra fields (additive — harmless if a stale client reads them).
+
+## Conclusion
+This change closes the Live-User-Channel-Proof gap that the previous PR left: the card now renders on the real dashboard and the Approve tap drives the real PIN-gated issue route, verified by a new controller integration test (`follow-me-controller-wiring`) plus the existing card/payload unit tests (47 tests green, tsc clean). No new authority or block surface. Clear to ship; the operator-tap → deliver → enroll → answer chain is exercised live in the proof itself.
+
+## Evidence pointers
+- `npx tsc --noEmit` — clean.
+- `npx vitest run` (6 files) — 47/47 pass, incl. the new `follow-me-controller-wiring` (drives fetch-scan → render → Approve → POST issue).