instar 1.3.623 → 1.3.624

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.623",
+  "version": "1.3.624",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-19T00:47:21.118Z",
-  "instarVersion": "1.3.623",
+  "generatedAt": "2026-06-19T02:52:10.913Z",
+  "instarVersion": "1.3.624",
   "entryCount": 201,
   "entries": {
     "hook:session-start": {
@@ -418,7 +418,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:agents": {
@@ -426,7 +426,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:backups": {
@@ -434,7 +434,7 @@
       "type": "route-group",
       "domain": "operations",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:git": {
@@ -442,7 +442,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:memory": {
@@ -450,7 +450,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:semantic": {
@@ -458,7 +458,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:status": {
@@ -466,7 +466,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:capabilities": {
@@ -474,7 +474,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:project-map": {
@@ -482,7 +482,7 @@
       "type": "route-group",
       "domain": "mapping",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:coherence": {
@@ -490,7 +490,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:topic-bindings": {
@@ -498,7 +498,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:context": {
@@ -506,7 +506,7 @@
       "type": "route-group",
       "domain": "context",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:scope-coherence": {
@@ -514,7 +514,7 @@
       "type": "route-group",
       "domain": "coherence",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:canonical-state": {
@@ -522,7 +522,7 @@
       "type": "route-group",
       "domain": "state",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:ci": {
@@ -530,7 +530,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:sessions": {
@@ -538,7 +538,7 @@
       "type": "route-group",
       "domain": "sessions",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:jobs": {
@@ -546,7 +546,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:skip-ledger": {
@@ -554,7 +554,7 @@
       "type": "route-group",
       "domain": "scheduling",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:telegram": {
@@ -562,7 +562,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:attention": {
@@ -570,7 +570,7 @@
       "type": "route-group",
       "domain": "communication",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:relationships": {
@@ -578,7 +578,7 @@
       "type": "route-group",
       "domain": "relationships",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:feedback": {
@@ -586,7 +586,7 @@
       "type": "route-group",
       "domain": "feedback",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:updates": {
@@ -594,7 +594,7 @@
       "type": "route-group",
       "domain": "updates",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:dispatches": {
@@ -602,7 +602,7 @@
       "type": "route-group",
       "domain": "dispatches",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:quota": {
@@ -610,7 +610,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:publishing": {
@@ -618,7 +618,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:private-views": {
@@ -626,7 +626,7 @@
       "type": "route-group",
       "domain": "publishing",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:tunnel": {
@@ -634,7 +634,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:events": {
@@ -642,7 +642,7 @@
       "type": "route-group",
       "domain": "networking",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:evolution": {
@@ -650,7 +650,7 @@
       "type": "route-group",
       "domain": "evolution",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:watchdog": {
@@ -658,7 +658,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:topic-memory": {
@@ -666,7 +666,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:state-sync": {
@@ -674,7 +674,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:intent": {
@@ -682,7 +682,7 @@
       "type": "route-group",
       "domain": "intent",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:triage": {
@@ -690,7 +690,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:operations": {
@@ -698,7 +698,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:sentinel": {
@@ -706,7 +706,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:trust": {
@@ -714,7 +714,7 @@
       "type": "route-group",
       "domain": "safety",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:monitoring": {
@@ -722,7 +722,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:commitments": {
@@ -730,7 +730,7 @@
       "type": "route-group",
       "domain": "commitments",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:episodes": {
@@ -738,7 +738,7 @@
       "type": "route-group",
       "domain": "memory",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:messages": {
@@ -746,7 +746,7 @@
       "type": "route-group",
       "domain": "coordination",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:system-reviews": {
@@ -754,7 +754,7 @@
       "type": "route-group",
       "domain": "monitoring",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "route-group:machine-mesh": {
@@ -770,7 +770,7 @@
       "type": "route-group",
       "domain": "security",
       "sourcePath": "src/server/routes.ts",
-      "contentHash": "a68a3c72eac278d5e5a7d0264e60a7a925e9e5df4ac0c428456525b64535e746",
+      "contentHash": "81524511cfacdc92599b1d994788849aa2563b92a9ae21ecbeb4c14f989df56b",
       "since": "2025-01-01"
     },
     "cli:init": {

package/upgrades/1.3.624.md

@@ -0,0 +1,23 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+Completes the last step of the account-follow-me login. The `url-code-paste` login (letting one machine use another's subscription) is two parts: open the link and sign in, then paste back the **code** the provider hands you. The dashboard card showed the "Sign in" link but had nowhere to put the code — in the live run the operator signed in, got a code, and had to route it through chat for the agent to paste by hand. This adds a code field right on the pending-login card, plus the routing to deliver it off-chat: a target-local route types the code into the waiting login pane and drives to a real outcome (S7 email-gate → add to pool), and a fronting relay carries the code one authed hop from the operator's single dashboard to the machine that owns the login. Hardened from a 4-round cross-model (codex) review: pane derivation via a single shared helper, single-token code-shape validation, a `url-code-paste` kind guard, a pane-**readiness** check (refuses if the pane dropped to a shell, so the code is never typed into a shell), a per-login in-flight mutex, best-effort scrollback clear after submit, and a greppable terminal-outcome log. Dev-gated (`multiMachine.accountFollowMe`), dark on the fleet.
+
+## What to Tell Your User
+
+When you let one of your machines borrow another's subscription, signing in is now self-serve from the dashboard. After you tap "Sign in" and authenticate, paste the code the page gives you into the box right there on the card and tap Submit — it goes straight to the machine doing the login over the secure connection, never through chat. The card then updates to "Done." No more sending a sign-in code through a message for me to paste by hand.
+
+## Summary of New Capabilities
+
+- **Paste your sign-in code on the card (off-chat).** The account-follow-me pending-login card now has a code field + "Submit code" button for the two-part Claude sign-in. The code travels over the authenticated dashboard API to the machine doing the login — never through chat — and the card shows the real outcome (done / finishing / needs another try). Dev-gated; dark on the fleet.
+
+## Evidence
+
+- `tests/integration/account-follow-me-submit-code-route.test.ts` — 12 tests over the full HTTP pipeline (target route + fronting relay): dark→503, missing/whitespace/control-char code→400, wrong-kind→409, no-pending→404, pane-not-at-prompt→409 (code never typed), concurrent double-submit→409 (mutex), happy-path→201 validated (code typed, value never echoed in the response), self→loopback relay→201, unreachable peer→502.
+- `tests/unit/framework-login-driver.test.ts` — 17 tests incl. the shared `enrollPaneSessionName` helper (regression guard against pane-name drift between spawn and submit).
+- `tests/unit/subscriptions-render.test.ts` (28) + `tests/unit/follow-me-controller-wiring.test.ts` (6) — the code field renders only for `url-code-paste` logins, and a Submit tap POSTs `{id, machineId, code}` to the relay (empty field does not POST).
+- `npx tsc --noEmit` clean; `pnpm build` clean.

package/upgrades/side-effects/ws52-code-paste-back.md

@@ -0,0 +1,105 @@
+# Side-effects review — WS5.2 Account Follow-Me operator code paste-back
+
+Spec: `docs/specs/ws52-code-paste-back.md` · ELI16: `docs/specs/ws52-code-paste-back.eli16.md`
+Parent principle: Operator-Surface Quality (constitution → Interaction family)
+
+## What the change is
+
+The account-follow-me `url-code-paste` login is a two-part flow: (1) the operator opens the
+verification URL and authenticates, (2) the provider hands back an authorization code that must
+be pasted into the waiting `claude auth login` process. The dashboard card surfaced part 1 but
+had no field for part 2, so the operator (live proof 2026-06-18) ended up routing the code through
+Telegram and the agent relayed it by hand. This adds: a code field on the card, a target-local
+route that types the code into the waiting pane and drives to a real outcome, and a fronting relay
+so the operator's single dashboard hands the code one authed hop to the machine owning the pane.
+
+Files: `src/server/routes.ts` (two routes + per-login mutex), `src/core/FrameworkLoginDriver.ts`
+(shared `enrollPaneSessionName` helper), `src/commands/server.ts` (use the shared helper),
+`dashboard/subscriptions.js` (code field + `wireCodeSubmit`). Tests: route integration,
+render unit, controller-wiring unit, helper unit.
+
+## 1. Over-block — legitimate inputs rejected that shouldn't be
+
+The code-shape validation rejects any value containing whitespace or control chars. Some users
+paste a code with surrounding whitespace — handled: the **client trims** leading/trailing
+whitespace before submitting, and the server validates the trimmed value, so harmless surrounding
+whitespace is tolerated; only embedded whitespace/control chars (which would break pane input) are
+rejected. The validation is reject-unsafe, not enumerate-allowed (FD11), so unusual but valid
+provider code charsets (punctuation, URL-safe base64) are accepted.
+
+## 2. Under-block — failure modes still missed
+
+- A genuinely malformed but whitespace-free code is accepted and typed into the pane; the provider
+  rejects it and the login stays open. Mitigation: the client surfaces an honest "re-tap the
+  sign-in link" message on a non-validated outcome; no false "done".
+- If the pane reconstruction were wrong, the code would go nowhere. Mitigated structurally: the
+  pane name is derived through the single shared `enrollPaneSessionName` helper used by BOTH the
+  spawn and this route (cannot drift), plus a pane-existence check (409 if not waiting).
+
+## 3. Level-of-abstraction fit
+
+Correct layer. The routes sit alongside the existing `/subscription-pool/follow-me/enroll/*`
+routes and reuse the proven follow-me machinery: the S7 email-gate (`completeFollowMe`) is the
+account validator, `SubscriptionPool.add` the sink, `resolvePeerUrls()` the cross-machine hop,
+`SessionManager.sendInput` (already argv-safe) the pane delivery. No new subsystem; the only new
+shared primitive (`enrollPaneSessionName`) de-duplicates a formula that previously lived in two
+places.
+
+## 4. Signal vs authority compliance
+
+No brittle blocking authority added. The routes are dev-gated (503 when off) and deny-by-default
+via the existing enroll gate. They carry **no new credential-returning authority**; they add a
+**narrow paste-back authority** (typing the operator's own single-use code into the operator's own
+login) bounded by: dev-gate, Bearer-auth, the `url-code-paste` kind guard, the pending-login
+lookup, the pane-existence check, the single-token code-shape validation, and the per-login
+in-flight mutex. The actual account-acceptance decision remains the S7 identity-oracle email gate
+(unchanged) — file-existence is only a trigger, never the validator.
+
+## 5. Interactions
+
+- Reuses `completeFollowMe` → identical email-gate behavior as the existing complete route
+  (validated/held/HIGH-attention-on-mismatch). No new account ever bypasses S7.
+- The per-login in-flight mutex prevents two rapid submits from interleaving into one pane; the
+  client also disables the button on submit (defense in depth).
+- A successful submit removes the pending login (via `completeFollowMe`), so a replay is a 404 —
+  one-shot by construction, layered on the provider's single-use code.
+- No shadowing/double-fire with the reissue/complete sweep: on poll-timeout the route returns
+  `submitted` and the existing sweep finishes the login (the route does not duplicate that path).
+
+## 6. External surfaces
+
+- New dashboard UI element (code field + Submit button) on the Subscriptions tab pending-login
+  card — operator-facing, off-chat. No raw internals exposed (login id / machineId are
+  de-emphasized data attributes, not displayed). Operators act in taps + a single paste.
+- The OAuth authorization code travels over the Bearer-authed API + authed mesh hop ONLY, never
+  any chat/messaging surface. It is never stored or logged (value redacted; only a greppable
+  terminal-outcome key is logged).
+- No change visible to other agents.
+
+## 7. Multi-machine posture (Cross-Machine Coherence)
+
+Machine-local execution, proxied-on-WRITE by design (FD9). The login pane is inherently
+machine-local (a tmux pane on the target's disk). The operator's SINGLE fronting dashboard calls
+the relay; the relay forwards one authed hop to the pane's owning machine via `resolvePeerUrls()`
+(self → loopback). No durable state is introduced that could strand on a topic transfer (the only
+state is the existing `PendingLogin`); no URLs are generated that must survive a machine boundary;
+an offline target returns an honest 502, never a false ok. Single-machine agents: the relay calls
+local — a no-op difference.
+
+## 8. Rollback cost
+
+Cheap. The feature is dev-gated (`multiMachine.accountFollowMe`) and dark on the fleet. Back-out
+is reverting the four source files; no data migration, no persistent schema, no agent-state repair
+(the only state touched is the existing transient `PendingLogin`, unchanged in shape). The static
+dashboard JS is served from disk per-request, so a client revert needs no restart.
+
+## Cross-model review note
+
+Codex (gpt-5.5) reviewed across rounds: round 1 surfaced 6 findings (pane-name drift, code
+escaping, replay/one-shot, authority framing, weak completion oracle, UX code ambiguity) — all
+addressed (shared helper, code-shape validation, kind guard + login-removal one-shot, S7-as-
+validator clarification, client copy). Round 2 surfaced MINOR refinements (concurrent-submit
+mutex, explicit charset/cap, client trim, "submitted"-is-success-pending, authority wording) —
+all addressed (mutex code + FD10–FD12 + Decision-Points rewording). Gemini degraded (timeout) and
+is recorded as such. The Standards-Conformance Gate flagged Observability (addressed via the
+greppable terminal-outcome log).