instar 1.3.930 → 1.3.932

package/dashboard/subscriptions.js

@@ -471,6 +471,7 @@ export function renderPendingLogins(doc, target, logins, now = Date.now(), outco
 /** Pivot the pool-scope + pending-scope bodies into a grid model. Pure + testable. */
 export function buildMatrixModel(poolScope, pendingScope, transient = {}) {
   const accountRows = (poolScope && Array.isArray(poolScope.accounts)) ? poolScope.accounts : [];
+  const gapRows = (poolScope && Array.isArray(poolScope.emailGaps)) ? poolScope.emailGaps : [];
   const pendingRows = (pendingScope && Array.isArray(pendingScope.logins)) ? pendingScope.logins : [];
   const failed = (poolScope && poolScope.pool && Array.isArray(poolScope.pool.failed)) ? poolScope.pool.failed : [];
   const selfMachineId = (poolScope && poolScope.pool && poolScope.pool.selfMachineId) || null;
@@ -485,6 +486,15 @@ export function buildMatrixModel(poolScope, pendingScope, transient = {}) {
     if (!mid || offlineMachineIds.has(mid)) continue;
     if (!machines.has(mid)) machines.set(mid, { machineId: mid, nickname: (a.machineNickname || mid), offline: false });
   }
+  for (const gap of gapRows) {
+    const mid = gap && gap.machineId;
+    if (!mid || offlineMachineIds.has(mid)) continue;
+    if (!machines.has(mid)) machines.set(mid, {
+      machineId: mid,
+      nickname: gap.machineNickname || mid,
+      offline: false,
+    });
+  }
   for (const f of failed) {
     const mid = f && f.machineId;
     if (!mid) continue;
@@ -500,6 +510,13 @@ export function buildMatrixModel(poolScope, pendingScope, transient = {}) {
     if (!accounts.has(id)) accounts.set(id, { accountId: id, email: a.email || id });
     else if (!accounts.get(id).email && a.email) accounts.get(id).email = a.email;
   }
+  for (const gap of gapRows) {
+    const id = gap && gap.accountId;
+    if (id && !accounts.has(id)) accounts.set(id, {
+      accountId: id,
+      email: gap.nickname || id,
+    });
+  }
   // A pending matrix login can reference an account not yet in any pool row — surface its row too.
   for (const l of pendingRows) {
     const id = l && l.id;
@@ -529,6 +546,11 @@ export function buildMatrixModel(poolScope, pendingScope, transient = {}) {
   for (const l of pendingRows) {
     if (l && l.id && l.machineId) inProgress.set(`${l.id}::${l.machineId}`, l);
   }
+  const emailMissing = new Set(
+    gapRows
+      .filter((gap) => gap && gap.accountId && gap.machineId)
+      .map((gap) => `${gap.accountId}::${gap.machineId}`),
+  );
 
   const machineList = Array.from(machines.values());
   const accountList = Array.from(accounts.values());
@@ -552,6 +574,7 @@ export function buildMatrixModel(poolScope, pendingScope, transient = {}) {
       if (m.offline) state = 'offline';                              // whole column offline (FD6)
       else if (t && t.state === 'held') state = 'held';
       else if (t && t.state === 'cant-resolve') state = 'cant-resolve';
+      else if (emailMissing.has(key) || (t && t.state === 'email-missing')) state = 'email-missing';
       // Durable pending state wins over enrollment bookkeeping after restart: the
       // full flow rehydrates into its cell even if the pool row still says Active.
       // broken (D5): the server says this attempt's sign-in pane is DEAD (record ⟂ pane
@@ -586,12 +609,13 @@ export function buildMatrixModel(poolScope, pendingScope, transient = {}) {
 
 const MATRIX_CELL_GLYPH = {
   active: '✓', 'needs-reauth': '⟳', 'in-progress': '◷', offline: '—', held: '⚠', 'cant-resolve': '✗',
-  expired: '✗', 'just-verified': '✓', broken: '✗',
+  'email-missing': '⚠', expired: '✗', 'just-verified': '✓', broken: '✗',
 };
 const MATRIX_CELL_WORD = {
   active: 'Active', 'needs-reauth': 'Needs sign-in', 'in-progress': 'Signing in…',
   offline: 'Machine offline', held: 'Didn’t match — re-try', 'cant-resolve': 'Can’t set up', other: 'Set up',
-  expired: 'Sign-in link expired', 'just-verified': 'Set up complete', broken: 'Sign-in needs a restart',
+  'email-missing': 'Account record is missing its email', expired: 'Sign-in link expired',
+  'just-verified': 'Set up complete', broken: 'Sign-in needs a restart',
 };
 
 /** D5 wording floor: never show a raw internal machine id (m_<hex>) to the operator —
@@ -700,17 +724,21 @@ export function renderAccountMatrix(doc, target, poolScope, pendingScope, transi
       const td = el(doc, 'td', `sub-matrix-cell sub-matrix-${c.state}${justVerified && c.state !== 'just-verified' ? ' sub-matrix-just-verified' : ''}`);
       // Stable cell identity for the interaction-hold rule + targeted merge updates (F9).
       td.setAttribute('data-cell-key', sanitizeForDisplay(`${c.accountId}::${c.machineId}`, 'url'));
-      if (c.state === 'empty' || c.state === 'needs-reauth' || c.state === 'held' || c.state === 'cant-resolve' || c.state === 'expired' || c.state === 'broken') {
+      if (c.state === 'empty' || c.state === 'needs-reauth' || c.state === 'held' || c.state === 'cant-resolve' || c.state === 'email-missing' || c.state === 'expired' || c.state === 'broken') {
         // An actionable cell → a button that runs the SAME in-dashboard sign-in flow (PIN → link →
         // paste code). empty → "Set up"; needs-reauth (an existing account whose login expired) →
         // "Sign in"; held/cant-resolve/expired/broken → "Retry". A needs-reauth account already
         // resolves to its email, so the start-cell orchestrator drives a real re-auth — never a
         // cosmetic button, and a broken (dead-pane) attempt is superseded server-side on Retry.
-        const label = c.state === 'empty' ? 'Set up' : (c.state === 'needs-reauth' ? 'Sign in' : 'Retry');
+        const label = c.state === 'empty' ? 'Set up'
+          : c.state === 'needs-reauth' ? 'Sign in'
+          : c.state === 'email-missing' ? 'Repair identity'
+          : 'Retry';
         const btn = el(doc, 'button', 'sub-matrix-setup', label);
         btn.setAttribute('data-matrix-setup', '1');
         btn.setAttribute('data-account-id', sanitizeForDisplay(c.accountId, 'label'));
         btn.setAttribute('data-machine-id', sanitizeForDisplay(c.machineId, 'label'));
+        if (c.state === 'email-missing') btn.setAttribute('data-email-repair', '1');
         if (c.state !== 'empty') {
           // Show the status word ("⟳ Needs sign-in" / "⚠ Didn't match…") ABOVE the button.
           td.appendChild(el(doc, 'div', 'sub-matrix-glyph', `${MATRIX_CELL_GLYPH[c.state]} ${MATRIX_CELL_WORD[c.state]}`));
@@ -1197,6 +1225,7 @@ export function createController(opts) {
     if (!cell) return;
     const accountId = btn.getAttribute('data-account-id');
     const machineId = btn.getAttribute('data-machine-id');
+    const emailRepair = btn.getAttribute('data-email-repair') === '1';
     if (!accountId || !machineId) return;
     // A retry clears the previous attempt's terminal presentation for this cell.
     delete state.matrixTransient[`${accountId}::${machineId}`];
@@ -1212,6 +1241,7 @@ export function createController(opts) {
     confirm.setAttribute('data-matrix-confirm', '1');
     confirm.setAttribute('data-account-id', accountId);
     confirm.setAttribute('data-machine-id', machineId);
+    if (emailRepair) confirm.setAttribute('data-email-repair', '1');
     cell.appendChild(confirm);
     // An explicit way OUT of the interaction (the hold would otherwise pin the cell
     // forever if the operator changes their mind) — client-side only, nothing started yet.
@@ -1237,6 +1267,7 @@ export function createController(opts) {
     if (!cell) return;
     const accountId = btn.getAttribute('data-account-id');
     const machineId = btn.getAttribute('data-machine-id');
+    const emailRepair = btn.getAttribute('data-email-repair') === '1';
     const pinInput = cell.querySelector('.sub-matrix-pin');
     const pin = pinInput ? pinInput.value.trim() : '';
     if (!accountId || !machineId) { setCellStatus(cell, 'Couldn’t prepare this — please refresh.'); return; }
@@ -1245,6 +1276,22 @@ export function createController(opts) {
     btn.setAttribute('disabled', '1');
     void (async () => {
       try {
+        if (emailRepair) {
+          const r = await postJson(`/subscription-pool/${encodeURIComponent(accountId)}/repair-email`, { pin });
+          if (pinInput) pinInput.value = '';
+          if (r.ok) {
+            cell.removeAttribute('data-interaction-open');
+            setCellStatus(cell, '✓ Account identity repaired.');
+            await tick();
+            return;
+          }
+          const msg = r.json && r.json.error
+            ? r.json.error
+            : 'Couldn’t verify this account from its signed-in credential.';
+          setCellStatus(cell, msg);
+          btn.removeAttribute('disabled');
+          return;
+        }
         const r = await postJson(URLS.startCell, { accountId, machineId, pin });
         if (pinInput) pinInput.value = ''; // PIN is memory-only — clear it immediately
         if (r.ok && r.json && r.json.verificationUrl) {
@@ -1257,8 +1304,15 @@ export function createController(opts) {
             ttlExpiresAt: r.json.ttlExpiresAt, notice: r.json.notice, kind: r.json.kind,
           });
         } else if (r.status === 409) {
-          state.matrixTransient[`${accountId}::${machineId}`] = { state: 'cant-resolve', at: now() };
-          setCellStatus(cell, 'Can’t set this account up here — its details couldn’t be resolved.');
+          const code = r.json && r.json.code;
+          state.matrixTransient[`${accountId}::${machineId}`] = {
+            state: code === 'account-record-missing-email' ? 'email-missing' : 'cant-resolve',
+            at: now(),
+          };
+          const message = r.json && r.json.error
+            ? r.json.error
+            : 'Can’t set this account up here — its identity details could not be verified.';
+          setCellStatus(cell, message);
           btn.removeAttribute('disabled');
         } else {
           const msg = (r.json && (r.json.error || r.json.reason)) ? (r.json.error || r.json.reason) : `failed (${r.status})`;

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA4EH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA0BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA8H7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAgFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAuID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA+rDD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CAwtBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA24pBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA4EH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAU3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA0BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA8H7D,OAAO,KAAK,EAAW,oBAAoB,EAAe,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAgFtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAuID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA+rDD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CAwtBN;AAgmBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAs7pBtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -12165,6 +12165,7 @@ export async function startServer(options) {
         // compat); only UNKNOWN mode (corrupt on-disk) raises a HIGH attention item, never throws.
         const { CredentialLocationLedger, shouldBootSeedCredentialLedger, shouldRunIdentityAudit } = await import('../core/CredentialLocationLedger.js');
         const { CredentialIdentityOracle } = await import('../core/CredentialIdentityOracle.js');
+        const credentialIdentityOracle = new CredentialIdentityOracle();
         const { CredentialLocationGate } = await import('../core/CredentialLocationGate.js');
         const credentialGateEmitAttention = telegram
             ? (item) => void telegram.createAttentionItem({
@@ -12180,9 +12181,24 @@ export async function startServer(options) {
         const credentialLocationLedger = new CredentialLocationLedger({
             stateDir: config.stateDir,
             pool: subscriptionPool,
-            oracle: new CredentialIdentityOracle(),
+            oracle: credentialIdentityOracle,
             emitAttention: credentialGateEmitAttention,
         });
+        // One-shot legacy identity reconciliation. It reads only each record's own
+        // credential slot through the real provider oracle; unresolved gaps remain
+        // quarantined and visible instead of being guessed from metadata.
+        const { repairMissingSubscriptionEmails } = await import('../core/SubscriptionAccountEmailRepair.js');
+        const { SubscriptionAccountEmailRegistrar, SubscriptionEmailReconciliationBarrier, } = await import('../core/SubscriptionPool.js');
+        const subscriptionEmailBarrier = new SubscriptionEmailReconciliationBarrier();
+        const subscriptionEmailRegistrar = new SubscriptionAccountEmailRegistrar(subscriptionPool, credentialIdentityOracle, credentialLocationLedger);
+        const runSubscriptionEmailRepair = async () => {
+            const emailRepair = await repairMissingSubscriptionEmails(subscriptionPool, credentialIdentityOracle, credentialLocationLedger);
+            subscriptionEmailBarrier.finish(emailRepair.unresolved);
+            if (emailRepair.repaired.length > 0 || emailRepair.unresolved.length > 0) {
+                console.log(pc.yellow(`  Subscription email reconciliation: ${emailRepair.repaired.length} repaired, ` +
+                    `${emailRepair.unresolved.length} unresolved`));
+            }
+        };
         // The §2.10 env-token gate (Step 8): the §0.b applicability precondition, enforced. Evaluates
         // BOTH `config.anthropicApiKey` (read LIVE per call — restartless) AND the live running fleet's
         // durable per-session `credentialSource` flag, so a mid-run flip to an env token cannot silently
@@ -12424,9 +12440,10 @@ export async function startServer(options) {
         // their respective awaits. isSeeded() does NOT protect this (seedFromOracle bumps version at
         // 'begin', so isSeeded() flips true mid-seed), so the audit gate also checks this flag.
         let credSeedInFlight = false;
-        if (shouldBootSeedCredentialLedger(resolveDevAgentGate(config.subscriptionPool?.credentialRepointing?.enabled, config), credentialLocationLedger.isSeeded())) {
+        const shouldSeedCredentialLedger = shouldBootSeedCredentialLedger(resolveDevAgentGate(config.subscriptionPool?.credentialRepointing?.enabled, config), credentialLocationLedger.isSeeded());
+        const seedCredentialLedger = () => {
             credSeedInFlight = true;
-            void credentialLocationLedger
+            return credentialLocationLedger
                 .seedFromOracle()
                 .then((outcomes) => {
                 const assigned = outcomes.filter((o) => o.result === 'assigned').length;
@@ -12434,7 +12451,21 @@ export async function startServer(options) {
             })
                 .catch((e) => console.warn(`[CredentialLedger] boot seed failed: ${e instanceof Error ? e.message : String(e)}`))
                 .finally(() => { credSeedInFlight = false; });
-        }
+        };
+        // A legacy email gap must be repaired against an already-existing,
+        // independent slot→tenant binding. seedFromOracle derives its candidates
+        // from complete pool rows and clears assignments first, so running it before
+        // repair could erase the only proof for an email-less row. Preserve that
+        // evidence: seed only when there are no quarantined gaps.
+        let credentialSeedReady = shouldSeedCredentialLedger && subscriptionPool.listEmailGaps().length === 0
+            ? seedCredentialLedger()
+            : Promise.resolve();
+        void credentialSeedReady
+            .then(() => runSubscriptionEmailRepair())
+            .catch((error) => {
+            subscriptionEmailBarrier.finish(subscriptionPool.listEmailGaps().length);
+            console.warn(`[subscription-email] reconciliation degraded: ${error instanceof Error ? error.message : String(error)}`);
+        });
         // B3b — the periodic balancer pass. tick() is a strict no-op while the feature resolves dark
         // (so the timer can always run; the gate lives INSIDE tick()), and on a dev agent it runs the
         // full decision loop in dry-run (zero writes). REENTRANCY-GUARDED: a slow tick never overlaps
@@ -12600,8 +12631,8 @@ export async function startServer(options) {
             // WS5.2 §5.3/S7 — the follow-me completion gate reads the minted login's account email
             // from its config-home slot (the Anthropic OAuth profile endpoint) and validates it against
             // operator expectation before the account is selectable. Same oracle the credential-location
-            // ledger uses; constructed fresh here (the ledger's instance is not in scope at this point).
-            oracle: new CredentialIdentityOracle(),
+            // ledger uses; one process-wide oracle keeps identity evidence coherent.
+            oracle: credentialIdentityOracle,
             // A HELD follow-me completion (surprise/mismatched/unverifiable email) raises a HIGH
             // attention item for the operator. Map the email-gate's {id,title,body,priority,source}
             // shape onto the telegram attention-queue createAttentionItem shape.
@@ -12683,13 +12714,13 @@ export async function startServer(options) {
                     // Upsert (D5): a re-auth of an EXISTING pool account updates it back to
                     // active; only a genuinely-new account is added (add() refuses dup ids).
                     if (subscriptionPool.get(login.id)) {
-                        subscriptionPool.update(login.id, {
-                            nickname: login.label, status: 'active', email,
+                        subscriptionEmailRegistrar.completeValidated(login.id, email, {
+                            nickname: login.label, status: 'active',
                             ...(login.configHome ? { configHome: login.configHome } : {}),
                         });
                     }
                     else {
-                        subscriptionPool.add({
+                        subscriptionEmailRegistrar.completeNewValidated({
                             id: login.id, nickname: login.label, provider: login.provider,
                             framework: login.framework, configHome: login.configHome ?? '', status: 'active', email,
                         });
@@ -23272,7 +23303,7 @@ export async function startServer(options) {
         catch (err) { /* @silent-fallback-ok: fleet-dark optional observer; failure is logged and adds no authority */
             console.warn('[AutonomousThroughputFloor] init failed:', err.message);
         }
-        const server = new AgentServer({ config, sessionManager, llmQueue: sharedLlmQueue, state, scheduler, telegram, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, cartographer: cartographer ?? undefined, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, subscriptionPool, accountFollowMePeerViews: async () => { const nickById = new Map((_listPoolMachines?.() ?? []).map((m) => [m.machineId, m.nickname ?? m.machineId])); let peers = (_resolvePeerUrls?.() ?? []).map((p) => ({ machineId: p.machineId, nickname: nickById.get(p.machineId) ?? p.machineId, url: p.url })); if (peers.length === 0) {
+        const server = new AgentServer({ config, subscriptionEmailBinding: credentialLocationLedger, subscriptionEmailBarrier, subscriptionIdentityOracle: credentialIdentityOracle, sessionManager, llmQueue: sharedLlmQueue, state, scheduler, telegram, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, cartographer: cartographer ?? undefined, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, subscriptionPool, accountFollowMePeerViews: async () => { const nickById = new Map((_listPoolMachines?.() ?? []).map((m) => [m.machineId, m.nickname ?? m.machineId])); let peers = (_resolvePeerUrls?.() ?? []).map((p) => ({ machineId: p.machineId, nickname: nickById.get(p.machineId) ?? p.machineId, url: p.url })); if (peers.length === 0) {
                 peers = (_listPoolMachines?.() ?? []).filter((m) => m.machineId !== _meshSelfId && !!m.lastKnownUrl).map((m) => ({ machineId: m.machineId, nickname: m.nickname ?? m.machineId, url: m.lastKnownUrl }));
             } if (peers.length === 0)
                 return []; const { fetchPeerSubscriptionViews } = await import('../core/fetchPeerSubscriptionViews.js'); return fetchPeerSubscriptionViews({ peers: () => peers, fetchImpl: fetch, authToken: config.authToken ?? '' }); }, quotaPoller, quotaAwareScheduler: _quotaAwareScheduler ?? undefined, proactiveSwapMonitor: _proactiveSwapMonitor ?? undefined, inUseAccountResolver, enrollmentWizard, accountFollowMeRevocation, credentialRepointing, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, greenPrAutoMerger: greenPrAutoMerger ?? undefined, guardLatchStore: guardLatchStore ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, topicProfile: _topicProfileCtx ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, meshBindActive: coordinator.managers.identityManager.hasIdentity() && config.multiMachine?.meshTransport?.enabled !== false, localSigningKeyPem, leaseTransport, peerEndpointRecorder, getSelfMeshEndpoints, onLeasePullRequest: () => leaseCoordinatorRef?.currentLease() ?? null, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, conversationRegistry, conversationBindAuth, conversationFollowThrough, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, threadLog, threadMessageRecorder, warrantsReplyGate, collaborationSurfacer, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, threadlineReplyWaiters, listenerManager: listenerManager ?? undefined, a2aDeliveryTracker: a2aDeliveryTracker ?? undefined, responseReviewGate, reviewCanaryBattery, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, ropeHealthMonitor, writeAdmission: writeAdmission ?? undefined, getInboundQueue: () => _inboundQueue, getMachineCoherence: () => _machineCoherenceSentinel, getSingleMachineFailoverGap: () => _singleMachineFailoverGap, getMissingLoginSession: () => _missingLoginSession, getSessionPoolFailoverRunner: () => _sessionPoolFailoverRunnerDriver?.status() ?? null, sessionPoolPromotionActivation: _sessionPoolPromotionActivation, meshRpcDispatcher, deliverA2aToMachine: _deliverA2aToMachine ?? undefined, workingSetPullCoordinator, workingSetArtifactManager, orchestratorPoller, commitmentReplicaStore, preferenceReplicaStore, replicatedRecordEmitter, conflictStore, rollbackUnmerge, droppedOriginRegistry, preferencesUnionReader, forwardCommitmentMutate, sessionOwnershipRegistry, sendDrain: _sendDrain ?? undefined, topicPinStore: _topicPinStore ?? undefined, topicPinSkewQuarantine: _topicPinSkewQuarantine ?? undefined, topicPinFoldView: _topicPinFoldView ?? undefined, ownershipReconciler: _ownershipReconciler ?? undefined, staleOwnerEngine: _staleOwnerEngine ?? undefined, duplicateReconciler: _duplicateReconciler ?? undefined, ownerDarkLadder: _ownerDarkLadder ?? undefined, spawnAdmission: _spawnAdmission ?? undefined, judgmentProvenance: _judgmentProvenance ?? undefined, leaseHandback: _leaseHandbackCtx ?? undefined, streamTicketStore: _streamTicketStore ?? undefined, poolStreamAllowRemoteInput: config.dashboard?.poolStream?.allowRemoteInput ?? false, poolStreamConnector: _poolStreamConnector ?? undefined, secretSync: _secretSyncHandle ?? undefined, meshSelfId: _meshSelfId ?? undefined, resolveRouterUrl: _resolveRouterUrl ?? undefined, resolvePeerUrls: _resolvePeerUrls ?? undefined, guardRegistry, listPoolMachines: _listPoolMachines ?? undefined, deliverMandateToMachine: _deliverMandateToMachine ?? undefined, poolLink: _poolLink ?? undefined, poolPollCache: _poolPollCache ?? undefined, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, agentWorktreeReaper, externalHogSentinel, orphanedWorkSentinel, mcpProcessReaper, geminiLoopRunner, sleepController, agentActivityState, reapLog, resumeQueue, resumeDrainer, autonomousLivenessReconciler, enforcedTerminationStatus: () => enforcedTerminationWatchdog?.guardStatus() ?? null, prHandLease: prHandLease ?? undefined, operatorStopRecorder: recordOperatorStop, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier, liveTestGate, liveTestGateMode, liveTestRunnerCtx }); // Resolve the late-bound topic-operator getter (increment 2e): routing was