carlos / platform Public

Fleet reloads currently publish token hashes before reading account ownership, and a dynamic tunnel can finish registering after detach or rotation. This change reads each credential/account pair from one SQLite snapshot, publishes one hub view, serializes fleet reloads, and rechecks dynamic authority when installing the connection. Detach closes only the exact removed connection; established connections retain the existing rotation behavior.

Bounded follow-up to paid-launch review211, based on verified9409. Seven files only; no schema, projection, lease, policy, public wording, billing activation or deployment change. Actual Opus design review accepted C1-C9. Real-handler regressions fail on9409; focused and complete edge/registry normal and race tests pass, with removal-of-lock and removal-of-recheck mutants caught. Actual Opus code/composition review and exact472458 host-exception validation/independent audit/CI are still running; this request is a checkpoint, not integrated acceptance. Original monolithic failures remain preserved. No main merge or deployment authorized.