COMMY_SUBSCRIBE bootstraps a bot; the realm holds its subscriptions (comms-g5zh.4, .5, .8)

[GraemeF]

COMMY_SUBSCRIBE bootstraps a bot account and is then inert. A seat's
subscriptions live in the realm under its own principal, and on the way up a
seat asks the realm what it is subscribed to instead of replaying a local copy.

Closes comms-g5zh.4, comms-g5zh.5, comms-g5zh.8, comms-9iro, comms-deg1.

What changes for an operator

Editing COMMY_SUBSCRIBE for a bot that already exists now does nothing. It
is applied when the bot is created and never read again; from then on the agent
owns its subscriptions and changes them with the subscribe / unsubscribe
tools. To start over from the launcher, delete the bot.

That is the point of the change rather than a side effect of it. While a
launcher value and an agent's own calls were both authoritative, the same
COMMY_SUBSCRIBE read at two launches of one bot was indistinguishable from the
bot's own runtime changes, and the two quietly fought.

On upgrade, a bot that already existed is not bootstrapped retroactively — it
keeps whatever the realm holds for it, and a bot that finds itself with nothing
can subscribe to what it wants. Worth knowing: every pinned bot crosses this
upgrade with an empty own-subscription set, because before the seat-owned
architecture the minter held the subscriptions. "Empty" here is universal and is
an artefact of the migration, not a signal about any particular bot's intent.
What keeps a pane hearing its project channel is the Type-1 defaults, which are
computed per boot on a separate path and are untouched by this.

How "once" is decided

AcquiredIdentity now carries the origin of the bind — whether the acquire
created the identity or bound to one that was already there. Both substrates
already computed this and threw it away: Zulip's acquire is a lookup that mints
on miss, and the memory adapter's registration has the same shape. So this reads
the substrate's answer rather than inferring one, which matters because every
available inference is wrong in a way that only shows in production — "has no
subscriptions" cannot tell a never-seeded bot from one that deliberately
unsubscribed from everything.

The seeding rides whichever path mints the seat: the boot acquire for a
persistent bot, the post-acquire hook for an ephemeral one. That closes a gap the
old boot-only seeding had — a seat whose session id had not arrived by boot used
to end up with its tokens in a client-side filter over a stream it was never
subscribed to.

An earlier draft of this branch carried a durable "already seeded" ledger, for
the population with no mint left to observe. It is gone: under the
leave-already-empty-alone ruling every branch of that reconciliation ends in
"don't apply", so nothing needed recording between boots.

Resume stops being restore

New port verb inbox.subscriptions() reads back the channels the realm delivers
to this seat, from the rows under its own principal. A local copy can disagree
with delivery; the realm's answer cannot.

What a subscription row cannot express is narrowing below a channel —
#chan/topic and new-topics:#chan both read back as plain #chan — so
rebuilding from the realm alone would silently widen every topic subscription
into its whole channel. The persisted record therefore shrinks to topic-level
intents only, and the rule is that each realm channel becomes a channel-wide
narrow unless a topic intent names it. Channel-wide intents are no longer
persisted at all.

The rebuild runs for both modes, which is what pays for it. A pinned pane has
no session record — its id is new every launch — so it used to come up with
nothing but its boot-time defaults while the realm went on delivering every
channel it had ever joined at runtime. That seat gets recovery for the first
time; the ephemeral seat merely stops being a special case. It also removes the
persisted-vs-realm divergence class by construction.

Reading never mints. A seat with no identity has no subscription rows either, so
the honest answer is "nothing" rather than "mint a bot and go and look" — the
rebuild reads only when the seat is already bound, or when a topic record proves
its bot already exists.

Known ceiling, documented rather than fixed: a topic-level intent an agent
creates at runtime still lives only in the local record. Zulip can hold topic
intent (POST /user_topics with visibility_policy: FOLLOWED) but does not
deliver against it, so recording it there would demote the local record from
authority to cache. Deliberately out of scope here — this change removes state,
and adding a realm write is a different kind of change with its own risks.

A boot deadlock, found while verifying something else

The ephemeral post-acquire hook blocks on the queue-resume verdict, and since
subscriptions moved to the seat's own principal the boot-time subscribe binds —
so that hook runs on the boot fiber. The verdict was reported only by the
events producer, which startEventPump materialises as the last step of boot. A
seat that bound at boot parked on a deferred only a step it would never reach
could complete: every ephemeral seat with COMMY_SUBSCRIBE set hung before
announcing its tools.

Fixed at the root rather than with a timeout: an absent queue-state answers the
verdict on its own, so boot reports it before anything can bind. A present
queue-state is still not an answer — whether that queue is alive is only knowable
by polling it — so the producer keeps reporting that case.

This did not reach the fleet, which runs the published pre-#209 plugin, and no
existing test could see it: the integration harness pre-completes that deferred,
and the one boot test that sets COMMY_SUBSCRIBE in ephemeral mode uses a fake
whose subscribe does not bind.

Tests

Two regressions pin properties held by the order of boot steps, which nothing
else would notice changing: boot completes with a genuinely uncompleted resume
verdict, and a listen-only seat runs its catch-up at boot with zero tool calls
(comms-9iro, now resolved — subscribing binds, so the seat acquires at boot and
the hook carrying catch-up fires there).

The contract suite gains inbox.subscriptions(), including that a topic-level
narrow reads back as its plain channel — the ceiling every caller designs around.

clients/claude-code/hooks-manifest.test.ts pins the set of adapter declarations
reaching boundHttp; subscriptions joins it deliberately. It is the one read
in that set, and it belongs there for a different reason than the writes: it asks
what the realm holds for this seat, so only the seat's own credential can
answer it.