abkslmandClaude Fable 5
031627ad1c
Completes §0.2 item 4. HostMsg.runnerPoolCredential (WireRunnerPoolCredential: poolId/secret/url/updatedAt) is pushed post-hello to control-scope peers the way relayMembership is (SyncHost.register → ConnectionHandler gate → defaulted SyncHostBridge.runnerPoolCredential hook), so every trusted mesh device manages the SAME pool instead of PoP-enrolling its own — which rotates the secret out from under whoever shared it. Receivers converge on updatedAt (newest wins): PeerClient routes the push into AppStore.mergeRunnerPoolCredential, which persists it and hands it to any in-flight RunnerPoolClient. The credential store upgrades to a JSON record (legacy bare "poolId.secret" tolerated as distantPast, so any shared revision supersedes it). RunnerPoolClient now manages the STORED credential's pool (possibly another device's), resolves the control-plane URL the credential carries, and only auto-re-enrolls on 401 for its OWN pool — a rotated shared credential surfaces "re-share from the owning Mac" rather than silently creating the wrong pool. iOS handles the new event inertly (Macs are the pool managers today). Verified: Darwin builds (app + iOS), wire round-trip/tolerance + sync suites green. Co-Authored-By: Claude Fable 5 <[email protected]>