Commit f7db359

load-bearing mechanic is a proxy that makes the caller's **real upstream request**, injects the

credential server-side and relays the answer verbatim. We never model an upstream API.

Everything else in this file is guidance; these are the contract, and they win over any other passage.

| `TREG_GOOGLE_CLIENT_ID` / `_SECRET` | *(empty)* | Google OAuth sign-in (redirect `<public_url>/auth/google/callback`); empty hides the button |

| `TREG_INSTAGRAM_CLIENT_ID` / `_SECRET` | *(empty)* | Instagram App ID and secret for direct Instagram Login (redirect `<public_url>/oauth/callback`) |

| `TREG_META_CLIENT_ID` / `_SECRET` | *(empty)* | Meta app credentials for Facebook Pages, Meta Ads, and optional Instagram `page-tools` |

| `TREG_RESEND_API_KEY` / `TREG_EMAIL_FROM` | *(empty)* | transactional email via Resend (OTP codes + invites); From must be a Resend-verified sender |

| `TREG_BLOCKED_EMAIL_DOMAINS` | *(empty)* | comma-separated email domains refused at every sign-up/sign-in door and at team creation (subdomains included, case-insensitive). Empty blocks nothing — no list ships in the code |

| `TREG_ADMIN_TOKEN` | *(empty)* | cross-tenant **super-admin** bearer; authorizes every `/admin/*` endpoint. Empty disables the env path (only `is_superadmin` users reach `/admin`). Keep it long + secret. |

1. **Server runs do not yet have filesystem/network isolation.** The resource limits above cap denial of

service, but a full jail (a locked-down user + egress allow-list, like the local sandbox) requires a

2. **The CLI-login handshake is in-process.** The short-lived pairing state for `treg login` lives in the

server process (it self-heals on retry and carries no rate-limit value). Running more than one server

instance requires sticky routing for that one flow, or moving it to shared storage.

| Fragment | Status | Covers |

|---|---|---|

| [Running & deploying the server](ops/deploy.md) | shipped | pyproject.toml, __main__.py, maintenance.py, env.py, … |

Rows older than the migration have no link and cannot get an exact one (the key needs the query

and body the audit row never kept); `scripts/backfill_call_archive_links.py` links them best-

effort — same endpoint, same byte size, fetch within ±10 s, unambiguous in both directions —

`TREG_ARCHIVE_MODE` (config `archive_mode`, default `off`) → `archive.mode()`:

`off` | `shadow` (record + learn, serve nothing — phase 0) | `serve` (shadow + answer eligible

fresh hits — phase 1+). Any unrecognized value degrades to `off`: a typo must disable, never

again per rolling-deploy instance, and a recording is one INSERT of a body already in memory).

Before it, a burst could put up to 512 concurrent short sessions in front of the API's 15-slot pool

(SToneX's pool-pressure report); those writes now land on the BACKGROUND pool instead

Queued recordings wait inside their fire-and-forget task, so the caller is unaffected; the 30s

bound covers wait+write, so a stuck queue still sheds rather than wedges. Throttled, not shed: the

burst test proves all 12 concurrent recordings land while peak DB concurrency stays ≤2.

pending work: `record()` sheds when EITHER the task count OR the bytes threshold is exceeded. The

done callback releases bytes when a task completes, keeping the budget accurate. The independent

R2 queue adds 128 MiB by default, for a combined 384 MiB body budget before SDK, compression

The semaphore is process-local; the recorder also supports deployment with multiple processes. An exact in-process key

lock is acquired before the semaphore, so duplicate recordings queue without consuming both

this. No commit changed, no test failed (nothing in the suite makes a live call), and the two failure

modes read differently: a version that **never existed** returns an HTML 404, a **sunset** one returns

a JSON 400 `UNSUPPORTED_VERSION`. `POST /health/run` would surface it on the day it breaks — it probes

`oauth_providers.GOOGLE_ADS`, `catalog/google-ads.yaml`, `catalog/google-ads.extended.yaml`, and

`scripts/catalog_ingest.py:GADS_VERSION`.

`token` header and verifies via free `GET /v1/stats`, requiring both HTTP success and

`status_code: 200`. A zero allowance does not invalidate a credential. The existing credential

ladder makes an org's tool/key win over the platform key and bypass treg billing and capacity checks.

Poll rows remain available by call reference and in admin diagnostics, but `/calls` excludes

them before pagination. No migration or historical reclassification is required.

index carried meant the planner chose an index for the other column and filtered the date in

`(endpoint_id, id)` for the newest-N feed and 0012 a partial index on `cached`. The cost of

getting this wrong is not a slow page: all three connection pools share one Postgres, so a scan

here queues every other query and the API pool empties into `503 treg_saturated` - see

**`LedgerEntry` is the other one, and it was the larger.** It is append-only and never pruned

(4.38M rows / 2.3 GB on prod 2026-09-06, ~400k rows a day), and `ledger.spent_today` - the

Three async SQLAlchemy engines against one database, declared by `POOL_SPECS` and exposed as

`session_maker` (api), `admin_session_maker` (`/admin/*`) and `background_session_maker` (audit,

archive writes, the ads worker) - a bulkhead, so no class of work can exhaust another's slots; sizes,

three alias one engine. The post-relay bookkeeping steps of `/call/` use `session_maker`; the request

session is committed before the relay so none of them ever waits on it, see

[proxy-model](proxy-model.md) § Connection discipline. The public