# Upgrade Guide — vNEXT

<!-- assembled-by: assemble-next-md -->
<!-- bump: patch -->

## What Changed

WS5.2 Account Follow-Me, R6/R6a(option 2)/S7 — the enroll-drive **START** route, the keystone that makes a cross-machine enrollment actually run after the operator approves it. New dark route `POST /subscription-pool/follow-me/enroll/start`: given an operator-issued `account-follow-me` mandate, it verifies the mandate (deny-by-default — non-allow → 403, the agent can never self-authorize), resolves the operator-APPROVED account email AUTHORITATIVELY from real pool state (local SubscriptionPool + the replicated `subscription-account-meta` peer views — NEVER the request body, per S7; unresolvable → 409 fail-closed), allocates a per-account config-home slot on this machine, and drives the local `EnrollmentWizard.start({…, expectedEmail})` to mint the device-code login. The existing `/complete` route then validates the minted login's email against `expectedEmail` before the account is added. This closes the gap between consent (the scan) and completion (the S7 gate) — the full Mechanism-B flow now runs end-to-end (per-server: the operator drives the target machine's own enroll route; nothing but read-only email metadata crosses machines).

## What to Tell Your User

This is the piece that makes "log in once, it works on every machine" actually run end-to-end (still off by default). When you approve a machine to use one of your accounts (a one-tap dashboard approval), that machine now starts its OWN login for it, and I verify the login that completes is really the account you approved before it's used — no token is ever copied between machines. With this in, the cross-machine enrollment works start-to-finish behind the flag.

## Summary of New Capabilities

The enroll-drive START route (dark): an operator-mandate-gated, per-server route that drives a target machine's own `EnrollmentWizard` with the authoritatively-resolved approved email, completing the WS5.2 Mechanism-B flow (consent → start → email-validated completion → selectable). No user-facing surface is live in this release.

## Evidence

- 11 tests: 6 unit (`resolveFollowMeEnrollTarget` — local-pool resolve, peer-view resolve, local-preferred, and all three fail-closed branches: unknown account, no email, blank email) + 5 Tier-2 integration over the REAL route pipeline (dark→503, denied/no-mandate→403 with zero pending logins, valid+resolvable→201 with a pending login carrying `expectedEmail` and the correct per-account slot, unresolvable email→409 fail-closed, missing fields→400). `tsc --noEmit` clean.
- Side-effects review + mandatory independent second-pass security review (concurred): verified deny-by-default authorization, `expectedEmail` is authoritative (never from the body), agentFp fails closed (a wrong fp denies, never accidentally allows), config-home path-traversal-safe, fail-closed exhaustiveness, and no regression to normal enrollment.
- Spec: `docs/specs/ws52-account-follow-me-security.md` R1/R6/R6a/S7 (converged, approved).
