ONE SHIELD PER ACCOUNT, NEVER POOLED
Credentials are the highest-value secret in the system, so they live behind their own boundary: Vault-backed references, tokens that refresh before the window closes, per-token budgets every service must ask for, and an identity register that knows exactly which person and which machine touched what.
THE DOMAIN THAT NEVER READS THE FILE
The account-and-network domain inspects behaviour — fake accounts, spam patterns, coordinated inauthentic behaviour — and its cost is the second-worst on the docs' severity ladder: you lose the accounts — correlated, rarely recoverable. Concealed common control is an enumerated prohibited purpose, enforced automatically at platform scale. TokenShield's answer is the opposite property: every account attributable, every credential scoped to one token, one budget, one shield — because pooling is precisely the correlation that takes a whole portfolio down together.
WHAT THE BUBBLE CAN DO
| Capability | Evidence | Status |
|---|---|---|
| Vault-backed credential storage — the register holds references, never values | T-033 | LANDED |
| System User tokens preferred; long-lived user tokens as the fallback path | T-034 · T-035 | LANDED |
| Refresh workflow fires at day 30–45 — never day 55, because a missed window costs a human | T-036 | LANDED |
| A failed refresh alerts immediately — it is never retried silently | T-037 | LANDED |
| Days-to-expiry as a first-class health metric | T-038 | LANDED |
| Revocation or permission withdrawal halts scheduling for that account | T-039 | LANDED |
| Per-token sliding-window counters in Redis | T-040 | LANDED |
| A budget-grant API that every service must call before spending a single request | T-041 | LANDED |
| Priority classes: publish outranks reconcile outranks insights | T-042 | LANDED |
| Meta's rate-limit response headers are authoritative, not our own estimates | T-043 | LANDED |
| 429 backoff scoped to the single token that tripped it — one raid, one shield | T-044 | LANDED |
| Assertion test that no pooling exists across accounts | T-045 | LANDED |
| Operator and machine identity register — who and what holds credentials | T-046 | LANDED |
| Least-privilege account assignment | T-047 | LANDED |
| Credential-use attribution log — every call traceable to an identity | T-048 | LANDED |
| Offboarding an operator without rotating every other account's credentials | T-049 | LANDED |
| A real Meta App and Business Manager, linked to a test professional account | T-009 | IN THE YARDS |
| App review for the publish and insights scopes — the platform's own gate | T-010 | IN THE YARDS |
LANDED MEANS MERGED WITH TESTS IN THE REPOSITORY — NOTHING HERE IS GENERALLY AVAILABLE YET. THE SHIELD'S OWN APP REVIEW IS STILL IN THE YARDS, AND THIS PAGE SAYS SO.
WHAT THE BUBBLE FLARES AT
Rate-limit exhaustion: background polling quietly starving live publishes, surfacing as a 429 on the one call that mattered. The budget-grant API and the priority classes exist so the swarm meets a wall instead of a window.
PUPPETEER HUNTERS →Coordinated-behavior detection watches the strings, not the cargo. One shield per account, per-account rhythms and a real identity register are why the fleet never reads as a rig.
THE MECHANICS IT BUDGETS AGAINST ARE PUBLIC — READ THE GUIDE TO INSTAGRAM'S API PUBLISHING LIMITS.
TokenShield rides identity-orchestrator — the fourth deck, carved out of the orchestrator after the original design shipped, because credentials deserve their own blast radius: a token failure is an auth outage, not a scheduling signal, and the deck runs its refresh schedule even when nothing is queued. It is the deepest dependency in the fleet — when it goes down, all platform API access stops, everywhere.
One shield per account, never pooled. One account's spare budget cannot cover another's shortfall — and the day it can is the day the platform sees one hand on many rudders.
WHY THE LATTICE HAS NO SHARED KNOTS