mrhid6andClaude Opus 5
c829cc41d9
Every customer handler that names an instance resolves it through ownedInstance, which returns 404 rather than 403 for another account's instance -- a 403 confirms the instance exists, which is an existence oracle over customer data. The unique index on admin_instances.instance_id, not the pre-check, is what actually prevents two accounts owning one instance. Relink issues a replacement covering the REMAINING term, so it cannot be used to extend a subscription, and the old licence is not revoked because offline verification has no revocation -- its instance binding is what stops it. The route table lands with the staff handlers in the next commit so every commit builds. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>