Clean prepaid SoT, identity mailbox, public access planes, leaf policy, fleet spawn

Persist account-balance books; edge caches prepaid from books. Add zappier-identity, verae-nats-accounts, verae-jobs-events, verae-access-staff, zapier-decisions. Edge binds loopback; lan-134 stays off; HTTP services prefer local spawn.

packages/zapier-decisions/LOG.md

@@ -0,0 +1,40 @@
+# Action log
+
+## 2026-09-11 — bootstrap
+
+- Created this repo to record decisions while executing cleanup items 1–5 (and a second pass on 2–5).
+- Assumption: single developer, lab only; breaking changes allowed.
+
+## Step 1 — account-balance is the prepaid source of truth
+
+- Persist books to `BOOKS_PATH` (atomic JSON).
+- Mutations go through `balance.adjust` / `usage.recorded`; edge cache `balanceCents` is updated from the books reply only.
+- Local cache mutate only when `NATS_URL` and `ACCOUNT_BALANCE_URL` are both unset (tests).
+
+## Step 2 — identity join
+
+- `zappier-identity` mailbox: `verae.identity.bind` / `verae.identity.lookup`.
+- Portal + middleware tenants store `veraeUserId`; JWT never public.
+
+## Step 3 — access planes are the public doors
+
+- zappier-edge binds loopback (`127.0.0.1:3000`).
+- Public: access-web `:3021`, access-api `:3022`, access-leaf `:3023`, access-zapier `:3024`, access-staff `:3025`.
+
+## Step 4 — leaf hardening
+
+- `verae-nats-accounts` holds nats.conf + subject policy.
+- Leaf token required; billing subjects denied in policy file and access-leaf.
+
+## Step 5 — fleet spawn
+
+- Prefer local machines for HTTP `spawn.command` services.
+- Disable lan-134 unless `FLEET_ENABLE_LAN134=1`.
+- SSH spawn timeout 8s; failed hosts skipped.
+
+## Second pass (2–5)
+
+- Identity used from portal when `IDENTITY_URL` set.
+- Leaf loads allow-list from nats-accounts `policy.json`.
+- Staff plane is a first-class mailbox (`verae-access-staff`).
+- jobs.events mailbox process `verae-jobs-events` (passthrough + count).