# Matrix Auth Inventory — baseline before MAS migration

Captured 2026-08-20 from `/var/lib/synapse/homeserver.db` (SQLite, pre-migration).

**Totals:** 20 users (7 deactivated), **65 devices**, **54 access tokens**, 9 e2e device key entries.

## Per-account baseline

| Account | Devices | Tokens | Password hash | Credential location | Auth style |
|---|---|---|---|---|---|
| `@jeremy` | 12 (incl. cross-signing keys) | 3 | yes | user-typed (`bigdog01`) | password + Element sessions |
| `@clippyauto` | **17** | **17** | yes | n8n credential store (encrypted, `/home/node/.n8n/database.sqlite` on .100) | **repeated password login** — new device per login |
| `@pluto` | **15** | **15** | yes | unknown (OpenClaw Gateway devices) | **repeated password login** |
| `@julie` | 5 | 2 | yes | Element X Android | password |
| `@spirit` | 2 | 3 | yes | `/mnt/infrastructure/spirit/openclaw.json` → key `accessToken` only | **access token** |
| `@margaret` | 2 | 2 | yes | `/mnt/infrastructure/margaret/openclaw.json` → keys `accessToken` **and** `password` | token + password |
| `@frigate` | 2 | 2 | yes | `compose/hf-pdocker-01/frigate-notify/.env` → `MATRIX_ACCESS_TOKEN=syt_ZnJpZ2F0…` | **access token** |
| `@alertbot` | 2 | 2 | yes | `/mnt/docker-data/configs/alertmanager/matrix-receiver-config.yml` → `token: "syt_YWxlcnRib3Q…"` | **access token** |
| `@hermes` | 2 | 2 | yes | unknown | unknown |
| `@fry` | 1 | 1 | yes | unknown | unknown |
| `@testbot` | 1 | 1 | yes | `TESTBOT_CI` device | unknown |
| `@admin1`, `@adminuser` | 2 each | 2 each | yes | unknown | admin accounts |
| `@aaron`, `@bob`, `@clippy`, `@travis`, `@tempadmin`, `@resetadmin`, `@resetadmin2` | 0 | 0 | none | — | deactivated |

## Risk read

- **Access-token accounts** (`spirit`, `frigate`, `alertbot`) are the safest: syn2mas imports access tokens, so they should continue uninterrupted.
- **`@clippyauto` and `@pluto` are the canaries.** The 1:1 device-to-token ratio and high counts mean they authenticate with a password on each connect, creating a fresh device every time. Post-migration they exercise the MAS **compatibility layer** (`/_matrix/client/*/login` proxied to MAS). If the bcrypt `unicode_normalization: true` scheme is misconfigured, these break first and loudest — `@clippyauto` polls every ~2s, so failure is visible within seconds.
- `@jeremy`'s 12 devices include cross-signing keys (master/self_signing/user_signing), not just sessions. Cross-signing state must survive or Element will prompt to re-verify.

## Post-migration verification command

```bash
ssh glyptic@192.168.86.192 'docker exec synapse-db psql -U synapse -d synapse -tc "
 select u.name,
        (select count(*) from devices d where d.user_id=u.name) dev,
        (select count(*) from access_tokens a where a.user_id=u.name) tok
 from users u where u.deactivated=0 order by u.name;"'
```

Compare against the table above. Device counts may **grow** (new logins) but must not shrink for token-based accounts.