Function resolve_bound_oauth_config_dir 

pub fn resolve_bound_oauth_config_dir(
    mstore: &Arc<Store>,
    id_store: &Arc<Store>,
    identity_store: &Arc<Store>,
    block_id: &str,
) -> Option<PathBuf>

Read-only lookup of a block’s identity-bound OAuth config dir — the same directory inject_identity_env_with_broker’s OAuth branch would inject, without any of that function’s side effects (no token-expiry probe, no account-status upsert, no identityaccounts:changed publish, no SpawnGateError on failure). For a background caller that only needs to know WHERE to look (e.g. subagent_watcher deciding which directory to watch at agent registration, not spawn) rather than what to inject.

Deliberately does not call inject_identity_env/inject_identity_env_with_broker: those also resolve API-key-class secrets into the caller’s env map (a leak risk for a caller that only wants a path) and perform real writes — none of which belong on every registration, only on an actual spawn/turn. See SPEC_SUBAGENT_WATCHER_IDENTITY_BOUND_CONFIG_DIR_2026_08_22.md.

Returns None (never an error) for: no instance for this block, no definition, a non-OAuth-class (or unrecognized) provider, no direct binding for that provider, an account row that doesn’t resolve, or a secret_ref that isn’t OAuthConfigDir — every one of these is exactly “nothing bound, fall back to the old behavior” for a caller that isn’t gating a spawn.