Add llm-subscription-resale-markets research topic

InferHub case study: subscription-entitlement resale, free-tier account
farming, proxy-pooled credential fleets, and the cheapest-wins auction that
prices them. Four files: index, analysis, sources, next-steps.

Evidence is public and unauthenticated only: InferHub terms/privacy/docs and its
public API (/api/openapi.json, /api/pricing/config, /api/market,
/api/pricing/usage, /api/status), the npm @inferhub/helper package, CodeBuddy's
own pricing/subscription docs, mastumbas.id, and
code.claude.com/docs/en/legal-and-compliance.

llm-subscription-resale-markets/next-steps.md

@@ -0,0 +1,104 @@
+---
+title: Next Steps — LLM Subscription-Resale Markets
+description: Open questions for the subscription-resale inference market study, and the evidence that would settle each one.
+status: active
+category: market
+tags: [inference-market, open-questions]
+draft: true
+created: 2026-10-05
+updated: 2026-10-05
+---
+
+# Next Steps — LLM Subscription-Resale Markets
+
+> Part of [[llm-subscription-resale-markets/index|LLM Subscription-Resale Markets]]
+
+## Open questions, and what would settle each
+
+### 1. Economics — how big is this, and does anyone make money?
+
+**Open:** marketplace gross volume per day in USDC; the price distribution per family vs official
+list; whether the observed clearing prices are above or below a publisher's real cost in the paid
+tier; the operator's 20% take; what a publisher earns per day at observed clearance prices.
+
+**What settles it:** arithmetic over two already-public feeds (`/api/pricing/usage` tokens ×
+`/api/market` asks), computed separately for the paid-subscription tier and the free-tier tier.
+The blended figure is misleading because the tiers have different cost structures — tier B's
+acquisition cost is ~$0.11–0.14 per account with ~450 banked credits, tier A's is a monthly fee.
+
+**Status:** deep lane dispatched 2026-10-05, not yet folded in.
+
+### 2. Mechanism — the credential and quota model in full
+
+**Open:** the exact scoring/selection function behind "best-scoring provider"; how a usage window
+is represented and refreshed; what `auto-reset-credit` spends and when; how `combo/<slug>` and
+bare aliases resolve to members; whether a consumer can observe which credential served them.
+
+**What settles it:** the public OpenAPI schema for `/publisher/providers`,
+`/publisher/providers/{id}/usage-windows`, `/publisher/upstreams/{slug}/*`, plus the public JS
+bundles under `/_next/static/chunks/`. Some of this is consumer-visible only with an account.
+
+**Status:** deep lane dispatched 2026-10-05, not yet folded in.
+
+### 3. The other 13 vendors' clauses
+
+**Open:** whether the same prohibition that Anthropic states explicitly also exists, quoted, for
+OpenAI (ChatGPT/Codex), Google (Gemini Code Assist / Antigravity / Cloud Code Assist), z.ai GLM
+Coding Plan, Cline, CodeBuddy, Command Code, OpenCode Go, MiniMax, Xiaomi MiMo and Alibaba/Qwen.
+
+**What settles it:** the vendor's own terms / usage policy / acceptable-use page for each, quoted
+verbatim with a URL and access date. **A well-evidenced "no clause found in the sources I could
+reach" is a valid result**, not a failure.
+
+**Status:** deep lane dispatched 2026-10-05, not yet folded in.
+
+### 4. Enforcement record
+
+**Open:** has any publisher actually lost a subscription for connecting it, and has any consumer
+lost access? Is there any public review, complaint or ban report naming inferhub.dev or the
+operator handle?
+
+**What settles it:** public reporting, Reddit / HN / X / Discord-indexed discussion, GitHub
+issues, and the project's own community. Absence is itself a finding, but only after a documented
+search.
+
+### 5. Operator and jurisdiction
+
+**Open:** the operator is described in their own terms as an individual, with the jurisdiction of
+residence undisclosed; the data controller is that individual. QRIS / IDR pricing points at an
+Indonesian-facing operation and the npm maintainer handle matches the Discord handle that posted
+the proxy dashboard.
+
+**What settles it:** only the operator can confirm. Treat as **UNKNOWN** and do not infer
+nationality from payment rails. Any further attribution stops at what the operator publishes
+himself; no personal data beyond the public professional profile belongs in this vault.
+
+### 6. Model substitution — the one question public data cannot answer
+
+**Open:** are the frontier-labelled rows actually the labelled models, or a cheaper backend behind
+a frontier model name? At 0.1–1% of official on free-tier families this cannot be excluded from the
+outside.
+
+**What settles it:** a paid account plus a black-box fingerprint audit in the shape of the IRIS /
+fingerprint-spoofing literature, measuring the served backend rather than trusting the model
+string. **Outside the passive scope of this study** and not authorised. If it is ever run, it must
+be a deliberate, bounded test — not incidental probing.
+
+### 7. Consumer-side viability
+
+**Open:** is the discount actually usable work? Measured 24 h API availability of 96.4% with
+`no_capacity` at 62.7% of errors, 5–19 s TTFT, and one flagship alias at 35% availability suggest
+the answer depends heavily on the model and the hour.
+
+**What settles it:** a metered, time-boxed trial of a single consumer balance against a first-party
+API on the same workload — cost per completed task, not cost per token. Requires spending money and
+an account; needs explicit owner approval first.
+
+## Housekeeping
+
+- [ ] Fold the three deep lanes into `analysis.md` when their verified versions arrive, and update
+      the `updated:` field
+- [ ] Owner will add additional material in the Buzz thread — append rather than rewrite
+- [ ] Decide `draft:` flag if this topic should appear on the public Quartz site
+- [ ] Cross-link the September `RESEARCH/free-token-gateways/` study once it is vaulted (it is
+      currently workspace-only)