provisionDelegate mints the pair of service-auth tokens the gate requires and maps its error codes to messages the creation form can show. listDelegatedAccounts lets remote controllers enumerate the accounts they own directly against Tranquil. tranquil-gate: let tranquil enforce the delegate cap Tranquil gained MAX_DELEGATED_ACCOUNTS_PER_CONTROLLER, which it checks against the authenticated controller before minting a PLC DID. That makes the gate's own quota redundant, and the gate's version was the weaker of the two: it counted only what the caller's listing token could see, issued the upstream listing request before validating that token's issuer, and needed a process-wide mutex to be race-safe. Set the limit to 2 on the dev env and drop the gate-side check, the listServiceAuth token the client minted to feed it, and the creation lock. The web client now maps Tranquil's InvalidDelegation to the over-limit message. Listing stays in the client for the repository owner picker. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: oppiliappan <me@oppi.li>