@jossuealcala/madre 0.7.2 → 1.0.0

package/src/server.mjs

@@ -1,36 +1,49 @@
 import http from 'node:http';
-import { readFile, realpath, writeFile, mkdir, rm, cp, rename, access } from 'node:fs/promises';
-import { rmSync } from 'node:fs';
-import { createHash } from 'node:crypto';
-import { classifyListening, probePort, framable } from './ports.mjs';
+import { readFile, realpath, writeFile, mkdir, cp, rename, access, stat } from 'node:fs/promises';
+import { existsSync, openSync, rmSync } from 'node:fs';
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import { probePort, framable } from './ports.mjs';
+import { ControlDesk } from './room/control.mjs';
 import { basename, dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { homedir } from 'node:os';
+import { homedir, hostname } from 'node:os';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 
 const execFileAsync = promisify(execFile);
 import { detectAgents, toolsPrefix } from './runtime-detection.mjs';
 import { EventStore } from './event-store.mjs';
-import { RoomMemory } from './memory.mjs';
+import { RoomMemory, travels as memoryTravels } from './memory.mjs';
 import { createEmbedder } from './embeddings.mjs';
 import { memoryServerFor } from './memory-tools.mjs';
 import { MotherChannel, CODE000_STRIKES } from './mother.mjs';
 import { ErrorSentinel } from './sentinel-errors.mjs';
-import { probeOllama, ollamaEmbedder, ollamaInvoker, pullModel, ollamaVersions, ownOllamaServers } from './ollama.mjs';
-import { moduleById, describeModules, findModuleRoute, toolsForTurn as modulesToolsForTurn, loadExternalModules, loadFailures, moduleFolders, moduleCommands, installModuleFile, installModuleText, verifyModuleText, moduleOrigin, removeExternalModule } from './modules/index.mjs';
+import { probeOllama, ollamaEmbedder, ollamaGenerate, ollamaInvoker, pullModel, ollamaVersions, ownOllamaServers } from './ollama.mjs';
+import { recallForTurn } from './modules/enlaces.mjs';
+import { MODULES, moduleById, describeModules, findModuleRoute, toolsForTurn as modulesToolsForTurn, loadExternalModules, loadFailures, moduleFolders, moduleCommands, installModuleFile, installModuleText, verifyModuleText, moduleOrigin, removeExternalModule } from './modules/index.mjs';
 import { madreAgent, madreInvoker, MADRE_AGENT_ID, MADRE_ADAPTER } from './adapters/madre.mjs';
 import { exportDataset, readiness as datasetReadiness } from './dataset.mjs';
 import { OutboundLog, outboundView, DEFAULT_REPORT_URL } from './outbound.mjs';
 import { language as roomLanguage, setLanguage as setRoomLanguage, t } from './i18n.mjs';
 
+// One per start of this process: a restart is a new one, a reload of the page is not.
+const BOOT_ID = `${process.pid}-${Date.now().toString(36)}`;
 const PACKAGE = JSON.parse(await readFile(new URL('../package.json', import.meta.url), 'utf8').catch(() => '{}'));
+// The phone is not in the public MADRE until it is stable (2026-10-12): it is offered only on a copy
+// run from its source, where the repository's `.git` sits beside `src/`. What npm installs never
+// carries a `.git` (`files` in package.json), so there no setting and no variable opens it.
+const FROM_SOURCE = existsSync(new URL('../.git', import.meta.url));
 let crashHandlersInstalled = false;
 
 // RIPLEY's bridge, injected into every page it renders: reports the page's path
 // and title to the viewer and forwards runtime errors and failed resources.
 // It talks only upward through postMessage; the frame stays an opaque origin.
-export const RIPLEY_BRIDGE = '<script data-ripley>(function(){var p=location.pathname;function send(m){try{parent.postMessage(Object.assign({ripley:1},m),"*")}catch(e){}}send({type:"page",path:p,title:document.title});addEventListener("DOMContentLoaded",function(){send({type:"page",path:p,title:document.title})});addEventListener("error",function(e){if(e.target&&e.target!==window&&!e.message){var u=e.target.src||e.target.href||"";send({type:"error",message:"Failed to load "+(u||e.target.tagName.toLowerCase()),source:u,line:0});return}send({type:"error",message:String(e.message||"error"),source:e.filename||"",line:e.lineno||0})},true);addEventListener("unhandledrejection",function(e){var r=e.reason;send({type:"error",message:"Unhandled promise rejection: "+String(r&&r.message||r),source:"",line:0})})})();</script>';
+// The bridge also says, once per page, that the page reached for its storage: the sealed frame
+// has an opaque origin, so localStorage, sessionStorage, IndexedDB and cookies throw or forget, and
+// an app that keeps its data there cannot be tried in here. The access still fails exactly as it
+// did; the viewer is only told, so it can say where the page can be tried with its data. Window is
+// the global interface: browsers put its storage getters on window itself, not on its prototype.
+export const RIPLEY_BRIDGE = '<script data-ripley>(function(){var p=location.pathname;function send(m){try{parent.postMessage(Object.assign({ripley:1},m),"*")}catch(e){}}send({type:"page",path:p,title:document.title});addEventListener("DOMContentLoaded",function(){send({type:"page",path:p,title:document.title})});addEventListener("error",function(e){if(e.target&&e.target!==window&&!e.message){var u=e.target.src||e.target.href||"";send({type:"error",message:"Failed to load "+(u||e.target.tagName.toLowerCase()),source:u,line:0});return}send({type:"error",message:String(e.message||"error"),source:e.filename||"",line:e.lineno||0})},true);addEventListener("unhandledrejection",function(e){var r=e.reason;send({type:"error",message:"Unhandled promise rejection: "+String(r&&r.message||r),source:"",line:0})});var told=0;function storage(n){if(!told){told=1;send({type:"storage",what:n})}}["localStorage","sessionStorage","indexedDB"].forEach(function(n){var d=Object.getOwnPropertyDescriptor(window,n)||Object.getOwnPropertyDescriptor(Window.prototype,n);if(!d||!d.get)return;try{Object.defineProperty(window,n,{configurable:true,get:function(){storage(n);return d.get.call(window)}})}catch(e){}});var c=Object.getOwnPropertyDescriptor(Document.prototype,"cookie");if(c&&c.get&&c.set){try{Object.defineProperty(document,"cookie",{configurable:true,get:function(){storage("cookie");return c.get.call(document)},set:function(v){storage("cookie");c.set.call(document,v)}})}catch(e){}}})();</script>';
 export function injectRipleyBridge(body) {
   const text = Buffer.isBuffer(body) ? body.toString('utf8') : String(body);
   if (text.includes('data-ripley')) return Buffer.from(text);
@@ -44,34 +57,50 @@ export function injectRipleyBridge(body) {
 import { QuotaMonitor } from './quota-monitor.mjs';
 import { defaultQuotaSources } from './quota-sources.mjs';
 import { Room } from './room.mjs';
-import { applyConfigToEnv, loadConfig } from './config.mjs';
+import { changeNeedsPhrase, keyHolds, mergeOverride, overrideSettings, phraseHash, publicOverride } from './override.mjs';
 import { extensionById, findOnPath, runInstaller } from './extensions.mjs';
 import { accountNoteFor, installPlanFor, looksLikeAdminProblem, loginPlanFor, probeAgentAuth, probeAll, TAKES_KEY } from './auth-probe.mjs';
 import { applyKey, keyPlanFor } from './credentials.mjs';
 import { forgetSecret, summary as vaultSummary, writeSecret } from './vault.mjs';
-import { loadConfig as readConfig, updateConfig } from './config.mjs';
+import { applyConfigToEnv, loadConfig as readConfig, updateConfig } from './config.mjs';
 import { Privacy, normalizeTerms, privacySettings } from './privacy.mjs';
-import { checkForUpdate, detectInstall, updateCommand, releaseUrl, applyCommand } from './updates.mjs';
-import { bootWhatsNew, markSeen, notesFor, whatsNew } from './whats-new.mjs';
+import { checkForUpdate, detectInstall, updateCommand, releaseUrl, applyCommand, fetchCommand } from './updates.mjs';
+import { bootWhatsNew, markSeen, newestNotes, notesFor, whatsNew } from './whats-new.mjs';
+import { answerAsk, tickAsk } from './review-ask.mjs';
+import { CHAPTERS, HINTS, TOUR_VERSION, cameBefore, changeTour, readTour, recoverProject, roomsWithoutProject } from './tour.mjs';
 
 // Where a person reads the module contract, in the language the room is speaking.
 const SDK_PAGE = { es: 'https://madre.run/sdk/', en: 'https://madre.run/en/sdk/' };
 import { moduleUpdate } from './modules/updates.mjs';
-import { adoptStrays, chatIndex, chatLedger, createChat, deleteChat, isChatId, listChats, openChat as openChatIndex, projectFloor, renameChat, touchChat, MAIN_CHAT } from './chats.mjs';
+import { adoptStrays, chatIndex, chatLedger, createChat, deleteChat, isChatId, listChats, openChat as openChatIndex, projectFloor, renameChat, touchChat } from './chats.mjs';
 import { spawn } from 'node:child_process';
 import { totalmem } from 'node:os';
 import { discoverModels } from './models.mjs';
-import { setImageModule } from './capabilities.mjs';
+import { observable } from './modules/intents-observe.mjs';
+import { normalizeMode, setImageModule } from './capabilities.mjs';
 import { resolveGeminiKey } from './image-studio.mjs';
 import { commandByName, listCommands, parseCommand } from './commands.mjs';
-import { listDirectory, searchFiles, readServable, storeAttachment, resolveInside, MAX_ATTACHMENT_BYTES } from './files.mjs';
-import { planFileOp, freeCopyPath, CREATIONS } from './file-ops.mjs';
+import { listDirectory, searchFiles, readServable, storeAttachment, resolveInside, createEmptyFile, writeEdited, MAX_ATTACHMENT_BYTES, MAX_EDIT_BYTES } from './files.mjs';
+import { planFileOp, freeCopyPath, needsDesignationOnDisk, CREATIONS } from './file-ops.mjs';
+import { ServerSentinel } from './server-sentinel.mjs';
 import { Eyecat } from './eyecat-watch.mjs';
 import { economy } from './room/economy.mjs';
 import { maturity } from './maturity.mjs';
 import { memoryDashboard } from './memory-dashboard.mjs';
 import { verdictFor } from './verdict.mjs';
 import { refuseForeign } from './request-guard.mjs';
+import { restoreGuard } from './room/guard.mjs';
+import { bridgeAnswers, hostBridge } from './bridge/host.mjs';
+import { BRIDGE_PORT } from './bridge/server.mjs';
+import { createInvite, forgetDevice, forgetNetwork, readStore, setEnabled, storeView, trustNetwork } from './bridge/devices.mjs';
+import { currentNetwork, lanAddresses } from './bridge/network.mjs';
+import { PHONE_MAX_MODE, writtenMode } from './bridge/policy.mjs';
+import { qrSvg } from './bridge/qr.mjs';
+import { readHandoff, writeHandoff } from './bridge/handoff.mjs';
+import { changeLooks, readLooks } from './looks.mjs';
+import { askRoom, associateProject, ensureSalasProject, forgetProject, isSalasRoom, knownRooms, listFolders, markProject, projectRoomId, roomComesUp, salasRoomId, startRoom, suggestProjects, universeOf } from './salas.mjs';
+import { parseWork, recentWork, WORK_SYSTEM, workPrompt } from './lobby-work.mjs';
+import { CHANNEL_HEADER, MAX_LIMIT as ENLACE_MAX_LIMIT, NO_SUCH_LINK, NOTICES as ENLACE_NOTICES, activeContracts, askEnlace, channelKey, countRecent, linkTraffic, mayServe, noteCrossing, noticeEnlace, readsFrom, recallContract, revokeContract, sameKey, servingRooms, signContract } from './enlaces.mjs';
 
 const sourceDirectory = dirname(fileURLToPath(import.meta.url));
 const publicDirectory = join(sourceDirectory, '..', 'public');
@@ -81,13 +110,18 @@ function sendJson(response, status, value) {
   response.end(JSON.stringify(value));
 }
 
-async function body(request) {
-  let text = '';
+// A request's JSON, read whole before it is decoded (2026-10-12, SRV-08): a «ñ» split between two
+// packets came out as «��». The limit is in bytes; a route that takes more says so (the editor).
+const BODY_LIMIT = 100_000;
+async function body(request, { limit = BODY_LIMIT } = {}) {
+  const chunks = [];
+  let size = 0;
   for await (const chunk of request) {
-    text += chunk;
-    if (text.length > 100_000) throw new Error('Request too large.');
+    size += chunk.length;
+    if (size > limit) throw Object.assign(new Error('Request too large.'), { status: 413 });
+    chunks.push(chunk);
   }
-  return JSON.parse(text || '{}');
+  return JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}');
 }
 
 export function openUrl(url) {
@@ -109,11 +143,20 @@ export function agentTimeoutsFromEnv(env = process.env, agentIds = ['codex', 'cl
   return timeouts;
 }
 
-export function projectRoomId(projectRoot) {
-  const path = resolve(projectRoot);
-  const digest = createHash('sha256').update(path).digest('hex').slice(0, 16);
-  return `${basename(path) || 'root'}-${digest}`;
-}
+// The id of a room lives beside the rest of what Salas knows of rooms (src/salas.mjs); it is still
+// read from here by everything that always did.
+export { projectRoomId };
+
+// What the pages of a project and of Home are sent with (2026-10-12, SRV-04 and WEB-01 of the 1.0
+// review). Only this same page may frame them — the split view frames `/?pane=split` — so another
+// page cannot lay them under its own buttons and borrow a click on RUN or STOP ALL. And images come
+// only from here: a picture in an answer that pointed elsewhere was fetched the moment it was
+// drawn, with whatever its address carried, and never counted as something that left the Mac.
+const PAGE_GUARDS = {
+  'x-frame-options': 'SAMEORIGIN',
+  'content-security-policy': "frame-ancestors 'self'; img-src 'self' data: blob:",
+  'x-content-type-options': 'nosniff',
+};
 
 export async function createPulseServer({
   projectRoot,
@@ -127,6 +170,8 @@ export async function createPulseServer({
   quotaSources = [],
   quotaPollIntervalMs = Number(process.env.PULSE_QUOTA_POLL_INTERVAL_MS ?? 60000),
   broadcastIntervalMs = Number(process.env.PULSE_BROADCAST_INTERVAL_MS ?? 500),
+  // How long a conversation opened beside the one on screen waits for a page to start watching it.
+  heldGraceMs = 30000,
   sseMaxBufferedBytes = Number(process.env.PULSE_SSE_MAX_BUFFERED_BYTES ?? 1_048_576),
   agentTimeouts,
   maxMessageChars = Number(process.env.PULSE_MAX_MESSAGE_CHARS ?? 20000),
@@ -153,7 +198,7 @@ export async function createPulseServer({
   // an update has news to show them, or this is a first install with nothing to catch up on.
   const novelty = await bootWhatsNew({ root, version: PACKAGE.version }).catch(() => ({ returning: false }));
   // ~/.pulse/config.json fills in whatever the environment did not set.
-  applyConfigToEnv(await loadConfig(root));
+  applyConfigToEnv(await readConfig(root));
   // What language the screens speak. The prompt the agents read is not one of them, and the
   // environment wins over the file, as it does for every other setting here.
   setRoomLanguage(process.env.PULSE_LANGUAGE ?? (await readConfig(root)).language);
@@ -164,6 +209,9 @@ export async function createPulseServer({
   const agents = providedAgents ?? await detector();
   const canonicalProjectRoot = await realpath(projectRoot).catch(() => resolve(projectRoot));
   const roomDir = join(root, 'rooms', projectRoomId(canonicalProjectRoot));
+  // Whether this is the room of Salas (docs/MACROVERSO.md, fase 3d): the room whose project is
+  // the notebook of Salas, decided once from real paths; the page carries the MACROVERSO key there.
+  const salasRoom = isSalasRoom(canonicalProjectRoot, root);
   // What left this machine. Every fetch this process makes — MADRE's own and any a module makes,
   // because a module runs in here and cannot opt out — goes through one wrapper and lands in a
   // line beside the ledger. Bodies, headers and query values are never in it. One room per
@@ -184,20 +232,78 @@ export async function createPulseServer({
   const openMark = join(roomDir, 'open.json');
   const alive = (pid) => { try { process.kill(pid, 0); return true; } catch (error) { return error.code === 'EPERM'; } };
   const held = await readFile(openMark, 'utf8').then((raw) => JSON.parse(raw)).catch(() => null);
-  if (held && Number.isInteger(held.pid) && held.pid !== process.pid && alive(held.pid)) {
+  // A live process is not enough (2026-10-12, LOG-13): after a restart of the Mac the number of the
+  // room that died is often some other program's, and the project said «already open» for good. It
+  // is taken only if that room also answers on its port.
+  const answers = async (port) => Number.isInteger(port) && await fetch(`http://127.0.0.1:${port}/api/version`, { signal: AbortSignal.timeout(1500) }).then((response) => response.ok, () => false);
+  if (held && Number.isInteger(held.pid) && held.pid !== process.pid && alive(held.pid) && await answers(held.port)) {
     const error = new Error(`MADRE is already open for this project at http://127.0.0.1:${held.port} (process ${held.pid}). Close that room first, or open another conversation inside it.`);
     error.code = 'ROOM_IN_USE';
     throw error;
   }
-  const markOpen = async (port) => { await mkdir(roomDir, { recursive: true }).catch(() => {}); await writeFile(openMark, JSON.stringify({ pid: process.pid, port, at: new Date().toISOString() })).catch(() => {}); };
+  // The room is this one's now. A room that died in the middle of a turn left the project's .env
+  // files and MADRE's folders read-only (room/guard.mjs): they get their modes back first.
+  const unlocked = await restoreGuard(join(roomDir, 'guard.json')).catch(() => []);
+  if (unlocked.length) console.error(`MADRE: a room that closed mid-turn had left ${unlocked.length} protected path(s) read-only; they are writable again.`);
+  // The mark also says which project and which MADRE, for the bridge's list of rooms on the phone.
+  let openPort = null;
+  // Where the project is, too (src/salas.mjs): a room that is closed can be opened again from Salas.
+  const markOpen = async (port) => { openPort = port; await mkdir(roomDir, { recursive: true }).catch(() => {}); await writeFile(openMark, JSON.stringify({ pid: process.pid, port, at: new Date().toISOString(), project: basename(canonicalProjectRoot), version: PACKAGE.version ?? null })).catch(() => {}); await markProject(roomDir, canonicalProjectRoot).catch(() => {}); };
+  // The phone (docs/MOBILE.md) is not offered in MADRE 1.0 (2026-10-11, hidden 2026-10-12): Safari
+  // in HTTPS-only mode refuses the bridge's http, and the relay that fixes it is not built. Only a
+  // copy run from source (FROM_SOURCE, above) on a Mac that turned it on — `phone.preview` in
+  // config.json, or PULSE_PHONE=1 — has it. Everywhere else nothing says it exists: no key on the
+  // bar, no place in Settings, no chapter in the tour, and the bridge never opens.
+  const phonePreview = async () => FROM_SOURCE && (process.env.PULSE_PHONE === '1' || (await readConfig(root).catch(() => ({}))).phone?.preview === true);
+  // This room offers to host the bridge once it is open; see bridge/host.mjs.
+  const phone = hostBridge({ root, publicDirectory, allowed: phonePreview });
+  async function phoneView() {
+    const store = await readStore(root);
+    const here = await currentNetwork().catch(() => null);
+    return {
+      available: Boolean(here),
+      network: here ? { id: here.id, gateway: here.gateway, trusted: store.networks.some((one) => one.id === here.id) } : null,
+      addresses: here ? lanAddresses({ device: here.device }) : [],
+      port: BRIDGE_PORT,
+      bridge: { up: await bridgeAnswers(), here: phone.status().hosting },
+      ...storeView(store),
+    };
+  }
   const releaseOpen = () => { try { rmSync(openMark, { force: true }); } catch { /* it was already gone */ } };
+  // How many memories of each kind, and how many travel into turns. Counted, never read out.
+  function memoryCensus() {
+    const all = memory ? memory.memories({ limit: 20000 }) : [];
+    const kinds = {};
+    let travelling = 0;
+    for (const note of all) {
+      kinds[note.kind] = (kinds[note.kind] ?? 0) + 1;
+      if (memoryTravels(note)) travelling += 1;
+    }
+    return { memories: all.length, kinds, travelling };
+  }
   // The human's own modules, from ~/.pulse/modules and <project>/.madre/modules.
   await loadExternalModules({ stateRoot: root, projectRoot: canonicalProjectRoot }).catch((error) => console.error(`MADRE modules: ${error.message}`));
   // A project has one memory and many conversations; one of them is open at a time, and the
   // numbering is the project's, so a citation means the same thing in all of them.
   await adoptStrays(roomDir).catch(() => null);
   let chatId = (await chatIndex(roomDir)).active;
-  let store = await new EventStore(chatLedger(roomDir, chatId), { floor: await projectFloor(roomDir, { except: chatId }) }).initialize();
+  // Every record open in this process. Two conversations may write at once (one at work while
+  // the human is in another, or both halves of a split window), so the floor a ledger numbers
+  // from is read when it writes: what the project had on disk, or what any open ledger has
+  // handed out since, whichever is higher.
+  const liveStores = new Set();
+  let retiredHigh = 0;   // the highest a ledger that closed in this process had reached
+  const openLedger = async (id) => {
+    const base = await projectFloor(roomDir, { except: id });
+    const opened = await new EventStore(chatLedger(roomDir, id), { floor: () => Math.max(base, retiredHigh, ...[...liveStores].map((each) => each.lastSequence)) }).initialize();
+    // A record with lines that are not events opens anyway (src/event-store.mjs); it is said here,
+    // with where the file is, and nothing in it is removed.
+    if (opened.damaged) console.error(`MADRE: ${opened.damaged} damaged line(s) in ${chatLedger(roomDir, id)} were stepped over; the file keeps them.`);
+    liveStores.add(opened);
+    return opened;
+  };
+  const retireLedger = (closed) => { if (!liveStores.delete(closed)) return; retiredHigh = Math.max(retiredHigh, closed.lastSequence); };
+  let store = await openLedger(chatId);
   let historicalEvents = await store.readAll();
   // The room's memory: derived from the ledger, rebuilt if missing or stale,
   // and never a reason for the room not to open.
@@ -227,13 +333,67 @@ export async function createPulseServer({
   // human message and whenever MU/TH/UR looks: a term named in one room guards them all.
   const privacy = new Privacy({ ...privacySettings(await readConfig(root)), home: homedir() });
   const refreshPrivacy = async () => { const { terms, marker, secrets, paths } = privacySettings(await readConfig(root)); privacy.set(terms, marker).setGuards({ secrets, paths }); return privacy; };
+  const memoryWasThere = await stat(join(roomDir, 'memory.sqlite')).then(() => true, () => false);
   const memory = await new RoomMemory(join(roomDir, 'memory.sqlite')).attachPrivacy(privacy).initialize(store)
     .catch((error) => { console.error(`MADRE memory unavailable, turns get the recent window only: ${error.message}`); return null; });
+  // A memory made again from nothing (its file deleted, a copy of the project's state without it)
+  // is filled from every conversation of the project, not only the one open (LOG-14 of the 1.0
+  // review): the index of the others was lost for good. The words are indexed once; a number
+  // already there is left as it is.
+  if (memory && !memoryWasThere) {
+    for (const chat of (await listChats(roomDir)).chats) {
+      if (chat.id === chatId) continue;
+      const file = chatLedger(roomDir, chat.id);
+      if (await stat(file).then((info) => info.isFile(), () => false)) memory.index(await new EventStore(file).readAll().catch(() => []));
+    }
+  }
   // Meaning-aware recall through the user's own Gemini key, when there is one;
   // and the memory as MCP tools for every agent's turn.
   // Ollama, when it is there: local embeddings and a local archivist. Probed at
   // start and again from MODULES; wired live, no restart.
   let ollama = { running: false, host: null, models: [], embedModel: null, chatModel: null };
+  // The lobby's two readings (src/lobby-work.mjs): MADRE's summary of what was worked on last, kept
+  // beside this room's record so a restart does not lose it, and the recent decisions of the open
+  // rooms, asked of them at most every few minutes (each room works its zones out itself).
+  const lobbyWork = { file: join(roomDir, 'lobby-work.json'), loaded: false, key: null, at: 0, tried: 0, bullets: null, model: null, error: null, running: null };
+  const lobbyDecisions = { at: 0, list: null, running: null };
+  // Every conversation's room other than the open one (see the note above mountChat); declared
+  // here because the local wiring below reaches all of them.
+  const parked = new Map();   // chatId -> { room, store, off, feed }
+  // The records of the project's other conversations: the open store of one held beside, or the
+  // file of one closed (never made where none exists). And every event of the project, for what is
+  // counted across all of them (the privacy exposure).
+  async function otherLedgers() {
+    const out = [];
+    for (const chat of (await listChats(roomDir)).chats) {
+      if (chat.id === chatId) continue;
+      const held = parked.get(chat.id);
+      if (held?.store) { out.push({ store: held.store, held }); continue; }
+      const file = chatLedger(roomDir, chat.id);
+      if (await stat(file).then((info) => info.isFile(), () => false)) out.push({ store: new EventStore(file), held: null });
+    }
+    return out;
+  }
+  async function projectEvents() {
+    const all = await store.readAll();
+    for (const { store: other } of await otherLedgers()) all.push(...await other.readAll().catch(() => []));
+    return all;
+  }
+  const opening = new Map();  // chatId -> the promise of its room, while it is being built
+  // What the human sets belongs to the project: it reaches the conversation on screen and every
+  // one alive beside it. A timeout raised from a conversation in a window used to change only the
+  // one on screen, and its retry ran with the old limit.
+  const liveRooms = () => [room, ...[...parked.values()].map((held) => held.room)].filter(Boolean);
+  // What the local brain lends every room of the project: the archivist that distills in Ollama
+  // and @madre. Settled once per wiring and handed to each room as it opens, beside or switched
+  // to. A room built with @madre and without the archivist's invoker distilled with the next
+  // cheapest crew member: a provider, unannounced, on every conversation but the first.
+  let localWiring = { archivist: null, madre: false };
+  function wireLocal(target) {
+    if (!target) return;
+    target.setInvoker('ollama', localWiring.archivist);
+    target.setInvoker(MADRE_ADAPTER, localWiring.madre ? madreInvoker({ memory, ollama: () => ({ ...ollama, chatModel: ollama.madreModel ?? ollama.chatModel }), fetchImpl: reportFetch }) : null);
+  }
   const ollamaSettings = async () => ({ enabled: true, embeddings: true, archivist: true, agent: true, ...((await readConfig(root)).modules?.ollama ?? {}) });
   // What the TRAIN card needs: where the recipe ships, the room, the model name @madre will pick up, a base that fits this machine.
   function trainingInfo() {
@@ -255,7 +415,7 @@ export async function createPulseServer({
       const embedder = createEmbedder({ key, env: embedEnvFor(await memoryConfig()), ollama: useEmbeddings ? ollama : null, ollamaEmbedder });
       if (room) room.setEmbedder(embedder); else memory.attachEmbedder(embedder);
     }
-    if (room) room.setInvoker('ollama', useArchivist ? ollamaInvoker({ host: ollama.host, model: ollama.chatModel }) : null);
+    localWiring.archivist = useArchivist ? ollamaInvoker({ host: ollama.host, model: ollama.chatModel, fetchImpl: reportFetch }) : null;
     // @madre: the fifth agent, present whenever Ollama has a chat model and the human left it on.
     const fifth = madreAgent({ ...ollama, chatModel: ollama.madreModel ?? ollama.chatModel }, { enabled: settings.enabled && settings.agent !== false });
     const index = agents.findIndex((agent) => agent.id === MADRE_AGENT_ID);
@@ -263,8 +423,10 @@ export async function createPulseServer({
     if (fifth.ready && index < 0) { agents.push(fifth); changed = true; }
     else if (fifth.ready && (agents[index].version !== fifth.version)) { Object.assign(agents[index], fifth); changed = true; }
     else if (!fifth.ready && index >= 0) { agents.splice(index, 1); changed = true; }
+    localWiring.madre = fifth.ready;
+    wireLocal(room);
+    for (const held of parked.values()) wireLocal(held.room);
     if (room) {
-      room.setInvoker(MADRE_ADAPTER, fifth.ready ? madreInvoker({ memory, ollama: () => ({ ...ollama, chatModel: ollama.madreModel ?? ollama.chatModel }), fetchImpl: reportFetch }) : null);
       if (changed) await room.record('agents.updated', { agents: agents.map((agent) => ({ id: agent.id, label: agent.label, detected: agent.detected, ready: agent.ready, version: agent.version, local: Boolean(agent.local), route: agent.route ?? null })), removed: fifth.ready ? [] : [MADRE_AGENT_ID], reason: fifth.ready ? `@madre is in the room · ${fifth.version}` : '@madre left the room: Ollama has no chat model running' });
       // That a local model is running is not the same as it being of use on this project, and
       // the second thing is the one a person needs told. Said once per model, in the room, with
@@ -298,25 +460,63 @@ export async function createPulseServer({
   // file, so a deleted or edited .pulse/mother.env is noticed.
   const mother = new MotherChannel(join(canonicalProjectRoot, '.pulse', 'mother.env'), { meta: memory ? { get: (key) => memory.metaGet(key), set: (key, value) => memory.metaSet(key, value) } : null });
   const motherOutcome = await mother.load().catch((error) => { console.error(`MADRE could not open MOTHER's channel: ${error.message}`); return null; });
-  const startupMemory = await memoryConfig();
+  // What the human last set for memory: a conversation opened later distills with it, not with
+  // what MADRE booted with.
+  let memorySettings = await memoryConfig();
+  // Which key unlocks #3 and #4, and for how long an accepted one holds. See src/override.mjs.
+  let overrideConfig = overrideSettings((await readConfig(root)).override);
+  // The passes the key gives (2026-10-12). The page asks for the key, the project checks it and
+  // hands back a pass for that agent and that mode; a message at #3 or #4 goes only with one. Without
+  // a remembered permission a pass opens one message; with one, any until it runs out. STOP ALL and
+  // a restart take them all back. Wrong keys are counted: a program trying words is slowed down.
+  const passes = new Map();          // token -> { agent, mode, until, once }
+  const keyMisses = [];              // when the last wrong keys were typed
+  const PASS_ONCE_MS = 30 * 60 * 1000;
+  function issuePass(agent, mode) {
+    const minutes = overrideConfig.grace[mode] ?? 0;
+    const token = randomBytes(24).toString('hex');
+    const pass = { agent, mode, until: Date.now() + (minutes ? minutes * 60000 : PASS_ONCE_MS), once: !minutes };
+    passes.set(token, pass);
+    return { token, until: new Date(pass.until).toISOString(), once: pass.once };
+  }
+  function spendPass(token, agent, mode) {
+    const pass = typeof token === 'string' ? passes.get(token) : null;
+    if (!pass || pass.agent !== agent || pass.mode < mode) return false;
+    if (pass.until < Date.now()) { passes.delete(token); return false; }
+    if (pass.once) passes.delete(token);
+    return true;
+  }
   let listening = null;
   const listeningPort = () => listening?.address?.()?.port ?? Number(process.env.PULSE_PORT ?? 4317);
-  const roomOptions = () => ({
+  // One CONTROL desk for the whole project, shared by every conversation alive at once: a single
+  // holder of the working tree whichever chat asked, and an UNDO that works from any of them.
+  const controlDesk = new ControlDesk({ projectRoot, guardRecord: join(roomDir, 'guard.json') });
+  // The open conversation's record unless another is named: a conversation held open beside it
+  // builds its room the same way, over its own record.
+  const roomOptions = (own = {}) => ({
     store,
     agents,
     projectRoot,
+    controlDesk,
     privacy,
     // Modules may hand tools to a turn; the room asks once per turn, the server knows the port.
     toolsForTurn: async (turn) => modulesToolsForTurn(await moduleContext(), { ...turn, port: listeningPort(), roomDir }),
+    // What BISHOP reads for a turn is recorded in that turn's conversation, not the open one.
+    bishopForTurn: salasRoom ? async (turn) => moduleById('bishop').promptForTurn({ ...(await moduleContext()), record: (type, payload) => ((turn.turn && liveRooms().find((one) => one.runningTurn?.(turn.turn))) || room).record(type, payload) }, turn) : null,
+    // Fase 3e: notes a link with automatic recall brings to a turn. Never in the room of Salas
+    // (BISHOP has its own); recorded in the conversation of the turn that read them.
+    linkedForTurn: salasRoom ? null : async (turn) => recallForTurn(await moduleContext(), { ...turn, port: listeningPort(), roomDir,
+      record: (type, payload) => ((turn.turn && liveRooms().find((one) => one.runningTurn?.(turn.turn))) || room).record(type, payload) }),
     softTokenBudget,
     contextMaxChars,
-    recallShare: Number(process.env.PULSE_RECALL_SHARE ?? startupMemory.recallShare),
-    cascade: process.env.PULSE_RECALL_CASCADE !== undefined ? process.env.PULSE_RECALL_CASCADE !== '0' : startupMemory.cascade !== false,
+    recallShare: Number(process.env.PULSE_RECALL_SHARE ?? memorySettings.recallShare),
+    cascade: process.env.PULSE_RECALL_CASCADE !== undefined ? process.env.PULSE_RECALL_CASCADE !== '0' : memorySettings.cascade !== false,
     distill: {
-      every: Number(process.env.PULSE_DISTILL_EVERY ?? startupMemory.every),
-      idleMs: Number(process.env.PULSE_DISTILL_IDLE_MS ?? startupMemory.idleMinutes * 60000),
-      agent: process.env.PULSE_DISTILL_AGENT ?? (startupMemory.archivist && startupMemory.archivist !== 'auto' ? startupMemory.archivist : null),
-      allowed: Array.isArray(startupMemory.archivists) && startupMemory.archivists.length ? startupMemory.archivists : null,
+      every: Number(process.env.PULSE_DISTILL_EVERY ?? memorySettings.every),
+      idleMs: Number(process.env.PULSE_DISTILL_IDLE_MS ?? memorySettings.idleMinutes * 60000),
+      agent: process.env.PULSE_DISTILL_AGENT ?? (memorySettings.archivist && memorySettings.archivist !== 'auto' ? memorySettings.archivist : null),
+      allowed: Array.isArray(memorySettings.archivists) && memorySettings.archivists.length ? memorySettings.archivists : null,
+      ...(typeof memorySettings.enabled === 'boolean' ? { enabled: memorySettings.enabled } : {}),
     },
     memory,
     memoryServer,
@@ -325,8 +525,11 @@ export async function createPulseServer({
     invokers,
     agentTimeouts,
     maxMessageChars,
-    delegation,
+    // S-032: in the room of Salas nobody delegates. BISHOP speaks there, and what it sets in
+    // motion goes through its own plans, never through a ```pulse plan of that room.
+    delegation: salasRoom ? false : delegation,
     maxPlanSteps,
+    ...own,
   });
   room = new Room(roomOptions());
   await wireOllama({ probe: false });
@@ -360,6 +563,7 @@ export async function createPulseServer({
       memory: memorySettingsView(),
       updates: { check: updatesEnabled(), envWins: process.env.PULSE_UPDATE_CHECK !== undefined },
       privacy: { terms: privacy.terms, marker: privacy.marker, envWins: privacySettings({}, process.env).envWins, ...privacy.guards },
+      override: publicOverride(overrideConfig),
     };
   }
   // What MU/TH/UR shows under MEMORY: the live values, who could distil, and what embeds today.
@@ -395,7 +599,7 @@ export async function createPulseServer({
     }
     if (patch.room) {
       config.room = { ...((await readConfig(root)).room ?? {}) };
-      if (typeof patch.room.delegation === 'boolean') { config.room.delegation = patch.room.delegation; live.delegation = patch.room.delegation; }
+      if (typeof patch.room.delegation === 'boolean') { config.room.delegation = patch.room.delegation; live.delegation = salasRoom ? false : patch.room.delegation; }
       if (Number(patch.room.maxPlanSteps) > 0) { config.room.maxPlanSteps = Number(patch.room.maxPlanSteps); live.maxPlanSteps = Number(patch.room.maxPlanSteps); }
       if (Number(patch.room.softTokenBudget) > 0) { config.room.softTokenBudget = Number(patch.room.softTokenBudget); live.softTokenBudget = Number(patch.room.softTokenBudget); }
     }
@@ -412,7 +616,9 @@ export async function createPulseServer({
       if (typeof m.cascade === 'boolean') next.cascade = m.cascade;
       if (typeof m.enabled === 'boolean') next.enabled = m.enabled;
       config.memory = next;
-      room.configureDistill({ every: next.every, idleMs: next.idleMinutes * 60000, agent: next.archivist === 'auto' ? null : next.archivist, allowed: next.archivists, recallShare: next.recallShare, cascade: next.cascade !== false, ...(typeof next.enabled === 'boolean' ? { enabled: next.enabled } : {}) });
+      memorySettings = next;
+      const distill = { every: next.every, idleMs: next.idleMinutes * 60000, agent: next.archivist === 'auto' ? null : next.archivist, allowed: next.archivists, recallShare: next.recallShare, cascade: next.cascade !== false, ...(typeof next.enabled === 'boolean' ? { enabled: next.enabled } : {}) };
+      for (const each of liveRooms()) each.configureDistill(distill);
       live.memory = true;
     }
     if (patch.scopes && typeof patch.scopes === 'object') {
@@ -426,14 +632,18 @@ export async function createPulseServer({
         if (Number.isInteger(Number(scopes.maxMode)) && Number(scopes.maxMode) >= 0 && Number(scopes.maxMode) <= 4) { config.scopes[agentId].maxMode = Number(scopes.maxMode); delete config.scopes[agentId].write; }
         if (Number.isInteger(Number(scopes.defaultMode)) && Number(scopes.defaultMode) >= 1 && Number(scopes.defaultMode) <= 2) { config.scopes[agentId].defaultMode = Number(scopes.defaultMode); delete config.scopes[agentId].alwaysCreate; }
       }
-      room.setScopes(config.scopes);
+      for (const each of liveRooms()) each.setScopes(config.scopes);
+    }
+    if (patch.override && typeof patch.override === 'object') {
+      overrideConfig = mergeOverride((await readConfig(root)).override, patch.override);
+      config.override = overrideConfig;
     }
     if (patch.gemini) {
       config.gemini = { ...((await readConfig(root)).gemini ?? {}) };
       if (Number(patch.gemini.idleMs) > 0) { config.gemini.idleMs = Number(patch.gemini.idleMs); process.env.PULSE_GEMINI_IDLE_MS = String(Number(patch.gemini.idleMs)); }
       if (Number.isFinite(Number(patch.gemini.retries))) { config.gemini.retries = Number(patch.gemini.retries); process.env.PULSE_GEMINI_RETRIES = String(Number(patch.gemini.retries)); }
     }
-    room.configure(live);
+    for (const each of liveRooms()) each.configure(live);
     await updateConfig(root, config);
     if (live.memory) await wireOllama({ probe: false });
     await room.record('room.settings', { changed: Object.keys(config), settings: effectiveSettings() });
@@ -571,53 +781,54 @@ export async function createPulseServer({
   await quotaMonitor.start();
   // SSE fan-out works from the durable log, not from in-memory emits, so events
   // appended by another MADRE process on the same room reach open pages too.
-  // `clients` maps each SSE response to the last sequence it already holds.
-  const clients = new Map();
-  let lastBroadcastSequence = historicalEvents.at(-1)?.sequence ?? 0;
-  // Byte offset of the log already broadcast; the poller only reads past it.
-  let tailOffset = (await store.tail(0)).offset;
-  let inFlight = null;
-  let dirty = false;
+  // A feed is one record and the pages watching it: `clients` maps each SSE response to the last
+  // sequence it already holds, `sent` is the last sequence broadcast and `offset` the byte offset
+  // of the log already read. The open conversation has one; a conversation held open beside it
+  // (the window split in two) has its own, so neither page hears the other's record.
+  const feedOver = async (source, events) => ({ store: source, clients: new Map(), sent: events.at(-1)?.sequence ?? 0, offset: (await source.tail(0)).offset, inFlight: null, dirty: false });
+  const mainFeed = await feedOver(store, historicalEvents);
+  const clients = mainFeed.clients;
   // A client that stops draining is dropped instead of buffering without bound.
-  const writeEvent = (client, event) => {
+  const writeEvent = (client, event, feed = mainFeed) => {
     // Ghost events have no sequence: they are never in the log, so no `id:`
     // line, and a reconnecting client will not ask for them again.
     client.write(`${event.sequence ? `id: ${event.sequence}\n` : ''}data: ${JSON.stringify(event)}\n\n`);
     if (client.writableLength > sseMaxBufferedBytes) {
-      clients.delete(client);
+      feed.clients.delete(client);
       client.destroy();
       return false;
     }
     return true;
   };
 
-  function broadcastPending() {
-    if (inFlight) {
-      dirty = true;
-      return inFlight;
+  function pump(feed) {
+    if (feed.inFlight) {
+      feed.dirty = true;
+      return feed.inFlight;
     }
-    inFlight = (async () => {
+    feed.inFlight = (async () => {
       try {
         do {
-          dirty = false;
-          const { events, offset } = await store.tail(tailOffset);
-          tailOffset = offset;
+          feed.dirty = false;
+          const { events, offset } = await feed.store.tail(feed.offset);
+          feed.offset = offset;
           for (const event of events) {
-            if (event.sequence <= lastBroadcastSequence) continue;
-            for (const [client, floor] of clients) {
-              if (event.sequence > floor) writeEvent(client, event);
+            if (event.sequence <= feed.sent) continue;
+            for (const [client, floor] of feed.clients) {
+              if (event.sequence > floor) writeEvent(client, event, feed);
             }
-            lastBroadcastSequence = event.sequence;
+            feed.sent = event.sequence;
           }
-        } while (dirty);
+        } while (feed.dirty);
       } catch (error) {
         console.error(`MADRE broadcast error: ${error.message}`);
       } finally {
-        inFlight = null;
+        feed.inFlight = null;
       }
     })();
-    return inFlight;
+    return feed.inFlight;
   }
+  const broadcastPending = () => pump(mainFeed);
   let unsubscribe = () => {};
 
   // The error sentinel: failures MU/TH/UR cannot classify, and crashes, become
@@ -665,8 +876,65 @@ export async function createPulseServer({
   // Everything that listens to the open conversation, attached in one place so that opening
   // another attaches exactly the same things to it. Live readings go straight to whoever is
   // watching and are never stored, so a page that opens later simply never sees them.
+  // What waits for the human in a conversation (docs/MOBILE.md, MOV-004): a choice an agent offered
+  // or a line it asked to run, since the human last spoke; a mode a plan asked for, until it is
+  // decided. Kept as the room speaks, so the list of rooms on a phone never reads a ledger to know.
+  // What was left unanswered half a day ago is not waiting for anybody any more.
+  const asksByRoom = new WeakMap();
+  const ASK_FRESH_MS = 12 * 60 * 60 * 1000;
+  function trackAsks(target, history = []) {
+    const asks = new Map();
+    const feed = (event) => {
+      const said = event?.payload ?? {};
+      // The human answering clears what waited; a message BISHOP's channel brought is not the human.
+      if (event?.type === 'message.created' && said.role === 'user' && said.via !== 'bishop') { for (const key of [...asks.keys()]) asks.delete(key); }
+      else if (event?.type === 'choice.offered') asks.set(`choice:${said.responseMessageId}`, { kind: 'choice', agent: said.agent, text: said.question ?? null, at: event.timestamp });
+      else if (event?.type === 'run.requested') asks.set(`run:${said.responseMessageId}`, { kind: 'run', agent: said.agent, text: said.commands?.[0]?.line ?? null, at: event.timestamp });
+      else if (event?.type === 'run.started') asks.delete(`run:${said.responseMessageId}`);
+      // BISHOP (fase 4c): a #3/#4 proposal waits for the human's key in this room; in Salas, a
+      // plan with something to press waits until it closes.
+      else if (event?.type === 'bishop.order.proposed') asks.set(`bishop:${said.plan}:${said.step}`, { kind: 'bishop', agent: said.agent, mode: said.mode, text: said.text ?? null, at: event.timestamp });
+      else if (event?.type === 'bishop.plan.proposed' && [...(said.orders ?? []), ...(said.links ?? [])].some((item) => item.status === 'ready')) asks.set(`plan:${said.plan}`, { kind: 'plan', agent: 'bishop', text: said.reason ?? null, at: event.timestamp });
+      else if (event?.type === 'bishop.plan.closed') asks.delete(`plan:${said.plan}`);
+    };
+    for (const event of history) feed(event);
+    asksByRoom.set(target, asks);
+    return target.subscribe(feed);
+  }
+  function asksOf(target, now = Date.now()) {
+    const modes = (target.pendingModes?.() ?? []).map((asked) => ({ kind: 'mode', agent: asked.agent, mode: asked.mode, text: null }));
+    const kept = [...(asksByRoom.get(target)?.values() ?? [])].filter((ask) => now - Date.parse(ask.at ?? 0) < ASK_FRESH_MS);
+    return [...modes, ...kept];
+  }
+  let unsubscribeAsks = () => {};
+  // What a conversation's name and preview show of a message. One BISHOP's channel brought starts
+  // with the header its agent reads; the person sees the task, as the page shows it.
+  const saidText = (payload) => (payload?.via === 'bishop' ? String(payload.text ?? '').replace(/^BISHOP › [^\n]*\n+/, '') : payload?.text);
+  // What a module hears of the ledger (`onEvent`, docs/SDK.md; S-027 in docs/MACROVERSO.md): each
+  // event of each conversation alive in this room, once, with that conversation's room and id.
+  // A module hears only while it is on, gets the same context as everywhere else, and can only
+  // record what `record()` already allows (never a message, never a turn). What it does with an
+  // event is its own business and never holds up the room: a failure is logged and dropped.
+  function wireModules(target, id) {
+    return target.subscribe((event) => {
+      const listening = MODULES.filter((module) => typeof module.onEvent === 'function');
+      if (!listening.length) return;
+      void (async () => {
+        const ctx = await moduleContext();
+        for (const module of listening) {
+          const settings = module.settingsFrom(ctx.config);
+          if (module.kind === 'builtin' && !settings.enabled) continue;
+          await Promise.resolve(module.onEvent({ ...ctx, settings, room: target, chat: id, record: (type, payload) => target.record(type, payload) }, event))
+            .catch((error) => console.error(`MADRE module ${module.id}: onEvent failed: ${error.message}`));
+        }
+      })().catch((error) => console.error(`MADRE: a module could not hear an event: ${error.message}`));
+    });
+  }
+  let unsubscribeModules = () => {};
   function wireRoom() {
     unsubscribe = room.subscribe(() => { void broadcastPending(); });
+    unsubscribeModules = wireModules(room, chatId);
+    unsubscribeAsks = trackAsks(room, historicalEvents);
     unsubscribeSentinel = room.subscribe((event) => { void sentinel.observe(event).catch(() => null); });
     unsubscribeEyecat = room.subscribe((event) => { void eyecat.observe(event).catch(() => null); });
     unsubscribeGhost = room.subscribeGhost((event) => { for (const client of clients.keys()) writeEvent(client, event); });
@@ -676,8 +944,9 @@ export async function createPulseServer({
     unsubscribeChats = room.subscribe((event) => {
       if (event?.type !== 'message.created' || event.ghost) return;
       const human = event.payload?.role === 'user';
-      chatWrites = chatWrites.then(() => touchChat(roomDir, chatId, { text: human ? event.payload.text : null, counts: human })).catch(() => null);
+      chatWrites = chatWrites.then(() => touchChat(roomDir, chatId, { text: human ? saidText(event.payload) : null, counts: human })).catch(() => null);
     });
+    unsubscribeActivity = watchActivity(room, chatId);
     sentinel.seed(historicalEvents);
     eyecat.seed(historicalEvents);
     room.restoreAttachments(historicalEvents
@@ -685,40 +954,235 @@ export async function createPulseServer({
       .map((event) => ({ ...event.payload, path: join(attachmentsRoot, event.payload.fileName), dir: attachmentsRoot })));
   }
   function unwireRoom() {
-    for (const off of [unsubscribe, unsubscribeSentinel, unsubscribeEyecat, unsubscribeGhost, unsubscribeLive, unsubscribeChats]) { try { off(); } catch { /* already gone */ } }
-    unsubscribe = unsubscribeSentinel = unsubscribeEyecat = unsubscribeGhost = unsubscribeLive = unsubscribeChats = () => {};
+    for (const off of [unsubscribe, unsubscribeSentinel, unsubscribeEyecat, unsubscribeGhost, unsubscribeLive, unsubscribeChats, unsubscribeActivity, unsubscribeAsks, unsubscribeModules]) { try { off(); } catch { /* already gone */ } }
+    unsubscribe = unsubscribeSentinel = unsubscribeEyecat = unsubscribeGhost = unsubscribeLive = unsubscribeChats = unsubscribeActivity = unsubscribeModules = () => {};
+  }
+
+  // TURNS: how much the room may do at once. On by default. Several conversations may be at work
+  // together (a turn that is taking its time no longer holds the human hostage) and each may run a
+  // few turns, both within limits the human sets in MU/TH/UR. Off, the room is what it was: one
+  // conversation drives the crew, and switching away from one that is working is refused.
+  const turnsPolicy = async () => {
+    const saved = (await readConfig(root)).turns ?? {};
+    const clamp = (value, low, high, fallback) => (Number.isInteger(Number(value)) ? Math.min(high, Math.max(low, Number(value))) : fallback);
+    // Three conversations by default: as many as fit on screen at once (the open one and two beside
+    // it, MAX_BESIDE in app.js), so every one the human can see may be at work.
+    return { enabled: saved.enabled !== false, chats: clamp(saved.chats, 1, 6, 3), turnsPerChat: clamp(saved.turnsPerChat, 1, 8, 3) };
+  };
+  // Conversations held open beside the one on screen. Two reasons to hold one: it is still at work
+  // after the human moved to another (parked: it keeps writing its record, and the page only hears
+  // that it is working and when a turn ends), or a page is watching it in the other half of the
+  // window (it has a feed of its own and takes messages addressed to it). One room per record,
+  // always: opening a held conversation takes the room that is already there. When nothing is
+  // running in it and nobody is watching, it closes itself.
+  const busyChats = () => [...parked.entries()].filter(([, held]) => held.room.busy()).map(([id]) => id);
+  const sayToAll = (type, payload) => {
+    const event = { id: `live-${randomUUID()}`, sequence: null, live: true, timestamp: new Date().toISOString(), type, payload };
+    for (const client of clients.keys()) writeEvent(client, event);
+  };
+  // The servers sentinel: this project's servers, watched while a page is open and RIPLEY is on,
+  // with what comes up and what goes down said live to every page and to no ledger.
+  const serverSentinel = new ServerSentinel({
+    projectRoot: canonicalProjectRoot,
+    self: () => listening?.address?.()?.port ?? null,
+    listen: async () => (await execFileAsync('lsof', ['-nP', '-iTCP', '-sTCP:LISTEN'], { timeout: 4000, maxBuffer: 2 * 1024 * 1024 })).stdout,
+    // lsof exits 1 when one of the processes is already gone, and still prints the others.
+    cwdsOf: (pids) => execFileAsync('lsof', ['-a', '-p', pids.join(','), '-d', 'cwd', '-Fpn'], { timeout: 4000, maxBuffer: 1024 * 1024 })
+      .then((result) => result.stdout, (error) => String(error.stdout ?? '')),
+    probe: (port) => probePort(port, { fetchImpl: reportFetch }),
+    isRoom: async (port) => {
+      const answer = await reportFetch(`http://127.0.0.1:${port}/api/version`, { signal: AbortSignal.timeout(800) });
+      const said = answer.ok ? await answer.json().catch(() => null) : null;
+      return said?.name === PACKAGE.name;
+    },
+    emit: (type, payload) => sayToAll(type, payload),
+    active: async () => clients.size > 0 && await ripleyOn(),
+  });
+  if (!testMode) serverSentinel.start();
+  const endClients = (feed) => { for (const client of [...feed.clients.keys()]) { feed.clients.delete(client); try { client.end(); } catch { /* already gone */ } } };
+  async function closeHeld(id) {
+    const held = parked.get(id);
+    if (!held) return;
+    parked.delete(id);
+    held.off();
+    await held.room.shutdown().catch(() => null);
+    retireLedger(held.store);
+  }
+  // A held conversation with no turn running and nobody watching it has no reason to stay open.
+  async function releaseIfIdle(id, target = null) {
+    const held = parked.get(id);
+    if (!held || (target && held.room !== target)) return;
+    if (held.room.busy() || held.room.hasLiveRuns?.() || held.feed?.clients.size) return;
+    await closeHeld(id);
+  }
+  // A conversation's turns starting and ending, said to every page whichever conversation it shows.
+  // The settle after an end is read a moment later: the turn leaves the room after its last event.
+  function watchActivity(target, id) {
+    return target.subscribe((event) => {
+      if (!['agent.started', 'agent.completed', 'message.failed'].includes(event?.type)) return;
+      const started = event.type === 'agent.started';
+      sayToAll('chat.activity', { chatId: id, working: true, ...(started ? {} : { finished: { agent: event.payload?.agent ?? event.payload?.target ?? null, ok: event.type === 'agent.completed' } }) });
+      if (started) return;
+      setTimeout(() => {
+        if (target.busy()) return;
+        sayToAll('chat.activity', { chatId: id, working: false });
+        void releaseIfIdle(id, target);
+      }, 400).unref?.();
+    });
+  }
+  // What a held conversation keeps doing while it is not the one on screen: its list entry follows
+  // what is said in it, and every page hears when a turn in it starts and ends.
+  function hold(id, target, source) {
+    const offTouch = target.subscribe((event) => {
+      if (event?.type !== 'message.created' || event.ghost) return;
+      const human = event.payload?.role === 'user';
+      chatWrites = chatWrites.then(() => touchChat(roomDir, id, { text: human ? saidText(event.payload) : null, counts: human })).catch(() => null);
+    });
+    const offActivity = watchActivity(target, id);
+    const offModules = wireModules(target, id);
+    let offAsks = () => {};
+    void source?.readAll?.().then((history) => { offAsks = trackAsks(target, history); }).catch(() => null);
+    const entry = { room: target, store: source, feed: null, off: () => { offTouch(); offActivity(); offAsks(); offModules(); } };
+    parked.set(id, entry);
+    return entry;
+  }
+  // A page starts watching a held conversation: it gets its own feed, fed by its own room.
+  async function watchHeld(entry) {
+    if (entry.feed) return entry.feed;
+    const feed = await feedOver(entry.store, await entry.store.readAll());
+    if (entry.feed) return entry.feed;
+    entry.feed = feed;
+    const offs = [
+      entry.room.subscribe(() => { void pump(feed); }),
+      entry.room.subscribeGhost((event) => { for (const client of [...feed.clients.keys()]) writeEvent(client, event, feed); }),
+      entry.room.subscribeLive((event) => { for (const client of [...feed.clients.keys()]) writeEvent(client, event, feed); }),
+    ];
+    const before = entry.off;
+    entry.off = () => { before(); for (const off of offs) { try { off(); } catch { /* already gone */ } } endClients(feed); };
+    return feed;
+  }
+  // The conversation a request is about. Without `?chat=`, or naming the one on screen, it is the
+  // open conversation, exactly as before. Naming another opens it beside, without changing which
+  // one is on screen: the same room a parked conversation already has, or a new one built the way
+  // mountChat builds one.
+  // The room on screen, for the places where a route names its own conversation `room`.
+  const openRoom = () => room;
+  async function scopeOf(url) {
+    const asked = url.searchParams.get('chat');
+    if (!asked || asked === chatId) return { id: chatId, room, store, feed: mainFeed, main: true };
+    if (!isChatId(asked)) return { error: `No conversation "${asked}".` };
+    let entry = parked.get(asked);
+    if (!entry) {
+      if (!opening.has(asked)) {
+        opening.set(asked, (async () => {
+          if (!(await listChats(roomDir)).chats.some((chat) => chat.id === asked)) return null;
+          const source = await openLedger(asked);
+          const events = await source.readAll();
+          const opened = new Room(roomOptions({ store: source, historicalEvents: events }));
+          // A conversation opened from disk runs nothing yet: a turn it shows as started was cut
+          // by a room that died, and is closed as one (LOG-14 of the 1.0 review). Only the
+          // conversation open at startup was reconciled, so the others «thought» forever.
+          await opened.reconcile();
+          wireLocal(opened);
+          await applyRoomSettings(opened, room);
+          opened.restoreAttachments(events
+            .filter((event) => event.type === 'attachment.stored')
+            .map((event) => ({ ...event.payload, path: join(attachmentsRoot, event.payload.fileName), dir: attachmentsRoot })));
+          const made = hold(asked, opened, source);
+          // Opened to be looked at; if no page comes to watch it, it closes again.
+          setTimeout(() => { void releaseIfIdle(asked, opened); }, heldGraceMs).unref?.();
+          return made;
+        })().finally(() => opening.delete(asked)));
+      }
+      entry = await opening.get(asked);
+      if (!entry) return { error: `No conversation "${asked}".` };
+    }
+    // It may have become the open one while it was being built.
+    if (asked === chatId) return { id: chatId, room, store, feed: mainFeed, main: true };
+    return { id: asked, room: entry.room, store: entry.store, entry, main: false };
+  }
+  let unsubscribeActivity = () => {};
+  const chatsView = async () => {
+    const list = await listChats(roomDir);
+    const working = new Set([...busyChats(), ...(room?.busy() ? [chatId] : [])]);
+    return { ...list, chats: list.chats.map((chat) => (working.has(chat.id) ? { ...chat, working: true } : chat)) };
+  };
+  // What the human set while the room was open belongs to the project, not to one conversation's
+  // record: a room opened for another chat used to start with no MAX MODE, no Ash, no Choices and
+  // the timeouts MADRE booted with.
+  async function applyRoomSettings(next, previous) {
+    const config = await readConfig(root);
+    next.setScopes(config.scopes ?? {});
+    next.setAsh(Boolean(config.modules?.ash?.enabled));
+    next.setChoices(Boolean(config.modules?.choices?.enabled));
+    next.setRuns(Boolean(config.modules?.runs?.enabled));
+    if (previous) next.configure(previous.settings());
   }
 
   // Opening another conversation. The project keeps its memory, its crew, its modules, its
-  // privacy list and its numbering; what changes is the record being written and read. One
-  // conversation drives the crew at a time — two threads editing the same working tree at once
-  // is not a feature, it is a way to lose work — so a turn in flight is a reason to refuse.
+  // privacy list and its numbering; what changes is the record being shown. With TURNS on, a
+  // conversation still at work is parked, not stopped; with it off, a turn in flight is a reason to
+  // refuse, as it always was.
   async function mountChat(id) {
     if (!isChatId(id)) return { error: `No conversation "${id}".` };
-    if (room && room.working()) return { error: t('A turn is running in this conversation. Let it finish, or STOP ALL, and try again.') };
+    const policy = await turnsPolicy();
+    const leaving = room;
+    const leavingBusy = Boolean(leaving?.busy());
+    if (leavingBusy && !policy.enabled) return { error: t('A turn is running in this conversation. Let it finish, or STOP ALL, and try again.') };
     const opened = await openChatIndex(roomDir, id);
     if (!opened) return { error: `No conversation "${id}".` };
+    // A room being built for it beside is the room it gets; never a second one over its record.
+    await opening.get(id)?.catch(() => null);
     unwireRoom();
     await chatWrites.catch(() => null);
-    await room?.shutdown().catch(() => null);
+    // A conversation with a command still alive (a server it started) is parked too, never closed
+    // under the process: its card is where that process is stopped.
+    if (leaving && (leavingBusy || leaving.hasLiveRuns?.()) && chatId !== id) {
+      // Still writing its record and touching the list; only the page stops watching it.
+      hold(chatId, leaving, store);
+    } else if (leaving) {
+      await leaving.shutdown().catch(() => null);
+      retireLedger(store);
+    }
     chatId = id;
-    store = await new EventStore(chatLedger(roomDir, id), { floor: await projectFloor(roomDir, { except: id }) }).initialize();
-    historicalEvents = await store.readAll();
-    room = new Room(roomOptions());
-    room.setInvoker(MADRE_ADAPTER, madreInvoker({ memory, ollama: () => ({ ...ollama, chatModel: ollama.madreModel ?? ollama.chatModel }), fetchImpl: reportFetch }));
+    const held = parked.get(id);
+    if (held) {
+      // Back to a conversation that kept working, or that was open beside: the same room, not a
+      // second one over its record. A page watching it there comes back to it as the open one.
+      parked.delete(id);
+      held.off();
+      room = held.room;
+      store = held.store;
+      historicalEvents = await store.readAll();
+    } else {
+      store = await openLedger(id);
+      historicalEvents = await store.readAll();
+      room = new Room(roomOptions());
+      // Opened from disk: what it shows as started was cut by a room that died (LOG-14).
+      if (await room.reconcile()) historicalEvents = await store.readAll();
+      wireLocal(room);
+      await applyRoomSettings(room, leaving);
+    }
     wireRoom();
-    // Whoever is watching is watching the wrong record now: their stream ends and they come back
-    // to the one that is open.
-    lastBroadcastSequence = historicalEvents.at(-1)?.sequence ?? 0;
-    tailOffset = (await store.tail(0)).offset;
-    for (const client of [...clients.keys()]) { clients.delete(client); try { client.end(); } catch { /* already gone */ } }
+    // Whoever is watching the open conversation is watching the wrong record now: their stream
+    // ends and they come back to the one that is open. A page watching another conversation
+    // beside it has a feed of its own and is not touched.
+    mainFeed.store = store;
+    mainFeed.sent = historicalEvents.at(-1)?.sequence ?? 0;
+    mainFeed.offset = (await store.tail(0)).offset;
+    endClients(mainFeed);
     return { chat: opened };
   }
   wireRoom();
-  const poller = setInterval(() => { void broadcastPending(); }, broadcastIntervalMs);
+  const poller = setInterval(() => {
+    void broadcastPending();
+    for (const held of parked.values()) if (held.feed) void pump(held.feed);
+  }, broadcastIntervalMs);
   poller.unref();
 
   let installing = null;
+  // Intenciones' reading of every conversation, kept per ledger file until that file changes.
+  const observedLedgers = new Map();
   // The context a module works in: the project, its settings, the room, and what this server offers.
   async function moduleContext() {
     const config = await readConfig(root);
@@ -728,8 +1192,68 @@ export async function createPulseServer({
       updateConfig: (patch) => updateConfig(root, patch),
       record: (type, payload) => room.record(type, payload),
       services: {
+        // Into one named conversation of this room, opened beside if it is not alive; the open one
+        // when the name is missing or no longer exists. The same `record()` and the same refusals.
+        recordIn: async (id, type, payload) => {
+          const here = typeof id === 'string' && id ? await scopeOf(new URL(`http://room/?chat=${encodeURIComponent(id)}`)) : { room };
+          return (here.error ? room : here.room).record(type, payload);
+        },
         imageKey,
         setImageModule,
+        // Intenciones keeps its measurements beside the project's room, reads the open
+        // conversation, and asks agents through the same bench EYECAT and the archivist draw on.
+        intents: {
+          roomDir,
+          events: () => store.readAll(),
+          bench: () => room.bench(),
+          // The questions to calibrate with are the project's, not one conversation's: a new
+          // conversation would otherwise have nothing to ask. Only what was said is read.
+          projectEvents: async () => {
+            const said = [];
+            for (const chat of (await listChats(roomDir)).chats) {
+              const text = await readFile(chatLedger(roomDir, chat.id), 'utf8').catch(() => '');
+              for (const line of text.split('\n')) {
+                if (!line.includes('"message.created"')) continue;
+                try { const event = JSON.parse(line); if (event.type === 'message.created') said.push(event); } catch { /* a torn last line */ }
+              }
+            }
+            return said;
+          },
+          // Every conversation's turns, cut down to what learning from real use reads: who was
+          // asked what, at which effort, how it ended, what it cost and what the human said of it.
+          // A ledger is parsed again only when it changed on disk.
+          ledgers: async () => {
+            const turns = [];
+            for (const chat of (await listChats(roomDir)).chats) {
+              const file = chatLedger(roomDir, chat.id);
+              const seen = await stat(file).catch(() => null);
+              if (!seen) continue;
+              let kept = observedLedgers.get(file);
+              if (!kept || kept.mtimeMs !== seen.mtimeMs || kept.size !== seen.size) {
+                const text = await readFile(file, 'utf8').catch(() => '');
+                const events = [];
+                for (const line of text.split('\n')) {
+                  if (!/"(message\.created|message\.failed|message\.rated|usage\.recorded|turn\.stopped)"/.test(line)) continue;
+                  try { const one = observable(JSON.parse(line), chat.id); if (one) events.push(one); } catch { /* a torn last line */ }
+                }
+                kept = { mtimeMs: seen.mtimeMs, size: seen.size, events };
+                observedLedgers.set(file, kept);
+              }
+              turns.push(...kept.events);
+            }
+            return turns;
+          },
+          // The effort Codex runs at when told none, from its own config: a turn sent without one
+          // ran there. Claude never says, and its turns stay at «its default».
+          defaults: async () => {
+            const codex = agents.find((agent) => agent.id === 'codex');
+            if (!codex) return {};
+            const found = (await discoverModels({ agents: [codex], config: await readConfig(root) }))?.codex;
+            if (!found) return {};
+            const byModel = Object.fromEntries(Object.entries(found.effortsByModel ?? {}).filter(([, one]) => one?.default).map(([slug, one]) => [slug, one.default]));
+            return { codex: { effort: found.effortDefault ?? null, byModel } };
+          },
+        },
         // What a card knows about being up to date. Reading is free: it answers from the day's
         // cache. The button on a card is what forces a look outside.
         moduleUpdate: (item, { force = false, cacheOnly = !force } = {}) => moduleUpdate(item, {
@@ -826,7 +1350,12 @@ export async function createPulseServer({
     const extension = extensionById(id);
     if (!extension) return { status: 404, body: { error: `Unknown module: ${id}.` } };
     // Built-ins are switches the module itself defines.
-    if (extension.toggle) return extension.toggle(await moduleContext(), payload);
+    if (extension.toggle) {
+      const toggled = await extension.toggle(await moduleContext(), payload);
+      // The switch flips the open conversation; the ones alive beside it follow.
+      for (const held of parked.values()) await applyRoomSettings(held.room, null);
+      return toggled;
+    }
     if (confirm !== true) return { status: 400, body: { error: t('Installing a module writes into the project; send { "confirm": true } to proceed.') } };
     if (installing) return { status: 409, body: { error: `Another install is running (${installing}).` } };
     const preflight = extension.preflight ? await extension.preflight(canonicalProjectRoot) : { ok: true, problems: [] };
@@ -885,13 +1414,17 @@ export async function createPulseServer({
     // not beside the first route that happened to need it: a const sits in its temporal dead zone
     // until its own line runs, so any route above it threw instead of refusing.
     const designationOk = (given) => typeof given === 'string' && given.trim().toLowerCase() === basename(canonicalProjectRoot).toLowerCase();
+    // A request the bridge passed on from a paired phone. It reaches the room from 127.0.0.1 like
+    // anything on this Mac, so «only from this computer» has to ask this too.
+    const viaPhone = typeof request.headers['x-madre-device'] === 'string';
+    const phoneKind = viaPhone ? String(request.headers['x-madre-device-kind'] ?? 'other').slice(0, 20) : null;
     try {
       if (request.method === 'GET' && url.pathname === '/') {
         const html = await readFile(join(publicDirectory, 'index.html'));
-        response.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });
+        response.writeHead(200, { 'content-type': 'text/html; charset=utf-8', ...PAGE_GUARDS });
         return response.end(html);
       }
-      if (request.method === 'GET' && ['/app.js', '/brands.js', '/troubleshooting.js', '/inquiry.js', '/i18n.js', '/es.js', '/resay.js', '/syntax.js', '/routing.js', '/abduction.js'].includes(url.pathname)) {
+      if (request.method === 'GET' && ['/app.js', '/nostromo-engine.js', '/brands.js', '/troubleshooting.js', '/inquiry.js', '/i18n.js', '/es.js', '/resay.js', '/syntax.js', '/editor.js', '/routing.js', '/abduction.js', '/review-ask.js', '/loader.js', '/tour.js', '/tour-chapters.js', '/touch.js'].includes(url.pathname)) {
         const js = await readFile(join(publicDirectory, url.pathname.slice(1)));
         response.writeHead(200, { 'content-type': 'text/javascript; charset=utf-8' });
         return response.end(js);
@@ -907,6 +1440,56 @@ export async function createPulseServer({
         ['/assets/abduction-cat-control-left.png', 'abduction-cat-control-left.png'],
         ['/assets/abduction-cat-control-right.png', 'abduction-cat-control-right.png'],
       ]);
+      // The brand: its typefaces (SIL OFL, licences beside them) and the favicon, served from the
+      // package itself. Nothing is fetched from a font service: the room never leaves this machine
+      // to draw a letter.
+      const brandAssets = new Map([
+        ['/assets/brand/Sora-latin.woff2', 'font/woff2'],
+        ['/assets/brand/Sora-latin-ext.woff2', 'font/woff2'],
+        ['/assets/brand/JetBrainsMono-latin.woff2', 'font/woff2'],
+        ['/assets/brand/JetBrainsMono-latin-ext.woff2', 'font/woff2'],
+        ['/assets/brand/Geist-latin.woff2', 'font/woff2'],
+        ['/assets/brand/Geist-latin-ext.woff2', 'font/woff2'],
+        ['/assets/brand/GeistMono-latin.woff2', 'font/woff2'],
+        ['/assets/brand/GeistMono-latin-ext.woff2', 'font/woff2'],
+        ['/assets/brand/OFL-Geist.txt', 'text/plain; charset=utf-8'],
+        ['/assets/brand/OFL-GeistMono.txt', 'text/plain; charset=utf-8'],
+        ['/assets/brand/OFL-Sora.txt', 'text/plain; charset=utf-8'],
+        ['/assets/brand/OFL-JetBrainsMono.txt', 'text/plain; charset=utf-8'],
+        ['/assets/brand/madre-favicon.svg', 'image/svg+xml'],
+        // The conversation's wallpapers (Appearance): twelve pictures, encoded by hand from their
+        // masters (cwebp), whose light and dark, layer or mesh and intensity are layers in the CSS.
+        ['/assets/wallpapers/jarrito.webp', 'image/webp'],
+        ['/assets/wallpapers/canela.webp', 'image/webp'],
+        ['/assets/wallpapers/paraiso.webp', 'image/webp'],
+        ['/assets/wallpapers/ventura.webp', 'image/webp'],
+        ['/assets/wallpapers/magna.webp', 'image/webp'],
+        ['/assets/wallpapers/biznaga.webp', 'image/webp'],
+        ['/assets/wallpapers/oceano.webp', 'image/webp'],
+        ['/assets/wallpapers/quila.webp', 'image/webp'],
+        ['/assets/wallpapers/xico.webp', 'image/webp'],
+        ['/assets/wallpapers/tropical.webp', 'image/webp'],
+        ['/assets/wallpapers/tradicion.webp', 'image/webp'],
+        ['/assets/wallpapers/urbania.webp', 'image/webp'],
+        // The pictures of the «what's new» board, one per thing it tells (src/whats-new.mjs).
+        ['/assets/news/1.0/settings.webp', 'image/webp'],
+        ['/assets/news/1.0/mother.webp', 'image/webp'],
+        ['/assets/news/1.0/intents.webp', 'image/webp'],
+        ['/assets/news/1.0/permissions.webp', 'image/webp'],
+        ['/assets/news/1.0/github.webp', 'image/webp'],
+        ['/assets/news/1.0/bar.webp', 'image/webp'],
+        ['/assets/news/1.0/modules.webp', 'image/webp'],
+        ['/assets/news/1.0/nostromo.webp', 'image/webp'],
+        ['/assets/news/1.0/room.webp', 'image/webp'],
+        ['/assets/news/1.0/looks.webp', 'image/webp'],
+        ['/assets/news/1.0/alerts.webp', 'image/webp'],
+        ['/assets/news/1.0/finder.webp', 'image/webp'],
+      ]);
+      if (request.method === 'GET' && brandAssets.has(url.pathname)) {
+        const file = await readFile(join(publicDirectory, url.pathname.slice(1)));
+        response.writeHead(200, { 'content-type': brandAssets.get(url.pathname), 'content-length': file.length, 'cache-control': 'public, max-age=86400' });
+        return response.end(file);
+      }
       if (request.method === 'GET' && abductionAssets.has(url.pathname)) {
         const image = await readFile(join(publicDirectory, 'assets', abductionAssets.get(url.pathname)));
         response.writeHead(200, {
@@ -916,20 +1499,527 @@ export async function createPulseServer({
         });
         return response.end(image);
       }
+      // ---------- The phone (docs/MOBILE.md) ----------
+      // Pairing and the list of phones are the Mac's alone: nothing that came through the bridge
+      // reaches them.
+      if (url.pathname === '/api/phone' || url.pathname.startsWith('/api/phone/')) {
+        if (viaPhone) return sendJson(response, 403, { error: t('This is done on the Mac.') });
+        if (!(await phonePreview())) {
+          if (request.method === 'GET' && url.pathname === '/api/phone') return sendJson(response, 200, { preview: false });
+          return sendJson(response, 404, { error: t('Not found.') });
+        }
+        if (request.method === 'GET' && url.pathname === '/api/phone') return sendJson(response, 200, { preview: true, ...(await phoneView()) });
+        const payload = request.method === 'POST' ? await body(request).catch(() => ({})) : {};
+        if (request.method === 'POST' && url.pathname === '/api/phone/trust') {
+          const here = await currentNetwork().catch(() => null);
+          if (!here) return sendJson(response, 412, { error: t('MADRE cannot tell which network this computer is on.') });
+          await trustNetwork(root, { id: here.id, name: typeof payload.name === 'string' ? payload.name : null });
+          await phone.tick();
+          return sendJson(response, 200, await phoneView());
+        }
+        if (request.method === 'POST' && url.pathname === '/api/phone/invite') {
+          const here = await currentNetwork().catch(() => null);
+          const store = await readStore(root);
+          if (!here || !store.networks.some((one) => one.id === here.id)) return sendJson(response, 412, { error: t('Mark this network as trusted first.'), trust: true });
+          const address = lanAddresses({ device: here.device })[0];
+          if (!address) return sendJson(response, 412, { error: t('This Mac has no address on the local network.') });
+          if (!store.enabled) await setEnabled(root, true);
+          const invite = await createInvite(root);
+          await phone.tick();
+          // Whichever room hosts it, the bridge has to answer before the code is shown.
+          for (let wait = 0; wait < 10 && !(await bridgeAnswers()); wait += 1) await new Promise((done) => setTimeout(done, 200));
+          if (!(await bridgeAnswers())) return sendJson(response, 503, { error: t('MADRE on your phone did not open on port {port}. Another program may be using it.', { port: BRIDGE_PORT }) });
+          const link = `http://${address}:${BRIDGE_PORT}/bridge/pair?c=${invite.code}`;
+          return sendJson(response, 200, { invite: { id: invite.id, expiresAt: invite.expiresAt }, url: link, qr: qrSvg(link, { label: t('Code to pair your phone') }), ...(await phoneView()) });
+        }
+        if (request.method === 'POST' && url.pathname === '/api/phone/forget') {
+          await forgetDevice(root, String(payload.id ?? ''));
+          await phone.tick();
+          return sendJson(response, 200, await phoneView());
+        }
+        if (request.method === 'POST' && url.pathname === '/api/phone/networks/forget') {
+          await forgetNetwork(root, String(payload.id ?? ''));
+          await phone.tick();
+          return sendJson(response, 200, await phoneView());
+        }
+        if (request.method === 'POST' && url.pathname === '/api/phone/enabled') {
+          await setEnabled(root, payload.on !== false);
+          await phone.tick();
+          return sendJson(response, 200, await phoneView());
+        }
+        return sendJson(response, 404, { error: t('Not found.') });
+      }
+      // The room in one line, for the list of rooms on the phone.
+      if (request.method === 'GET' && url.pathname === '/api/glance') {
+        const { chats } = await listChats(roomDir);
+        const latest = chats[0] ?? null;
+        const working = new Set(room.activeTurns().map((turn) => turn.agent));
+        for (const held of parked.values()) for (const turn of held.room.activeTurns()) working.add(turn.agent);
+        // What waits for the human, and in which conversation, so the phone opens straight to it.
+        const titleOf = (id) => chats.find((one) => one.id === id)?.title ?? null;
+        const waiting = [
+          ...asksOf(room).map((ask) => ({ ...ask, chat: chatId, chatTitle: titleOf(chatId) })),
+          ...[...parked.entries()].flatMap(([id, held]) => asksOf(held.room).map((ask) => ({ ...ask, chat: id, chatTitle: titleOf(id) }))),
+        ];
+        return sendJson(response, 200, {
+          project: basename(canonicalProjectRoot),
+          version: PACKAGE.version ?? null,
+          chats: chats.length,
+          chat: latest ? { id: latest.id, title: latest.title, named: latest.named, preview: latest.preview, at: latest.updatedAt, messages: latest.messages } : null,
+          working: [...working],
+          waiting: waiting.slice(0, 5).map(({ kind, agent, mode, text, chat, chatTitle }) => ({ kind, agent, mode: mode ?? undefined, text: typeof text === 'string' ? text.slice(0, 140) : null, chat, chatTitle })),
+          waitingCount: waiting.length,
+          // What the archive holds, counted, when Salas asks (?census=1): never the words, only how
+          // many of each kind and how many travel into turns.
+          ...(url.searchParams.get('census') === '1' ? { census: memoryCensus() } : {}),
+        });
+      }
+      // ---- Salas on the Mac (src/salas.mjs, docs/MACROVERSO.md). The page speaks only to this
+      // room; this room speaks to the others from here, the way the phone's bridge does. Opening,
+      // closing and stopping rooms is the Mac's: a phone never reaches these.
+      if ((url.pathname === '/salas' || url.pathname.startsWith('/api/salas') || url.pathname === '/api/room/close') && viaPhone) {
+        return sendJson(response, 403, { error: t('This is done on the Mac.') });
+      }
+      if (request.method === 'GET' && url.pathname === '/salas') {
+        const html = await readFile(join(publicDirectory, 'salas-mac.html'));
+        response.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-cache', ...PAGE_GUARDS });
+        return response.end(html);
+      }
+      if (request.method === 'GET' && (url.pathname === '/salas-mac.js' || url.pathname === '/salas-mac.css' || url.pathname === '/macroverso.js')) {
+        const file = await readFile(join(publicDirectory, url.pathname.slice(1)));
+        response.writeHead(200, { 'content-type': url.pathname.endsWith('.js') ? 'text/javascript; charset=utf-8' : 'text/css; charset=utf-8', 'cache-control': 'no-cache' });
+        return response.end(file);
+      }
+      if (request.method === 'GET' && url.pathname === '/api/salas') {
+        const rooms = await knownRooms(root);
+        const here = basename(roomDir);
+        const seen = await Promise.all(rooms.map(async (one) => ({
+          ...one,
+          here: one.id === here,
+          glance: one.open ? await askRoom(one.open.port, '/api/glance?census=1') : null,
+        })));
+        // The links in force (docs/MACROVERSO.md, fase 3c), each with what crossed: counted from the
+        // lines the serving room keeps beside its record, never from a ledger. `salas` is the id of
+        // the room of Salas, whether or not that room exists yet (phase 3d).
+        const salas = salasRoomId(root);
+        const enlaces = await Promise.all(activeContracts(await readConfig(root), { salas }).map(async (contract) => ({ ...contract, traffic: await linkTraffic(servingRooms(contract).map((id) => join(root, 'rooms', id)), contract) })));
+        return sendJson(response, 200, { mac: hostname().replace(/\.local$/i, ''), language: roomLanguage(), here, version: PACKAGE.version ?? null, rooms: seen, handoff: (await readHandoff(root)).mac ?? null, salas, enlaces, phonePreview: await phonePreview() });
+      }
+      // The open rooms, each in one line (its glance: who works, who waits, its last conversation;
+      // never its census or the links), for the room's switcher (2026-10-10), asked every few
+      // seconds while a room's page is in view. Read only by this Mac's own pages, as the work is.
+      if (request.method === 'GET' && url.pathname === '/api/salas/open') {
+        const host = String(request.headers.host ?? '');
+        const site = request.headers['sec-fetch-site'];
+        if (!/^(127\.0\.0\.1|localhost)(:\d+)?$/.test(host) || (site !== undefined && site !== 'same-origin' && site !== 'none')) return sendJson(response, 403, { error: t('This is done from Home, on this Mac.') });
+        const here = basename(roomDir);
+        const rooms = (await knownRooms(root)).filter((one) => one.open);
+        const seen = await Promise.all(rooms.map(async (one) => ({
+          id: one.id,
+          name: one.name,
+          port: one.open.port,
+          here: one.id === here,
+          glance: one.id === here ? null : await askRoom(one.open.port, '/api/glance'),
+        })));
+        return sendJson(response, 200, { here, salas: salasRoomId(root), rooms: seen });
+      }
+      // One room as the Macroverso draws it: its memories and the veins between them, read from
+      // that room the way its own NOSTROMO reads them (`/api/memory`, with its designation). Without
+      // `full` no words cross: a far universe is drawn from kinds, zones and sizes alone; the chosen
+      // one asks for them. A phone never reaches this (above).
+      if (request.method === 'GET' && url.pathname === '/api/salas/universe') {
+        const id = url.searchParams.get('id') ?? '';
+        const room = (await knownRooms(root)).find((one) => one.id === id);
+        if (!room) return sendJson(response, 404, { error: t('MADRE does not know that project on this Mac.') });
+        if (!room.open) return sendJson(response, 200, { id, asleep: true });
+        const answer = await askRoom(room.open.port, `/api/memory?designation=${encodeURIComponent(room.name)}`, { timeoutMs: 4000 });
+        if (answer.outdated) return sendJson(response, 200, { id, outdated: true });
+        if (answer.unreachable) return sendJson(response, 200, { id, sealed: answer.status === 423, unreachable: answer.status !== 423 });
+        return sendJson(response, 200, { id, ...universeOf(answer, { full: url.searchParams.get('full') === '1' }) });
+      }
+      if (request.method === 'POST' && url.pathname === '/api/salas/start') {
+        const payload = await body(request).catch(() => ({}));
+        let room = (await knownRooms(root)).find((one) => one.id === payload.room);
+        // BISHOP's own room is MADRE's: talking to it from the lobby wakes it even the first time,
+        // before it was ever opened (its folder is made then, empty, as `madre lobby` makes it).
+        if (!room && payload.room === salasRoomId(root)) {
+          const folder = await ensureSalasProject(root);
+          room = { id: payload.room, root: folder, open: null };
+        }
+        if (!room) return sendJson(response, 404, { error: t('MADRE does not know that project on this Mac.') });
+        if (room.open) return sendJson(response, 200, { room: room.id, port: room.open.port, already: true });
+        if (!room.root) return sendJson(response, 404, { error: t('The folder of that project is no longer on this Mac.') });
+        startRoom({ projectRoot: room.root, roomDir: join(root, 'rooms', room.id) });
+        const up = await roomComesUp(root, room.id);
+        if (!up) return sendJson(response, 504, { error: t('The project did not open. What it said on the way up is in start.log, beside its record.') });
+        return sendJson(response, 200, { room: up.id, port: up.open.port });
+      }
+      // ---- The lobby adds projects (2026-10-10, src/salas.mjs). Only this page, on this Mac: a
+      // phone was refused above; another site is refused here, whether it tries to read the
+      // folders (Sec-Fetch-Site) or to add one (Origin), and so is any host name but this Mac's
+      // own, so a name pointed at it from outside reaches nothing. Folders are listed inside the
+      // home folder only; what is listed is names, never what a file says.
+      if (url.pathname === '/api/salas/folders' || url.pathname === '/api/salas/suggestions' || url.pathname === '/api/salas/projects' || url.pathname === '/api/salas/work' || url.pathname === '/api/salas/decisions') {
+        const host = String(request.headers.host ?? '');
+        const localHost = /^(127\.0\.0\.1|localhost)(:\d+)?$/.test(host);
+        const site = request.headers['sec-fetch-site'];
+        if (!localHost || (site !== undefined && site !== 'same-origin' && site !== 'none')) return sendJson(response, 403, { error: t('This is done from Home, on this Mac.') });
+        if (request.method === 'POST' && request.headers.origin !== `http://${host}`) return sendJson(response, 403, { error: t('This is done from Home, on this Mac.') });
+        const home = process.env.PULSE_LOBBY_HOME || homedir();
+        if (request.method === 'GET' && url.pathname === '/api/salas/folders') {
+          const listed = await listFolders({ path: url.searchParams.get('path') || null, home, stateRoot: root });
+          if (listed.error === 'outside') return sendJson(response, 403, { error: t('Only folders inside your home folder.') });
+          if (listed.error) return sendJson(response, 404, { error: t('That folder is not there.') });
+          return sendJson(response, 200, listed);
+        }
+        if (request.method === 'GET' && url.pathname === '/api/salas/suggestions') {
+          return sendJson(response, 200, { suggestions: await suggestProjects({ home, stateRoot: root }) });
+        }
+        // WHAT WAS WORKED ON LAST: the newest conversations of every room the lobby knows (read from
+        // their folders, open or asleep), and MADRE's summary of them with its local model. The
+        // summary is written in the background and kept until what it summarises changes; it is
+        // written again at most every five minutes, or when the person asks (POST). Without a local
+        // model the lobby shows the conversations as they are, and says why.
+        if (url.pathname === '/api/salas/work' && (request.method === 'GET' || request.method === 'POST')) {
+          const salas = salasRoomId(root);
+          const rooms = (await knownRooms(root)).map((one) => ({ id: one.id, name: one.id === salas ? 'Coordinator' : one.name }));
+          const items = await recentWork({ stateRoot: root, rooms, limit: 5 });
+          const sources = items.map(({ room, name, chat, title, at, said }) => ({ room, name, chat, title, at, last: said?.at(-1) ?? null }));
+          if (!items.length) return sendJson(response, 200, { state: 'empty', sources });
+          if (!lobbyWork.loaded) {
+            lobbyWork.loaded = true;
+            const kept = await readFile(lobbyWork.file, 'utf8').then((raw) => JSON.parse(raw)).catch(() => null);
+            if (kept?.bullets?.length) Object.assign(lobbyWork, { key: kept.key, at: kept.at, tried: kept.at, bullets: kept.bullets, model: kept.model ?? null });
+          }
+          const settings = await ollamaSettings();
+          const model = ollama.madreModel ?? ollama.chatModel;
+          if (!ollama.running || !model || !settings.enabled || settings.agent === false) return sendJson(response, 200, { state: 'unavailable', sources, bullets: lobbyWork.bullets, at: lobbyWork.at || null, model: lobbyWork.model });
+          const key = createHash('sha256').update(items.map((item) => `${item.room}:${item.chat}:${item.at}:${item.messages}`).join('|')).digest('hex').slice(0, 16);
+          const asked = request.method === 'POST';
+          const due = !lobbyWork.bullets || (lobbyWork.key !== key && Date.now() - lobbyWork.tried > 5 * 60 * 1000);
+          if (!lobbyWork.running && (asked || due)) {
+            lobbyWork.tried = Date.now();
+            const language = roomLanguage() === 'en' ? 'en' : 'es';
+            lobbyWork.running = ollamaGenerate({ host: ollama.host, model, system: WORK_SYSTEM[language], prompt: workPrompt(items, language), fetchImpl: reportFetch, timeoutMs: 120000, temperature: 0.1 })
+              .then(async (answer) => {
+                const bullets = parseWork(answer.text, items);
+                if (!bullets.length) throw new Error('MADRE answered nothing the lobby could check against the conversations.');
+                Object.assign(lobbyWork, { key, at: Date.now(), bullets, model, error: null });
+                await writeFile(lobbyWork.file, JSON.stringify({ key, at: lobbyWork.at, bullets, model })).catch(() => {});
+              })
+              .catch((error) => { lobbyWork.error = String(error?.message ?? error).slice(0, 200); })
+              .finally(() => { lobbyWork.running = null; });
+          }
+          const state = lobbyWork.running ? 'working' : lobbyWork.bullets ? 'ready' : 'failed';
+          return sendJson(response, 200, { state, sources, bullets: lobbyWork.bullets, at: lobbyWork.at || null, model: lobbyWork.model ?? model, stale: Boolean(lobbyWork.bullets) && lobbyWork.key !== key, error: state === 'failed' ? lobbyWork.error : null });
+        }
+        // RECENT DECISIONS: what the open rooms decided last, as each room keeps it (only the notes
+        // that travel into turns: hold and bridge; never med bay or jettisoned), newest first.
+        // Asked of the rooms at most every five minutes; a room asleep, sealed or older says nothing.
+        if (request.method === 'GET' && url.pathname === '/api/salas/decisions') {
+          if (!lobbyDecisions.running && (!lobbyDecisions.list || Date.now() - lobbyDecisions.at > 5 * 60 * 1000)) {
+            const salas = salasRoomId(root);
+            lobbyDecisions.running = (async () => {
+              const open = (await knownRooms(root)).filter((one) => one.open);
+              const lists = await Promise.all(open.map(async (one) => {
+                const answer = await askRoom(one.open.port, `/api/memory?designation=${encodeURIComponent(one.name)}`, { timeoutMs: 6000 });
+                if (!Array.isArray(answer?.memories)) return [];
+                return answer.memories
+                  .filter((note) => note.kind === 'decision' && (note.zone === 'hold' || note.zone === 'bridge') && typeof note.text === 'string')
+                  .map((note) => ({ room: one.id, name: one.id === salas ? 'Coordinator' : one.name, text: note.text.slice(0, 260), at: note.created ?? null }));
+              }));
+              lobbyDecisions.list = lists.flat().sort((a, b) => String(b.at ?? '').localeCompare(String(a.at ?? ''))).slice(0, 6);
+              lobbyDecisions.at = Date.now();
+            })().catch(() => {}).finally(() => { lobbyDecisions.running = null; });
+          }
+          if (!lobbyDecisions.list) await lobbyDecisions.running;
+          return sendJson(response, 200, { decisions: lobbyDecisions.list ?? [], at: lobbyDecisions.at || null });
+        }
+        if (request.method === 'POST' && url.pathname === '/api/salas/projects') {
+          const payload = await body(request).catch(() => ({}));
+          const roots = Array.isArray(payload.roots) ? payload.roots.filter((one) => typeof one === 'string').slice(0, 50) : [];
+          if (!roots.length) return sendJson(response, 422, { error: t('Choose at least one folder.') });
+          const added = [];
+          const refused = [];
+          for (const one of roots) {
+            const result = await associateProject({ root: one, home, stateRoot: root });
+            if (result.error) refused.push({ root: one, error: result.error === 'madre' ? t('That folder is MADRE\'s own.') : result.error === 'outside' ? t('Only folders inside your home folder.') : t('That folder is not there.') });
+            else added.push(result);
+          }
+          return sendJson(response, added.length ? 200 : 422, { added, refused });
+        }
+        return sendJson(response, 405, { error: 'method' });
+      }
+      if (request.method === 'POST' && url.pathname === '/api/salas/close') {
+        const payload = await body(request).catch(() => ({}));
+        const room = (await knownRooms(root)).find((one) => one.id === payload.room);
+        if (!room?.open) return sendJson(response, 200, { room: payload.room ?? null, closed: true });
+        if (room.id === basename(roomDir)) {
+          sendJson(response, 202, { room: room.id, closing: true, here: true });
+          setTimeout(() => server.emit('madre:close'), 150);
+          return undefined;
+        }
+        const answer = await askRoom(room.open.port, '/api/room/close', { method: 'POST', body: {} });
+        if (answer.outdated) return sendJson(response, 409, { error: t('That project runs an older MADRE. Update it, or close it from its terminal.'), outdated: true });
+        if (answer.unreachable) return sendJson(response, 502, { error: t('That project did not answer.') });
+        return sendJson(response, 202, { room: room.id, closing: true });
+      }
+      if (request.method === 'POST' && url.pathname === '/api/salas/stop-all') {
+        const rooms = (await knownRooms(root)).filter((one) => one.open);
+        const stopped = await Promise.all(rooms.map((one) => askRoom(one.open.port, '/api/stop-all', { method: 'POST', body: {}, timeoutMs: 3000 }).then((answer) => !answer.unreachable && !answer.outdated)));
+        return sendJson(response, 200, { rooms: rooms.length, stopped: stopped.filter(Boolean).length });
+      }
+      // This room, asked to close by Salas: what is running stops and the room closes the way a
+      // signal closes it (startPulse listens). Nothing here ends the process itself.
+      if (request.method === 'POST' && url.pathname === '/api/room/close') {
+        sendJson(response, 202, { closing: true });
+        setTimeout(() => server.emit('madre:close'), 150);
+        return undefined;
+      }
+      // ---------- ENLACES (docs/MACROVERSO.md, fase 3b) ----------
+      // The side that serves a link. Another room on this Mac asks, from its own process, for the
+      // notes a signed contract lets it read; every lock is here, in the room that hands them over,
+      // and in this order: never a phone, never a page, only a process holding the key of this
+      // Mac; one answer for every contract that does not serve this pair (missing, revoked,
+      // expired, facing the other way: the asker is not told which); sealed by CODE000; over its
+      // hourly ceiling. What crosses is what travels into a turn (`travels()`), of the kinds the
+      // contract names, each text through this room's privacy guard, and nothing of the ledger.
+      if (request.method === 'GET' && url.pathname === '/api/enlace/memories') {
+        if (viaPhone) return sendJson(response, 403, { error: t('This is done on the Mac.') });
+        if (request.headers.origin !== undefined) return sendJson(response, 403, { error: t('A page cannot read across a connection; only a project can.') });
+        const key = await channelKey(root).catch(() => null);
+        if (!key || !sameKey(request.headers[CHANNEL_HEADER], key)) return sendJson(response, 403, { error: t('That is not the key of this Mac.') });
+        const here = basename(roomDir);
+        const asking = String(url.searchParams.get('asking') ?? '');
+        const contract = activeContracts(await readConfig(root), { salas: salasRoomId(root) }).find((one) => one.id === url.searchParams.get('contract')) ?? null;
+        if (!mayServe({ contract, serving: here, asking }).ok) return sendJson(response, 404, { error: NO_SUCH_LINK });
+        const sealed = room.motherStatus()?.lockedForMs ?? 0;
+        if (sealed > 0) return sendJson(response, 423, { error: `CODE000. THE ARCHIVE IS SEALED FOR ${Math.ceil(sealed / 60000)} MORE MINUTE${Math.ceil(sealed / 60000) === 1 ? '' : 'S'}.`, lockedForMs: sealed });
+        if (!memory) return sendJson(response, 503, { error: t('The project has no memory.') });
+        const reads = await countRecent(roomDir, contract.id, 'read');
+        if (reads >= contract.orders.perHour) return sendJson(response, 429, { error: t('This connection was read {n} times in the last hour, its limit. Try again later.', { n: reads }) });
+        const q = String(url.searchParams.get('q') ?? '').replace(/\s+/g, ' ').trim().slice(0, 500);
+        const limit = Math.min(ENLACE_MAX_LIMIT, Math.max(1, Math.trunc(Number(url.searchParams.get('limit'))) || ENLACE_MAX_LIMIT));
+        // The kinds asked for, if any, inside the kinds signed: a reading narrows, never widens.
+        const asked = String(url.searchParams.get('kinds') ?? '').split(',').map((kind) => kind.trim()).filter(Boolean);
+        const kinds = asked.length ? contract.kinds.filter((kind) => asked.includes(kind)) : contract.kinds;
+        await refreshPrivacy();
+        // The same search of notes memory_search makes (src/mcp/memory-server.mjs), untracked: a
+        // reading from another room is not this room leaning on a note. Without words, the latest.
+        const rows = q
+          ? memory.recallMemories(q, { limit: ENLACE_MAX_LIMIT * 3, maxChars: ENLACE_MAX_LIMIT * 3 * 300, queryVector: await memory.embedQuery(q).catch(() => null), track: false })
+          : memory.memories({ limit: ENLACE_MAX_LIMIT * 3 });
+        const notes = rows
+          .filter((row) => memoryTravels(row) && kinds.includes(row.kind))
+          .slice(0, limit)
+          .map((row) => ({ id: row.id, kind: row.kind, zone: row.zone, text: privacy.redact(row.text, { always: true }).text, fromSequence: row.fromSequence, throughSequence: row.throughSequence, created: row.created }));
+        // Which agent of the asking room read (S-021): that room's word, checked there against a turn
+        // it is running; here it is only kept, shaped like an agent id or not at all.
+        const reader = /^[a-z][a-z0-9_-]{0,30}$/.test(String(url.searchParams.get('agent') ?? '')) ? url.searchParams.get('agent') : null;
+        await room.record('enlace.read', { contract: contract.id, to: asking, count: notes.length, kinds, query: q ? createHash('sha256').update(q).digest('hex').slice(0, 16) : null, ...(reader ? { agent: reader } : {}) });
+        await noteCrossing(roomDir, { kind: 'read', contract: contract.id, other: asking, count: notes.length, agent: reader });
+        return sendJson(response, 200, { contract: contract.id, from: here, notes });
+      }
+      // The side that asks (fase 3c): a tool of this room's own turn asks this room, and this room
+      // asks the room that serves, by the channel. The same three doors as above — never a phone,
+      // never a page, only the key — because the tool is a process of this Mac and nothing else is.
+      // `room` is the id or the name of the room to read from; the contract is the one in force
+      // that lets THIS room read from THAT one. What came back is counted here (`enlace.received`,
+      // with the query as a hash) and the notes are handed on; nothing of them is kept.
+      if (request.method === 'POST' && url.pathname === '/api/enlace/ask') {
+        if (viaPhone) return sendJson(response, 403, { error: t('This is done on the Mac.') });
+        if (request.headers.origin !== undefined) return sendJson(response, 403, { error: t('A page cannot read across a connection; only a project can.') });
+        const key = await channelKey(root).catch(() => null);
+        if (!key || !sameKey(request.headers[CHANNEL_HEADER], key)) return sendJson(response, 403, { error: t('That is not the key of this Mac.') });
+        const payload = await body(request).catch(() => ({}));
+        const here = basename(roomDir);
+        // S-021: a reading belongs to a turn. The tool says which turn and which agent; this room
+        // checks that this very turn is running here now, for that agent, above GHOST, and records
+        // the reading in that turn's conversation. A tool that outlived its turn reads nothing.
+        const turnId = String(payload.turn ?? '');
+        const host = turnId ? liveRooms().find((one) => one.runningTurn?.(turnId)) : null;
+        const running = host?.runningTurn(turnId) ?? null;
+        if (!running || running.agent !== payload.agent || !(running.mode >= 1)) return sendJson(response, 409, { error: t('That reading does not belong to a turn running in this project.') });
+        const wanted = String(payload.room ?? '').trim();
+        const rooms = await knownRooms(root);
+        const named = rooms.filter((one) => one.id === wanted);
+        if (!named.length) named.push(...rooms.filter((one) => one.name.toLowerCase() === wanted.toLowerCase()));
+        if (!wanted || !named.length) return sendJson(response, 404, { error: t('MADRE does not know that project on this Mac.') });
+        const readable = readsFrom(activeContracts(await readConfig(root), { salas: salasRoomId(root) }), here);
+        const link = named.map((source) => ({ source, contract: readable.find((one) => one.from === source.id)?.contract ?? null })).find((one) => one.contract) ?? null;
+        if (!link) return sendJson(response, 404, { error: NO_SUCH_LINK });
+        const { source, contract } = link;
+        const asked = Array.isArray(payload.kinds) ? payload.kinds.map(String) : [];
+        const kinds = asked.length ? contract.kinds.filter((kind) => asked.includes(kind)) : contract.kinds;
+        if (!kinds.length) return sendJson(response, 422, { error: t('This connection lets this project read only: {kinds}.', { kinds: contract.kinds.join(', ') }) });
+        if (!source.open) return sendJson(response, 409, { error: t('That project is asleep. Wake it from Home to read from it.') });
+        const q = String(payload.query ?? '').replace(/\s+/g, ' ').trim().slice(0, 500);
+        const answer = await askEnlace({
+          port: source.open.port, contract, asking: here, q, kinds: asked.length ? kinds : null, limit: payload.limit, key, turn: turnId, agent: running.agent,
+          record: (type, event) => host.record(type, { ...event, query: q ? createHash('sha256').update(q).digest('hex').slice(0, 16) : null }),
+          roomDir,
+        });
+        if (answer.notes) return sendJson(response, 200, { from: source.name, contract: contract.id, notes: answer.notes });
+        if (answer.outdated) return sendJson(response, 409, { error: t('That project runs an older MADRE. Update it, or close it from its terminal.') });
+        if (answer.unreachable) return sendJson(response, 502, { error: t('That project did not answer.') });
+        return sendJson(response, answer.status ?? 502, { error: answer.refused ?? t('That project did not answer.') });
+      }
+      // What another room tells this one by the channel: a link of this room's was signed or
+      // revoked. One line in the ledger, never a message; any other type is refused.
+      if (request.method === 'POST' && url.pathname === '/api/enlace/notice') {
+        if (viaPhone) return sendJson(response, 403, { error: t('This is done on the Mac.') });
+        if (request.headers.origin !== undefined) return sendJson(response, 403, { error: t('A page cannot read across a connection; only a project can.') });
+        const key = await channelKey(root).catch(() => null);
+        if (!key || !sameKey(request.headers[CHANNEL_HEADER], key)) return sendJson(response, 403, { error: t('That is not the key of this Mac.') });
+        const payload = await body(request).catch(() => ({}));
+        if (!ENLACE_NOTICES.includes(payload.type) || !payload.payload || typeof payload.payload !== 'object' || Array.isArray(payload.payload)) return sendJson(response, 422, { error: t('That is not a notice a connection sends.') });
+        await room.record(payload.type, payload.payload);
+        return sendJson(response, 202, { accepted: true });
+      }
+      // Signing and revoking, from Salas (fase 3c). A change of state, so it comes only from this
+      // room's own page or a process of this Mac (src/request-guard.mjs) and never from a phone
+      // (above). Both rooms are told, if they are open: this one straight into its ledger, the
+      // other by the channel; a room that is asleep reads the contract when it wakes.
+      const tellRooms = async (type, contract, rooms) => {
+        if (typeof contract?.rooms?.a !== 'string' || typeof contract?.rooms?.b !== 'string') return;
+        const key = await channelKey(root).catch(() => null);
+        const here = basename(roomDir);
+        const [a, b] = [contract.rooms.a, contract.rooms.b].map((id) => rooms.find((one) => one.id === id) ?? { id, name: id, open: null });
+        for (const [me, other] of [[a, b], [b, a]]) {
+          const role = contract.direction === 'both' ? 'both' : servingRooms(contract).includes(me.id) ? 'serves' : 'reads';
+          const payload = type === 'enlace.signed'
+            ? { contract, other: other.name, otherId: other.id, coordinator: other.id === salasRoomId(root), role, kinds: contract.kinds, expires: contract.expires, orders: contract.orders }
+            : { contract, other: other.name, otherId: other.id, coordinator: other.id === salasRoomId(root) };
+          if (me.id === here) await room.record(type, payload);
+          else if (me.open && key) await noticeEnlace({ port: me.open.port, type, payload, key }).catch(() => null);
+        }
+      };
+      if (request.method === 'POST' && url.pathname === '/api/salas/enlaces') {
+        const payload = await body(request).catch(() => ({}));
+        const rooms = await knownRooms(root);
+        for (const id of [payload.a, payload.b]) if (!rooms.some((one) => one.id === id)) return sendJson(response, 404, { error: t('MADRE does not know that project on this Mac.') });
+        // Two projects are connected once: signContract checks it under the lock (src/enlaces.mjs).
+        let contract;
+        try {
+          // BISHOP signs only from the room's own process (no Origin: never a page), and the contract
+          // itself holds it to a link to read that expires within a week (D-S13, src/enlaces.mjs).
+          const signed = payload.by === 'bishop' && request.headers.origin === undefined ? { by: 'bishop' } : undefined;
+          // «Include always» only from the page (INI-04 of the 1.0 review): its own route refuses a
+          // process, and signing let one set it anyway, so a project got another's notes every turn.
+          const recall = payload.recall === true && !signed && request.headers.origin !== undefined;
+          contract = await signContract(root, { rooms: { a: payload.a, b: payload.b }, direction: payload.direction, kinds: payload.kinds, expires: payload.expires ?? null, orders: payload.orders ?? { allowed: false, maxMode: 0, perHour: 6 }, signed, recall }, { rooms, salas: salasRoomId(root), designation: payload.designation ?? null });
+        } catch (error) {
+          if (error.code === 'DESIGNATION') return sendJson(response, 403, { error: t('UNABLE TO COMPUTE. UNABLE TO CLARIFY.') });
+          if (error.code === 'ALREADY') return sendJson(response, 409, { error: t(error.message) });
+          return sendJson(response, error.code === 'UNKNOWN_ROOM' ? 404 : 422, { error: t(error.message) });
+        }
+        await tellRooms('enlace.signed', contract, rooms);
+        return sendJson(response, 200, { contract });
+      }
+      // Fase 3e: the box «recall on every turn» of a link, ticked or cleared by the human from Salas
+      // (never a phone, never a process: the page asks). It changes what each turn of the room that
+      // reads is handed, not what that room may read; the contract is otherwise untouched.
+      if (request.method === 'POST' && url.pathname === '/api/salas/enlaces/recall') {
+        const payload = await body(request).catch(() => ({}));
+        if (request.headers.origin === undefined) return sendJson(response, 403, { error: t('This is changed by you, from Home.') });
+        if (typeof payload.recall !== 'boolean') return sendJson(response, 422, { error: t('recall is on or off.') });
+        const contract = await recallContract(root, String(payload.id ?? ''), payload.recall, { salas: salasRoomId(root) });
+        if (!contract) return sendJson(response, 404, { error: NO_SUCH_LINK });
+        return sendJson(response, 200, { contract });
+      }
+      if (request.method === 'POST' && url.pathname === '/api/salas/enlaces/revoke') {
+        const payload = await body(request).catch(() => ({}));
+        const id = String(payload.id ?? '');
+        // Told once: a link revoked twice keeps its first stamp and says nothing new.
+        const already = Boolean((await readConfig(root)).enlaces?.[id]?.revoked);
+        const contract = await revokeContract(root, id);
+        if (!contract) return sendJson(response, 404, { error: NO_SUCH_LINK });
+        if (!already) await tellRooms('enlace.revoked', contract, await knownRooms(root)).catch(() => null);
+        return sendJson(response, 200, { contract });
+      }
+      // Taking a project out of MADRE (2026-10-10), from Home and only from its page on this Mac, as
+      // adding one is. Never the Coordinator's own, never the room that is asked. Open, it is closed
+      // first; its connections end with it, so none is left pointing at a project MADRE no longer
+      // knows; then its record goes aside (forgetProject). Its folder on the Mac is not touched.
+      if (request.method === 'POST' && url.pathname === '/api/salas/forget') {
+        const host = String(request.headers.host ?? '');
+        const site = request.headers['sec-fetch-site'];
+        if (!/^(127\.0\.0\.1|localhost)(:\d+)?$/.test(host) || (site !== undefined && site !== 'same-origin' && site !== 'none') || request.headers.origin !== `http://${host}`) return sendJson(response, 403, { error: t('This is done from Home, on this Mac.') });
+        const payload = await body(request).catch(() => ({}));
+        const id = String(payload.room ?? '');
+        const salas = salasRoomId(root);
+        if (id === salas || id === basename(roomDir)) return sendJson(response, 422, { error: t('The Coordinator\'s project stays in MADRE.') });
+        const find = async () => (await knownRooms(root)).find((one) => one.id === id) ?? null;
+        let one = await find();
+        if (!one) return sendJson(response, 404, { error: t('MADRE does not know that project on this Mac.') });
+        if (one.open) {
+          const answer = await askRoom(one.open.port, '/api/room/close', { method: 'POST', body: {} });
+          if (answer.outdated) return sendJson(response, 409, { error: t('That project runs an older MADRE. Update it, or close it from its terminal.'), outdated: true });
+          if (answer.unreachable) return sendJson(response, 502, { error: t('That project did not answer.') });
+          for (let tries = 0; tries < 40 && one?.open; tries += 1) { await new Promise((resolve) => setTimeout(resolve, 250)); one = await find(); }
+          if (one?.open) return sendJson(response, 504, { error: t('That project did not close. Close it and try again.') });
+        }
+        const ended = [];
+        for (const contract of activeContracts(await readConfig(root), { salas })) {
+          if (contract.rooms.a !== id && contract.rooms.b !== id) continue;
+          const revoked = await revokeContract(root, contract.id);
+          if (!revoked) continue;
+          ended.push(revoked.id);
+          await tellRooms('enlace.revoked', revoked, await knownRooms(root)).catch(() => null);
+        }
+        const forgotten = await forgetProject({ stateRoot: root, id });
+        // A room from before MADRE kept the path has no record to set aside: closed, it is gone.
+        if (forgotten.error && await find()) return sendJson(response, 404, { error: t('MADRE does not know that project on this Mac.') });
+        return sendJson(response, 200, { id, name: forgotten.name ?? one?.name ?? id, root: forgotten.root ?? null, ended });
+      }
+      // ---------- fin ENLACES ----------
+      // Where the person was, to pick it up on the other side (bridge/handoff.mjs).
+      if (url.pathname === '/api/handoff') {
+        if (request.method === 'GET') return sendJson(response, 200, await readHandoff(root));
+        if (request.method === 'POST') {
+          const payload = await body(request).catch(() => ({}));
+          const { chats } = await listChats(roomDir);
+          const chat = chats.find((one) => one.id === payload.chat) ?? chats.find((one) => one.active) ?? null;
+          const saved = await writeHandoff(root, viaPhone ? 'phone' : 'mac', { room: basename(roomDir), project: basename(canonicalProjectRoot), port: openPort, chat: chat?.id ?? null, chatTitle: chat?.title ?? null, anchor: payload.anchor, draft: payload.draft, kind: phoneKind });
+          return sendJson(response, 200, { saved });
+        }
+      }
       if (request.method === 'GET' && url.pathname === '/api/state') {
+        // `?chat=` reads another conversation, held open beside the one on screen; the room-wide
+        // parts are the same, the record and what is running in it are that conversation's.
+        const here = await scopeOf(url);
+        if (here.error) return sendJson(response, 404, here);
+        const room = here.room;
+        const store = here.store;
         return sendJson(response, 200, {
+          ...(here.main ? {} : { chat: here.id }),
           projectRoot,
+          // The project's name as this system writes paths (WEB-11): the page cut it at «/», and on
+          // Windows the name was the whole path, so the key for #3 never matched.
+          projectName: basename(canonicalProjectRoot),
           platform: process.platform,
+          // Behind the bridge, the page is on a phone and knows it. On the Mac it learns whether a
+          // phone is paired, so it keeps its place for the phone only when there is one.
+          device: viaPhone ? { kind: phoneKind } : null,
+          // Whether this Mac offers the phone (a preview in 1.0); behind the bridge, it does.
+          phonePreview: viaPhone ? true : await phonePreview(),
+          // The room of Salas knows it is: true only there, false in every other room.
+          salas: salasRoom,
+          room: basename(roomDir),
+          phones: viaPhone ? undefined : await phonePreview() ? (await readStore(root).catch(() => ({ devices: [] }))).devices.length : 0,
           // Which MADRE this is. The page prints it in the corner: the one fact a bug report
           // always needs and nobody ever remembers to ask for.
           version: PACKAGE.version,
+          // Which start of this process the page is talking to. The page draws its logo when this
+          // changes — MADRE restarted — and not on every reload of the same running room.
+          boot: BOOT_ID,
           // What language this machine set MADRE to, for a browser that has never chosen. It is
           // the language the room is SPEAKING, not the one written in the file: PULSE_LANGUAGE
           // wins over the config here as it does everywhere else, and reading the file again
           // would hand the page a different answer from the one the server itself is using.
           language: roomLanguage(),
           // Which conversation this page is looking at, and the others it could open.
-          chats: await listChats(roomDir),
+          chats: await chatsView(),
           agents: agents.map((agent) => ({ ...agent, login: loginPlanFor(agent), install: installPlanFor(agent), key: keyPlanFor(agent.id), ...(accountNoteFor(agent.id) ?? {}) })),
           ash: { enabled: room.ashEnabled() },
           choices: { enabled: room.choicesEnabled() },
@@ -941,6 +2031,7 @@ export async function createPulseServer({
           ripleyWeb: Boolean((await readConfig(root)).modules?.ripley?.web),
           ripley: { enabled: await ripleyOn() },
           softTokenBudget,
+          override: publicOverride(overrideConfig),
           timeouts: Object.fromEntries(agents.map((agent) => [agent.id, room.timeoutFor(agent.id)])),
           delegation: { enabled: room.settings().delegation, maxPlanSteps: room.settings().maxPlanSteps },
           plans: room.activePlans(),
@@ -958,6 +2049,10 @@ export async function createPulseServer({
       if (request.method === 'GET' && url.pathname === '/api/events') {
         const sinceValue = request.headers['last-event-id'] ?? url.searchParams.get('since');
         const since = sinceValue === undefined || sinceValue === null || sinceValue === '' ? null : Number(sinceValue);
+        // `?chat=` watches a conversation held open beside the one on screen, on a feed of its own.
+        const here = await scopeOf(url);
+        if (here.error) return sendJson(response, 404, here);
+        const feed = here.main ? mainFeed : await watchHeld(here.entry);
         response.writeHead(200, {
           'content-type': 'text/event-stream',
           'cache-control': 'no-cache',
@@ -966,17 +2061,22 @@ export async function createPulseServer({
         response.write(': connected\n\n');
         // Replay what this client missed between /api/state and this connection,
         // then register it so the shared cursor delivers everything newer.
-        const events = Number.isFinite(since) ? await store.readAll() : [];
+        const events = Number.isFinite(since) ? await feed.store.readAll() : [];
         let floor = Number.isFinite(since) ? since : 0;
         for (const event of events) {
-          if (event.sequence > floor && event.sequence <= lastBroadcastSequence) {
-            writeEvent(response, event);
+          if (event.sequence > floor && event.sequence <= feed.sent) {
+            writeEvent(response, event, feed);
             floor = event.sequence;
           }
         }
-        clients.set(response, floor);
-        request.on('close', () => clients.delete(response));
-        void broadcastPending();
+        feed.clients.set(response, floor);
+        request.on('close', () => {
+          feed.clients.delete(response);
+          // The last page watching a held conversation went away: it closes unless it is at work. A
+          // moment later, so a page that is only reconnecting finds the same room.
+          if (!here.main) setTimeout(() => { void releaseIfIdle(here.id, here.room); }, 1500).unref?.();
+        });
+        void pump(feed);
         return;
       }
       // Copying and moving, by the human's own hand. Both ends are resolved inside the project
@@ -996,6 +2096,7 @@ export async function createPulseServer({
         }
         const plan = planFileOp(payload);
         if (!plan.ok) return sendJson(response, 400, { error: t(plan.error) });
+        if (!plan.guarded) plan.guarded = await needsDesignationOnDisk(canonicalProjectRoot, plan.from, plan.to);
         if (plan.guarded && !designationOk(payload.designation)) {
           return sendJson(response, 403, { error: t('UNABLE TO COMPUTE. UNABLE TO CLARIFY.'), guarded: true });
         }
@@ -1040,9 +2141,43 @@ export async function createPulseServer({
           'x-content-type-options': 'nosniff',
           'content-security-policy': "default-src 'none'; style-src 'unsafe-inline'; img-src data:",
           'content-disposition': `inline; filename="${encodeURIComponent(basename(file.path))}"`,
+          // When the editor opened it: saving checks the file is still the one it opened.
+          'x-mtime': String(file.mtimeMs ?? ''),
         });
         return response.end(file.body);
       }
+      // The editor saves a project file. The human's own hand, so no mode and no lease — but the
+      // same two fences the file manager keeps: inside the project after following links, and the
+      // zones the room guards (.git, .pulse, .madre, a .env) ask for the project's designation.
+      // A new, empty file from the Finder; guarded paths ask for the designation, like saving.
+      if (request.method === 'POST' && url.pathname === '/api/files') {
+        const payload = await body(request).catch(() => ({}));
+        const relative = String(payload.path ?? '').trim().replace(/^\/+/, '');
+        if (relative && await needsDesignationOnDisk(canonicalProjectRoot, relative) && !designationOk(payload.designation)) {
+          return sendJson(response, 403, { error: t('This file is one the project guards. Type the project name to save it.'), guarded: true });
+        }
+        const result = await createEmptyFile(canonicalProjectRoot, relative);
+        if (result.status !== 201) return sendJson(response, result.status, { error: t(result.error) });
+        await room.record('project.file.created', { path: result.path });
+        return sendJson(response, 201, { ok: true, path: result.path });
+      }
+      if (request.method === 'PUT' && url.pathname === '/api/files') {
+        // The editor saves up to MAX_EDIT_BYTES; written as JSON a file can take a few times its
+        // size (every newline and quote escaped). Too large is said as that, not as «Nothing to save».
+        let payload;
+        try { payload = await body(request, { limit: MAX_EDIT_BYTES * 3 + 65536 }); } catch (error) {
+          return sendJson(response, error.status === 413 ? 413 : 400, { error: error.status === 413 ? t('The editor saves files up to {mb} MB.', { mb: MAX_EDIT_BYTES / 1024 / 1024 }) : t('That could not be read.') });
+        }
+        const relative = String(payload.path ?? '').replace(/^\/+/, '');
+        if (!relative) return sendJson(response, 400, { error: t('Nothing to save.') });
+        if (await needsDesignationOnDisk(canonicalProjectRoot, relative) && !designationOk(payload.designation)) {
+          return sendJson(response, 403, { error: t('This file is one the project guards. Type the project name to save it.'), guarded: true });
+        }
+        const result = await writeEdited(canonicalProjectRoot, relative, payload.content, { mtimeMs: payload.mtimeMs, force: payload.force === true });
+        if (result.status !== 200) return sendJson(response, result.status, { error: result.status === 413 ? t('The editor saves files up to {mb} MB.', { mb: MAX_EDIT_BYTES / 1024 / 1024 }) : t(result.error), changed: result.changed, mtimeMs: result.mtimeMs });
+        await room.record('project.file.saved', { path: relative, bytes: result.bytes });
+        return sendJson(response, 200, { ok: true, bytes: result.bytes, mtimeMs: result.mtimeMs });
+      }
       // RIPLEY: the project rendered as a site, inside a frame that runs scripts but
       // reaches nothing: an opaque origin (sandbox without same-origin), no network
       // (connect-src none), no forms, no top navigation, assets only from MADRE's
@@ -1050,7 +2185,7 @@ export async function createPulseServer({
       // resolve to the same route.
       const previewMatch = request.method === 'GET' && url.pathname.match(/^\/preview\/(project|attachments)\/(.*)$/);
       if (previewMatch) {
-        if (!(await ripleyOn())) return sendJson(response, 412, { error: t('RIPLEY is off. Enable it in MODULES to render files.') });
+        if (!(await ripleyOn())) return sendJson(response, 412, { error: t('Preview is off. Enable it in MODULES to render files.') });
         const which = previewMatch[1] === 'attachments' ? attachmentsRoot : canonicalProjectRoot;
         const relative = decodeURIComponent(previewMatch[2]);
         const file = await readServable(which, relative);
@@ -1069,6 +2204,13 @@ export async function createPulseServer({
           'content-disposition': `inline; filename="${encodeURIComponent(basename(file.path))}"`,
         };
         if (isPage) headers['content-security-policy'] = `sandbox allow-scripts; default-src 'none'; script-src 'unsafe-inline' ${origin}; style-src 'unsafe-inline' ${origin}; img-src ${origin} data: blob:; font-src ${origin} data:; media-src ${origin} data: blob:; connect-src 'none'; frame-src 'none'; object-src 'none'; form-action 'none'; base-uri 'none'`;
+        // Everything else is sealed too (SRV-02, 2026-10-12): an SVG or an XML file carries scripts,
+        // and opened on its own — a link in an answer, a frame the project's server navigates — it
+        // ran with the project's origin and reached its API. Sealed, it is drawn and runs nothing.
+        // A PDF keeps the browser's own viewer, which a sealed document cannot open; the scripts and
+        // styles a page links are left as they were (opened on their own they are text, and a
+        // worker the page starts would be shut by a policy meant for documents).
+        else if (!/^(application\/pdf|text\/css|(text|application)\/javascript)\b/i.test(file.contentType ?? '')) headers['content-security-policy'] = `sandbox; default-src 'none'; img-src ${origin} data:; style-src 'unsafe-inline'; media-src ${origin} data: blob:`;
         response.writeHead(200, headers);
         return response.end(bodyOut);
       }
@@ -1080,15 +2222,46 @@ export async function createPulseServer({
           return sendJson(response, error.status ?? 400, { error: error.message });
         }
         const name = decodeURIComponent(request.headers['x-pulse-filename'] ?? url.searchParams.get('name') ?? 'attachment');
-        const record = await room.registerAttachment(await storeAttachment(attachmentsRoot, { name, bytes }));
+        const here = await scopeOf(url);
+        if (here.error) return sendJson(response, 404, here);
+        const record = await here.room.registerAttachment(await storeAttachment(attachmentsRoot, { name, bytes }));
         return sendJson(response, 201, { attachment: { id: record.id, name: record.name, fileName: record.fileName, size: record.size, contentType: record.contentType, url: `/api/files?root=attachments&path=${encodeURIComponent(record.fileName)}` } });
       }
+      // The key for #3 and #4, checked here (src/override.mjs): what was typed, once or twice, and a
+      // pass back for that agent and mode. Never from a phone: #3 and #4 are opened on the Mac.
+      if (request.method === 'POST' && url.pathname === '/api/override/arm') {
+        if (viaPhone) return sendJson(response, 403, { error: t('#3 EDIT and #4 FULL ACCESS are opened from the Mac.') });
+        const payload = await body(request).catch(() => ({}));
+        const mode = Number(payload.mode);
+        const agent = String(payload.agent ?? '');
+        if ((mode !== 3 && mode !== 4) || !agents.some((one) => one.id === agent)) return sendJson(response, 400, { error: t('Unlock #3 or #4 for an agent of this project.') });
+        const now = Date.now();
+        while (keyMisses.length && keyMisses[0] < now - 60000) keyMisses.shift();
+        if (keyMisses.length >= 8) return sendJson(response, 429, { error: t('Too many wrong keys. Wait a minute and try again.') });
+        if (!keyHolds(overrideConfig, { mode, words: payload.words, designation: basename(canonicalProjectRoot) })) {
+          keyMisses.push(now);
+          return sendJson(response, 403, { error: t('That is not it. Try again, or cancel.'), denied: true });
+        }
+        return sendJson(response, 200, issuePass(agent, mode));
+      }
       if (request.method === 'GET' && url.pathname === '/api/settings') {
         await refreshPrivacy();
-        return sendJson(response, 200, { settings: effectiveSettings(), config: await readConfig(root), sessions, sessionsAt, loggingIn, agents: agents.map((agent) => ({ ...agent, login: loginPlanFor(agent), install: installPlanFor(agent), key: keyPlanFor(agent.id), ...(accountNoteFor(agent.id) ?? {}) })) });
+        const stored = await readConfig(root);
+        if (stored.override) stored.override = publicOverride(stored.override);
+        return sendJson(response, 200, { settings: effectiveSettings(), config: stored, sessions, sessionsAt, loggingIn, agents: agents.map((agent) => ({ ...agent, login: loginPlanFor(agent), install: installPlanFor(agent), key: keyPlanFor(agent.id), ...(accountNoteFor(agent.id) ?? {}) })) });
       }
       if (request.method === 'POST' && url.pathname === '/api/settings') {
-        return sendJson(response, 200, { settings: await applySettings(await body(request)) });
+        const patch = await body(request);
+        // Permissions and the key that opens #3 and #4 are changed on the Mac.
+        if (viaPhone && (patch?.scopes !== undefined || patch?.override !== undefined)) return sendJson(response, 403, { error: t('Permissions are changed on the Mac.') });
+        if (patch?.override && typeof patch.override === 'object') {
+          const proof = patch.override.proof;
+          delete patch.override.proof;
+          if (changeNeedsPhrase(overrideConfig) && !(typeof proof === 'string' && proof.trim() && phraseHash(overrideConfig.phrase.salt, proof) === overrideConfig.phrase.hash)) {
+            return sendJson(response, 403, { error: t('Type your current phrase to change the keys.'), needsPhrase: true });
+          }
+        }
+        return sendJson(response, 200, { settings: await applySettings(patch) });
       }
       // NOSTROMO: the archive is behind the project designation, like CONTROL.
       // Sentinel: reports, settings, the manual road (a prefilled issue) and the automatic one.
@@ -1119,7 +2292,8 @@ export async function createPulseServer({
       const moduleRoute = findModuleRoute(request.method, url.pathname);
       if (moduleRoute) {
         const payload = request.method === 'POST' ? await body(request).catch(() => ({})) : {};
-        const result = await moduleRoute.route.handler(await moduleContext(), { request, url, params: moduleRoute.params, payload });
+        // `viaPhone` (encargo §6, excepción 4): a module can refuse the phone by its own hand.
+        const result = await moduleRoute.route.handler(await moduleContext(), { request, url, params: moduleRoute.params, payload, viaPhone });
         return sendJson(response, result.status ?? 200, result.body ?? {});
       }
       // Where this room's tokens go: what each block of the briefing has cost, how much came back
@@ -1146,7 +2320,7 @@ export async function createPulseServer({
         if (!/^https?:$/.test(target.protocol)) return sendJson(response, 400, { error: t('Only http and https.') });
         const local = ['127.0.0.1', 'localhost', '[::1]'].includes(target.hostname);
         if (!local && !(await readConfig(root)).modules?.ripley?.web) {
-          return sendJson(response, 403, { error: t('RIPLEY reaches this computer only · turn the web on in MODULES to open an address outside it') });
+          return sendJson(response, 403, { error: t('PREVIEW reaches this computer only · turn the web on in MODULES to open an address outside it') });
         }
         try {
           const controller = new AbortController();
@@ -1159,32 +2333,36 @@ export async function createPulseServer({
         }
       }
       if (request.method === 'GET' && url.pathname === '/api/ports') {
-        if (!(await ripleyOn())) return sendJson(response, 412, { error: t('RIPLEY is off. Enable it in MODULES to render files.') });
-        let listening = { ports: [], wider: [] };
-        try {
-          const { stdout } = await execFileAsync('lsof', ['-nP', '-iTCP', '-sTCP:LISTEN'], { timeout: 4000, maxBuffer: 2 * 1024 * 1024 });
-          listening = classifyListening(stdout, { self: request.socket.localPort });
-        } catch { return sendJson(response, 200, { ports: [], wider: [], probed: false }); }
-        const ports = [];
-        for (const found of listening.ports.slice(0, 24)) {
-          const probe = await probePort(found.port, { fetchImpl: reportFetch });
-          if (probe.ok) ports.push({ ...found, status: probe.status, html: probe.html, contentType: probe.contentType, framable: probe.framable });
-        }
-        // What is listening on every interface travels too. It is not offered — this room does not
-        // help anyone frame something reachable from the network — but saying nothing about it is
-        // what made an empty list read as «there is nothing here» when there plainly was.
-        return sendJson(response, 200, { ports, wider: listening.wider.slice(0, 8).map(({ port, command }) => ({ port, command })), probed: true });
+        if (!(await ripleyOn())) return sendJson(response, 412, { error: t('Preview is off. Enable it in MODULES to render files.') });
+        // Only this project's servers, read by the servers sentinel: the same reading its watch
+        // makes, so the menu and the live updates never disagree about what is here.
+        const read = await serverSentinel.scan();
+        return sendJson(response, 200, { ...read, wider: read.wider.slice(0, 8) });
       }
       if (request.method === 'GET' && url.pathname === '/api/questions') {
         const limit = Math.min(5, Math.max(1, Number(url.searchParams.get('limit') ?? 3) || 3));
-        return sendJson(response, 200, { questions: room.questions({ limit }) });
+        const here = await scopeOf(url);
+        if (here.error) return sendJson(response, 404, here);
+        return sendJson(response, 200, { questions: here.room.questions({ limit }) });
       }
       if (request.method === 'GET' && url.pathname === '/api/decisions') {
         const limit = Math.min(5, Math.max(1, Number(url.searchParams.get('limit') ?? 3) || 3));
-        return sendJson(response, 200, { decisions: room.decisions({ limit }) });
+        const here = await scopeOf(url);
+        if (here.error) return sendJson(response, 404, here);
+        return sendJson(response, 200, { decisions: here.room.decisions({ limit }) });
       }
+      // The economy of the room: every conversation's turns, not only the open one's. The card and
+      // the panel say «this room», and they used to weigh one conversation's ledger under that name.
       if (url.pathname === '/api/economy' && request.method === 'GET') {
-        return sendJson(response, 200, economy(await store.readAll()));
+        const weighed = [];
+        for (const chat of (await listChats(roomDir)).chats) {
+          const text = await readFile(chatLedger(roomDir, chat.id), 'utf8').catch(() => '');
+          for (const line of text.split('\n')) {
+            if (!line.includes('"turn.cost"')) continue;
+            try { const event = JSON.parse(line); if (event.type === 'turn.cost') weighed.push(event); } catch { /* a torn last line */ }
+          }
+        }
+        return sendJson(response, 200, { ...economy(weighed), conversations: (await listChats(roomDir)).chats.length });
       }
 
       // What left this machine: every address MADRE may reach, whether it is on today, and the
@@ -1224,7 +2402,7 @@ export async function createPulseServer({
       if (eyecatVerdict) {
         const payload = await body(request).catch(() => ({}));
         if (!designationOk(payload.designation)) return sendJson(response, 403, { error: t('UNABLE TO COMPUTE. UNABLE TO CLARIFY.') });
-        if (!memory) return sendJson(response, 503, { error: t('The room has no memory.') });
+        if (!memory) return sendJson(response, 503, { error: t('The project has no memory.') });
         const finding = eyecat.findings().find((item) => item.key === payload.key);
         if (!finding) return sendJson(response, 404, { error: t('EYECAT is not holding that one.') });
         const settled = eyecat.settle(finding.key, { verdict: eyecatVerdict[1] === 'confirm' ? 'aberration' : 'dismissed' });
@@ -1264,6 +2442,13 @@ export async function createPulseServer({
       // PRIVACY: the terms live in config.json only; the ledger records counts, never words.
       // Which language MADRE speaks. The page keeps its own copy so the first paint needs no
       // round trip; this is the durable one, shared by every browser on this machine.
+      // The looks every page shares (src/looks.mjs): Home and each project are different origins,
+      // so the browser alone kept a choice for one page only.
+      if (request.method === 'GET' && url.pathname === '/api/looks') return sendJson(response, 200, await readLooks(root));
+      if (request.method === 'POST' && url.pathname === '/api/looks') {
+        const answer = await changeLooks(root, await body(request).catch(() => null));
+        return sendJson(response, answer.error ? 400 : 200, answer);
+      }
       if (request.method === 'POST' && url.pathname === '/api/language') {
         const payload = await body(request).catch(() => ({}));
         const language = payload.language === 'en' ? 'en' : 'es';
@@ -1273,7 +2458,7 @@ export async function createPulseServer({
       }
       if (request.method === 'GET' && url.pathname === '/api/privacy') {
         await refreshPrivacy();
-        return sendJson(response, 200, { terms: privacy.terms, marker: privacy.marker, ...privacy.guards, exposure: room.privacyExposure(await store.readAll()) });
+        return sendJson(response, 200, { terms: privacy.terms, marker: privacy.marker, ...privacy.guards, exposure: room.privacyExposure(await projectEvents()) });
       }
       if (request.method === 'POST' && url.pathname === '/api/privacy') {
         const patch = await body(request).catch(() => ({}));
@@ -1287,36 +2472,98 @@ export async function createPulseServer({
         await refreshPrivacy();
         // The room records that the setting changed and what it is now, never the words.
         await room.record('privacy.updated', { terms: privacy.terms.length, marker: privacy.marker, ...privacy.guards });
-        return sendJson(response, 200, { terms: privacy.terms, marker: privacy.marker, ...privacy.guards, exposure: room.privacyExposure(await store.readAll()) });
+        return sendJson(response, 200, { terms: privacy.terms, marker: privacy.marker, ...privacy.guards, exposure: room.privacyExposure(await projectEvents()) });
       }
       if (request.method === 'POST' && url.pathname === '/api/privacy/purge') {
         const payload = await body(request).catch(() => ({}));
         if (!designationOk(payload.designation)) return sendJson(response, 403, { error: t('UNABLE TO COMPUTE. UNABLE TO CLARIFY.') });
         await refreshPrivacy();
-        if (!privacy.enabled) return sendJson(response, 412, { error: t('No private terms are set. Write them first.') });
+        if (!privacy.enabled) return sendJson(response, 412, { error: t('No hidden data is set. Write it first.') });
         const result = await room.purgePrivate();
         // The log was rewritten in place: the broadcaster's byte offset is stale, the sequences are not.
-        tailOffset = (await store.tail(0)).offset;
-        return sendJson(response, 200, { purged: result, exposure: room.privacyExposure(await store.readAll()) });
+        mainFeed.offset = (await store.tail(0)).offset;
+        // And every other conversation of the project too (LOG-03 of the 1.0 review): the purge
+        // cleaned only the one on screen, the others kept the words in plain text and sent them to
+        // the providers the next time they were opened, while the count said nothing was left.
+        for (const { store: other, held } of await otherLedgers()) {
+          const done = await other.rewrite((event) => {
+            const { value, hits } = privacy.redactDeep(event.payload);
+            return hits ? { ...event, payload: value } : event;
+          });
+          result.events += done.changed;
+          if (held?.feed) held.feed.offset = (await other.tail(0)).offset;
+        }
+        return sendJson(response, 200, { purged: result, exposure: room.privacyExposure(await projectEvents()) });
       }
       // The human's verdict on a reply, for the dataset: good, bad, none.
       if (request.method === 'POST' && url.pathname === '/api/messages/rate') {
         const payload = await body(request).catch(() => ({}));
         try {
-          const event = await room.rateMessage(String(payload.messageId ?? ''), String(payload.rating ?? ''));
+          const here = await scopeOf(url);
+          if (here.error) return sendJson(response, 404, here);
+          const event = await here.room.rateMessage(String(payload.messageId ?? ''), String(payload.rating ?? ''));
           return sendJson(response, 200, { rated: event.payload });
         } catch (error) { return sendJson(response, 400, { error: error.message }); }
       }
       // Release channel: current, latest on npm, and the command for how this copy runs.
       // What this version brings, once, to someone who came from an older one.
       if (request.method === 'GET' && url.pathname === '/api/whats-new') {
-        const news = await whatsNew({ root, version: PACKAGE.version, returning: novelty.returning, any: url.searchParams.get('any') === '1' });
-        return sendJson(response, 200, { ...news, changes: { es: releaseUrl(PACKAGE.repository, PACKAGE.version, 'es'), en: releaseUrl(PACKAGE.repository, PACKAGE.version, 'en') } });
+        // `version`, with `any`: another version's sheet, to look at it before it ships. It reads
+        // and never marks anything as seen; only a sheet with notes can be asked for.
+        const any = url.searchParams.get('any') === '1';
+        const asked = url.searchParams.get('version');
+        const version = any && asked && notesFor(asked) ? asked : PACKAGE.version;
+        const news = await whatsNew({ root, version, returning: novelty.returning, any });
+        return sendJson(response, 200, { ...news, preview: version !== PACKAGE.version, newest: newestNotes(), changes: { es: releaseUrl(PACKAGE.repository, version, 'es'), en: releaseUrl(PACKAGE.repository, version, 'en') } });
       }
       if (request.method === 'POST' && url.pathname === '/api/whats-new/seen') {
         await markSeen(root, PACKAGE.version);
         return sendJson(response, 200, { seen: PACKAGE.version });
       }
+      // Asking for a star or a review (src/review-ask.mjs): a page in view says so once a minute and
+      // hears whether a moment is due; the answer ends the asking or lets that moment pass. A phone
+      // is never asked.
+      if (request.method === 'POST' && url.pathname === '/api/review-ask/tick') {
+        if (viaPhone) return sendJson(response, 200, { due: null });
+        // Never on the day of the bonjour: one welcome is enough for a day.
+        return sendJson(response, 200, await tickAsk(root, Date.now(), { quietSince: (await readTour(root)).bonjourAt }));
+      }
+      if (request.method === 'POST' && url.pathname === '/api/review-ask/answer') {
+        if (viaPhone) return sendJson(response, 403, { error: t('This is done on the Mac.') });
+        const payload = await body(request).catch(() => ({}));
+        const result = await answerAsk(root, { moment: String(payload.moment ?? ''), answer: String(payload.answer ?? '') });
+        if (result.error) return sendJson(response, 422, { error: t('That is not an answer to this question.') });
+        return sendJson(response, 200, result);
+      }
+      // The welcome of 1.0 (src/tour.mjs): where the person is in it, kept in ~/.pulse for every
+      // project and port, and the projects of 0.7.2 brought to Home. Only the pages of this Mac:
+      // a phone never gets the bonjour, and nothing here is changed from anywhere else.
+      if (url.pathname === '/api/tour' || url.pathname.startsWith('/api/tour/')) {
+        const host = String(request.headers.host ?? '');
+        const site = request.headers['sec-fetch-site'];
+        const fromHere = /^(127\.0\.0\.1|localhost)(:\d+)?$/.test(host) && (site === undefined || site === 'same-origin' || site === 'none');
+        if (request.method === 'GET' && url.pathname === '/api/tour') {
+          const state = await readTour(root);
+          if (viaPhone || !fromHere) return sendJson(response, 200, { version: TOUR_VERSION, state, owed: false, returning: false, chapters: CHAPTERS, hints: HINTS });
+          return sendJson(response, 200, { version: TOUR_VERSION, state, owed: !state.bonjourAt, returning: state.path ? state.path === 'back' : await cameBefore(root), chapters: CHAPTERS, hints: HINTS });
+        }
+        if (viaPhone || !fromHere || (request.method === 'POST' && request.headers.origin !== `http://${host}`)) return sendJson(response, 403, { error: t('This is done on the Mac.') });
+        if (request.method === 'POST' && url.pathname === '/api/tour') {
+          const changed = await changeTour(root, await body(request).catch(() => null));
+          if (changed.error) return sendJson(response, 422, { error: t('That is not a change to the tour.') });
+          return sendJson(response, 200, { state: changed });
+        }
+        if (request.method === 'GET' && url.pathname === '/api/tour/projects') {
+          return sendJson(response, 200, { rooms: await roomsWithoutProject(root) });
+        }
+        if (request.method === 'POST' && url.pathname === '/api/tour/projects') {
+          const payload = await body(request).catch(() => ({}));
+          const found = await recoverProject({ stateRoot: root, home: process.env.PULSE_LOBBY_HOME || homedir(), id: String(payload.id ?? '') });
+          if (found.error) return sendJson(response, 404, { error: t('MADRE does not know that project on this Mac.') });
+          return sendJson(response, 200, found);
+        }
+        return sendJson(response, 404, { error: 'Not found' });
+      }
       if (request.method === 'GET' && url.pathname === '/api/version') {
         return sendJson(response, 200, await versionView({ force: url.searchParams.get('force') === '1' }));
       }
@@ -1325,16 +2572,32 @@ export async function createPulseServer({
       if (request.method === 'POST' && url.pathname === '/api/updates/apply') {
         const info = await versionView();
         if (!info.available) return sendJson(response, 409, { error: `Nothing to apply: ${info.current} is the latest MADRE knows of.` });
+        if (install === 'source') return sendJson(response, 412, { error: t('This copy runs from source: pull the repository and start it again.') });
         const command = applyCommand({ install, name: PACKAGE.name, version: info.latest, port: request.socket.localPort, projectRoot: canonicalProjectRoot });
-        if (!command) return sendJson(response, 412, { error: t('This copy runs from source: pull the repository and start it again.') });
+        const fetching = fetchCommand({ name: PACKAGE.name, version: info.latest });
+        // Only a version semver would write reaches a shell, and the restart never runs without the
+        // download first (src/updates.mjs): an unchecked one used to skip the download and run.
+        if (!command || !fetching) return sendJson(response, 412, { error: t('The version the registry gave ({version}) is not one MADRE installs.', { version: String(info.latest).slice(0, 40) }) });
         if (room.activeTurns().length || room.activePlans().length) return sendJson(response, 409, { error: t('Agents are still working. STOPALL or wait, then update.') });
+        {
+          // npm is a .cmd on Windows and needs a shell there; every argument here is fixed or checked above.
+          const fetched = await new Promise((resolve) => execFile(fetching.command, fetching.args, { cwd: root, timeout: 180000, shell: process.platform === 'win32', windowsHide: true, maxBuffer: 1024 * 1024 }, (error, stdout, stderr) => resolve(error ? (String(stderr || error.message).split('\n').map((line) => line.trim()).find((line) => line && !/complete log|^npm (error|ERR!)(\s+code\b.*)?\s*$/i.test(line)) ?? error.message) : null)));
+          if (fetched !== null) {
+            await room.record('room.update.refused', { from: info.current, to: info.latest, error: fetched.slice(0, 300) });
+            return sendJson(response, 502, { error: t('npm does not hand out {version} yet; a new release can take a few minutes. The project stays open: try again in a moment.', { version: info.latest }) });
+          }
+        }
         await room.record('room.updating', { from: info.current, to: info.latest, install, command });
         sendJson(response, 202, { restarting: true, from: info.current, to: info.latest, command });
         setTimeout(() => {
           server.close(() => {
             // Each system has its own shell: the command is one line either way.
             const shell = process.platform === 'win32' ? { file: process.env.COMSPEC ?? 'cmd.exe', args: ['/d', '/s', '/c', command] } : { file: '/bin/sh', args: ['-c', command] };
-            const child = spawn(shell.file, shell.args, { cwd: canonicalProjectRoot, detached: process.platform !== 'win32', windowsHide: true, stdio: 'ignore', env: { ...process.env, PULSE_UPDATE_RESTART: '1' } });
+            // What the new copy says on the way up lands beside the ledger: if it never comes back,
+            // this file is the only witness.
+            let log = 'ignore';
+            try { log = openSync(join(roomDir, 'update.log'), 'a'); } catch { /* no witness, still restart */ }
+            const child = spawn(shell.file, shell.args, { cwd: canonicalProjectRoot, detached: process.platform !== 'win32', windowsHide: true, stdio: ['ignore', log, log], env: { ...process.env, PULSE_UPDATE_RESTART: '1' } });
             child.unref();
             setTimeout(() => process.exit(0), 200);
           });
@@ -1354,14 +2617,14 @@ export async function createPulseServer({
         const payload = await body(request).catch(() => ({}));
         if (!designationOk(payload.designation)) return sendJson(response, 403, { error: t('UNABLE TO COMPUTE. UNABLE TO CLARIFY.') });
         const result = await room.code000({ strikes: Number(payload.strikes) || CODE000_STRIKES });
-        return result ? sendJson(response, 200, { code: result.code, lockedForMs: result.lockedForMs, n: result.n }) : sendJson(response, 503, { error: t('MOTHER is silent.') });
+        return result ? sendJson(response, 200, { code: result.code, lockedForMs: result.lockedForMs, n: result.n }) : sendJson(response, 503, { error: t('Security is silent.') });
       }
       if (request.method === 'GET' && url.pathname === '/api/memory') {
         if (!designationOk(url.searchParams.get('designation'))) return sendJson(response, 403, { error: t('UNABLE TO COMPUTE. UNABLE TO CLARIFY.') });
         const sealed = room.motherStatus()?.lockedForMs ?? 0;
         if (sealed > 0) return sendJson(response, 423, { error: `CODE000. THE ARCHIVE IS SEALED FOR ${Math.ceil(sealed / 60000)} MORE MINUTE${Math.ceil(sealed / 60000) === 1 ? '' : 'S'}.`, lockedForMs: sealed });
         const research = room.memoryResearch();
-        if (!research) return sendJson(response, 503, { error: t('The room has no memory.') });
+        if (!research) return sendJson(response, 503, { error: t('The project has no memory.') });
         // How grown this archive is, read from the same notes the map draws.
         const grown = maturity({ readiness: datasetReadiness(await store.readAll(), research.memories), notes: research.memories, links: research.links, stats: research.stats });
         return sendJson(response, 200, { ...research, maturity: grown });
@@ -1383,6 +2646,13 @@ export async function createPulseServer({
       }
       // The MEMORY dashboard: what the archive did day by day and what it is made of. Counts
       // only, no text of any memory, so it is read like /api/maturity, without the designation.
+      // What the archive says about something on the screen, for the questions a surface offers.
+      // Memory text, so behind the designation like the archive itself.
+      if (request.method === 'GET' && url.pathname === '/api/memory/about') {
+        if (!designationOk(url.searchParams.get('designation'))) return sendJson(response, 403, { error: t('UNABLE TO COMPUTE. UNABLE TO CLARIFY.') });
+        if ((room.motherStatus()?.lockedForMs ?? 0) > 0) return sendJson(response, 423, { notes: [] });
+        return sendJson(response, 200, { notes: room.notesAbout(url.searchParams.get('text') ?? '', { limit: 3 }) });
+      }
       if (request.method === 'GET' && url.pathname === '/api/memory/dashboard') {
         return sendJson(response, 200, { dashboard: memoryDashboard({ activity: room.memoryActivity(), stats: room.memoryStats() }) });
       }
@@ -1393,6 +2663,9 @@ export async function createPulseServer({
         const mode = Math.min(4, Math.max(0, Number(url.searchParams.get('mode') ?? 1) || 0));
         const text = String(url.searchParams.get('text') ?? '').slice(0, 2000);
         const ash = url.searchParams.get('ash') === 'true';
+        const here = await scopeOf(url);
+        if (here.error) return sendJson(response, 404, here);
+        const room = here.room;
         const briefing = await room.briefing({ agent: asked, mode, text, ash });
         if (!briefing) return sendJson(response, 404, { error: `No agent "${asked}" on this computer.` });
         return sendJson(response, 200, {
@@ -1403,35 +2676,45 @@ export async function createPulseServer({
       }
       // The conversations of this project. One memory, one crew, one numbering; many records.
       if (request.method === 'GET' && url.pathname === '/api/chats') {
-        return sendJson(response, 200, await listChats(roomDir));
+        return sendJson(response, 200, await chatsView());
       }
       if (request.method === 'POST' && url.pathname === '/api/chats') {
-        if (room.working()) return sendJson(response, 409, { error: t('A turn is running in this conversation. Let it finish, or STOP ALL, and try again.') });
+        if (room.busy() && !(await turnsPolicy()).enabled) return sendJson(response, 409, { error: t('A turn is running in this conversation. Let it finish, or STOP ALL, and try again.') });
         const payload = await body(request).catch(() => ({}));
+        // A phone looks at conversations by their own address and never moves the one the room has
+        // open: the Mac would be left showing one conversation while sending into another.
+        if (viaPhone) {
+          const made = await createChat(roomDir, { title: typeof payload.title === 'string' ? payload.title : null, activate: false });
+          return sendJson(response, 200, { ...(await chatsView()), opened: made.id });
+        }
         const made = await createChat(roomDir, { title: typeof payload.title === 'string' ? payload.title : null });
         const mounted = await mountChat(made.id);
         if (mounted.error) return sendJson(response, 409, mounted);
-        return sendJson(response, 200, { ...(await listChats(roomDir)), opened: made.id });
+        return sendJson(response, 200, { ...(await chatsView()), opened: made.id });
       }
       const chatMatch = url.pathname.match(/^\/api\/chats\/([a-z0-9]+)$/);
       if (chatMatch && request.method === 'POST') {
+        if (viaPhone) return sendJson(response, 200, { ...(await chatsView()), opened: chatMatch[1] });
         const mounted = await mountChat(chatMatch[1]);
         if (mounted.error) return sendJson(response, 409, mounted);
-        return sendJson(response, 200, { ...(await listChats(roomDir)), opened: chatMatch[1] });
+        return sendJson(response, 200, { ...(await chatsView()), opened: chatMatch[1] });
       }
       if (chatMatch && request.method === 'PATCH') {
         const payload = await body(request).catch(() => ({}));
         const named = await renameChat(roomDir, chatMatch[1], payload.title);
-        return named ? sendJson(response, 200, { ...(await listChats(roomDir)) }) : sendJson(response, 404, { error: t('No such conversation.') });
+        return named ? sendJson(response, 200, { ...(await chatsView()) }) : sendJson(response, 404, { error: t('No such conversation.') });
       }
       if (chatMatch && request.method === 'DELETE') {
-        if (chatMatch[1] === chatId && room.working()) return sendJson(response, 409, { error: t('A turn is running in this conversation.') });
+        if ((chatMatch[1] === chatId && room.busy()) || parked.get(chatMatch[1])?.room.busy()) return sendJson(response, 409, { error: t('A turn is running in this conversation.') });
+        // Open beside the one on screen and idle: its room closes, and the page watching it hears
+        // its stream end, before its record goes.
+        await closeHeld(chatMatch[1]);
         const gone = await deleteChat(roomDir, chatMatch[1]);
         if (!gone) return sendJson(response, 404, { error: t('No such conversation.') });
         if (gone.error) return sendJson(response, 409, gone);
         // What the archivist distilled from it is the project's memory and stays where it is.
         if (chatMatch[1] === chatId) { const mounted = await mountChat(gone.active); if (mounted.error) return sendJson(response, 409, mounted); }
-        return sendJson(response, 200, { ...(await listChats(roomDir)), deleted: gone.deleted });
+        return sendJson(response, 200, { ...(await chatsView()), deleted: gone.deleted });
       }
       // The three tests. Reading is free; running one is the human's call, and the slow one says
       // where it is while it works.
@@ -1535,7 +2818,7 @@ export async function createPulseServer({
         const payload = await body(request).catch(() => ({}));
         if (!designationOk(payload.designation)) return sendJson(response, 403, { error: t('UNABLE TO COMPUTE. UNABLE TO CLARIFY.') });
         const done = room.dismissAsk(String(payload.id ?? '').slice(0, 80));
-        return done ? sendJson(response, 200, done) : sendJson(response, 404, { error: t('The room has no memory.') });
+        return done ? sendJson(response, 200, done) : sendJson(response, 404, { error: t('The project has no memory.') });
       }
       // One memory's own traffic: who it keeps arriving with, who asked for it, what a
       // refutation did. Read while its card is open, so the card is alive rather than a snapshot.
@@ -1543,7 +2826,7 @@ export async function createPulseServer({
       if (trafficMatch) {
         if (!designationOk(url.searchParams.get('designation'))) return sendJson(response, 403, { error: t('UNABLE TO COMPUTE. UNABLE TO CLARIFY.') });
         const sealed = room.motherStatus()?.lockedForMs ?? 0;
-        if (sealed > 0) return sendJson(response, 423, { error: t('CODE000. THE ARCHIVE IS SEALED.'), lockedForMs: sealed });
+        if (sealed > 0) return sendJson(response, 423, { error: t('TEMPORARY LOCK. THE ARCHIVE IS SEALED.'), lockedForMs: sealed });
         const traffic = room.memoryTraffic(Number(trafficMatch[1]));
         return traffic ? sendJson(response, 200, traffic) : sendJson(response, 404, { error: t('No such memory.') });
       }
@@ -1551,7 +2834,7 @@ export async function createPulseServer({
       if (forgetMatch) {
         const payload = await body(request).catch(() => ({}));
         if (!designationOk(payload.designation)) return sendJson(response, 403, { error: t('UNABLE TO COMPUTE. UNABLE TO CLARIFY.') });
-        if ((room.motherStatus()?.lockedForMs ?? 0) > 0) return sendJson(response, 423, { error: t('CODE000. THE ARCHIVE IS SEALED.') });
+        if ((room.motherStatus()?.lockedForMs ?? 0) > 0) return sendJson(response, 423, { error: t('TEMPORARY LOCK. THE ARCHIVE IS SEALED.') });
         const row = await room.forgetMemory(forgetMatch[1]);
         return row ? sendJson(response, 200, { forgotten: row, stats: room.memoryStats() }) : sendJson(response, 404, { error: t('No such memory.') });
       }
@@ -1571,7 +2854,7 @@ export async function createPulseServer({
       if (vaultMatch && (request.method === 'POST' || request.method === 'DELETE')) {
         const id = vaultMatch[1];
         const address = request.socket.remoteAddress ?? '';
-        if (!['127.0.0.1', '::1', '::ffff:127.0.0.1'].includes(address)) {
+        if (viaPhone || !['127.0.0.1', '::1', '::ffff:127.0.0.1'].includes(address)) {
           return sendJson(response, 403, { error: t('A key is only accepted from this computer, never over the network.') });
         }
         const module = moduleById(id);
@@ -1595,7 +2878,7 @@ export async function createPulseServer({
       if (keyMatch) {
         const id = keyMatch[1];
         const address = request.socket.remoteAddress ?? '';
-        if (!['127.0.0.1', '::1', '::ffff:127.0.0.1'].includes(address)) {
+        if (viaPhone || !['127.0.0.1', '::1', '::ffff:127.0.0.1'].includes(address)) {
           return sendJson(response, 403, { error: t('A key is only accepted from this computer, never over the network.') });
         }
         const agent = agents.find((item) => item.id === id);
@@ -1644,25 +2927,61 @@ export async function createPulseServer({
       // One answer, not the room. The master brake lives next door and means something else.
       if (request.method === 'POST' && url.pathname === '/api/stop-turn') {
         const payload = await body(request).catch(() => ({}));
-        const stopped = await room.stopTurn(String(payload.messageId ?? ''));
+        const here = await scopeOf(url);
+        if (here.error) return sendJson(response, 404, here);
+        const stopped = await here.room.stopTurn(String(payload.messageId ?? ''));
         return sendJson(response, stopped ? 200 : 404, stopped ? { stopped: true } : { error: t('That turn is not running any more.') });
       }
+      // TURNS, read and set from MU/TH/UR. The limits apply to the next message; nothing running stops.
+      if (request.method === 'GET' && url.pathname === '/api/turns') {
+        return sendJson(response, 200, { turns: await turnsPolicy(), working: { here: room.turnsRunning(), chats: busyChats().length + (room.busy() ? 1 : 0) } });
+      }
+      if (request.method === 'POST' && url.pathname === '/api/turns') {
+        const patch = await body(request).catch(() => ({}));
+        const current = (await readConfig(root)).turns ?? {};
+        const next = { ...current };
+        if (typeof patch.enabled === 'boolean') next.enabled = patch.enabled;
+        for (const key of ['chats', 'turnsPerChat']) if (Number.isInteger(Number(patch[key])) && Number(patch[key]) >= 1) next[key] = Number(patch[key]);
+        await updateConfig(root, { turns: next });
+        await room.record('room.turns', { turns: await turnsPolicy() });
+        return sendJson(response, 200, { turns: await turnsPolicy() });
+      }
       if (request.method === 'POST' && url.pathname === '/api/stop-all') {
+        // Every conversation at work, not only the one on screen: the brake is the room's, not the chat's.
         const result = await room.stopAll();
+        passes.clear();
+        for (const held of parked.values()) {
+          const more = await held.room.stopAll().catch(() => ({ plans: 0, turns: 0 }));
+          result.plans += more.plans ?? 0;
+          result.turns += more.turns ?? 0;
+        }
         return sendJson(response, 202, { stopped: true, ...result });
       }
       const stopMatch = request.method === 'POST' && url.pathname.match(/^\/api\/plans\/([0-9a-f-]+)\/stop$/);
       if (stopMatch) {
-        const stopped = await room.stopPlan(stopMatch[1]);
+        const here = await scopeOf(url);
+        if (here.error) return sendJson(response, 404, here);
+        const stopped = await here.room.stopPlan(stopMatch[1]);
         return sendJson(response, stopped ? 202 : 404, stopped ? { stopped: true } : { error: t('No running plan with that id.') });
       }
       // One line of a ```pulse-run, pressed by the human. The body names the request and the line;
       // the command itself is read from the room's record, never from the page.
+      // STOP on one running command's card: a server, or anything still at it.
+      if (request.method === 'POST' && url.pathname === '/api/runs/stop') {
+        const payload = await body(request).catch(() => ({}));
+        const index = Number(payload.index);
+        if (typeof payload.responseMessageId !== 'string' || !Number.isInteger(index) || index < 0) return sendJson(response, 400, { error: t('Name the request and the line to run.') });
+        const here = await scopeOf(url);
+        if (here.error) return sendJson(response, 404, here);
+        return here.room.stopRun({ responseMessageId: payload.responseMessageId, index }) ? sendJson(response, 202, { stopped: true }) : sendJson(response, 404, { error: t('That command is not running.') });
+      }
       if (request.method === 'POST' && url.pathname === '/api/runs') {
         const payload = await body(request).catch(() => ({}));
         const index = Number(payload.index);
         if (typeof payload.responseMessageId !== 'string' || !Number.isInteger(index) || index < 0) return sendJson(response, 400, { error: t('Name the request and the line to run.') });
-        const outcome = await room.runRequested({ responseMessageId: payload.responseMessageId, index });
+        const here = await scopeOf(url);
+        if (here.error) return sendJson(response, 404, here);
+        const outcome = await here.room.runRequested({ responseMessageId: payload.responseMessageId, index });
         return sendJson(response, outcome.status, outcome.ok ? outcome.result : { error: outcome.error });
       }
       if (request.method === 'GET' && url.pathname === '/api/commands') {
@@ -1699,7 +3018,9 @@ export async function createPulseServer({
           } catch (error) { result = { ok: false, title: own.title, text: `/${parsed.name} failed: ${error.message}` }; }
           command = own;
         }
-        const event = await room.recordCommand({ name: parsed.name, args: parsed.args, ...result });
+        const here = await scopeOf(url);
+        if (here.error) return sendJson(response, 404, here);
+        const event = await here.room.recordCommand({ name: parsed.name, args: parsed.args, ...result });
         return sendJson(response, result.ok ? 200 : 422, { command: parsed.name, title: result.title, ok: result.ok, sequence: event.sequence });
       }
       if (request.method === 'GET' && url.pathname === '/api/extensions') {
@@ -1753,25 +3074,58 @@ export async function createPulseServer({
       }
       const installMatch = request.method === 'POST' && url.pathname.match(/^\/api\/extensions\/([a-z0-9-]+)\/install$/);
       if (installMatch) {
+        // A phone switches MADRE's own modules; installing one runs commands in the project.
+        if (viaPhone && !extensionById(installMatch[1])?.toggle) return sendJson(response, 403, { error: t('This is done on the Mac.') });
         const result = await installExtension(installMatch[1], await body(request));
         return sendJson(response, result.status, result.body);
       }
       if (request.method === 'POST' && /^\/api\/control\/[\w-]+\/undo$/.test(url.pathname)) {
-        const result = await room.undoControl(url.pathname.split('/')[3]);
+        const here = await scopeOf(url);
+        if (here.error) return sendJson(response, 404, here);
+        const result = await here.room.undoControl(url.pathname.split('/')[3]);
         return sendJson(response, result.ok ? 200 : result.status ?? 400, result);
       }
       if (request.method === 'POST' && /^\/api\/modes\/[\w-]+\/decide$/.test(url.pathname)) {
         const requestId = url.pathname.split('/')[3];
         const { decision } = await body(request);
-        const result = room.decideMode(requestId, decision);
+        const here = await scopeOf(url);
+        if (here.error) return sendJson(response, 404, here);
+        // From a phone a mode is granted up to #2, as it is asked for up to #2.
+        if (viaPhone && decision !== 'deny' && (here.room.modeAsked(requestId) ?? 0) > PHONE_MAX_MODE) return sendJson(response, 403, { error: t('#3 EDIT and #4 FULL ACCESS are opened from the Mac.') });
+        const result = here.room.decideMode(requestId, decision);
         return sendJson(response, result.ok ? 200 : 409, result);
       }
       if (request.method === 'POST' && url.pathname === '/api/messages') {
         const payload = await body(request);
+        // A phone asks up to #2. The bridge already said so; the room says it again, and records
+        // where the message came from. Only the bridge's word counts for that, never the body's.
+        if (viaPhone) {
+          const written = writtenMode(payload.text);
+          // Read the way the room reads it: «"4"» is #4 there, so it is #4 here (TEL-01).
+          if (Math.max(normalizeMode(payload.mode, payload.create === true ? 2 : 1), written) > PHONE_MAX_MODE) return sendJson(response, 403, { error: t('#3 EDIT and #4 FULL ACCESS are opened from the Mac.') });
+          payload.via = phoneKind;
+        } else delete payload.via;
+        // `?chat=` sends into a conversation held open beside the one on screen. TURNS counts it
+        // like any other: the conversation on screen is one of the "others" when it is working.
+        const here = await scopeOf(url);
+        if (here.error) return sendJson(response, 404, here);
+        const room = here.room;
         // Modes are checked before the turn is accepted, so the composer
         // hears "no" with a reason instead of a silent log line.
         const gate = await room.modeCheck(payload);
         if (!gate.ok) return sendJson(response, gate.status ?? 403, { error: gate.error, mode: gate.mode, maxMode: gate.maxMode });
+        // #3 and #4 go with the pass their key gave, for this agent (above).
+        if (gate.mode >= 3 && !spendPass(payload.key, gate.agent, gate.mode)) return sendJson(response, 403, { error: t('#{n} needs its key. Unlock it again and send.', { n: gate.mode }), mode: gate.mode, needsKey: true });
+        delete payload.key;
+        const turns = await turnsPolicy();
+        if (turns.enabled) {
+          if (room.turnsRunning() >= turns.turnsPerChat) return sendJson(response, 429, { error: t('This conversation already has {n} turns running, and TURNS allows {max} at a time. Wait for one to finish, open another conversation, or raise it in Diagnostics → TURNS.', { n: room.turnsRunning(), max: turns.turnsPerChat }) });
+          const others = busyChats().filter((id) => id !== here.id).length + (!here.main && openRoom().busy() ? 1 : 0);
+          if (!room.busy() && others + 1 > turns.chats) return sendJson(response, 429, { error: t('{n} other conversations are already working, and TURNS allows {max} at a time. Wait for one to finish, or raise it in Diagnostics → TURNS.', { n: others, max: turns.chats }) });
+        } else if (!here.main && !room.busy() && openRoom().busy()) {
+          // TURNS off: one conversation drives the crew at a time, beside or not.
+          return sendJson(response, 409, { error: t('A turn is running in this conversation. Let it finish, or STOP ALL, and try again.') });
+        }
         await refreshPrivacy();
         void room.send(payload).catch((error) => {
           console.error(`MADRE room error: ${error.message}`);
@@ -1798,26 +3152,29 @@ export async function createPulseServer({
   const nativeClose = server.close.bind(server);
   server.close = (callback) => {
     clearInterval(poller);
+    serverSentinel.stop();
     clearTimeout(embedKick);
     unwatchOutbound();
     // In-flight agent processes are killed and their turns recorded as failed
     // before the SSE clients go away, so open pages see the outcome.
-    const shutdown = room.shutdown().catch((error) => console.error(`MADRE shutdown error: ${error.message}`));
-    let result;
+    const shutdown = Promise.all([room, ...[...parked.values()].map((held) => held.room)].map((each) => each.shutdown().catch((error) => console.error(`MADRE shutdown error: ${error.message}`))));
+    // off() also ends the streams of pages watching a conversation held open beside.
+    for (const held of parked.values()) held.off();
+    parked.clear();
     shutdown.then(() => {
       void broadcastPending().then(() => chatWrites).then(() => {
         unsubscribe();
         unsubscribeSentinel();
         unsubscribeEyecat();
         unsubscribeLive();
-    unsubscribeGhost();
+        unsubscribeGhost();
         for (const client of clients.keys()) client.end();
         clients.clear();
         // The memory file closes last, once nothing else writes to it; WAL and shm go with it.
         try { memory?.close(); } catch { /* already closed */ }
         void outbound.drain();
         releaseOpen();
-        result = nativeClose(callback);
+        nativeClose(callback);
         server.closeIdleConnections?.();
       });
     });
@@ -1825,11 +3182,12 @@ export async function createPulseServer({
   };
   server.on('close', () => quotaMonitor.stop());
 
-  return { server, store, agents, quotaMonitor, markOpen, releaseOpen };
+  server.on('close', () => { void phone.stop(); });
+  return { server, store, agents, quotaMonitor, markOpen, releaseOpen, phone };
 }
 
-export async function startPulse({ port, projectRoot, openBrowser }) {
-  const { server, agents, markOpen } = await createPulseServer({ projectRoot, quotaSources: defaultQuotaSources() });
+export async function startPulse({ port, projectRoot, openBrowser, openPath = '' }) {
+  const { server, agents, markOpen, phone } = await createPulseServer({ projectRoot, quotaSources: defaultQuotaSources() });
   await new Promise((resolve, reject) => {
     server.once('error', reject);
     server.listen(port, '127.0.0.1', resolve);
@@ -1837,13 +3195,18 @@ export async function startPulse({ port, projectRoot, openBrowser }) {
   const address = server.address();
   // The room is taken from here on, and says so on disk for anyone who tries to open it again.
   await markOpen(address.port);
+  // From here this room offers to host the phone's bridge, when there is a phone to reach it.
+  phone.start();
   const url = `http://127.0.0.1:${address.port}`;
   const ready = agents.filter((agent) => agent.ready).map((agent) => agent.label).join(', ') || 'none';
   const detected = agents.filter((agent) => agent.detected).map((agent) => agent.label).join(', ') || 'none';
-  console.log(`\nMADRE is ready\n\n  ${url}\n  Project: ${projectRoot}\n  Ready: ${ready}\n  Detected: ${detected}\n`);
-  if (openBrowser) openUrl(url);
-  for (const signal of ['SIGINT', 'SIGTERM']) {
+  console.log(`\nMADRE is ready\n\n  ${url}${openPath}\n  Project: ${projectRoot}\n  Ready: ${ready}\n  Detected: ${detected}\n`);
+  if (openBrowser) openUrl(`${url}${openPath}`);
+  // SIGHUP too: closing the Terminal the room was started in is a way of closing it.
+  for (const signal of ['SIGINT', 'SIGTERM', 'SIGHUP']) {
     process.once(signal, () => server.close(() => process.exit(0)));
   }
+  // Salas asked this room to close: the same as a signal.
+  server.once('madre:close', () => server.close(() => process.exit(0)));
   return { server, url };
 }