@jossuealcala/madre 1.0.1 → 1.0.3

package/src/server.mjs

@@ -1,12 +1,15 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 import http from 'node:http';
-import { readFile, realpath, writeFile, mkdir, cp, rename, access, stat } from 'node:fs/promises';
+import { readFile, realpath, writeFile, mkdir, mkdtemp, cp, rename, access, rm, stat } from 'node:fs/promises';
 import { existsSync, openSync, rmSync } from 'node:fs';
 import { createHash, randomBytes, randomUUID } from 'node:crypto';
 import { probePort, framable } from './ports.mjs';
 import { ControlDesk } from './room/control.mjs';
 import { basename, dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { homedir, hostname } from 'node:os';
+import { gzipSync } from 'node:zlib';
+import { homedir, hostname, tmpdir } from 'node:os';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 
@@ -20,9 +23,10 @@ import { MotherChannel, CODE000_STRIKES } from './mother.mjs';
 import { ErrorSentinel } from './sentinel-errors.mjs';
 import { probeOllama, ollamaEmbedder, ollamaGenerate, ollamaInvoker, pullModel, ollamaVersions, ownOllamaServers } from './ollama.mjs';
 import { recallForTurn } from './modules/enlaces.mjs';
+import { hardwareOnce, MODEL_TIERS } from './modules/local-models.mjs';
 import { MODULES, moduleById, describeModules, findModuleRoute, toolsForTurn as modulesToolsForTurn, loadExternalModules, loadFailures, moduleFolders, moduleCommands, installModuleFile, installModuleText, verifyModuleText, moduleOrigin, removeExternalModule } from './modules/index.mjs';
 import { madreAgent, madreInvoker, MADRE_AGENT_ID, MADRE_ADAPTER } from './adapters/madre.mjs';
-import { exportDataset, readiness as datasetReadiness } from './dataset.mjs';
+import { exportDataset, forgetCorpus, keepCorpus, keptCorpus, pruneCorpora, readiness as datasetReadiness } from './dataset.mjs';
 import { OutboundLog, outboundView, DEFAULT_REPORT_URL } from './outbound.mjs';
 import { language as roomLanguage, setLanguage as setRoomLanguage, t } from './i18n.mjs';
 
@@ -60,10 +64,11 @@ export function injectRipleyBridge(body) {
 import { QuotaMonitor } from './quota-monitor.mjs';
 import { defaultQuotaSources } from './quota-sources.mjs';
 import { Room } from './room.mjs';
-import { changeNeedsPhrase, keyHolds, mergeOverride, overrideSettings, phraseHash, publicOverride } from './override.mjs';
+import { COPILOT_WINDOWS } from './room/copilot.mjs';
+import { OVERRIDE_GRACE, changeNeedsPhrase, keyHolds, mergeOverride, overrideSettings, phraseHash, publicOverride } from './override.mjs';
 import { extensionById, findOnPath, runInstaller } from './extensions.mjs';
-import { accountNoteFor, installPlanFor, looksLikeAdminProblem, loginPlanFor, looksLikeCodePrompt, probeAgentAuth, probeAll, TAKES_KEY } from './auth-probe.mjs';
-import { applyKey, keyPlanFor, OPENCODE_PROVIDERS, readOpenCodeProviders, removeOpenCodeKey } from './credentials.mjs';
+import { accountNoteFor, deviceCodeIn, geminiSignIn, installPlanFor, looksLikeAdminProblem, loginPlanFor, looksLikeCodePrompt, looksLikeConsentPrompt, probeAgentAuth, probeAll, TAKES_KEY } from './auth-probe.mjs';
+import { applyKey, keyPlanFor, openCodeKeyProviders, readOpenCodeProviders, removeOpenCodeKey } from './credentials.mjs';
 import { forgetSecret, readSecret, summary as vaultSummary, writeSecret } from './vault.mjs';
 import { applyConfigToEnv, loadConfig as readConfig, updateConfig } from './config.mjs';
 import { Privacy, normalizeTerms, privacySettings } from './privacy.mjs';
@@ -78,7 +83,7 @@ import { moduleUpdate } from './modules/updates.mjs';
 import { adoptStrays, chatIndex, chatLedger, createChat, deleteChat, isChatId, listChats, openChat as openChatIndex, projectFloor, renameChat, touchChat } from './chats.mjs';
 import { spawn } from 'node:child_process';
 import { cpus, freemem, loadavg, totalmem } from 'node:os';
-import { discoverModels, groupOpenCode, openCodeHidden, providerLabel, OPENCODE_OWN } from './models.mjs';
+import { discoverModels, groupOpenCode, openCodeHidden, parseOpenCodeVerbose, providerLabel, OPENCODE_OWN } from './models.mjs';
 import { observable } from './modules/intents-observe.mjs';
 import { normalizeMode, setImageModule } from './capabilities.mjs';
 import { resolveGeminiKey } from './image-studio.mjs';
@@ -100,16 +105,58 @@ import { currentNetwork, lanAddresses } from './bridge/network.mjs';
 import { PHONE_MAX_MODE, writtenMode } from './bridge/policy.mjs';
 import { qrSvg } from './bridge/qr.mjs';
 import { readHandoff, writeHandoff } from './bridge/handoff.mjs';
-import { changeLooks, readLooks, changeRoomLook, roomLooks } from './looks.mjs';
+import { changeHome, changeLooks, readHome, readLooks, changeRoomLook, roomLooks, WALLPAPER_BYTES, dropWallpaper, frameWallpaper, readWallpaper, saveWallpaper, wallpaperBytes } from './looks.mjs';
 import { localAiConfig, localAiFor, localAiPatch } from './local-ai.mjs';
+import { moduleOnIn, scopeView, settingsIn } from './module-scope.mjs';
+import { forgetFromMarket, installFromMarket, installedFromMarket, keptCatalog, marketAnnounced, marketAnnouncements, marketNews, marketNewsSeen, refreshCatalog, updateFromMarket } from './market-remote.mjs';
+// Not moved project by project: the Coordinator is Home's, Git has no switch, and Local AI keeps
+// its own list of projects (local-ai.mjs).
+const NOT_BY_PROJECT = new Set(['bishop', 'git-pulse', 'ollama']);
 import { heartbeat } from './heartbeat.mjs';
-import { askRoom, associateProject, ensureSalasProject, forgetProject, isSalasRoom, knownRooms, listFolders, markProject, projectRoomId, roomComesUp, salasRoomId, startRoom, suggestProjects, universeOf } from './salas.mjs';
+import { askRoom, associateProject, createProject, ensureSalasProject, forgetProject, isSalasRoom, knownRooms, listFolders, markProject, projectRoomId, roomComesUp, salasRoomId, startRoom, suggestProjects, universeOf } from './salas.mjs';
 import { parseWork, recentWork, WORK_SYSTEM, workPrompt } from './lobby-work.mjs';
-import { CHANNEL_HEADER, MAX_LIMIT as ENLACE_MAX_LIMIT, NO_SUCH_LINK, NOTICES as ENLACE_NOTICES, activeContracts, askEnlace, channelKey, countRecent, linkTraffic, mayServe, noteCrossing, noticeEnlace, readsFrom, recallContract, revokeContract, sameKey, servingRooms, signContract } from './enlaces.mjs';
+import { CHANNEL_HEADER, CORPUS_MAX, CORPUS_PER_HOUR, DELIVER_MAX, MAX_LIMIT as ENLACE_MAX_LIMIT, NO_SUCH_LINK, NOTICES as ENLACE_NOTICES, activeContracts, allowContract, askCorpus, askEnlace, askState, channelKey, countRecent, decideDelivery, deliverable, deliverNotes, deliversTo, linkTraffic, mayServe, noteCrossing, noticeEnlace, readInbox, readsFrom, recallContract, receiveDelivery, revokeContract, sameKey, servingRooms, signContract, trainContract } from './enlaces.mjs';
+import { readContinuity } from './modules/ahp.mjs';
+import { readAt } from './checkpoint.mjs';
 
 const sourceDirectory = dirname(fileURLToPath(import.meta.url));
 const publicDirectory = join(sourceDirectory, '..', 'public');
 
+// The page's own scripts and styles (2026-10-15): an ETag from the file's size and time, so a
+// reload that finds them unchanged gets «304» and the browser reuses its copy — and the code it
+// already compiled — instead of reading 2.5 MB again; and gzip for whoever asks, compressed once per
+// change of the file. `no-cache` still revalidates every time, so an edit shows on the next load.
+// Only the compressed copy is kept in memory (~0.6 MB for all of them); the plain file is read when
+// a client does not take gzip.
+const assetCache = new Map();
+async function sendAsset(request, response, file, type) {
+  const info = await stat(file);
+  const tag = `W/"${info.size.toString(36)}-${Math.floor(info.mtimeMs).toString(36)}"`;
+  const headers = { 'content-type': type, 'cache-control': 'no-cache', etag: tag, vary: 'accept-encoding' };
+  if (request.headers['if-none-match'] === tag) { response.writeHead(304, headers); return response.end(); }
+  const gzip = /\bgzip\b/.test(String(request.headers['accept-encoding'] ?? '')) && info.size > 8192;
+  if (gzip) {
+    let held = assetCache.get(file);
+    if (held?.tag !== tag) { held = { tag, body: gzipSync(await readFile(file), { level: 6 }) }; assetCache.set(file, held); }
+    response.writeHead(200, { ...headers, 'content-encoding': 'gzip', 'content-length': held.body.length });
+    return response.end(held.body);
+  }
+  const body = await readFile(file);
+  response.writeHead(200, { ...headers, 'content-length': body.length });
+  return response.end(body);
+}
+
+// The record as a page opening it needs it (2026-10-15). `quota.updated` is how full each agent's
+// window is, read again every few minutes; the page keeps only the last reading of each agent, so
+// every older one was downloaded, parsed and drawn for nothing — 87% of a long conversation's
+// record, and seconds of drawing. The ledger keeps them all; the page gets the newest of each.
+export function forThePage(events) {
+  const lastQuota = new Map();
+  for (const event of events) if (event?.type === 'quota.updated') lastQuota.set(event.payload?.agent ?? null, event);
+  const keep = new Set(lastQuota.values());
+  return events.filter((event) => event?.type !== 'quota.updated' || keep.has(event));
+}
+
 function sendJson(response, status, value) {
   response.writeHead(status, { 'content-type': 'application/json; charset=utf-8' });
   response.end(JSON.stringify(value));
@@ -137,7 +184,7 @@ export function openUrl(url) {
 
 // PULSE_AGENT_TIMEOUT_MS applies to every agent; PULSE_<AGENT>_TIMEOUT_MS
 // (e.g. PULSE_CLAUDE_TIMEOUT_MS) overrides it for one.
-export function agentTimeoutsFromEnv(env = process.env, agentIds = ['codex', 'claude', 'gemini', 'opencode']) {
+export function agentTimeoutsFromEnv(env = process.env, agentIds = ['codex', 'claude', 'gemini', 'opencode', 'cursor']) {
   const timeouts = {};
   const shared = Number(env.PULSE_AGENT_TIMEOUT_MS);
   if (Number.isFinite(shared) && shared > 0) timeouts.default = shared;
@@ -195,6 +242,10 @@ export async function createPulseServer({
   imageKey = resolveGeminiKey,
   // The sentinel's outbound channel; tests hand in a fake.
   reportFetch = globalThis.fetch,
+  // The Market's catalog and module files from madre.run (src/market-remote.mjs); tests hand in a
+  // fake, and the key their catalog is signed with.
+  marketFetch = globalThis.fetch,
+  marketKey = null,
   // Ollama detection; tests hand in a fake probe. PULSE_OLLAMA=0 leaves Ollama alone entirely.
   ollamaProbe = process.env.PULSE_OLLAMA === '0' ? async () => ({ running: false, host: null, models: [], embedModel: null, chatModel: null, disabled: true }) : probeOllama,
 }) {
@@ -207,8 +258,11 @@ export async function createPulseServer({
   // What language the screens speak. The prompt the agents read is not one of them, and the
   // environment wins over the file, as it does for every other setting here.
   setRoomLanguage(process.env.PULSE_LANGUAGE ?? (await readConfig(root)).language);
+  // Whether anyone set it: a MADRE nobody has set takes the language of the first browser that
+  // opens it (public/i18n.js, browserLanguage), once, and keeps it as if it had been chosen.
+  let languageChosen = Boolean(process.env.PULSE_LANGUAGE || (await readConfig(root)).language);
   // RIPLEY renders HTML in the viewer only while the human has it switched on; read live, the switch is the module's.
-  const ripleyOn = async () => Boolean((await readConfig(root)).modules?.ripley?.enabled);
+  const ripleyOn = async () => moduleOnHere(await readConfig(root), 'ripley');
   agentTimeouts ??= agentTimeoutsFromEnv();
   const detector = detect ?? (providedAgents ? null : detectAgents);
   const agents = providedAgents ?? await detector();
@@ -225,6 +279,7 @@ export async function createPulseServer({
   const unwatchOutbound = outbound.install();
   process.env.PULSE_OUTBOUND_LOG = join(roomDir, 'outbound.jsonl');
   reportFetch = outbound.watch(reportFetch);
+  marketFetch = outbound.watch(marketFetch);
 
   // Attachments live beside the room log, never inside the project, and belong to the project
   // rather than to one conversation.
@@ -316,6 +371,23 @@ export async function createPulseServer({
   // default; PULSE_UPDATE_CHECK=0 or the switch in MU/TH/UR turns it off. Never self-updates.
   const updatesEnabled = () => (process.env.PULSE_UPDATE_CHECK !== undefined ? process.env.PULSE_UPDATE_CHECK !== '0' : updatesConfig.check !== false);
   let updatesConfig = { ...((await readConfig(root)).updates ?? {}) };
+  // THE MARKET from madre.run (src/market-remote.mjs): read when MADRE opens, while Look for new
+  // versions is on (PULSE_MARKET=0 says no to it alone). A module got from it updates itself and
+  // says so once, the next time a page asks (market/updates.json).
+  const marketOn = () => process.env.PULSE_MARKET !== '0' && updatesEnabled();
+  const marketKeyed = marketKey ? { publicKey: marketKey } : {};
+  const marketTools = () => ({ stateRoot: root, projectRoot: canonicalProjectRoot, madre: PACKAGE.version, fetchImpl: marketFetch, verifyText: verifyModuleText, installText: installModuleText });
+  let marketSync = null;
+  const syncMarket = ({ force = false } = {}) => {
+    if (!marketOn()) return Promise.resolve({ catalog: null, off: true });
+    marketSync ??= (async () => {
+      const read = await refreshCatalog({ stateRoot: root, fetchImpl: marketFetch, force, ...marketKeyed });
+      if (read.catalog) await updateFromMarket({ ...marketTools(), catalog: read.catalog, names: Object.fromEntries(MODULES.map((one) => [one.id, one.name])) }).catch(() => []);
+      return read;
+    })().finally(() => { marketSync = null; });
+    return marketSync;
+  };
+  void syncMarket().catch(() => null);
   const install = detectInstall({ projectRoot: canonicalProjectRoot });
   async function versionView({ force = false } = {}) {
     const check = await checkForUpdate({ name: PACKAGE.name, current: PACKAGE.version, cacheFile: join(root, 'updates.json'), fetchImpl: reportFetch, enabled: updatesEnabled(), force });
@@ -516,6 +588,10 @@ export async function createPulseServer({
   const ollamaSettings = async () => ({ enabled: true, embeddings: true, archivist: true, agent: true, ...((await readConfig(root)).modules?.ollama ?? {}) });
   // Whether this project uses the local AI at all, as Home decides it (src/local-ai.mjs).
   const thisRoomId = projectRoomId(canonicalProjectRoot);
+  // This project's word on a module's switch (module-scope.mjs). Home's room is not a project: it
+  // reads, and writes, the switch for every project.
+  const scopeRoom = salasRoom ? null : thisRoomId;
+  const moduleOnHere = (config, key, fallback = false) => moduleOnIn(config?.modules?.[key] ?? {}, scopeRoom, fallback);
   const localAiHere = async () => localAiFor(await readConfig(root), thisRoomId, { home: salasRoom });
   // This project's own switch, outside «auto»; null when Home decides.
   async function setLocalAiHere(on) {
@@ -524,10 +600,110 @@ export async function createPulseServer({
     return wireOllama({ probe: false });
   }
   // What the TRAIN card needs: where the recipe ships, the room, the model name @madre will pick up, a base that fits this machine.
-  function trainingInfo() {
+  // Every event of every conversation of this project, in order: the training export and its
+  // readiness read the whole project, not only the conversation on screen.
+  async function projectEvents() {
+    const { chats: list } = await listChats(roomDir).catch(() => ({ chats: [] }));
+    const ids = list.length ? list.map((chat) => chat.id) : ['main'];
+    const all = [];
+    for (const id of ids) {
+      const raw = await readFile(chatLedger(roomDir, id), 'utf8').catch(() => '');
+      for (const line of raw.split('\n')) {
+        if (!line) continue;
+        try { all.push(JSON.parse(line)); } catch { /* a torn line is skipped */ }
+      }
+    }
+    return all.sort((x, y) => (x.sequence ?? 0) - (y.sequence ?? 0));
+  }
+  // The code workspace (1.0.3): an agent's last EDIT turn on a file, read from every conversation
+  // of the project (only the lines about control turns are parsed), and the parts the human kept.
+  async function lastAgentChange(path) {
+    const { chats: list } = await listChats(roomDir).catch(() => ({ chats: [] }));
+    const ids = list.length ? list.map((chat) => chat.id) : ['main'];
+    let found = null;
+    const undone = new Set();
+    for (const id of ids) {
+      const raw = await readFile(chatLedger(roomDir, id), 'utf8').catch(() => '');
+      for (const line of raw.split('\n')) {
+        if (!line.includes('"control.')) continue;
+        let event;
+        try { event = JSON.parse(line); } catch { continue; }
+        if (event.type === 'control.reverted') { undone.add(event.payload?.checkpointId); continue; }
+        if (event.type !== 'control.changed') continue;
+        const file = (event.payload?.files ?? []).find((one) => one.path === path);
+        if (!file || file.status === 'D' || !event.payload.agent || event.payload.agent === 'you') continue;
+        const at = Date.parse(event.timestamp) || 0;
+        if (!found || at >= found.at) found = { at, agent: event.payload.agent, checkpointId: event.payload.checkpointId, afterTree: event.payload.afterTree ?? null, status: file.status, messageId: event.payload.responseMessageId ?? event.payload.messageId ?? null };
+      }
+    }
+    return found && !undone.has(found.checkpointId) ? { ...found, at: new Date(found.at).toISOString() } : null;
+  }
+  const reviewedFile = join(roomDir, 'code-reviewed.json');
+  let reviewedWrites = Promise.resolve();
+  async function readReviewed() {
+    try { const raw = JSON.parse(await readFile(reviewedFile, 'utf8')); return raw && typeof raw === 'object' && !Array.isArray(raw) ? raw : {}; } catch { return {}; }
+  }
+  function keepReviewed(key, hunk) {
+    const run = reviewedWrites.then(async () => {
+      const all = await readReviewed();
+      const list = [...new Set([...(Array.isArray(all[key]) ? all[key] : []), hunk])].slice(-200);
+      delete all[key];
+      all[key] = list;
+      // The newest 300 files are enough: an older change was long since kept or taken back.
+      const keys = Object.keys(all);
+      for (const old of keys.slice(0, Math.max(0, keys.length - 300))) delete all[old];
+      await writeFile(reviewedFile, `${JSON.stringify(all)}\n`);
+      return list;
+    });
+    reviewedWrites = run.catch(() => null);
+    return run;
+  }
+  // D-S15 · what every project that lets it has to teach the Coordinator, asked now. A project that
+  // is asleep or does not answer is not lost: the copy Salas kept the last time it answered is used
+  // and the manifest says so; one that never answered is listed as missing. Copies of projects that
+  // no longer allow it are forgotten first.
+  async function gatherLinked(datasetDir) {
+    const salas = salasRoomId(root);
+    const contracts = activeContracts(await readConfig(root), { salas });
+    const sources = readsFrom(contracts, salas).filter(({ contract }) => contract.train);
+    await pruneCorpora(datasetDir, new Set(sources.map(({ from }) => from)));
+    if (!sources.length) return [];
+    const rooms = await knownRooms(root);
+    const key = await channelKey(root).catch(() => null);
+    const out = [];
+    for (const { contract, from } of sources) {
+      const where = rooms.find((one) => one.id === from);
+      const answer = where?.open && key
+        ? await askCorpus({ port: where.open.port, contract, asking: salas, key, record: (type, event) => room.record(type, event), roomDir })
+        : { unreachable: true };
+      if (answer.notes) {
+        const at = new Date().toISOString();
+        // D-S16: with the state shared too, a dated photo of it goes with the notes.
+        const shared = contract.state ? await askState({ port: where.open.port, contract, asking: salas, key }) : null;
+        const corpus = { ...answer, ...(shared?.state ? { state: shared.state } : {}) };
+        await keepCorpus(datasetDir, corpus);
+        out.push({ ...corpus, source: 'live', at });
+        continue;
+      }
+      const kept = await keptCorpus(datasetDir, from);
+      out.push(kept && kept.contract === contract.id ? { ...kept, source: 'kept' } : { contract: contract.id, from, name: where?.name ?? from, notes: [], source: 'missing' });
+    }
+    return out;
+  }
+  // A link that stops allowing it (revoked, or the box cleared): the copy Salas kept goes now.
+  async function forgetLinkedCorpus(contract) {
+    const salas = salasRoomId(root);
+    if (contract.rooms.a !== salas && contract.rooms.b !== salas) return;
+    const other = contract.rooms.a === salas ? contract.rooms.b : contract.rooms.a;
+    await forgetCorpus(join(root, 'rooms', salas, 'dataset'), other).catch(() => null);
+  }
+  // The base to train on comes from this computer's hardware (src/modules/local-models.mjs), not
+  // from one rule for every machine: the page lists every size and what this one can do with it.
+  async function trainingInfo() {
     const slug = basename(canonicalProjectRoot).toLowerCase().replace(/[^a-z0-9]+/g, '-');
-    const gb = Math.round(totalmem() / 1024 ** 3);
-    return { roomDir, recipeDir: fileURLToPath(new URL('../docs/training/', import.meta.url)), modelName: `madre-${slug}`, baseModel: gb >= 32 ? 'Qwen/Qwen2.5-3B-Instruct' : 'Qwen/Qwen2.5-1.5B-Instruct', memoryGb: gb };
+    const fit = await hardwareOnce();
+    const base = fit.recommended.train ?? MODEL_TIERS[1];
+    return { roomDir, recipeDir: fileURLToPath(new URL('../docs/training/', import.meta.url)), modelName: `madre-${slug}`, baseModel: base.base, memoryGb: fit.hardware?.memoryGb ?? Math.round(totalmem() / 1024 ** 3), fit };
   }
   async function wireOllama({ probe: doProbe = true } = {}) {
     if (doProbe) ollama = await ollamaProbe();
@@ -557,7 +733,7 @@ export async function createPulseServer({
     wireLocal(room);
     for (const held of parked.values()) wireLocal(held.room);
     if (room) {
-      if (changed) await room.record('agents.updated', { agents: agents.map((agent) => ({ id: agent.id, label: agent.label, detected: agent.detected, ready: agent.ready, version: agent.version, local: Boolean(agent.local), route: agent.route ?? null })), removed: fifth.ready ? [] : [MADRE_AGENT_ID], reason: fifth.ready ? `@madre is in the room · ${fifth.version}` : '@madre left the room: Ollama has no chat model running' });
+      if (changed) await room.record('agents.updated', { agents: agents.map((agent) => ({ id: agent.id, label: agent.label, detected: agent.detected, ready: agent.ready, version: agent.version, local: Boolean(agent.local), route: agent.route ?? null })), removed: fifth.ready ? [] : [MADRE_AGENT_ID], reason: fifth.ready ? `@madre is in the project · ${fifth.version}` : '@madre left the project: Ollama has no chat model running' });
       // That a local model is running is not the same as it being of use on this project, and
       // the second thing is the one a person needs told. Said once per model, in the room, with
       // the one button that settles it — the crew line above fires only when the crew CHANGES,
@@ -602,8 +778,10 @@ export async function createPulseServer({
   const passes = new Map();          // token -> { agent, mode, until, once }
   const keyMisses = [];              // when the last wrong keys were typed
   const PASS_ONCE_MS = 30 * 60 * 1000;
-  function issuePass(agent, mode) {
-    const minutes = overrideConfig.grace[mode] ?? 0;
+  // `asked` is a window the human chose on an agent's request for this mode (2026-10-14): one of
+  // the windows the project allows, never longer, and only for that agent and mode.
+  function issuePass(agent, mode, asked = 0) {
+    const minutes = asked > 0 && OVERRIDE_GRACE[mode]?.includes(asked) ? asked : overrideConfig.grace[mode] ?? 0;
     const token = randomBytes(24).toString('hex');
     const pass = { agent, mode, until: Date.now() + (minutes ? minutes * 60000 : PASS_ONCE_MS), once: !minutes };
     passes.set(token, pass);
@@ -616,6 +794,18 @@ export async function createPulseServer({
     if (pass.once) passes.delete(token);
     return true;
   }
+  // The copilot (src/room/copilot.mjs): one window for the project, opened with the #3 key, up to
+  // 24 hours. In memory only, like the passes: a restart and STOP ALL close it. Every conversation
+  // of the project asks this one when it decides whether a message is a copilot's.
+  let copilot = null;                 // { since, until, minutes, timer }
+  const copilotNow = () => (copilot && copilot.until > Date.now() ? { since: copilot.since, until: copilot.until, minutes: copilot.minutes } : null);
+  const copilotState = () => ({ active: Boolean(copilotNow()), ...(copilotNow() ?? {}), windows: COPILOT_WINDOWS });
+  async function endCopilot(reason) {
+    if (!copilot) return;
+    clearTimeout(copilot.timer);
+    copilot = null;
+    await room.record('copilot.ended', { reason }).catch(() => null);
+  }
   let listening = null;
   const listeningPort = () => listening?.address?.()?.port ?? Number(process.env.PULSE_PORT ?? 4317);
   // One CONTROL desk for the whole project, shared by every conversation alive at once: a single
@@ -635,6 +825,7 @@ export async function createPulseServer({
     bishopForTurn: salasRoom ? async (turn) => moduleById('bishop').promptForTurn({ ...(await moduleContext()), record: (type, payload) => ((turn.turn && liveRooms().find((one) => one.runningTurn?.(turn.turn))) || room).record(type, payload) }, turn) : null,
     // Fase 3e: notes a link with automatic recall brings to a turn. Never in the room of Salas
     // (BISHOP has its own); recorded in the conversation of the turn that read them.
+    copilot: copilotNow,
     linkedForTurn: salasRoom ? null : async (turn) => recallForTurn(await moduleContext(), { ...turn, port: listeningPort(), roomDir,
       record: (type, payload) => ((turn.turn && liveRooms().find((one) => one.runningTurn?.(turn.turn))) || room).record(type, payload) }),
     softTokenBudget,
@@ -788,8 +979,9 @@ export async function createPulseServer({
   let loggingIn = null;
   // A sign-in in flight, as the room is allowed to see it: which door, the address to open, and
   // whether the CLI is waiting to be told the code that page gave back. Never the code itself.
+  // A device sign-in's code is the opposite case: it is shown to be typed on the provider's page.
   let loginRun = null;
-  const loginState = () => (loginRun ? { agent: loginRun.agent, method: loginRun.method, command: loginRun.command, url: loginRun.url, asksForCode: loginRun.asksForCode, awaitingCode: loginRun.awaitingCode, startedAt: loginRun.startedAt } : null);
+  const loginState = () => (loginRun ? { agent: loginRun.agent, method: loginRun.method, command: loginRun.command, url: loginRun.url, deviceCode: loginRun.deviceCode, asksForCode: loginRun.asksForCode, awaitingCode: loginRun.awaitingCode, startedAt: loginRun.startedAt } : null);
 
   async function loginAgent(id, { method = null } = {}) {
     const agent = agents.find((item) => item.id === id);
@@ -799,36 +991,91 @@ export async function createPulseServer({
     if (!plan) return { status: 404, body: { error: `No sign-in flow known for ${id}.` } };
     if (!plan.headless) return { status: 409, body: { error: `${agent.label} signs in from its own prompt. Run this in a terminal, then press RECHECK.`, command: plan.display, note: plan.note } };
     if (loggingIn) return { status: 409, body: { error: `A sign-in is already running (${loggingIn}).` } };
+    // A CLI with no sign-in command of its own (Gemini) signs in on its first question: its settings
+    // are set before, and the run is stopped as soon as the credentials are written. It runs in an
+    // empty folder, so that question never sees the project.
+    const flow = typeof plan.flow === 'object' ? plan.flow : plan.flow === 'gemini-google' ? geminiSignIn() : null;
+    let cwd = canonicalProjectRoot;
+    if (flow) {
+      try {
+        await flow.prepare();
+        cwd = await mkdtemp(join(tmpdir(), 'madre-signin-'));
+      } catch (error) {
+        await flow.undo().catch(() => {});
+        return { status: 500, body: { error: `The sign-in could not be prepared: ${error.message}` } };
+      }
+    }
+    const env = { ...process.env, ...(plan.env ?? {}) };
+    for (const name of [...(plan.dropEnv ?? []), ...(plan.ci === false ? ['CI'] : [])]) delete env[name];
     loggingIn = id;
-    loginRun = { agent: id, method: plan.method ?? null, command: plan.display, url: null, asksForCode: Boolean(plan.asksForCode), awaitingCode: false, startedAt: Date.now(), child: null };
+    loginRun = { agent: id, method: plan.method ?? null, command: plan.display, url: null, deviceCode: null, asksForCode: Boolean(plan.asksForCode), awaitingCode: false, startedAt: Date.now(), child: null };
     await room.record('connection.login.started', { agent: id, command: plan.display, note: plan.note, method: plan.method ?? null });
     void (async () => {
       const lines = [];
+      let consented = false;
+      const answered = new Set();
+      let finished = false;
+      let refused = false;
+      // Signed in is not yet working: Google lets a free personal account sign in to Gemini CLI and
+      // refuses it at the first question (2026-10-17). So the run is let ask its one-word question,
+      // in an empty folder, and the sign-in counts only if that answer is not a refusal. A run that
+      // goes quiet is stopped after half a minute, and counts.
+      const watch = flow ? setInterval(async () => {
+        if (finished || !(await flow.signedIn())) return;
+        finished = true;
+        setTimeout(() => { if (loginRun?.agent === id) loginRun.child?.cancel?.(); }, flow.verifyMs ?? 30000).unref?.();
+      }, 700) : null;
       const result = await runInstaller({
         command: plan.command,
         args: plan.args,
-        projectRoot: canonicalProjectRoot,
+        projectRoot: cwd,
+        env,
+        ci: plan.ci !== false,
         // A person is in the middle of this: the browser, the account, the code. Five minutes was
         // the installer's clock, and it killed sign-ins that were only waiting on a human.
         timeoutMs: 900000,
         // A CLI that asks for a code needs a way to be answered, and its question never ends in a
         // newline, so the half-line is flushed rather than left sitting in the buffer.
-        stdin: plan.asksForCode ? 'pipe' : 'ignore',
-        flushIdleMs: plan.asksForCode ? 600 : 0,
+        stdin: plan.asksForCode || plan.consent || plan.answers?.length ? 'pipe' : 'ignore',
+        flushIdleMs: plan.asksForCode || plan.consent ? 600 : 0,
         quietNote: 'the sign-in is waiting on you: finish it in the page that opened',
         onChild: (handle) => { if (loginRun?.agent === id) loginRun.child = handle; },
-        onLine: (line) => {
+        onLine: (raw) => {
+          // A terminal UI (OpenCode's) hides and moves its cursor even with NO_COLOR: the room
+          // shows what it says, not the escapes it draws with.
+          const line = raw.replace(/\u001b\[[0-9;?]*[A-Za-z]/g, '');
+          if (!line.trim()) return;
           lines.push(line);
+          if (flow?.refused?.(line) && !refused) { refused = true; loginRun?.child?.cancel?.(); }
           const url = line.match(/https?:\/\/\S+/)?.[0] ?? null;
+          const deviceCode = plan.deviceCode ? deviceCodeIn(line) : null;
           if (loginRun?.agent === id) {
             if (url) loginRun.url = url;
+            if (deviceCode) loginRun.deviceCode = deviceCode;
+            // A menu the CLI draws before its sign-in (OpenCode asks which GitHub): the button
+            // pressed already chose, so the room answers it once, the way the plan says.
+            for (const answer of plan.answers ?? []) if (!answered.has(answer) && line.includes(answer.prompt)) { answered.add(answer); loginRun.child?.write?.(answer.send); }
             if (plan.asksForCode && looksLikeCodePrompt(line)) loginRun.awaitingCode = true;
+            // The person already said yes: that was the button they pressed.
+            if (plan.consent && !consented && looksLikeConsentPrompt(line)) { consented = true; loginRun.child?.write?.('y\n'); }
           }
-          void room.record('connection.login.output', { agent: id, line: line.slice(0, 500), url });
+          void room.record('connection.login.output', { agent: id, line: line.slice(0, 500), url, ...(deviceCode ? { deviceCode } : {}) });
         },
       });
+      if (watch) clearInterval(watch);
+      const good = finished && !refused;
+      if (flow) {
+        // Not finished, or refused at its first question: everything goes back as it was.
+        if (!good) await flow.undo().catch(() => {});
+        await rm(cwd, { recursive: true, force: true }).catch(() => {});
+      }
       await refreshSessions();
-      await room.record('connection.login.finished', { agent: id, code: result.code, error: result.error ?? null, session: sessions[id] ?? null, tail: lines.slice(-6) });
+      // A run with no flow (Codex, Claude, OpenCode) ends on its own, and its exit says how it went.
+      const code = flow ? (good ? 0 : (result.code || 1)) : result.code;
+      const error = refused
+        ? t('Google signed you in, but it refuses this account on Gemini CLI (free personal accounts are refused). Gemini was left as it was: paste a Gemini API key from Google AI Studio instead.')
+        : finished ? null : result.error ?? null;
+      await room.record('connection.login.finished', { agent: id, code, error, session: sessions[id] ?? null, tail: lines.slice(-6) });
       loggingIn = null;
       loginRun = null;
     })();
@@ -943,10 +1190,7 @@ export async function createPulseServer({
 
   const startupConfig = await readConfig(root);
   room.setScopes(startupConfig.scopes ?? {});
-  setImageModule(startupConfig.modules?.imageStudio ?? {});
-  room.setAsh(Boolean(startupConfig.modules?.ash?.enabled));
-  room.setChoices(Boolean(startupConfig.modules?.choices?.enabled));
-  room.setRuns(Boolean(startupConfig.modules?.runs?.enabled));
+  applyModuleSwitches(room, startupConfig);
   const recoveredTurns = await room.reconcile();
   if (recoveredTurns) console.error(`MADRE recovered ${recoveredTurns} unfinished turn(s) from a previous run.`);
   const quotaMonitor = new QuotaMonitor({
@@ -1123,8 +1367,9 @@ export async function createPulseServer({
     // its own takes the first thing the human said in it.
     unsubscribeChats = room.subscribe((event) => {
       if (event?.type !== 'message.created' || event.ghost) return;
+      // A message MADRE wrote for the human (results going back) neither names nor previews it.
       const human = event.payload?.role === 'user';
-      chatWrites = chatWrites.then(() => touchChat(roomDir, chatId, { text: human ? saidText(event.payload) : null, counts: human })).catch(() => null);
+      chatWrites = chatWrites.then(() => touchChat(roomDir, chatId, { text: human && !event.payload?.auto ? saidText(event.payload) : null, counts: human })).catch(() => null);
     });
     unsubscribeActivity = watchActivity(room, chatId);
     sentinel.seed(historicalEvents);
@@ -1221,7 +1466,7 @@ export async function createPulseServer({
     const offTouch = target.subscribe((event) => {
       if (event?.type !== 'message.created' || event.ghost) return;
       const human = event.payload?.role === 'user';
-      chatWrites = chatWrites.then(() => touchChat(roomDir, id, { text: human ? saidText(event.payload) : null, counts: human })).catch(() => null);
+      chatWrites = chatWrites.then(() => touchChat(roomDir, id, { text: human && !event.payload?.auto ? saidText(event.payload) : null, counts: human })).catch(() => null);
     });
     const offActivity = watchActivity(target, id);
     const offModules = wireModules(target, id);
@@ -1298,11 +1543,17 @@ export async function createPulseServer({
   async function applyRoomSettings(next, previous) {
     const config = await readConfig(root);
     next.setScopes(config.scopes ?? {});
-    next.setAsh(Boolean(config.modules?.ash?.enabled));
-    next.setChoices(Boolean(config.modules?.choices?.enabled));
-    next.setRuns(Boolean(config.modules?.runs?.enabled));
+    applyModuleSwitches(next, config);
     if (previous) next.configure(previous.settings());
   }
+  // The switches a room holds itself, as this project says them (module-scope.mjs). Read again
+  // before every message, so a switch moved in Home reaches a project that is already open.
+  function applyModuleSwitches(target, config) {
+    setImageModule(settingsIn(config.modules?.imageStudio ?? {}, scopeRoom));
+    target.setAsh(moduleOnHere(config, 'ash'));
+    target.setChoices(moduleOnHere(config, 'choices'));
+    target.setRuns(moduleOnHere(config, 'runs'));
+  }
 
   // Opening another conversation. The project keeps its memory, its crew, its modules, its
   // privacy list and its numbering; what changes is the record being shown. With TURNS on, a
@@ -1373,6 +1624,8 @@ export async function createPulseServer({
     const config = await readConfig(root);
     return {
       projectRoot: canonicalProjectRoot, stateRoot: root, config, env: process.env, agents, room,
+      // Which project's word a module's switch reads and writes; none in Home (module-scope.mjs).
+      roomId: scopeRoom,
       readConfig: () => readConfig(root),
       updateConfig: (patch) => updateConfig(root, patch),
       record: (type, payload) => room.record(type, payload),
@@ -1552,6 +1805,9 @@ export async function createPulseServer({
     }
     const before = await extension.detect(canonicalProjectRoot);
     const plan = installers[id]?.({ projectRoot: canonicalProjectRoot, agents }) ?? extension.installCommand({ agents });
+    // What the module asked MADRE to do first (Continuity: `git init` in a project with no git),
+    // shown in the same confirmation and run before the install, each step stopping the next.
+    const prepare = Array.isArray(preflight.prepare) ? preflight.prepare : [];
     installing = id;
     await room.record('extension.install.started', { id, name: extension.name, command: plan.display, platforms: plan.platforms ?? [], alreadyInstalled: before.installed });
     void (async () => {
@@ -1565,17 +1821,19 @@ export async function createPulseServer({
         pending = [];
         await room.record('extension.install.output', { id, lines: batch });
       };
-      const result = await runInstaller({
-        command: plan.command,
-        args: plan.args,
-        projectRoot: canonicalProjectRoot,
-        onLine: (line) => {
-          lines.push(line);
-          pending.push(line.slice(0, 500));
-          if (pending.length >= 20) void flush();
-          else if (!flushTimer) flushTimer = setTimeout(() => { void flush(); }, 400);
-        },
-      });
+      const onLine = (line) => {
+        lines.push(line);
+        pending.push(line.slice(0, 500));
+        if (pending.length >= 20) void flush();
+        else if (!flushTimer) flushTimer = setTimeout(() => { void flush(); }, 400);
+      };
+      let result = { code: 0 };
+      for (const step of prepare) {
+        onLine(`$ ${step.display}`);
+        result = await runInstaller({ command: step.command, args: step.args, projectRoot: canonicalProjectRoot, onLine });
+        if (result.code !== 0) break;
+      }
+      if (result.code === 0) result = await runInstaller({ command: plan.command, args: plan.args, projectRoot: canonicalProjectRoot, onLine });
       clearTimeout(flushTimer);
       await flush();
       const after = await extension.detect(canonicalProjectRoot);
@@ -1611,15 +1869,11 @@ export async function createPulseServer({
         response.writeHead(200, { 'content-type': 'text/html; charset=utf-8', ...PAGE_GUARDS });
         return response.end(html);
       }
-      if (request.method === 'GET' && ['/app.js', '/nostromo-engine.js', '/brands.js', '/troubleshooting.js', '/inquiry.js', '/i18n.js', '/es.js', '/resay.js', '/syntax.js', '/editor.js', '/routing.js', '/abduction.js', '/review-ask.js', '/loader.js', '/tour.js', '/tour-chapters.js', '/touch.js'].includes(url.pathname)) {
-        const js = await readFile(join(publicDirectory, url.pathname.slice(1)));
-        response.writeHead(200, { 'content-type': 'text/javascript; charset=utf-8' });
-        return response.end(js);
+      if (request.method === 'GET' && ['/app.js', '/nostromo-engine.js', '/brands.js', '/troubleshooting.js', '/inquiry.js', '/i18n.js', '/es.js', '/resay.js', '/syntax.js', '/editor.js', '/routing.js', '/abduction.js', '/review-ask.js', '/loader.js', '/tour.js', '/tour-chapters.js', '/touch.js', '/attribution.js', '/power.js', '/wallpaper.js', '/neural.js', '/hardware.js', '/code-tools.js', '/market.js', '/market-view.js', '/market-art.js'].includes(url.pathname)) {
+        return sendAsset(request, response, join(publicDirectory, url.pathname.slice(1)), 'text/javascript; charset=utf-8');
       }
       if (request.method === 'GET' && url.pathname === '/styles.css') {
-        const css = await readFile(join(publicDirectory, 'styles.css'));
-        response.writeHead(200, { 'content-type': 'text/css; charset=utf-8' });
-        return response.end(css);
+        return sendAsset(request, response, join(publicDirectory, 'styles.css'), 'text/css; charset=utf-8');
       }
       const abductionAssets = new Map([
         ['/assets/abduction-cat.png', 'abduction-cat.png'],
@@ -1773,9 +2027,7 @@ export async function createPulseServer({
         return response.end(html);
       }
       if (request.method === 'GET' && (url.pathname === '/salas-mac.js' || url.pathname === '/salas-mac.css' || url.pathname === '/macroverso.js')) {
-        const file = await readFile(join(publicDirectory, url.pathname.slice(1)));
-        response.writeHead(200, { 'content-type': url.pathname.endsWith('.js') ? 'text/javascript; charset=utf-8' : 'text/css; charset=utf-8', 'cache-control': 'no-cache' });
-        return response.end(file);
+        return sendAsset(request, response, join(publicDirectory, url.pathname.slice(1)), url.pathname.endsWith('.js') ? 'text/javascript; charset=utf-8' : 'text/css; charset=utf-8');
       }
       // A widget of Home, read here (homeWidget above): only from this Mac's own pages.
       if (request.method === 'GET' && url.pathname === '/api/salas/widget') {
@@ -1833,7 +2085,7 @@ export async function createPulseServer({
         // the room of Salas, whether or not that room exists yet (phase 3d).
         const salas = salasRoomId(root);
         const enlaces = await Promise.all(activeContracts(await readConfig(root), { salas }).map(async (contract) => ({ ...contract, traffic: await linkTraffic(servingRooms(contract).map((id) => join(root, 'rooms', id)), contract) })));
-        return sendJson(response, 200, { mac: hostname().replace(/\.local$/i, ''), language: roomLanguage(), here, version: PACKAGE.version ?? null, rooms: seen, handoff: (await readHandoff(root)).mac ?? null, salas, enlaces, phonePreview: await phonePreview() });
+        return sendJson(response, 200, { mac: hostname().replace(/\.local$/i, ''), language: roomLanguage(), languageChosen, here, version: PACKAGE.version ?? null, rooms: seen, handoff: (await readHandoff(root)).mac ?? null, salas, enlaces, phonePreview: await phonePreview() });
       }
       // The open rooms, each in one line (its glance: who works, who waits, its last conversation;
       // never its census or the links), for the room's switcher (2026-10-10), asked every few
@@ -1898,7 +2150,7 @@ export async function createPulseServer({
       // folders (Sec-Fetch-Site) or to add one (Origin), and so is any host name but this Mac's
       // own, so a name pointed at it from outside reaches nothing. Folders are listed inside the
       // home folder only; what is listed is names, never what a file says.
-      if (url.pathname === '/api/salas/folders' || url.pathname === '/api/salas/suggestions' || url.pathname === '/api/salas/projects' || url.pathname === '/api/salas/work' || url.pathname === '/api/salas/decisions') {
+      if (url.pathname === '/api/salas/folders' || url.pathname === '/api/salas/suggestions' || url.pathname === '/api/salas/projects' || url.pathname === '/api/salas/new' || url.pathname === '/api/salas/work' || url.pathname === '/api/salas/decisions') {
         const host = String(request.headers.host ?? '');
         const localHost = /^(127\.0\.0\.1|localhost)(:\d+)?$/.test(host);
         const site = request.headers['sec-fetch-site'];
@@ -1974,6 +2226,21 @@ export async function createPulseServer({
           if (!lobbyDecisions.list) await lobbyDecisions.running;
           return sendJson(response, 200, { decisions: lobbyDecisions.list ?? [], at: lobbyDecisions.at || null });
         }
+        // A project from nothing: a new folder, named by the person, in the folder they were in.
+        if (request.method === 'POST' && url.pathname === '/api/salas/new') {
+          const payload = await body(request).catch(() => ({}));
+          const made = await createProject({ name: typeof payload.name === 'string' ? payload.name : '', parent: typeof payload.parent === 'string' ? payload.parent : null, home, stateRoot: root });
+          if (!made.error) return sendJson(response, 200, { added: [made] });
+          const said = {
+            empty: t('Write a name for the project.'),
+            long: t('That name is too long.'),
+            name: t('A folder cannot be called that: leave out slashes and : * ? " < > |, and do not start with a dot or end with a dot or a space.'),
+            exists: t('There is already a folder with that name there.'),
+            outside: t('Only folders inside your home folder.'),
+            madre: t('That folder is MADRE\'s own.'),
+          }[made.error] ?? t('That folder is not there.');
+          return sendJson(response, made.error === 'exists' ? 409 : 422, { error: said, code: made.error });
+        }
         if (request.method === 'POST' && url.pathname === '/api/salas/projects') {
           const payload = await body(request).catch(() => ({}));
           const roots = Array.isArray(payload.roots) ? payload.roots.filter((one) => typeof one === 'string').slice(0, 50) : [];
@@ -2008,6 +2275,27 @@ export async function createPulseServer({
         const stopped = await Promise.all(rooms.map((one) => askRoom(one.open.port, '/api/stop-all', { method: 'POST', body: {}, timeoutMs: 3000 }).then((answer) => !answer.unreachable && !answer.outdated)));
         return sendJson(response, 200, { rooms: rooms.length, stopped: stopped.filter(Boolean).length });
       }
+      // Turning MADRE off (2026-10-16), from a page of this Mac only, after the person confirmed it.
+      // Every other open project is asked to close the way Home closes one — its agents stop, their
+      // turns are recorded, its memory and its marker are put away — and waited for; then this room
+      // closes the same way. Ollama is its own program and keeps running. Nothing else is touched.
+      if (request.method === 'POST' && url.pathname === '/api/madre/shutdown') {
+        const host = String(request.headers.host ?? '');
+        const site = request.headers['sec-fetch-site'];
+        if (viaPhone || !/^(127\.0\.0\.1|localhost)(:\d+)?$/.test(host) || (site !== undefined && site !== 'same-origin' && site !== 'none') || request.headers.origin !== `http://${host}`) return sendJson(response, 403, { error: t('MADRE is turned off from its own page, on this computer.') });
+        const here = basename(roomDir);
+        const others = (await knownRooms(root)).filter((one) => one.open && one.id !== here);
+        await Promise.all(others.map((one) => askRoom(one.open.port, '/api/room/close', { method: 'POST', body: {}, timeoutMs: 3000 }).catch(() => null)));
+        let left = others;
+        for (let tries = 0; tries < 60 && left.length; tries += 1) {
+          await new Promise((resolve) => setTimeout(resolve, 250));
+          const now = await knownRooms(root);
+          left = left.filter((one) => now.find((room) => room.id === one.id)?.open);
+        }
+        sendJson(response, 202, { closing: true, closed: others.length - left.length, stuck: left.map((one) => one.name) });
+        setTimeout(() => server.emit('madre:close'), 150);
+        return undefined;
+      }
       // This room, asked to close by Salas: what is running stops and the room closes the way a
       // signal closes it (startPulse listens). Nothing here ends the process itself.
       if (request.method === 'POST' && url.pathname === '/api/room/close') {
@@ -2059,6 +2347,89 @@ export async function createPulseServer({
         await noteCrossing(roomDir, { kind: 'read', contract: contract.id, other: asking, count: notes.length, agent: reader });
         return sendJson(response, 200, { contract: contract.id, from: here, notes });
       }
+      // D-S15 · the whole of what this project lets the Coordinator learn, for its training export.
+      // The same doors as a reading, a contract that says `train`, and a ceiling of its own: every
+      // note that travels (`travels()`), of the kinds signed, through this room's privacy guard.
+      // Not a search and not the latest: all of it, up to CORPUS_MAX, so nothing the project knows
+      // is left out of what the Coordinator learns about it. Nothing of the ledger crosses.
+      if (request.method === 'GET' && url.pathname === '/api/enlace/corpus') {
+        if (viaPhone) return sendJson(response, 403, { error: t('This is done on the Mac.') });
+        if (request.headers.origin !== undefined) return sendJson(response, 403, { error: t('A page cannot read across a connection; only a project can.') });
+        const key = await channelKey(root).catch(() => null);
+        if (!key || !sameKey(request.headers[CHANNEL_HEADER], key)) return sendJson(response, 403, { error: t('That is not the key of this Mac.') });
+        const here = basename(roomDir);
+        const asking = String(url.searchParams.get('asking') ?? '');
+        const contract = activeContracts(await readConfig(root), { salas: salasRoomId(root) }).find((one) => one.id === url.searchParams.get('contract')) ?? null;
+        if (!contract?.train || !mayServe({ contract, serving: here, asking }).ok) return sendJson(response, 404, { error: NO_SUCH_LINK });
+        const sealed = room.motherStatus()?.lockedForMs ?? 0;
+        if (sealed > 0) return sendJson(response, 423, { error: `CODE000. THE ARCHIVE IS SEALED FOR ${Math.ceil(sealed / 60000)} MORE MINUTE${Math.ceil(sealed / 60000) === 1 ? '' : 'S'}.`, lockedForMs: sealed });
+        if (!memory) return sendJson(response, 503, { error: t('The project has no memory.') });
+        const taken = await countRecent(roomDir, contract.id, 'corpus');
+        if (taken >= CORPUS_PER_HOUR) return sendJson(response, 429, { error: t('The Coordinator took what this project knows {n} times in the last hour, its limit. Try again later.', { n: taken }) });
+        await refreshPrivacy();
+        const notes = memory.memories({ limit: CORPUS_MAX * 2 })
+          .filter((row) => memoryTravels(row) && contract.kinds.includes(row.kind))
+          .slice(0, CORPUS_MAX)
+          .map((row) => ({ id: row.id, kind: row.kind, zone: row.zone, text: privacy.redact(row.text, { always: true }).text, fromSequence: row.fromSequence, throughSequence: row.throughSequence, created: row.created }));
+        await room.record('enlace.corpus', { contract: contract.id, to: asking, count: notes.length, kinds: contract.kinds });
+        await noteCrossing(roomDir, { kind: 'corpus', contract: contract.id, other: asking, count: notes.length });
+        return sendJson(response, 200, { contract: contract.id, from: here, name: basename(canonicalProjectRoot), notes });
+      }
+      // D-S16 · this project's canonical state (Continuity, AHP+), for the room that reads under a
+      // link that says `state`. The same doors as a reading and the same ceiling, counted apart: the
+      // state is read from .ahp/ now, through this room's privacy guard, and nothing else of the
+      // project (no git, no files, no evidence) crosses. Without .ahp/ the answer says so: `null`.
+      if (request.method === 'GET' && url.pathname === '/api/enlace/state') {
+        if (viaPhone) return sendJson(response, 403, { error: t('This is done on the Mac.') });
+        if (request.headers.origin !== undefined) return sendJson(response, 403, { error: t('A page cannot read across a connection; only a project can.') });
+        const key = await channelKey(root).catch(() => null);
+        if (!key || !sameKey(request.headers[CHANNEL_HEADER], key)) return sendJson(response, 403, { error: t('That is not the key of this Mac.') });
+        const here = basename(roomDir);
+        const asking = String(url.searchParams.get('asking') ?? '');
+        const contract = activeContracts(await readConfig(root), { salas: salasRoomId(root) }).find((one) => one.id === url.searchParams.get('contract')) ?? null;
+        if (!contract?.state || !mayServe({ contract, serving: here, asking }).ok) return sendJson(response, 404, { error: NO_SUCH_LINK });
+        const sealed = room.motherStatus()?.lockedForMs ?? 0;
+        if (sealed > 0) return sendJson(response, 423, { error: `CODE000. THE ARCHIVE IS SEALED FOR ${Math.ceil(sealed / 60000)} MORE MINUTE${Math.ceil(sealed / 60000) === 1 ? '' : 'S'}.`, lockedForMs: sealed });
+        const reads = await countRecent(roomDir, contract.id, 'state');
+        if (reads >= contract.orders.perHour) return sendJson(response, 429, { error: t('The state of this project was read {n} times in the last hour, its limit. Try again later.', { n: reads }) });
+        await refreshPrivacy();
+        const state = await readContinuity(canonicalProjectRoot, { redact: (text) => privacy.redact(text, { always: true }).text });
+        const reader = /^[a-z][a-z0-9_-]{0,30}$/.test(String(url.searchParams.get('agent') ?? '')) ? url.searchParams.get('agent') : null;
+        await room.record('enlace.state', { contract: contract.id, to: asking, source: state?.source ?? null, ...(reader ? { agent: reader } : {}) });
+        await noteCrossing(roomDir, { kind: 'state', contract: contract.id, other: asking, count: state ? 1 : 0, agent: reader });
+        return sendJson(response, 200, { contract: contract.id, from: here, name: basename(canonicalProjectRoot), state });
+      }
+      // D-S17 · notes another project hands to this one, under a link that says `deliver` and lets
+      // that project read from this one. The same doors; the contract's ceiling, counted apart. They
+      // wait in this room's inbox (enlaces-inbox.json): nothing enters the memory until this project
+      // accepts it, by your press or by an agent of this project in #3 or above.
+      if (request.method === 'POST' && url.pathname === '/api/enlace/deliver') {
+        if (viaPhone) return sendJson(response, 403, { error: t('This is done on the Mac.') });
+        if (request.headers.origin !== undefined) return sendJson(response, 403, { error: t('A page cannot deliver across a connection; only a project can.') });
+        const key = await channelKey(root).catch(() => null);
+        if (!key || !sameKey(request.headers[CHANNEL_HEADER], key)) return sendJson(response, 403, { error: t('That is not the key of this Mac.') });
+        const payload = await body(request).catch(() => ({}));
+        const here = basename(roomDir);
+        const from = String(payload.from ?? '');
+        const contract = activeContracts(await readConfig(root), { salas: salasRoomId(root) }).find((one) => one.id === payload.contract) ?? null;
+        if (!contract?.deliver || !mayServe({ contract, serving: here, asking: from }).ok) return sendJson(response, 404, { error: NO_SUCH_LINK });
+        if (!Array.isArray(payload.notes) || !payload.notes.length || payload.notes.length > DELIVER_MAX) return sendJson(response, 422, { error: t('A delivery carries between 1 and {n} notes.', { n: DELIVER_MAX }) });
+        let notes;
+        try { notes = payload.notes.map(deliverable); } catch (error) { return sendJson(response, 422, { error: t(error.message) }); }
+        const received = await countRecent(roomDir, contract.id, 'delivered');
+        if (received >= contract.orders.perHour) return sendJson(response, 429, { error: t('This project received {n} deliveries in the last hour, its limit. Try again later.', { n: received }) });
+        // What arrives is cleaned here too, by this room's guard, before it is even shown.
+        await refreshPrivacy();
+        const clean = notes.map((note) => ({ ...note, text: privacy.redact(note.text, { always: true }).text, why: note.why ? privacy.redact(note.why, { always: true }).text : null }));
+        const sender = (await knownRooms(root)).find((one) => one.id === from);
+        const agent = /^[a-z][a-z0-9_-]{0,30}$/.test(String(payload.agent ?? '')) ? payload.agent : null;
+        let added;
+        try { added = await receiveDelivery(roomDir, { contract: contract.id, from, name: sender?.name ?? from, agent, notes: clean }); }
+        catch (error) { return sendJson(response, error.code === 'FULL' ? 429 : 500, { error: t(error.message) }); }
+        await room.record('enlace.delivered', { contract: contract.id, from, name: sender?.name ?? from, agent, coordinator: from === salasRoomId(root), notes: added.map(({ id, kind, text, why }) => ({ id, kind, text, why })) });
+        await noteCrossing(roomDir, { kind: 'delivered', contract: contract.id, other: from, count: added.length, agent });
+        return sendJson(response, 202, { accepted: added.length, ids: added.map((note) => note.id) });
+      }
       // The side that asks (fase 3c): a tool of this room's own turn asks this room, and this room
       // asks the room that serves, by the channel. The same three doors as above — never a phone,
       // never a page, only the key — because the tool is a process of this Mac and nothing else is.
@@ -2103,6 +2474,84 @@ export async function createPulseServer({
         if (answer.unreachable) return sendJson(response, 502, { error: t('That project did not answer.') });
         return sendJson(response, answer.status ?? 502, { error: answer.refused ?? t('That project did not answer.') });
       }
+      // D-S16 and D-S17, the side that asks: a tool of this room's own turn reads the state of a
+      // project it reads from, or delivers notes to it. The same doors and the same check that the
+      // turn is running here, for that agent, above GHOST, as /api/enlace/ask.
+      if (request.method === 'POST' && (url.pathname === '/api/enlace/ask-state' || url.pathname === '/api/enlace/send')) {
+        if (viaPhone) return sendJson(response, 403, { error: t('This is done on the Mac.') });
+        if (request.headers.origin !== undefined) return sendJson(response, 403, { error: t('A page cannot read across a connection; only a project can.') });
+        const key = await channelKey(root).catch(() => null);
+        if (!key || !sameKey(request.headers[CHANNEL_HEADER], key)) return sendJson(response, 403, { error: t('That is not the key of this Mac.') });
+        const payload = await body(request).catch(() => ({}));
+        const here = basename(roomDir);
+        const turnId = String(payload.turn ?? '');
+        const host = turnId ? liveRooms().find((one) => one.runningTurn?.(turnId)) : null;
+        const running = host?.runningTurn(turnId) ?? null;
+        if (!running || running.agent !== payload.agent || !(running.mode >= 1)) return sendJson(response, 409, { error: t('That reading does not belong to a turn running in this project.') });
+        const wanted = String(payload.room ?? '').trim();
+        const rooms = await knownRooms(root);
+        const named = rooms.filter((one) => one.id === wanted || one.name.toLowerCase() === wanted.toLowerCase());
+        if (!wanted || !named.length) return sendJson(response, 404, { error: t('MADRE does not know that project on this Mac.') });
+        const contracts = activeContracts(await readConfig(root), { salas: salasRoomId(root) });
+        const sending = url.pathname === '/api/enlace/send';
+        const usable = sending ? deliversTo(contracts, here).map(({ contract, to }) => ({ contract, other: to })) : readsFrom(contracts, here).filter(({ contract }) => contract.state).map(({ contract, from }) => ({ contract, other: from }));
+        const link = named.map((source) => ({ source, contract: usable.find((one) => one.other === source.id)?.contract ?? null })).find((one) => one.contract) ?? null;
+        if (!link) return sendJson(response, 404, { error: sending ? t('No signed connection lets this project deliver notes to that one.') : t('No signed connection lets this project read the state of that one.') });
+        const { source, contract } = link;
+        if (!source.open) return sendJson(response, 409, { error: t('That project is asleep. Wake it from Home to read from it.') });
+        if (!sending) {
+          const answer = await askState({ port: source.open.port, contract, asking: here, key, agent: running.agent });
+          if (answer.outdated) return sendJson(response, 409, { error: t('That project runs an older MADRE. Update it, or close it from its terminal.') });
+          if (answer.unreachable) return sendJson(response, 502, { error: t('That project did not answer.') });
+          if (answer.refused) return sendJson(response, answer.status ?? 502, { error: answer.refused });
+          await host.record('enlace.state.received', { contract: contract.id, from: source.id, name: source.name, agent: running.agent, turn: turnId, found: Boolean(answer.state) });
+          return sendJson(response, 200, { from: source.name, contract: contract.id, state: answer.state });
+        }
+        if (!Array.isArray(payload.notes) || !payload.notes.length || payload.notes.length > DELIVER_MAX) return sendJson(response, 422, { error: t('A delivery carries between 1 and {n} notes.', { n: DELIVER_MAX }) });
+        let notes;
+        try { notes = payload.notes.map(deliverable); } catch (error) { return sendJson(response, 422, { error: t(error.message) }); }
+        // What leaves is cleaned by this room's guard first, as every note that crosses.
+        await refreshPrivacy();
+        notes = notes.map((note) => ({ ...note, text: privacy.redact(note.text, { always: true }).text, why: note.why ? privacy.redact(note.why, { always: true }).text : null }));
+        const sent = await deliverNotes({ port: source.open.port, contract, from: here, notes, key, agent: running.agent });
+        if (sent.outdated) return sendJson(response, 409, { error: t('That project runs an older MADRE. Update it, or close it from its terminal.') });
+        if (sent.unreachable) return sendJson(response, 502, { error: t('That project did not answer.') });
+        if (sent.refused) return sendJson(response, sent.status ?? 502, { error: sent.refused });
+        await host.record('enlace.sent', { contract: contract.id, to: source.id, name: source.name, agent: running.agent, turn: turnId, notes: notes.map(({ kind, text }) => ({ kind, text: text.slice(0, 200) })) });
+        await noteCrossing(roomDir, { kind: 'sent', contract: contract.id, other: source.id, count: sent.accepted, agent: running.agent, turn: turnId });
+        return sendJson(response, 202, { to: source.name, delivered: sent.accepted });
+      }
+      // D-S17 · the notes other projects delivered here. Read by the page or by a tool of a turn of
+      // this room; decided by you from the page, or by an agent of this project whose turn runs in
+      // #3 or #4 (it changes the project's memory, as CONTROL may). Accepted, the note enters the
+      // memory as a distilled note does — held first — citing the ledger line of its acceptance.
+      // Read like the room's other records (the guard keeps other computers and other sites out).
+      if (url.pathname === '/api/enlace/inbox' && request.method === 'GET') {
+        return sendJson(response, 200, { notes: (await readInbox(roomDir)).slice(-100).reverse() });
+      }
+      if (url.pathname === '/api/enlace/inbox/decide' && request.method === 'POST') {
+        const payload = await body(request).catch(() => ({}));
+        let by = 'you';
+        if (request.headers.origin === undefined) {
+          const key = await channelKey(root).catch(() => null);
+          if (viaPhone || !key || !sameKey(request.headers[CHANNEL_HEADER], key)) return sendJson(response, 403, { error: t('That is not the key of this Mac.') });
+          const turnId = String(payload.turn ?? '');
+          const running = turnId ? liveRooms().find((one) => one.runningTurn?.(turnId))?.runningTurn(turnId) : null;
+          if (!running || running.agent !== payload.agent) return sendJson(response, 409, { error: t('That reading does not belong to a turn running in this project.') });
+          if (!(running.mode >= 3)) return sendJson(response, 403, { error: t('Only an agent in #3 or #4 accepts a delivered note; below that, you decide it.') });
+          by = running.agent;
+        } else if (viaPhone) return sendJson(response, 403, { error: t('This is done on the Mac.') });
+        if (typeof payload.accept !== 'boolean') return sendJson(response, 422, { error: t('A delivered note is accepted or declined.') });
+        if (payload.accept && !memory) return sendJson(response, 503, { error: t('The project has no memory.') });
+        const note = await decideDelivery(roomDir, String(payload.id ?? ''), { accept: payload.accept, by });
+        if (!note) return sendJson(response, 404, { error: t('That delivered note is not waiting here.') });
+        const event = await room.record(payload.accept ? 'enlace.accepted' : 'enlace.declined', { id: note.id, contract: note.contract, from: note.from, name: note.name, kind: note.kind, text: note.text, by });
+        if (payload.accept) {
+          const sequence = Number(event?.sequence) || 0;
+          memory.addMemories([{ kind: note.kind, text: `${note.text} (delivered by ${note.name})` }], { agent: by, fromSequence: sequence, throughSequence: sequence, origin: 'delivered' });
+        }
+        return sendJson(response, 200, { note });
+      }
       // What another room tells this one by the channel: a link of this room's was signed or
       // revoked. One line in the ledger, never a message; any other type is refused.
       if (request.method === 'POST' && url.pathname === '/api/enlace/notice') {
@@ -2146,7 +2595,12 @@ export async function createPulseServer({
           // «Include always» only from the page (INI-04 of the 1.0 review): its own route refuses a
           // process, and signing let one set it anyway, so a project got another's notes every turn.
           const recall = payload.recall === true && !signed && request.headers.origin !== undefined;
-          contract = await signContract(root, { rooms: { a: payload.a, b: payload.b }, direction: payload.direction, kinds: payload.kinds, expires: payload.expires ?? null, orders: payload.orders ?? { allowed: false, maxMode: 0, perHour: 6 }, signed, recall }, { rooms, salas: salasRoomId(root), designation: payload.designation ?? null });
+          // D-S15: «the Coordinator may learn from it» the same way: only you, only from the page.
+          const train = payload.train === true && !signed && request.headers.origin !== undefined;
+          // D-S16 and D-S17 the same way: the state and deliveries, only you, only from the page.
+          const state = payload.state === true && !signed && request.headers.origin !== undefined;
+          const deliver = payload.deliver === true && !signed && request.headers.origin !== undefined;
+          contract = await signContract(root, { rooms: { a: payload.a, b: payload.b }, direction: payload.direction, kinds: payload.kinds, expires: payload.expires ?? null, orders: payload.orders ?? { allowed: false, maxMode: 0, perHour: 6 }, signed, recall, train, state, deliver }, { rooms, salas: salasRoomId(root), designation: payload.designation ?? null });
         } catch (error) {
           if (error.code === 'DESIGNATION') return sendJson(response, 403, { error: t('UNABLE TO COMPUTE. UNABLE TO CLARIFY.') });
           if (error.code === 'ALREADY') return sendJson(response, 409, { error: t(error.message) });
@@ -2161,11 +2615,35 @@ export async function createPulseServer({
       if (request.method === 'POST' && url.pathname === '/api/salas/enlaces/recall') {
         const payload = await body(request).catch(() => ({}));
         if (request.headers.origin === undefined) return sendJson(response, 403, { error: t('This is changed by you, from Home.') });
-        if (typeof payload.recall !== 'boolean') return sendJson(response, 422, { error: t('recall is on or off.') });
+        if (typeof payload.recall !== 'boolean') return sendJson(response, 422, { error: t('automatic recall can only be on or off.') });
         const contract = await recallContract(root, String(payload.id ?? ''), payload.recall, { salas: salasRoomId(root) });
         if (!contract) return sendJson(response, 404, { error: NO_SUCH_LINK });
         return sendJson(response, 200, { contract });
       }
+      // D-S15: «the Coordinator may learn from this project», ticked or cleared by the human from
+      // Home (never a phone, never a process). Cleared, Salas forgets the copy it kept of that
+      // project at once, and the next export leaves it out.
+      if (request.method === 'POST' && url.pathname === '/api/salas/enlaces/train') {
+        const payload = await body(request).catch(() => ({}));
+        if (viaPhone || request.headers.origin === undefined) return sendJson(response, 403, { error: t('This is changed by you, from Home.') });
+        if (typeof payload.train !== 'boolean') return sendJson(response, 422, { error: t('learning can only be on or off.') });
+        let contract;
+        try { contract = await trainContract(root, String(payload.id ?? ''), payload.train, { salas: salasRoomId(root) }); } catch (error) { return sendJson(response, 422, { error: t(error.message) }); }
+        if (!contract) return sendJson(response, 404, { error: NO_SUCH_LINK });
+        if (!contract.train) await forgetLinkedCorpus(contract);
+        return sendJson(response, 200, { contract });
+      }
+      // D-S16 and D-S17: «it shares its state» and «notes can be delivered to it», ticked or cleared
+      // by you from Home (never a phone, never a process).
+      if (request.method === 'POST' && url.pathname === '/api/salas/enlaces/allow') {
+        const payload = await body(request).catch(() => ({}));
+        if (viaPhone || request.headers.origin === undefined) return sendJson(response, 403, { error: t('This is changed by you, from Home.') });
+        if (!['state', 'deliver'].includes(payload.field) || typeof payload.on !== 'boolean') return sendJson(response, 422, { error: t('That is not something a connection can allow.') });
+        let contract;
+        try { contract = await allowContract(root, String(payload.id ?? ''), payload.field, payload.on, { salas: salasRoomId(root) }); } catch (error) { return sendJson(response, 422, { error: t(error.message) }); }
+        if (!contract) return sendJson(response, 404, { error: NO_SUCH_LINK });
+        return sendJson(response, 200, { contract });
+      }
       if (request.method === 'POST' && url.pathname === '/api/salas/enlaces/revoke') {
         const payload = await body(request).catch(() => ({}));
         const id = String(payload.id ?? '');
@@ -2173,6 +2651,7 @@ export async function createPulseServer({
         const already = Boolean((await readConfig(root)).enlaces?.[id]?.revoked);
         const contract = await revokeContract(root, id);
         if (!contract) return sendJson(response, 404, { error: NO_SUCH_LINK });
+        await forgetLinkedCorpus(contract);
         if (!already) await tellRooms('enlace.revoked', contract, await knownRooms(root)).catch(() => null);
         return sendJson(response, 200, { contract });
       }
@@ -2257,6 +2736,7 @@ export async function createPulseServer({
           // wins over the config here as it does everywhere else, and reading the file again
           // would hand the page a different answer from the one the server itself is using.
           language: roomLanguage(),
+          languageChosen,
           // Which conversation this page is looking at, and the others it could open.
           chats: await chatsView(),
           agents: agents.map((agent) => ({ ...agent, login: loginPlanFor(agent), install: installPlanFor(agent), key: keyPlanFor(agent.id), ...(accountNoteFor(agent.id) ?? {}) })),
@@ -2283,7 +2763,7 @@ export async function createPulseServer({
           capabilities: room.capabilities(),
           quotaSources: quotaMonitor.snapshot(),
           budgetWindow: room.budgetWindow(),
-          events: await store.readAll(),
+          events: forThePage(await store.readAll()),
         });
       }
       if (request.method === 'GET' && url.pathname === '/api/events') {
@@ -2418,6 +2898,29 @@ export async function createPulseServer({
         await room.record('project.file.saved', { path: relative, bytes: result.bytes });
         return sendJson(response, 200, { ok: true, bytes: result.bytes, mtimeMs: result.mtimeMs });
       }
+      // The code workspace (1.0.3): the last time an agent changed a file in an EDIT turn, as git
+      // kept it — the file before the turn and the file the turn left — and which parts of it the
+      // human already kept. A turn taken back with UNDO is no longer a change.
+      if (request.method === 'GET' && url.pathname === '/api/files/changes') {
+        const path = String(url.searchParams.get('path') ?? '').replace(/^\.?\/+/, '');
+        if (!path || path.split('/').includes('..')) return sendJson(response, 400, { error: t('That is not a file of this project.') });
+        const change = await lastAgentChange(path);
+        if (!change) return sendJson(response, 200, { change: null, reviewed: [] });
+        const before = change.status === 'A' ? '' : await readAt(canonicalProjectRoot, { checkpointId: change.checkpointId, path });
+        if (before === null) return sendJson(response, 200, { change: null, reviewed: [] });
+        const after = change.afterTree ? await readAt(canonicalProjectRoot, { tree: change.afterTree, path }) : null;
+        const reviewed = (await readReviewed())[`${change.checkpointId}|${path}`] ?? [];
+        return sendJson(response, 200, { change: { agent: change.agent, checkpointId: change.checkpointId, at: change.at, status: change.status, before, after, messageId: change.messageId }, reviewed });
+      }
+      if (request.method === 'POST' && url.pathname === '/api/files/changes/review') {
+        const payload = await body(request).catch(() => ({}));
+        const path = String(payload.path ?? '').replace(/^\.?\/+/, '');
+        const checkpointId = String(payload.checkpointId ?? '');
+        const hunk = String(payload.hunk ?? '');
+        if (!path || path.split('/').includes('..') || !/^[0-9A-Za-z][\w-]{0,79}$/.test(checkpointId) || !/^[0-9a-f]{6,16}$/.test(hunk)) return sendJson(response, 400, { error: t('That is not a change of this project.') });
+        const reviewed = await keepReviewed(`${checkpointId}|${path}`, hunk);
+        return sendJson(response, 200, { reviewed });
+      }
       // RIPLEY: the project rendered as a site, inside a frame that runs scripts but
       // reaches nothing: an opaque origin (sandbox without same-origin), no network
       // (connect-src none), no forms, no top navigation, assets only from MADRE's
@@ -2477,12 +2980,37 @@ export async function createPulseServer({
         if ((mode !== 3 && mode !== 4) || !agents.some((one) => one.id === agent)) return sendJson(response, 400, { error: t('Unlock #3 or #4 for an agent of this project.') });
         const now = Date.now();
         while (keyMisses.length && keyMisses[0] < now - 60000) keyMisses.shift();
-        if (keyMisses.length >= 8) return sendJson(response, 429, { error: t('Too many wrong keys. Wait a minute and try again.') });
+        if (keyMisses.length >= 8) return sendJson(response, 429, { error: t('Too many wrong confirmations. Wait a minute and try again.') });
         if (!keyHolds(overrideConfig, { mode, words: payload.words, designation: basename(canonicalProjectRoot) })) {
           keyMisses.push(now);
           return sendJson(response, 403, { error: t('That is not it. Try again, or cancel.'), denied: true });
         }
-        return sendJson(response, 200, issuePass(agent, mode));
+        return sendJson(response, 200, issuePass(agent, mode, Number(payload.minutes) || 0));
+      }
+      // The copilot: what it is now, turning it on with the #3 key for a chosen while, turning it off.
+      if (request.method === 'GET' && url.pathname === '/api/copilot') return sendJson(response, 200, copilotState());
+      if (request.method === 'POST' && url.pathname === '/api/copilot') {
+        if (viaPhone) return sendJson(response, 403, { error: t('The copilot is turned on from the computer, not from the phone.') });
+        const payload = await body(request).catch(() => ({}));
+        const minutes = Number(payload.minutes);
+        if (!COPILOT_WINDOWS.includes(minutes)) return sendJson(response, 400, { error: t('Choose how long the copilot lasts: up to 24 hours.') });
+        const now = Date.now();
+        while (keyMisses.length && keyMisses[0] < now - 60000) keyMisses.shift();
+        if (keyMisses.length >= 8) return sendJson(response, 429, { error: t('Too many wrong confirmations. Wait a minute and try again.') });
+        if (!keyHolds(overrideConfig, { mode: 3, words: payload.words, designation: basename(canonicalProjectRoot) })) {
+          keyMisses.push(now);
+          return sendJson(response, 403, { error: t('That is not it. Try again, or cancel.'), denied: true });
+        }
+        if (copilot) clearTimeout(copilot.timer);
+        const until = now + minutes * 60000;
+        copilot = { since: now, until, minutes, timer: setTimeout(() => { void endCopilot('time'); }, minutes * 60000) };
+        copilot.timer.unref?.();
+        await room.record('copilot.started', { until: new Date(until).toISOString(), minutes });
+        return sendJson(response, 200, copilotState());
+      }
+      if (request.method === 'POST' && url.pathname === '/api/copilot/off') {
+        await endCopilot('human');
+        return sendJson(response, 200, copilotState());
       }
       // This project's switch for the local AI (src/local-ai.mjs). In «auto» Home decides and the
       // switch does not move; /apply is how Home tells an open project the choice changed.
@@ -2513,7 +3041,7 @@ export async function createPulseServer({
           const proof = patch.override.proof;
           delete patch.override.proof;
           if (changeNeedsPhrase(overrideConfig) && !(typeof proof === 'string' && proof.trim() && phraseHash(overrideConfig.phrase.salt, proof) === overrideConfig.phrase.hash)) {
-            return sendJson(response, 403, { error: t('Type your current phrase to change the keys.'), needsPhrase: true });
+            return sendJson(response, 403, { error: t('Type your current phrase to change how modes are confirmed.'), needsPhrase: true });
           }
         }
         return sendJson(response, 200, { settings: await applySettings(patch) });
@@ -2549,6 +3077,12 @@ export async function createPulseServer({
         const payload = request.method === 'POST' ? await body(request).catch(() => ({})) : {};
         // `viaPhone` (encargo §6, excepción 4): a module can refuse the phone by its own hand.
         const result = await moduleRoute.route.handler(await moduleContext(), { request, url, params: moduleRoute.params, payload, viaPhone });
+        // A page instead of JSON, for the one place a browser lands on a module's route on its
+        // own: the way back from a sign-in (Connect MCP's OAuth). Never cached.
+        if (typeof result.html === 'string') {
+          response.writeHead(result.status ?? 200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', 'content-security-policy': "default-src 'none'; style-src 'unsafe-inline'" });
+          return response.end(result.html);
+        }
         return sendJson(response, result.status ?? 200, result.body ?? {});
       }
       // Where this room's tokens go: what each block of the briefing has cost, how much came back
@@ -2634,6 +3168,7 @@ export async function createPulseServer({
             image: Boolean(modules['image-studio']?.enabled),
             npm: updatesEnabled(),
             github: updatesEnabled(),
+            market: marketOn(),
             reports: Boolean(sentinel.settings().autoReport),
             anthropic: agents.some((agent) => agent.id === 'claude' && agent.ready),
             ollama: Boolean(ollama.running),
@@ -2685,29 +3220,61 @@ export async function createPulseServer({
         const notes = memory ? memory.memories({ limit: 5000 }) : [];
         if (request.method === 'GET') {
           const manifest = await readFile(join(dir, 'manifest.json'), 'utf8').then(JSON.parse).catch(() => null);
-          const ready = datasetReadiness(await store.readAll(), notes);
+          const ready = datasetReadiness(await projectEvents(), notes);
           const research = room.memoryResearch();
-          return sendJson(response, 200, { dataset: manifest, dir, trained: ollama.madreModel ?? null, readiness: ready, maturity: maturity({ readiness: ready, notes, links: research?.links ?? [], stats: research?.stats ?? null }), training: trainingInfo() });
+          return sendJson(response, 200, { dataset: manifest, dir, trained: ollama.madreModel ?? null, readiness: ready, maturity: maturity({ readiness: ready, notes, links: research?.links ?? [], stats: research?.stats ?? null }), training: await trainingInfo() });
         }
-        const events = await store.readAll();
-        const result = await exportDataset({ events, notes, dir, project: basename(canonicalProjectRoot), home: homedir(), privacy });
-        await room.record('dataset.exported', { pairs: result.pairs, turns: result.turns, notes: result.notes, train: result.train, valid: result.valid, dir });
+        // Every conversation of the project, not only the one open: a turn answered in another
+        // conversation is as much the project's as the one on screen.
+        const events = await projectEvents();
+        // D-S15: in the room of Salas, what each project that lets it has to teach the Coordinator.
+        const linked = salasRoom ? await gatherLinked(dir) : [];
+        const result = await exportDataset({ events, notes, dir, project: basename(canonicalProjectRoot), home: homedir(), privacy, linked });
+        await room.record('dataset.exported', { pairs: result.pairs, turns: result.turns, notes: result.notes, train: result.train, valid: result.valid, dir, ...(salasRoom ? { linked: result.linked.map((one) => ({ room: one.room, notes: one.notes, source: one.source })) } : {}) });
         const after = datasetReadiness(events, notes);
         const drawn = room.memoryResearch();
-        return sendJson(response, 200, { dataset: result, dir, trained: ollama.madreModel ?? null, readiness: after, maturity: maturity({ readiness: after, notes, links: drawn?.links ?? [], stats: drawn?.stats ?? null }), training: trainingInfo() });
+        return sendJson(response, 200, { dataset: result, dir, trained: ollama.madreModel ?? null, readiness: after, maturity: maturity({ readiness: after, notes, links: drawn?.links ?? [], stats: drawn?.stats ?? null }), training: await trainingInfo() });
       }
       // PRIVACY: the terms live in config.json only; the ledger records counts, never words.
       // Which language MADRE speaks. The page keeps its own copy so the first paint needs no
       // round trip; this is the durable one, shared by every browser on this machine.
       // The looks every page shares (src/looks.mjs): Home and each project are different origins,
       // so the browser alone kept a choice for one page only.
-      if (request.method === 'GET' && url.pathname === '/api/looks') return sendJson(response, 200, await readLooks(root, { room: basename(roomDir) }));
+      if (request.method === 'GET' && url.pathname === '/api/looks') return sendJson(response, 200, { ...await readLooks(root, { room: basename(roomDir) }), custom: await readWallpaper(root) });
+      // Your own wallpaper (src/looks.mjs, 1.0.3): one picture, kept once for every page. Served as
+      // the picture it is, never sniffed into anything else; written only from this page.
+      if (request.method === 'GET' && url.pathname === '/api/looks/wallpaper') {
+        const picture = await wallpaperBytes(root);
+        if (!picture) return sendJson(response, 404, { error: t('There is no picture of yours here.') });
+        response.writeHead(200, { 'content-type': picture.type, 'content-length': picture.bytes.length, 'cache-control': 'private, max-age=31536000, immutable', 'x-content-type-options': 'nosniff', 'content-security-policy': "default-src 'none'" });
+        return response.end(picture.bytes);
+      }
+      if (request.method === 'PUT' && url.pathname === '/api/looks/wallpaper') {
+        let bytes;
+        try { bytes = await rawBody(request, WALLPAPER_BYTES); } catch { return sendJson(response, 413, { error: t('The picture is larger than 8 MB.') }); }
+        let meta = null;
+        try { meta = JSON.parse(decodeURIComponent(String(request.headers['x-madre-wallpaper'] ?? ''))); } catch { /* checked with the picture */ }
+        const answer = await saveWallpaper(root, bytes, meta);
+        if (answer.error) return sendJson(response, 400, { error: answer.error === 'type' ? t('Only a WebP, JPEG or PNG picture can be a wallpaper.') : t('That picture could not be kept.') });
+        return sendJson(response, 200, answer);
+      }
+      if (request.method === 'POST' && url.pathname === '/api/looks/wallpaper/frame') {
+        const answer = await frameWallpaper(root, await body(request).catch(() => null));
+        return sendJson(response, answer.error ? 400 : 200, answer);
+      }
+      if (request.method === 'DELETE' && url.pathname === '/api/looks/wallpaper') return sendJson(response, 200, await dropWallpaper(root));
       // This project's own wallpaper («only in this project»), or back to the shared one with null.
       if (request.method === 'POST' && url.pathname === '/api/looks/room') {
         const payload = await body(request).catch(() => ({}));
         const answer = await changeRoomLook(root, basename(roomDir), payload?.wallpaper ?? null);
         return sendJson(response, answer.error ? 400 : 200, answer);
       }
+      // How Home is arranged (src/looks.mjs, home.json): the same on every port Home is shown from.
+      if (request.method === 'GET' && url.pathname === '/api/home-layout') return sendJson(response, 200, await readHome(root));
+      if (request.method === 'POST' && url.pathname === '/api/home-layout') {
+        const answer = await changeHome(root, await body(request).catch(() => null));
+        return sendJson(response, answer.error ? 400 : 200, answer);
+      }
       if (request.method === 'POST' && url.pathname === '/api/looks') {
         const answer = await changeLooks(root, await body(request).catch(() => null));
         return sendJson(response, answer.error ? 400 : 200, answer);
@@ -2716,6 +3283,7 @@ export async function createPulseServer({
         const payload = await body(request).catch(() => ({}));
         const language = payload.language === 'en' ? 'en' : 'es';
         await updateConfig(root, { language });
+        languageChosen = true;
         setRoomLanguage(process.env.PULSE_LANGUAGE ?? language);
         return sendJson(response, 200, { language });
       }
@@ -2883,7 +3451,7 @@ export async function createPulseServer({
         const payload = await body(request).catch(() => ({}));
         if (!designationOk(payload.designation)) return sendJson(response, 403, { error: t('UNABLE TO COMPUTE. UNABLE TO CLARIFY.') });
         const result = await room.code000({ strikes: Number(payload.strikes) || CODE000_STRIKES });
-        return result ? sendJson(response, 200, { code: result.code, lockedForMs: result.lockedForMs, n: result.n }) : sendJson(response, 503, { error: t('Security is silent.') });
+        return result ? sendJson(response, 200, { code: result.code, lockedForMs: result.lockedForMs, n: result.n }) : sendJson(response, 503, { error: t('The Security module did not respond.') });
       }
       if (request.method === 'GET' && url.pathname === '/api/memory') {
         if (!designationOk(url.searchParams.get('designation'))) return sendJson(response, 403, { error: t('UNABLE TO COMPUTE. UNABLE TO CLARIFY.') });
@@ -3194,10 +3762,11 @@ export async function createPulseServer({
         return sendJson(response, result.status, result.body);
       }
       if (request.method === 'GET' && url.pathname === '/api/models') {
+        // `--verbose` adds each model's metadata, its «variants» (the reasoning rungs) among it.
         const listOpenCode = async (opencode) => {
-          const models = [];
-          await runInstaller({ command: opencode.path, args: ['models'], projectRoot: canonicalProjectRoot, timeoutMs: 20000, onLine: (line) => { if (/^[\w.-]+\/[\w.:-]+$/.test(line.trim())) models.push(line.trim()); } });
-          return models;
+          const lines = [];
+          await runInstaller({ command: opencode.path, args: ['models', '--verbose'], projectRoot: canonicalProjectRoot, timeoutMs: 30000, onLine: (line) => { lines.push(line); } });
+          return parseOpenCodeVerbose(lines);
         };
         return sendJson(response, 200, { models: await discoverModels({ agents, config: await readConfig(root), listOpenCode: url.searchParams.get('opencode') === '1' ? listOpenCode : async () => [] }) });
       }
@@ -3212,12 +3781,15 @@ export async function createPulseServer({
         const hidden = new Set(openCodeHidden(config));
         const signed = new Map((await readOpenCodeProviders({ home: credentialHome })).map((one) => [one.id, one.type]));
         const groups = new Map(groupOpenCode(names).map((group) => [group.id, group]));
-        const ids = [...new Set([...OPENCODE_PROVIDERS.map((one) => one.id), ...signed.keys(), ...groups.keys()])];
+        // Every provider a key opens, from OpenCode's own catalogue (credentials.mjs), plus the
+        // ones already signed in or listing models.
+        const keyable = new Map((await openCodeKeyProviders({ home: credentialHome })).map((one) => [one.id, one]));
+        const ids = [...new Set([...keyable.keys(), ...signed.keys(), ...groups.keys()])];
         const providers = ids.map((id) => {
-          const known = OPENCODE_PROVIDERS.find((one) => one.id === id);
+          const known = keyable.get(id);
           const own = id === OPENCODE_OWN;
           const via = own ? 'own' : signed.get(id) ?? null;
-          return { id, label: providerLabel(id), keyUrl: known?.keyUrl ?? null, takesKey: Boolean(known), via, models: groups.get(id)?.models ?? [], hidden: hidden.has(id) };
+          return { id, label: known?.label ?? providerLabel(id), keyUrl: known?.keyUrl ?? null, takesKey: Boolean(known), featured: Boolean(known?.featured), via, models: groups.get(id)?.models ?? [], hidden: hidden.has(id) };
         }).sort((a, b) => Number(Boolean(b.via)) - Number(Boolean(a.via)) || Number(a.via === 'own') - Number(b.via === 'own') || a.label.localeCompare(b.label));
         return sendJson(response, 200, { providers, default: process.env.PULSE_OPENCODE_MODEL ?? null });
       }
@@ -3267,6 +3839,7 @@ export async function createPulseServer({
         // Every conversation at work, not only the one on screen: the brake is the room's, not the chat's.
         const result = await room.stopAll();
         passes.clear();
+        await endCopilot('stopall');
         for (const held of parked.values()) {
           const more = await held.room.stopAll().catch(() => ({ plans: 0, turns: 0 }));
           result.plans += more.plans ?? 0;
@@ -3298,9 +3871,18 @@ export async function createPulseServer({
         if (typeof payload.responseMessageId !== 'string' || !Number.isInteger(index) || index < 0) return sendJson(response, 400, { error: t('Name the request and the line to run.') });
         const here = await scopeOf(url);
         if (here.error) return sendJson(response, 404, here);
-        const outcome = await here.room.runRequested({ responseMessageId: payload.responseMessageId, index });
+        const outcome = await here.room.runRequested({ responseMessageId: payload.responseMessageId, index, returnCap: viaPhone ? PHONE_MAX_MODE : 3 });
         return sendJson(response, outcome.status, outcome.ok ? outcome.result : { error: outcome.error });
       }
+      // The human ran some lines of a request and hands back what there is, without the rest.
+      if (request.method === 'POST' && url.pathname === '/api/runs/return') {
+        const payload = await body(request).catch(() => ({}));
+        if (typeof payload.responseMessageId !== 'string') return sendJson(response, 400, { error: t('Say which request to hand back.') });
+        const here = await scopeOf(url);
+        if (here.error) return sendJson(response, 404, here);
+        const outcome = await here.room.returnRun({ responseMessageId: payload.responseMessageId, returnCap: viaPhone ? PHONE_MAX_MODE : 3 });
+        return sendJson(response, outcome.status, outcome.ok ? outcome : { error: outcome.error });
+      }
       if (request.method === 'GET' && url.pathname === '/api/commands') {
         const ctx = await moduleContext();
         const fromModules = await Promise.all(moduleCommands().map(async (command) => {
@@ -3345,6 +3927,76 @@ export async function createPulseServer({
         void warmModuleUpdates(extensions);
         return sendJson(response, 200, { installing, extensions, failures: loadFailures, folders: moduleFolders({ stateRoot: root, projectRoot: canonicalProjectRoot }), sdk: SDK_PAGE[roomLanguage()] ?? SDK_PAGE.es });
       }
+      // THE MARKET's catalog for the page: the one kept here at once (and a fresh one asked for
+      // behind it), what was got from it, and what it updated on its own that nobody was told yet.
+      if (request.method === 'GET' && url.pathname === '/api/market') {
+        const kept = await keptCatalog({ stateRoot: root, ...marketKeyed });
+        const read = kept ? (void syncMarket().catch(() => null), { catalog: kept }) : await syncMarket().catch(() => ({ catalog: null }));
+        return sendJson(response, 200, { catalog: read.catalog ?? null, off: !marketOn(), installed: await installedFromMarket(root), news: await marketNews(root), announce: await marketAnnouncements(root, read.catalog, MODULES.map((one) => one.id)), madre: PACKAGE.version });
+      }
+      if (request.method === 'POST' && url.pathname === '/api/market/seen') {
+        await marketNewsSeen(root);
+        return sendJson(response, 200, { ok: true });
+      }
+      // The Market's news a page has just told: not again, on this computer.
+      if (request.method === 'POST' && url.pathname === '/api/market/announced') {
+        const payload = await body(request).catch(() => ({}));
+        await marketAnnounced(root, Array.isArray(payload.keys) ? payload.keys.slice(0, 50) : []);
+        return sendJson(response, 200, { ok: true });
+      }
+      // A module from the Market onto this computer: its signed file, checked like any module, for
+      // every project; then every project open right now loads it, and each one turns it on.
+      if (request.method === 'POST' && url.pathname === '/api/market/install') {
+        if (viaPhone) return sendJson(response, 403, { error: t('This is done on the Mac.') });
+        const payload = await body(request).catch(() => ({}));
+        const catalog = (await keptCatalog({ stateRoot: root, ...marketKeyed })) ?? (await syncMarket({ force: true }).catch(() => ({}))).catalog;
+        if (!catalog) return sendJson(response, 503, { error: t('MADRE could not reach the Market. Check your internet connection and try again.') });
+        try {
+          const done = await installFromMarket({ ...marketTools(), id: String(payload.id ?? ''), catalog });
+          await room.record('extension.installed', { id: done.id, name: done.name, origin: 'market', version: done.version, by: 'you' });
+          for (const one of await knownRooms(root)) {
+            if (!one.open?.port || one.id === thisRoomId) continue;
+            await fetch(`http://127.0.0.1:${one.open.port}/api/extensions/reload`, { method: 'POST' }).catch(() => null);
+          }
+          return sendJson(response, 200, { installed: done, extensions: await describeModules(await moduleContext()) });
+        } catch (error) { return sendJson(response, 422, { error: error.message }); }
+      }
+      // Home's view of which projects each module is on in (module-scope.mjs), and where the
+      // modules that install into a project's folder are installed.
+      if (request.method === 'GET' && url.pathname === '/api/modules/scope') {
+        const config = await readConfig(root);
+        const home = salasRoomId(root);
+        const projects = (await knownRooms(root)).filter((one) => one.id !== home && one.root).map((one) => ({ id: one.id, name: one.name, open: Boolean(one.open) }));
+        const roots = new Map((await knownRooms(root)).map((one) => [one.id, one.root]));
+        const ids = projects.map((one) => one.id);
+        const modules = [];
+        for (const module of MODULES) {
+          if (module.scope && !NOT_BY_PROJECT.has(module.id)) modules.push({ id: module.id, switch: true, ...scopeView(config.modules?.[module.configKey] ?? {}, Boolean(module.defaults?.enabled), ids) });
+          else if (module.kind === 'installer' && module.detect) {
+            const on = [];
+            for (const id of ids) if ((await module.detect(roots.get(id)).catch(() => null))?.installed) on.push(id);
+            modules.push({ id: module.id, switch: false, on, everywhere: false });
+          }
+        }
+        return sendJson(response, 200, { projects, modules });
+      }
+      // The keys modules put beside MADRE's version (sdk.mjs, `footer`): only those on here.
+      if (request.method === 'GET' && url.pathname === '/api/modules/footer') {
+        const context = await moduleContext();
+        const keys = MODULES.filter((module) => module.footer?.length && module.settingsFrom?.(context.config, context.roomId)?.enabled).map((module) => ({ id: module.id, name: module.name, footer: module.footer }));
+        return sendJson(response, 200, { keys });
+      }
+      // Home's word: every project (`all`), or some (`rooms`). A project's own MODULES moves only its word.
+      const scopeMatch = request.method === 'POST' && url.pathname.match(/^\/api\/extensions\/([a-z0-9-]+)\/scope$/);
+      if (scopeMatch) {
+        if (viaPhone) return sendJson(response, 403, { error: t('This is done on the Mac.') });
+        const module = moduleById(scopeMatch[1]);
+        if (!module?.scope || NOT_BY_PROJECT.has(module.id)) return sendJson(response, 404, { error: t('That module is not turned on by project.') });
+        const payload = await body(request).catch(() => ({}));
+        const result = await module.scope(await moduleContext(), { all: payload.all, rooms: payload.rooms, confirm: payload.confirm });
+        for (const held of parked.values()) await applyRoomSettings(held.room, null);
+        return sendJson(response, result.status, result.body);
+      }
       // The human installs a module file an agent wrote (or they did): checked first, then copied into the chosen folder.
       if (request.method === 'POST' && url.pathname === '/api/extensions/install-file') {
         const payload = await body(request).catch(() => ({}));
@@ -3360,6 +4012,7 @@ export async function createPulseServer({
       if (removeMatch) {
         try {
           const removed = await removeExternalModule({ id: removeMatch[1], stateRoot: root, projectRoot: canonicalProjectRoot });
+          await forgetFromMarket(root, removed.id).catch(() => false);
           await room.record('extension.removed', { id: removed.id, name: removed.name, by: 'you' });
           return sendJson(response, 200, { removed, extensions: await describeModules(await moduleContext()) });
         } catch (error) { return sendJson(response, moduleById(removeMatch[1]) ? 403 : 404, { error: error.message }); }
@@ -3389,6 +4042,19 @@ export async function createPulseServer({
         const result = await module.setControl(await moduleContext(), await body(request));
         return sendJson(response, result.status, result.body);
       }
+      // What a module offers to put right before it can install (Continuity on a Mac with no git:
+      // Apple's installer for its command line tools). Asked from this Mac only; the command is the
+      // module's own, never one sent by the page.
+      const fixMatch = request.method === 'POST' && url.pathname.match(/^\/api\/extensions\/([a-z0-9-]+)\/fix$/);
+      if (fixMatch) {
+        if (viaPhone) return sendJson(response, 403, { error: t('This is done on the Mac.') });
+        const extension = extensionById(fixMatch[1]);
+        const checked = extension?.preflight ? await extension.preflight(canonicalProjectRoot) : null;
+        if (!checked?.fix) return sendJson(response, 409, { error: t('There is nothing to set up for this module.') });
+        const ran = await runInstaller({ command: checked.fix.command, args: checked.fix.args, projectRoot: canonicalProjectRoot, timeoutMs: 60000 });
+        await room.record('extension.fix.started', { id: fixMatch[1], command: checked.fix.display, code: ran.code });
+        return sendJson(response, ran.code === 0 ? 202 : 500, ran.code === 0 ? { started: true, command: checked.fix.display } : { error: ran.error ?? t('It could not be started.') });
+      }
       const installMatch = request.method === 'POST' && url.pathname.match(/^\/api\/extensions\/([a-z0-9-]+)\/install$/);
       if (installMatch) {
         // A phone switches MADRE's own modules; installing one runs commands in the project.
@@ -3412,7 +4078,7 @@ export async function createPulseServer({
         if (!asked) return sendJson(response, 409, { error: t('That request is no longer pending.') });
         if (decision !== 'deny' && asked.mode > PHONE_MAX_MODE) {
           if (viaPhone) return sendJson(response, 403, { error: t('#3 EDIT and #4 FULL ACCESS are opened from the Mac.') });
-          if (!spendPass(key, asked.agent, asked.mode)) return sendJson(response, 403, { error: t('#{n} needs its key. Unlock it again and send.', { n: asked.mode }), needsKey: true });
+          if (!spendPass(key, asked.agent, asked.mode)) return sendJson(response, 403, { error: t('#{n} needs your confirmation. Unlock it again and send.', { n: asked.mode }), needsKey: true });
         }
         const result = here.room.decideMode(requestId, decision);
         return sendJson(response, result.ok ? 200 : 409, result);
@@ -3431,13 +4097,23 @@ export async function createPulseServer({
         // like any other: the conversation on screen is one of the "others" when it is working.
         const here = await scopeOf(url);
         if (here.error) return sendJson(response, 404, here);
+        // A switch moved in Home since this project opened reaches it here (module-scope.mjs).
+        applyModuleSwitches(here.room, await readConfig(root));
         const room = here.room;
+        // A copilot message at #3 goes with the copilot's window instead of a pass; from this
+        // computer only. With the window closed it is said, and the page asks for the key again.
+        if (payload.copilot === true && (viaPhone || !copilotNow())) {
+          if (!viaPhone) return sendJson(response, 409, { error: t('The copilot is off: it ended or was stopped. Turn it on again, or send and confirm #3.'), copilotOff: true });
+          delete payload.copilot;
+        }
         // Modes are checked before the turn is accepted, so the composer
         // hears "no" with a reason instead of a silent log line.
         const gate = await room.modeCheck(payload);
         if (!gate.ok) return sendJson(response, gate.status ?? 403, { error: gate.error, mode: gate.mode, maxMode: gate.maxMode });
+        const byCopilot = payload.copilot === true && gate.mode === 3;
+        if (!byCopilot) delete payload.copilot;
         // #3 and #4 go with the pass their key gave, for this agent (above).
-        if (gate.mode >= 3 && !spendPass(payload.key, gate.agent, gate.mode)) return sendJson(response, 403, { error: t('#{n} needs its key. Unlock it again and send.', { n: gate.mode }), mode: gate.mode, needsKey: true });
+        if (gate.mode >= 3 && !byCopilot && !spendPass(payload.key, gate.agent, gate.mode)) return sendJson(response, 403, { error: t('#{n} needs your confirmation. Unlock it again and send.', { n: gate.mode }), mode: gate.mode, needsKey: true });
         delete payload.key;
         const turns = await turnsPolicy();
         if (turns.enabled) {