@milpa/comal 0.2.3 → 0.2.4

package/src/qr-scan.mjs

@@ -0,0 +1,240 @@
+// /rc device scan: reads the M5Stack's pairing QR with a local camera, only while the person asked for it, 30 s at most
+// in total (finding the camera included). One ffmpeg stays open for the scan (so focus and exposure settle) and writes
+// 2 frames a second into a private 0700 directory; each completed frame is decoded with zbarimg and deleted right
+// after, and the directory goes at the end (and on process exit). Nothing is kept and nothing leaves this machine.
+// Processes are spawned with argv arrays (no shell). `spawn`, `now`, `sleep`, `readdir` (of /dev) and `tmpRoot` are
+// injectable so tests run without a camera.
+import { spawn as nodeSpawn } from 'node:child_process';
+import { rmSync } from 'node:fs';
+import { chmod, lstat, mkdtemp, readdir as fsReaddir, rm } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { t, registerMessages } from './i18n/index.mjs';
+
+/** The QR on the device's pairing screen: this prefix plus the code as shown, uppercase Crockford XXXX-XXXX.
+ * It carries nothing secret (the device's poll token never goes in it). Same constant as
+ * devices/m5stack/lib/comal_core/pairing.h (PAIR_QR_PREFIX). */
+export const PAIR_QR_PREFIX = 'comal-pair:v1:';
+const PAIR_QR = /^comal-pair:v1:([0-9A-HJKMNP-TV-Z]{4}-[0-9A-HJKMNP-TV-Z]{4})$/;
+const CAMERA = /^\/dev\/video[0-9]+$/;
+export const SCAN_TIMEOUT_MS = 30000;
+export const SCAN_INTERVAL_MS = 250;  // how often the private directory is looked at for completed frames
+const STREAM_SIZE = '1280x720';
+const STREAM_FPS = 2;
+const PROBE_TIMEOUT_MS = 5000;
+const GRAB_TIMEOUT_MS = 10000;
+const FRAME_MAX_BYTES = 32 * 1024 * 1024;
+const FRAME = /^f[0-9]{6}\.png$/;
+const DIR_PREFIX = 'comal-qr-';
+const DIR_SHAPE = /^comal-qr-[A-Za-z0-9]{6}$/;  // what mkdtemp makes of DIR_PREFIX: only these are swept
+const STALE_MS = 120000;  // a scan touches its directory every half second; one untouched for 2 min is left over
+
+registerMessages({
+  'The camera must be a /dev/videoN device.': 'La cámara debe ser un dispositivo /dev/videoN.',
+  'COMAL_CAMERA must be a /dev/videoN device.': 'COMAL_CAMERA debe ser un dispositivo /dev/videoN.',
+  'No camera found (/dev/video*). Pass one with /rc device scan /dev/videoN, or type the code: /rc device XXXX-XXXX.': 'No se encontró una cámara (/dev/video*). Indica una con /rc device scan /dev/videoN, o escribe el código: /rc device XXXX-XXXX.',
+  'Scanning needs ffmpeg and zbarimg. Install the ffmpeg and zbar packages, or type the code: /rc device XXXX-XXXX.': 'Escanear necesita ffmpeg y zbarimg. Instala los paquetes ffmpeg y zbar, o escribe el código: /rc device XXXX-XXXX.',
+  'Could not read the camera {camera}: {reason}': 'No se pudo leer la cámara {camera}: {reason}',
+  'No pairing QR seen in {seconds} s. Bring the M5Stack 10-20 cm from the camera, so the QR fills about a third of the picture, and try again, or type the code: /rc device XXXX-XXXX.': 'No se vio un QR de emparejamiento en {seconds} s. Acerca el M5Stack a 10-20 cm de la cámara, que el QR ocupe un tercio de la imagen, e inténtalo de nuevo, o escribe el código: /rc device XXXX-XXXX.',
+  'QR scan cancelled; the camera is off.': 'Escaneo del QR cancelado; la cámara está apagada.',
+});
+
+/** zbarimg's stdout counts only when it is exactly one symbol: one matching line plus its newline. */
+function onlyPairCode(stdout) {
+  const text = stdout.toString('utf8').replace(/\r?\n$/, '');
+  return /[\r\n]/.test(text) ? null : pairCodeFromQr(text);
+}
+
+/** The code in a pairing QR's text, or null for anything else (which is never echoed). */
+export function pairCodeFromQr(text) {
+  const match = PAIR_QR.exec(typeof text === 'string' ? text : '');
+  return match ? match[1] : null;
+}
+
+export const isCameraPath = value => typeof value === 'string' && CAMERA.test(value);
+
+const failure = (code, message) => Object.assign(new Error(message), { code });
+const aborted = () => Object.assign(new Error(t('QR scan cancelled; the camera is off.')), { name: 'AbortError', code: 'ABORT_ERR' });
+const missingTools = () => failure('QR_SCAN_TOOLS', t('Scanning needs ffmpeg and zbarimg. Install the ffmpeg and zbar packages, or type the code: /rc device XXXX-XXXX.'));
+const timedOut = seconds => failure('QR_SCAN_TIMEOUT', t('No pairing QR seen in {seconds} s. Bring the M5Stack 10-20 cm from the camera, so the QR fills about a third of the picture, and try again, or type the code: /rc device XXXX-XXXX.', { seconds: String(seconds) }));
+const oneLine = text => String(text || '').split(/\r?\n/).map(line => line.trim()).find(Boolean)?.replace(/[\u0000-\u001f\u007f-\u009f]/g, '').slice(0, 200) || 'no frame';
+
+/** Runs one process to its end: {code, stdout, stderr}. Killed on abort or after `timeoutMs`; ENOENT → missing tools. */
+function run(spawn, cmd, args, { signal, timeoutMs = GRAB_TIMEOUT_MS } = {}) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) { reject(aborted()); return; }
+    let child;
+    try { child = spawn(cmd, args, { stdio: ['ignore', 'pipe', 'pipe'], shell: false }); }
+    catch (error) { reject(error.code === 'ENOENT' ? missingTools() : error); return; }
+    const out = [], err = [];
+    let size = 0, errSize = 0, settled = false;
+    const settle = (fn, value) => { if (settled) return; settled = true; clearTimeout(timer); signal?.removeEventListener('abort', onAbort); fn(value); };
+    const kill = () => { try { child.kill('SIGKILL'); } catch {} };
+    const onAbort = () => { kill(); settle(reject, aborted()); };
+    const timer = setTimeout(() => { kill(); settle(resolve, { code: null, stdout: Buffer.alloc(0), stderr: 'timed out' }); }, timeoutMs);
+    timer.unref?.();
+    signal?.addEventListener('abort', onAbort, { once: true });
+    child.stdout?.on('data', chunk => { size += chunk.length; if (size > FRAME_MAX_BYTES) { kill(); settle(resolve, { code: null, stdout: Buffer.alloc(0), stderr: 'frame too large' }); } else out.push(chunk); });
+    child.stderr?.on('data', chunk => { if (errSize < 4096) { err.push(chunk); errSize += chunk.length; } });
+    child.on('error', error => settle(reject, error.code === 'ENOENT' ? missingTools() : error));
+    child.on('close', code => settle(resolve, { code, stdout: Buffer.concat(out), stderr: Buffer.concat(err).toString('utf8') }));
+  });
+}
+
+const grabArgs = device => ['-hide_banner', '-loglevel', 'error', '-f', 'v4l2', '-i', device, '-frames:v', '1', '-f', 'image2pipe', '-vcodec', 'png', '-'];
+const DECODE_ARGS = ['--raw', '-q', '-Sdisable', '-Sqrcode.enable'];
+
+/** True when `v4l2-ctl --all` says this node itself captures video (Device Caps; Capabilities is the whole device's). */
+function capturesVideo(text) {
+  const lines = String(text).split('\n');
+  const start = lines.findIndex(line => /^\s*Device Caps\s*:/.test(line));
+  if (start < 0) return false;
+  const indent = lines[start].match(/^\s*/)[0].length;
+  for (const line of lines.slice(start + 1)) {
+    if (!line.trim() || line.match(/^\s*/)[0].length <= indent) break;
+    if (/^\s*Video Capture(?: Multiplanar)?\s*$/.test(line)) return true;
+  }
+  return false;
+}
+
+/** The camera: `camera` (argument) > env COMAL_CAMERA > the first /dev/videoN that v4l2-ctl reports as Video Capture
+ * (without v4l2-ctl: the first one ffmpeg can read a frame from). Anything that is not /dev/videoN is refused. */
+export async function pickCamera({ camera, env = process.env, spawn = nodeSpawn, readdir = fsReaddir, signal, deadline = Infinity, now = Date.now, seconds = SCAN_TIMEOUT_MS / 1000 } = {}) {
+  if (camera !== undefined && camera !== null && camera !== '') {
+    if (!isCameraPath(camera)) throw failure('QR_SCAN_CAMERA_PATH', t('The camera must be a /dev/videoN device.'));
+    return camera;
+  }
+  const fromEnv = env?.COMAL_CAMERA?.trim();
+  if (fromEnv) {
+    if (!isCameraPath(fromEnv)) throw failure('QR_SCAN_CAMERA_PATH', t('COMAL_CAMERA must be a /dev/videoN device.'));
+    return fromEnv;
+  }
+  let names = [];
+  try { names = await readdir('/dev'); } catch {}
+  const candidates = names.filter(name => /^video[0-9]+$/.test(name)).sort((a, b) => Number(a.slice(5)) - Number(b.slice(5))).map(name => '/dev/' + name);
+  // Probing counts toward the scan's time: each probe gets what is left, and none starts past the deadline.
+  const left = limit => { const ms = Math.min(limit, deadline - now()); if (ms <= 0) throw timedOut(seconds); return ms; };
+  let haveV4l2 = true;
+  for (const device of candidates) {
+    if (haveV4l2) {
+      try {
+        const result = await run(spawn, 'v4l2-ctl', ['--device', device, '--all'], { signal, timeoutMs: left(PROBE_TIMEOUT_MS) });
+        if (result.code === 0 && capturesVideo(result.stdout.toString('utf8'))) return device;
+        continue;
+      } catch (error) {
+        if (error.name === 'AbortError' || error.code === 'QR_SCAN_TIMEOUT') throw error;
+        if (error.code !== 'QR_SCAN_TOOLS') continue;
+        haveV4l2 = false;
+      }
+    }
+    const result = await run(spawn, 'ffmpeg', grabArgs(device), { signal, timeoutMs: left(GRAB_TIMEOUT_MS) });
+    if (result.code === 0 && result.stdout.length) return device;
+  }
+  throw failure('QR_SCAN_NO_CAMERA', t('No camera found (/dev/video*). Pass one with /rc device scan /dev/videoN, or type the code: /rc device XXXX-XXXX.'));
+}
+
+const abortableSleep = (ms, signal) => new Promise((resolve, reject) => {
+  if (signal?.aborted) { reject(aborted()); return; }
+  const timer = setTimeout(() => { signal?.removeEventListener('abort', onAbort); resolve(); }, ms);
+  const onAbort = () => { clearTimeout(timer); reject(aborted()); };
+  signal?.addEventListener('abort', onAbort, { once: true });
+});
+
+// How the camera is opened, in order, each tried when the one before ends without a frame: 1280x720 MJPEG (a UVC
+// camera often has 1280x720 only as MJPEG and silently gives 640x480 raw frames for a bare -video_size), 1280x720 in
+// its default format, then its own default size.
+const STREAM_ATTEMPTS = [['-input_format', 'mjpeg', '-video_size', STREAM_SIZE], ['-video_size', STREAM_SIZE], []];
+// `-t` (an input option) is the seconds left to the scan, rounded up: if Comal dies without its exit hook (SIGKILL, OOM,
+// a crash) ffmpeg still ends itself, and turns the camera off, at the scan's deadline.
+const streamArgs = (device, dir, attempt, seconds) => ['-hide_banner', '-loglevel', 'error', '-f', 'v4l2', ...STREAM_ATTEMPTS[attempt], '-t', String(seconds), '-i', device, '-vf', `fps=${STREAM_FPS}`, '-f', 'image2', path.join(dir, 'f%06d.png')];
+
+/** The long-running ffmpeg of a scan: {child, exited, error, stderr, closed}. */
+function startStream(spawn, args) {
+  const stream = { child: null, exited: false, error: null, stderr: '' };
+  stream.closed = new Promise(resolve => {
+    try { stream.child = spawn('ffmpeg', args, { stdio: ['ignore', 'ignore', 'pipe'], shell: false }); }
+    catch (error) { stream.exited = true; stream.error = error; resolve(); return; }
+    stream.child.stderr?.on('data', chunk => { if (stream.stderr.length < 4096) stream.stderr += chunk.toString('utf8'); });
+    stream.child.on('error', error => { stream.error = error; stream.exited = true; resolve(); });
+    stream.child.on('close', () => { stream.exited = true; resolve(); });
+  });
+  return stream;
+}
+/** Kills a stream and waits (briefly) until it is gone, so nothing writes into the directory being removed. */
+async function stopStream(stream) {
+  if (!stream || stream.exited) return;
+  try { stream.child.kill('SIGKILL'); } catch {}
+  let timer;
+  await Promise.race([stream.closed, new Promise(resolve => { timer = setTimeout(resolve, 2000); timer.unref?.(); })]);
+  clearTimeout(timer);
+}
+
+/** Removes this user's own comal-qr-* directories in `root` that no scan has touched for a while (a killed process). */
+async function sweepStale(root) {
+  let names = [];
+  try { names = await fsReaddir(root); } catch { return; }
+  const uid = process.getuid?.();
+  for (const name of names) {
+    if (!DIR_SHAPE.test(name)) continue;
+    try {
+      const info = await lstat(path.join(root, name));
+      if (!info.isDirectory() || (uid !== undefined && info.uid !== uid) || Date.now() - info.mtimeMs < STALE_MS) continue;
+      await rm(path.join(root, name), { recursive: true, force: true });
+    } catch {}
+  }
+}
+
+/** Scans for the pairing QR for up to `timeoutMs` in total, finding the camera included. Resolves {code, camera}. */
+export async function scanPairingQr({ camera, env = process.env, timeoutMs = SCAN_TIMEOUT_MS, intervalMs = SCAN_INTERVAL_MS, signal, spawn = nodeSpawn, now = Date.now, sleep, readdir = fsReaddir, tmpRoot = os.tmpdir() } = {}) {
+  if (signal?.aborted) throw aborted();
+  const deadline = now() + timeoutMs, seconds = Math.round(timeoutMs / 1000);
+  const left = limit => { const ms = Math.min(limit, deadline - now()); if (ms <= 0) throw timedOut(seconds); return ms; };
+  const pause = sleep ?? (ms => abortableSleep(ms, signal));
+  // Both tools are checked before the camera turns on.
+  for (const [cmd, args] of [['ffmpeg', ['-hide_banner', '-version']], ['zbarimg', ['--version']]]) await run(spawn, cmd, args, { signal, timeoutMs: left(PROBE_TIMEOUT_MS) });
+  const root = path.resolve(tmpRoot);
+  await sweepStale(root);
+  const dir = await mkdtemp(path.join(root, DIR_PREFIX));
+  let stream = null;
+  const onExit = () => { try { stream?.child?.kill('SIGKILL'); } catch {} try { rmSync(dir, { recursive: true, force: true }); } catch {} };
+  process.once('exit', onExit);
+  try {
+    await chmod(dir, 0o700);
+    const device = await pickCamera({ camera, env, spawn, readdir, signal, deadline, now, seconds });
+    left(1);
+    let attempt = 0, seen = 0;
+    const secondsLeft = () => Math.max(1, Math.ceil((deadline - now()) / 1000));
+    stream = startStream(spawn, streamArgs(device, dir, attempt, secondsLeft()));
+    for (;;) {
+      await pause(Math.max(0, Math.min(intervalMs, deadline - now())));
+      if (signal?.aborted) throw aborted();
+      // Read whether ffmpeg ended BEFORE listing: then every listed frame is complete. While it runs, the newest frame
+      // may still be being written, so only the ones older than it are complete. Of those only the newest is decoded:
+      // older ones are deleted unread, so a slow decode never builds a backlog of stale frames.
+      const ended = stream.exited;
+      const frames = (await fsReaddir(dir)).filter(name => FRAME.test(name)).sort();
+      const complete = ended ? frames : frames.slice(0, -1);
+      if (complete.length) {
+        seen += complete.length;
+        for (const name of complete.slice(0, -1)) await rm(path.join(dir, name), { force: true });
+        const file = path.join(dir, complete.at(-1));
+        let decoded;
+        try { decoded = await run(spawn, 'zbarimg', [...DECODE_ARGS, file], { signal, timeoutMs: Math.max(1, Math.min(PROBE_TIMEOUT_MS, deadline - now())) }); }
+        finally { await rm(file, { force: true }); }
+        const code = decoded.code === 0 ? onlyPairCode(decoded.stdout) : null;
+        if (code) return { code, camera: device };
+      }
+      if (ended && !frames.length) {
+        if (stream.error) throw stream.error.code === 'ENOENT' ? missingTools() : stream.error;
+        // A camera that refuses a format or size is opened again the next way, down to its own default.
+        if (!seen && attempt + 1 < STREAM_ATTEMPTS.length) { attempt += 1; left(1); stream = startStream(spawn, streamArgs(device, dir, attempt, secondsLeft())); continue; }
+        throw failure('QR_SCAN_CAMERA', t('Could not read the camera {camera}: {reason}', { camera: device, reason: oneLine(stream.stderr) }));
+      }
+      if (now() >= deadline) throw timedOut(seconds);
+    }
+  } finally {
+    await stopStream(stream);
+    await rm(dir, { recursive: true, force: true });
+    process.removeListener('exit', onExit);
+  }
+}

package/src/relay/broker.mjs

@@ -9,6 +9,19 @@ import { RELAY_ANSWERS } from '../remote-relay.mjs';
 // intento (otra superficie, un control repetido o viejo) responde already_decided sin mutar.
 // Hace falta en Comal porque relayd admite rechazar un plan ya aprobado y aún no aplicado.
 registerMessages({
+  'Open /rc first, with a Comal backend that supports devices.': 'Abre /rc primero, con un backend de Comal que admita dispositivos.',
+  'Device: {label} ({id}){connected}.': 'Dispositivo: {label} ({id}){connected}.',
+  ', connected {time}': ', conectado {time}',
+  'No device paired.': 'Ningún dispositivo emparejado.',
+  'Device removed; its permission answers are off.': 'Dispositivo quitado; sus respuestas de permisos quedan apagadas.',
+  'Permission answers from the M5Stack: armed until {time}.': 'Respuestas de permisos desde el M5Stack: armadas hasta las {time}.',
+  'Permission answers from the M5Stack: off.': 'Respuestas de permisos desde el M5Stack: apagadas.',
+  'Pair a device first with /rc device CODE.': 'Empareja un dispositivo primero con /rc device CODE.',
+  'The /rc session has expired; open /rc again.': 'La sesión de /rc caducó; abre /rc de nuevo.',
+  'M5Stack permission answers are armed until {time}. Each card\'s command or path goes through comal.milpahq.com to the device and is not stored.': 'Permisos desde el M5Stack activos hasta {time}. El comando o la ruta de cada tarjeta pasa por comal.milpahq.com hacia el aparato y no se guarda.',
+  'Device paired: {label} ({id}).': 'Dispositivo emparejado: {label} ({id}).',
+  'Answered on the M5Stack: {decision} · {tool}': 'Contestada en el M5Stack: {decision} · {tool}',
+  'allowed once': 'permitida una vez', 'denied': 'negada',
   '{what} was decided from the browser ({outcome}).': '{what} se decidió desde el navegador ({outcome}).',
   'Already decided from the browser ({outcome}); nothing was sent.': 'Ya decidida desde el navegador ({outcome}); no se envió nada.',
   'This card is being decided in this terminal right now.': 'Esta tarjeta se está decidiendo ahora mismo en esta terminal.',

package/src/remote-control.mjs

@@ -1,5 +1,8 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { CloudClient } from './cloud-client.mjs';
+import { readFileSync } from 'node:fs';
+import { PERMISSION_ACK_STATES, PERMISSION_OUTCOMES } from './remote-permissions.mjs';
+import { fitStats, STATS_FLOOR_MS, STATS_INTERVAL_MS, STATS_MAX_BYTES } from './remote-stats.mjs';
 
 const digest = value => createHash('sha256').update(JSON.stringify(value)).digest('hex');
 export const remoteInputDigest = (session, request, text) => digest([session,request,text]);
@@ -17,7 +20,8 @@ export function projectRemoteEvent(event, turnId) {
   }
   if(event.type==='tool_result')return {...base,type:'tool.finished',tool_name:boundText(event.name,128),text:event.is_error?'failed':'returned',...(event.tool_use_id?{tool_call_id:boundText(event.tool_use_id,128)}:{}),...(Number.isSafeInteger(event.duration_ms)&&event.duration_ms>=0&&event.duration_ms<=86400000?{duration_ms:event.duration_ms}:{})};
   if(event.type==='house_waiting')return {...base,type:'permission.waiting',tool_name:boundText(event.operation,128),text:'Waiting for approval in the local terminal'};
-  if(event.type==='house_answered')return {...base,type:'permission.answered',tool_name:boundText(event.operation,128),text:event.allowed?'Approved locally':'Declined locally'};
+  // Neutral: the terminal or the paired M5Stack may have answered it.
+  if(event.type==='house_answered')return {...base,type:'permission.answered',tool_name:boundText(event.operation,128),text:event.allowed?'Approved':'Declined'};
   if(event.type==='response_discarded'||event.type==='model_retry')return {...base,type:'stream.discarded'};
   // Avisos de plugins (p. ej. objeción y corrección del revisor de open-relay): se proyectan al
   // admitirse, urgentes o no, para que /rc los vea aunque no despierten un turno. El backend
@@ -42,6 +46,9 @@ export const RELAY_SESSION_EVENTS = 2000, RELAY_SESSION_BYTES = 16 << 20, RELAY_
 // Rechazos del backend que no se arreglan reintentando: se descarta ESE evento relay.* y la
 // proyección sigue (sin esto, un evento rechazado bloquearía la cola entera).
 const RELAY_REFUSALS = new Set(['INPUT_SCHEMA','REMOTE_FEATURE','REMOTE_RELAY','REMOTE_RELAY_STALE','REMOTE_SIZE']);
+// A session.stats is a summary the next one replaces: one the backend will not take (a quota, its size, the feature,
+// its schema) is dropped, never left at the head of the queue holding the conversation behind it.
+const STATS_REFUSALS = new Set(['INPUT_SCHEMA','REMOTE_FEATURE','REMOTE_SIZE','REMOTE_QUOTA','REMOTE_STORAGE_QUOTA']);
 
 // Respuestas de /relay desde el navegador (D1): armadas sólo con /rc relay on en esta terminal,
 // en memoria de este proceso, con caducidad (tope 8 h). Nunca se guardan en disco ni en el
@@ -49,15 +56,117 @@ const RELAY_REFUSALS = new Set(['INPUT_SCHEMA','REMOTE_FEATURE','REMOTE_RELAY','
 export const RELAY_ARM_MAX_MS = 8 * 3600e3, RELAY_ARM_DEFAULT_MS = 30 * 60e3;
 // Estados de ACK de un control relay (el backend sólo los admite para kind=relay).
 const RELAY_ACK_STATES = new Set(['applied','stale','refused','expired']);
+// Tarjetas de permiso para el M5Stack: sólo por el WebSocket del host y mientras el armado está vivo;
+// el relay las reenvía al aparato emparejado y no las guarda, así que se reenvían cada 10 s mientras
+// la pregunta sigue abierta (cubre que el aparato se reconecte) y al instante cuando se conecta.
+export const CARD_RESEND_MS = 10000;
+// After an arm, a kept card goes once the pulse landed and again this long after: past the relay's 2 s arm cache.
+export const CARD_ARM_RECHECK_MS = 2500;
+const CARD_CLOSES_KEPT = 32;
+
+// Código de emparejamiento del M5Stack: Crockford en mayúsculas, XXXX-XXXX. O→0, I/L→1.
+const DEVICE_CODE=/^[0-9A-HJKMNP-TV-Z]{8}$/;
+export function normalizeDeviceCode(code){
+  const clean=String(code??'').toUpperCase().replace(/[\s-]+/g,'').replace(/O/g,'0').replace(/[IL]/g,'1');
+  if(!DEVICE_CODE.test(clean))throw Error('That is not a device code: expected 8 letters or digits (XXXX-XXXX).');
+  return clean.slice(0,4)+'-'+clean.slice(4);
+}
 
 const cancelled = () => Object.assign(new Error('Remote Control connection cancelled.'), {name:'AbortError',code:'REMOTE_CANCELLED'});
 const lifetimeSignal = (run,timeout=10000) => run?.controller ? AbortSignal.any([run.controller.signal,AbortSignal.timeout(timeout)]) : AbortSignal.timeout(timeout);
 
+let quickReplyList=null;
+/** The three fixed replies come from the device contract, read once. */
+function quickReplies(){return quickReplyList??=JSON.parse(readFileSync(new URL('../backend/contracts/remote-device-v1.json',import.meta.url),'utf8')).inputs.quick_reply.properties.text.enum;}
 export class RemoteHost {
-  constructor({client=new CloudClient(),onInput=async()=>{throw Error('Local queue unavailable.');},onStop=async()=>false,onNotice=()=>{},getWorkspace=null,relay=null,onRelay=null,now=Date.now,socketFactory=(url,protocol)=>new WebSocket(url,protocol)}={}) {
-    Object.assign(this,{client,onInput,onStop,onNotice,getWorkspace,relay,onRelay,now,socketFactory});this.answersUntil=0;this.pending=[];this.turnId=null;this.stopped=true;this.transport='disconnected';this.processing=null;this.sending=null;this.lifecycle=null;this.starting=null;
+  constructor({client=new CloudClient(),onInput=async()=>{throw Error('Local queue unavailable.');},onStop=async()=>false,onNotice=()=>{},getWorkspace=null,relay=null,onRelay=null,onDeviceConnected=null,onPermissionsDisarmed=null,onPermission=null,getStats=null,now=Date.now,socketFactory=(url,protocol)=>new WebSocket(url,protocol)}={}) {
+    Object.assign(this,{client,onInput,onStop,onNotice,getWorkspace,relay,onRelay,onDeviceConnected,onPermissionsDisarmed,onPermission,getStats,now,socketFactory});this.cards=new Map();this.cardCloses=[];this.cardsSentAt=0;this.cardsShown=false;this.answersUntil=0;this.permissionUntil=0;this.permissionDevice=null;this.deviceInfo=null;this.pending=[];this.turnId=null;this.stopped=true;this.transport='disconnected';this.processing=null;this.sending=null;this.lifecycle=null;this.starting=null;
+  }
+  status(){const run=this.lifecycle;return this.session?{enabled:!this.stopped,url:this.url,session:this.session.id,transport:this.transport,permissions:'local_terminal_only',relay:run?.relay?(run.answers?'answers':'read_only'):'off',...(run?.answers?{relay_answers:{armed:this.armed(),until:this.armed()?this.answersUntil:null}}:{}),...(run?.device?{device:this.deviceInfo??null,permission_answers:{armed:this.permissionsArmed(),until:this.permissionsArmed()?this.permissionUntil:null}}:{})}:{enabled:false};}
+  deviceAvailable(){return Boolean(this.current(this.lifecycle)&&this.lifecycle.device);}
+  permissionsArmed(){return this.deviceAvailable()&&this.permissionUntil>this.now()&&Boolean(this.deviceInfo)&&this.deviceInfo.id===this.permissionDevice;}
+  /** The arm belongs to the device it was granted for: when that device is gone or another takes its place, it ends and the book hears why. */
+  dropArm(reason){
+    const was=this.permissionUntil>0;
+    this.permissionUntil=0;this.permissionDevice=null;
+    if(!was)return;
+    this.hideCards();
+    if(this.deviceAvailable())this.pulse().catch(()=>{});
+    if(this.onPermissionsDisarmed)try{this.onPermissionsDisarmed(reason);}catch{}
+  }
+  /** Recuerda el dispositivo de la última lectura de remote.state (page.session) o del emparejamiento; gana lo más reciente. */
+  noteSession(session){
+    if(!session||!('device' in session))return false;
+    const before=this.deviceInfo?.connected_at??null;
+    this.deviceInfo=session.device?{id:session.device.id,label:session.device.label,connected_at:session.device.connected_at??null}:null;
+    if(this.permissionUntil>0&&(this.deviceInfo?.id??null)!==this.permissionDevice)this.dropArm(this.deviceInfo?'device_changed':'device_gone');
+    const after=this.deviceInfo?.connected_at??null,changed=after!==null&&after!==before;
+    if(changed&&this.onDeviceConnected)try{this.onDeviceConnected(this.deviceInfo);}catch{}
+    if(changed){this.sendCards();this.publishStats({device:true}).catch(()=>{});}
+    return changed;
+  }
+  async pairDevice(code){
+    const normalized=normalizeDeviceCode(code);
+    if(!this.deviceAvailable())throw Error('Open /rc first, with a Comal backend that supports devices.');
+    const run=this.lifecycle;
+    const result=await this.client.invoke('remote.devices.pair.approve',{remote_session_id:this.session.id,code:normalized},{expectedAccount:this.account,signal:lifetimeSignal(run)});
+    this.assertCurrent(run);
+    this.deviceInfo={id:result.device_id,label:result.label,connected_at:this.deviceInfo?.id===result.device_id?this.deviceInfo.connected_at:null};
+    if(this.permissionUntil>0&&result.device_id!==this.permissionDevice)this.dropArm('device_changed');
+    return {device_id:result.device_id,label:result.label};
+  }
+  async forgetDevice(){
+    if(!this.deviceAvailable())throw Error('Open /rc first, with a Comal backend that supports devices.');
+    const run=this.lifecycle;
+    await this.client.invoke('remote.devices.revoke',{remote_session_id:this.session.id},{expectedAccount:this.account,signal:lifetimeSignal(run)});
+    this.permissionUntil=0;this.permissionDevice=null;this.hideCards();this.deviceInfo=null;this.pulse(run).catch(()=>{});
+  }
+  /** /rc permissions on [duración]: el aparato emparejado puede responder tarjetas hasta now+ms (60 s…8 h, y no más allá de la sesión). */
+  armPermissions(ms=RELAY_ARM_DEFAULT_MS){
+    if(!this.deviceAvailable())throw Error('Open /rc first, with a Comal backend that supports devices.');
+    if(!this.deviceInfo)throw Error('Pair a device first with /rc device CODE.');
+    const now=this.now(),expires=Number(this.session?.expires_at)*1000;
+    if(Number.isFinite(expires)&&expires<=now)throw Error('The /rc session has expired; open /rc again.');
+    let until=now+Math.min(Math.max(60e3,Math.floor(Number(ms)||RELAY_ARM_DEFAULT_MS)),RELAY_ARM_MAX_MS);
+    if(Number.isFinite(expires))until=Math.min(until,expires);
+    this.permissionUntil=until;this.permissionDevice=this.deviceInfo.id;
+    // A kept card goes only once the backend holds the arm (the relay refuses a card it cannot confirm armed), and
+    // again CARD_ARM_RECHECK_MS later, when an arm the relay read before this pulse is no longer fresh enough to use.
+    const run=this.lifecycle;
+    this.pulse(run).catch(()=>{}).then(()=>{if(!this.current(run)||!this.sendCards())return;this.cardsSentAt=this.now()-CARD_RESEND_MS+CARD_ARM_RECHECK_MS;});
+    return until;
+  }
+  /** One frame over the host WebSocket, only when it is the live transport. Never over remote.events.publish. */
+  cardFrame(frame){
+    if(this.transport!=='websocket'||this.socket?.readyState!==1)return false;
+    try{this.socket.send(JSON.stringify({protocol:'comal.remote.v1',...frame}));return true;}catch{return false;}
   }
-  status(){const run=this.lifecycle;return this.session?{enabled:!this.stopped,url:this.url,session:this.session.id,transport:this.transport,permissions:'local_terminal_only',relay:run?.relay?(run.answers?'answers':'read_only'):'off',...(run?.answers?{relay_answers:{armed:this.armed(),until:this.armed()?this.answersUntil:null}}:{})}:{enabled:false};}
+  /** Permission card for the paired device (Task 10's buildDeviceCard). Nothing is kept or sent while not armed. */
+  sendCard(card){
+    if(!card||typeof card.question_id!=='string'||!this.permissionsArmed())return false;
+    this.cards.set(card.question_id,card);return this.sendCards();
+  }
+  sendCards(){
+    if(!this.cards.size||!this.permissionsArmed())return false;
+    let sent=false;for(const card of this.cards.values())sent=this.cardFrame({kind:'card',card})||sent;
+    if(sent){this.cardsSentAt=this.now();this.cardsShown=true;}
+    return sent;
+  }
+  /** The arm ended (off, lapsed, the device gone): the device stops showing cards it can no longer answer.
+   *  They are kept, so a new arm while the question is still open shows them again. */
+  hideCards(){
+    if(!this.cards.size||!this.cardsShown)return;
+    let sent=true;for(const id of this.cards.keys())sent=this.cardFrame({kind:'card.close',question_id:id})&&sent;
+    if(sent)this.cardsShown=false;
+  }
+  /** The question was decided or dropped: the device stops showing it (on the next connection if the socket is down). */
+  closeCard(questionId){
+    const had=this.cards.delete(questionId);
+    if(this.cardFrame({kind:'card.close',question_id:questionId})||!had)return;
+    this.cardCloses.push(questionId);if(this.cardCloses.length>CARD_CLOSES_KEPT)this.cardCloses.shift();
+  }
+  flushCardCloses(){while(this.cardCloses.length&&this.cardFrame({kind:'card.close',question_id:this.cardCloses[0]}))this.cardCloses.shift();}
+  disarmPermissions(){this.permissionUntil=0;this.permissionDevice=null;this.hideCards();if(this.deviceAvailable())this.pulse().catch(()=>{});}
   /** ¿Puede esta sesión de /rc responder tarjetas de /relay? (backend con relay_answers_v1). */
   answersAvailable(){return Boolean(this.current(this.lifecycle)&&this.lifecycle.answers);}
   armed(){return this.answersAvailable()&&this.answersUntil>this.now();}
@@ -87,12 +196,13 @@ export class RemoteHost {
         if(!account)throw Error('Sign in with comal cloud login before enabling Remote Control.');
         run.account={origin:account.origin,user_id:account.user_id};run.enablingToken=account.token;
         const workspace=this.getWorkspace?await this.getWorkspace(session):null;this.assertCurrent(run,{starting:true});
-        const features=['commands_v1','thinking_v1',...(this.getWorkspace?['workspace_v1']:[]),...(this.relay?['relay_v1']:[]),...(this.relay&&this.onRelay?['relay_answers_v1']:[])];
+        const features=['commands_v1','thinking_v1',...(this.getWorkspace?['workspace_v1']:[]),...(this.relay?['relay_v1']:[]),...(this.relay&&this.onRelay?['relay_answers_v1']:[]),'device_v1','stats_v1'];
         const open=list=>this.client.invoke('remote.sessions.open',{local_session_id:session.id,host_id:randomUUID(),label:boundText(session.name || 'Comal',80),features:list},{expectedAccount:run.account,signal:run.controller.signal});
         // Un backend anterior rechaza la capacidad desconocida en el esquema de Milpa (no se crea
         // sesión): se reintenta sin relay_answers_v1 (backend de la fase «ver») y después sin
         // relay_v1 (backend anterior a /relay). /rc se abre igual con lo que el backend admite.
-        const attempts=[features,features.filter(item=>item!=='relay_answers_v1'),features.filter(item=>!item.startsWith('relay_'))].filter((list,index,all)=>index===0||list.length<all[index-1].length);
+        const noDevice=features.filter(item=>item!=='device_v1'&&item!=='stats_v1');
+        const attempts=[features,noDevice,noDevice.filter(item=>item!=='relay_answers_v1'),noDevice.filter(item=>!item.startsWith('relay_'))].filter((list,index,all)=>index===0||list.length<all[index-1].length);
         let opened,used=attempts[0];
         for(const [index,list] of attempts.entries()){
           try{used=list;opened=await open(list);break;}
@@ -101,7 +211,7 @@ export class RemoteHost {
         run.relayRefused=Boolean(this.relay)&&!used.includes('relay_v1');
         run.session=opened.session;
         const granted=feature=>used.includes(feature)&&(!Array.isArray(opened.session?.features)||opened.session.features.includes(feature));
-        run.relay=Boolean(this.relay)&&granted('relay_v1');run.answers=run.relay&&Boolean(this.onRelay)&&granted('relay_answers_v1');this.answersUntil=0;
+        run.relay=Boolean(this.relay)&&granted('relay_v1');run.answers=run.relay&&Boolean(this.onRelay)&&granted('relay_answers_v1');this.answersUntil=0;run.device=granted('device_v1');run.stats=Boolean(this.getStats)&&granted('stats_v1');this.permissionUntil=0;this.permissionDevice=null;this.deviceInfo=null;
         // Abort can race a successful response. Revoke a late-created grant even
         // when the local stop completed before its identifier became available.
         if(!this.current(run,{starting:true})){await this.revoke(run);throw cancelled();}
@@ -109,6 +219,7 @@ export class RemoteHost {
         await this.authorize(run);this.assertCurrent(run);await this.pulse(run);this.assertCurrent(run);
         this.transport='https-polling';this.connectSocket(run);
         if(workspace)this.publishWorkspace(workspace,run);
+        this.publishStats({},run).catch(()=>{});
         if(run.relay){run.relaySink={extended:run.answers,relayBoard:(board,options)=>this.relayBoard(board,options,run),relayEvent:(type,relay)=>this.relayEvent(type,relay,run)};this.relay.attach(run.relaySink);}
         this.timer=setInterval(()=>this.tick(run),1000);this.timer.unref();
         for(const message of (session.historyMessages || []).slice(-20)){
@@ -151,7 +262,7 @@ export class RemoteHost {
       const ws=this.socket=this.socketFactory(url.href,'comal.remote.v1');
       const timeout=this.socketTimeout=setTimeout(()=>ws.close(),10000);timeout.unref();
       ws.addEventListener('open',()=>{if(!this.current(run)||this.socket!==ws){ws.close();return;}ws.send(JSON.stringify({protocol:'comal.remote.v1',kind:'auth',ticket:ticket.ticket,after:'0'}));});
-      ws.addEventListener('message',event=>{if(!this.current(run)||this.socket!==ws)return;try{const m=JSON.parse(event.data);if(m.kind==='ready'){clearTimeout(timeout);this.transport='websocket';}}catch{ws.close();}});
+      ws.addEventListener('message',event=>{if(!this.current(run)||this.socket!==ws)return;try{const m=JSON.parse(event.data);if(m.kind==='ready'){clearTimeout(timeout);this.transport='websocket';this.flushCardCloses();this.sendCards();}else if(m.kind==='state'&&run.device)this.noteSession(m.session);}catch{ws.close();}});
       ws.addEventListener('error',()=>{});
       ws.addEventListener('close',()=>{clearTimeout(timeout);if(this.current(run)&&this.socket===ws){this.socket=null;this.transport='https-polling';}});
     }catch{/* HTTPS is already active. A later tick retries WSS. */}
@@ -165,6 +276,38 @@ export class RemoteHost {
     this.pending.push({event_id:randomUUID(),event:{type:'workspace.snapshot',text:'',turn_id:this.turnId||'local',workspace}});
     run.workspaceDigest=key;this.flush(run).catch(()=>{});
   }
+  /** session.stats (stats_v1). A change: at most once per 5 s. `force` (turn end): skips the 5 s but
+   *  not the unchanged check. `device` (a device connected): publishes even unchanged, since it has
+   *  not seen them. Never two publishes within 1 s: a request inside the gap waits for one timer,
+   *  which carries the strongest reason asked for. Never oversize; a getStats that fails or gives null publishes nothing. */
+  publishStats({force=false,device=false}={},run=this.lifecycle){
+    if(!this.current(run)||!run.stats||!this.getStats)return Promise.resolve(false);
+    const step=(run.statsChain||Promise.resolve()).then(()=>this.publishStatsNow({force:force||device,device},run)).catch(()=>false);
+    run.statsChain=step;return step;
+  }
+  async publishStatsNow({force,device},run){
+    if(!this.current(run))return false;
+    const now=this.now(),wait=run.statsAt?run.statsAt+(force?STATS_FLOOR_MS:STATS_INTERVAL_MS)-now:0;
+    if(wait>0){
+      const asked=run.statsAsked||{force:false,device:false};run.statsAsked={force:asked.force||force,device:asked.device||device};
+      if(!run.statsTimer||now+wait<run.statsTimerAt){
+        clearTimeout(run.statsTimer);run.statsTimerAt=now+wait;
+        run.statsTimer=setTimeout(()=>{const again=run.statsAsked||{};run.statsAsked=null;run.statsTimer=null;this.publishStats(again,run).catch(()=>{});},wait);run.statsTimer.unref?.();
+      }
+      return false;
+    }
+    const stats=fitStats(await this.getStats());
+    if(!this.current(run)||!stats)return false;
+    const key=JSON.stringify(stats);
+    if(Buffer.byteLength(key)>STATS_MAX_BYTES||(!device&&key===run.statsKey))return false;
+    const entry={event_id:randomUUID(),event:{type:'session.stats',text:'',turn_id:this.turnId||'local',stats}};
+    // The last summary wins in the buffer: an unsent one is replaced, never stacked.
+    const index=this.pending.findIndex((item,position)=>item.event.type==='session.stats'&&(position>0||!this.sending));
+    if(index>=0)this.pending[index]=entry;
+    else{if(this.pending.length>=512)return false;this.pending.push(entry);}
+    run.statsKey=key;run.statsAt=this.now();clearTimeout(run.statsTimer);run.statsTimer=null;run.statsAsked=null;
+    this.flush(run).catch(()=>{});return true;
+  }
   /** Tablero de /swarm: coalescido (≥ 3 s), sin repetir huella y «el último gana» en el búfer. */
   relayBoard(board,{now=false}={},run=this.lifecycle) {
     if(!this.current(run)||!run.relay)return;
@@ -217,6 +360,7 @@ export class RemoteHost {
     if(this.stopped)return;
     if(['tool_result','house_waiting','house_answered','result'].includes(event.type))this.invalidateWorkspace();
     const append=projected=>this.pending.push({event_id:randomUUID(),event:projected});
+    if(['result','context_projection','usage_accounting'].includes(event.type))this.publishStats().catch(()=>{});
     if(event.type==='model_stream_progress'&&event.reasoning_chars>0&&!this.thinkingActive){
       this.thinkingActive=true;append({type:'thinking.started',turn_id:this.turnId||'local',text:'Thinking…'});this.flush().catch(()=>{});return;
     }
@@ -247,16 +391,21 @@ export class RemoteHost {
     const work=(async()=>{while(this.current(run)&&this.pending.length){
       const item=this.pending[0];
       try{await this.call('remote.events.publish',item,run);}
-      catch(error){if(!this.current(run)||!String(item.event?.type).startsWith('relay.')||!RELAY_REFUSALS.has(error.code))throw error;this.onNotice('Remote /relay event refused by the backend ('+error.code+'); /relay and /swarm in this terminal are unaffected.');}
+      catch(error){
+        if(!this.current(run))throw error;
+        if(item.event?.type==='session.stats'&&STATS_REFUSALS.has(error.code)){/* dropped: the next summary replaces it */}
+        else if(String(item.event?.type).startsWith('relay.')&&RELAY_REFUSALS.has(error.code))this.onNotice('Remote /relay event refused by the backend ('+error.code+'); /relay and /swarm in this terminal are unaffected.');
+        else throw error;
+      }
       this.assertCurrent(run);if(this.pending[0]===item)this.pending.shift();else{const index=this.pending.indexOf(item);if(index>=0)this.pending.splice(index,1);}
     }})();
     this.sending=work;try{return await work;}finally{if(this.sending===work)this.sending=null;}
   }
-  pulse(run=this.lifecycle){const work=(this.pulsing || Promise.resolve()).catch(()=>{}).then(()=>{if(!this.current(run))return;const armed=run.answers&&this.answersUntil>this.now();return this.call('remote.host.pulse',{status:this.turnId?'busy':'idle',turn_id:this.turnId,...(run.answers?{relay_answers:{armed,until:armed?Math.floor(this.answersUntil/1000):0}}:{})},run);});this.pulsing=work;return work;}
+  pulse(run=this.lifecycle){const work=(this.pulsing || Promise.resolve()).catch(()=>{}).then(()=>{if(!this.current(run))return;const armed=run.answers&&this.answersUntil>this.now(),permitted=Boolean(run.device)&&this.permissionUntil>this.now();return this.call('remote.host.pulse',{status:this.turnId?'busy':'idle',turn_id:this.turnId,...(run.answers?{relay_answers:{armed,until:armed?Math.floor(this.answersUntil/1000):0}}:{}),...(run.device?{permission_answers:{armed:permitted,until:permitted?Math.floor(this.permissionUntil/1000):0}}:{})},run);});this.pulsing=work;return work;}
   async beginTurn(){this.turnId=randomUUID();if(!this.stopped)this.pulse().catch(error=>{if(error.code!=='REMOTE_CANCELLED')this.onNotice('Remote state unavailable: '+error.message);});}
   async endTurn(){
     this.invalidateWorkspace();
-    if(!this.stopped){this.pending.push({event_id:randomUUID(),event:{type:'turn.settled',text:'Local turn settled.',turn_id:this.turnId || 'local'}});this.flush().catch(()=>{});}
+    if(!this.stopped){this.pending.push({event_id:randomUUID(),event:{type:'turn.settled',text:'Local turn settled.',turn_id:this.turnId || 'local'}});this.flush().catch(()=>{});this.publishStats({force:true}).catch(()=>{});}
     clearTimeout(this.deltaTimer);this.deltaTimer=null;this.delta='';this.thinkingActive=false;this.turnId=null;this.pulse().catch(()=>{});
   }
   async validate(item){
@@ -266,6 +415,7 @@ export class RemoteHost {
     await this.call('remote.inputs.validate',{request_id:item.remote.request},run);this.assertCurrent(run);return true;
   }
   async tick(run=this.lifecycle){
+    if(this.current(run)&&this.cards.size){if(!this.permissionsArmed())this.hideCards();else if(this.now()-this.cardsSentAt>=CARD_RESEND_MS)this.sendCards();}
     if(!this.current(run)||this.processing)return this.processing;
     const work=(async()=>{
       await this.pulse(run);this.assertCurrent(run);await this.flush(run);this.assertCurrent(run);
@@ -274,11 +424,17 @@ export class RemoteHost {
         this.assertCurrent(run);let state='accepted_locally',queue_item_id='',outcome=null;
         // Only admission errors are rejection. A lost ACK must redeliver the same input.
         if(input.kind==='relay'){({state,outcome}=await this.relayAnswer(input,run));}
+        else if(input.kind==='permission.answer'){({state,outcome}=await this.permissionAnswer(input,run));}
         else try {
           if(input.kind==='stop'){if(input.turn_id!==this.turnId||!await this.onStop(input.turn_id))throw Error('Stale turn.');queue_item_id='stop:'+input.turn_id;}
+          else if(input.kind==='quick.reply'){const text=input.control?.text;if(typeof text!=='string'||!quickReplies().includes(text))throw Error('Unknown quick reply.');const accepted=await this.onInput({...input,text},{session:this.session.id,request:input.request_id});queue_item_id=accepted.id;}
           else {const accepted=await this.onInput(input,{session:this.session.id,request:input.request_id});queue_item_id=accepted.id;}
         }catch{state='rejected';}
-        this.assertCurrent(run);await this.call('remote.inputs.ack',{request_id:input.request_id,state,queue_item_id,...(outcome?{outcome}:{})},run);
+        this.assertCurrent(run);
+        try{await this.call('remote.inputs.ack',{request_id:input.request_id,state,queue_item_id,...(outcome?{outcome}:{})},run);}
+        // The backend already settled this device input (expired or its device gone after the claim):
+        // it is not retried nor applied again; the local book row stays the record of what was decided here.
+        catch(error){if(input.kind!=='permission.answer'||error?.code!=='REMOTE_CONFLICT')throw error;}
       }
       if(!this.socket&&Date.now()>this.nextSocketAt)this.connectSocket(run);
     })().catch(error=>{
@@ -298,10 +454,19 @@ export class RemoteHost {
       return {state,outcome:/^[a-z_]{1,64}$/.test(String(result?.outcome||''))?result.outcome:'host_error'};
     }catch(error){if(!this.current(run))throw error;return {state:'refused',outcome:'host_error'};}
   }
+  /** Answer to a permission card from the paired M5Stack (kind=permission.answer). Never enters the model's
+   *  queue: the PermissionDesk checks it again (arm, expiry, device, pending question, digest) and decides. */
+  async permissionAnswer(input,run=this.lifecycle){
+    if(!run?.device||!this.onPermission)return {state:'refused',outcome:'disarmed'};
+    try{
+      const result=await this.onPermission(input,{deviceId:this.permissionsArmed()?this.permissionDevice:null,armed:()=>this.permissionsArmed()});
+      return {state:PERMISSION_ACK_STATES.has(result?.state)?result.state:'refused',outcome:PERMISSION_OUTCOMES.has(result?.outcome)?result.outcome:'stale'};
+    }catch(error){if(!this.current(run))throw error;return {state:'refused',outcome:'stale'};}
+  }
   async stop(){
     const run=this.lifecycle || {session:this.session,account:this.account,enablingToken:this.enablingToken};
-    this.lifecycle=null;this.starting=null;run.controller?.abort();clearTimeout(run.workspaceTimer);clearTimeout(run.boardTimer);if(run.relaySink)this.relay?.detach(run.relaySink);
-    this.stopped=true;this.answersUntil=0;clearInterval(this.timer);clearTimeout(this.deltaTimer);clearTimeout(this.socketTimeout);this.socket?.close();this.socket=null;this.delta='';this.transport='disconnected';
+    this.lifecycle=null;this.starting=null;run.controller?.abort();clearTimeout(run.workspaceTimer);clearTimeout(run.boardTimer);clearTimeout(run.statsTimer);if(run.relaySink)this.relay?.detach(run.relaySink);
+    this.stopped=true;this.answersUntil=0;this.permissionUntil=0;this.permissionDevice=null;this.cards.clear();this.cardCloses=[];this.cardsSentAt=0;this.cardsShown=false;clearInterval(this.timer);clearTimeout(this.deltaTimer);clearTimeout(this.socketTimeout);this.socket?.close();this.socket=null;this.delta='';this.transport='disconnected';
     this.access=null;this.enablingToken=null;this.pending=[];this.turnId=null;this.processing=null;this.sending=null;this.pulsing=null;this.connecting=null;
     await this.revoke(run);return this.status();
   }