@mmmbuto/nexuscrew 0.9.29 → 0.9.31

package/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 All notable changes to NexusCrew are tracked here.
 
+## Unreleased
+
+- **Custom engines now list their declared models in the pickers.** A custom profile has no builtin catalog, so the model lists stayed empty even when models were declared for the engine; the engine list now joins the profile catalog with the declared models (for `pi` custom engines the pinned model stays first in the list).
+
+## 0.9.31 — 2026-09-18
+
+- **Deck layout edits survive with several windows open.** A save now rebases and retries instead of failing: the layout is merged per window, an in-flight save is awaited before the next one, a drag that ends with the pointer still down flushes its size, and a rejected save says so in the log instead of losing the change silently.
+- **A model in use is refused by the engine that declares it.** Removing a model now compares against the declaring engine's keys, so an unrelated engine sharing the name no longer blocks the removal — and the rejection names the limit it hit.
+- **The doctor separates the two tmux preload outcomes.** A missing `LD_PRELOAD` support and a tmux server that is not running are reported as different causes, each with its own remedy.
+- **Up to 128 declared models in the fleet catalog (was 64)**; the ceiling is named in the rejection instead of a silent stop.
+
+## 0.9.30 — 2026-09-16
+
+- Internal work references removed from the published package (enforced by the npm payload gate).
+- **Paired nodes exchange a federated event feed.** A subscriber opens a snapshot and then a stream per owner, attributed to the node that emitted it: an imported event is re-emitted locally only, so it can never travel back, and what a peer may see follows its granted access instead of what it asks for.
+- **A question from another node is answered through a durable receipt.** The receipt is written before the paste, so a crash leaves an uncertain attempt that the operator reconciles explicitly instead of a blind retry: the same request replays the stored outcome, a decision is bound to the generation of the outcomes it was taken on, and a terminal outcome refuses any further paste on every path.
+- **Imported notifications ring on the phone, once per event.** A relay with its own queue and alert budget sends the OS alert, keeps a durable per-owner registry so a replay of an already-recorded event or a restart does not ring again within the registry limits (4096 ids over 24 hours); senders remain best-effort, so a single alert per phone is not universally guaranteed (provider dedup and distinct PWA origins are out of contract), and the relay can be turned off per browser.
+- **An imported alert opens the question it came from.** The ask correlation travels from its creation to the alert payload, so the notification lands on that question instead of the owner's page alone.
+- **An imported file delivery stays inside its cell's alert budget.** The file notice keeps the cell it belongs to on the way in, and it is the same class of alert as a local one.
+
 ## 0.9.29 — 2026-09-15
 
 - **The Live host of a node is chosen with an explicit command.** `Use as Live host` and `Remove Live host` sit in the cell menu and in the cell selector: the star is a pin only, and a small indicator shows the current host, so the choice and its outcome stay in sight.

package/docs/LIVE_PROMPT.md

@@ -93,7 +93,7 @@ the pattern to extend if this contract ever changes:
 - `'NATIVA con cella OCCUPATA...'` — the ordinary case, file found and
   applied, identity header followed by the prompt text.
 - `'BUG prefisso: un device con prefisso diverso da cloud- deve trovare
-  comunque il prompt'` — a device whose sessions are named `macair-*`: the
+  comunque il prompt'` — a device whose sessions are named `labhost-*`: the
   file is written under that exact session name, not under `cloud-`, and the
   bridge is expected to find it there. This is the test that would have
   caught the original bug — it fails against the pre-fix bridge and passes

package/docs/NOTIFICATIONS.md

@@ -82,6 +82,43 @@ announces notifications.
 Only new live notification frames are spoken. Persisted questions and previous
 events are not replayed.
 
+## Imported events and one-browser alerts
+
+Events imported from a federated owner ring the operating system too, so a
+closed PWA still shows them. Three rules keep that trustworthy:
+
+- **One alert per event.** An event already alerted never rings twice, not after
+  a replay, not after the service worker is restarted: the identity is the
+  `(owner, eventId)` pair and it is written before the send. A re-import of a
+  known event, a state refresh or an ask closure updates the UI silently.
+- **A local link only.** The notification link is always a path inside this app;
+  an absolute or foreign URL in a payload is dropped and the app root is opened
+  instead. The full text stays in the card — the system alert carries a short
+  preview.
+- **A separate budget.** Imported alerts have their own queue and their own
+  per-minute allowance, apart from local notifications. A noisy or misbehaving
+  owner is dropped and counted; it cannot delay local alerts, and a failed
+  delivery never retries the live stream that already accepted the event.
+
+An alert names the ask it belongs to only when the source event carries one:
+an imported notification does not, because the ask itself arrives as its own
+event and that event deliberately stays silent. That notification therefore
+opens the owner's feed, without an `ask=` component.
+
+### Two PWAs on the same phone
+
+One phone can hold two installed PWAs (for example this node and an owner's).
+Each browser keeps its own subscription, so both can receive alerts. If you want
+the operating system to stay quiet for one of them:
+
+1. Open **Settings → Notifications** in that PWA.
+2. Choose **silence on this browser**.
+
+This is a browser-local choice, stored on the device only: it unsubscribes that
+browser, keeps the app fully usable, and never changes the other side's push
+setup. Turning it back on requires the same button, so a device that was asked
+to stay silent does not re-subscribe itself.
+
 ## Platform notes
 
 | Platform | Expected behavior |