@mmmbuto/nexuscrew 0.9.63 → 0.9.65

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to NexusCrew are tracked here.
 
+## 0.9.65 — 2026-10-09
+
+- **Notifications from a remote node can be cleared locally, one voice or all at once.** Every imported notice offers the same close action asks already have: one request dismisses a single notice or the whole visible set of an owner. The dismissal travels to the owner over the authorized routes and is judged by the origin's view; the owner records it and publishes one `notify-closed` closure per cleared notice, so every receiver empties, including the ones that were not part of the clear. When the owner cannot take it — unreachable, or without the notices surface — the request still succeeds: the node records the intent durably, as pending with a bounded retry or as blocked until the pairing changes, and the record, not the browser, is what keeps the card down. A reload or a restart of the receiving node does not bring a cleared notice back, and once the owner takes the dismissed intent he stops serving those notices himself. "Clear" means the whole visible set of that owner on this node: every notice currently shown for him, cleared in one request inside the owner's per-request budget.
+- **A dismissal queue that cannot persist says so.** The queue still honours a cleared notice in memory when the disk refuses the write, but the operator's answer no longer looks like the durable success: queued answers (the single dismiss and the pending/blocked outcomes of clear-all) carry `durable: false` and a `degraded` reason (`queue-write-failed`, `queue-oversize`, `queue-read-failed`, `queue-schema`) when the queue cannot be written or read. The loss is real and now visible: after a restart the cleared card can come back, and the answer warns about it before that happens. A healthy write clears the flag again, and the answer returns to its normal shape.
+- **A queue file that cannot be read is never overwritten with a partial list.** When the queue file is unreadable, foreign or oversize at the first read, the node retries the read before any write, merges what the disk holds with the dismissals accepted in the meantime, and replays them in order on top of the disk. The queue keeps its bounds (200 records, 64 KiB, 15 minutes): when it is full the oldest records leave, never the dismissal just accepted. While the disk stays unreadable the answers keep declaring `durable: false` and the reason.
+- **A missed closure heals at the next read.** A browser that misses a notice's live closure frame kept the card on screen even after a fresh, complete feed-state read no longer listed the notice. For every owner whose view is fresh and authoritative, the notice panel now reconciles against that read: what the owner no longer serves goes, and a card that arrived while the read was in flight stays. Stale, incomplete or resync-flagged views keep their cards as before.
+- **An owner with a full window is no longer refused as incomplete.** A snapshot page cut exactly at its cap (50 notifications, 100 asks) was marked as incomplete on every full page, so a receiving node refused the snapshot of an owner with a full window, imported nothing and never opened the stream. The marker now means that the source had more entries than the page holds; a page exactly at the cap is whole and accepted, and a page over the cap or flagged for resync is still refused.
+
+## 0.9.64 — 2026-10-07
+
+- **The active quick list hides stopped cells.** The active mode keeps only live cells and active degraded rows, regardless of each node's saved all or pinned preference; ordering and pins remain intact.
+- **Live has its own directory identity.** A persisted thread registry exposes a reserved Live entry, verifies message labels against the current thread, and removes entries only when the matching thread is gone. The interface shows a Live badge while a thread exists.
+- **Public source and packages use neutral examples.** The README no longer includes screenshots, internal work references have been removed from public files, and source and package checks enforce the publication boundary.
+
 ## 0.9.63 — 2026-10-07
 
 - **Sidebar node names keep their own row.** The mode filter sits below the node name and aligns to the right, leaving the name readable without changing the node controls.

package/README.md

@@ -19,10 +19,6 @@ stay yours, and your infrastructure stays under your control.
 > in what order, and what not to do. Every other NexusCrew skill assumes it,
 > and this README alone does not replace it.
 
-<p align="center">
-  <img src="docs/img/fleet-deck-desktop.png" width="960" alt="NexusCrew desktop deck with multiple live tmux sessions">
-</p>
-
 ## One control plane. Every screen.
 
 The desktop deck keeps the whole fleet visible. Open any cell from a phone and
@@ -39,12 +35,6 @@ routed Fleet state while open, keeps a degraded cell visible as a warning, and
 has an explicit all-cells view when you need the complete inventory instead of
 a quick switch.
 
-<p align="center">
-  <img src="docs/img/session-mobile.png" width="360" alt="NexusCrew mobile terminal connected to a real tmux session with touch controls">
-  <br>
-  <sub><strong>Real tmux on mobile.</strong> Terminal keys, dictation and file handoff stay within reach.</sub>
-</p>
-
 ## Install in 30 seconds
 
 Install the package globally:
@@ -117,20 +107,18 @@ session ownership to tmux.
 
 ### Pair only devices you own
 
-**A paired node is trusted as you are.** Pairing today grants a node the same
-authority over this machine that you have: it can create sessions, attach to
+**A paired admin node is trusted as you are.** The `admin` access preset grants
+a node the same authority over this machine that you have: it can create sessions, attach to
 them and type into them as the user running NexusCrew, define engines and cells,
-and read what the fleet exposes. There is no lesser class of peer yet.
+and read what the fleet exposes. The `user` and `nexushost` access presets grant
+less authority.
 
 Pair your own devices, and only those. Do not accept a pairing invite from
-someone else's installation, and do not hand one out expecting it to grant less
-than everything.
-
-This is a property of the current design, not an oversight: NexusCrew was built
-to put one person's machines on one control plane. Supporting a node that
-belongs to somebody else needs per-node authority that can be granted and
-revoked — a capability model, not a setting. It is on the roadmap and it is not
-here yet.
+someone else's installation. Choose the access preset deliberately: `admin`
+grants owner-equivalent authority; `user` and `nexushost` grant less.
+
+Federated ASK creation and closure are delivered only to configured `admin`
+peers, hop by hop: each hub applies this rule to its own next peer.
 
 Remote access is intentionally carried through SSH or a VPN you control:
 

package/docs/NOTIFICATIONS.md

@@ -119,6 +119,40 @@ browser, keeps the app fully usable, and never changes the other side's push
 setup. Turning it back on requires the same button, so a device that was asked
 to stay silent does not re-subscribe itself.
 
+## Clearing imported notifications
+
+An imported notice can be closed like a local one, for a single notice or for
+the whole visible set of one owner with a single request. The closure is not a
+browser-side hide; the protocol keeps every view of that owner honest:
+
+- **The owner records it.** The dismissal travels the authorized routes to the
+  owner, is judged by the origin's view, and is answered by one `notify-closed`
+  closure frame per cleared notice. Closures enter the owner's feed history, so
+  a receiver that was offline recovers them from the backlog; the receiving
+  side never turns a closure into a card.
+- **Every receiver empties.** Once the owner has recorded the dismissal he
+  stops serving those notices, so no node that holds a view of him keeps
+  showing them, whether it was live during the clear or reloads afterwards.
+- **The intent survives when the owner cannot take it.** If the owner is
+  unreachable the clear still succeeds: the node records the intent durably
+  (a bounded local queue, retries with backoff, one delivery attempt per owner
+  at a time) and hands it over when the owner is back. If the owner has no
+  notices surface at all the record stays blocked until the pairing changes.
+  In both cases the record — not the browser — is what keeps the card down: a
+  reload or a restart of the node does not bring it back. If the queue cannot
+  write (disk refusal), the intent is still honoured in memory but it cannot
+  survive a restart: the answer declares it with `durable: false` and the
+  degradation reason, instead of looking like the durable success.
+- **A browser that misses a closure heals at the next read.** The closure
+  frame travels live; a browser that never received it (offline, tab asleep)
+  catches up at the next fresh feed-state read, which reconciles the panel
+  with what the owner still serves. Views that are stale, incomplete or
+  flagged for resync never reconcile, so a degraded feed cannot silently
+  empty the panel.
+- **"Clear" is the whole visible set of that owner.** It closes every notice
+  currently shown for him on this node, in one request inside the owner's
+  per-request budget — never one request per card.
+
 ## Platform notes
 
 | Platform | Expected behavior |

package/docs/SECURITY.md

@@ -86,9 +86,9 @@ their path is inserted into the terminal without automatically pressing Enter.
 
 ## Pairing and sharing
 
-**Pairing grants owner-equivalent authority. Pair only devices you own.**
+**A paired admin node is trusted as you are. Pair only devices you own.**
 
-A paired node can create tmux sessions — including a shell — attach to them over
+A node with the `admin` access preset can create tmux sessions — including a shell — attach to them over
 the federated WebSocket and write into them as the user running NexusCrew. It
 can define engines and cells, and a custom engine may name an existing
 executable with arguments of its choosing: the trust gate checks the binary's
@@ -98,9 +98,14 @@ Admission is the exception. Minting a pairing invite is not federated: an invite
 belongs to the installation that will host the new node, so it is issued there,
 locally. A paired node cannot admit a third party on your behalf.
 
-This is a deliberate boundary, not a defect list. NexusCrew was designed to put
-one person's machines on one control plane, and it treats a paired node the way
-it treats you.
+The `user` preset grants event and file-read access, without administrative
+operations or ASK replies. The `nexushost` preset grants no cell visibility or
+those access rights. Choose the preset on the installation that owns the
+resources. An `admin` peer is trusted as you are; the other presets grant less.
+
+Federated ASK creation and closure go only to configured `admin` peers, hop by
+hop. Each hub checks its own next peer before forwarding. This rule does not
+change generic notifications or the relay of ASK replies.
 
 ### Cell scope
 
@@ -123,13 +128,9 @@ be able to create the cell it was not granted. The terminal attach is gated
 with the same predicate, and a tmux session that maps to no cell is outside
 every scope.
 
-What the scope does **not** change: the pairing itself is still
-owner-equivalent for everything it governs, and the granted cells are granted
-fully — inside its scope a node still creates sessions, attaches to them and
-writes into them as the user running NexusCrew. It attenuates reach, not the
-authority held within that reach. A capability model with proof of possession —
-authority granted, attenuated and revoked as a token rather than as
-configuration — remains on the roadmap and is not implemented.
+Cell scope limits the cells a peer can reach; the access preset also limits
+what it can do. Neither is a sandbox for an executable launched with
+administrative authority.
 
 So: do not accept a pairing invite from an installation you do not own, and do
 not treat a cell scope as a sandbox for code you do not trust. It is a