@monster-orange/den 0.1.0 → 0.2.0

package/src/shared/agent-actor.ts

@@ -0,0 +1,77 @@
+/**
+ * Who asked: the headers the MCP server (`<cli> mcp`) sends with every web
+ * API call, so the server can record an action as an agent's. The client
+ * name and version are what the MCP client reported about itself at
+ * initialize: a label for the audit trail, never used for authorization.
+ */
+import type { IncomingHttpHeaders } from "http";
+
+export const AUDIT_HEADERS = {
+  actor: "x-den-actor",
+  client: "x-den-mcp-client",
+  clientVersion: "x-den-mcp-client-version",
+  pid: "x-den-mcp-pid",
+  session: "x-den-mcp-session",
+} as const;
+
+export interface AgentInfo {
+  /** The MCP client's self-reported name (clientInfo.name). */
+  client: string;
+  /** The MCP client's self-reported version (clientInfo.version). */
+  clientVersion: string;
+  /** The MCP server process's pid. */
+  mcpPid: number | null;
+  /** The MCP server's session id (one per `<cli> mcp` process). */
+  session: string;
+}
+
+export interface AgentActor extends AgentInfo {
+  kind: "agent";
+}
+
+/** null: a person in the web UI (no agent headers). */
+export type Actor = AgentActor | null;
+
+/** Printable, single-line, bounded: these values land in log lines. */
+function clean(v: unknown, max = 64): string {
+  const s = Array.isArray(v) ? v[0] : v;
+  return String(s ?? "")
+    .replace(/[^\x20-\x7e]/g, "")
+    .trim()
+    .slice(0, max);
+}
+
+/** The headers the MCP client sends (see AUDIT_HEADERS). */
+export function agentAuditHeaders(info: AgentInfo): Record<string, string> {
+  return {
+    [AUDIT_HEADERS.actor]: "agent",
+    [AUDIT_HEADERS.client]: clean(info.client) || "unknown",
+    [AUDIT_HEADERS.clientVersion]: clean(info.clientVersion) || "unknown",
+    [AUDIT_HEADERS.pid]: info.mcpPid === null ? "" : String(info.mcpPid),
+    [AUDIT_HEADERS.session]: clean(info.session).replace(/[^A-Za-z0-9-]/g, ""),
+  };
+}
+
+/** The actor an incoming request names, or null for a person in the UI. */
+export function actorFromHeaders(
+  headers: IncomingHttpHeaders | Record<string, string | undefined>,
+): Actor {
+  const h = headers as Record<string, string | string[] | undefined>;
+  if (clean(h[AUDIT_HEADERS.actor]) !== "agent") return null;
+  const pid = clean(h[AUDIT_HEADERS.pid], 10);
+  return {
+    kind: "agent",
+    client: clean(h[AUDIT_HEADERS.client]) || "unknown",
+    clientVersion: clean(h[AUDIT_HEADERS.clientVersion], 32) || "unknown",
+    mcpPid: /^\d+$/.test(pid) ? Number(pid) : null,
+    session: clean(h[AUDIT_HEADERS.session]).replace(/[^A-Za-z0-9-]/g, ""),
+  };
+}
+
+/** "agent <client> <version> (mcp pid <pid>, session <id>)". */
+export function actorLabel(actor: AgentActor): string {
+  return (
+    `agent ${actor.client} ${actor.clientVersion} ` +
+    `(mcp pid ${actor.mcpPid ?? "?"}, session ${actor.session || "?"})`
+  );
+}

package/src/shared/den-config.ts

@@ -178,6 +178,12 @@ export interface DenConfig {
   secrets?: SecretsConfig;
   /** Environments enabled for this deployment. */
   environments: Environment[];
+  /**
+   * The environments that count as production (default: prod, production).
+   * Production is an attribute of an env, never a name check: Den refuses to
+   * start, stop, scan or exec a remote service whose target env is listed.
+   */
+  production_envs?: string[];
   /**
    * Root directory for local repo discovery, relative to the den directory.
    * Defaults to ".." (the parent of den), which covers the common layout where
@@ -227,6 +233,11 @@ export interface DenConfig {
   env_health_urls?: Record<string, string>;
   /** Security pillar (OWASP ZAP) policy — see readSecurityOwnedHosts. */
   security?: SecurityConfig;
+  /**
+   * The MCP server (`<cli> mcp`). Without this block agents get read tools
+   * only; `actions` opts in to named actions. See readMcpConfig.
+   */
+  mcp?: McpConfig;
   /**
    * Shared test accounts (email + secrets-backend item per role) the test
    * pillars log in as — see src/shared/auth/test-accounts.ts.
@@ -299,6 +310,16 @@ export interface UserConfig {
    * local and never get committed. Merged field-wise over the team base.
    */
   release?: Partial<ReleaseConfig>;
+  /**
+   * Graph layout preferences (direction, grouping, card density, panel
+   * width), set from the Local Dev graph. See src/ui/server/graph-prefs.ts.
+   */
+  graph?: {
+    direction?: string;
+    group?: string;
+    density?: string;
+    panelWidth?: number;
+  };
 }
 
 const ALL_ENVIRONMENTS: Environment[] = [
@@ -311,6 +332,11 @@ const ALL_ENVIRONMENTS: Environment[] = [
   "production",
 ];
 
+/** Den's built-in environment names (used when the org config lists none). */
+export function builtinEnvironments(): Environment[] {
+  return [...ALL_ENVIRONMENTS];
+}
+
 const DEFAULT_CONFIG: DenConfig = {
   environments: ALL_ENVIRONMENTS,
 };
@@ -388,6 +414,7 @@ export function readDenConfig(): DenConfig {
       environments: envs.filter((e): e is Environment =>
         ALL_ENVIRONMENTS.includes(e as Environment),
       ),
+      production_envs: parsed?.production_envs,
       repos_root: parsed?.repos_root,
       github_org: parsed?.github_org,
       orgs: parsed?.orgs,
@@ -398,6 +425,7 @@ export function readDenConfig(): DenConfig {
       service_env: parsed?.service_env,
       env_health_urls: parsed?.env_health_urls,
       security: parsed?.security,
+      mcp: parsed?.mcp,
       test_accounts: parsed?.test_accounts,
       defaults: parsed?.defaults,
       secrets: parsed?.secrets,
@@ -428,6 +456,39 @@ export function getReposRoot(): string {
   return path.resolve(ROOT, config.repos_root ?? "..");
 }
 
+const DEFAULT_PRODUCTION_ENVS = ["prod", "production"];
+
+/** The envs the org counts as production (`production_envs`). */
+export function productionEnvs(config: DenConfig = readDenConfig()): string[] {
+  const listed = config.production_envs;
+  return Array.isArray(listed) &&
+    listed.every((e): e is string => typeof e === "string")
+    ? listed
+    : DEFAULT_PRODUCTION_ENVS;
+}
+
+/**
+ * Whether the org counts `env` as production. An unreadable org config falls
+ * back to the default list rather than letting a guard throw.
+ */
+export function isProductionEnv(env: string, config?: DenConfig): boolean {
+  let listed: string[];
+  try {
+    listed = productionEnvs(config ?? readDenConfig());
+  } catch {
+    listed = DEFAULT_PRODUCTION_ENVS;
+  }
+  return listed.includes(env);
+}
+
+/**
+ * The org's environment names, for validating manifests: the config's
+ * `environments` (Den's built-in list when unset), always with `local`.
+ */
+export function orgEnvironments(config: DenConfig = readDenConfig()): string[] {
+  return [...new Set<string>(["local", ...config.environments])];
+}
+
 /** True when the `local` environment is enabled for this engineer. */
 export function isLocalEnabled(): boolean {
   return readDenConfig().environments.includes("local");
@@ -480,6 +541,67 @@ export function readSecurityAutoTargets(
   return config.security?.auto_targets === true;
 }
 
+// ── MCP config (`<cli> mcp`) ───────────────────────────────────────────────────
+
+/** The action tools an org can opt in to. Read tools are always on. */
+export const MCP_ACTIONS = [
+  "service_up",
+  "service_down",
+  "service_restart",
+  "workspace_sync",
+  "run_tests",
+] as const;
+export type McpAction = (typeof MCP_ACTIONS)[number];
+
+/** `mcp:` in the org config. */
+export interface McpConfig {
+  /** Action tools to register; none when absent. */
+  actions?: string[];
+  /** Environments `run_tests` may target (default [local]; production never). */
+  run_tests?: { envs?: string[] };
+  /** `remote: true` lets the log tools read non-local sources (e.g. CloudWatch). */
+  logs?: { remote?: boolean };
+}
+
+/** `mcp:` with its defaults applied. */
+export interface ResolvedMcpConfig {
+  actions: McpAction[];
+  runTestsEnvs: Environment[];
+  logsRemote: boolean;
+}
+
+/**
+ * The effective MCP config. An unknown action or environment name throws:
+ * a typo must not silently turn a guard off (or an action on).
+ */
+export function readMcpConfig(
+  config: DenConfig = readDenConfig(),
+): ResolvedMcpConfig {
+  const raw = config.mcp ?? {};
+  const actions = (Array.isArray(raw.actions) ? raw.actions : []).map((a) => {
+    if (!(MCP_ACTIONS as readonly string[]).includes(String(a)))
+      throw new Error(
+        `mcp.actions: unknown action "${String(a)}" (known: ${MCP_ACTIONS.join(", ")})`,
+      );
+    return a as McpAction;
+  });
+  const envList = raw.run_tests?.envs;
+  const runTestsEnvs = (Array.isArray(envList) ? envList : ["local"]).map(
+    (e) => {
+      if (!ALL_ENVIRONMENTS.includes(e as Environment))
+        throw new Error(
+          `mcp.run_tests.envs: unknown environment "${String(e)}" (known: ${ALL_ENVIRONMENTS.join(", ")})`,
+        );
+      return e as Environment;
+    },
+  );
+  return {
+    actions: [...new Set(actions)],
+    runTestsEnvs: [...new Set(runTestsEnvs)],
+    logsRemote: raw.logs?.remote === true,
+  };
+}
+
 // ── Release config (Release tab) ──────────────────────────────────────────────
 
 /**

package/src/shared/edge/status.ts

@@ -0,0 +1,74 @@
+/**
+ * Read-only edge status: what `edge status` shows, as data. The CLI prints
+ * it; the web server serves it at /api/edge (and through it the MCP
+ * `edge_status` tool).
+ */
+import * as fs from "fs";
+import * as path from "path";
+import { certNames, edgeDomains, edgeNames, routeUrl } from "./render.js";
+import { caTrusted, containerState } from "./runtime.js";
+import type { EdgeConfig, EdgePorts } from "./types.js";
+
+export interface EdgeStatus {
+  org: string;
+  container: string;
+  /** Docker's container state ("running", "exited", …) or "absent". */
+  state: string;
+  up: boolean;
+  /** Published host ports, or null when another proxy fronts the edge. */
+  ports: EdgePorts | null;
+  network: string;
+  domains: string[];
+  routes: { name: string; url: string; upstream: string }[];
+  /** Names on the issued cert, or the planned ones when none is issued yet. */
+  certNames: string[];
+  certIssued: boolean;
+  /** Whether the CA is trusted on this machine (null: can't tell). */
+  caTrusted: boolean | null;
+}
+
+export interface EdgeStatusDeps {
+  containerState: (name: string) => string;
+  caTrusted: (cfg: EdgeConfig) => boolean | null;
+  /** Names on the issued cert (its stamp file), or null when none is issued. */
+  issuedNames: (cfg: EdgeConfig) => string[] | null;
+}
+
+/** The names stamp `ensureCerts` writes beside the cert. */
+export function issuedCertNames(cfg: EdgeConfig): string[] | null {
+  const stamp = path.join(cfg.stateDir, "certs", "names.txt");
+  if (!fs.existsSync(stamp)) return null;
+  return fs.readFileSync(stamp, "utf-8").split("\n").filter(Boolean);
+}
+
+const defaultDeps: EdgeStatusDeps = {
+  containerState,
+  caTrusted,
+  issuedNames: issuedCertNames,
+};
+
+export function edgeStatus(
+  cfg: EdgeConfig,
+  deps: EdgeStatusDeps = defaultDeps,
+): EdgeStatus {
+  const n = edgeNames(cfg.org);
+  const state = deps.containerState(n.container);
+  const issued = deps.issuedNames(cfg);
+  return {
+    org: cfg.org,
+    container: n.container,
+    state,
+    up: state === "running",
+    ports: cfg.ports,
+    network: n.network,
+    domains: edgeDomains(cfg),
+    routes: Object.entries(cfg.routes).map(([name, upstream]) => ({
+      name,
+      url: routeUrl(name, cfg),
+      upstream,
+    })),
+    certNames: issued ?? certNames(cfg),
+    certIssued: issued !== null,
+    caTrusted: deps.caTrusted(cfg),
+  };
+}

package/src/shared/environment-manager/health.ts

@@ -14,8 +14,18 @@ import * as fs from "fs";
 import * as path from "path";
 import * as dns from "dns";
 import { spawn } from "child_process";
-import { HEALTH_CHECK_TIMEOUT_MS, CLI_SPAWN_TIMEOUT_MS } from "../constants.js";
+import {
+  HEALTH_CHECK_TIMEOUT_MS,
+  HOSTED_HEALTH_CHECK_TIMEOUT_MS,
+  CLI_SPAWN_TIMEOUT_MS,
+} from "../constants.js";
 import { readManifest } from "../manifest/read-manifest.js";
+import {
+  expectMatches,
+  resolveHealthCheck,
+  type Expect,
+  type Placement,
+} from "../manifest/placement.js";
 import { readCatalog } from "./catalog.js";
 import {
   getActiveWorkspace,
@@ -42,6 +52,9 @@ export interface ServiceHealthResult {
   branch: string | null;
   health: "ok" | "error" | "unknown";
   healthDetail?: string;
+  /** Where the service runs for the env checked (R13). */
+  runs?: Placement["runs"];
+  target?: Placement["target"];
 }
 
 // ── Name resolution ───────────────────────────────────────────────────────────
@@ -288,7 +301,16 @@ const LOCALHOST_FALLBACK_TIMEOUT_MS = 1_500;
 export async function pingHttp(
   url: string,
   timeoutMs: number = HEALTH_CHECK_TIMEOUT_MS,
+  expect?: Expect,
 ): Promise<PingResult> {
+  // A remote target's probe (target.url): up only on the expected codes, and
+  // never a localhost fallback (it is not on this machine).
+  if (expect !== undefined) {
+    const r = await pingOnce(url, timeoutMs);
+    return r.status === undefined
+      ? r
+      : { ok: expectMatches(r.status, expect), status: r.status };
+  }
   const result = await pingOnce(url, timeoutMs);
   if (!result.ok) {
     // Fall back to localhost for Docker-style hostnames regardless of how the
@@ -432,12 +454,25 @@ export async function checkServiceHealth(
           getFocusedWorkspaceName() ?? "default",
         )
       : null;
-  const healthCfg =
-    manifest.services?.[resolved.subsystem]?.health?.[env] ??
-    (composeHealth
-      ? { type: "shell" as const, cmd: composeHealth }
-      : undefined);
+  const plan = resolveHealthCheck(
+    manifest,
+    resolved.subsystem,
+    env,
+    composeHealth,
+  );
+  const placed: Pick<ServiceHealthResult, "runs" | "target"> = {
+    runs: plan.placement.runs,
+    target: plan.placement.target,
+  };
+  const healthCfg = plan.check;
   if (!healthCfg) {
+    if (plan.placement.runs === "remote")
+      return {
+        ...base,
+        ...placed,
+        health: "unknown",
+        healthDetail: "no health check configured",
+      };
     // Conventional local discovery: opctl exposes each system on the host at
     // http://<repo> (port 80), and stack services serve /healthz. When the
     // PRIMARY service (entrypoint, or a repo's only service) declares no local
@@ -460,6 +495,7 @@ export async function checkServiceHealth(
       if (probe.ok && probe.status !== undefined && probe.status < 300) {
         return {
           ...base,
+          ...placed,
           health: "ok",
           healthDetail: `conventional ${conventional}`,
         };
@@ -467,6 +503,7 @@ export async function checkServiceHealth(
     }
     return {
       ...base,
+      ...placed,
       health: "unknown",
       healthDetail: "no health check configured",
     };
@@ -475,10 +512,17 @@ export async function checkServiceHealth(
   const result =
     healthCfg.type === "shell"
       ? await pingShell(healthCfg.cmd, {}, resolved.repoPath)
-      : await pingHttp(healthCfg.url);
+      : await pingHttp(
+          healthCfg.url,
+          env === "local" && plan.placement.runs !== "remote"
+            ? HEALTH_CHECK_TIMEOUT_MS
+            : HOSTED_HEALTH_CHECK_TIMEOUT_MS,
+          plan.expect,
+        );
 
   return {
     ...base,
+    ...placed,
     health: result.ok ? "ok" : "error",
     healthDetail:
       result.error ??
@@ -554,8 +598,10 @@ export function rollupRepoHealth(
       ? rows.find((r) => r.subsystem === entrypoint)
       : undefined;
     if (epRow) {
-      // Show the entrypoint's health under the clean repo-name address.
+      // Show the entrypoint's health under the clean repo-name address. A
+      // remote service is not a sidecar: it keeps its own row (R13).
       out.push({ ...epRow, address: repoName });
+      out.push(...rows.filter((r) => r !== epRow && r.runs === "remote"));
     } else {
       // No entrypoint → infra provider; keep the subsystem breakdown.
       out.push(...rows);

package/src/shared/environment-manager/load-applications.ts

@@ -8,6 +8,12 @@ import { deriveGraph } from "./derivation/derive-graph.js";
 import type { DerivedGraph } from "./derivation/types.js";
 import { getWorkspaceServices } from "./service-runner.js";
 import { readOrg, type Org } from "../org.js";
+import {
+  rollupPlacement,
+  servicePlacement,
+  type Placement,
+  type RollupPlacement,
+} from "../manifest/placement.js";
 
 export function loadApplications(workspace?: string): Application[] {
   const services = getWorkspaceServices(workspace);
@@ -47,6 +53,12 @@ export interface ApplicationView extends Application {
   addresses: string[];
   /** Repos the team config lists for it that are not in this workspace. */
   absent: string[];
+  /** address → where that service runs locally, and where a remote one is. */
+  placements: Record<string, Placement>;
+  /** local | remote | hybrid | none, over its services (R13). */
+  placement: RollupPlacement;
+  /** "shop-frontend local · shop-core remote (dev)" */
+  summary: string;
 }
 
 /** Org > Application > Repo > Services for a workspace (CLI `apps`, web UI). */
@@ -55,9 +67,18 @@ export function loadApplicationTree(workspace?: string): {
   applications: ApplicationView[];
 } {
   const byRepo = new Map<string, string[]>();
+  const placed = new Map<
+    string,
+    Placement & { repo: string; service: string }
+  >();
   for (const s of getWorkspaceServices(workspace)) {
     if (!byRepo.has(s.repoName)) byRepo.set(s.repoName, []);
     byRepo.get(s.repoName)!.push(s.address);
+    placed.set(s.address, {
+      repo: s.repoName,
+      service: s.subsystem,
+      ...servicePlacement(readManifest(s.repoPath), s.subsystem, "local"),
+    });
   }
   const config = readDenConfig().applications ?? {};
   const org = readOrg();
@@ -67,11 +88,20 @@ export function loadApplicationTree(workspace?: string): {
       const services = Object.fromEntries(
         a.repos.map((r) => [r, byRepo.get(r) ?? []]),
       );
+      const addresses = Object.values(services).flat();
+      const rows = addresses.flatMap((addr) => placed.get(addr) ?? []);
       return {
         ...a,
         services,
-        addresses: Object.values(services).flat(),
+        addresses,
         absent: (config[a.name]?.repos ?? []).filter((r) => !byRepo.has(r)),
+        placements: Object.fromEntries(
+          addresses.flatMap((addr) => {
+            const p = placed.get(addr);
+            return p ? [[addr, { runs: p.runs, target: p.target }]] : [];
+          }),
+        ),
+        ...rollupPlacement(rows),
       };
     }),
   };

package/src/shared/environment-manager/log-tail.ts

@@ -2,8 +2,9 @@
  * Live log tailing for a local service — the CLI-side counterpart of the web
  * /api/service/taillog SSE endpoint. Source resolution, in order:
  *   1. The service's manifest `logs.local` shell command (e.g. `docker logs -f`)
- *   2. Conventional container derivation: a running `opctl_<base>_<hash>`
- *      container → `docker logs -f` — real runtime logs with zero manifest config
+ *   2. The service's running container → `docker logs -f`: a compose stack's
+ *      `<stack>-<workspace>-<service>-1`, else an `opctl_<base>_<hash>` one —
+ *      real runtime logs with zero manifest config
  *   3. The den daemon startup log (~/.den/logs/<repo>/<subsystem>.log) —
  *      last resort, covers host-run processes with no container
  * A source whose command exits within the quick-exit window (container not
@@ -13,7 +14,7 @@
 import * as fs from "fs";
 import { DAEMON_QUICK_EXIT_MS, LIVE_TAIL_LINES } from "../constants.js";
 import { readManifest } from "../manifest/read-manifest.js";
-import { findConventionalContainer } from "./opctl.js";
+import { findServiceContainer } from "./service-container.js";
 import {
   getServiceLogPath,
   spawnStreaming,
@@ -85,7 +86,7 @@ export function tailSourceCandidates(
 export function resolveTailSources(resolved: ResolvedService): TailSource[] {
   const manifest = readManifest(resolved.repoPath);
   const logSource = manifest?.services?.[resolved.subsystem]?.logs?.local;
-  const container = findConventionalContainer(
+  const container = findServiceContainer(
     resolved.repoName,
     resolved.repoPath,
     resolved.subsystem,

package/src/shared/environment-manager/opctl.ts

@@ -100,7 +100,8 @@ export function isOpctlContainerFor(name: string, base: string): boolean {
   return suffix.length > 0 && !suffix.includes("_");
 }
 
-function runningDockerNames(): string[] {
+/** Names of the running docker containers (throws when docker is unavailable). */
+export function runningDockerNames(): string[] {
   return execSync('docker ps --format "{{.Names}}"', {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "ignore"],

package/src/shared/environment-manager/service-container.ts

@@ -0,0 +1,47 @@
+/**
+ * The running container that holds a service's logs. A compose-stack service
+ * runs as `<stack>-<workspace>-<service>-1` (the stacks naming helpers); any
+ * other container-run service is found by opctl's naming convention.
+ */
+import { readManifest } from "../manifest/read-manifest.js";
+import { composeServiceContainers } from "../stacks/manifest-commands.js";
+import { resolveStackWorkspaces } from "../stacks/status.js";
+import { findConventionalContainer, runningDockerNames } from "./opctl.js";
+
+/** The stack's container for `subsystem` when one is running, else null. */
+export function findStackServiceContainer(
+  repoName: string,
+  repoPath: string | undefined,
+  subsystem: string | undefined,
+): string | null {
+  if (!repoPath || !subsystem) return null;
+  const manifest = readManifest(repoPath);
+  if (!manifest?.compose) return null;
+  let candidates: string[];
+  let running: string[];
+  try {
+    const { stackWorkspace } = resolveStackWorkspaces();
+    candidates = composeServiceContainers(
+      manifest,
+      subsystem,
+      repoName,
+      stackWorkspace,
+    );
+    running = runningDockerNames();
+  } catch {
+    return null; // bad workspace name, or docker unavailable
+  }
+  return candidates.find((c) => running.includes(c)) ?? null;
+}
+
+/** A service's running container: its compose stack's, else opctl's. */
+export function findServiceContainer(
+  repoName: string,
+  repoPath?: string,
+  subsystem?: string,
+): string | null {
+  return (
+    findStackServiceContainer(repoName, repoPath, subsystem) ??
+    findConventionalContainer(repoName, repoPath, subsystem)
+  );
+}

package/src/shared/environment-manager/service-runner.ts

@@ -16,7 +16,8 @@ import {
   spawnInteractive,
   getServiceLogPath,
 } from "../process/spawn-streaming.js";
-import { readUserConfig } from "../den-config.js";
+import { isProductionEnv, readUserConfig } from "../den-config.js";
+import { placementRefusal, servicePlacement } from "../manifest/placement.js";
 import { lookupTab, recordTab, forgetTab } from "../cli-tabs.js";
 import {
   closeTab,
@@ -1056,6 +1057,20 @@ export function runServiceCommand(
 
   const { repoPath, subsystem } = resolved;
 
+  // R13: Den never runs a command on a remote service. A down stops nothing
+  // here, which is a success; anything else is refused.
+  const refusal = placementRefusal(
+    resolved.address,
+    servicePlacement(readManifest(repoPath), subsystem, "local"),
+    (e) => isProductionEnv(e) === true,
+    command === "down" ? "stop" : "start",
+  );
+  if (refusal) {
+    onLine(refusal);
+    closeAsync(command === "down" ? 0 : 1);
+    return dummy();
+  }
+
   // ── Up: share-if-identical / hard-block on conflict ─────────────────────────
   if (command === "up" || command === "restart") {
     let existing = findDaemonByAddress(resolved.address);