@scp-dev/core 0.1.5 → 0.2.0

package/dist/index.d.ts

@@ -998,11 +998,12 @@ declare function relationText(peer: PolicySubject, me: PolicySubject): string;
 /**
  * The scope check for a message from `a` to `b`: `out(a)` admits `b` and `in(b)` admits `a`. Either side the account's human (with `humanAlways`)
  * or the system endpoint passes, except an `unverified` human sender (one without a terminal), which is checked like any unplaced sender; an
- * ancestor of `b` (unless `strict`) and a solicited reply pass both.
+ * ancestor of `b` (unless `strict`), a solicited reply and a parent and child `linked` across machines pass both.
  */
 declare function scopeDecision(world: ScopeWorld, a: ScopeNode, b: ScopeNode, options: {
     humanAlways: boolean;
     solicited?: boolean;
+    linked?: boolean;
     unverified?: boolean;
     strict?: boolean;
 }): ScopeDecision;
@@ -1085,6 +1086,8 @@ interface EndpointRow {
     /** the root endpoint's id; null for a root */
     tree: string | null;
     parent_ep: string | null;
+    /** a parent on another machine of the account, `<machine>/<handle>`: the row stays a root of its own tree */
+    parent_addr: string | null;
     depth: number | null;
     /** JSON {@link ScopeRules} */
     rules: string | null;
@@ -1109,6 +1112,10 @@ interface EndpointRow {
     linked: number | null;
     /** how the session that holds the endpoint wakes it: a {@link Wake} other than none, or null */
     wake: string | null;
+    /** the live connections that set the wake */
+    wakers: number;
+    /** when the last hook connection that set the wake closed */
+    waker_left: number | null;
 }
 interface MessageRow {
     id: string;
@@ -1171,6 +1178,8 @@ declare class RelayCore {
     constructor(sql: Sql, options: CoreOptions);
     /** a `machine` label naming this host by its hostname, as clients default it, names it by its machine name when one is set */
     private machineLabel;
+    /** this host's own agent rows labelled with another machine (its name before a rename, or its hostname) take its machine name */
+    relabelMachine(): number;
     migrate(): void;
     /** every stored list that is exactly `tree:self`, the tree preset's old list, narrows once to the preset's list */
     private migrateTreePreset;
@@ -1256,6 +1265,8 @@ declare class RelayCore {
      * whether a claim placed under `parent` restarts `row`: it lands where `row` sits (under `row`'s parent, or a root with no placement), or on
      * `row` itself from `row`'s own process; never under `row` or elsewhere in its tree
      */
+    /** a local row held only by connections whose harness process exited, as a shim that outlived its harness leaves it */
+    private outlived;
     private restarts;
     /**
      * whether the claim re-claims `row` with the grant `row` spent: from `row`'s own process or one of its ancestors, or with no lineage from
@@ -1344,6 +1355,15 @@ declare class RelayCore {
         transient?: boolean;
         process?: string;
     }): boolean;
+    /**
+     * a connection that set the endpoint's wake starts (`live`) or stops counting as its waker. A hook's (`grace`) still counts for
+     * LIMITS.restartGraceS after it closes, while its harness starts the next one
+     */
+    waker(endpoint: string, live: boolean, options?: {
+        grace?: boolean;
+    }): void;
+    /** clears a wake no waker holds once a hook waker's grace ran out too: nothing is left to wake the endpoint */
+    private lapseWake;
     /**
      * a title for the caller's in-process subagent `id` from the description its parent gave it; the subagent's endpoint id when it changed one.
      * It fills only a title nobody set, as an inferred one, and waits for the subagent's claim when it has no endpoint yet
@@ -1388,8 +1408,22 @@ declare class RelayCore {
         endpoint: EndpointView;
         parent: string;
     };
-    /** `row`, a root, and its subtree moved under `parent`, a local agent that is neither `row` nor one of its descendants */
+    /**
+     * `row`, a root, and its subtree moved under `parent`, a local agent that is neither `row` nor one of its descendants; a parent on another
+     * machine goes to {@link linkAcross}
+     */
     private link;
+    /** a link of `row`, which already sits under a parent, to another one */
+    private alreadyLinked;
+    /**
+     * the key `<machine>/<handle>` that links `row`, a local agent, under `parent`, an agent on another machine, once the parent is checked; no
+     * inherited or child-default caps come with it. A relay of one machine has no such parent
+     */
+    protected linkAcross(_row: EndpointRow, _parent: EndpointRow): string;
+    /** whether `a` and `b` are a parent and its child on different machines */
+    protected linkedAcross(_a: EndpointRow, _b: EndpointRow): boolean;
+    /** the address of `row`'s parent on another machine, null when it has none; with `shown`, null for a parent outside it */
+    protected linkedParent(_row: EndpointRow, _shown?: Set<string>): string | null;
     /**
      * renames an agent in place: its id, mail, threads, status, title and relations stay. An agent renames only itself, and only a root unless
      * the policy's `defaults.rename` is `self`; the human at a terminal renames any local agent. The new handle is valid and held by no other endpoint
@@ -1404,6 +1438,8 @@ declare class RelayCore {
     };
     /** the endpoint's handle set to `value`, with the stored `ep:` and `fleet:` selectors that named it */
     private renameRow;
+    /** a local agent's handle moved from `from` to `to`: a subclass updates what names it on another machine's rows */
+    protected renamedHandle(_from: string, _to: string): void;
     /**
      * a session leaves: it lets go of its session and token and shows offline, its mail kept; a later join takes it back. An agent leaves only
      * itself, the human at a terminal any local root or linked agent. A spawned worker stays joined while it runs
@@ -1685,7 +1721,7 @@ declare class RelayCore {
     }): AuditRow[];
     /** drops what expired: deliveries, message bodies past their grace, old guard state and old audit rows */
     sweep(): void;
-    /** ends the hook presence of local agent endpoints whose harness process exited without a session_end, as one would */
+    /** ends the hook presence of local agent endpoints whose harness process exited without a session_end, as one would, and lapses wakes whose hook waker never came back */
     endExited(now?: number): void;
     /** an agent endpoint left offline drops a working or waiting status, which no one is left to keep current */
     private settleOffline;

package/dist/index.js

@@ -558,6 +558,7 @@ function scopeDecision(world, a, b, options) {
   if (options.humanAlways && (b.human || a.human && !options.unverified)) return { allowed: true, reasons: ["the human is always reachable"] };
   if (!options.strict && isAncestor(a, b)) return { allowed: true, reasons: [`${a.address} is an ancestor of ${b.address}: scopes never stop it`] };
   if (options.solicited) return { allowed: true, reasons: [`a reply to ${b.address}'s message in its thread`] };
+  if (options.linked) return { allowed: true, reasons: [`${a.address} and ${b.address} are parent and child across machines`] };
   const memo = /* @__PURE__ */ new Map();
   const out = admits(world, a, "out", b, memo);
   if (!out.ok) return { allowed: false, dir: "out", reasons: [out.why] };
@@ -1306,6 +1307,19 @@ var RelayCore = class {
     if (this.namedMachine !== null && labels.machine !== void 0 && labels.machine === this.hostname) labels.machine = this.namedMachine;
     return labels;
   }
+  /** this host's own agent rows labelled with another machine (its name before a rename, or its hostname) take its machine name */
+  relabelMachine() {
+    const machine = this.namedMachine;
+    if (machine === null) return 0;
+    let changed = 0;
+    for (const row of this.sql.all(`SELECT * FROM endpoints WHERE kind = 'agent' AND labels LIKE '%"machine"%'`)) {
+      const labels = json(row.labels, {});
+      if (labels.machine === void 0 || labels.machine === machine || !this.localRow(row)) continue;
+      this.sql.all(`UPDATE endpoints SET labels = ? WHERE id = ?`, JSON.stringify({ ...labels, machine }), row.id);
+      changed++;
+    }
+    return changed;
+  }
   migrate() {
     for (const statement of MIGRATION) this.sql.all(statement);
     const columns = this.sql.all(`PRAGMA table_info(idempotency)`).map((c) => c.name);
@@ -1325,6 +1339,7 @@ var RelayCore = class {
     for (const [column, type] of [
       ["tree", "TEXT"],
       ["parent_ep", "TEXT"],
+      ["parent_addr", "TEXT"],
       ["depth", "INTEGER"],
       ["rules", "TEXT"],
       ["caps", "TEXT"],
@@ -1344,7 +1359,9 @@ var RelayCore = class {
       ["tldr_turn", "INTEGER"],
       ["named", "INTEGER"],
       ["linked", "INTEGER"],
-      ["wake", "TEXT"]
+      ["wake", "TEXT"],
+      ["wakers", "INTEGER NOT NULL DEFAULT 0"],
+      ["waker_left", "INTEGER"]
     ]) {
       if (!endpointColumns.includes(column)) this.sql.all(`ALTER TABLE endpoints ADD COLUMN ${column} ${type}`);
     }
@@ -1621,7 +1638,7 @@ var RelayCore = class {
     if (row && presenceOf(row, now) === "offline") {
       this.sql.all(`UPDATE endpoints SET session = NULL WHERE id = ?`, row.id);
       row = void 0;
-    } else if (row && !transient && !sameProcess(row, fields.process)) {
+    } else if (row && !transient && !sameProcess(row, fields.process) && !(row.handle === wanted && reclaims(row, fields.process))) {
       row = void 0;
       session = null;
     } else if (row && !transient && row.token_hash === null && row.named === null && row.handle !== wanted && !row.handle.startsWith(`${wanted.slice(0, 58)}-`)) {
@@ -1663,7 +1680,7 @@ var RelayCore = class {
         this.sql.all(`INSERT INTO endpoints (id, handle, kind, harness, labels, created_at) VALUES (?, ?, 'agent', ?, '{}', ?)`, id, handle, harness, now);
         row = this.byId(id);
         created = true;
-      } else if (held.kind === "agent" && held.connections === 0 && presenceOf(held, now) === "offline" && harnessFits(held.harness, harness) && held.id !== scope.subagent?.root && !(scope.subagent && held.session?.startsWith("sub:") && held.session !== fields.session)) {
+      } else if (held.kind === "agent" && (held.connections === 0 && presenceOf(held, now) === "offline" || !transient && this.outlived(held)) && harnessFits(held.harness, harness) && held.id !== scope.subagent?.root && !(scope.subagent && held.session?.startsWith("sub:") && held.session !== fields.session)) {
         own = transient && held.process !== null && fields.process !== null && sameHarness(held.process, fields.process);
         const ended = held.hook_ended !== null || (held.last_seen ?? held.created_at) < now - LIMITS.restartGraceS * 1e3;
         if ((!transient || own || ended) && (this.restarts(held, this.placement(scope, now).parent, fields.process) || this.redeems(held, scope, { harness, ...fields })))
@@ -1872,6 +1889,11 @@ var RelayCore = class {
    * whether a claim placed under `parent` restarts `row`: it lands where `row` sits (under `row`'s parent, or a root with no placement), or on
    * `row` itself from `row`'s own process; never under `row` or elsewhere in its tree
    */
+  /** a local row held only by connections whose harness process exited, as a shim that outlived its harness leaves it */
+  outlived(row) {
+    const pid = Number(/^pid:(\d+):/.exec(row.process ?? "")?.[1]);
+    return row.connections > 0 && pid > 0 && this.localRow(row) && !this.alive(pid);
+  }
   restarts(row, parent, process) {
     if (parent?.id === row.id) return process !== null && row.process !== null && sameHarness(row.process, process);
     return (parent?.id ?? null) === row.parent_ep || parent === null && row.linked !== null;
@@ -1922,7 +1944,7 @@ var RelayCore = class {
     }
     caps.caps.push(...this.capsOf(row).caps);
     this.sql.all(
-      `UPDATE endpoints SET tree = ?, parent_ep = ?, depth = ?, rules = ?, caps = ? WHERE id = ?`,
+      `UPDATE endpoints SET tree = ?, parent_ep = ?, parent_addr = NULL, depth = ?, rules = ?, caps = ? WHERE id = ?`,
       parent ? parent.tree ?? parent.id : null,
       parent?.id ?? null,
       depth,
@@ -2036,7 +2058,7 @@ var RelayCore = class {
       endpoint
     );
     const row = this.mustEndpoint(endpoint);
-    if (!options.settle || presenceOf(row, now) !== "offline" || row.status_state !== "working" && row.status_state !== "waiting") return false;
+    if (!options.settle || shownPresence(row, now) !== "offline" || row.status_state !== "working" && row.status_state !== "waiting") return false;
     this.sql.all(`UPDATE endpoints SET status_state = NULL, status_note = NULL WHERE id = ?`, endpoint);
     return true;
   }
@@ -2051,6 +2073,7 @@ var RelayCore = class {
       `UPDATE endpoints SET connections = 0, hook_seen = CASE WHEN kind = 'agent' AND hook_ended IS NULL THEN MAX(COALESCE(hook_seen, 0), ?) ELSE hook_seen END WHERE connections > 0`,
       this.now() - (LIMITS.hookIdleS - LIMITS.restartGraceS) * 1e3
     );
+    this.sql.all(`UPDATE endpoints SET wakers = 0, waker_left = ? WHERE wakers > 0`, this.now());
   }
   whoami(endpoint) {
     return this.view(this.mustEndpoint(endpoint));
@@ -2068,7 +2091,7 @@ var RelayCore = class {
     const viewer = filters.viewer === void 0 ? void 0 : this.mustEndpoint(filters.viewer);
     const shown = viewer ? new Set(this.visibleRows(viewer).map((row) => row.id)) : void 0;
     const peeker = viewer ?? (filters.peekable === true ? this.byHandle(HUMAN_HANDLE) : void 0);
-    return this.listed().filter((row) => filters.all || row.connections > 0 || row.kind === "human" || (row.last_seen ?? 0) >= cutoff).filter((row) => !filters.harness || row.harness === filters.harness).filter((row) => !filters.kind || row.kind === filters.kind).filter((row) => !viewer || row.id === viewer.id || this.mayMessage(viewer, row, viewer.kind === "human")).map((row) => {
+    return this.listed().filter((row) => filters.all || row.connections > 0 || row.kind === "human" || (row.last_seen ?? 0) >= cutoff || waking(row, now)).filter((row) => !filters.harness || row.harness === filters.harness).filter((row) => !filters.kind || row.kind === filters.kind).filter((row) => !viewer || row.id === viewer.id || this.mayMessage(viewer, row, viewer.kind === "human")).map((row) => {
       const view = this.view(row, shown);
       return peeker && this.peekableBy(peeker, row, viewer?.kind === "human") ? { ...view, peekable: row.peek } : view;
     }).filter((view) => !filters.presence || view.presence === filters.presence);
@@ -2168,6 +2191,27 @@ var RelayCore = class {
     this.sql.all(`UPDATE endpoints SET wake = ? WHERE id = ?`, wake, endpoint);
     return true;
   }
+  /**
+   * a connection that set the endpoint's wake starts (`live`) or stops counting as its waker. A hook's (`grace`) still counts for
+   * LIMITS.restartGraceS after it closes, while its harness starts the next one
+   */
+  waker(endpoint, live, options = {}) {
+    if (live) this.sql.all(`UPDATE endpoints SET wakers = wakers + 1 WHERE id = ?`, endpoint);
+    else {
+      const now = this.now();
+      this.sql.all(
+        `UPDATE endpoints SET wakers = MAX(wakers - 1, 0), waker_left = CASE WHEN ? THEN ? ELSE waker_left END WHERE id = ?`,
+        options.grace ? 1 : 0,
+        now,
+        endpoint
+      );
+      if (!options.grace) this.lapseWake(endpoint, now);
+    }
+  }
+  /** clears a wake no waker holds once a hook waker's grace ran out too: nothing is left to wake the endpoint */
+  lapseWake(endpoint, now) {
+    this.sql.all(`UPDATE endpoints SET wake = NULL WHERE id = ? AND wakers = 0 AND COALESCE(waker_left, 0) < ?`, endpoint, now - LIMITS.restartGraceS * 1e3);
+  }
   /**
    * a title for the caller's in-process subagent `id` from the description its parent gave it; the subagent's endpoint id when it changed one.
    * It fills only a title nobody set, as an inferred one, and waits for the subagent's claim when it has no endpoint yet
@@ -2272,7 +2316,8 @@ var RelayCore = class {
       const target = params.endpoint === void 0 ? me : this.resolve(params.endpoint);
       if (actor.kind !== "human" && target.id !== me.id) throw new RelayError("scope_refused", "an agent unlinks only itself");
       if (target.kind !== "agent" || !this.localRow(target)) throw new RelayError("invalid_params", "only a local agent endpoint can be unlinked");
-      if (target.parent_ep === null) throw new RelayError("invalid_params", `${this.address(target)} is a root: it has no parent`);
+      if (target.parent_ep === null && target.parent_addr === null)
+        throw new RelayError("invalid_params", `${this.address(target)} is a root: it has no parent`);
       if (actor.kind !== "human" && this.policy?.defaults?.unlink !== "self")
         throw this.scopeRefused(
           actor,
@@ -2280,6 +2325,14 @@ var RelayCore = class {
           { target: this.address(target), reason: "unlink" },
           "unlinking widens a worker's scope: only the human at a terminal unlinks it (policy defaults.unlink: self lets it)"
         );
+      if (target.parent_ep === null) {
+        const from2 = this.linkedParent(target) ?? target.parent_addr;
+        this.sql.all(`UPDATE endpoints SET parent_addr = NULL, linked = NULL WHERE id = ?`, target.id);
+        this.scopeMemo?.ancestors.clear();
+        this.scopeMemo?.limited.clear();
+        this.audit("unlink", target.id, null, { ...this.actorDetail(actor, me), target: this.address(target), parent: from2 });
+        return { endpoint: this.whoami(target.id), parent: from2 };
+      }
       const parent = this.byId(target.parent_ep);
       const from = parent ? this.address(parent) : target.parent_ep;
       const shift = target.depth ?? 0;
@@ -2303,16 +2356,26 @@ var RelayCore = class {
       return { endpoint: this.whoami(target.id), parent: from };
     });
   }
-  /** `row`, a root, and its subtree moved under `parent`, a local agent that is neither `row` nor one of its descendants */
+  /**
+   * `row`, a root, and its subtree moved under `parent`, a local agent that is neither `row` nor one of its descendants; a parent on another
+   * machine goes to {@link linkAcross}
+   */
   link(row, parent, by) {
-    if (parent.kind !== "agent" || !this.localRow(parent)) throw new RelayError("invalid_params", "the parent is a local agent endpoint");
+    if (!this.localRow(parent)) {
+      const key = this.linkAcross(row, parent);
+      if (row.parent_addr === key) return;
+      if (row.parent_ep !== null || row.parent_addr !== null) throw this.alreadyLinked(row);
+      this.sql.all(`UPDATE endpoints SET parent_addr = ?, linked = ? WHERE id = ?`, key, this.now(), row.id);
+      this.scopeMemo?.ancestors.clear();
+      this.scopeMemo?.limited.clear();
+      this.audit("adopt", row.id, null, { ...by, target: this.address(row), parent: this.address(parent) });
+      return;
+    }
+    if (parent.kind !== "agent") throw new RelayError("invalid_params", "the parent is an agent endpoint");
     if (row.parent_ep === parent.id) return;
     if (parent.id === row.id || this.ancestorsOf(parent).includes(row.id))
       throw new RelayError("scope_refused", `${this.address(parent)} sits under ${this.address(row)}: a session cannot go under its own descendant`);
-    if (row.parent_ep !== null) {
-      const now = this.byId(row.parent_ep);
-      throw new RelayError("scope_refused", `${this.address(row)} already sits under ${now ? this.address(now) : "another agent"}; unlink it first`);
-    }
+    if (row.parent_ep !== null || row.parent_addr !== null) throw this.alreadyLinked(row);
     const depth = (parent.depth ?? 0) + 1;
     const deepest = one(this.sql, `SELECT MAX(depth) AS d FROM endpoints WHERE tree = ?`, row.id)?.d ?? 0;
     if (deepest + depth > LIMITS.depthMax)
@@ -2336,6 +2399,27 @@ var RelayCore = class {
     this.scopeMemo?.limited.clear();
     this.audit("adopt", row.id, null, { ...by, target: this.address(row), parent: this.address(parent) });
   }
+  /** a link of `row`, which already sits under a parent, to another one */
+  alreadyLinked(row) {
+    const local = row.parent_ep ? this.byId(row.parent_ep) : void 0;
+    const now = local ? this.address(local) : row.parent_addr !== null ? this.linkedParent(row) ?? row.parent_addr : "another agent";
+    return new RelayError("scope_refused", `${this.address(row)} already sits under ${now}; unlink it first`);
+  }
+  /**
+   * the key `<machine>/<handle>` that links `row`, a local agent, under `parent`, an agent on another machine, once the parent is checked; no
+   * inherited or child-default caps come with it. A relay of one machine has no such parent
+   */
+  linkAcross(_row, _parent) {
+    throw new RelayError("invalid_params", "the parent is a local agent endpoint");
+  }
+  /** whether `a` and `b` are a parent and its child on different machines */
+  linkedAcross(_a, _b) {
+    return false;
+  }
+  /** the address of `row`'s parent on another machine, null when it has none; with `shown`, null for a parent outside it */
+  linkedParent(_row, _shown) {
+    return null;
+  }
   /**
    * renames an agent in place: its id, mail, threads, status, title and relations stay. An agent renames only itself, and only a root unless
    * the policy's `defaults.rename` is `self`; the human at a terminal renames any local agent. The new handle is valid and held by no other endpoint
@@ -2383,8 +2467,12 @@ var RelayCore = class {
       ])
         this.sql.all(`UPDATE ${table} SET ${column} = REPLACE(${column}, ?, ?) WHERE instr(${column}, ?) > 0`, a, b, a);
     }
+    this.renamedHandle(from, handle);
     this.audit("rename", row.id, null, { from, to: handle });
   }
+  /** a local agent's handle moved from `from` to `to`: a subclass updates what names it on another machine's rows */
+  renamedHandle(_from, _to) {
+  }
   /**
    * a session leaves: it lets go of its session and token and shows offline, its mail kept; a later join takes it back. An agent leaves only
    * itself, the human at a terminal any local root or linked agent. A spawned worker stays joined while it runs
@@ -2469,7 +2557,7 @@ var RelayCore = class {
     const recipients = [...new Map(resolved.map((row) => [row.id, row])).values()];
     if (params.live !== void 0 && typeof params.live !== "boolean") throw new RelayError("invalid_params", "live must be true or false");
     const dark = recipients.filter(
-      (r) => r.kind === "agent" && presenceOf(r, now) === "offline" && (now - Math.max(r.last_seen ?? 0, r.hook_seen ?? 0) >= ASK_ENDED_GRACE_MS || r.session === null && r.token_hash === null && r.hook_ended !== null) && !this.unjoinedSpawn(sender, r.handle, now)
+      (r) => r.kind === "agent" && shownPresence(r, now) === "offline" && (now - Math.max(r.last_seen ?? 0, r.hook_seen ?? 0) >= ASK_ENDED_GRACE_MS || r.session === null && r.token_hash === null && r.hook_ended !== null) && !this.unjoinedSpawn(sender, r.handle, now)
     );
     if (params.live === true && dark.length)
       throw new RelayError("not_live", `no live session holds ${dark.map((r) => this.address(r)).join(", ")}: nothing was queued`);
@@ -2714,7 +2802,7 @@ var RelayCore = class {
   reach(sender, recipient, offline, now) {
     if (recipient.kind !== "agent" || !this.localRow(recipient)) return void 0;
     const done = recipient.status_state === "done";
-    if ((done || presenceOf(recipient, now) === "offline") && this.unjoinedSpawn(sender, recipient.handle, now)) return "starting";
+    if ((done || shownPresence(recipient, now) === "offline") && this.unjoinedSpawn(sender, recipient.handle, now)) return "starting";
     if (done) return "ended";
     return offline ? "offline" : "running";
   }
@@ -3113,7 +3201,7 @@ var RelayCore = class {
         continue;
       }
       const row = this.byId(grant.used_by);
-      if (!row || row.status_state === "done" || presenceOf(row, now) === "offline" && (grant.handback !== null || !pid || !this.alive(pid))) continue;
+      if (!row || row.status_state === "done" || shownPresence(row, now) === "offline" && (grant.handback !== null || !pid || !this.alive(pid))) continue;
       workers.set(row.id, row);
       if (grant.pushed_at !== null && grant.pushed_at > now - LIMITS.pushGapS * 1e3) paced.add(row.id);
     }
@@ -3476,9 +3564,9 @@ var RelayCore = class {
       request,
       endpoint
     ).filter(
-      (row) => present ? present.includes(row.id) : presenceOf(row, now) !== "offline" || Math.max(row.last_seen ?? 0, row.hook_seen ?? 0, row.hook_ended ?? 0) >= asked.created_at
+      (row) => present ? present.includes(row.id) : shownPresence(row, now) !== "offline" || Math.max(row.last_seen ?? 0, row.hook_seen ?? 0, row.hook_ended ?? 0) >= asked.created_at
     );
-    const gone = (row) => presenceOf(row, now) === "offline" && ((row.hook_ended ?? 0) >= asked.created_at || row.status_state === "done" || now - Math.max(row.last_seen ?? 0, row.hook_seen ?? 0) >= ASK_ENDED_GRACE_MS);
+    const gone = (row) => shownPresence(row, now) === "offline" && ((row.hook_ended ?? 0) >= asked.created_at || row.status_state === "done" || now - Math.max(row.last_seen ?? 0, row.hook_seen ?? 0) >= ASK_ENDED_GRACE_MS);
     if (!rows.length || !rows.every(gone)) return null;
     return rows.map((row) => ({ address: this.address(row), state: row.status_state }));
   }
@@ -3558,22 +3646,31 @@ var RelayCore = class {
       if (!root || root.handle.startsWith(GONE_PREFIX) || !seen) this.dropGroup(group.name);
     }
   }
-  /** ends the hook presence of local agent endpoints whose harness process exited without a session_end, as one would */
+  /** ends the hook presence of local agent endpoints whose harness process exited without a session_end, as one would, and lapses wakes whose hook waker never came back */
   endExited(now = this.now()) {
     for (const row of this.sql.all(
       `SELECT * FROM endpoints WHERE kind = 'agent' AND connections = 0 AND hook_seen IS NOT NULL AND process IS NOT NULL`
     )) {
       const pid = Number(/^pid:(\d+)/.exec(row.process)?.[1]);
       if (!pid || !this.localRow(row) || this.alive(pid)) continue;
-      this.sql.all(`UPDATE endpoints SET hook_seen = NULL, hook_ended = ?, session = NULL WHERE id = ? AND connections = 0`, now, row.id);
+      this.sql.all(
+        `UPDATE endpoints SET hook_seen = NULL, hook_ended = ?, session = NULL, wake = CASE WHEN wakers = 0 THEN NULL ELSE wake END WHERE id = ? AND connections = 0`,
+        now,
+        row.id
+      );
     }
+    for (const row of this.sql.all(
+      `SELECT * FROM endpoints WHERE wake IS NOT NULL AND wakers = 0 AND waker_left < ?`,
+      now - LIMITS.restartGraceS * 1e3
+    ))
+      if (this.localRow(row)) this.lapseWake(row.id, now);
   }
   /** an agent endpoint left offline drops a working or waiting status, which no one is left to keep current */
   settleOffline(now) {
     for (const row of this.sql.all(
       `SELECT * FROM endpoints WHERE kind = 'agent' AND connections = 0 AND status_state IN ('working', 'waiting')`
     )) {
-      if (this.localRow(row) && presenceOf(row, now) === "offline")
+      if (this.localRow(row) && shownPresence(row, now) === "offline")
         this.sql.all(`UPDATE endpoints SET status_state = NULL, status_note = NULL WHERE id = ?`, row.id);
     }
   }
@@ -3616,7 +3713,8 @@ var RelayCore = class {
     if (params.kind === "session_end") {
       if (own)
         this.sql.all(
-          `UPDATE endpoints SET hook_seen = NULL, hook_ended = ?, session = CASE WHEN connections = 0 THEN NULL ELSE session END WHERE id = ?`,
+          `UPDATE endpoints SET hook_seen = NULL, hook_ended = ?, session = CASE WHEN connections = 0 THEN NULL ELSE session END,
+           wake = CASE WHEN wakers = 0 THEN NULL ELSE wake END WHERE id = ?`,
           now,
           endpoint
         );
@@ -4245,7 +4343,8 @@ var RelayCore = class {
       }
       const note = [`exited ${p.code}`, spender.status_note].filter(Boolean).join("; ").slice(0, LIMITS.noteChars);
       this.sql.all(
-        `UPDATE endpoints SET status_state = 'done', status_note = ?, hook_seen = NULL, hook_ended = ?, session = CASE WHEN connections = 0 THEN NULL ELSE session END WHERE id = ?`,
+        `UPDATE endpoints SET status_state = 'done', status_note = ?, hook_seen = NULL, hook_ended = ?, session = CASE WHEN connections = 0 THEN NULL ELSE session END,
+         wake = CASE WHEN wakers = 0 THEN NULL ELSE wake END WHERE id = ?`,
         note,
         now,
         spender.id
@@ -4670,6 +4769,7 @@ ${stderr}` : "";
     return scopeDecision(world, world.node(a.id) ?? this.scopeNode(a), world.node(b.id) ?? this.scopeNode(b), {
       humanAlways: this.defaults().humanAlways,
       solicited,
+      linked: a.id !== b.id && this.linkedAcross(a, b),
       unverified,
       strict
     });
@@ -5382,7 +5482,7 @@ ${stderr}` : "";
   }
   /** with `shown`, the ids a viewer sees: a parent outside it is null */
   view(row, shown) {
-    const presence = presenceOf(row, this.now());
+    const presence = shownPresence(row, this.now());
     return {
       id: row.id,
       address: this.address(row),
@@ -5400,7 +5500,8 @@ ${stderr}` : "";
   }
   placeView(row, shown) {
     const parent = row.parent_ep && (!shown || shown.has(row.parent_ep)) ? this.byId(row.parent_ep) : void 0;
-    return { parent: parent ? this.address(parent) : null, depth: row.depth ?? 0, scope: presetOf(this.scopeNode(row), this.defaults().symmetric) };
+    const across = !parent && row.parent_ep === null && row.parent_addr ? this.linkedParent(row, shown) : null;
+    return { parent: parent ? this.address(parent) : across, depth: row.depth ?? 0, scope: presetOf(this.scopeNode(row), this.defaults().symmetric) };
   }
   /** `recipient` names the delivery's endpoint when there is no `seq`: a send to several addresses shows each recipient only itself */
   envelope(row, seq, recipient) {
@@ -5575,6 +5676,9 @@ function unreachable(address) {
 var PROCESS_KEY = /^pid:\d+:[A-Za-z0-9:-]{1,64}$/;
 var BARE_PID_KEY = /^pid:\d+$/;
 var ANY_PROCESS_KEY = /^pid:\d+(:[A-Za-z0-9:-]{1,64})?$/;
+function reclaims(row, key) {
+  return row.connections > 0 && key !== null && row.process === key && PROCESS_KEY.test(key);
+}
 function sameProcess(row, key) {
   if (row.connections > 0 || key === null || row.process === null) return false;
   return row.token_hash === null ? sameHarness(row.process, key) : row.process === key && PROCESS_KEY.test(key);
@@ -5615,6 +5719,13 @@ function presenceOf(row, now) {
   if (row.hook_seen >= now - LIMITS.hookOnlineS * 1e3) return "online";
   return row.hook_seen >= now - LIMITS.hookIdleS * 1e3 ? "idle" : "offline";
 }
+function waking(row, now) {
+  return wakeOf(row) !== null && (row.wakers > 0 || (row.waker_left ?? 0) >= now - LIMITS.restartGraceS * 1e3);
+}
+function shownPresence(row, now) {
+  const presence = presenceOf(row, now);
+  return presence === "offline" && waking(row, now) ? "idle" : presence;
+}
 function pairKey(a, b) {
   return a < b ? `${a}|${b}` : `${b}|${a}`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scp-dev/core",
-  "version": "0.1.5",
+  "version": "0.2.0",
   "description": "Swarm Communication Protocol core: wire types, framing, scopes, policy, judge and the relay core.",
   "license": "Apache-2.0",
   "homepage": "https://scp.dev",

package/src/core.ts

@@ -243,6 +243,8 @@ export interface EndpointRow {
   /** the root endpoint's id; null for a root */
   tree: string | null
   parent_ep: string | null
+  /** a parent on another machine of the account, `<machine>/<handle>`: the row stays a root of its own tree */
+  parent_addr: string | null
   depth: number | null
   /** JSON {@link ScopeRules} */
   rules: string | null
@@ -267,6 +269,10 @@ export interface EndpointRow {
   linked: number | null
   /** how the session that holds the endpoint wakes it: a {@link Wake} other than none, or null */
   wake: string | null
+  /** the live connections that set the wake */
+  wakers: number
+  /** when the last hook connection that set the wake closed */
+  waker_left: number | null
 }
 
 export interface MessageRow {
@@ -496,6 +502,20 @@ export class RelayCore {
     return labels
   }
 
+  /** this host's own agent rows labelled with another machine (its name before a rename, or its hostname) take its machine name */
+  relabelMachine(): number {
+    const machine = this.namedMachine
+    if (machine === null) return 0
+    let changed = 0
+    for (const row of this.sql.all<EndpointRow>(`SELECT * FROM endpoints WHERE kind = 'agent' AND labels LIKE '%"machine"%'`)) {
+      const labels = json<Record<string, string>>(row.labels, {})
+      if (labels.machine === undefined || labels.machine === machine || !this.localRow(row)) continue
+      this.sql.all(`UPDATE endpoints SET labels = ? WHERE id = ?`, JSON.stringify({ ...labels, machine }), row.id)
+      changed++
+    }
+    return changed
+  }
+
   migrate(): void {
     for (const statement of MIGRATION) this.sql.all(statement)
     const columns = this.sql.all<{ name: string }>(`PRAGMA table_info(idempotency)`).map((c) => c.name)
@@ -515,6 +535,7 @@ export class RelayCore {
     for (const [column, type] of [
       ["tree", "TEXT"],
       ["parent_ep", "TEXT"],
+      ["parent_addr", "TEXT"],
       ["depth", "INTEGER"],
       ["rules", "TEXT"],
       ["caps", "TEXT"],
@@ -535,6 +556,8 @@ export class RelayCore {
       ["named", "INTEGER"],
       ["linked", "INTEGER"],
       ["wake", "TEXT"],
+      ["wakers", "INTEGER NOT NULL DEFAULT 0"],
+      ["waker_left", "INTEGER"],
     ] as const) {
       if (!endpointColumns.includes(column)) this.sql.all(`ALTER TABLE endpoints ADD COLUMN ${column} ${type}`)
     }
@@ -834,7 +857,7 @@ export class RelayCore {
     if (row && presenceOf(row, now) === "offline") {
       this.sql.all(`UPDATE endpoints SET session = NULL WHERE id = ?`, row.id)
       row = undefined
-    } else if (row && !transient && !sameProcess(row, fields.process)) {
+    } else if (row && !transient && !sameProcess(row, fields.process) && !(row.handle === wanted && reclaims(row, fields.process))) {
       row = undefined
       session = null
     } else if (
@@ -884,8 +907,7 @@ export class RelayCore {
         created = true
       } else if (
         held.kind === "agent" &&
-        held.connections === 0 &&
-        presenceOf(held, now) === "offline" &&
+        ((held.connections === 0 && presenceOf(held, now) === "offline") || (!transient && this.outlived(held))) &&
         harnessFits(held.harness, harness) &&
         held.id !== scope.subagent?.root &&
         !(scope.subagent && held.session?.startsWith("sub:") && held.session !== fields.session)
@@ -1124,6 +1146,12 @@ export class RelayCore {
    * whether a claim placed under `parent` restarts `row`: it lands where `row` sits (under `row`'s parent, or a root with no placement), or on
    * `row` itself from `row`'s own process; never under `row` or elsewhere in its tree
    */
+  /** a local row held only by connections whose harness process exited, as a shim that outlived its harness leaves it */
+  private outlived(row: EndpointRow): boolean {
+    const pid = Number(/^pid:(\d+):/.exec(row.process ?? "")?.[1])
+    return row.connections > 0 && pid > 0 && this.localRow(row) && !this.alive(pid)
+  }
+
   private restarts(row: EndpointRow, parent: EndpointRow | null, process: string | null): boolean {
     if (parent?.id === row.id) return process !== null && row.process !== null && sameHarness(row.process, process)
     return (parent?.id ?? null) === row.parent_ep || (parent === null && row.linked !== null)
@@ -1178,7 +1206,7 @@ export class RelayCore {
     }
     caps.caps.push(...this.capsOf(row).caps)
     this.sql.all(
-      `UPDATE endpoints SET tree = ?, parent_ep = ?, depth = ?, rules = ?, caps = ? WHERE id = ?`,
+      `UPDATE endpoints SET tree = ?, parent_ep = ?, parent_addr = NULL, depth = ?, rules = ?, caps = ? WHERE id = ?`,
       parent ? (parent.tree ?? parent.id) : null,
       parent?.id ?? null,
       depth,
@@ -1305,7 +1333,7 @@ export class RelayCore {
       endpoint,
     )
     const row = this.mustEndpoint(endpoint)
-    if (!options.settle || presenceOf(row, now) !== "offline" || (row.status_state !== "working" && row.status_state !== "waiting")) return false
+    if (!options.settle || shownPresence(row, now) !== "offline" || (row.status_state !== "working" && row.status_state !== "waiting")) return false
     this.sql.all(`UPDATE endpoints SET status_state = NULL, status_note = NULL WHERE id = ?`, endpoint)
     return true
   }
@@ -1322,6 +1350,7 @@ export class RelayCore {
       `UPDATE endpoints SET connections = 0, hook_seen = CASE WHEN kind = 'agent' AND hook_ended IS NULL THEN MAX(COALESCE(hook_seen, 0), ?) ELSE hook_seen END WHERE connections > 0`,
       this.now() - (LIMITS.hookIdleS - LIMITS.restartGraceS) * 1000,
     )
+    this.sql.all(`UPDATE endpoints SET wakers = 0, waker_left = ? WHERE wakers > 0`, this.now())
   }
 
   whoami(endpoint: string): EndpointView {
@@ -1351,7 +1380,7 @@ export class RelayCore {
     const shown = viewer ? new Set(this.visibleRows(viewer).map((row) => row.id)) : undefined
     const peeker = viewer ?? (filters.peekable === true ? this.byHandle(HUMAN_HANDLE)! : undefined)
     return this.listed()
-      .filter((row) => filters.all || row.connections > 0 || row.kind === "human" || (row.last_seen ?? 0) >= cutoff)
+      .filter((row) => filters.all || row.connections > 0 || row.kind === "human" || (row.last_seen ?? 0) >= cutoff || waking(row, now))
       .filter((row) => !filters.harness || row.harness === filters.harness)
       .filter((row) => !filters.kind || row.kind === filters.kind)
       .filter((row) => !viewer || row.id === viewer.id || this.mayMessage(viewer, row, viewer.kind === "human"))
@@ -1468,6 +1497,29 @@ export class RelayCore {
     return true
   }
 
+  /**
+   * a connection that set the endpoint's wake starts (`live`) or stops counting as its waker. A hook's (`grace`) still counts for
+   * LIMITS.restartGraceS after it closes, while its harness starts the next one
+   */
+  waker(endpoint: string, live: boolean, options: { grace?: boolean } = {}): void {
+    if (live) this.sql.all(`UPDATE endpoints SET wakers = wakers + 1 WHERE id = ?`, endpoint)
+    else {
+      const now = this.now()
+      this.sql.all(
+        `UPDATE endpoints SET wakers = MAX(wakers - 1, 0), waker_left = CASE WHEN ? THEN ? ELSE waker_left END WHERE id = ?`,
+        options.grace ? 1 : 0,
+        now,
+        endpoint,
+      )
+      if (!options.grace) this.lapseWake(endpoint, now)
+    }
+  }
+
+  /** clears a wake no waker holds once a hook waker's grace ran out too: nothing is left to wake the endpoint */
+  private lapseWake(endpoint: string, now: number): void {
+    this.sql.all(`UPDATE endpoints SET wake = NULL WHERE id = ? AND wakers = 0 AND COALESCE(waker_left, 0) < ?`, endpoint, now - LIMITS.restartGraceS * 1000)
+  }
+
   /**
    * a title for the caller's in-process subagent `id` from the description its parent gave it; the subagent's endpoint id when it changed one.
    * It fills only a title nobody set, as an inferred one, and waits for the subagent's claim when it has no endpoint yet
@@ -1579,7 +1631,8 @@ export class RelayCore {
       const target = params.endpoint === undefined ? me : this.resolve(params.endpoint)
       if (actor.kind !== "human" && target.id !== me.id) throw new RelayError("scope_refused", "an agent unlinks only itself")
       if (target.kind !== "agent" || !this.localRow(target)) throw new RelayError("invalid_params", "only a local agent endpoint can be unlinked")
-      if (target.parent_ep === null) throw new RelayError("invalid_params", `${this.address(target)} is a root: it has no parent`)
+      if (target.parent_ep === null && target.parent_addr === null)
+        throw new RelayError("invalid_params", `${this.address(target)} is a root: it has no parent`)
       if (actor.kind !== "human" && this.policy?.defaults?.unlink !== "self")
         throw this.scopeRefused(
           actor,
@@ -1587,6 +1640,14 @@ export class RelayCore {
           { target: this.address(target), reason: "unlink" },
           "unlinking widens a worker's scope: only the human at a terminal unlinks it (policy defaults.unlink: self lets it)",
         )
+      if (target.parent_ep === null) {
+        const from = this.linkedParent(target) ?? target.parent_addr!
+        this.sql.all(`UPDATE endpoints SET parent_addr = NULL, linked = NULL WHERE id = ?`, target.id)
+        this.scopeMemo?.ancestors.clear()
+        this.scopeMemo?.limited.clear()
+        this.audit("unlink", target.id, null, { ...this.actorDetail(actor, me), target: this.address(target), parent: from })
+        return { endpoint: this.whoami(target.id), parent: from }
+      }
       const parent = this.byId(target.parent_ep)
       const from = parent ? this.address(parent) : target.parent_ep
       const shift = target.depth ?? 0
@@ -1611,16 +1672,26 @@ export class RelayCore {
     })
   }
 
-  /** `row`, a root, and its subtree moved under `parent`, a local agent that is neither `row` nor one of its descendants */
+  /**
+   * `row`, a root, and its subtree moved under `parent`, a local agent that is neither `row` nor one of its descendants; a parent on another
+   * machine goes to {@link linkAcross}
+   */
   private link(row: EndpointRow, parent: EndpointRow, by: { by: string; auth: string }): void {
-    if (parent.kind !== "agent" || !this.localRow(parent)) throw new RelayError("invalid_params", "the parent is a local agent endpoint")
+    if (!this.localRow(parent)) {
+      const key = this.linkAcross(row, parent)
+      if (row.parent_addr === key) return
+      if (row.parent_ep !== null || row.parent_addr !== null) throw this.alreadyLinked(row)
+      this.sql.all(`UPDATE endpoints SET parent_addr = ?, linked = ? WHERE id = ?`, key, this.now(), row.id)
+      this.scopeMemo?.ancestors.clear()
+      this.scopeMemo?.limited.clear()
+      this.audit("adopt", row.id, null, { ...by, target: this.address(row), parent: this.address(parent) })
+      return
+    }
+    if (parent.kind !== "agent") throw new RelayError("invalid_params", "the parent is an agent endpoint")
     if (row.parent_ep === parent.id) return
     if (parent.id === row.id || this.ancestorsOf(parent).includes(row.id))
       throw new RelayError("scope_refused", `${this.address(parent)} sits under ${this.address(row)}: a session cannot go under its own descendant`)
-    if (row.parent_ep !== null) {
-      const now = this.byId(row.parent_ep)
-      throw new RelayError("scope_refused", `${this.address(row)} already sits under ${now ? this.address(now) : "another agent"}; unlink it first`)
-    }
+    if (row.parent_ep !== null || row.parent_addr !== null) throw this.alreadyLinked(row)
     const depth = (parent.depth ?? 0) + 1
     const deepest = one<{ d: number | null }>(this.sql, `SELECT MAX(depth) AS d FROM endpoints WHERE tree = ?`, row.id)?.d ?? 0
     if (deepest + depth > LIMITS.depthMax)
@@ -1645,6 +1716,31 @@ export class RelayCore {
     this.audit("adopt", row.id, null, { ...by, target: this.address(row), parent: this.address(parent) })
   }
 
+  /** a link of `row`, which already sits under a parent, to another one */
+  private alreadyLinked(row: EndpointRow): RelayError {
+    const local = row.parent_ep ? this.byId(row.parent_ep) : undefined
+    const now = local ? this.address(local) : row.parent_addr !== null ? (this.linkedParent(row) ?? row.parent_addr) : "another agent"
+    return new RelayError("scope_refused", `${this.address(row)} already sits under ${now}; unlink it first`)
+  }
+
+  /**
+   * the key `<machine>/<handle>` that links `row`, a local agent, under `parent`, an agent on another machine, once the parent is checked; no
+   * inherited or child-default caps come with it. A relay of one machine has no such parent
+   */
+  protected linkAcross(_row: EndpointRow, _parent: EndpointRow): string {
+    throw new RelayError("invalid_params", "the parent is a local agent endpoint")
+  }
+
+  /** whether `a` and `b` are a parent and its child on different machines */
+  protected linkedAcross(_a: EndpointRow, _b: EndpointRow): boolean {
+    return false
+  }
+
+  /** the address of `row`'s parent on another machine, null when it has none; with `shown`, null for a parent outside it */
+  protected linkedParent(_row: EndpointRow, _shown?: Set<string>): string | null {
+    return null
+  }
+
   /**
    * renames an agent in place: its id, mail, threads, status, title and relations stay. An agent renames only itself, and only a root unless
    * the policy's `defaults.rename` is `self`; the human at a terminal renames any local agent. The new handle is valid and held by no other endpoint
@@ -1693,9 +1789,13 @@ export class RelayCore {
       ] as const)
         this.sql.all(`UPDATE ${table} SET ${column} = REPLACE(${column}, ?, ?) WHERE instr(${column}, ?) > 0`, a, b, a)
     }
+    this.renamedHandle(from, handle)
     this.audit("rename", row.id, null, { from, to: handle })
   }
 
+  /** a local agent's handle moved from `from` to `to`: a subclass updates what names it on another machine's rows */
+  protected renamedHandle(_from: string, _to: string): void {}
+
   /**
    * a session leaves: it lets go of its session and token and shows offline, its mail kept; a later join takes it back. An agent leaves only
    * itself, the human at a terminal any local root or linked agent. A spawned worker stays joined while it runs
@@ -1787,7 +1887,7 @@ export class RelayCore {
     const dark = recipients.filter(
       (r) =>
         r.kind === "agent" &&
-        presenceOf(r, now) === "offline" &&
+        shownPresence(r, now) === "offline" &&
         (now - Math.max(r.last_seen ?? 0, r.hook_seen ?? 0) >= ASK_ENDED_GRACE_MS || (r.session === null && r.token_hash === null && r.hook_ended !== null)) &&
         !this.unjoinedSpawn(sender, r.handle, now),
     )
@@ -2047,7 +2147,7 @@ export class RelayCore {
   private reach(sender: EndpointRow, recipient: EndpointRow, offline: boolean, now: number): Reach | undefined {
     if (recipient.kind !== "agent" || !this.localRow(recipient)) return undefined
     const done = recipient.status_state === "done"
-    if ((done || presenceOf(recipient, now) === "offline") && this.unjoinedSpawn(sender, recipient.handle, now)) return "starting"
+    if ((done || shownPresence(recipient, now) === "offline") && this.unjoinedSpawn(sender, recipient.handle, now)) return "starting"
     if (done) return "ended"
     return offline ? "offline" : "running"
   }
@@ -2500,7 +2600,7 @@ export class RelayCore {
         continue
       }
       const row = this.byId(grant.used_by)
-      if (!row || row.status_state === "done" || (presenceOf(row, now) === "offline" && (grant.handback !== null || !pid || !this.alive(pid)))) continue
+      if (!row || row.status_state === "done" || (shownPresence(row, now) === "offline" && (grant.handback !== null || !pid || !this.alive(pid)))) continue
       workers.set(row.id, row)
       if (grant.pushed_at !== null && grant.pushed_at > now - LIMITS.pushGapS * 1000) paced.add(row.id)
     }
@@ -2902,10 +3002,10 @@ export class RelayCore {
       .filter((row) =>
         present
           ? present.includes(row.id)
-          : presenceOf(row, now) !== "offline" || Math.max(row.last_seen ?? 0, row.hook_seen ?? 0, row.hook_ended ?? 0) >= asked.created_at,
+          : shownPresence(row, now) !== "offline" || Math.max(row.last_seen ?? 0, row.hook_seen ?? 0, row.hook_ended ?? 0) >= asked.created_at,
       )
     const gone = (row: EndpointRow): boolean =>
-      presenceOf(row, now) === "offline" &&
+      shownPresence(row, now) === "offline" &&
       ((row.hook_ended ?? 0) >= asked.created_at || row.status_state === "done" || now - Math.max(row.last_seen ?? 0, row.hook_seen ?? 0) >= ASK_ENDED_GRACE_MS)
     if (!rows.length || !rows.every(gone)) return null
     return rows.map((row) => ({ address: this.address(row), state: row.status_state as StatusState | null }))
@@ -3003,15 +3103,24 @@ export class RelayCore {
     }
   }
 
-  /** ends the hook presence of local agent endpoints whose harness process exited without a session_end, as one would */
+  /** ends the hook presence of local agent endpoints whose harness process exited without a session_end, as one would, and lapses wakes whose hook waker never came back */
   endExited(now = this.now()): void {
     for (const row of this.sql.all<EndpointRow>(
       `SELECT * FROM endpoints WHERE kind = 'agent' AND connections = 0 AND hook_seen IS NOT NULL AND process IS NOT NULL`,
     )) {
       const pid = Number(/^pid:(\d+)/.exec(row.process!)?.[1])
       if (!pid || !this.localRow(row) || this.alive(pid)) continue
-      this.sql.all(`UPDATE endpoints SET hook_seen = NULL, hook_ended = ?, session = NULL WHERE id = ? AND connections = 0`, now, row.id)
+      this.sql.all(
+        `UPDATE endpoints SET hook_seen = NULL, hook_ended = ?, session = NULL, wake = CASE WHEN wakers = 0 THEN NULL ELSE wake END WHERE id = ? AND connections = 0`,
+        now,
+        row.id,
+      )
     }
+    for (const row of this.sql.all<EndpointRow>(
+      `SELECT * FROM endpoints WHERE wake IS NOT NULL AND wakers = 0 AND waker_left < ?`,
+      now - LIMITS.restartGraceS * 1000,
+    ))
+      if (this.localRow(row)) this.lapseWake(row.id, now)
   }
 
   /** an agent endpoint left offline drops a working or waiting status, which no one is left to keep current */
@@ -3019,7 +3128,7 @@ export class RelayCore {
     for (const row of this.sql.all<EndpointRow>(
       `SELECT * FROM endpoints WHERE kind = 'agent' AND connections = 0 AND status_state IN ('working', 'waiting')`,
     )) {
-      if (this.localRow(row) && presenceOf(row, now) === "offline")
+      if (this.localRow(row) && shownPresence(row, now) === "offline")
         this.sql.all(`UPDATE endpoints SET status_state = NULL, status_note = NULL WHERE id = ?`, row.id)
     }
   }
@@ -3068,7 +3177,8 @@ export class RelayCore {
     if (params.kind === "session_end") {
       if (own)
         this.sql.all(
-          `UPDATE endpoints SET hook_seen = NULL, hook_ended = ?, session = CASE WHEN connections = 0 THEN NULL ELSE session END WHERE id = ?`,
+          `UPDATE endpoints SET hook_seen = NULL, hook_ended = ?, session = CASE WHEN connections = 0 THEN NULL ELSE session END,
+           wake = CASE WHEN wakers = 0 THEN NULL ELSE wake END WHERE id = ?`,
           now,
           endpoint,
         )
@@ -3780,7 +3890,8 @@ export class RelayCore {
       }
       const note = [`exited ${p.code}`, spender.status_note].filter(Boolean).join("; ").slice(0, LIMITS.noteChars)
       this.sql.all(
-        `UPDATE endpoints SET status_state = 'done', status_note = ?, hook_seen = NULL, hook_ended = ?, session = CASE WHEN connections = 0 THEN NULL ELSE session END WHERE id = ?`,
+        `UPDATE endpoints SET status_state = 'done', status_note = ?, hook_seen = NULL, hook_ended = ?, session = CASE WHEN connections = 0 THEN NULL ELSE session END,
+         wake = CASE WHEN wakers = 0 THEN NULL ELSE wake END WHERE id = ?`,
         note,
         now,
         spender.id,
@@ -4269,6 +4380,7 @@ export class RelayCore {
     return scopeDecision(world, world.node(a.id) ?? this.scopeNode(a), world.node(b.id) ?? this.scopeNode(b), {
       humanAlways: this.defaults().humanAlways,
       solicited,
+      linked: a.id !== b.id && this.linkedAcross(a, b),
       unverified,
       strict,
     })
@@ -5079,7 +5191,7 @@ export class RelayCore {
 
   /** with `shown`, the ids a viewer sees: a parent outside it is null */
   protected view(row: EndpointRow, shown?: Set<string>): EndpointView {
-    const presence = presenceOf(row, this.now())
+    const presence = shownPresence(row, this.now())
     return {
       id: row.id,
       address: this.address(row),
@@ -5098,7 +5210,8 @@ export class RelayCore {
 
   private placeView(row: EndpointRow, shown?: Set<string>): Pick<EndpointView, "parent" | "depth" | "scope"> {
     const parent = row.parent_ep && (!shown || shown.has(row.parent_ep)) ? this.byId(row.parent_ep) : undefined
-    return { parent: parent ? this.address(parent) : null, depth: row.depth ?? 0, scope: presetOf(this.scopeNode(row), this.defaults().symmetric) }
+    const across = !parent && row.parent_ep === null && row.parent_addr ? this.linkedParent(row, shown) : null
+    return { parent: parent ? this.address(parent) : across, depth: row.depth ?? 0, scope: presetOf(this.scopeNode(row), this.defaults().symmetric) }
   }
 
   /** `recipient` names the delivery's endpoint when there is no `seq`: a send to several addresses shows each recipient only itself */
@@ -5315,6 +5428,11 @@ const ANY_PROCESS_KEY = /^pid:\d+(:[A-Za-z0-9:-]{1,64})?$/
  * whether a connecting claim from the harness process `key` may join a session endpoint: no connection holds it, the harness process that last
  * claimed it claims again, and, once a connection held it (a token was handed out), with the same full key, which a recycled pid cannot match
  */
+/** a claim from the very harness process that holds the live `row`, such as a session it restarted in process */
+function reclaims(row: EndpointRow, key: string | null): boolean {
+  return row.connections > 0 && key !== null && row.process === key && PROCESS_KEY.test(key)
+}
+
 function sameProcess(row: EndpointRow, key: string | null): boolean {
   if (row.connections > 0 || key === null || row.process === null) return false
   return row.token_hash === null ? sameHarness(row.process, key) : row.process === key && PROCESS_KEY.test(key)
@@ -5379,6 +5497,17 @@ function presenceOf(row: EndpointRow, now: number): Presence {
   return row.hook_seen >= now - LIMITS.hookIdleS * 1000 ? "idle" : "offline"
 }
 
+/** a wake with a live waker, or a hook waker that left within LIMITS.restartGraceS */
+function waking(row: EndpointRow, now: number): boolean {
+  return wakeOf(row) !== null && (row.wakers > 0 || (row.waker_left ?? 0) >= now - LIMITS.restartGraceS * 1000)
+}
+
+/** the presence an endpoint shows: one its waker can wake is at least idle, though its session's own presence decayed */
+function shownPresence(row: EndpointRow, now: number): Presence {
+  const presence = presenceOf(row, now)
+  return presence === "offline" && waking(row, now) ? "idle" : presence
+}
+
 function pairKey(a: string, b: string): string {
   return a < b ? `${a}|${b}` : `${b}|${a}`
 }

package/src/scopes.ts

@@ -293,19 +293,20 @@ export function relationText(peer: PolicySubject, me: PolicySubject): string {
 /**
  * The scope check for a message from `a` to `b`: `out(a)` admits `b` and `in(b)` admits `a`. Either side the account's human (with `humanAlways`)
  * or the system endpoint passes, except an `unverified` human sender (one without a terminal), which is checked like any unplaced sender; an
- * ancestor of `b` (unless `strict`) and a solicited reply pass both.
+ * ancestor of `b` (unless `strict`), a solicited reply and a parent and child `linked` across machines pass both.
  */
 export function scopeDecision(
   world: ScopeWorld,
   a: ScopeNode,
   b: ScopeNode,
-  options: { humanAlways: boolean; solicited?: boolean; unverified?: boolean; strict?: boolean },
+  options: { humanAlways: boolean; solicited?: boolean; linked?: boolean; unverified?: boolean; strict?: boolean },
 ): ScopeDecision {
   const kinds = [a.subject.kind, b.subject.kind]
   if (kinds.includes("system")) return { allowed: true, reasons: ["the relay itself"] }
   if (options.humanAlways && (b.human || (a.human && !options.unverified))) return { allowed: true, reasons: ["the human is always reachable"] }
   if (!options.strict && isAncestor(a, b)) return { allowed: true, reasons: [`${a.address} is an ancestor of ${b.address}: scopes never stop it`] }
   if (options.solicited) return { allowed: true, reasons: [`a reply to ${b.address}'s message in its thread`] }
+  if (options.linked) return { allowed: true, reasons: [`${a.address} and ${b.address} are parent and child across machines`] }
   const memo: Memo = new Map()
   const out = admits(world, a, "out", b, memo)
   if (!out.ok) return { allowed: false, dir: "out", reasons: [out.why] }