@scp-dev/core 0.1.6 → 0.2.0

package/dist/index.d.ts

@@ -998,11 +998,12 @@ declare function relationText(peer: PolicySubject, me: PolicySubject): string;
 /**
  * The scope check for a message from `a` to `b`: `out(a)` admits `b` and `in(b)` admits `a`. Either side the account's human (with `humanAlways`)
  * or the system endpoint passes, except an `unverified` human sender (one without a terminal), which is checked like any unplaced sender; an
- * ancestor of `b` (unless `strict`) and a solicited reply pass both.
+ * ancestor of `b` (unless `strict`), a solicited reply and a parent and child `linked` across machines pass both.
  */
 declare function scopeDecision(world: ScopeWorld, a: ScopeNode, b: ScopeNode, options: {
     humanAlways: boolean;
     solicited?: boolean;
+    linked?: boolean;
     unverified?: boolean;
     strict?: boolean;
 }): ScopeDecision;
@@ -1085,6 +1086,8 @@ interface EndpointRow {
     /** the root endpoint's id; null for a root */
     tree: string | null;
     parent_ep: string | null;
+    /** a parent on another machine of the account, `<machine>/<handle>`: the row stays a root of its own tree */
+    parent_addr: string | null;
     depth: number | null;
     /** JSON {@link ScopeRules} */
     rules: string | null;
@@ -1359,6 +1362,8 @@ declare class RelayCore {
     waker(endpoint: string, live: boolean, options?: {
         grace?: boolean;
     }): void;
+    /** clears a wake no waker holds once a hook waker's grace ran out too: nothing is left to wake the endpoint */
+    private lapseWake;
     /**
      * a title for the caller's in-process subagent `id` from the description its parent gave it; the subagent's endpoint id when it changed one.
      * It fills only a title nobody set, as an inferred one, and waits for the subagent's claim when it has no endpoint yet
@@ -1403,8 +1408,22 @@ declare class RelayCore {
         endpoint: EndpointView;
         parent: string;
     };
-    /** `row`, a root, and its subtree moved under `parent`, a local agent that is neither `row` nor one of its descendants */
+    /**
+     * `row`, a root, and its subtree moved under `parent`, a local agent that is neither `row` nor one of its descendants; a parent on another
+     * machine goes to {@link linkAcross}
+     */
     private link;
+    /** a link of `row`, which already sits under a parent, to another one */
+    private alreadyLinked;
+    /**
+     * the key `<machine>/<handle>` that links `row`, a local agent, under `parent`, an agent on another machine, once the parent is checked; no
+     * inherited or child-default caps come with it. A relay of one machine has no such parent
+     */
+    protected linkAcross(_row: EndpointRow, _parent: EndpointRow): string;
+    /** whether `a` and `b` are a parent and its child on different machines */
+    protected linkedAcross(_a: EndpointRow, _b: EndpointRow): boolean;
+    /** the address of `row`'s parent on another machine, null when it has none; with `shown`, null for a parent outside it */
+    protected linkedParent(_row: EndpointRow, _shown?: Set<string>): string | null;
     /**
      * renames an agent in place: its id, mail, threads, status, title and relations stay. An agent renames only itself, and only a root unless
      * the policy's `defaults.rename` is `self`; the human at a terminal renames any local agent. The new handle is valid and held by no other endpoint
@@ -1419,6 +1438,8 @@ declare class RelayCore {
     };
     /** the endpoint's handle set to `value`, with the stored `ep:` and `fleet:` selectors that named it */
     private renameRow;
+    /** a local agent's handle moved from `from` to `to`: a subclass updates what names it on another machine's rows */
+    protected renamedHandle(_from: string, _to: string): void;
     /**
      * a session leaves: it lets go of its session and token and shows offline, its mail kept; a later join takes it back. An agent leaves only
      * itself, the human at a terminal any local root or linked agent. A spawned worker stays joined while it runs
@@ -1700,7 +1721,7 @@ declare class RelayCore {
     }): AuditRow[];
     /** drops what expired: deliveries, message bodies past their grace, old guard state and old audit rows */
     sweep(): void;
-    /** ends the hook presence of local agent endpoints whose harness process exited without a session_end, as one would */
+    /** ends the hook presence of local agent endpoints whose harness process exited without a session_end, as one would, and lapses wakes whose hook waker never came back */
     endExited(now?: number): void;
     /** an agent endpoint left offline drops a working or waiting status, which no one is left to keep current */
     private settleOffline;

package/dist/index.js

@@ -558,6 +558,7 @@ function scopeDecision(world, a, b, options) {
   if (options.humanAlways && (b.human || a.human && !options.unverified)) return { allowed: true, reasons: ["the human is always reachable"] };
   if (!options.strict && isAncestor(a, b)) return { allowed: true, reasons: [`${a.address} is an ancestor of ${b.address}: scopes never stop it`] };
   if (options.solicited) return { allowed: true, reasons: [`a reply to ${b.address}'s message in its thread`] };
+  if (options.linked) return { allowed: true, reasons: [`${a.address} and ${b.address} are parent and child across machines`] };
   const memo = /* @__PURE__ */ new Map();
   const out = admits(world, a, "out", b, memo);
   if (!out.ok) return { allowed: false, dir: "out", reasons: [out.why] };
@@ -1338,6 +1339,7 @@ var RelayCore = class {
     for (const [column, type] of [
       ["tree", "TEXT"],
       ["parent_ep", "TEXT"],
+      ["parent_addr", "TEXT"],
       ["depth", "INTEGER"],
       ["rules", "TEXT"],
       ["caps", "TEXT"],
@@ -1942,7 +1944,7 @@ var RelayCore = class {
     }
     caps.caps.push(...this.capsOf(row).caps);
     this.sql.all(
-      `UPDATE endpoints SET tree = ?, parent_ep = ?, depth = ?, rules = ?, caps = ? WHERE id = ?`,
+      `UPDATE endpoints SET tree = ?, parent_ep = ?, parent_addr = NULL, depth = ?, rules = ?, caps = ? WHERE id = ?`,
       parent ? parent.tree ?? parent.id : null,
       parent?.id ?? null,
       depth,
@@ -2195,13 +2197,20 @@ var RelayCore = class {
    */
   waker(endpoint, live, options = {}) {
     if (live) this.sql.all(`UPDATE endpoints SET wakers = wakers + 1 WHERE id = ?`, endpoint);
-    else
+    else {
+      const now = this.now();
       this.sql.all(
         `UPDATE endpoints SET wakers = MAX(wakers - 1, 0), waker_left = CASE WHEN ? THEN ? ELSE waker_left END WHERE id = ?`,
         options.grace ? 1 : 0,
-        this.now(),
+        now,
         endpoint
       );
+      if (!options.grace) this.lapseWake(endpoint, now);
+    }
+  }
+  /** clears a wake no waker holds once a hook waker's grace ran out too: nothing is left to wake the endpoint */
+  lapseWake(endpoint, now) {
+    this.sql.all(`UPDATE endpoints SET wake = NULL WHERE id = ? AND wakers = 0 AND COALESCE(waker_left, 0) < ?`, endpoint, now - LIMITS.restartGraceS * 1e3);
   }
   /**
    * a title for the caller's in-process subagent `id` from the description its parent gave it; the subagent's endpoint id when it changed one.
@@ -2307,7 +2316,8 @@ var RelayCore = class {
       const target = params.endpoint === void 0 ? me : this.resolve(params.endpoint);
       if (actor.kind !== "human" && target.id !== me.id) throw new RelayError("scope_refused", "an agent unlinks only itself");
       if (target.kind !== "agent" || !this.localRow(target)) throw new RelayError("invalid_params", "only a local agent endpoint can be unlinked");
-      if (target.parent_ep === null) throw new RelayError("invalid_params", `${this.address(target)} is a root: it has no parent`);
+      if (target.parent_ep === null && target.parent_addr === null)
+        throw new RelayError("invalid_params", `${this.address(target)} is a root: it has no parent`);
       if (actor.kind !== "human" && this.policy?.defaults?.unlink !== "self")
         throw this.scopeRefused(
           actor,
@@ -2315,6 +2325,14 @@ var RelayCore = class {
           { target: this.address(target), reason: "unlink" },
           "unlinking widens a worker's scope: only the human at a terminal unlinks it (policy defaults.unlink: self lets it)"
         );
+      if (target.parent_ep === null) {
+        const from2 = this.linkedParent(target) ?? target.parent_addr;
+        this.sql.all(`UPDATE endpoints SET parent_addr = NULL, linked = NULL WHERE id = ?`, target.id);
+        this.scopeMemo?.ancestors.clear();
+        this.scopeMemo?.limited.clear();
+        this.audit("unlink", target.id, null, { ...this.actorDetail(actor, me), target: this.address(target), parent: from2 });
+        return { endpoint: this.whoami(target.id), parent: from2 };
+      }
       const parent = this.byId(target.parent_ep);
       const from = parent ? this.address(parent) : target.parent_ep;
       const shift = target.depth ?? 0;
@@ -2338,16 +2356,26 @@ var RelayCore = class {
       return { endpoint: this.whoami(target.id), parent: from };
     });
   }
-  /** `row`, a root, and its subtree moved under `parent`, a local agent that is neither `row` nor one of its descendants */
+  /**
+   * `row`, a root, and its subtree moved under `parent`, a local agent that is neither `row` nor one of its descendants; a parent on another
+   * machine goes to {@link linkAcross}
+   */
   link(row, parent, by) {
-    if (parent.kind !== "agent" || !this.localRow(parent)) throw new RelayError("invalid_params", "the parent is a local agent endpoint");
+    if (!this.localRow(parent)) {
+      const key = this.linkAcross(row, parent);
+      if (row.parent_addr === key) return;
+      if (row.parent_ep !== null || row.parent_addr !== null) throw this.alreadyLinked(row);
+      this.sql.all(`UPDATE endpoints SET parent_addr = ?, linked = ? WHERE id = ?`, key, this.now(), row.id);
+      this.scopeMemo?.ancestors.clear();
+      this.scopeMemo?.limited.clear();
+      this.audit("adopt", row.id, null, { ...by, target: this.address(row), parent: this.address(parent) });
+      return;
+    }
+    if (parent.kind !== "agent") throw new RelayError("invalid_params", "the parent is an agent endpoint");
     if (row.parent_ep === parent.id) return;
     if (parent.id === row.id || this.ancestorsOf(parent).includes(row.id))
       throw new RelayError("scope_refused", `${this.address(parent)} sits under ${this.address(row)}: a session cannot go under its own descendant`);
-    if (row.parent_ep !== null) {
-      const now = this.byId(row.parent_ep);
-      throw new RelayError("scope_refused", `${this.address(row)} already sits under ${now ? this.address(now) : "another agent"}; unlink it first`);
-    }
+    if (row.parent_ep !== null || row.parent_addr !== null) throw this.alreadyLinked(row);
     const depth = (parent.depth ?? 0) + 1;
     const deepest = one(this.sql, `SELECT MAX(depth) AS d FROM endpoints WHERE tree = ?`, row.id)?.d ?? 0;
     if (deepest + depth > LIMITS.depthMax)
@@ -2371,6 +2399,27 @@ var RelayCore = class {
     this.scopeMemo?.limited.clear();
     this.audit("adopt", row.id, null, { ...by, target: this.address(row), parent: this.address(parent) });
   }
+  /** a link of `row`, which already sits under a parent, to another one */
+  alreadyLinked(row) {
+    const local = row.parent_ep ? this.byId(row.parent_ep) : void 0;
+    const now = local ? this.address(local) : row.parent_addr !== null ? this.linkedParent(row) ?? row.parent_addr : "another agent";
+    return new RelayError("scope_refused", `${this.address(row)} already sits under ${now}; unlink it first`);
+  }
+  /**
+   * the key `<machine>/<handle>` that links `row`, a local agent, under `parent`, an agent on another machine, once the parent is checked; no
+   * inherited or child-default caps come with it. A relay of one machine has no such parent
+   */
+  linkAcross(_row, _parent) {
+    throw new RelayError("invalid_params", "the parent is a local agent endpoint");
+  }
+  /** whether `a` and `b` are a parent and its child on different machines */
+  linkedAcross(_a, _b) {
+    return false;
+  }
+  /** the address of `row`'s parent on another machine, null when it has none; with `shown`, null for a parent outside it */
+  linkedParent(_row, _shown) {
+    return null;
+  }
   /**
    * renames an agent in place: its id, mail, threads, status, title and relations stay. An agent renames only itself, and only a root unless
    * the policy's `defaults.rename` is `self`; the human at a terminal renames any local agent. The new handle is valid and held by no other endpoint
@@ -2418,8 +2467,12 @@ var RelayCore = class {
       ])
         this.sql.all(`UPDATE ${table} SET ${column} = REPLACE(${column}, ?, ?) WHERE instr(${column}, ?) > 0`, a, b, a);
     }
+    this.renamedHandle(from, handle);
     this.audit("rename", row.id, null, { from, to: handle });
   }
+  /** a local agent's handle moved from `from` to `to`: a subclass updates what names it on another machine's rows */
+  renamedHandle(_from, _to) {
+  }
   /**
    * a session leaves: it lets go of its session and token and shows offline, its mail kept; a later join takes it back. An agent leaves only
    * itself, the human at a terminal any local root or linked agent. A spawned worker stays joined while it runs
@@ -3593,15 +3646,24 @@ var RelayCore = class {
       if (!root || root.handle.startsWith(GONE_PREFIX) || !seen) this.dropGroup(group.name);
     }
   }
-  /** ends the hook presence of local agent endpoints whose harness process exited without a session_end, as one would */
+  /** ends the hook presence of local agent endpoints whose harness process exited without a session_end, as one would, and lapses wakes whose hook waker never came back */
   endExited(now = this.now()) {
     for (const row of this.sql.all(
       `SELECT * FROM endpoints WHERE kind = 'agent' AND connections = 0 AND hook_seen IS NOT NULL AND process IS NOT NULL`
     )) {
       const pid = Number(/^pid:(\d+)/.exec(row.process)?.[1]);
       if (!pid || !this.localRow(row) || this.alive(pid)) continue;
-      this.sql.all(`UPDATE endpoints SET hook_seen = NULL, hook_ended = ?, session = NULL WHERE id = ? AND connections = 0`, now, row.id);
+      this.sql.all(
+        `UPDATE endpoints SET hook_seen = NULL, hook_ended = ?, session = NULL, wake = CASE WHEN wakers = 0 THEN NULL ELSE wake END WHERE id = ? AND connections = 0`,
+        now,
+        row.id
+      );
     }
+    for (const row of this.sql.all(
+      `SELECT * FROM endpoints WHERE wake IS NOT NULL AND wakers = 0 AND waker_left < ?`,
+      now - LIMITS.restartGraceS * 1e3
+    ))
+      if (this.localRow(row)) this.lapseWake(row.id, now);
   }
   /** an agent endpoint left offline drops a working or waiting status, which no one is left to keep current */
   settleOffline(now) {
@@ -3651,7 +3713,8 @@ var RelayCore = class {
     if (params.kind === "session_end") {
       if (own)
         this.sql.all(
-          `UPDATE endpoints SET hook_seen = NULL, hook_ended = ?, session = CASE WHEN connections = 0 THEN NULL ELSE session END WHERE id = ?`,
+          `UPDATE endpoints SET hook_seen = NULL, hook_ended = ?, session = CASE WHEN connections = 0 THEN NULL ELSE session END,
+           wake = CASE WHEN wakers = 0 THEN NULL ELSE wake END WHERE id = ?`,
           now,
           endpoint
         );
@@ -4280,7 +4343,8 @@ var RelayCore = class {
       }
       const note = [`exited ${p.code}`, spender.status_note].filter(Boolean).join("; ").slice(0, LIMITS.noteChars);
       this.sql.all(
-        `UPDATE endpoints SET status_state = 'done', status_note = ?, hook_seen = NULL, hook_ended = ?, session = CASE WHEN connections = 0 THEN NULL ELSE session END WHERE id = ?`,
+        `UPDATE endpoints SET status_state = 'done', status_note = ?, hook_seen = NULL, hook_ended = ?, session = CASE WHEN connections = 0 THEN NULL ELSE session END,
+         wake = CASE WHEN wakers = 0 THEN NULL ELSE wake END WHERE id = ?`,
         note,
         now,
         spender.id
@@ -4705,6 +4769,7 @@ ${stderr}` : "";
     return scopeDecision(world, world.node(a.id) ?? this.scopeNode(a), world.node(b.id) ?? this.scopeNode(b), {
       humanAlways: this.defaults().humanAlways,
       solicited,
+      linked: a.id !== b.id && this.linkedAcross(a, b),
       unverified,
       strict
     });
@@ -5435,7 +5500,8 @@ ${stderr}` : "";
   }
   placeView(row, shown) {
     const parent = row.parent_ep && (!shown || shown.has(row.parent_ep)) ? this.byId(row.parent_ep) : void 0;
-    return { parent: parent ? this.address(parent) : null, depth: row.depth ?? 0, scope: presetOf(this.scopeNode(row), this.defaults().symmetric) };
+    const across = !parent && row.parent_ep === null && row.parent_addr ? this.linkedParent(row, shown) : null;
+    return { parent: parent ? this.address(parent) : across, depth: row.depth ?? 0, scope: presetOf(this.scopeNode(row), this.defaults().symmetric) };
   }
   /** `recipient` names the delivery's endpoint when there is no `seq`: a send to several addresses shows each recipient only itself */
   envelope(row, seq, recipient) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scp-dev/core",
-  "version": "0.1.6",
+  "version": "0.2.0",
   "description": "Swarm Communication Protocol core: wire types, framing, scopes, policy, judge and the relay core.",
   "license": "Apache-2.0",
   "homepage": "https://scp.dev",

package/src/core.ts

@@ -243,6 +243,8 @@ export interface EndpointRow {
   /** the root endpoint's id; null for a root */
   tree: string | null
   parent_ep: string | null
+  /** a parent on another machine of the account, `<machine>/<handle>`: the row stays a root of its own tree */
+  parent_addr: string | null
   depth: number | null
   /** JSON {@link ScopeRules} */
   rules: string | null
@@ -533,6 +535,7 @@ export class RelayCore {
     for (const [column, type] of [
       ["tree", "TEXT"],
       ["parent_ep", "TEXT"],
+      ["parent_addr", "TEXT"],
       ["depth", "INTEGER"],
       ["rules", "TEXT"],
       ["caps", "TEXT"],
@@ -1203,7 +1206,7 @@ export class RelayCore {
     }
     caps.caps.push(...this.capsOf(row).caps)
     this.sql.all(
-      `UPDATE endpoints SET tree = ?, parent_ep = ?, depth = ?, rules = ?, caps = ? WHERE id = ?`,
+      `UPDATE endpoints SET tree = ?, parent_ep = ?, parent_addr = NULL, depth = ?, rules = ?, caps = ? WHERE id = ?`,
       parent ? (parent.tree ?? parent.id) : null,
       parent?.id ?? null,
       depth,
@@ -1500,13 +1503,21 @@ export class RelayCore {
    */
   waker(endpoint: string, live: boolean, options: { grace?: boolean } = {}): void {
     if (live) this.sql.all(`UPDATE endpoints SET wakers = wakers + 1 WHERE id = ?`, endpoint)
-    else
+    else {
+      const now = this.now()
       this.sql.all(
         `UPDATE endpoints SET wakers = MAX(wakers - 1, 0), waker_left = CASE WHEN ? THEN ? ELSE waker_left END WHERE id = ?`,
         options.grace ? 1 : 0,
-        this.now(),
+        now,
         endpoint,
       )
+      if (!options.grace) this.lapseWake(endpoint, now)
+    }
+  }
+
+  /** clears a wake no waker holds once a hook waker's grace ran out too: nothing is left to wake the endpoint */
+  private lapseWake(endpoint: string, now: number): void {
+    this.sql.all(`UPDATE endpoints SET wake = NULL WHERE id = ? AND wakers = 0 AND COALESCE(waker_left, 0) < ?`, endpoint, now - LIMITS.restartGraceS * 1000)
   }
 
   /**
@@ -1620,7 +1631,8 @@ export class RelayCore {
       const target = params.endpoint === undefined ? me : this.resolve(params.endpoint)
       if (actor.kind !== "human" && target.id !== me.id) throw new RelayError("scope_refused", "an agent unlinks only itself")
       if (target.kind !== "agent" || !this.localRow(target)) throw new RelayError("invalid_params", "only a local agent endpoint can be unlinked")
-      if (target.parent_ep === null) throw new RelayError("invalid_params", `${this.address(target)} is a root: it has no parent`)
+      if (target.parent_ep === null && target.parent_addr === null)
+        throw new RelayError("invalid_params", `${this.address(target)} is a root: it has no parent`)
       if (actor.kind !== "human" && this.policy?.defaults?.unlink !== "self")
         throw this.scopeRefused(
           actor,
@@ -1628,6 +1640,14 @@ export class RelayCore {
           { target: this.address(target), reason: "unlink" },
           "unlinking widens a worker's scope: only the human at a terminal unlinks it (policy defaults.unlink: self lets it)",
         )
+      if (target.parent_ep === null) {
+        const from = this.linkedParent(target) ?? target.parent_addr!
+        this.sql.all(`UPDATE endpoints SET parent_addr = NULL, linked = NULL WHERE id = ?`, target.id)
+        this.scopeMemo?.ancestors.clear()
+        this.scopeMemo?.limited.clear()
+        this.audit("unlink", target.id, null, { ...this.actorDetail(actor, me), target: this.address(target), parent: from })
+        return { endpoint: this.whoami(target.id), parent: from }
+      }
       const parent = this.byId(target.parent_ep)
       const from = parent ? this.address(parent) : target.parent_ep
       const shift = target.depth ?? 0
@@ -1652,16 +1672,26 @@ export class RelayCore {
     })
   }
 
-  /** `row`, a root, and its subtree moved under `parent`, a local agent that is neither `row` nor one of its descendants */
+  /**
+   * `row`, a root, and its subtree moved under `parent`, a local agent that is neither `row` nor one of its descendants; a parent on another
+   * machine goes to {@link linkAcross}
+   */
   private link(row: EndpointRow, parent: EndpointRow, by: { by: string; auth: string }): void {
-    if (parent.kind !== "agent" || !this.localRow(parent)) throw new RelayError("invalid_params", "the parent is a local agent endpoint")
+    if (!this.localRow(parent)) {
+      const key = this.linkAcross(row, parent)
+      if (row.parent_addr === key) return
+      if (row.parent_ep !== null || row.parent_addr !== null) throw this.alreadyLinked(row)
+      this.sql.all(`UPDATE endpoints SET parent_addr = ?, linked = ? WHERE id = ?`, key, this.now(), row.id)
+      this.scopeMemo?.ancestors.clear()
+      this.scopeMemo?.limited.clear()
+      this.audit("adopt", row.id, null, { ...by, target: this.address(row), parent: this.address(parent) })
+      return
+    }
+    if (parent.kind !== "agent") throw new RelayError("invalid_params", "the parent is an agent endpoint")
     if (row.parent_ep === parent.id) return
     if (parent.id === row.id || this.ancestorsOf(parent).includes(row.id))
       throw new RelayError("scope_refused", `${this.address(parent)} sits under ${this.address(row)}: a session cannot go under its own descendant`)
-    if (row.parent_ep !== null) {
-      const now = this.byId(row.parent_ep)
-      throw new RelayError("scope_refused", `${this.address(row)} already sits under ${now ? this.address(now) : "another agent"}; unlink it first`)
-    }
+    if (row.parent_ep !== null || row.parent_addr !== null) throw this.alreadyLinked(row)
     const depth = (parent.depth ?? 0) + 1
     const deepest = one<{ d: number | null }>(this.sql, `SELECT MAX(depth) AS d FROM endpoints WHERE tree = ?`, row.id)?.d ?? 0
     if (deepest + depth > LIMITS.depthMax)
@@ -1686,6 +1716,31 @@ export class RelayCore {
     this.audit("adopt", row.id, null, { ...by, target: this.address(row), parent: this.address(parent) })
   }
 
+  /** a link of `row`, which already sits under a parent, to another one */
+  private alreadyLinked(row: EndpointRow): RelayError {
+    const local = row.parent_ep ? this.byId(row.parent_ep) : undefined
+    const now = local ? this.address(local) : row.parent_addr !== null ? (this.linkedParent(row) ?? row.parent_addr) : "another agent"
+    return new RelayError("scope_refused", `${this.address(row)} already sits under ${now}; unlink it first`)
+  }
+
+  /**
+   * the key `<machine>/<handle>` that links `row`, a local agent, under `parent`, an agent on another machine, once the parent is checked; no
+   * inherited or child-default caps come with it. A relay of one machine has no such parent
+   */
+  protected linkAcross(_row: EndpointRow, _parent: EndpointRow): string {
+    throw new RelayError("invalid_params", "the parent is a local agent endpoint")
+  }
+
+  /** whether `a` and `b` are a parent and its child on different machines */
+  protected linkedAcross(_a: EndpointRow, _b: EndpointRow): boolean {
+    return false
+  }
+
+  /** the address of `row`'s parent on another machine, null when it has none; with `shown`, null for a parent outside it */
+  protected linkedParent(_row: EndpointRow, _shown?: Set<string>): string | null {
+    return null
+  }
+
   /**
    * renames an agent in place: its id, mail, threads, status, title and relations stay. An agent renames only itself, and only a root unless
    * the policy's `defaults.rename` is `self`; the human at a terminal renames any local agent. The new handle is valid and held by no other endpoint
@@ -1734,9 +1789,13 @@ export class RelayCore {
       ] as const)
         this.sql.all(`UPDATE ${table} SET ${column} = REPLACE(${column}, ?, ?) WHERE instr(${column}, ?) > 0`, a, b, a)
     }
+    this.renamedHandle(from, handle)
     this.audit("rename", row.id, null, { from, to: handle })
   }
 
+  /** a local agent's handle moved from `from` to `to`: a subclass updates what names it on another machine's rows */
+  protected renamedHandle(_from: string, _to: string): void {}
+
   /**
    * a session leaves: it lets go of its session and token and shows offline, its mail kept; a later join takes it back. An agent leaves only
    * itself, the human at a terminal any local root or linked agent. A spawned worker stays joined while it runs
@@ -3044,15 +3103,24 @@ export class RelayCore {
     }
   }
 
-  /** ends the hook presence of local agent endpoints whose harness process exited without a session_end, as one would */
+  /** ends the hook presence of local agent endpoints whose harness process exited without a session_end, as one would, and lapses wakes whose hook waker never came back */
   endExited(now = this.now()): void {
     for (const row of this.sql.all<EndpointRow>(
       `SELECT * FROM endpoints WHERE kind = 'agent' AND connections = 0 AND hook_seen IS NOT NULL AND process IS NOT NULL`,
     )) {
       const pid = Number(/^pid:(\d+)/.exec(row.process!)?.[1])
       if (!pid || !this.localRow(row) || this.alive(pid)) continue
-      this.sql.all(`UPDATE endpoints SET hook_seen = NULL, hook_ended = ?, session = NULL WHERE id = ? AND connections = 0`, now, row.id)
+      this.sql.all(
+        `UPDATE endpoints SET hook_seen = NULL, hook_ended = ?, session = NULL, wake = CASE WHEN wakers = 0 THEN NULL ELSE wake END WHERE id = ? AND connections = 0`,
+        now,
+        row.id,
+      )
     }
+    for (const row of this.sql.all<EndpointRow>(
+      `SELECT * FROM endpoints WHERE wake IS NOT NULL AND wakers = 0 AND waker_left < ?`,
+      now - LIMITS.restartGraceS * 1000,
+    ))
+      if (this.localRow(row)) this.lapseWake(row.id, now)
   }
 
   /** an agent endpoint left offline drops a working or waiting status, which no one is left to keep current */
@@ -3109,7 +3177,8 @@ export class RelayCore {
     if (params.kind === "session_end") {
       if (own)
         this.sql.all(
-          `UPDATE endpoints SET hook_seen = NULL, hook_ended = ?, session = CASE WHEN connections = 0 THEN NULL ELSE session END WHERE id = ?`,
+          `UPDATE endpoints SET hook_seen = NULL, hook_ended = ?, session = CASE WHEN connections = 0 THEN NULL ELSE session END,
+           wake = CASE WHEN wakers = 0 THEN NULL ELSE wake END WHERE id = ?`,
           now,
           endpoint,
         )
@@ -3821,7 +3890,8 @@ export class RelayCore {
       }
       const note = [`exited ${p.code}`, spender.status_note].filter(Boolean).join("; ").slice(0, LIMITS.noteChars)
       this.sql.all(
-        `UPDATE endpoints SET status_state = 'done', status_note = ?, hook_seen = NULL, hook_ended = ?, session = CASE WHEN connections = 0 THEN NULL ELSE session END WHERE id = ?`,
+        `UPDATE endpoints SET status_state = 'done', status_note = ?, hook_seen = NULL, hook_ended = ?, session = CASE WHEN connections = 0 THEN NULL ELSE session END,
+         wake = CASE WHEN wakers = 0 THEN NULL ELSE wake END WHERE id = ?`,
         note,
         now,
         spender.id,
@@ -4310,6 +4380,7 @@ export class RelayCore {
     return scopeDecision(world, world.node(a.id) ?? this.scopeNode(a), world.node(b.id) ?? this.scopeNode(b), {
       humanAlways: this.defaults().humanAlways,
       solicited,
+      linked: a.id !== b.id && this.linkedAcross(a, b),
       unverified,
       strict,
     })
@@ -5139,7 +5210,8 @@ export class RelayCore {
 
   private placeView(row: EndpointRow, shown?: Set<string>): Pick<EndpointView, "parent" | "depth" | "scope"> {
     const parent = row.parent_ep && (!shown || shown.has(row.parent_ep)) ? this.byId(row.parent_ep) : undefined
-    return { parent: parent ? this.address(parent) : null, depth: row.depth ?? 0, scope: presetOf(this.scopeNode(row), this.defaults().symmetric) }
+    const across = !parent && row.parent_ep === null && row.parent_addr ? this.linkedParent(row, shown) : null
+    return { parent: parent ? this.address(parent) : across, depth: row.depth ?? 0, scope: presetOf(this.scopeNode(row), this.defaults().symmetric) }
   }
 
   /** `recipient` names the delivery's endpoint when there is no `seq`: a send to several addresses shows each recipient only itself */

package/src/scopes.ts

@@ -293,19 +293,20 @@ export function relationText(peer: PolicySubject, me: PolicySubject): string {
 /**
  * The scope check for a message from `a` to `b`: `out(a)` admits `b` and `in(b)` admits `a`. Either side the account's human (with `humanAlways`)
  * or the system endpoint passes, except an `unverified` human sender (one without a terminal), which is checked like any unplaced sender; an
- * ancestor of `b` (unless `strict`) and a solicited reply pass both.
+ * ancestor of `b` (unless `strict`), a solicited reply and a parent and child `linked` across machines pass both.
  */
 export function scopeDecision(
   world: ScopeWorld,
   a: ScopeNode,
   b: ScopeNode,
-  options: { humanAlways: boolean; solicited?: boolean; unverified?: boolean; strict?: boolean },
+  options: { humanAlways: boolean; solicited?: boolean; linked?: boolean; unverified?: boolean; strict?: boolean },
 ): ScopeDecision {
   const kinds = [a.subject.kind, b.subject.kind]
   if (kinds.includes("system")) return { allowed: true, reasons: ["the relay itself"] }
   if (options.humanAlways && (b.human || (a.human && !options.unverified))) return { allowed: true, reasons: ["the human is always reachable"] }
   if (!options.strict && isAncestor(a, b)) return { allowed: true, reasons: [`${a.address} is an ancestor of ${b.address}: scopes never stop it`] }
   if (options.solicited) return { allowed: true, reasons: [`a reply to ${b.address}'s message in its thread`] }
+  if (options.linked) return { allowed: true, reasons: [`${a.address} and ${b.address} are parent and child across machines`] }
   const memo: Memo = new Map()
   const out = admits(world, a, "out", b, memo)
   if (!out.ok) return { allowed: false, dir: "out", reasons: [out.why] }