@songsid/agend 2.3.0-beta.22 → 2.3.0-beta.23

package/dist/tunnel/named-diagnostics.js

@@ -0,0 +1,52 @@
+/** #2344: private vendor text is evidence for a closed reason, never a user/log message. */
+import { redactDiagnostics } from "../diagnostic-redaction.js";
+export const NAMED_TUNNEL_FAILURE_MESSAGES = {
+    "named-auth-failed": "Named tunnel credentials were refused; copy only the connector token from Cloudflare and set it again.",
+    "named-route-missing": "The named hostname did not reach a published application; check this tunnel's hostname, DNS and published application route.",
+    "named-hostname-mismatch": "The named hostname answered with a different page; check that its published application points to AgEnD's origin URL.",
+    "named-origin-unreachable": "Cloudflare could not reach the local origin; check the published application's origin URL and port.",
+    "named-connection-failed": "The named tunnel could not connect to Cloudflare; check network, DNS and firewall access, then retry.",
+};
+export function namedTunnelFailureMessage(kind) {
+    return Object.hasOwn(NAMED_TUNNEL_FAILURE_MESSAGES, kind) ? NAMED_TUNNEL_FAILURE_MESSAGES[kind] : undefined;
+}
+const CONNECTION_CODES = new Set(["EAI_AGAIN", "ETIMEDOUT", "ECONNRESET", "ECONNREFUSED", "ENETUNREACH", "EHOSTUNREACH", "UND_ERR_CONNECT_TIMEOUT", "UND_ERR_SOCKET"]);
+/** Node fetch wraps DNS/connect failures in cause; AggregateError can contain several address attempts. */
+export function classifyNamedTunnelProbeError(error, token) {
+    const pending = [error], seen = new Set(), messages = [];
+    let connection = false;
+    // Bound both nested errors and text; cycles or a large address list must not turn a failed probe into work.
+    while (pending.length && seen.size < 8) {
+        const next = pending.shift();
+        if (!next || typeof next !== "object" || seen.has(next))
+            continue;
+        seen.add(next);
+        const node = next;
+        if (node.code === "ENOTFOUND")
+            return "named-route-missing";
+        if (typeof node.code === "string" && CONNECTION_CODES.has(node.code))
+            connection = true;
+        if (typeof node.message === "string")
+            messages.push(node.message.slice(0, 8 * 1024));
+        if (node.cause)
+            pending.push(node.cause);
+        if (Array.isArray(node.errors))
+            pending.push(...node.errors.slice(0, 8));
+    }
+    return connection ? "named-connection-failed" : classifyNamedTunnelOutput(messages.join("\n"), token);
+}
+/** Exact configured credentials and the shared redactor's credential shapes are removed before interpretation. */
+export function classifyNamedTunnelOutput(output, token) {
+    const exactRemoved = token ? output.split(token).join("[REDACTED]") : output;
+    const clean = redactDiagnostics("cloudflared diagnostics: " + exactRemoved.slice(-64 * 1024), { keepIdentifiers: true });
+    if (/\b(?:invalid|unauthorized|unauthorised|expired|revoked)\b.{0,100}\b(?:token|credentials?|tunnel)\b|\b(?:token|credentials?)\b.{0,100}\b(?:not valid|invalid|unauthorized|unauthorised|expired|revoked)\b|\bauthentication (?:failed|error)\b/i.test(clean))
+        return "named-auth-failed";
+    if (/\b(?:no|missing) (?:ingress|published application) (?:rules?|routes?)\b|\bno ingress rules\b/i.test(clean))
+        return "named-route-missing";
+    if (/\bunable to reach the origin service\b|\b(?:origin|127\.0\.0\.1|localhost)\b.{0,160}\b(?:connection refused|ECONNREFUSED)\b/i.test(clean))
+        return "named-origin-unreachable";
+    if (/\b(?:failed to (?:dial|connect|resolve)|unable to (?:dial|connect|resolve)|no such host|network is unreachable|i\/o timeout|connection timed out|connect timeout|context deadline exceeded|EAI_AGAIN|ENOTFOUND|ETIMEDOUT|ECONNREFUSED|ECONNRESET|ENETUNREACH|EHOSTUNREACH)\b/i.test(clean))
+        return "named-connection-failed";
+    return undefined;
+}
+//# sourceMappingURL=named-diagnostics.js.map

package/dist/tunnel/named-diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"named-diagnostics.js","sourceRoot":"","sources":["../../src/tunnel/named-diagnostics.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,mBAAmB,EAAE,wGAAwG;IAC7H,qBAAqB,EAAE,8HAA8H;IACrJ,yBAAyB,EAAE,uHAAuH;IAClJ,0BAA0B,EAAE,qGAAqG;IACjI,yBAAyB,EAAE,uGAAuG;CAC1H,CAAC;AAEX,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,OAAO,MAAM,CAAC,MAAM,CAAC,6BAA6B,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAAC,IAA8B,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACxI,CAAC;AAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,yBAAyB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAEvK,2GAA2G;AAC3G,MAAM,UAAU,6BAA6B,CAAC,KAAc,EAAE,KAAa;IACzE,MAAM,OAAO,GAAc,CAAC,KAAK,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,EAAU,EAAE,QAAQ,GAAa,EAAE,CAAC;IACtF,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,4GAA4G;IAC5G,OAAO,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAClE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,IAAI,GAAG,IAAgF,CAAC;QAC9F,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,qBAAqB,CAAC;QAC5D,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,UAAU,GAAG,IAAI,CAAC;QACxF,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QACrF,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,UAAU,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,yBAAyB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;AACxG,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,yBAAyB,CAAC,MAAc,EAAE,KAAa;IACrE,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7E,MAAM,KAAK,GAAG,iBAAiB,CAAC,2BAA2B,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IACzH,IAAI,+OAA+O,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,mBAAmB,CAAC;IAC5R,IAAI,+FAA+F,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,qBAAqB,CAAC;IAC9I,IAAI,8HAA8H,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,0BAA0B,CAAC;IAClL,IAAI,+QAA+Q,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,yBAAyB,CAAC;IAClU,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/tunnel/types.d.ts

@@ -12,9 +12,10 @@
  * serve, and `docs/design/web-terminal-tunnel-provider.zh-TW.md` (sol) for the
  * original provider design.
  */
+import type { NamedTunnelFailureKind } from "./named-diagnostics.js";
 export type TunnelVisibility = "public" | "tailnet" | "loopback" | "manual";
 /** Why a provider cannot run, in bounded terms — never a vendor error string. */
-export type TunnelErrorKind = "binary-missing" | "binary-not-executable" | "not-logged-in" | "spawn-failed" | "transport-failed" | "no-url"
+export type TunnelErrorKind = NamedTunnelFailureKind | "binary-missing" | "binary-not-executable" | "not-logged-in" | "spawn-failed" | "transport-failed" | "no-url"
 /** #1767: Cloudflare refused to provision a quick tunnel with HTTP 429 (rate limited for this network). */
  | "rate-limited"
 /** #1767: Cloudflare refused to provision a quick tunnel with another HTTP error. */

package/dist/tunnel/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/tunnel/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AA2GH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAE9B;IAGA;IAJX,YACW,SAA0B,EACnC,OAAe;IACf,6EAA6E;IACpE,WAA+E;QAExF,KAAK,CAAC,OAAO,CAAC,CAAC;QALN,cAAS,GAAT,SAAS,CAAiB;QAG1B,gBAAW,GAAX,WAAW,CAAoE;QAGxF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AACjD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AACjD,qFAAqF;AACrF,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/tunnel/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AA8GH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAE9B;IAGA;IAJX,YACW,SAA0B,EACnC,OAAe;IACf,6EAA6E;IACpE,WAA+E;QAExF,KAAK,CAAC,OAAO,CAAC,CAAC;QALN,cAAS,GAAT,SAAS,CAAiB;QAG1B,gBAAW,GAAX,WAAW,CAAoE;QAGxF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AACjD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AACjD,qFAAqF;AACrF,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC"}

package/dist/types.d.ts

@@ -274,6 +274,11 @@ export interface FleetDefaults extends Partial<InstanceConfig> {
     daily_summary?: DailySummaryConfig;
     /** Daily General-topic tips and update-completion tip. Default: true. */
     tips?: boolean;
+    /** #2246 step 3: the task board's fleet-level settings. */
+    task_board?: {
+        /** The daily summary's time in the fleet's zone ("HH:MM", 24 h), or "off". Default "09:00". */
+        summary_at?: string;
+    };
     webhooks?: WebhookConfig[];
 }
 export type RotationSnapshotEvent = {
@@ -341,6 +346,10 @@ export interface FleetTemplate {
 }
 /** Web UI feature toggles (fleet.yaml `web:` section). */
 export interface WebConfig {
+    /** Canvas Worker effects are experimental and off unless explicitly enabled. Ambient effects are independent. */
+    experimental?: {
+        canvas_worker?: boolean;
+    };
     /** Only menu availability; every exposure requires explicit admin consent. */
     public_link?: {
         allow_public?: boolean;

package/dist/ui/app-effects.js

@@ -5,6 +5,7 @@ import { navStore } from "/assets/app-nav.js";
 import { onPrefsChanged } from "/assets/app-prefs.js";
 import { resolvedMode, themesStore, themesShown } from "/assets/app-themes.js";
 import { ownerCssLifecycle, safeMode } from "/assets/owner-css.js";
+import { canvasWorkerEnabled } from "/assets/feature-flags.js";
 import { constrainedDevice } from "/assets/effect-policy.js";
 import { createAppEffectRuntime } from "/assets/effect-app-runtime.js";
 import { effectBootstrapReady } from "/assets/effect-frame.js";
@@ -19,6 +20,7 @@ export function getAppEffects(host = window) { const value = owners.get(host); r
 
 /** Boot once with the page's Chat store, including when the first visible panel is Fleet. */
 export function startAppEffects({ store, window: host = window, factories = {} } = {}) {
+  if (!canvasWorkerEnabled()) return null;
   const existing = owners.get(host);
   if (existing) { if (!existing.dead) existing.bindStore(store); return getAppEffects(host); }
   const playbackIdentity = effectPlaybackIdentity(host), ownerIdentity = chatEffectIdentity(host);
@@ -26,7 +28,7 @@ export function startAppEffects({ store, window: host = window, factories = {} }
   const doc = host.document, releases = [], ended = new Set(), updates = new Set(), trialUpdates = new Set(); let replyOff = null, replyStore = null, regions = null, cursor = null, cursorStamp = null, trialControl = null, trialIntent = null, trialHint = ownerIdentity ? null : false, trialSerial = 0, trialStamp = null, chatBinding = null;
   const safe = fn => { try { return fn(); } catch { return null; } };
   const hold = off => { if (entry.dead) safe(() => off?.()); else releases.push(off); };
-  const entry = { dead: false, api: null,
+  const entry = { dead: false, api: null, disposed: null,
     cursorSnapshot: () => cursor?.snapshot() ?? { status: "unavailable", id: null },
     gates: () => context(),
     subscribe(fn) { if (typeof fn !== "function" || entry.dead) return () => {}; updates.add(fn); return () => updates.delete(fn); },
@@ -74,11 +76,14 @@ export function startAppEffects({ store, window: host = window, factories = {} }
       if (!handle) chatBinding = null;
       return handle;
     },
-    dispose() {
-      if (entry.dead) return; entry.dead = true;
-      safe(() => trialControl?.dispose()); safe(() => entry.api?.dispose()); safe(() => replyOff?.()); replyOff = null; replyStore = null;
+    dispose(restartable = false) {
+      if (entry.dead) return entry.disposed; entry.dead = true;
+      if (restartable && owners.get(host) === entry) owners.delete(host);
+      safe(() => trialControl?.dispose()); const coreDisposed = safe(() => entry.api?.dispose(restartable === true)); safe(() => replyOff?.()); replyOff = null; replyStore = null;
       for (const off of releases.splice(0)) safe(off);
       updates.clear(); trialUpdates.clear(); const listeners = [...ended]; ended.clear(); for (const fn of listeners) safe(fn);
+      entry.disposed = Promise.all([coreDisposed, safe(() => cursor?.whenDisposed?.())]);
+      return entry.disposed;
     },
   };
   owners.set(host, entry); // Reentrant setup never constructs another owner.
@@ -210,6 +215,7 @@ export function startAppEffects({ store, window: host = window, factories = {} }
     hold(navStore.subscribe(value => { if (entry.dead || value.seq === navSeq) return; navSeq = value.seq; trialControl?.stop(); chatBinding = null; entry.api.detachChat(); syncCursor(); }));
     hold(appStore.subscribe(value => {
       if (entry.dead) return;
+      if (!canvasWorkerEnabled()) { entry.dispose(true); return; }
       if (value.connection === "ended") { entry.dispose(); return; }
       const guestNext = guestChatVersion(value), chatChanged = value.themesRev !== revision || guestNext !== guestRevision, ownerChanged = value.prefsRev !== prefsRevision;
       revision = value.themesRev; prefsRevision = value.prefsRev; guestRevision = guestNext;

package/dist/ui/chat-strings.js

@@ -72,6 +72,8 @@ register("chat", {
     pvPage: "Page", pvCode: "Code", pvReload: "Reload", pvClose: "Close the panel", pvBack: "Back to the chat", pvResize: "Resize the preview panel",
     pvNewer: "A newer version is in the reply from {0}.", pvNewerShow: "Show it", pvPanelIdle: "Click Preview to run it here.",
     lbLabel: "Image: {0}", lbLabelNoName: "Image", lbClose: "Close", lbOpenOriginal: "Open original", lbPrev: "Previous image", lbNext: "Next image", lbCount: "{0} / {1}",
+    // #2333: zoom in the lightbox.
+    lbZoomIn: "Zoom in (+)", lbZoomOut: "Zoom out (−)", lbZoomLevel: "{0}% — click for fit or actual size (0 / 1)", lbFitWidth: "Fit width (W)",
     // #1554: preview.js's words (its English is the fallback there), and the server's reasons by code.
     pvWhyOptin: "HTML previews are off. Allow them from this card's ⋯ menu or Settings → Preferences.",
     pvWhyOptinPanel: "HTML previews are off.",
@@ -209,6 +211,7 @@ register("chat", {
     pvPage: "頁面", pvCode: "程式碼", pvReload: "重新載入", pvClose: "關閉面板", pvBack: "回到對話", pvResize: "調整預覽面板寬度",
     pvNewer: "{0} 的回覆裡有較新的版本。", pvNewerShow: "顯示", pvPanelIdle: "按「預覽」在這裡執行。",
     lbLabel: "圖片：{0}", lbLabelNoName: "圖片", lbClose: "關閉", lbOpenOriginal: "開啟原圖", lbPrev: "上一張", lbNext: "下一張", lbCount: "{0} / {1}",
+    lbZoomIn: "放大（+）", lbZoomOut: "縮小（−）", lbZoomLevel: "{0}%：點一下切換「符合視窗」與「實際大小」（0 / 1）", lbFitWidth: "符合寬度（W）",
     pvWhyOptin: "還沒允許 HTML 預覽。可從這張卡片的 ⋯ 選單或「設定 → 偏好設定」允許。",
     pvWhyOptinPanel: "還沒允許 HTML 預覽。",
     pvWhyNever: "這台裝置在這個工作階段已關閉預覽。",

package/dist/ui/chat-thread.js

@@ -8,7 +8,7 @@
 // Unrelated updates (a new message, another message's tick) stop nothing (#1306 §6.2, #1408 §4).
 import "./chat-render.js";
 import "./preview.js";
-import { effectTrialMessage } from "./effect-trial-offer.js";
+import { canvasWorkerEnabled, onCanvasWorkerChange, onCanvasMetadataChange, readCanvasTrialMessage } from "/assets/feature-flags.js";
 import { loadHtmlAttachment } from "./html-attachment.js";
 import { chatTime, chatTimeFull, onDayChange } from "./chat-time.js";
 import { textLinkSegments } from "/assets/app-route.js";
@@ -132,8 +132,8 @@ export function createThread(list, scroller, opts) {
     // #1770: the label ("17:38", "Yesterday 17:38", "10/11 17:38") depends on today, so it is not part of the html a node
     // is kept by: it is written into the node (timeLabels) — crossing midnight relabels in place and reloads no preview.
     const time = x.ts ? `<span class="time" data-ts="${escAttr(x.ts)}" title="${escAttr(chatTimeFull(x.ts))}"></span>` : `<span class="time"></span>`;
-    const trial = effectTrialMessage(x);
-    if (trial) return trialHtml(trial, time, x);
+    const trial = readCanvasTrialMessage(x);
+    if (trial) return canvasWorkerEnabled() ? trialHtml(trial, time, x) : "";
     if (x.role === "status") return statusHtml(x, time);
     const u = opts.isUser(x);
     // renderMarkdown escapes the whole text before it adds any tag of its own (chat-render.js).
@@ -186,7 +186,8 @@ export function createThread(list, scroller, opts) {
   }
   function armTrials() {
     if (trialTimer !== null) clearTimeout(trialTimer); trialTimer = null;
-    const now = trialNow(), next = msgs.map(x => effectTrialMessage(x)).filter(x => x && x.expiresAt > now).reduce((n, x) => Math.min(n, x.expiresAt), Infinity);
+    if (!canvasWorkerEnabled()) return;
+    const now = trialNow(), next = msgs.map(x => readCanvasTrialMessage(x)).filter(x => x && x.expiresAt > now).reduce((n, x) => Math.min(n, x.expiresAt), Infinity);
     if (Number.isFinite(next)) trialTimer = setTimeout(() => { trialTimer = null; render(msgs); }, Math.max(1, Math.min(2147483647, next - now)));
   }
   /**
@@ -649,7 +650,11 @@ export function createThread(list, scroller, opts) {
   }
   /** Put the messages from startIndex() on in the list (nodes reused when unchanged). Returns how many are new. */
   function draw(drawOpts) {
-    const shown = msgs.slice(startIndex());
+    const shown = msgs.slice(startIndex()).filter(message => {
+      // Volatile host offer records are hidden off and while their on-only parser is loading.
+      const hostOffer = message?.role === "status" && message.sender === "agend" && Object.hasOwn(message, "effectTrial") && message.effectTrial != null;
+      return !hostOffer || canvasWorkerEnabled() && readCanvasTrialMessage(message) !== undefined;
+    });
     const keep = new Set(shown.map(msgKey));
     for (const [k, v] of nodes) if (!keep.has(k)) { stopIn(v.node); v.node.remove(); nodes.delete(k); }
     let prev = null, added = 0;
@@ -764,7 +769,7 @@ export function createThread(list, scroller, opts) {
       if (m && opts.clickReplyButton) opts.clickReplyButton(m[1], Number(m[2]));
     } else if (act === "effectTrial") {
       // Only the current host-produced keyed card and a real local click can request admission. No token is read from DOM.
-      const key = el.dataset.arg, row = msgs.find(x => msgKey(x) === key), owner = nodes.get(key), node = owner?.node, offer = effectTrialMessage(row);
+      const key = el.dataset.arg, row = msgs.find(x => msgKey(x) === key), owner = nodes.get(key), node = owner?.node, offer = readCanvasTrialMessage(row);
       if (PUBLIC_LINK() || e.defaultPrevented || e.isTrusted !== true || owner?.trialButton !== el || el.className !== "btn btn-sm effect-trial-start" || !node?.contains(el) || el.closest(".effect-trial-offer")?.getAttribute("data-trust") !== "thread-control"
         || !offer || trialNow() >= offer.expiresAt) return;
       if (trialStatus(row) === "ready" && opts.canTryEffect?.(row) === true) opts.startEffectTrial?.(row);
@@ -816,8 +821,10 @@ export function createThread(list, scroller, opts) {
     if (ro) { ro.observe(list); ro.observe(sc); }
   }
   /** `own`: only this thread's previews stop (a thread let go while another chat is in view); else every one, as leaving. */
+  const redrawFeature = () => { if (!disposed && !parked) render(msgs); };
+  const featureOff = onCanvasWorkerChange(redrawFeature), metadataOff = onCanvasMetadataChange(redrawFeature);
   function dispose(own = false) {
-    disposed = true;
+    disposed = true; featureOff(); metadataOff();
     if (!parked) watchReader(scroller, false);
     if (trialTimer !== null) clearTimeout(trialTimer); trialTimer = null;
     if (ro) ro.disconnect();

package/dist/ui/effect-trial-offer.js

@@ -1,31 +1,2 @@
-/** #1629: closed host display metadata. Neither this object nor its token grants a trial read. */
-const KEYS = ["v", "offer", "id", "title", "expiresAt"], ID = /^[0-9a-f]{32}$/;
-const FORBIDDEN = /(?!\u200d)[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u;
-const VISIBLE = /[^\p{M}\p{C}\p{Z}\u115f\u1160\u3164\uffa0\u2800]/u;
-let graphemes = null;
-export function checkEffectTrialOffer(value) {
-  try {
-    if (!value || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) return null;
-    const keys = Reflect.ownKeys(value);
-    if (keys.length !== KEYS.length || keys.some(k => typeof k !== "string" || !KEYS.includes(k))) return null;
-    const x = Object.create(null);
-    for (const key of KEYS) {
-      const d = Object.getOwnPropertyDescriptor(value, key);
-      if (!d || !("value" in d) || !d.enumerable) return null;
-      x[key] = d.value;
-    }
-    if (x.v !== 1 || typeof x.offer !== "string" || !ID.test(x.offer) || typeof x.id !== "string" || !ID.test(x.id)
-      || typeof x.title !== "string" || x.title.length > 400 || x.title.normalize("NFC") !== x.title || x.title.trim() !== x.title
-      || FORBIDDEN.test(x.title) || !VISIBLE.test(x.title) || !Number.isSafeInteger(x.expiresAt) || x.expiresAt < 0) return null;
-    graphemes ??= new Intl.Segmenter(undefined, { granularity: "grapheme" });
-    let count = 0; for (const _part of graphemes.segment(x.title)) if (++count > 40) return null;
-    if (count < 1) return null;
-    return Object.freeze({ v: 1, offer: x.offer, id: x.id, title: x.title, expiresAt: x.expiresAt });
-  } catch { return null; }
-}
-/** Role and sender are host fields, never inferred from a message's text. Start must separately authorize. */
-export function effectTrialMessage(message) {
-  if (!message || message.role !== "status" || message.sender !== "agend" || typeof message.instance !== "string"
-    || message.instance.length < 1 || message.instance.length > 128) return null;
-  return checkEffectTrialOffer(message.effectTrial);
-}
+// On-only Canvas Worker display validation; ordinary chat boot imports no parser.
+export { checkEffectTrialOffer, effectTrialMessage } from "/assets/effect-display-metadata.js";

package/dist/ui/effects-waker.js

@@ -1,70 +1,2 @@
-// #2193: the web effects runtime stays unloaded until there is something it could play for this viewer. Before that,
-// this module is all there is: a few store subscriptions comparing fields the page already has (no observer, listener,
-// timer, layer or request). The runtime itself (app-effects.js and everything it imports) is the reviewed code,
-// unchanged; it is imported and started here, once, the first time one of these holds:
-//   - the open chat has Canvas Worker placements: its status row's effect_chat_v (the hash of its placements, taken
-//     before the server's region filtering — so it can only wake for nothing, never miss something) is not the hash of
-//     an empty list;
-//   - the signed-in person has a personal effect slot chosen (fx.page/header/sidebar/box/cursor — app-prefs);
-//   - an agent's "Try" offer is shown (wakeEffects() from the chat), or Settings saved a personal effect.
-// Once started it stays for the page: the runtime is one episode per window (a disposed one cannot start again).
-// Owner CSS is not the runtime's: owner-css.js is installed by the app shell and works with the runtime never loaded.
-import { appStore } from "/assets/app-store.js";
-import { navStore } from "/assets/app-nav.js";
-import { ownerEffectsChosen, onOwnerEffectsChanged } from "/assets/app-prefs.js";
-
-/** effect_chat_v of a chat with no placements: sha256(JSON.stringify([])), first 32 hex (fleet-manager's status row). */
-export const EMPTY_CHAT_EFFECTS = "4f53cda18c2baa0c0354bb5f9a3ecbe5";
-
-let mod = null, waking = null, chatStore = null, started = false;
-const awakeListeners = new Set();
-
-/** Whether `name`'s chat has Canvas Worker placements (as the status rows say). */
-export function chatHasEffects(name, app = appStore.get()) {
-  const v = name ? app.instances?.find(i => i.name === name)?.effect_chat_v : undefined;
-  return typeof v === "string" && /^[a-f0-9]{32}$/.test(v) && v !== EMPTY_CHAT_EFFECTS;
-}
-
-/** The running effects owner, or null while dormant (or when it could not start: as getAppEffects always was). */
-export function getAppEffects(host) { return mod ? mod.getAppEffects(host) : null; }
-
-/** Whether the runtime has been asked to start on this page. */
-export function effectsAwake() { return waking !== null; }
-/** Whether its module has loaded (started, or found it could not: getAppEffects() then says which). */
-export function effectsLoaded() { return mod !== null; }
-
-/** Called once the runtime has started (or immediately when it already has). Returns the unsubscribe. */
-export function onEffectsAwake(fn) {
-  if (typeof fn !== "function") return () => {};
-  if (mod) { try { fn(); } catch { /* a listener's error is its own */ } return () => {}; }
-  awakeListeners.add(fn); return () => awakeListeners.delete(fn);
-}
-
-/** Load and start the runtime (once per page). Resolves to the owner, or null when it could not start. */
-export function wakeEffects() {
-  if (waking) return waking;
-  waking = import("./app-effects.js").then(m => {
-    mod = m;
-    const owner = chatStore ? m.startAppEffects({ store: chatStore }) : null;
-    for (const fn of [...awakeListeners]) { try { fn(); } catch { /* the rest still hear */ } }
-    awakeListeners.clear();
-    return owner;
-  }, () => null);
-  return waking;
-}
-
-/** Wake when the open chat has placements or the person has a personal effect. */
-function check() {
-  if (waking) return;
-  const route = navStore.get().route;
-  if ((route?.panel === "chat" && chatHasEffects(route.instance)) || ownerEffectsChosen()) void wakeEffects();
-}
-
-/** Boot (once per page, with the Chat store the runtime binds to). Starts nothing but the watch. */
-export function startEffectsWaker({ store }) {
-  chatStore = store;
-  if (started) return;
-  started = true;
-  appStore.subscribe(check); navStore.subscribe(check); onOwnerEffectsChanged(check);
-  check();
-}
+// Compatibility entry for opted-in effect consumers. Product boot uses the neutral feature policy.
+export { EMPTY_CHAT_EFFECTS, chatHasEffects, getAppEffects, effectsAwake, effectsLoaded, onEffectsAwake, wakeEffects, startEffectsWaker } from "/assets/feature-flags.js";

package/dist/ui/fleet-task-card.js

@@ -8,7 +8,7 @@ import { appStore, useStore } from "/assets/app-store.js";
 import { Dialog } from "/assets/ui-dialog.js";
 import { Icon } from "/assets/ui-icons.js";
 import { toast } from "/assets/ui-toast.js";
-import { StatusPill, answerBlocked, askText, boardApi, currentWork, errorText, followsSubs, moveCard, notesForPeople, relTime, wrapUpText } from "./fleet-task-common.js";
+import { StatusPill, Who, answerBlocked, askText, boardApi, currentWork, errorText, followsSubs, moveCard, notesForPeople, relTime, wrapUpText } from "./fleet-task-common.js";
 
 register("taskcard", {
   en: {
@@ -132,7 +132,7 @@ export function CardDialog({ id, tick, projects, writable = true, place = null,
   }
 
   if (missing || !detail) {
-    return html`<${Dialog} title=${id} onClose=${onClose} wide><p class="muted">${missing ? t("taskcard.missing", id) : t("taskcard.loading")}</p></${Dialog}>`;
+    return html`<${Dialog} title=${id} onClose=${onClose} wide drawer><p class="muted">${missing ? t("taskcard.missing", id) : t("taskcard.loading")}</p></${Dialog}>`;
   }
 
   const { card, parent, children } = detail;
@@ -166,7 +166,7 @@ export function CardDialog({ id, tick, projects, writable = true, place = null,
     } catch { /* no clipboard */ }
   }
 
-  return html`<${Dialog} title=${`${card.id} · ${t(`tasks.${card.kind}`)}`} onClose=${onClose} wide label=${`${card.id} ${card.title}`}>
+  return html`<${Dialog} title=${`${card.id} · ${t(`tasks.${card.kind}`)}`} onClose=${onClose} wide drawer label=${`${card.id} ${card.title}`}>
     <div class="tc">
       <div class="tc-head">
         ${writable ? html`<${InlineTitle} value=${card.title} version=${card.version} onSave=${(title, base) => save({ title }, base)} />` : html`<h3 class="tc-title">${card.title}</h3>`}
@@ -195,7 +195,7 @@ export function CardDialog({ id, tick, projects, writable = true, place = null,
 
       <dl class="tc-meta">
         <dt>${t("taskcard.assignee")}</dt>
-        <dd><span class="tb-who">${card.assignee || t("taskcard.nobody")}</span>
+        <dd><${Who} name=${card.assignee} empty=${t("taskcard.nobody")} />
           ${writable ? html`<select class="tb-select" value="\u0000pick" aria-label=${t("taskcard.assignee")} onChange=${(e) => { const v = e.target.value; e.target.value = "\u0000pick"; void chooseAssignee(v); }}>
             <option value="\u0000pick" disabled hidden>${t("taskcard.change")}</option>
             ${card.assignee ? html`<option value="\u0000none">${t("taskcard.unassign")}</option>` : null}
@@ -207,7 +207,7 @@ export function CardDialog({ id, tick, projects, writable = true, place = null,
           if (!now) return html`<span class="muted">${card.status === "review" ? t("tasks.review") : t("taskcard.nowNone")}</span>`;
           return now.cards.map((c) => html`<button key=${c.id} type="button" class="tc-now" onClick=${() => onOpen(c.id)} title=${c.title}>
             <span class=${`tb-now-label st-${now.tone}`}>${t(now.label)}</span><span class="tb-code">${c.id}</span><span class="tc-child-title">${c.title}</span>
-            <span class="tb-who">${c.assignee || t("tasks.nobody")}</span></button>`);
+            <${Who} name=${c.assignee} empty=${t("tasks.nobody")} /></button>`);
         })()}</dd>` : null}
         <dt>${t("taskcard.dispatcher")}</dt>
         <dd><span class="tb-who" title=${t("taskcard.dispatcherHint")}>${!card.dispatcher ? t("taskcard.dispatcherNone")

package/dist/ui/fleet-task-common.js

@@ -1,9 +1,10 @@
 // The task board's shared pieces (Fleet › Tasks): its words, the numbers a project shows, the requests, asking for a
-// reason, moving a card, and the small marks (status pill, progress bar). fleet-tasks.js draws the board and
+// reason, moving a card, and the small marks (status pill, progress bar, who). fleet-tasks.js draws the board and
 // fleet-task-card.js one card; both use these. No style attribute anywhere (the CSP): bars are SVG rects.
 import { html, useEffect, useState } from "/assets/app-html.js";
 import { t, register, lang } from "/assets/app-i18n.js";
-import { createStore, useStore } from "/assets/app-store.js";
+import { appStore, createStore, useStore } from "/assets/app-store.js";
+import { identityOf, paintIdentity, useIdentityColors } from "/assets/identity-color.js";
 import { Dialog } from "/assets/ui-dialog.js";
 import { toast } from "/assets/ui-toast.js";
 
@@ -14,7 +15,8 @@ register("tasks", {
     sizeS: "Small", sizeM: "Medium", sizeL: "Large", sizeNone: "Not sized",
     projects: "Projects", noProject: "No project", noProjectDesc: "Tasks the fleet opened outside any project",
     newProject: "New project", newMain: "Main task", archived: "Archived", archive: "Archive", restore: "Restore",
-    rename: "Rename or describe", projectName: "Name", projectDesc: "Description", create: "Create", save: "Save", cancel: "Cancel",
+    rename: "Edit project", projectName: "Name", projectDesc: "Description",
+    projectLead: "Lead instance", projectLeadNone: "None — General", projectLeadHint: "Cards of this project that wait for you (to confirm, or blocked) get their buttons in the lead's channel, unless an instance handed them out (then in its channel).", projectLeadGone: "{0} (no longer in the fleet)", projectLeadChip: "lead: {0}", create: "Create", save: "Save", cancel: "Cancel",
     projectCreated: "Project created", projectSaved: "Project saved",
     noProjects: "No projects yet", noProjectsHint: "A project groups related work — create one, then open main tasks in it.",
     mainCount: "{0} main tasks", mainOne: "1 main task", waiting: "{0} waiting for you", blockedN: "{0} blocked", lastActivity: "Last change {0}",
@@ -56,7 +58,7 @@ register("tasks", {
     "err.too_long": "{0} is too long: {1} characters, at most {2}", "err.state_lines": "State is at most {0} lines (it has {1})",
     "err.acceptance_empty": "An acceptance item cannot be empty", "err.acceptance_max": "At most {0} acceptance items",
     "err.acceptance_no_item": "There is no acceptance item {0} (there are {1})", "err.project_not_found": "There is no project “{0}”",
-    "err.project_name_empty": "A project needs a name", "err.project_name_digits": "A project's name cannot be only digits",
+    "err.project_name_empty": "A project needs a name", "err.project_name_digits": "A project's name cannot be only digits", "err.lead_not_instance": "The lead must be one of the fleet's instances",
     "err.project_name_taken": "There is already a project named “{0}”", "err.project_archived": "Project “{0}” is archived: it takes no new main tasks",
     "err.card_not_found": "There is no card {0}", "err.title_empty": "A card needs a title", "err.scope_main_only": "Scope is for main tasks only",
     "err.blocked_reason_not_blocked": "Only a blocked card has a blocked reason", "err.block_reason": "Blocking needs a reason: who has to answer what",
@@ -72,6 +74,13 @@ register("tasks", {
     "note.review_waiting": "{0} “{1}”: every sub task is done — it waits for your confirmation",
     "note.back_to": "{0} has unfinished sub tasks again: it is back to {1}", "note.deps_done": "{0}'s dependencies are all done: it can start",
     "note.deps_unmet": "Note: {0} not done yet",
+    // #2246 step 3: who works on what (fleet-task-work.js)
+    instances: "Instances", instancesTip: "The fleet's instances and what each works on", instancesHead: "{0} instance(s) · {1} working",
+    workSentBack: "Sent back", workDoing: "In progress", workBlocked: "Blocked", workReview: "Waiting for you", workMain: "Owns",
+    workReady: "Can start", workWaiting: "Waiting on", workSubs: "sub tasks {0}/{1}", workClaimable: "nobody's: can be taken",
+    workWaitsFor: "waits for {0}", workNone: "Nothing on the board", workNewComments: "Comments it has not read yet",
+    workOutside: "Not in the fleet", workFailed: "Could not read who works on what: {0}", workJoin: ", ",
+    detailsBoard: "Task board",
   },
   "zh-TW": {
     open: "待辦", claimed: "進行中", blocked: "卡住", review: "待確認", done: "完成", cancelled: "取消",
@@ -79,7 +88,8 @@ register("tasks", {
     sizeS: "小", sizeM: "中", sizeL: "大", sizeNone: "未定",
     projects: "專案", noProject: "未分類", noProjectDesc: "fleet 在專案以外開的 task",
     newProject: "新增專案", newMain: "主任務", archived: "已封存", archive: "封存", restore: "恢復",
-    rename: "改名或改說明", projectName: "名稱", projectDesc: "說明", create: "建立", save: "儲存", cancel: "取消",
+    rename: "編輯專案", projectName: "名稱", projectDesc: "說明",
+    projectLead: "負責的 instance", projectLeadNone: "無（General）", projectLeadHint: "這個專案裡等你處理的卡片（待確認或卡住）會在負責 instance 的頻道顯示按鈕；若卡片是某個 instance 派出的，則顯示在派出者的頻道。", projectLeadGone: "{0}（已不在 fleet 中）", projectLeadChip: "負責：{0}", create: "建立", save: "儲存", cancel: "取消",
     projectCreated: "專案已建立", projectSaved: "專案已儲存",
     noProjects: "還沒有專案", noProjectsHint: "專案是一組相關的工作：先建立專案，再在裡面開主任務。",
     mainCount: "{0} 個主任務", mainOne: "1 個主任務", waiting: "等你確認 {0}", blockedN: "卡住 {0}", lastActivity: "最後動態 {0}",
@@ -121,7 +131,7 @@ register("tasks", {
     "err.too_long": "{0}太長：{1} 字，上限 {2} 字", "err.state_lines": "目前狀態最多 {0} 行（現在 {1} 行）",
     "err.acceptance_empty": "驗收條件不能是空的", "err.acceptance_max": "驗收條件最多 {0} 項",
     "err.acceptance_no_item": "驗收條件沒有第 {0} 項（共 {1} 項）", "err.project_not_found": "找不到專案「{0}」",
-    "err.project_name_empty": "專案名稱不能是空的", "err.project_name_digits": "專案名稱不能只有數字",
+    "err.project_name_empty": "專案名稱不能是空的", "err.project_name_digits": "專案名稱不能只有數字", "err.lead_not_instance": "負責人必須是 fleet 裡的 instance",
     "err.project_name_taken": "已經有專案叫「{0}」", "err.project_archived": "專案「{0}」已封存，不能再開主任務",
     "err.card_not_found": "找不到 {0}", "err.title_empty": "標題不能是空的", "err.scope_main_only": "範圍只用在主任務",
     "err.blocked_reason_not_blocked": "只有卡住的卡才有卡住原因", "err.block_reason": "卡住要寫原因：需要誰回答什麼",
@@ -137,6 +147,13 @@ register("tasks", {
     "note.review_waiting": "{0}「{1}」的子任務都完成了，等你確認",
     "note.back_to": "{0} 又有沒完成的子任務，已回到{1}", "note.deps_done": "{0} 的相依都完成了，可以開始",
     "note.deps_unmet": "提醒：{0} 還沒完成",
+    // #2246 step 3：誰在做什麼（fleet-task-work.js）
+    instances: "Instance", instancesTip: "fleet 有哪些 instance、各在做什麼", instancesHead: "{0} 個 · 工作中 {1}",
+    workSentBack: "被退回", workDoing: "進行中", workBlocked: "卡住", workReview: "待確認", workMain: "負責",
+    workReady: "可以開始", workWaiting: "等前置", workSubs: "子任務 {0}/{1}", workClaimable: "沒人負責，可領",
+    workWaitsFor: "等 {0}", workNone: "看板上沒有它的卡", workNewComments: "有它還沒看過的留言",
+    workOutside: "不在 fleet 裡", workFailed: "讀不到工作清單：{0}", workJoin: "、",
+    detailsBoard: "任務看板",
   },
 });
 
@@ -312,7 +329,9 @@ export const boardApi = {
   move: (id, to, input = {}) => boardCall("POST", `/ui/tasks/cards/${enc(id)}/move`, { to, ...input }),
   reorder: (id, after, before) => boardCall("POST", `/ui/tasks/cards/${enc(id)}/reorder`, { after, before }),
   search: (q) => boardCall("GET", `/ui/tasks/search?q=${enc(q)}`),
-  createProject: (name, description) => boardCall("POST", "/ui/tasks/projects", { name, description }),
+  /** #2246 step 3: each instance's work (its `task mine`), or one instance's. */
+  work: (instance) => boardCall("GET", `/ui/tasks/work${instance ? `?instance=${enc(instance)}` : ""}`),
+  createProject: (name, description, leadInstance) => boardCall("POST", "/ui/tasks/projects", { name, description, ...(leadInstance ? { leadInstance } : {}) }),
   updateProject: (id, patch) => boardCall("POST", `/ui/tasks/projects/${id}`, patch),
 };
 
@@ -439,6 +458,21 @@ export function StatusPill({ status }) {
   return html`<span class=${`tb-pill st-${status}`}>${t(`tasks.${status}`)}</span>`;
 }
 
+/**
+ * Who a card is with, as taskhall shows it: a round initial, then the name. An instance's initial takes its identity
+ * colour (#1958, the sidebar's), painted through the CSSOM; a person's, or anyone not in the fleet, stays grey.
+ */
+export function Who({ name, title, empty = "—" }) {
+  const { instances } = useStore(appStore);
+  useIdentityColors();
+  if (!name) return html`<span class="tb-person none"><span class="tb-who">${empty}</span></span>`;
+  const it = (instances || []).find((i) => i.name === name);
+  const id = it ? identityOf(it) : null;
+  return html`<span class="tb-person" title=${title || name}>
+    <span class="tb-av idc" aria-hidden="true" ref=${(el) => paintIdentity(el, id)}>${initialOf(name)}</span><span class="tb-who">${name}</span></span>`;
+}
+const initialOf = (name) => (Array.from(name.trim())[0] || "?").toLocaleUpperCase();
+
 /** A per-device preference (localStorage may be unavailable: then nothing is remembered). */
 export function readStored(key, fallback) {
   try { const v = localStorage.getItem(key); return v === null ? fallback : v; } catch { return fallback; }

package/dist/ui/fleet-task-work.js

@@ -0,0 +1,107 @@
+// #2246 step 3: who works on what on the task board — each instance's cards as its `task mine` reads them (GET
+// /ui/tasks/work, the server's myWork): the board's Instance list, a drawer by team as taskhall's, and the block on an
+// instance's Details page. A card opens on the board. No style attribute anywhere (the CSP).
+import { html, useEffect, useState } from "/assets/app-html.js";
+import { t } from "/assets/app-i18n.js";
+import { appStore, useStore } from "/assets/app-store.js";
+import { Dialog } from "/assets/ui-dialog.js";
+import { Icon } from "/assets/ui-icons.js";
+import { Skeleton } from "/assets/ui-states.js";
+import { GroupMark, InstanceAvatar, dotLabel, dotState, groupKind, groupLabel, groupOf, namesOf, namesStore } from "/assets/instance-nav.js";
+import { Who, boardApi, errorText } from "./fleet-task-common.js";
+
+const LABEL = { back: "tasks.workSentBack", doing: "tasks.workDoing", blocked: "tasks.workBlocked", review: "tasks.workReview", main: "tasks.workMain", ready: "tasks.workReady", waiting: "tasks.workWaiting" };
+
+/**
+ * An instance's work as lines, in taskhall's order: what it works on, is blocked on, waits on the person for, the main
+ * tasks it coordinates, what it can start, what waits for other cards. A card sent back to it says so instead.
+ */
+export function workLines(w) {
+  const back = new Set(w.sentBack || []), unread = new Set(w.newComments || []);
+  const line = (kind, card, note = "") => ({ kind: kind !== "main" && back.has(card.id) ? "back" : kind, card, note, unread: unread.has(card.id) });
+  return [
+    ...(w.doing || []).map((c) => line("doing", c)),
+    ...(w.blocked || []).map((c) => line("blocked", c)),
+    ...(w.review || []).map((c) => line("review", c)),
+    ...(w.mains || []).map((c) => line("main", c, c.progress && c.progress.total ? t("tasks.workSubs", c.progress.done, c.progress.total) : "")),
+    ...(w.ready || []).map((c) => line("ready", c, c.assignee ? "" : t("tasks.workClaimable"))),
+    ...(w.waiting || []).map((c) => line("waiting", c, t("tasks.workWaitsFor", (c.unmetDeps || []).join(t("tasks.workJoin"))))),
+  ];
+}
+
+export function WorkLines({ lines, onOpen }) {
+  if (!lines.length) return html`<p class="muted tw-none">${t("tasks.workNone")}</p>`;
+  return html`<ul class="tw-lines">${lines.map((l) => html`<li key=${`${l.kind}:${l.card.id}`}>
+    <button type="button" class="tw-line" title=${`${l.card.id} ${l.card.title}`} onClick=${() => onOpen(l.card.id)}>
+      <span class=${`tw-kind k-${l.kind}`}>${t(LABEL[l.kind])}</span><span class="tb-code">${l.card.id}</span><span class="tw-title">${l.card.title}</span>
+      ${l.note ? html`<span class="muted tw-note">${l.note}</span>` : null}
+      ${l.unread ? html`<span class="tw-unread" title=${t("tasks.workNewComments")} aria-label=${t("tasks.workNewComments")}><${Icon} name="chat" size=${13} /></span>` : null}
+    </button></li>`)}</ul>`;
+}
+
+const OUTSIDE = "\u0000outside";
+/** Groups as the sidebar orders them: teams, then tags, then the rest; names nobody in the fleet has last. */
+const groupRank = (g) => (g === OUTSIDE ? 3 : groupKind(g) === "team" ? 0 : groupKind(g) === "tag" ? 1 : 2);
+
+/** The board's Instance list: every instance by team, working ones first, each with its cards. Read again on each board change. */
+export function InstancesDrawer({ tick, onClose, onOpen }) {
+  const { instances, exec, awaiting } = useStore(appStore);
+  useStore(namesStore);                                   // the sidebar's Names choice: display name or instance name first
+  const [work, setWork] = useState(null);
+  const [error, setError] = useState("");
+  useEffect(() => {
+    let live = true;
+    boardApi.work().then((d) => { if (live) { setWork(d.instances || []); setError(""); } }, (e) => { if (live) setError(errorText(e)); });
+    return () => { live = false; };
+  }, [tick]);
+  const byName = new Map((instances || []).map((i) => [i.name, i]));
+  const rows = (work || []).map((w) => {
+    const it = byName.get(w.name);
+    return { w, it, state: it ? dotState(it, exec[w.name], awaiting[w.name]) : null, lines: workLines(w) };
+  });
+  // Working first, then those with cards, then the running ones; by name.
+  const rank = (r) => (r.state === "working" ? 0 : r.lines.length ? 1 : r.it && r.it.status === "running" ? 2 : 3);
+  rows.sort((a, b) => rank(a) - rank(b) || a.w.name.localeCompare(b.w.name));
+  const groups = new Map();
+  for (const r of rows) {
+    const g = r.it ? groupOf(r.it) : OUTSIDE;
+    if (!groups.has(g)) groups.set(g, []);
+    groups.get(g).push(r);
+  }
+  const ordered = [...groups].sort(([a], [b]) => groupRank(a) - groupRank(b));
+  const working = rows.filter((r) => r.state === "working").length;
+  return html`<${Dialog} title=${t("tasks.instances")} onClose=${onClose} wide drawer>
+    <div class="tw">
+      ${work ? html`<p class="muted tw-head">${t("tasks.instancesHead", rows.length, working)}</p>` : null}
+      ${error ? html`<p class="tw-error" role="alert">${t("tasks.workFailed", error)}</p>` : null}
+      ${!work && !error ? html`<${Skeleton} lines=${4} />` : null}
+      ${ordered.map(([g, list]) => html`<section key=${g} class="tw-group">
+        <h3 class="tw-group-head">${g === OUTSIDE ? t("tasks.workOutside") : html`<${GroupMark} group=${g} />${groupLabel(g)}`}<span class="tb-count">${list.length}</span></h3>
+        ${list.map((r) => html`<div key=${r.w.name} class="tw-inst">
+          <div class="tw-inst-head">
+            ${r.it ? html`<${InstanceAvatar} it=${r.it} state=${r.state} />` : html`<${Who} name=${r.w.name} />`}
+            ${r.it ? (() => { const n = namesOf(r.it); return html`<span class="tw-name" title=${r.w.name}>${n.primary}</span>${n.secondary ? html`<span class="muted tw-alt">${n.secondary}</span>` : null}`; })() : null}
+            ${r.state ? html`<span class="muted tw-state">${dotLabel(r.state)}</span>` : null}
+          </div>
+          ${r.it && r.it.description ? html`<p class="muted tw-desc">${r.it.description}</p>` : null}
+          <${WorkLines} lines=${r.lines} onOpen=${onOpen} />
+        </div>`)}
+      </section>`)}
+    </div>
+  </${Dialog}>`;
+}
+
+/** An instance's Details page: its cards, read once when the page opens (the page reads nothing recurring, #1374). */
+export function InstanceBoardWork({ name, onOpen }) {
+  const [work, setWork] = useState(null);
+  const [error, setError] = useState("");
+  useEffect(() => {
+    let live = true;
+    setWork(null); setError("");
+    boardApi.work(name).then((d) => { if (live) setWork((d.instances || [])[0] || { name }); }, (e) => { if (live) setError(errorText(e)); });
+    return () => { live = false; };
+  }, [name]);
+  return html`<section class="card d-board"><h3>${t("tasks.detailsBoard")}</h3>
+    ${error ? html`<p class="note">${t("tasks.workFailed", error)}</p>` : !work ? html`<${Skeleton} lines=${2} />` : html`<${WorkLines} lines=${workLines(work)} onOpen=${onOpen} />`}
+  </section>`;
+}