@typetorch/framework 0.4.0 → 0.5.0

package/README.md

@@ -152,8 +152,18 @@ export class CoinService extends Module implements OnStart {
 - **Dev menu:** devs (Studio, project members, dev badge) get a DEV button, `Ctrl+Shift+D` and `/tt dev`: artifact
   (with how long the server and client generations have run, the server's uptime and the build's age), server status,
   logs (server, own client, other players' clients), client and server dex, network stats, module state, a branch and
-  build picker (Server > Branch) and a Claude prompt. Prod-channel servers are read-only. The window can be dragged by
-  its header and resized from its corner (double-tap the header to reset).
+  build picker (Server > Branch) and a Claude prompt. The sidebar, top to bottom: Artifact, Server, Network, Modules,
+  Manage, Logs, Dex, Claude. The window can be dragged by its header and resized from its corner (double-tap the
+  header to reset).
+- **Server TPS (framework 0.4.2, kernel 0.4.2):** Server > Status has a *TPS* line next to Memory and Lua heap: the
+  last minute's average, its slowest second and the physics FPS (`59.9 avg, 52.0 min, physics 60`; the warning colour
+  under 50 on average). Older kernels show `needs kernel 0.4.2`. The same numbers ride on fleet heartbeats (the
+  explorer's fleet table).
+- **Dev-only tools (framework 0.4.1, `devtools/access.ts`):** Claude, Logs > Upload, Dex edits on the server, Network
+  packet blocking and the hot-swap sound work under dev rules (private, reserved and Studio servers on a dev branch)
+  for every dev, and on a public server an owner switched to a dev branch (Server > Branch) for owners only. Everywhere
+  else the menu is read-only, with a short reason: "Dev branch only", "Owners only on public servers", "Owner-switched
+  servers only". The rules themselves don't change (`TypeTorch.channel`, signatures, owner-only rollbacks).
 - **Panes and windows (dev menu):** every page shows in a pane with a small header: tap the title to pick another
   page, or use Split right, Split down, Open in new window and Close. Drag the line between two panes to resize them.
   The sidebar opens pages in the focused pane (the highlighted one; tap a pane to focus it). Floating windows move by
@@ -171,8 +181,8 @@ export class CoinService extends Module implements OnStart {
   strings (cut), numbers, booleans, nil, datatypes through `tostring`, an Instance as its full path, a Player as its
   name, `function`, `thread`, buffer sizes. Nothing is ever called (raw reads only: no metamethods, no getters); a
   value that is its own ancestor shows as a cycle. A key filter (open nodes stay listed), Refresh and Auto (every 2 s).
-  Server state comes from the op `state.inspect` (rate-limited, size-capped): devs on dev-channel servers, owners only
-  on prod-effective servers, since server state can hold player data.
+  Server state comes from the op `state.inspect` (rate-limited, size-capped): owners everywhere, other devs where the
+  dev-only tools are open to them, since server state can hold player data.
 - **Logs > Upload:** sends the logs shown (Server: this server's log ring; Client: your own client's; Others: the
   picked player's client) to the dev PC paired in the Claude tab, which saves them under `<repo>/.typetorch/logs/`.
   No Claude run, no prompt quota. Not paired: "Pair in the Claude tab first".
@@ -182,11 +192,12 @@ export class CoinService extends Module implements OnStart {
   verified head). A public switch lasts for that server's lifetime and is never stored, so new servers still boot the
   signed prod head. Others see "Join", which moves only them to a reserved server. Manage > Servers "Load a build..."
   does the same for this server, the ticked servers or a share of one branch (A/B pins), with one status line under
-  the list.
+  the list. A public server an owner switched to a dev branch opens the dev-only tools (Claude too) to owners.
 - **Owners and devs:** two roles (no admins: an older kernel's or typetorch.json's "admin" counts as a dev). The Manage
   group (Players, Servers, Bans) is for owners only.
-- **Remote Claude** (dev-channel servers only): while `typetorch remote-claude` (`@typetorch/dev-server`) runs on a dev's machine, allowlisted
-  devs prompt Claude Code from the Claude tab. Each dev pairs once by pasting the pairing code printed by
+- **Remote Claude** (a dev-only tool: dev rules, or owners on a public server an owner switched to a dev branch):
+  while `typetorch remote-claude` (`@typetorch/dev-server`) runs on a dev's machine, allowlisted devs prompt Claude
+  Code from the Claude tab. Each dev pairs once by pasting the pairing code printed by
   typetorch-dev-server; the game server keeps the session URL and the tokens in memory and never sends them to clients.
   No Roblox secret is needed.
 

package/out/analytics/SCHEMA.md

@@ -26,7 +26,7 @@ Integers are written with every digit (never exponent notation).
 | `seq` | int64 | That artifact's deploy seq (`0` when unknown) |
 | `branch` | string | Server branch |
 | `channel` | string | Effective channel: `prod` or `dev` |
-| `dev` | string | `desktop`, `phone`, `tablet`, `console`, `vr`, `unknown` (from the client's hello; `unknown` for server-only events and until the client reports) |
+| `dev` | string | The session's device class: `desktop`, `phone`, `tablet`, `console`, `vr`, `unknown`. Set once per session from the client's first hello (`unknown` for server-only events and until the client reports; frameworks after 0.4.2 keep it when a later hello says otherwise). How it is decided: the `session` / `device` row below |
 | `newp` | bool | The event belongs to the player's first-ever session |
 | `state` | string | The player's state **after** this event: `zone:<z>\|screen:<s>\|activity:<a>`, empty parts left out (`""` when nothing is known). Server-only events: `activity:<server activity>` or `""` |
 | `exp` | string | JSON object of the player's active experiments, `{"onboarding":"short"}`; `{}` when none |
@@ -58,7 +58,7 @@ First-ever-session detail, one row per packed chunk.
 | kind | name | props |
 |---|---|---|
 | session | `join` | `from`: `direct` (Home, search, sorts: Roblox doesn't say), `teleport` (same game), `teleport_game` (another game), `referral` (invite/referral link), `share` (launch data), `follow` (followed someone); `ctx?` (GameJoinContext.JoinSource name); `tp?` (had teleport data); `party?` (players teleported along); `age` (account age: `<1d`, `1-7d`, `7-30d`, `30-90d`, `90-365d`, `1-3y`, `3y+`); `prem` (Premium); `country?` (ISO code); `friends` (how many of the player's friends are in the server: one friend-list lookup per join, at most 10 pages, `0` when it fails); `ret` (days since the last visit, `-1` first visit or unknown); `late?` (the engine started over 60 s after the join). `t` is the join time |
-| session | `device` (src client) | `input` (`kbm`, `touch`, `gamepad`, `vr`, `unknown`), `w`, `h` (viewport points), `touch`, `kb`, `mouse`, `pad`, `vr`. Once per session |
+| session | `device` (src client) | `dev?` (the device class, as the `dev` column; frameworks after 0.4.2, older ones leave it out), `input` (`kbm`, `touch`, `gamepad`, `vr`, `unknown`), `w`, `h` (viewport points), `touch`, `kb`, `mouse`, `pad`, `vr`. Once per session. The class (Roblox gives game scripts no OS): `vr` when VRService.VREnabled; `console` when GuiService:IsTenFootInterface(); touch without a keyboard: `tablet` when the viewport's short side is 600 points or more, else `phone` (the first hello waits up to 2 s for a real viewport); a keyboard or mouse: `desktop` (touch laptops, tablets with a keyboard); else `unknown` |
 | session | `leave` | `secs` (session length), `why`: `left`, `shutdown`, `gone` (left while no generation ran the engine), `swap60?` (left within 60 s of a hot swap) |
 | tech | `server` | Every `techEvery` s: `fps` (physics), `hb` (Heartbeat rate), `mem` (MB, 10s), `players`, `ping50?`, `ping90?` (ms), `q`, `qr` (queued events, recordings), `dropped`, `sent`, `fails`, `health?`, `errors?` (kernel 0.3.2 health) |
 | tech | `client` (src client) | Every `techEvery` s: `fps`, `mem` (MB, 10s), `ping?` (ms) |

package/out/analytics/client.luau

@@ -26,6 +26,7 @@ local CHUNK_SECONDS = _protocol.CHUNK_SECONDS
 local CHUNK_TARGET_BYTES = _protocol.CHUNK_TARGET_BYTES
 local CLIENT_BATCH_BYTES = _protocol.CLIENT_BATCH_BYTES
 local CLIENT_BATCH_MAX = _protocol.CLIENT_BATCH_MAX
+local deviceClass = _protocol.deviceClass
 local isEventName = _protocol.isEventName
 local _props = TS.import(script, script.Parent, "props")
 local encodeProps = _props.encodeProps
@@ -60,23 +61,28 @@ local IGNORED_GUIS = {
 }
 --* A screen that closes and opens again within this many seconds (ResetOnSpawn) never left. 
 local SCREEN_DEBOUNCE = 1
-local function deviceInfo()
+--* The camera's viewport in points (0 x 0 without a camera). 
+local function viewportSize()
 	local camera = Workspace.CurrentCamera
-	local viewport = if camera then camera.ViewportSize else Vector2.new(0, 0)
+	return if camera then camera.ViewportSize else Vector2.new(0, 0)
+end
+--* Seconds the first hello waits for a real viewport (a camera reports 1 x 1 for a moment at startup). 
+local VIEWPORT_WAIT = 2
+local function deviceInfo()
+	local viewport = viewportSize()
 	local vr = VRService.VREnabled
 	local consoleOk, isConsole = pcall(function()
 		return GuiService:IsTenFootInterface()
 	end)
-	local dev = "unknown"
-	if vr then
-		dev = "vr"
-	elseif consoleOk and isConsole then
-		dev = "console"
-	elseif UserInputService.TouchEnabled and not UserInputService.KeyboardEnabled then
-		dev = if math.min(viewport.X, viewport.Y) >= 600 then "tablet" else "phone"
-	elseif UserInputService.KeyboardEnabled or UserInputService.MouseEnabled then
-		dev = "desktop"
-	end
+	local dev = deviceClass({
+		vr = vr,
+		tenFoot = consoleOk and isConsole == true,
+		touch = UserInputService.TouchEnabled,
+		keyboard = UserInputService.KeyboardEnabled,
+		mouse = UserInputService.MouseEnabled,
+		w = viewport.X,
+		h = viewport.Y,
+	})
 	local last = UserInputService:GetLastInputType()
 	local input = "unknown"
 	if vr then
@@ -698,7 +704,7 @@ do
 				end
 			end)
 			if not ok then
-				warn("[src/analytics/client.ts:506]", `[analytics] server message failed: {string.sub(tostring(err), 1, 200)}`)
+				warn("[src/analytics/client.ts:518]", `[analytics] server message failed: {string.sub(tostring(err), 1, 200)}`)
 			end
 		end)
 		trove:add(function()
@@ -805,6 +811,11 @@ do
 	end
 	function ClientAnalytics:startSending()
 		self.trove:add(task.spawn(function()
+			-- The device class reads the viewport (phone vs tablet): give the camera a moment to report a real size.
+			local waitUntil = os.clock() + VIEWPORT_WAIT
+			while math.min(viewportSize().X, viewportSize().Y) <= 1 and os.clock() < waitUntil and not self.stopped do
+				task.wait(0.1)
+			end
 			-- Hello until the server answers (its engine may start later than this one): every 5 s for a minute, then
 			-- every 30 s.
 			local tries = 0
@@ -839,7 +850,7 @@ do
 	end
 	function ClientAnalytics:track(kind, name, props)
 		if not isEventName(name) then
-			warn("[src/analytics/client.ts:622]", `[analytics] {kind} event name must be 1-64 characters: {string.sub(tostring(name), 1, 80)}`)
+			warn("[src/analytics/client.ts:637]", `[analytics] {kind} event name must be 1-64 characters: {string.sub(tostring(name), 1, 80)}`)
 			return nil
 		end
 		self:push(kind, name, encodeProps(props))
@@ -897,7 +908,7 @@ do
 		end
 		local control = _condition
 		if not isExperimentName(name) or not isVariantList(variants) then
-			warn("[src/analytics/client.ts:656]", `[analytics] experiment("{string.sub(tostring(name), 1, 64)}"): bad name or variants (1-16 distinct names)`)
+			warn("[src/analytics/client.ts:671]", `[analytics] experiment("{string.sub(tostring(name), 1, 64)}"): bad name or variants (1-16 distinct names)`)
 			return control
 		end
 		local deadline = os.clock() + 10

package/out/analytics/protocol.d.ts

@@ -35,6 +35,27 @@ export interface HelloInfo {
     /** Seconds from the client starting to the engine starting (first client generation only). */
     load?: number;
 }
+/** What the client knows about its device when it says hello (UserInputService, VRService, GuiService, the camera). */
+export interface DeviceFacts {
+    vr: boolean;
+    /** GuiService:IsTenFootInterface(): a console (Xbox, PlayStation). */
+    tenFoot: boolean;
+    touch: boolean;
+    keyboard: boolean;
+    mouse: boolean;
+    /** Viewport size in points (0 when the camera has none yet). */
+    w: number;
+    h: number;
+}
+/** A touch-only device whose viewport's short side is at least this many points is a tablet, else a phone. */
+export declare const TABLET_MIN_SHORT_SIDE = 600;
+/**
+ * The session's device class (the `dev` column), in this order: VR headset; console (ten-foot interface); touch without
+ * a keyboard: tablet when the viewport's short side is 600 points or more, else phone (also when the viewport isn't
+ * known); a keyboard or mouse: desktop (a touch laptop or a tablet with a keyboard counts here); else unknown. Roblox
+ * gives game scripts no OS, so this is the closest a game gets.
+ */
+export declare function deviceClass(f: DeviceFacts): DeviceKind;
 /** [ageMs, kind, name, propsJson] */
 export type ClientEvent = [
     age: number,

package/out/analytics/protocol.luau

@@ -22,6 +22,32 @@ local CLIENT_BATCH_BYTES = 12000
 local CHUNK_TARGET_BYTES = 6000
 local CHUNK_MAX_BYTES = 16384
 local CHUNK_SECONDS = 10
+--* What the client knows about its device when it says hello (UserInputService, VRService, GuiService, the camera). 
+--* A touch-only device whose viewport's short side is at least this many points is a tablet, else a phone. 
+local TABLET_MIN_SHORT_SIDE = 600
+--[[
+	*
+	 * The session's device class (the `dev` column), in this order: VR headset; console (ten-foot interface); touch without
+	 * a keyboard: tablet when the viewport's short side is 600 points or more, else phone (also when the viewport isn't
+	 * known); a keyboard or mouse: desktop (a touch laptop or a tablet with a keyboard counts here); else unknown. Roblox
+	 * gives game scripts no OS, so this is the closest a game gets.
+	 
+]]
+local function deviceClass(f)
+	if f.vr then
+		return "vr"
+	end
+	if f.tenFoot then
+		return "console"
+	end
+	if f.touch and not f.keyboard then
+		return if math.min(f.w, f.h) >= TABLET_MIN_SHORT_SIDE then "tablet" else "phone"
+	end
+	if f.keyboard or f.mouse then
+		return "desktop"
+	end
+	return "unknown"
+end
 --* [ageMs, kind, name, propsJson] 
 local DEVICES = {
 	["desktop"] = true,
@@ -127,6 +153,7 @@ local function cleanClientEvent(value)
 	return { math.floor(age), kind, name, props }
 end
 return {
+	deviceClass = deviceClass,
 	cleanHello = cleanHello,
 	isEventName = isEventName,
 	cleanClientEvent = cleanClientEvent,
@@ -136,5 +163,6 @@ return {
 	CHUNK_TARGET_BYTES = CHUNK_TARGET_BYTES,
 	CHUNK_MAX_BYTES = CHUNK_MAX_BYTES,
 	CHUNK_SECONDS = CHUNK_SECONDS,
+	TABLET_MIN_SHORT_SIDE = TABLET_MIN_SHORT_SIDE,
 	CLIENT_KINDS = CLIENT_KINDS,
 }

package/out/analytics/server.luau

@@ -1284,9 +1284,14 @@ do
 		end
 		local first = session.device == nil
 		session.device = info
-		session.dev = info.dev
+		-- The device class is the session's: set by the first hello and kept (a later hello after a hot swap, or a keyboard
+		-- plugged into a tablet, doesn't move the session's rows to another class), unless the first one didn't know.
+		if first or session.dev == "unknown" then
+			session.dev = info.dev
+		end
 		if first and self.options.sessions ~= false then
 			self:emit(session, "session", "device", encodeProps({
+				dev = info.dev,
 				input = info.input,
 				w = info.w,
 				h = info.h,
@@ -1494,7 +1499,7 @@ do
 				end
 			end)
 			if not ok then
-				warn("[src/analytics/server.ts:1075]", `[analytics] client message failed: {string.sub(tostring(err), 1, 200)}`)
+				warn("[src/analytics/server.ts:1077]", `[analytics] client message failed: {string.sub(tostring(err), 1, 200)}`)
 			end
 		end)
 		self.trove:add(function()
@@ -1777,7 +1782,7 @@ do
 		self.lastWarnAt = now
 		local more = if self.suppressed > 0 then ` (+{self.suppressed} more in the last minute)` else ""
 		self.suppressed = 0
-		warn("[src/analytics/server.ts:1270]", `[analytics] {message}{more}`)
+		warn("[src/analytics/server.ts:1272]", `[analytics] {message}{more}`)
 		return true
 	end
 	function ServerAnalytics:noteSuccess()

package/out/devtools/access.d.ts

@@ -0,0 +1,71 @@
+import type { Channel, DevInfo, KernelStatus, ServerType } from "../kernel";
+/**
+ * Framework 0.4.1: who may use the dev-only devtools on this server. Every such gate asks here: Claude (prompts, live
+ * tools, toolbox inserts, keeping the dev machine's session, the long-polls; claude.ts, toolbox-server.ts), Logs >
+ * Upload, Dex edits (explorer-server.ts), Modules > State reads for non-owners (server.ts), Manage's own respawn
+ * (admin-server.ts), and on the client (cosmetic; the server re-checks) Dex edits, Network packet blocking, the
+ * Claude tab, the hot-swap sound and the run_luau hint (op "access", `facts.access` of op "status").
+ *
+ * The owner's model: two channels, prod (the single prod branch) and dev (every other branch). The tools work:
+ *   1. under dev RULES (private, reserved and Studio servers on a dev branch with a dev build): every dev, as before;
+ *   2. on a PUBLIC server whose branch channel is dev and whose branch an OWNER switched to (kernel 0.3.4+ owner switch:
+ *      `status().switched` names this branch, and the kernel follows it by dev rules, `status().signedOnly` false,
+ *      which only its in-memory `ownerBranch` gives a public server): owners only;
+ *   3. nowhere else.
+ * The rules themselves don't change (signatures, owner-only rollbacks in the kernel, `TypeTorch.channel`, which games
+ * split data stores by). Older kernels have no `branchChannel` (before 0.3.9) or no `switched` (before 0.3.4): their
+ * public servers stay refused, as before.
+ */
+/** Why the dev-only tools are refused (an error code of the dev ops; client.ts and claude-ui.ts have short texts). */
+export type DevRefusal = "dev_branch_only" | "owner_switch_only" | "owners_only";
+/** The server's half of the rule: "dev" (rule 1), "owners" (rule 2) or why not. */
+export type ServerAccess = "dev" | "owners" | "dev_branch_only" | "owner_switch_only";
+/** What op "access" answers (and `facts.access` of op "status" holds: "ok" or the refusal). */
+export type AccessReply = {
+    ok: true;
+} | {
+    ok: false;
+    error: DevRefusal;
+};
+/** What the rule reads from the kernel (ServerKernel has all of it; tests pass stubs). */
+export interface AccessKernel {
+    readonly branch: string;
+    readonly channel: Channel;
+    readonly rules?: Channel;
+    readonly branchChannel?: Channel;
+    readonly serverType: ServerType;
+    status(): Pick<KernelStatus, "branch" | "signedOnly" | "switched">;
+    devInfo(player: Player): DevInfo;
+}
+/**
+ * A public server's branch was set by an owner switch: the kernel's switch record names this branch (only owners switch
+ * or load builds on public servers), the kernel runs that branch now, and it follows it by dev rules (`signedOnly`
+ * false: the owner's dev branch). Absent fields (older kernels) mean no.
+ */
+export declare function ownerSwitchedHere(kernel: Pick<AccessKernel, "branch">, status: Pick<KernelStatus, "branch" | "signedOnly" | "switched">): boolean;
+/** The server's half: rules dev, else a public dev branch an owner switched to, else refused. */
+export declare function serverAccess(kernel: AccessKernel): ServerAccess;
+/** Whether `player` may use the dev-only tools here (undefined) or why not. `server`: serverAccess, when known. */
+export declare function devAccess(kernel: AccessKernel, player: Player, server?: ServerAccess): DevRefusal | undefined;
+/**
+ * The rule for one generation. The server half reads `kernel.status()` on public servers, so it is kept for `ttl`
+ * seconds (Claude's long-poll manager asks every second); the player half (the owner check) is asked every time.
+ */
+export declare class DevAccess {
+    private readonly kernel;
+    private readonly ttl;
+    private cached?;
+    private cachedAt;
+    constructor(kernel: AccessKernel, ttl?: number);
+    /** The server's half (see serverAccess). */
+    server(): ServerAccess;
+    /** Some player may use the tools here (rule 1 or 2): e.g. the server keeps the dev machine's session. */
+    serverOpen(): boolean;
+    /** Rule 2 (a public server an owner switched): owners only; a kept Claude session only while one is paired. */
+    ownersOnly(): boolean;
+    /** Undefined when `player` may use the tools here, else why not. */
+    refusal(player: Player): DevRefusal | undefined;
+    allows(player: Player): boolean;
+    /** Op "access". */
+    reply(player: Player): AccessReply;
+}

package/out/devtools/access.luau

@@ -0,0 +1,140 @@
+-- Compiled with roblox-ts v3.0.0
+local TS = _G[script]
+local _kernel = TS.import(script, script.Parent.Parent, "kernel")
+local branchChannelOf = _kernel.branchChannelOf
+local devRoleOf = _kernel.devRoleOf
+local rulesOf = _kernel.rulesOf
+--[[
+	*
+	 * Framework 0.4.1: who may use the dev-only devtools on this server. Every such gate asks here: Claude (prompts, live
+	 * tools, toolbox inserts, keeping the dev machine's session, the long-polls; claude.ts, toolbox-server.ts), Logs >
+	 * Upload, Dex edits (explorer-server.ts), Modules > State reads for non-owners (server.ts), Manage's own respawn
+	 * (admin-server.ts), and on the client (cosmetic; the server re-checks) Dex edits, Network packet blocking, the
+	 * Claude tab, the hot-swap sound and the run_luau hint (op "access", `facts.access` of op "status").
+	 *
+	 * The owner's model: two channels, prod (the single prod branch) and dev (every other branch). The tools work:
+	 *   1. under dev RULES (private, reserved and Studio servers on a dev branch with a dev build): every dev, as before;
+	 *   2. on a PUBLIC server whose branch channel is dev and whose branch an OWNER switched to (kernel 0.3.4+ owner switch:
+	 *      `status().switched` names this branch, and the kernel follows it by dev rules, `status().signedOnly` false,
+	 *      which only its in-memory `ownerBranch` gives a public server): owners only;
+	 *   3. nowhere else.
+	 * The rules themselves don't change (signatures, owner-only rollbacks in the kernel, `TypeTorch.channel`, which games
+	 * split data stores by). Older kernels have no `branchChannel` (before 0.3.9) or no `switched` (before 0.3.4): their
+	 * public servers stay refused, as before.
+	 
+]]
+--* Why the dev-only tools are refused (an error code of the dev ops; client.ts and claude-ui.ts have short texts). 
+--* The server's half of the rule: "dev" (rule 1), "owners" (rule 2) or why not. 
+--* What op "access" answers (and `facts.access` of op "status" holds: "ok" or the refusal). 
+--* What the rule reads from the kernel (ServerKernel has all of it; tests pass stubs). 
+--[[
+	*
+	 * A public server's branch was set by an owner switch: the kernel's switch record names this branch (only owners switch
+	 * or load builds on public servers), the kernel runs that branch now, and it follows it by dev rules (`signedOnly`
+	 * false: the owner's dev branch). Absent fields (older kernels) mean no.
+	 
+]]
+local function ownerSwitchedHere(kernel, status)
+	local switched = status.switched
+	if not (type(switched) == "table") then
+		return false
+	end
+	local _condition = status.signedOnly == false and status.branch == kernel.branch and switched.branch == kernel.branch
+	if _condition then
+		local _by = switched.by
+		_condition = type(_by) == "number"
+	end
+	return _condition
+end
+--* The server's half: rules dev, else a public dev branch an owner switched to, else refused. 
+local function serverAccess(kernel)
+	if rulesOf(kernel) == "dev" then
+		return "dev"
+	end
+	if branchChannelOf(kernel) ~= "dev" or kernel.serverType ~= "public" then
+		return "dev_branch_only"
+	end
+	local ok, status = pcall(function()
+		return kernel:status()
+	end)
+	if not ok or not (type(status) == "table") then
+		return "owner_switch_only"
+	end
+	return if ownerSwitchedHere(kernel, status) then "owners" else "owner_switch_only"
+end
+--* Whether `player` may use the dev-only tools here (undefined) or why not. `server`: serverAccess, when known. 
+local function devAccess(kernel, player, server)
+	if server == nil then
+		server = serverAccess(kernel)
+	end
+	if server == "dev" then
+		return nil
+	end
+	if server ~= "owners" then
+		return server
+	end
+	return if devRoleOf(kernel, player) == "owner" then nil else "owners_only"
+end
+--[[
+	*
+	 * The rule for one generation. The server half reads `kernel.status()` on public servers, so it is kept for `ttl`
+	 * seconds (Claude's long-poll manager asks every second); the player half (the owner check) is asked every time.
+	 
+]]
+local DevAccess
+do
+	DevAccess = setmetatable({}, {
+		__tostring = function()
+			return "DevAccess"
+		end,
+	})
+	DevAccess.__index = DevAccess
+	function DevAccess.new(...)
+		local self = setmetatable({}, DevAccess)
+		return self:constructor(...) or self
+	end
+	function DevAccess:constructor(kernel, ttl)
+		if ttl == nil then
+			ttl = 1
+		end
+		self.kernel = kernel
+		self.ttl = ttl
+		self.cachedAt = -math.huge
+	end
+	function DevAccess:server()
+		local now = os.clock()
+		if self.cached == nil or now - self.cachedAt >= self.ttl then
+			self.cached = serverAccess(self.kernel)
+			self.cachedAt = now
+		end
+		return self.cached
+	end
+	function DevAccess:serverOpen()
+		local server = self:server()
+		return server == "dev" or server == "owners"
+	end
+	function DevAccess:ownersOnly()
+		return self:server() == "owners"
+	end
+	function DevAccess:refusal(player)
+		return devAccess(self.kernel, player, self:server())
+	end
+	function DevAccess:allows(player)
+		return self:refusal(player) == nil
+	end
+	function DevAccess:reply(player)
+		local refusal = self:refusal(player)
+		return if refusal == nil then {
+			ok = true,
+		} else {
+			ok = false,
+			error = refusal,
+		}
+	end
+end
+return {
+	ownerSwitchedHere = ownerSwitchedHere,
+	serverAccess = serverAccess,
+	devAccess = devAccess,
+	DevAccess = DevAccess,
+}

package/out/devtools/admin-server.d.ts

@@ -1,5 +1,6 @@
 import { Trove } from "@rbxts/trove";
 import { type Channel, type Role, type ServerKernel, type ServerType } from "../kernel";
+import { DevAccess } from "./access";
 /**
  * Server half of the dev menu's Manage group (plans/10; "Admin" before framework 0.3.2): players (teleport to, bring,
  * respawn, kick, ban), bans (unban, history) and the live servers of this universe (list, join, new server, shut down,
@@ -116,4 +117,4 @@ export declare function kernelHasFleetStatus(kernel: ServerKernel): boolean;
  * Registers the "admin.*" dev ops and starts this server's heartbeat in the server list. Everything it connects or
  * spawns lives in `trove` (the devtools trove, cleaned on swap).
  */
-export declare function registerAdminOps(register: (op: string, handler: (player: Player, payload: unknown) => unknown) => void, kernel: ServerKernel, trove: Trove): void;
+export declare function registerAdminOps(register: (op: string, handler: (player: Player, payload: unknown) => unknown) => void, kernel: ServerKernel, trove: Trove, access?: DevAccess): void;

package/out/devtools/admin-server.luau

@@ -9,7 +9,8 @@ local TeleportService = _services.TeleportService
 local TextService = _services.TextService
 local _kernel = TS.import(script, script.Parent.Parent, "kernel")
 local branchChannelOf = _kernel.branchChannelOf
-local normalRole = _kernel.normalRole
+local devRoleOf = _kernel.devRoleOf
+local DevAccess = TS.import(script, script.Parent, "access").DevAccess
 local countBudget = TS.import(script, script.Parent.Parent, "budget").countBudget
 local RateLimiter = TS.import(script, script.Parent.Parent, "net", "limits").RateLimiter
 local _ab = TS.import(script, script.Parent, "ab")
@@ -183,7 +184,10 @@ end
 	 * spawns lives in `trove` (the devtools trove, cleaned on swap).
 	 
 ]]
-local function registerAdminOps(register, kernel, trove)
+local function registerAdminOps(register, kernel, trove, access)
+	if access == nil then
+		access = DevAccess.new(kernel)
+	end
 	local saved = kernel:persist(PERSIST_KEY, function()
 		return {
 			modSeq = 0,
@@ -196,13 +200,7 @@ local function registerAdminOps(register, kernel, trove)
 	local jobLabel = if game.JobId ~= "" then game.JobId else "studio"
 	local jobKey = if game.JobId ~= "" then string.sub((string.gsub(game.JobId, "-", "")), 1, 24) else "studio"
 	local roleOf = function(player)
-		local ok, info = pcall(function()
-			return kernel:devInfo(player)
-		end)
-		if not ok or not (type(info) == "table") or info.dev ~= true then
-			return nil
-		end
-		return normalRole(info.role)
+		return devRoleOf(kernel, player)
 	end
 	local actorOf = function(player)
 		-- The dispatcher checks this too; re-checked so these ops stay dev-only wherever they are registered.
@@ -247,7 +245,7 @@ local function registerAdminOps(register, kernel, trove)
 		return {
 			tp = not isSelf,
 			bring = not isSelf and actor.owner and actor.rank >= targetRank,
-			respawn = if isSelf then kernel.channel == "dev" or actor.owner else actor.owner and actor.rank >= targetRank,
+			respawn = if isSelf then actor.owner or access:allows(actor.player) else actor.owner and actor.rank >= targetRank,
 			kick = not isSelf and actor.owner and actor.rank > targetRank,
 			ban = not isSelf and actor.owner and actor.rank > targetRank,
 		}
@@ -326,7 +324,7 @@ local function registerAdminOps(register, kernel, trove)
 				return DataStoreService:GetDataStore(MOD_STORE):SetAsync(key, entry)
 			end)
 			if not ok then
-				warn("[src/devtools/admin-server.ts:394]", `[manage] durable record {key} failed: {err}`)
+				warn("[src/devtools/admin-server.ts:393]", `[manage] durable record {key} failed: {err}`)
 			end
 		end)
 	end
@@ -952,7 +950,7 @@ local function registerAdminOps(register, kernel, trove)
 			end)
 			if not ok then
 				failed += 1
-				warn("[src/devtools/admin-server.ts:756]", `[manage] A/B publish failed: {err}`)
+				warn("[src/devtools/admin-server.ts:755]", `[manage] A/B publish failed: {err}`)
 			end
 		end
 		for branch, group in groups do
@@ -1183,7 +1181,7 @@ local function registerAdminOps(register, kernel, trove)
 			return nil
 		end
 		backoff(entry)
-		warn("[src/devtools/admin-server.ts:885]", `[manage] migrate: {target.Name} failed ({result.Name}): {message}`)
+		warn("[src/devtools/admin-server.ts:884]", `[manage] migrate: {target.Name} failed ({result.Name}): {message}`)
 	end)
 	trove:connect(Players.PlayerRemoving, function(leaving)
 		local _leaving = leaving
@@ -1269,7 +1267,7 @@ local function registerAdminOps(register, kernel, trove)
 							return TeleportService:TeleportAsync(game.PlaceId, batch, options)
 						end)
 						if not ok then
-							warn("[src/devtools/admin-server.ts:925]", `[manage] migrate: teleport of {#batch} failed: {err}`)
+							warn("[src/devtools/admin-server.ts:924]", `[manage] migrate: teleport of {#batch} failed: {err}`)
 							for _, target in batch do
 								local entry = attempts[target]
 								if entry then