@vibelord/lanes 1.0.2 → 1.0.4

package/payload/lanes/holders.lock

@@ -6,3 +6,13 @@ zmx 0.8.1 dfd75720b942466f28870731cc86dbc07afa72fb8f3bd5eeb4ff707e4eecebe8 https
 # glow 3.0.0 (markdown preview, `lanes preview`): tarball digest matches GitHub's asset digest and the release's checksums.txt;
 # the binary sits in glow_3.0.0_Linux_x86_64/. Installed only when no glow is on PATH; without either, the preview uses less -R.
 glow 3.0.0 13e05e4b2acc18d2aee44291aefe6325b077ec321b631a0cfa780e8e3bc33f78 https://github.com/charmbracelet/glow/releases/download/v3.0.0/glow_3.0.0_Linux_x86_64.tar.gz
+#
+# OPT-IN pins carry three more fields and are skipped by host-install.sh; the step that needs one installs it:
+# name  version  sha256(tarball)  url  opt-in  member-inside-the-tarball  sha256(member)
+# throttle-rc is the co-located Studio Host (docs/SHARING.md "Co-located Studio Host"; `lanes studio-host install`
+# downloads, checks BOTH digests and selects it). It comes from a `node/<sha12>` GitHub prerelease
+# (docs/runbooks/node-release-asset.md): version = node-<sha12>, the asset sidecars give both digests. No
+# node/<sha12> release containing the co-location CLI exists yet, so no line is active: until one is tagged, install
+# a locally built binary with `lanes studio-host install --from PATH [--sha256 HEX]` (also sha256-verified).
+# Template (fill from the release's two .sha256 sidecars, then uncomment):
+# throttle-rc node-<sha12> <tarball-sha256> https://github.com/bwllaming/bw-tools/releases/download/node/<sha12>/throttle-rc-x86_64-unknown-linux-gnu.tar.gz opt-in throttle-rc-x86_64-unknown-linux-gnu/throttle-rc <binary-sha256>

package/payload/lanes/install/enable-studio-host.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+# Opt-in: run the Throttle Studio Host co-located on this lanes server (docs/SHARING.md "Co-located Studio Host").
+# As the workspace account. Writes the Host config in lanes-server mode if absent, publishes this machine's PUBLIC
+# key for the deploy, adopts a deploy receipt or enrols with a registration key file, and enables
+# lanes-studio-host.service — or leaves it enabled and WAITING for enrolment (exit 0; exit 3 when a receipt or key
+# was refused, the units still enabled so lanes-studio-host-enrol.timer retries).
+# Never prints a key. --dry-run changes nothing. --help lists the options.
+set -eu
+repo=$(cd "$(dirname "$0")/.." && pwd)
+case "$(uname -s)" in Linux) ;; *) echo 'The co-located Studio Host runs on a Linux lanes server.' >&2; exit 1 ;; esac
+[ "$(id -u)" != 0 ] || { echo 'Run as the workspace account, not root.' >&2; exit 1; }
+command -v python3 >/dev/null 2>&1 || { echo 'Missing prerequisite: python3 (see docs/INSTALL.md)' >&2; exit 1; }
+export XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"
+exec python3 "$repo/libexec/studio_host.py" enable "$@"

package/payload/lanes/install/host-install.sh

@@ -22,7 +22,7 @@ for command in python3 curl tar sha256sum infocmp tic install systemctl docker t
     command -v "$command" >/dev/null 2>&1 || { echo "Missing prerequisite: $command (see docs/INSTALL.md)" >&2; exit 1; }
 done
 python3 -c 'import sys; sys.exit(0 if sys.version_info >= (3, 9) else "Python 3.9+ is required")'
-export XDG_RUNTIME_DIR=${XDG_RUNTIME_DIR:-/run/user/$(id -u)}
+export XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"
 if [ "$start" = 1 ]; then
     systemctl --user show-environment >/dev/null
     python3 -c 'import subprocess; subprocess.run(["docker", "info", "--format", "{{.ServerVersion}}"], check=True, timeout=15)'
@@ -37,8 +37,11 @@ mkdir -p "$share/bin" "$share/dl" "$state/flags"
 # The view server's PATH (bin/lanes clean_env): the Run pane that renders `lanes preview` sees this, never the
 # installer's PATH, so a glow in ~/.local/bin or ~/go/bin does not count as installed.
 pane_path=$share/bin:$repo/bin:/usr/local/bin:/usr/bin:/bin
-grep -v '^#' "$repo/holders.lock" | while read -r name version sha url; do
+grep -v '^#' "$repo/holders.lock" | while read -r name version sha url flag _rest; do
     [ -n "$name" ] || continue
+    # An `opt-in` pin (the co-located Studio Host's throttle-rc) is installed by the opt-in step that needs it
+    # (install/enable-studio-host.sh, `lanes studio-host install`), never by every server install.
+    [ "$flag" != opt-in ] || continue
     target=$share/bin/$name-$version
     if [ -x "$target" ]; then echo "ok  $name $version"; continue; fi
     # The markdown preview's renderer is optional: a glow the pane can find serves `lanes preview` as well.

package/payload/lanes/install/services.py

@@ -1,7 +1,10 @@
 #!/usr/bin/env python3
 """Register this checkout's user services without starting or restarting them."""
+import json
 import os
 import shutil
+import sys
+import subprocess
 from pathlib import Path
 import tempfile
 
@@ -35,8 +38,95 @@ def notify_settings(environ):
     return {name: environ[name] for name in NOTIFY_SETTINGS if environ.get(name)}
 
 
-def register(repo, home, share, state, workspaces=None, economy=None, notify=None):
+def throttle_rc_path(share):
+    """The co-located Studio Host's binary: a stable link the opt-in installer points at a sha256-verified file
+    (`lanes studio-host install`, libexec/studio_host.py). Rendered whether or not it exists yet, like @CADDY@."""
+    return Path(share) / 'bin' / 'throttle-rc'
+
+
+# Units that run throttle-rc (or the installer that resolves its paths): they must see the SAME XDG roots the
+# installer used, or the config and credential it wrote are not where the supervised Host looks (review round 1).
+# Review round 3: BOTH roots are pinned ALWAYS — the installer's own, else the defaults as systemd specifiers — never
+# left to the user manager's environment block, which can carry roots the installing shell did not.
+STUDIO_HOST_UNITS = ('lanes-studio-host.service', 'lanes-studio-host-enrol.service')
+XDG_ROOTS = ('XDG_CONFIG_HOME', 'XDG_DATA_HOME')
+XDG_DEFAULTS = {'XDG_CONFIG_HOME': '%h/.config', 'XDG_DATA_HOME': '%h/.local/share'}
+
+
+# Review round 4: the roots the opt-in enable step (install/enable-studio-host.sh) rendered the studio units with,
+# recorded beside its enrolment record. A later server install (re-run for every update, possibly from a shell that
+# does not carry them, e.g. `sudo -u <account> sh` without -i) renders the studio units from THIS record, never from
+# its own environment, so it cannot move the supervised Host away from the config and credential enable wrote.
+XDG_RECORD = Path('studio-host') / 'xdg-roots.json'
+
+
+def recorded_xdg(state):
+    """The roots enable recorded under $LANES_STATE, or None when it never ran (or the record is unreadable)."""
+    try:
+        doc = json.loads((Path(state) / XDG_RECORD).read_text())
+    except (OSError, ValueError):
+        return None
+    if not isinstance(doc, dict) or not isinstance(doc.get('roots'), dict):
+        return None
+    return {name: value for name, value in doc['roots'].items()
+            if name in XDG_ROOTS and isinstance(value, str) and value.startswith('/')}
+
+
+def record_xdg(state, xdg):
+    """Record the roots enable renders the studio units with (an empty dict = the defaults)."""
+    path = Path(state) / XDG_RECORD
+    path.parent.mkdir(parents=True, exist_ok=True)
+    fd, temporary = tempfile.mkstemp(prefix='.xdg-roots-', dir=path.parent)
+    try:
+        with os.fdopen(fd, 'w') as handle:
+            json.dump({'schema': 'lanes.studio-host-xdg-roots', 'version': 1,
+                       'roots': {name: str(Path(xdg[name]).resolve()) for name in XDG_ROOTS if xdg.get(name)}},
+                      handle, sort_keys=True)
+            handle.write('\n')
+        os.chmod(temporary, 0o600)
+        os.replace(temporary, path)
+    finally:
+        if os.path.exists(temporary):
+            os.unlink(temporary)
+
+
+def studio_host_config(home, xdg):
+    """The Host's config path as libexec/studio_host.py's Layout resolves it: $XDG_CONFIG_HOME, else %h/.config
+    (left as the systemd specifier so the unit stays the golden when no XDG root is set)."""
+    if xdg.get('XDG_CONFIG_HOME'):
+        return unit_value(Path(xdg['XDG_CONFIG_HOME']) / 'throttle-rc/studio-host.toml', command=True)
+    return '%h/.config/throttle-rc/studio-host.toml'
+
+
+def manager_unit_dir(home):
+    """Where the user MANAGER reads unit files (systemd.unit(5)): $XDG_CONFIG_HOME/systemd/user when the manager's own
+    environment sets it, else ~/.config/systemd/user. Asked of the manager, never of this shell (review round 2);
+    no answer keeps the default. libexec/studio_host.py's manager_units_dir is the same rule."""
+    default = Path(home) / '.config/systemd/user'
+    try:
+        result = subprocess.run(['systemctl', '--user', 'show-environment'], capture_output=True, text=True,
+                                timeout=10, stdin=subprocess.DEVNULL)
+    except (OSError, subprocess.TimeoutExpired):
+        return default
+    if result.returncode == 0:
+        for line in result.stdout.splitlines():
+            if line.startswith('XDG_CONFIG_HOME=') and line.split('=', 1)[1].startswith('/'):
+                return Path(line.split('=', 1)[1]) / 'systemd/user'
+    return default
+
+
+def register(repo, home, share, state, workspaces=None, economy=None, notify=None, xdg=None, units_dir=None):
     repo, home, share, state = (Path(p).resolve() for p in (repo, home, share, state))
+    if xdg is None:
+        ambient = {name: os.environ[name] for name in XDG_ROOTS if os.environ.get(name)}
+        xdg = recorded_xdg(state)
+        if xdg is None:
+            xdg = ambient
+        elif {k: str(Path(v).resolve()) for k, v in ambient.items()} != {k: str(Path(v).resolve()) for k, v in xdg.items()}:
+            print(f'services.py: the studio units keep the XDG roots install/enable-studio-host.sh recorded in '
+                  f'{state / XDG_RECORD} ({xdg or "the defaults"}), not this shell\'s ({ambient or "none"}); re-run '
+                  'install/enable-studio-host.sh from the shell whose roots should hold', file=sys.stderr)
+    xdg = {name: str(Path(value).resolve()) for name, value in xdg.items() if name in XDG_ROOTS and value}
     current = home / '.local/share/lanes/current'
     links = ((current, repo), (home / '.local/bin/lanes', repo / 'bin/lanes'))
     for link, _ in links:
@@ -50,6 +140,9 @@ def register(repo, home, share, state, workspaces=None, economy=None, notify=Non
                                   for name, value in sorted((economy or {}).items()) if name in ECONOMY_SETTINGS)
     notify_environment = ''.join(f'Environment="{name}={unit_value(value)}"\n'
                                  for name, value in sorted((notify or {}).items()) if name in NOTIFY_SETTINGS)
+    studio_environment = environment + ''.join(
+        f'Environment="{name}={unit_value(xdg[name]) if name in xdg else XDG_DEFAULTS[name]}"\n'
+        for name in XDG_ROOTS)
     rendered = {}
     for source in sorted((repo / 'systemd').iterdir()):
         if source.name.startswith('.') or source.suffix not in ('.service', '.timer', '.slice') or not source.is_file():
@@ -57,12 +150,15 @@ def register(repo, home, share, state, workspaces=None, economy=None, notify=Non
         content = source.read_text().replace('@REPO@', unit_value(repo, command=True))
         content = content.replace('@SHARE@', unit_value(share, command=True))
         content = content.replace('@CADDY@', unit_value(shutil.which('caddy') or '/usr/bin/caddy', command=True))
+        content = content.replace('@THROTTLE_RC@', unit_value(throttle_rc_path(share), command=True))
+        content = content.replace('@STUDIO_HOST_CONFIG@', studio_host_config(home, xdg))
         if '[Service]\n' in content:
+            lines = studio_environment if source.name in STUDIO_HOST_UNITS else environment
             extra = (economy_environment if source.name in ECONOMY_UNITS else
                      notify_environment if source.name in NOTIFY_UNITS else '')
-            content = content.replace('[Service]\n', '[Service]\n' + environment + extra, 1)
+            content = content.replace('[Service]\n', '[Service]\n' + lines + extra, 1)
         rendered[source.name] = '# Generated by lanes/install/services.py; re-run the server installer to update.\n' + content
-    units = home / '.config/systemd/user'
+    units = Path(units_dir) if units_dir else home / '.config/systemd/user'
     units.mkdir(parents=True, exist_ok=True)
     for name, content in rendered.items():
         fd, temporary = tempfile.mkstemp(prefix='.lanes-', dir=units)
@@ -85,4 +181,5 @@ if __name__ == '__main__':
     register(Path(__file__).resolve().parents[1], Path.home(),
              os.environ.get('LANES_SHARE', Path.home() / '.local/share/lanes'),
              os.environ.get('LANES_STATE', Path.home() / '.local/state/lanes'),
-             os.environ.get('LANES_WORKSPACES'), economy_settings(os.environ), notify_settings(os.environ))
+             os.environ.get('LANES_WORKSPACES'), economy_settings(os.environ), notify_settings(os.environ),
+             units_dir=manager_unit_dir(Path.home()))

package/payload/lanes/install.sh

@@ -285,7 +285,7 @@ EOF
 #     parent's only include) and nothing loads later. Omarchy's theme file sits two deep: one hop.
 #  2. KIND — a theme pair loses to ANY explicit colour key in the everyday chain (above), so the pair is installed only
 #     when that chain sets none; otherwise the explicit dark palette (last assignment wins) and `say` names the file.
-# Both rules are read from Ghostty's source, not observed on a running Ghostty here (DEF-1466 holds the live check).
+# Both rules are read from Ghostty's source, not observed on a running Ghostty here (DEF-1547 holds the live check).
 # Without the flag the include is absent and every earlier palette file is removed: inherit-first is the default.
 install_palette() {
     rm -f "$config"/ghostty-palette*.conf

package/payload/lanes/libexec/agent_state.py

@@ -194,7 +194,7 @@ def read_sidecar_dict(d, now, max_age, proc_root=None):
 
     Freshness is the LAST event (`at`; `since` when a writer predates `at`), while `since` is when the status began:
     a `working` stretch re-signalled by every tool call keeps its start. lane-run's `{phase, exit, at, pid}` records
-    live one directory up and are never a sidecar (no `v`; the two writers never share a file name, DEF-1436). With
+    live one directory up and are never a sidecar (no `v`; the two writers never share a file name, DEF-1572). With
     `proc_root` (the container's /proc as the host sees it) a recorded `pid` must be live and, when the writer
     recorded `start`, still be the same process (field 22 of /proc/<pid>/stat, as `claude_sessions` checks Claude's
     `procStart`): a crashed agent's last word is never published. `pid` 0 means the writer could not name its agent;

package/payload/lanes/libexec/cursor_sync.py

@@ -21,7 +21,7 @@ NEW lane its identity (LANE_ID, LANE_WS, the lanes/<ws>/<id> trace). `--identity
 recipe of the plain shape `[exec] tmux -L <socket> new -ADs <session> [-c <dir>] <command…>` the same identity
 (`plain_tmux_new`: the command argv is kept, only the `-e` flags are added); any other working recipe is left
 alone and its lane carries no identity. The old value is kept as `createPrevious` in both cases. Identity reaches a
-tmux lane ONLY through these `-e` flags: `lane open` never exports it (DEF-1478, lanes/docs/ARCHITECTURE.md).
+tmux lane ONLY through these `-e` flags: `lane open` never exports it (DEF-1559, lanes/docs/ARCHITECTURE.md).
 Boards whose registry lives outside a repository are additionally PROJECTED into the file Cursor
 reads for that folder, named by `"cursor": "<path>"` on the repository entry of the workspace manifest.
 """
@@ -83,7 +83,7 @@ def needs_canonical(create, folder, exists):
         return 'no create recipe'
     recipe = create.replace('${workspaceFolder}', folder).replace('[workspaceFolder]', folder)
     # Every class `lanes doctor` warns about (lanes_lib.classify_recipe: null, attach-only, retired-path) is one this
-    # repairs, read by the same parser, so the doctor's "fix with --canonicalize" is never a no-op (DEF-1460).
+    # repairs, read by the same parser, so the doctor's "fix with --canonicalize" is never a no-op (DEF-1541).
     reason = CLASS_REASONS.get(L.classify_recipe(recipe))
     if reason:
         return reason

package/payload/lanes/libexec/economy_poll.py

@@ -28,7 +28,7 @@ The poller (plan Task 11, opt-in `lanes-economy.service`; enabling it is an oper
 production daemon's loopback control port): every `--interval` seconds it GETs `/status` and `/sessions` (3 s
 timeout, optional bearer from `LANES_THROTTLE_TOKEN_FILE`), folds today's log through `day_totals`, and writes
 `STATE/economy.json` (schema `v: 1`, additive) only when the payload changed apart from `at` — or when the file's
-`at` is HEARTBEAT seconds old, so `at` is a liveness heartbeat the sidebar ages with its own clock (DEF-1447); the
+`at` is HEARTBEAT seconds old, so `at` is a liveness heartbeat the sidebar ages with its own clock (DEF-1528); the
 cursor lives in `STATE/economy.cursor.json`. `LANES_THROTTLE_CONTROL=none` disables every daemon request (the log fold still runs);
 `--status-file`/`--sessions-file` feed fixture documents instead. A failed `/status` keeps the previous `fleet` with
 `stale: true`; a failed `/sessions` keeps each lane's previous live figures with `stale: true`. GET requests only:
@@ -38,7 +38,7 @@ Where it runs: `lanes-economy.service` is a HOST user unit, while the daemon (it
 workspace container. `LANES_THROTTLE_CONTAINER=<name>` reads the log through that container's home volume
 (`lanes_lib.host_path` of `/home/coder/.local/share/throttle`, the home recorded in `STATE/containers.json` by
 `lanes sync`); an explicit `LANES_THROTTLE_LOG_DIR` wins. The control URL must be reachable from the HOST's network
-namespace — a daemon bound to the container's 127.0.0.1 is not (DEF-1444). Why a source is down (`connection
+namespace — a daemon bound to the container's 127.0.0.1 is not (DEF-1525). Why a source is down (`connection
 refused`, `timed out`, `HTTP 401`, `log dir missing`, ...) goes to stderr — the journal — each time it changes, and
 on every `--once`; it is never written into economy.json.
 """
@@ -572,7 +572,7 @@ def poll_once(state_dir, env, opener=None, now=None, write=True, status_file=Non
               diagnostics=None):
     """One poll: the daemon (or fixture files), today's log fold and the lane maps → the economy.json v1 payload.
     With `write`, economy.json is replaced only when the payload changed apart from `at` or its `at` is HEARTBEAT
-    seconds old (the liveness heartbeat, DEF-1447), and the cursor only when it changed. Never raises for a down daemon or a missing log; raises LanesError for a malformed control URL. A
+    seconds old (the liveness heartbeat, DEF-1528), and the cursor only when it changed. Never raises for a down daemon or a missing log; raises LanesError for a malformed control URL. A
     `diagnostics` dict receives why each of status, sessions and log is unavailable (None when it answered)."""
     state_dir = Path(state_dir)
     now = int(time.time() if now is None else now)

package/payload/lanes/libexec/lanes_lib.py

@@ -799,7 +799,7 @@ def classify_recipe(create):
 
 def recipe_identity(create):
     """Does the recipe give the lane it creates its identity — an `-e LANE_ID=…` on a tmux new-session (the
-    canonical recipe's flags, DEF-1478)? An env prefix (`LANE_ID=x tmux …`) does not count: it reaches the tmux
+    canonical recipe's flags, DEF-1559)? An env prefix (`LANE_ID=x tmux …`) does not count: it reaches the tmux
     client, never the session."""
     lists = _recipe_word_lists(create) if isinstance(create, str) else None
     return any(verb in _RECIPE_NEW and any(letter == 'e' and value.startswith('LANE_ID=')

package/payload/lanes/libexec/notify.py

@@ -16,9 +16,9 @@ NEEDS_YOU set. The six-word `state` is never read: the agent status is the only
     lane) for a DESK device only: one with a `<device>.*.pid` of any age whose `STATE/devices/<device>.json` is not
     `mobile: true`. Phone presence is decided by the device's mobile layout, not by how it attached: a Safari phone
     has no `.pid`, and an SSH-only phone that ran `lanes attach phone --mobile` is still mobile, so opening a lane
-    from the phone's picker never mutes pushes (DEF-1452). A phone's own attach within the window still counts.
+    from the phone's picker never mutes pushes (DEF-1533). A phone's own attach within the window still counts.
     Typing in a lane touches neither file, so this is "attached or opened a lane at a desk recently", not "is
-    looking now" (DEF-1451). A suppressed transition is consumed, never sent later.
+    looking now" (DEF-1532). A suppressed transition is consumed, never sent later.
   * Payload: `<lane name>: <agent task> — <status>` and, on a second line, the client command that opens the lane
     (`lanes-launch lane <id>`). No client registers a URL scheme for it, so the push carries a tappable action only
     when `action_url` (a template over `{lane}`) is configured.
@@ -140,7 +140,7 @@ def device_active(clients_dir, window, now, devices_dir=None):
     (the mark of `lanes attach`) AND whose `devices_dir/<device>.json` is not `mobile: true`. The mobile flag is
     the authoritative phone mark: a Safari phone never runs `lanes attach`, but an SSH-only phone may
     (`lanes attach phone --mobile`, RUNBOOK) and its pid is never removed — so a lane opened from the phone's picker
-    never mutes the phone's own pushes, however it attached (DEF-1452). `devices_dir` defaults to the `devices`
+    never mutes the phone's own pushes, however it attached (DEF-1533). `devices_dir` defaults to the `devices`
     directory beside `clients_dir` (both live in STATE). A missing directory is nobody present; a window of 0 is
     never present."""
     if window <= 0:

package/payload/lanes/libexec/registrations.py

@@ -81,7 +81,7 @@ def rename(lane_id, new_name):
     """Display name of one registered session — this file is its only name authority (`apply` takes the lane's
     name from the record). Only `name` changes: the id, binding, workspace and folder stay, so view targets,
     resolve files and `lane open <id>` keep working. The `user-sessions/` and `resolve.dynamic/` files an
-    UNREGISTERED session is renamed through are never read for a registered one (DEF-1475)."""
+    UNREGISTERED session is renamed through are never read for a registered one (DEF-1556)."""
     name = L._title(new_name)
     with L.registry_lock():
         data = load()

package/payload/lanes/libexec/session_actions.py

@@ -179,7 +179,7 @@ def promote_to_registered(workspace_id, entry, registry):
         raise L.LanesError('Only tmux sessions can be promoted (zmx and exec holders are not supported)')
     # A binding any board already holds — a repository declaration or an adopted registered session — is
     # registered. Appending it again would make the repository declaration win the binding on the next sync,
-    # re-keying an adopted lane's id and orphaning its view targets (DEF-1474). Nothing is written.
+    # re-keying an adopted lane's id and orphaning its view targets (DEF-1555). Nothing is written.
     if entry.get('registered_session') or session_key(entry) in {
             session_key(lane) for w in registry.get('workspaces', []) for lane in w.get('lanes', [])
             if lane.get('holder') == 'tmux'}:

package/payload/lanes/libexec/sidebar.py

@@ -93,7 +93,7 @@ def osc_text(text):
 # ----------------------------------------------------------------- economy (plan Task 12, spec §4.2/§4.6(c))
 ECONOMY_SCHEMA = 1             # economy.json `v` this reader understands (Task 11, DM-LANES-ECONOMY; additive)
 STARVING_AGE = 600             # seconds without a request while the pane is producing output
-# economy.json older than this by its own `at`, measured with OUR clock, is a frozen picture (DEF-1447): the poller
+# economy.json older than this by its own `at`, measured with OUR clock, is a frozen picture (DEF-1528): the poller
 # rewrites the file at least every economy_poll.HEARTBEAT (60 s) even when nothing changed, so three missed heartbeats
 # mean the poller stopped (crashed, disabled, or a host too loaded to run it) — the same own-clock rule as HEALTH_STALE.
 ECONOMY_STALE = 180
@@ -564,7 +564,7 @@ class Sidebar:
 
     def economy_aged(self, now):
         """True when the loaded economy.json is older than ECONOMY_STALE by its own `at` against `now` (our clock):
-        the poller stopped, so every figure in it is frozen (DEF-1447). False without a document or without a numeric
+        the poller stopped, so every figure in it is frozen (DEF-1528). False without a document or without a numeric
         `at` — nothing is known, so nothing is claimed (health_banner's rule for a missing health file)."""
         at = number(self.economy.get('at')) if self.economy else None
         return at is not None and now - at > ECONOMY_STALE
@@ -682,7 +682,7 @@ class Sidebar:
         marks the fleet `stale` (a frozen picture is not live), ink-dim with the stale mark in front."""
         fleet = self.economy.get('fleet') or {}
         # Frozen two ways: the poller kept its last fleet strip (`/status` down), or the poller itself stopped and the
-        # whole document is older than ECONOMY_STALE by our clock (DEF-1447). Both are painted alike.
+        # whole document is older than ECONOMY_STALE by our clock (DEF-1528). Both are painted alike.
         stale = fleet.get('stale') is True or self.economy_aged(now)
         spend, budget = number(fleet.get('overflow_spend_today_usd')), number(fleet.get('overflow_budget_usd'))
         fraction = number(fleet.get('spent_fraction'))
@@ -766,7 +766,7 @@ class Sidebar:
         """(glyph, role) for column 34, by priority (spec §4.2): not-observed beats everything, then what is
         actionable — stale `?` > starving ⚠ > downgraded ↓ > paid `$` > a blank. `econ` is the lane's economy.json
         object from `self.economy` or None (no poller, or a lane the poller has not joined: the tail is blank).
-        A FROZEN economy figure keeps its glyph but loses the attention tone (ink-dim, DEF-1447): the lane record
+        A FROZEN economy figure keeps its glyph but loses the attention tone (ink-dim, DEF-1528): the lane record
         carries `stale: true` (the poller kept it while `/sessions` was down), or — with `now` — the whole document
         is older than ECONOMY_STALE. A frozen ⚠ is last-known, not a live alarm; the `?` stays statusd's mark."""
         if observed.get('stale'):
@@ -906,7 +906,7 @@ class Sidebar:
         """The cursor is a LANE (spec §4.5). `entries` is a freshly computed list, `cursor_id` the lane the cursor was
         on before it: the index is re-found from the id, and `top` shifts by the rows that appeared above it, so a lane
         that moves between sections never moves the operator's eye. Then the index is clamped. render() and
-        render_mobile() bound the shifted `top` by the list (DEF-1433): a list that fits the body is never scrolled."""
+        render_mobile() bound the shifted `top` by the list (DEF-1514): a list that fits the body is never scrolled."""
         if cursor_id:
             index = next((i for i, e in enumerate(entries) if e.get('id') == cursor_id), None)
             if index is not None and index != self.cursor:
@@ -1107,7 +1107,7 @@ class Sidebar:
             return
         try:
             # Routed by the registry SHAPE, never by the id's spelling: an adopted session keeps its `--x-` id
-            # but its name authority is registered-sessions.json, not user-sessions/ (DEF-1475).
+            # but its name authority is registered-sessions.json, not user-sessions/ (DEF-1556).
             if entry.get('registered_session'):
                 R.rename(entry['id'], new_name)
                 self.message = f'Renamed → {new_name}'
@@ -1142,7 +1142,7 @@ class Sidebar:
             return
         # Gated the way `start_registration` is: only an UNREGISTERED, reconnectable tmux session. A repository
         # lane or an adopted (`registered_session`) lane is already registered; promoting it would append a
-        # second declaration of the same binding to the repository's terminals.json (DEF-1474).
+        # second declaration of the same binding to the repository's terminals.json (DEF-1555).
         if entry.get('registered_session') or entry.get('repo') or entry.get('source'):
             self.message = 'Already a registered lane; nothing to promote'
             self.dirty = True

package/payload/lanes/libexec/statusd.py

@@ -276,7 +276,7 @@ def agent_signals(containers, sessions_by_server):
     (`parse_codex_title`) over a bare-shell foreground can be a harness that ended into its shell, and only the
     child read (`child_liveness`) tells that apart from a live harness launched under `bash -c` or a wrapper. A pane
     a live Claude session file already claims is not probed (the file outranks the title). The key is set only for
-    a known answer: unknown liveness leaves it absent, and an absent key never demotes a title (DEF-1476). A
+    a known answer: unknown liveness leaves it absent, and an absent key never demotes a title (DEF-1557). A
     container whose files cannot be read costs only its own agents, never a lane its `state`."""
     claude = {}
     for container in sorted({container for container, _socket in sessions_by_server}):
@@ -312,7 +312,7 @@ def agent_signals(containers, sessions_by_server):
 SIDECAR_MAX_AGE = 3600   # a hook sidecar whose last event is older than this loses to the live signals
 # The hook sidecars' own directory under the container home. NOT `.lz/state` itself: lane-run writes each zmx lane's
 # `{phase, ...}` record there as `<zmx name>.json` and exports that name as LANE_ID, so a shared name would let a hook
-# overwrite the record `observe_zmx_container` and the container `lane ls` read (DEF-1436).
+# overwrite the record `observe_zmx_container` and the container `lane ls` read (DEF-1572).
 SIDECAR_DIR = ('.lz', 'state', 'hooks')
 
 
@@ -337,7 +337,7 @@ def agent_sidecars(containers, wanted, now=None):
     ~/.lz/state/hooks per cycle, and a read only for the `.json` names in it — lane-run's phase records in the parent
     directory are never listed or read here. A container whose directory cannot be listed simply has no sidecars —
     absent is "no hook installed", never an error a lane pays for. A zmx lane's hook sidecar is named by its zmx
-    session (lane-run's LANE_ID), not by its published `<ws>--z-<name>` id, so it joins no lane yet (DEF-1437)."""
+    session (lane-run's LANE_ID), not by its published `<ws>--z-<name>` id, so it joins no lane yet (DEF-1573)."""
     out = {}
     for container in sorted(wanted):
         info = containers.get(container) or {}
@@ -757,7 +757,7 @@ def observe_zmx_container(container):
         name = fields.get('name', '')
         if not L.IDENT.match(name):
             continue
-        # The meta and state sidecars are written INSIDE the container (DEF-1461): each one is read as an object or
+        # The meta and state sidecars are written INSIDE the container (DEF-1542): each one is read as an object or
         # nothing, each field as one printable line or nothing, and the workspace must be a lanes identifier — it
         # names a host file below. A malformed sidecar costs its own row's labels, never the container's other rows.
         # `lane new` writes exactly these shapes (`ws` checked against IDENT or empty, `zmx_version` a string).
@@ -782,12 +782,22 @@ def observe_zmx_container(container):
     return lanes, groups
 
 
-def observe_zmx(containers, previous=None):
-    """zmx-held lanes describe themselves (labels + meta sidecar): no registry edit is needed to see one."""
+def observe_zmx(containers, previous=None, listed=None):
+    """zmx-held lanes describe themselves (labels + meta sidecar): no registry edit is needed to see one.
+
+    `listed`, when given, receives `{container: unix time the zmx list was ISSUED}` for every container whose listing
+    ANSWERED this cycle (status.json `zmx_listed_at`). A container that timed out or failed is absent from it: its
+    groups are the previous ones republished, which say nothing about a lane created since. The co-located Studio
+    Host prunes a lane it started only on such a listing (design §8.10 C1, review round 6 — it read absence from any
+    fresh status.json and lost stop authority over lanes a timed-out listing had never seen)."""
     lanes, groups = {}, {}
     for container in containers:
+        issued = time.time()
         try:
-            found = observe_zmx_container(container) or kept_zmx(previous or {}, 'timeout', container)
+            answered = observe_zmx_container(container)
+            found = answered or kept_zmx(previous or {}, 'timeout', container)
+            if answered is not None and listed is not None:
+                listed[container] = issued
         except Exception as error:
             log(f'zmx {container}', error)
             found = kept_zmx(previous or {}, 'error', container)
@@ -860,7 +870,7 @@ def build_payload(ctx, level, reconcile=True):
     except Exception as error:
         log('observe', error)
         lanes = {lane_id: keep(previous, lane_id, 'error') for lane_id in previous.get('lanes') or {}}
-        # DEF-1457: COPIES of what was published, never the previous payload itself (`previous` is the very object
+        # DEF-1538: COPIES of what was published, never the previous payload itself (`previous` is the very object
         # `ctx['published']` holds, so a kept list extended in place would grow the published payload), and only
         # observe's own rows (holder 'tmux', the rows `observe` carries over too).
         servers = dict(previous.get('servers') or {})
@@ -876,11 +886,15 @@ def build_payload(ctx, level, reconcile=True):
             reconcile_client_sizes(registry, containers, live)
         except Exception as error:
             log('reconcile', error)
+    listed = {}
     try:
-        zmx_lanes, zmx_groups = observe_zmx(containers, previous)
+        zmx_lanes, zmx_groups = observe_zmx(containers, previous, listed)
     except Exception as error:
         log('zmx', error)
         zmx_lanes, zmx_groups = kept_zmx(previous, 'error')
+        listed = {}
+    # Outside the payload: it changes every cycle, and status.json is rewritten only on change (plus the heartbeat).
+    ctx['zmx_listed_at'] = listed
     lanes.update(zmx_lanes)
     return {'lanes': lanes, 'servers': servers, 'unregistered': unregistered, 'zmx': zmx_groups,
             'containers': {k: {'running': v.get('running', False)} for k, v in containers.items()}}
@@ -919,7 +933,8 @@ def cycle(ctx, reconcile=True):
         if payload != ctx['published'] or started - ctx['status_at'] > HEARTBEAT:
             try:
                 written = time.time()
-                L.atomic_write(L.STATE / 'status.json', json.dumps(dict(payload, health=health, updated_at=written)) + '\n')
+                L.atomic_write(L.STATE / 'status.json', json.dumps(dict(payload, health=health, updated_at=written,
+                                                                        zmx_listed_at=ctx.get('zmx_listed_at') or {})) + '\n')
                 ctx['published'], ctx['status_at'] = payload, written
             except Exception as error:
                 log('status.json', error)