@vibelord/lanes 1.0.4 → 1.1.0

package/payload/lanes/install.sh

@@ -7,21 +7,44 @@
 #   ./install.sh --check         verify terminal, SSH path, key and server (changes nothing)
 #   ./install.sh --uninstall     remove what the installer added (your SSH key and ~/Lanes Uploads are kept)
 #
-# Options
-#   --device NAME     name of this machine's view session (default: <user>-<hostname>; kept on re-install)
+# Options — remembered in ~/.config/lanes/install-options: a re-run (an update) repeats the last install's choices,
+# and a flag given again overrides the remembered value (`lanes-launch update`: the newest npm package, run that way)
+#   --device NAME     name of this machine's view session (default: <user>-<hostname>)
 #   --key PATH        SSH private key to use (default: the one already configured, else ~/.ssh/id_ed25519,
 #                     else a new dedicated key ~/.ssh/lanes_ed25519)
-#   --site FILE       server profile (default: site/site.conf, else the remembered client profile)
-#   --link            symlink the client into this checkout instead of copying it (for working on the harness)
-#   --coder-launch    also provide the command name `coder-launch` (an existing one is kept as coder-launch-legacy)
-#   --no-desktop      skip desktop integration (Lanes.app / .desktop entry / Hyprland key binding)
-#   --no-uploads      skip the uploads watch folder and the upload helper service
+#   --site FILE       server profile (default: the remembered one, else site/site.conf, else the installed copy)
+#   --coder-launch    also provide the command name `coder-launch` (an existing one is kept as coder-launch-legacy);
+#                     --no-coder-launch takes it away again
+#   --no-desktop      no desktop integration (Lanes.app / .desktop entry / Hyprland key binding): what an earlier
+#                     install added is removed; --desktop: back on
+#   --no-uploads      no uploads watch-folder agent and no upload helper service: what an earlier install added is
+#                     stopped and removed (~/Lanes Uploads and the files in it stay); --uploads: back on
 #   --palette         give the lanes window the cockpit's own Ghostty palette instead of your everyday theme
-#                     (off by default; a re-run without it puts the inherited look back)
+#                     (off by default; --no-palette puts the inherited look back)
+# Not remembered
+#   --invite CODE     join with an invite code when the server does not know this machine's key yet (or: LANES_INVITE)
+#   --resume          keep waiting on this machine's pending access request (~/.config/lanes/enrol-request)
+#   --link            symlink the client into this checkout instead of copying it (for working on the harness)
 #   --yes             never prompt (a new key is then created WITHOUT a passphrase)
 #
+# With a key that has a passphrase (Linux), the upload helper service logs in through the SSH agent the systemd user
+# manager holds, looked up again before every login: the installer hands this terminal's agent over and adds a marked
+# block to your login profile that does it at every local login (removed by --uninstall and --no-uploads; a profile
+# it cannot write is left as it was, the line printed). An agent your desktop session hands over itself works too.
+#
+# A server with a Tailscale name (the profile's LANES_SERVER_NAME ends in .ts.net) is tried only once this machine is
+# in the tailnet: no Tailscale -> the install command for it; logged out -> the installer opens `tailscale login` and
+# waits up to 120 s (LANES_TAILSCALE_WAIT) for this machine to connect, with a countdown. --check only looks.
+# The SSH alias `lanes` names the server by that name when this machine resolves it (MagicDNS), its address as lanes-ip.
+#
+# Joining: when the server does not know this machine's key, the site's enrolment service (https://<LANES_SERVER_NAME>
+# :8443/enrol/) authorizes it — at once for an invite code; without one, on a terminal, the installer offers to ask the
+# site's members and waits up to 10 min (LANES_ENROL_WAIT) for an approval. The client never edits authorized_keys.
+# No service, a refused code, or no code and no terminal: the public key is printed for the admin (exit 3), as before.
+#
 # Exit status: 0 ready to use · 3 installed, but this machine's key is not authorized on the server yet ·
-#              4 installed, but the server is not reachable (Tailscale?) or did not answer in time (busy?) · 1 error
+#              4 installed, but not in the tailnet, or the server is not reachable or did not answer in time (busy?) ·
+#              1 error
 set -eu
 here=$(cd "$(dirname "$0")" && pwd)
 if [ "${1:-}" = --server ]; then
@@ -37,8 +60,8 @@ stamp=$(date -u +%Y%m%dT%H%M%SZ)
 label=ai.beyondwork.lanes-upload
 helper_label=ai.beyondwork.lanes-helper
 
-mode=install device= key= site_file=$here/site/site.conf link=0 coder_launch=0 desktop=1 uploads=1 assume_yes=0 palette=0
-[ -r "$site_file" ] || site_file=$config/client-site.conf
+# Empty = not given on the command line: resolve_options fills it from install-options, else the default.
+mode=install device= key= site_file= link=0 coder_launch= desktop= uploads= assume_yes=0 palette= invite= resume=0
 while [ $# -gt 0 ]; do
     case "$1" in
         --check) mode=check ;;
@@ -46,17 +69,24 @@ while [ $# -gt 0 ]; do
         --device) device=${2:?--device NAME}; shift ;;
         --key) key=${2:?--key PATH}; shift ;;
         --site) site_file=${2:?--site FILE}; shift ;;
+        --invite) invite=${2:?--invite CODE}; shift ;;
+        --resume) resume=1 ;;
         --link) link=1 ;;
         --coder-launch) coder_launch=1 ;;
+        --no-coder-launch) coder_launch=0 ;;
+        --desktop) desktop=1 ;;
         --no-desktop) desktop=0 ;;
+        --uploads) uploads=1 ;;
         --no-uploads) uploads=0 ;;
         --palette) palette=1 ;;
+        --no-palette) palette=0 ;;
         --yes|-y) assume_yes=1 ;;
-        -h|--help) sed -n '2,24p' "$0"; exit 0 ;;
+        -h|--help) sed -n '2,47p' "$0"; exit 0 ;;
         *) echo "install.sh: unknown option $1 (see --help)" >&2; exit 1 ;;
     esac
     shift
 done
+[ -n "$invite" ] || invite=${LANES_INVITE:-}
 
 say()  { printf '  %s\n' "$*"; }
 head_() { printf '\n%s\n' "$*"; }
@@ -64,6 +94,93 @@ warn() { printf '  ! %s\n' "$*" >&2; }
 die()  { printf 'install.sh: %s\n' "$*" >&2; exit 1; }
 tilde() { case "$1" in "$HOME"/*) printf '~/%s' "${1#"$HOME"/}" ;; *) printf '%s' "$1" ;; esac; }
 
+# ---- remembered options ---------------------------------------------------------------------------------------------
+# $config/install-options holds every choice of the last install (KEY=VALUE, mode 0600, read with sed — never sourced
+# or executed), so a plain re-run, and with it every update, repeats that install; a flag on the command line wins and
+# becomes the new remembered value; --check only reads it; --uninstall removes it. A newer SCHEMA is neither read nor
+# overwritten. SITE holds a profile bundled with the running tree by NAME (it resolves against the tree that runs, so
+# an update reads the new package's copy and its pinned host key), any other profile by absolute path.
+options=$config/install-options
+options_schema=1
+opt() { sed -n "s/^$1=//p" "$options" 2>/dev/null | tail -n 1; }
+opt_flag() {   # opt_flag NAME -> 0, 1 or nothing
+    ov=$(opt "$1")
+    case "$ov" in ''|0|1) printf '%s' "$ov" ;; *) warn "install-options: ignored $1 (not 0 or 1)" ;; esac
+}
+read_options() {   # -> o_*; returns 1 when there is no file to read
+    o_device= o_key= o_site= o_desktop= o_uploads= o_palette= o_coder_launch= options_keep=0
+    [ -r "$options" ] || return 1
+    case "$(opt SCHEMA)" in ''|"$options_schema") ;; *)
+        warn "$(tilde "$options") was written by a newer installer: not read, and left as it is"
+        options_keep=1; return 0 ;;
+    esac
+    o_device=$(opt DEVICE)
+    case "$o_device" in *[!a-z0-9_.-]*|.*) warn 'install-options: ignored DEVICE (not a device name)'; o_device= ;; esac
+    o_key=$(opt KEY)
+    case "$o_key" in ''|/*|'~/'*) ;; *) warn 'install-options: ignored KEY (not an absolute path)'; o_key= ;; esac
+    o_site=$(opt SITE)
+    case "$o_site" in ''|/*) ;; .*|*/*|*[!A-Za-z0-9_.-]*) warn 'install-options: ignored SITE (neither a profile name nor an absolute path)'; o_site= ;; esac
+    o_desktop=$(opt_flag DESKTOP); o_uploads=$(opt_flag UPLOADS)
+    o_palette=$(opt_flag PALETTE); o_coder_launch=$(opt_flag CODER_LAUNCH)
+    return 0
+}
+# A client installed before install-options existed left its choices behind as files: read them from there once.
+# Desktop and uploads read as off only when NOTHING of that integration is left (desktop_left / uploads_left): an
+# option that is off takes away what an earlier install added, so an "off" inferred from one deleted piece would take
+# away the rest — a key binding still in use, a running upload helper.
+adopt_options() {
+    if [ -z "$palette" ] && [ -e "$config/ghostty-palette.conf" ]; then palette=1; fi
+    if [ -z "$coder_launch" ]; then
+        case "$(readlink "$bin/coder-launch" 2>/dev/null || :)" in */lanes/client/*|"$here"/client/*) coder_launch=1 ;; esac
+    fi
+    if [ -z "$desktop" ] && ! desktop_left; then desktop=0; fi
+    if [ -z "$uploads" ] && ! uploads_left; then uploads=0; fi
+}
+# Command line > install-options > (an older install's files) > defaults. Sets site_pick: the explicitly chosen
+# profile (command line or remembered), empty when the default chain picked it.
+resolve_options() {
+    adopting=0
+    if ! read_options && [ -r "$config/device" ]; then adopting=1; fi
+    [ -n "$device" ] || device=$o_device
+    [ -n "$key" ] || key=$o_key
+    site_pick=$site_file
+    if [ -z "$site_file" ] && [ -n "$o_site" ]; then
+        case "$o_site" in /*) remembered_site=$o_site ;; *) remembered_site=$here/site/$o_site/site.conf ;; esac
+        if [ -r "$remembered_site" ]; then site_file=$remembered_site; site_pick=$remembered_site
+        else warn "the remembered site profile ($o_site) is not here: using the default profile"; fi
+    fi
+    if [ -z "$site_file" ]; then site_file=$here/site/site.conf; [ -r "$site_file" ] || site_file=$config/client-site.conf; fi
+    [ -n "$desktop" ] || desktop=$o_desktop
+    [ -n "$uploads" ] || uploads=$o_uploads
+    [ -n "$palette" ] || palette=$o_palette
+    [ -n "$coder_launch" ] || coder_launch=$o_coder_launch
+    if [ "$adopting" = 1 ]; then adopt_options; fi
+    : "${desktop:=1}" "${uploads:=1}" "${palette:=0}" "${coder_launch:=0}"
+}
+site_memory() {   # -> the SITE value to remember, or nothing (load_site has proven $site_pick readable)
+    [ -n "$site_pick" ] || return 0
+    case "$site_pick" in /*) sm=$site_pick ;; *) sm=$(cd "$(dirname "$site_pick")" && pwd)/$(basename "$site_pick") ;; esac
+    case "$sm" in "$config/client-site.conf") return 0 ;; esac                        # the installed copy itself
+    case "$sm" in "$here"/site/*/site.conf)
+        sm_name=${sm#"$here"/site/}; sm_name=${sm_name%/site.conf}
+        case "$sm_name" in ''|.*|*/*|*[!A-Za-z0-9_.-]*) ;; *) printf '%s' "$sm_name"; return 0 ;; esac ;;
+    esac
+    printf '%s' "$sm"
+}
+write_options() {
+    [ "$options_keep" = 0 ] || return 0
+    sm=$(site_memory)
+    rm -f "$options.new"
+    ( umask 077
+      { printf '%s\n' '# lanes client install options: written by install.sh on every install and read by the next one.' \
+            '# A flag on the command line overrides a value here; install.sh --uninstall removes this file. Never executed.' \
+            "SCHEMA=$options_schema" "DEVICE=$device" "KEY=$key"
+        if [ -n "$sm" ]; then printf 'SITE=%s\n' "$sm"; fi
+        printf '%s\n' "DESKTOP=$desktop" "UPLOADS=$uploads" "PALETTE=$palette" "CODER_LAUNCH=$coder_launch"
+      } > "$options.new" )
+    chmod 600 "$options.new"; mv "$options.new" "$options"
+}
+
 # ---- site -----------------------------------------------------------------------------------------------------------
 site_value() { sed -n "s/^$1=//p" "$site_file" 2>/dev/null | head -n 1; }
 load_site() {
@@ -71,11 +188,16 @@ load_site() {
     case "$(site_value LANES_SITE_SCHEMA)" in ''|1) ;; *) die "site file $site_file has a newer schema than this installer: update the checkout" ;; esac
     server_host=$(site_value LANES_SERVER_HOST); server_user=$(site_value LANES_SERVER_USER)
     server_alias=$(site_value LANES_SERVER_ALIAS); server_name=$(site_value LANES_SERVER_NAME)
+    site_name=$(site_value LANES_SITE); site_code=$(site_value LANES_SITE_CODE)
     server_public=$(site_value LANES_SERVER_PUBLIC)
     [ -n "$server_public" ] || server_public=$(sed -n 's/^LANES_SERVER_PUBLIC=//p' "$config/site.cache" 2>/dev/null | head -n 1)
     for value in "$server_host" "$server_user" "$server_alias"; do
         case "$value" in ''|*[!A-Za-z0-9_.:-]*) die "site file $site_file: LANES_SERVER_HOST/USER/ALIAS missing or malformed" ;; esac
     done
+    # (the name goes into an SSH stanza, a URL and curl's --resolve; the code is compared with an invite's prefix)
+    case "$server_name" in *[!A-Za-z0-9.-]*) die "site file $site_file: LANES_SERVER_NAME malformed" ;; esac
+    case "$site_code" in *[!A-Za-z]*|?????????*) die "site file $site_file: LANES_SITE_CODE malformed (1-8 letters)" ;; esac
+    case "$site_name" in *[!A-Za-z0-9_.-]*) site_name= ;; esac
     case "$server_public" in *[!A-Za-z0-9_.:-]*) server_public= ;; esac
     pinned=$(dirname "$site_file")/known_hosts
     [ "$site_file" != "$config/client-site.conf" ] || pinned=$config/client-known-hosts
@@ -97,6 +219,8 @@ choose_key() {
         key=$(awk '$1 == "IdentityFile" { print $2; exit }' "$HOME/.ssh/config.d/lanes.conf")
     fi
     case "$key" in "~/"*) key=$HOME/${key#"~/"} ;; esac
+    # (absolute, so the SSH stanza and install-options name the same file from any working directory)
+    case "$key" in ''|/*) ;; *) if [ -d "$(dirname "$key")" ]; then key=$(cd "$(dirname "$key")" && pwd)/$(basename "$key"); fi ;; esac
     if [ -z "$key" ]; then
         if [ -r "$HOME/.ssh/id_ed25519" ]; then key=$HOME/.ssh/id_ed25519; else key=$HOME/.ssh/lanes_ed25519; fi
     fi
@@ -122,17 +246,43 @@ ssh_knows() { ssh -F /dev/null -o "$1" -G localhost >/dev/null 2>&1; }
 optional() {   # optional <MARKER> <yes|no>: keep or drop the template lines carrying #@MARKER@
     if [ "$2" = yes ]; then sed "s/^#@$1@ \{0,1\}//"; else grep -v "^#@$1@" || :; fi
 }
+# The alias names the server by its MagicDNS name when THIS machine resolves it — a server that gets a new tailnet
+# address keeps working — with the address as a second alias, lanes-ip, that lanes-launch falls back to. A machine
+# without MagicDNS (or with `tailscale up --accept-dns=false`) gets the address, as before. Both aliases pin ONE host
+# key: known_hosts is keyed by HostKeyAlias (the profile's alias), never by the name or the address.
+name_resolves() {   # NAME -> 0 when this machine's resolver answers for it (bounded: a resolver that hangs is a no)
+    deadline=$(( $(date +%s) + 5 ))
+    if command -v getent >/dev/null 2>&1; then
+        bounded getent hosts "$1" && [ -n "$out" ]
+    elif command -v dscacheutil >/dev/null 2>&1; then          # macOS has no getent
+        bounded dscacheutil -q host -a name "$1" || :
+        case "$out" in *ip_address:*) return 0 ;; esac
+        return 1
+    else
+        return 1
+    fi
+}
+ssh_target() {   # -> ssh_hostname (HostName of `lanes`), ip_alias (HostName of lanes-ip; empty = none), magicdns_note
+    ssh_hostname=$server_host ip_alias= magicdns_note=
+    st_name=${server_name%.}
+    if [ -z "$st_name" ] || [ "$st_name" = "$server_host" ]; then return 0; fi
+    if name_resolves "$st_name"; then ssh_hostname=$st_name; ip_alias=$server_host
+    else magicdns_note=" (MagicDNS does not resolve $st_name here)"; fi
+}
 render_stanza() {   # -> stdout
     identity=$(tilde "$key")
     public=no; [ -n "$server_public" ] && public=yes
     obscure=no; ssh_knows ObscureKeystrokeTiming=no && obscure=yes
     keychain=no; ssh_knows UseKeychain=yes && keychain=yes
-    sed -e "s|@HOST@|$server_host|g" -e "s|@USER@|$server_user|g" -e "s|@ALIAS@|$server_alias|g" \
+    ipalias=no noipalias=yes; if [ -n "$ip_alias" ]; then ipalias=yes noipalias=no; fi
+    sed -e "s|@HOST@|$ssh_hostname|g" -e "s|@IP@|$ip_alias|g" -e "s|@USER@|$server_user|g" -e "s|@ALIAS@|$server_alias|g" \
         -e "s|@IDENTITY@|$identity|g" -e "s|@PUBLIC_HOST@|$server_public|g" "$src/ssh.stanza.in" |
+        optional IPALIAS "$ipalias" | optional NOIPALIAS "$noipalias" |
         optional PUBLIC "$public" | optional OBSCURE "$obscure" | optional KEYCHAIN "$keychain"
 }
 install_ssh() {
     mkdir -p "$HOME/.ssh/config.d"; chmod 700 "$HOME/.ssh" "$HOME/.ssh/config.d"
+    ssh_target
     # Guard: our file is parsed for EVERY ssh destination. If the configuration parsed before and does not parse
     # after, put the previous file back — never leave a machine whose ssh is broken for other hosts.
     parsed_before=no; ssh -G lanes-selftest.invalid >/dev/null 2>&1 && parsed_before=yes
@@ -155,7 +305,9 @@ install_ssh() {
         die "the generated SSH stanza does not parse on this machine — put the previous one back. ssh said: $problem"
     fi
     rm -f "$stanza.prev"
-    say "ssh: host alias 'lanes' -> $server_user@$server_host, key $(tilde "$key")$([ -n "$server_public" ] && echo ', fallback lanes-public')"
+    if [ -n "$ip_alias" ]; then sv_path="$server_user@$ssh_hostname (fallback lanes-ip -> $ip_alias)"
+    else sv_path="$server_user@$ssh_hostname$magicdns_note"; fi
+    say "ssh: host alias 'lanes' -> $sv_path, key $(tilde "$key")$([ -n "$server_public" ] && echo ', fallback lanes-public')"
     pin_host_key
 }
 # The server key is PINNED from the package (site/known_hosts): a new machine never trusts on first use.
@@ -198,6 +350,7 @@ install_client() {
     say "commands: lanes-launch, lanes-window, lanes-upload in $(tilde "$bin") ($([ "$link" = 1 ] && echo "linked to this checkout" || echo "copied to $(tilde "$target")"))"
     printf '%s\n' "$device" > "$config/device"
     say "device (view session) name: $device"
+    write_options
     # (a non-interactive ssh session has a minimal PATH: ask the login shell before complaining)
     login_path=$("${SHELL:-/bin/sh}" -lc 'printf %s "$PATH"' 2>/dev/null || :)
     case ":$PATH:$login_path:" in *":$bin:"*) ;; *)
@@ -210,6 +363,13 @@ install_client() {
             mv "$bin/coder-launch" "$bin/coder-launch-legacy"; say 'kept the previous coder-launch as coder-launch-legacy'
         fi
         ln -sfn "$target/lanes-launch" "$bin/coder-launch"; say '`coder-launch` now starts the lanes client'
+    else
+        # Off (--no-coder-launch, or remembered off): a coder-launch this installer provided goes, the kept one returns.
+        case "$(readlink "$bin/coder-launch" 2>/dev/null || :)" in */lanes/client/*|"$here"/client/*)
+            rm -f "$bin/coder-launch"
+            if [ -e "$bin/coder-launch-legacy" ]; then mv "$bin/coder-launch-legacy" "$bin/coder-launch"; say 'restored the previous coder-launch'; fi
+            say '`coder-launch` no longer starts the lanes client (--coder-launch brings it back)' ;;
+        esac
     fi
     # Ghostty: a SEPARATE instance with its own config file; the everyday Ghostty config is only read, never written.
     { echo "# Generated by the lanes installer — edit the sources in client/ghostty/ and re-run it."
@@ -460,6 +620,89 @@ install_macos_helper_app() {
     mv "$built" "$helper_app"
     rmdir "$build"
 }
+# ---- SSH agent hand-off (Linux, a key with a passphrase) ------------------------------------------------------------
+# A user unit cannot ask for a passphrase, so the helper service logs in through the agent the systemd user manager
+# holds — looked up again before every login (lanes-launch `manager_agent`), because default.target can start the
+# service before a desktop session hands its agent to the manager. The installer hands this terminal's agent over now
+# and appends ONE marked block to the file this account's login shell reads at session start, which does the same at
+# every local login: never a remote login's forwarded agent (SSH_CONNECTION), and a no-op while the manager already
+# has that agent (so login shells that tools spawn do not restart the helper; the helper takes the manager's agent at
+# its next login anyway — the try-restart only saves that wait). The markers keep a re-run from adding a second block
+# and let --uninstall and --no-uploads remove exactly it.
+agent_begin='# >>> lanes agent hand-off >>>'
+agent_end='# <<< lanes agent hand-off <<<'
+agent_profile() {   # -> the login file of $SHELL; fails for fish (not POSIX syntax; that block is not written)
+    case "${SHELL:-}" in
+        */fish) return 1 ;;
+        */zsh) printf '%s' "${ZDOTDIR:-$HOME}/.zprofile" ;;
+        */bash)   # bash reads the FIRST of these that exists, ~/.profile only when neither other one does
+            for ap in "$HOME/.bash_profile" "$HOME/.bash_login" "$HOME/.profile"; do
+                if [ -e "$ap" ]; then printf '%s' "$ap"; return 0; fi
+            done
+            printf '%s' "$HOME/.profile" ;;
+        *) printf '%s' "$HOME/.profile" ;;
+    esac
+}
+agent_block() {
+    printf '%s\n' "$agent_begin" \
+        "# The lanes upload helper service (a systemd user unit) logs in through this login's SSH agent: hand it to the" \
+        '# user manager once per agent. Added by the lanes installer; `install.sh --uninstall` removes this block.' \
+        'if [ -n "${SSH_AUTH_SOCK:-}" ] && [ -z "${SSH_CONNECTION:-}" ] && command -v systemctl >/dev/null 2>&1 &&' \
+        '   ! systemctl --user show-environment 2>/dev/null | grep -qxF "SSH_AUTH_SOCK=$SSH_AUTH_SOCK"; then' \
+        '    systemctl --user import-environment SSH_AUTH_SOCK >/dev/null 2>&1 &&' \
+        '        systemctl --user try-restart lanes-helper.service >/dev/null 2>&1 || :' \
+        'fi' "$agent_end"
+}
+# The login profile is the user's own file (a read-only dotfiles checkout, root-owned, chattr +i, a full disk): every
+# write to it is backed up first and made in a subshell, so one that fails costs a warning, never the install or the
+# uninstall, and one that fails part-way is put back from the backup — in place, so a profile that is a symlink into
+# a dotfiles checkout stays one. append_agent_block returns 0 only when the whole block was written.
+append_agent_block() {   # FILE: append the block (after a newline when FILE does not end in one)
+    if [ ! -e "$1" ]; then
+        ( agent_block > "$1" ) 2>/dev/null && return 0
+        if [ ! -L "$1" ]; then rm -f "$1"; fi; return 1      # (a new file written part-way goes again)
+    fi
+    if ! cp -p "$1" "$1.pre-lanes.$stamp" 2>/dev/null; then rm -f "$1.pre-lanes.$stamp"; return 1; fi
+    ( { if [ -s "$1" ] && [ -n "$(tail -c 1 "$1")" ]; then printf '\n'; fi; agent_block; } >> "$1" ) 2>/dev/null && return 0
+    undo_profile_write "$1" "$1.pre-lanes.$stamp"; return 1
+}
+undo_profile_write() {   # FILE BACKUP: a write to FILE failed — FILE gets the backup's content back, the backup goes
+    if cmp -s "$2" "$1" || ( cat "$2" > "$1" ) 2>/dev/null; then rm -f "$2" || :; return 0; fi
+    warn "$(tilde "$1") was changed part-way and could not be put back: its earlier content is in $(tilde "$2")"
+}
+hand_agent_over() {
+    if ! ap=$(agent_profile); then
+        warn 'your key has a passphrase and your shell is fish: add `systemctl --user import-environment SSH_AUTH_SOCK; systemctl --user try-restart lanes-helper` to your fish login (nothing is written for fish)'
+        later='your fish login (the line above)'
+    elif { [ -f "$ap" ] && grep -qxF "$agent_begin" "$ap"; } || append_agent_block "$ap"; then
+        later="$(tilde "$ap") (block 'lanes agent hand-off')"
+    else
+        warn "your key has a passphrase and $(tilde "$ap") could not be written (left as it was): add \`systemctl --user import-environment SSH_AUTH_SOCK; systemctl --user try-restart lanes-helper\` to your login yourself"
+        later='your login (the line above)'
+    fi
+    if [ -n "${SSH_AUTH_SOCK:-}" ] && [ -z "${SSH_CONNECTION:-}" ]; then
+        systemctl --user import-environment SSH_AUTH_SOCK >/dev/null 2>&1 || :
+        say "upload helper: your key has a passphrase — handed this terminal's SSH agent to the service now; $later hands it over at every local login"
+    else
+        say "upload helper: your key has a passphrase — $later hands your SSH agent to the service from your next local login on; until then the open window serves the upload box"
+    fi
+}
+remove_agent_hand_off() {   # [uninstall|off]: the reason, which names the backup (.pre-lanes-<reason>.<UTC>)
+    for ap in "$HOME/.profile" "$HOME/.bash_profile" "$HOME/.bash_login" "${ZDOTDIR:-$HOME}/.zprofile"; do
+        if [ ! -f "$ap" ] || ! grep -qxF "$agent_begin" "$ap"; then continue; fi
+        if ! grep -qxF "$agent_end" "$ap"; then warn "$(tilde "$ap"): the lanes agent hand-off block has lost its end marker — left as it is"; continue; fi
+        backup=$ap.pre-lanes-${1:-uninstall}.$stamp
+        if ! cp -p "$ap" "$backup" 2>/dev/null; then
+            rm -f "$backup"                                       # (a backup that did not fit: nothing else touched)
+        elif ( awk -v b="$agent_begin" -v e="$agent_end" '$0 == b { skip = 1 } !skip { print } $0 == e { skip = 0 }' \
+                "$backup" > "$ap" ) 2>/dev/null; then
+            say "removed the SSH agent hand-off from $(tilde "$ap") (backup kept)"; continue
+        else
+            undo_profile_write "$ap" "$backup"
+        fi
+        warn "$(tilde "$ap") could not be written: the lanes agent hand-off block is still in it — delete its lines from '$agent_begin' to '$agent_end' yourself"
+    done
+}
 install_helper_service() {
     if ! helper_supported; then say 'upload helper: the open lanes window serves the upload box (this client has no service mode)'; return 0; fi
     mkdir -p "$state"
@@ -486,13 +729,14 @@ install_helper_service() {
             '[Service]' "ExecStart=/bin/sh $bin/lanes-launch --helper $device --service" 'Restart=always' 'RestartSec=5' \
             '[Install]' 'WantedBy=default.target' > "$units/lanes-helper.service"
         systemctl --user daemon-reload >/dev/null 2>&1 || :
+        # A user unit has no terminal to ask for a passphrase and cannot be handed SSH_AUTH_SOCK by this script
+        # (PassEnvironment is not valid in user units): with a protected key the service logs in through the agent
+        # the user manager knows. (-P '': succeeds only for a key without a passphrase.) Before the restart below,
+        # so the restarted service starts with the agent.
+        ssh-keygen -y -P '' -f "$key" >/dev/null 2>&1 || hand_agent_over
         # enable + restart (not `enable --now`): an update must run the NEW client, a first install connects once.
         systemctl --user enable lanes-helper.service >/dev/null 2>&1 || :
         systemctl --user restart lanes-helper.service >/dev/null 2>&1 || :
-        # A user unit has no terminal to ask for a passphrase and cannot be handed SSH_AUTH_SOCK by this script
-        # (PassEnvironment is not valid in user units). (-P '': succeeds only for a key without a passphrase.)
-        ssh-keygen -y -P '' -f "$key" >/dev/null 2>&1 ||
-            warn "your key has a passphrase: the helper service can only log in through an agent the systemd user manager knows (\`systemctl --user import-environment SSH_AUTH_SOCK\` at session start, then \`systemctl --user restart lanes-helper\`). Until then the open window serves the upload box."
     else
         say 'upload helper: no launchd or systemd here — the open lanes window serves the upload box'; return 0
     fi
@@ -504,18 +748,254 @@ mtime() { stat -c %Y "$1" 2>/dev/null || stat -f %m "$1" 2>/dev/null; }
 # --check: is anything serving the upload box? Whoever does (the service, or a window's own helper when there is no
 # service) touches helper.alive on every READY/PING line from the server (one every 5 s); serving = younger than 90 s.
 check_helper() {
+    # (uploads off: no service is meant to run; one that still does is what an install with --no-uploads takes away —
+    # named with the flag: off may come from this command line while install-options still says UPLOADS=1)
+    if [ "$uploads" = 0 ]; then
+        if helper_loaded; then warn 'upload helper: uploads are off, but the service still runs — ./install.sh --no-uploads takes it away'
+        else say 'upload helper: off (--uploads turns it on) — an open lanes window serves the upload box itself'; fi
+        return 0
+    fi
     # (a client without the service side never writes helper.alive: there is nothing to measure, and nothing wrong)
     if ! helper_supported; then say 'upload helper: an open lanes window serves the upload box itself (this client has no service mode)'; return 0; fi
     service='no service (./install.sh adds it)'; if helper_loaded; then service='service running'; fi
     seen=$(mtime "$state/helper.alive") || seen=
     if [ -z "$seen" ] && helper_loaded; then warn "upload helper: $service, but it has never reached the server (log: $(helper_log))"; return 0; fi
-    # (no service and no heartbeat may be a choice: --no-uploads, or no window opened yet)
+    # (no service and no heartbeat: no launchd or systemd here, or no window opened yet)
     if [ -z "$seen" ]; then say "upload helper: $service — an open lanes window serves the upload box itself"; return 0; fi
     age=$(( $(date +%s) - seen ))
     if [ "$age" -lt 90 ]; then say "ok   upload helper: $service; last heard from the server ${age}s ago"
     else warn "upload helper: $service; last heard from the server ${age}s ago (log: $(helper_log))"; fi
 }
 
+# ---- an integration turned off --------------------------------------------------------------------------------------
+# --no-desktop / --no-uploads — given, or remembered — on a machine where an earlier install added that integration
+# take it away again, as --no-coder-launch and --no-palette do: the installed state follows the remembered value, so no
+# update leaves a helper running, or a key binding in place, that the options say is off. --uninstall runs the same.
+#   desktop_off|uploads_off off        only what is there: a machine that never had it is not touched
+#   desktop_off|uploads_off uninstall  every agent and unit, also one whose file is already gone
+# -> off_gone: what was taken away, for one line ('' = nothing was there). The watch folder and its files always stay.
+off_add() { off_gone="${off_gone:+$off_gone, }$1"; }
+# The lanes lines of a Hyprland config, and the blank line install_desktop put before its comment: the file is put back
+# as it was before, so turning the desktop off and on again never piles up blank lines.
+hypr_strip='index($0, c) || index($0, r) || index($0, s) { if (index($0, c)) held = 0; next }
+held { print "" } { held = ($0 == "") } !held { print } END { if (held) print "" }'
+hypr_require='require("hypr.lanes")' hypr_source='source = ~/.config/hypr/lanes.conf'
+# Is any piece of that integration on this machine — anything desktop_off / uploads_off would take away (the watch
+# folder's README counts for uploads: a 1.0.x install always wrote it)? adopt_options reads "off" only from a no.
+desktop_left() {
+    for piece in "$HOME/Applications/Lanes.app" "$HOME/Applications/Lanes Upload.app" \
+                 "$HOME/.local/share/applications/lanes.desktop" "$HOME/.config/hypr/lanes.lua" "$HOME/.config/hypr/lanes.conf"; do
+        [ ! -e "$piece" ] || return 0
+    done
+    for main in "$HOME/.config/hypr/hyprland.lua" "$HOME/.config/hypr/hyprland.conf"; do
+        if [ -f "$main" ] && grep -q -F -e "$hypr_require" -e "$hypr_source" "$main"; then return 0; fi
+    done
+    return 1
+}
+uploads_left() {
+    left_units=${XDG_CONFIG_HOME:-$HOME/.config}/systemd/user
+    for piece in "$(cat "$config/uploads-dir" 2>/dev/null || echo "$HOME/Lanes Uploads")/README.txt" \
+                 "$HOME/Library/LaunchAgents/$label.plist" "$HOME/Library/LaunchAgents/$helper_label.plist" \
+                 "$HOME/Applications/Lanes Upload.app" "$HOME/Applications/Lanes Helper.app" \
+                 "$left_units/lanes-upload.path" "$left_units/lanes-upload.service" "$left_units/lanes-helper.service"; do
+        [ ! -e "$piece" ] || return 0
+    done
+    return 1
+}
+desktop_off() {
+    off_gone=
+    if [ "$os" = Darwin ]; then
+        for app in "$HOME/Applications/Lanes.app" "$HOME/Applications/Lanes Upload.app"; do
+            if [ -e "$app" ]; then rm -rf "$app"; off_add "$(tilde "$app")"; fi
+        done
+        return 0
+    fi
+    entry=$HOME/.local/share/applications/lanes.desktop
+    if [ -e "$entry" ]; then rm -f "$entry"; off_add 'the Lanes launcher entry'; fi
+    hypr=$HOME/.config/hypr hypr_kept=0 hypr_gone=0
+    for main in "$hypr/hyprland.lua" "$hypr/hyprland.conf"; do
+        [ -f "$main" ] && grep -q -F -e "$hypr_require" -e "$hypr_source" "$main" || continue
+        # The user's own file, written as the login profile is (backup first, in a subshell, put back on failure): one
+        # that cannot be written costs a warning, never the run — and keeps the bind file it still loads.
+        backup=$main.pre-lanes-$1.$stamp
+        if ! cp -p "$main" "$backup" 2>/dev/null; then
+            rm -f "$backup"
+        elif ( awk -v c='lanes workspace server (remove this line' -v r="$hypr_require" \
+                   -v s="$hypr_source" "$hypr_strip" "$backup" > "$main" ) 2>/dev/null; then
+            off_add "the lanes line in $(tilde "$main") (backup $(basename "$backup"))"; hypr_gone=1; continue
+        else
+            undo_profile_write "$main" "$backup"
+        fi
+        hypr_kept=1
+        warn "Hyprland: $(tilde "$main") could not be written — it still loads the lanes key bindings; delete its lanes line yourself"
+    done
+    if [ "$hypr_kept" = 0 ]; then
+        for piece in "$hypr/lanes.lua" "$hypr/lanes.conf"; do
+            if [ -e "$piece" ]; then rm -f "$piece"; off_add "$(tilde "$piece")"; hypr_gone=1; fi
+        done
+    fi
+    if [ "$hypr_gone" = 1 ] || [ "$1" = uninstall ]; then
+        if command -v hyprctl >/dev/null 2>&1; then hyprctl reload >/dev/null 2>&1 || :; fi
+    fi
+}
+uploads_off() {
+    off_gone=
+    if [ "$os" = Darwin ]; then
+        for agent in "$label" "$helper_label"; do
+            plist=$HOME/Library/LaunchAgents/$agent.plist
+            [ "$1" = uninstall ] || [ -e "$plist" ] || continue
+            launchctl bootout "gui/$(id -u)/$agent" >/dev/null 2>&1 || :
+            if [ -e "$plist" ]; then rm -f "$plist"; off_add "the launchd agent $agent"; fi
+        done
+        for app in "$HOME/Applications/Lanes Upload.app" "$HOME/Applications/Lanes Helper.app"; do
+            if [ -e "$app" ]; then rm -rf "$app"; off_add "$(tilde "$app")"; fi
+        done
+    else
+        units=${XDG_CONFIG_HOME:-$HOME/.config}/systemd/user
+        uo_any=0
+        for unit in lanes-upload.path lanes-helper.service; do
+            [ "$1" = uninstall ] || [ -e "$units/$unit" ] || continue
+            systemctl --user disable --now "$unit" >/dev/null 2>&1 || :
+            uo_any=1; if [ -e "$units/$unit" ]; then off_add "$unit"; fi
+        done
+        if [ "$uo_any" = 1 ] || [ -e "$units/lanes-upload.service" ]; then
+            [ ! -e "$units/lanes-upload.service" ] || [ -n "$off_gone" ] || off_add lanes-upload.service
+            rm -f "$units/lanes-upload.path" "$units/lanes-upload.service" "$units/lanes-helper.service"
+            systemctl --user daemon-reload >/dev/null 2>&1 || :
+        fi
+    fi
+    rm -f "$state/helper.alive"          # (a window's own helper takes over at once instead of waiting it out)
+}
+
+# ---- tailscale ------------------------------------------------------------------------------------------------------
+# A profile whose server has a MagicDNS name (LANES_SERVER_NAME=*.ts.net) reaches it only through the tailnet, so this
+# machine has to be in it before the server is tried. An install opens `tailscale login` when the tailnet asks for one
+# and waits — bounded by LANES_TAILSCALE_WAIT seconds (default 120), with a countdown — until this machine is Running
+# and online; --check only looks. Not in the tailnet keeps the exit status the server's: 4, "installed, but the server
+# is not reachable". A profile without a .ts.net name skips all of this.
+tailscale_hint='macOS: brew install --cask tailscale · Linux: https://tailscale.com/download'
+tailnet_site() { case "$server_name" in *.ts.net|*.ts.net.) return 0 ;; esac; return 1; }
+tailscale_bin() {   # -> the tailscale CLI: on PATH, else (macOS) the one inside the app, a per-user copy first
+    if command -v tailscale >/dev/null 2>&1; then command -v tailscale; return 0; fi
+    [ "$os" = Darwin ] || return 1
+    for app in "$HOME/Applications/Tailscale.app" /Applications/Tailscale.app; do
+        [ -x "$app/Contents/MacOS/Tailscale" ] && { printf '%s\n' "$app/Contents/MacOS/Tailscale"; return 0; }
+    done
+    return 1
+}
+# JSON on stdin -> one "PATH=VALUE" line per scalar: PATH is /Key/Key/0… (array items by index), strings unquoted with
+# their escapes left as they are. Enough of a tokenizer for `tailscale status --json` in any layout — braces and quotes
+# inside strings included — so a peer's "Online" or another user's "LoginName" is never mistaken for this machine's.
+json_paths() {
+    awk '
+    function emit(v,   p, k) { p = ""; for (k = 1; k <= d; k++) p = p "/" key[k]; print p "=" v }
+    {
+        n = length($0); i = 1
+        while (i <= n) {
+            c = substr($0, i, 1)
+            if (c == "\"") {
+                j = i + 1
+                while (j <= n) { e = substr($0, j, 1); if (e == "\\") j += 2; else if (e == "\"") break; else j++ }
+                s = substr($0, i + 1, j - i - 1); i = j + 1
+                if (kind[d] == "o" && want) { key[d] = s; want = 0 } else emit(s)
+                continue
+            }
+            if (c == "{") { d++; kind[d] = "o"; key[d] = ""; want = 1 }
+            else if (c == "[") { d++; kind[d] = "a"; key[d] = 0; want = 0 }
+            else if (c == "}" || c == "]") d--
+            else if (c == ",") { if (kind[d] == "a") key[d]++; else want = 1 }
+            else if (c ~ /[-0-9tfn]/) {
+                j = i; while (j <= n && substr($0, j, 1) ~ /[-+.0-9A-Za-z]/) j++
+                emit(substr($0, i, j - i)); i = j; continue
+            }
+            i++
+        }
+    }'
+}
+ts_path() { printf '%s\n' "$ts_paths" | sed -n "s|^$1=||p" | head -n 1; }
+# One look -> ts_state (BackendState; empty when tailscaled does not answer), ts_online (Self.Online), ts_ip (Self's
+# first Tailscale address), ts_login (the LoginName of Self's user, looked up by Self.UserID in the User map).
+tailscale_look() {
+    ts_paths=$("$ts" status --json 2>/dev/null | json_paths) || ts_paths=
+    ts_state=$(ts_path /BackendState); ts_online=$(ts_path /Self/Online); ts_ip=$(ts_path /Self/TailscaleIPs/0)
+    ts_uid=$(ts_path /Self/UserID); ts_login=
+    case "$ts_uid" in ''|*[!0-9]*) ;; *) ts_login=$(ts_path "/User/$ts_uid/LoginName") ;; esac
+}
+# Said once per state, when it is first seen; ts_explained=1 when the state had its own advice.
+tailscale_explain() {
+    ts_explained=1
+    case "$ts_state" in
+        NeedsLogin)
+            if [ "$mode" = install ]; then say 'tailscale: needs login — opening `tailscale login`… (approve in the browser)'
+            else warn 'tailscale: needs login — run `tailscale login` (an install opens it for you), then check again'; fi ;;
+        '') warn "tailscale: installed, but not running — macOS: open the Tailscale app · Linux: sudo systemctl enable --now tailscaled ($("$ts" status --json 2>&1 >/dev/null | head -n 1))" ;;
+        Stopped) warn 'tailscale: switched off — switch it on in the Tailscale menu, or run `tailscale up`' ;;
+        NeedsMachineAuth) warn 'tailscale: this machine waits for a tailnet admin to approve it (admin console → Machines)' ;;
+        *) ts_explained=0 ;;
+    esac
+}
+# The countdown: rewritten in place on a terminal, a line every 10 s otherwise.
+ts_countdown() {
+    if [ -t 1 ]; then printf '\r  tailscale: waiting for the tailnet (%s) — %s s left ' "${ts_state:-no answer}" "$1"; ts_line=1
+    elif [ -z "$ts_note" ] || [ "$1" -le "$ts_note" ]; then
+        say "tailscale: waiting for the tailnet (${ts_state:-no answer}) — $1 s left"; ts_note=$(( $1 - 10 ))
+    fi
+}
+ts_countdown_done() { if [ "$ts_line" = 1 ]; then printf '\r\033[K'; ts_line=0; fi; }
+ts_end_login() {   # a login still waiting for approval is ended with the wait (the CLI is one process)
+    [ -n "$ts_login_pid" ] || return 0
+    kill "$ts_login_pid" 2>/dev/null || :
+    wait "$ts_login_pid" 2>/dev/null || :
+    ts_login_pid=
+}
+ts_finish() { ts_countdown_done; ts_end_login; trap - INT TERM HUP; }
+# -> 0 in the tailnet ("connected as …"), 1 not (why, and what to do, already printed)
+check_tailscale() {
+    if ! ts=$(tailscale_bin); then warn "tailscale: not installed — $tailscale_hint"; return 1; fi
+    ts_wait=${LANES_TAILSCALE_WAIT:-120}
+    case "$ts_wait" in ''|*[!0-9]*) warn "LANES_TAILSCALE_WAIT ignored (not a number of seconds): waiting 120 s"; ts_wait=120 ;; esac
+    [ "$mode" = install ] || ts_wait=0                  # --check looks once: no login, no wait
+    ts_deadline=$(( $(date +%s) + ts_wait ))
+    ts_seen=- ts_note= ts_line=0 ts_login_pid= ts_login_rc= ts_explained=0
+    while :; do
+        tailscale_look
+        if [ "$ts_state" = Running ] && [ "$ts_online" = true ]; then
+            ts_finish
+            say "tailscale: connected as ${ts_login:-an unknown login} (${ts_ip:-no address yet})"
+            return 0
+        fi
+        if [ "$ts_state" != "$ts_seen" ]; then ts_seen=$ts_state; ts_countdown_done; tailscale_explain; fi
+        if [ "$ts_state" = NeedsLogin ] && [ "$mode" = install ] && [ -z "$ts_login_pid$ts_login_rc" ]; then
+            # Its output — the login URL where no browser opens by itself — reaches this terminal.
+            "$ts" login </dev/null &
+            ts_login_pid=$!
+            # A background job ignores SIGINT: Ctrl-C (or a closed terminal) ends the login with the installer.
+            trap 'ts_end_login; exit 130' INT; trap 'ts_end_login; exit 143' TERM; trap 'ts_end_login; exit 129' HUP
+        fi
+        # A login that has already given up (Linux without operator rights: "Access denied") ends the wait now.
+        if [ -n "$ts_login_pid" ] && ! kill -0 "$ts_login_pid" 2>/dev/null; then
+            ts_login_rc=0; wait "$ts_login_pid" || ts_login_rc=$?
+            ts_login_pid=
+            if [ "$ts_login_rc" != 0 ]; then
+                ts_finish
+                warn "tailscale: \`tailscale login\` failed (exit $ts_login_rc) — Linux: \`sudo tailscale up\` once (\`sudo tailscale set --operator=\$USER\` lets you log in without sudo), then run ./install.sh again"
+                return 1
+            fi
+        fi
+        ts_left=$(( ts_deadline - $(date +%s) ))
+        [ "$ts_left" -gt 0 ] || break
+        ts_countdown "$ts_left"
+        sleep 1
+    done
+    ts_finish
+    if [ "$mode" = install ]; then
+        warn "tailscale: not on the tailnet after $ts_wait s (state: ${ts_state:-no answer}) — connect it, then run ./install.sh again"
+    elif [ "$ts_explained" = 0 ]; then
+        warn "tailscale: not on the tailnet yet (state: ${ts_state:-no answer}) — wait for it to connect, then check again"
+    fi
+    return 1
+}
+
 # ---- server ---------------------------------------------------------------------------------------------------------
 # Every call to the server is BOUNDED. A thrashing host accepts the connection and then says nothing for minutes;
 # ConnectTimeout does not cover the remote command, and macOS has no timeout(1) — so a watchdog subshell does it.
@@ -596,6 +1076,12 @@ report_server() {
         ok) say "server: $server_note" ;;
         old) warn "server answered, but without the expected greeting (an older server?): $server_note" ;;
         unauthorized)
+            # The enrolment service refused this machine for a reason a re-run fixes (enrol_conflicted): that remedy,
+            # never the hand-added key line — an invite is still live after a 409.
+            case "$enrol_conflict" in
+                device-taken) report_device_taken; return 0 ;;
+                key-taken) report_key_taken; return 0 ;;
+            esac
             head_ 'One step left: this machine is not authorized on the server yet.'
             say 'Send this PUBLIC key to your workspace-server admin (it is safe to share):'
             printf '\n    %s\n\n' "$(cat "$key.pub")"
@@ -609,34 +1095,399 @@ report_server() {
         unreachable)
             head_ "The server ($server_host) is not reachable from this machine."
             say 'The path runs over Tailscale: is it running, and is this machine in the tailnet?'
-            ts=$(command -v tailscale 2>/dev/null || echo /Applications/Tailscale.app/Contents/MacOS/Tailscale)
-            if [ -x "$ts" ]; then say "tailscale: $("$ts" status 2>&1 | head -n 1)"; else say 'tailscale: not installed (tailscale.com/download)'; fi
+            if ts=$(tailscale_bin); then say "tailscale: $("$ts" status 2>&1 | head -n 1)"; else say "tailscale: not installed — $tailscale_hint"; fi
             say "detail: $server_note" ;;
+        # (check_tailscale has said why and what to do; the server was not tried from outside the tailnet)
+        tailnet)
+            if [ "$mode" = install ]; then say 'The client is installed; the server is checked once this machine is in the tailnet.'; fi ;;
     esac
 }
 
+# A 409 from the enrolment service (enrold answers it only after a valid invite code, or to a request it would
+# otherwise file): the machine's name or key is already a member's. Nothing was used up: the invite stays live and no
+# request is open, so the same command with another name — or another key — joins.
+report_device_taken() {
+    head_ "One step left: the server already has a device named $device."
+    say 'Another machine has that name (two laptops with one hostname), or this machine joined before with another key.'
+    if [ "$enrol_via" = invite ]; then
+        say 'Your invite is still valid. Run the install again with a name of its own for this machine:'
+        say '    --invite CODE --device NAME          (the installer remembers the name)'
+    else
+        say 'Ask again under a name of its own for this machine:  --device NAME   (the installer remembers the name)'
+    fi
+    say "If the machine that had the name is gone, a member first ends it on the server: lanes offboard $device --yes"
+}
+report_key_taken() {
+    head_ "One step left: the server already holds this machine's key ($(tilde "$key")) for another device."
+    say 'A key joins once. The server keeps it under another device name, yet does not let it in here.'
+    if [ "$key" != "$HOME/.ssh/lanes_ed25519" ]; then
+        if [ "$enrol_via" = invite ]; then
+            say 'Your invite is still valid. Join with a key of its own (the installer makes it):'
+            say '    --invite CODE --key ~/.ssh/lanes_ed25519'
+        else
+            say 'Ask again with a key of its own (the installer makes it):  --key ~/.ssh/lanes_ed25519'
+        fi
+    fi
+    say 'A member sees on the server which device holds it: lanes keys list   (gone? lanes offboard <device> --yes)'
+}
+
+# ---- joining a site -------------------------------------------------------------------------------------------------
+# The server answered, but not for this machine's key (check_server: unauthorized). The site's enrolment service —
+# lanes-enrold behind the server's private HTTPS front, https://<LANES_SERVER_NAME>:8443/enrol/ — authorizes the key: at
+# once for an invite code (--invite, LANES_INVITE, or typed at the prompt); without one, a member approves an access
+# request while the installer waits (LANES_ENROL_WAIT s, default 600; --resume waits again). The service writes the
+# server's authorized_keys; this client never edits that file. Wire contract v1 as lanes-enrold serves it (W8 A3,
+# DM-LANES-ENROL-WIRE; what this client reads of it: lanes/docs/ARCHITECTURE.md, "Joining a site"): JSON both ways,
+# 200 = done (202 = a request filed), any other status = refused, with {"error": …}. No service, a refusal, or no code
+# and nobody at a terminal to ask: report_server's exit-3 text, unchanged — except a 409 (the device name or the key is
+# already a member's), which names the re-run that joins instead (report_device_taken, report_key_taken). The code
+# goes in a request body on stdin: never on a command line, in a file or in the output.
+enrol_file=$config/enrol-request enrol_caller= enrol_conflict= enrol_via=
+invite_problem() {   # CODE -> why it is not an invite code for this profile, or nothing. Names the prefix at most.
+    ip_bad='not an invite code (letters, digits and dashes, like LN-xxxx-xxxxxxxxxxxx)'
+    case "$1" in ''|-*|*-|*--*|*[!A-Za-z0-9-]*) printf '%s' "$ip_bad"; return 0 ;; *-*) ;; *) printf '%s' "$ip_bad"; return 0 ;; esac
+    ip_prefix=${1%%-*}
+    case "$ip_prefix" in *[!A-Za-z]*) printf '%s' "$ip_bad"; return 0 ;; esac
+    if [ "${#1}" -gt 64 ] || [ "${#ip_prefix}" -gt 8 ]; then printf '%s' "$ip_bad"; return 0; fi
+    ip_prefix=$(printf '%s' "$ip_prefix" | tr 'a-z' 'A-Z'); ip_site=$(printf '%s' "$site_code" | tr 'a-z' 'A-Z')
+    if [ -n "$ip_site" ] && [ "$ip_prefix" != "$ip_site" ]; then
+        printf 'this code is for another site (prefix %s); the profile %s takes %s codes — choose its site with --site' \
+            "$ip_prefix" "${site_name:-$(tilde "$site_file")}" "$ip_site"
+    fi
+}
+check_invite() {   # a code from the command line or LANES_INVITE: refused before anything is installed
+    [ -n "$invite" ] || return 0
+    invite=$(printf '%s' "$invite" | tr -d ' \t\r\n')      # (pasted with a blank or a line break)
+    ci_problem=$(invite_problem "$invite")
+    [ -z "$ci_problem" ] || die "invite: $ci_problem"
+}
+enrol_clean() { printf '%s' "$1" | tr -cd 'A-Za-z0-9@._+-' | cut -c1-80; }    # a server's word, safe for a terminal
+enrol_json() { case "$(printf '%s' "$http_body" | tr -d ' \t\r\n' | cut -c1)" in '{') return 0 ;; esac; return 1; }
+json_get() {   # PATH -> the value at that path of $http_body (strings unquoted); nothing for null or absent
+    jg=$(printf '%s\n' "$http_body" | json_paths | sed -n "s|^$1=||p" | head -n 1)
+    [ "$jg" = null ] || printf '%s' "$jg"
+}
+# -> enrol_base (scheme://host[:port]), enrol_host, enrol_port, enrol_ip (the tailnet address to use when this machine
+# cannot resolve the name: an IPv4 LANES_SERVER_HOST); 1 + enrol_note when there is no service to ask.
+# LANES_ENROL_URL replaces the base (development and tests); the name and address logic stays the same.
+enrol_target() {
+    enrol_base=${LANES_ENROL_URL:-} enrol_resolve= enrol_note=
+    if [ -z "$enrol_base" ]; then
+        if [ -z "$server_name" ]; then enrol_note='this site profile names no LANES_SERVER_NAME (its enrolment service answers under that name)'; return 1; fi
+        enrol_base=https://${server_name%.}:8443
+    fi
+    enrol_base=${enrol_base%/}
+    et_hostport=${enrol_base#*://}
+    case "$enrol_base" in http://*|https://*) ;; *) enrol_note='LANES_ENROL_URL is not an http(s) URL'; return 1 ;; esac
+    case "$et_hostport" in ''|*/*|*[!A-Za-z0-9.:-]*) enrol_note='LANES_ENROL_URL is not scheme://host[:port]'; return 1 ;; esac
+    enrol_host=${et_hostport%:*} enrol_port=${et_hostport##*:}
+    if [ "$enrol_host" = "$et_hostport" ]; then
+        enrol_port=443; case "$enrol_base" in http://*) enrol_port=80 ;; esac
+    fi
+    case "$enrol_port" in ''|*[!0-9]*) enrol_note='LANES_ENROL_URL has a malformed port'; return 1 ;; esac
+    enrol_ip=
+    case "$server_host" in ''|*[!0-9.]*) ;; *) [ "$server_host" = "$enrol_host" ] || enrol_ip=$server_host ;; esac
+}
+# python3 when there is no curl (minimal Linux images): http.client, because urllib.request raises on every status but
+# 2xx and cannot be told which address to connect to. Status on stdout, the answer into $4, why not on stderr.
+enrol_py='
+import http.client, socket, ssl, sys, urllib.parse
+method, url, address, out = sys.argv[1:5]
+body = sys.stdin.buffer.read() if method == "POST" else None
+parts = urllib.parse.urlsplit(url)
+tls = parts.scheme == "https"
+host, port = parts.hostname, parts.port or (443 if tls else 80)
+context = ssl.create_default_context() if tls else None
+def ask(where):
+    if tls:
+        conn = http.client.HTTPSConnection(host, port, timeout=15, context=context)
+    else:
+        conn = http.client.HTTPConnection(host, port, timeout=15)
+    if where != host:
+        def connect():   # the tailnet address; the name stays for TLS (SNI, the certificate) and Host
+            sock = socket.create_connection((where, port), 5)
+            sock.settimeout(15)
+            conn.sock = context.wrap_socket(sock, server_hostname=host) if tls else sock
+        conn.connect = connect
+    headers = {"Accept": "application/json"}
+    if body is not None:
+        headers["Content-Type"] = "application/json"
+    conn.request(method, parts.path or "/", body=body, headers=headers)
+    reply = conn.getresponse()
+    return reply.status, reply.read(65537)
+try:
+    try:
+        status, data = ask(host)
+    except socket.gaierror:
+        if not address:
+            raise
+        status, data = ask(address)
+except Exception as error:
+    sys.stderr.write("python3: %s: %s\n" % (type(error).__name__, error))
+    sys.exit(7)
+if len(data) > 65536:
+    sys.stderr.write("python3: the answer is larger than 64 KiB\n")
+    sys.exit(7)
+with open(out, "wb") as f:
+    f.write(data)
+print(status)
+'
+enrol_curl() {   # METHOD PATH [BODY] -> ec_rc, ec_code; the answer in $ec_tmp, curl's complaint in $ec_tmp.err
+    ecm=$1 ecp=$2 ecb=${3:-}
+    # -q first: no ~/.curlrc (it could add -v or another -o); no proxy: the service lives on the tailnet only.
+    set -- -q -sS --noproxy '*' --connect-timeout 5 --max-time 15 --max-filesize 65536 -o "$ec_tmp" -w '%{http_code}' \
+        -H 'Accept: application/json'
+    if [ -n "$enrol_resolve" ]; then set -- "$@" --resolve "$enrol_resolve"; fi
+    ec_rc=0
+    if [ "$ecm" = POST ]; then
+        ec_code=$(printf '%s' "$ecb" | curl "$@" -H 'Content-Type: application/json' --data-binary @- "$enrol_base$ecp" \
+            2>"$ec_tmp.err") || ec_rc=$?
+    else
+        ec_code=$(curl "$@" "$enrol_base$ecp" </dev/null 2>"$ec_tmp.err") || ec_rc=$?
+    fi
+}
+# enrol_call GET|POST PATH [BODY] -> http_status (empty = no answer), http_body, enrol_detail (why no answer)
+enrol_call() {
+    http_status= http_body= enrol_detail= ec_rc=0 ec_code=
+    ec_tmp=$(mktemp)
+    if command -v curl >/dev/null 2>&1; then
+        enrol_curl "$@"
+        # 6 = this machine could not resolve the name (MagicDNS off): the same request to the tailnet address, the name
+        # kept for TLS and Host (--resolve), and remembered for the rest of this run.
+        if [ "$ec_rc" = 6 ] && [ -z "$enrol_resolve" ] && [ -n "$enrol_ip" ]; then
+            enrol_resolve=$enrol_host:$enrol_port:$enrol_ip
+            enrol_curl "$@"
+        fi
+    elif command -v python3 >/dev/null 2>&1; then
+        ec_rc=0
+        ec_code=$(printf '%s' "${3:-}" | python3 -c "$enrol_py" "$1" "$enrol_base$2" "$enrol_ip" "$ec_tmp" 2>"$ec_tmp.err") ||
+            ec_rc=$?
+    else
+        ec_rc=127; echo 'neither curl nor python3 is installed' > "$ec_tmp.err"
+    fi
+    if [ "$ec_rc" = 0 ]; then
+        case "$ec_code" in [1-5][0-9][0-9]) http_status=$ec_code; http_body=$(cat "$ec_tmp") ;; esac
+    fi
+    [ -n "$http_status" ] || enrol_detail=$(head -n 1 "$ec_tmp.err" 2>/dev/null | tr -cd '[:print:]' | cut -c1-160)
+    rm -f "$ec_tmp" "$ec_tmp.err"
+}
+enrol_refusal() {   # -> "the server answered 403 (invalid-or-expired)" | "no answer from <base> (<why>)"
+    if [ -z "$http_status" ]; then printf 'no answer from %s (%s)' "$enrol_base" "${enrol_detail:-no detail}"; return 0; fi
+    er=; if enrol_json; then er=$(json_get /error | tr -cd 'A-Za-z0-9@._+:,;()/ -' | cut -c1-120); fi
+    printf 'the server answered %s%s' "$http_status" "${er:+ ($er)}"
+}
+enrol_conflicted() {   # invite|request, after a refusal: a 409 device-taken|key-taken -> enrol_conflict, enrol_via
+    enrol_conflict= enrol_via=$1
+    if [ "$http_status" = 409 ] && enrol_json; then
+        case "$(json_get /error)" in device-taken|key-taken) enrol_conflict=$(json_get /error) ;; esac
+    fi
+}
+enrol_site() {   # GET /enrol/site -> 0, request_mode and enrol_caller; or 1 and enrol_note
+    enrol_call GET /enrol/site
+    if [ -z "$http_status" ]; then enrol_note=$(enrol_refusal); return 1; fi
+    if [ "$http_status" != 200 ]; then enrol_note="no enrolment service at $enrol_base/enrol/ (the server answered $http_status)"; return 1; fi
+    # (a server without the service hands /enrol/site to its web client: a page, not this document)
+    if ! enrol_json; then enrol_note="no enrolment service at $enrol_base/enrol/ (the answer is not JSON)"; return 1; fi
+    # lanes-enrold's /site always says request_mode, true or false: that is what tells it from any other JSON. Its
+    # `version` is the server's Lanes release, not a wire number (wire v1 is additive only, and none is served).
+    request_mode=$(json_get /request_mode)
+    case "$request_mode" in
+        true|false) ;;
+        *) enrol_note="no enrolment service at $enrol_base/enrol/ (the answer says nothing of request_mode)"; return 1 ;;
+    esac
+    # The tailnet login the service received (null outside request mode): the owner a request is filed under.
+    enrol_caller=$(enrol_clean "$(json_get /caller)")
+}
+enrol_key() {   # -> enrol_pubkey "ssh-ed25519 <base64>" (enrold writes its own comment); 1, said, for any other key
+    enrol_pubkey= kt= kb=
+    if [ -r "$key.pub" ]; then read -r kt kb _ < "$key.pub" || :; fi
+    if [ "$kt" != ssh-ed25519 ]; then
+        warn "enrolment: takes an ed25519 key, and $(tilde "$key") is $(enrol_clean "${kt:-unreadable}") — choose one with --key, or let the installer make one (--key ~/.ssh/lanes_ed25519)"
+        return 1
+    fi
+    case "$kb" in ''|*[!A-Za-z0-9+/=]*) warn "enrolment: $(tilde "$key.pub") does not hold a public key"; return 1 ;; esac
+    enrol_pubkey="$kt $kb"
+}
+enrol_restore_tty() { if [ -n "$ep_tty" ]; then stty "$ep_tty" 2>/dev/null || :; fi; }
+# On a terminal: the code, typed with echo off (switched off BEFORE the prompt shows, so nothing typed early is echoed).
+# -> 0 with invite set, or empty (Enter: ask the members); 1 nothing usable. A malformed code is asked again, 3 times.
+enrol_prompt() {
+    if [ "$request_mode" = true ]; then ep_q='Invite code (Enter = ask the members of this site for access instead): '
+    else ep_q='Invite code (Enter = skip): '; fi
+    head_ 'This machine is not authorized on the server yet.'
+    ep_tries=0
+    while [ "$ep_tries" -lt 3 ]; do
+        ep_tries=$((ep_tries + 1))
+        ep_tty=$(stty -g 2>/dev/null) || ep_tty=
+        trap 'enrol_restore_tty; exit 130' INT; trap 'enrol_restore_tty; exit 143' TERM; trap 'enrol_restore_tty; exit 129' HUP
+        stty -echo 2>/dev/null || :
+        printf '  %s' "$ep_q"
+        ep_read=0; IFS= read -r ep_answer || ep_read=$?
+        enrol_restore_tty; trap - INT TERM HUP
+        printf '\n'
+        [ "$ep_read" = 0 ] || return 1                     # end of input (Ctrl-D): nothing
+        ep_answer=$(printf '%s' "$ep_answer" | tr -d ' \t\r')
+        if [ -z "$ep_answer" ]; then
+            invite=
+            if [ "$request_mode" = true ]; then return 0; fi
+            say 'request: this site admits by invite only — ask a member for an invite, then ./install.sh --invite CODE'
+            return 1
+        fi
+        ep_problem=$(invite_problem "$ep_answer")
+        if [ -z "$ep_problem" ]; then invite=$ep_answer; return 0; fi
+        warn "invite: $ep_problem"
+    done
+    return 1
+}
+enrol_authorized() {   # invite|request: say the verdict; the pending request, if any, is over
+    # A redeem answers {device, owner{login,name,email}|null, ssh_ready}; a request's verdict is only {id, state,
+    # expires_at}, and its owner is the login the request was filed under (the /site caller).
+    if [ "$1" = invite ]; then
+        ea_owner=$(enrol_clean "$(json_get /owner/login)"); [ -n "$ea_owner" ] || ea_owner=$(enrol_clean "$(json_get /owner/name)")
+        ea_device=$(enrol_clean "$(json_get /device)")
+    else
+        ea_owner=$enrol_caller ea_device=
+    fi
+    ea_said="this machine's key is now authorized for ${ea_owner:-this site} (device ${ea_device:-$device})"
+    if [ "$1" = invite ]; then say "invite: redeemed — $ea_said"; else say "request: approved — $ea_said"; fi
+    if [ -n "$ea_device" ] && [ "$ea_device" != "$device" ]; then
+        warn "the server enrolled this key as device $ea_device, and this machine's view is $device (--device $ea_device matches it)"
+    fi
+    rm -f "$enrol_file"
+}
+enrol_redeem() {
+    enrol_call POST /enrol/redeem "{\"code\":\"$invite\",\"pubkey\":\"$enrol_pubkey\",\"device\":\"$device\",\"client_version\":\"$client_version\"}"
+    if [ "$http_status" = 200 ] && enrol_json; then enrol_authorized invite; return 0; fi
+    warn "invite: not redeemed — $(enrol_refusal)"
+    enrol_conflicted invite
+    return 1
+}
+# $config/enrol-request: the open request (KEY=VALUE, mode 0600, read with sed, never executed), kept until a member
+# answers so --resume waits on it instead of filing another; tied to the enrolment service it was filed with.
+enrol_save() {
+    rm -f "$enrol_file.new"
+    ( umask 077
+      printf '%s\n' '# lanes access request: written by install.sh while no member has answered it; `install.sh --resume` keeps' \
+          '# waiting on it. Removed once it is answered and by install.sh --uninstall. Never executed.' \
+          'SCHEMA=1' "ID=$1" "URL=$enrol_base" "DEVICE=$device" "FILED=$(date -u +%Y-%m-%dT%H:%M:%SZ)" > "$enrol_file.new" )
+    chmod 600 "$enrol_file.new"; mv "$enrol_file.new" "$enrol_file"
+}
+enrol_saved() {   # -> the id of this machine's open request to this enrolment service, or nothing
+    [ -r "$enrol_file" ] || return 0
+    es_id=$(sed -n 's/^ID=//p' "$enrol_file" | tail -n 1); es_url=$(sed -n 's/^URL=//p' "$enrol_file" | tail -n 1)
+    case "$es_id" in ''|*[!A-Za-z0-9_-]*) return 0 ;; esac
+    if [ "${#es_id}" -le 64 ] && [ "$es_url" = "$enrol_base" ]; then printf '%s' "$es_id"; fi
+}
+enrol_request() {   # -> enrol_id, saved
+    enrol_call POST /enrol/request "{\"pubkey\":\"$enrol_pubkey\",\"device\":\"$device\",\"client_version\":\"$client_version\"}"
+    enrol_id=
+    # (enrold answers 202 Accepted {id, expires_at}, also for the same device and key asked again)
+    case "$http_status" in 200|202) if enrol_json; then enrol_id=$(json_get /id); fi ;; esac
+    case "$enrol_id" in ''|*[!A-Za-z0-9_-]*) warn "request: not filed — $(enrol_refusal)"; enrol_conflicted request; return 1 ;; esac
+    if [ "${#enrol_id}" -gt 64 ]; then warn "request: not filed — $(enrol_refusal)"; return 1; fi
+    enrol_save "$enrol_id"
+    say "request: filed as $enrol_id for $device — a member approves it on their phone ($enrol_base/enrol/pending) or on the server: lanes enrol approve $enrol_id"
+}
+enrol_clock() { printf '%d:%02d' $(( $1 / 60 )) $(( $1 % 60 )); }
+enrol_countdown() {   # rewritten in place on a terminal, a line a minute otherwise
+    if [ -t 1 ]; then printf '\r  request: waiting for approval — %s left ' "$(enrol_clock "$1")"; ep_line=1
+    elif [ -z "$ep_note" ] || [ "$1" -le "$ep_note" ]; then say "request: waiting for approval — $(enrol_clock "$1") left"; ep_note=$(( $1 - 60 )); fi
+}
+enrol_countdown_done() { if [ "$ep_line" = 1 ]; then printf '\r\033[K'; ep_line=0; fi; }
+enrol_poll() {   # ID: ask every LANES_ENROL_POLL s (5) for the verdict, at most LANES_ENROL_WAIT s (600)
+    ep_id=$1 ep_wait=${LANES_ENROL_WAIT:-600} ep_every=${LANES_ENROL_POLL:-5} ep_line=0 ep_note=
+    case "$ep_wait" in ''|*[!0-9]*) warn 'LANES_ENROL_WAIT ignored (not a number of seconds): waiting 600 s'; ep_wait=600 ;; esac
+    case "$ep_every" in ''|0|*[!0-9]*) ep_every=5 ;; esac
+    ep_deadline=$(( $(date +%s) + ep_wait ))
+    say "request: waiting up to $(enrol_clock "$ep_wait") for a member's answer (Ctrl-C stops; ./install.sh --resume waits again)"
+    trap 'enrol_countdown_done; warn "request: still open — ./install.sh --resume keeps waiting (request $ep_id)"; exit 130' INT
+    trap 'enrol_countdown_done; exit 143' TERM; trap 'enrol_countdown_done; exit 129' HUP
+    while :; do
+        enrol_call GET "/enrol/request/$ep_id"
+        if [ "$http_status" = 200 ] && enrol_json; then
+            case "$(json_get /state)" in        # {id, state: pending|approved|denied|expired, expires_at}
+                approved) enrol_countdown_done; trap - INT TERM HUP; enrol_authorized request; return 0 ;;
+                denied) ep_end='denied — ask a member for an invite, then ./install.sh --invite CODE'; break ;;
+                expired) ep_end='expired before anyone answered — run ./install.sh again to ask again'; break ;;
+            esac
+        elif [ "$http_status" = 404 ]; then            # (enrold: unknown, or filed by another tailnet login)
+            ep_end="the server no longer knows request $ep_id — run ./install.sh again to ask again"; break
+        fi
+        # pending — or no answer for now (a server restarting): ask again until the bound
+        ep_left=$(( ep_deadline - $(date +%s) ))
+        if [ "$ep_left" -le 0 ]; then ep_end=; break; fi
+        enrol_countdown "$ep_left"
+        if [ "$ep_left" -lt "$ep_every" ]; then sleep "$ep_left"; else sleep "$ep_every"; fi
+    done
+    enrol_countdown_done; trap - INT TERM HUP
+    if [ -n "$ep_end" ]; then rm -f "$enrol_file"; warn "request: $ep_end"; return 1; fi
+    warn "request: no answer within $(enrol_clock "$ep_wait") — it stays open: ./install.sh --resume keeps waiting (request $ep_id)"
+    return 1
+}
+# -> 0 when the key is authorized now (and check_server has looked again); 1 = report_server's exit-3 text follows.
+enrol() {
+    en_terminal=0; if [ -t 0 ] && [ -t 1 ] && [ "$assume_yes" = 0 ]; then en_terminal=1; fi
+    en_asked=0; if [ -n "$invite" ] || [ "$resume" = 1 ]; then en_asked=1; fi
+    [ "$en_asked" = 1 ] || [ "$en_terminal" = 1 ] || return 1      # nobody asked, nobody to ask: nothing is sent
+    # (a bare terminal install against a server without the service stays silent: the exit-3 text says what to do)
+    if ! enrol_target; then [ "$en_asked" = 0 ] || warn "enrolment: $enrol_note"; return 1; fi
+    enrol_pending=$(enrol_saved)
+    if [ "$resume" = 1 ] && [ -z "$invite" ] && [ -z "$enrol_pending" ]; then
+        warn 'request: nothing to resume — this machine has no open access request'; return 1
+    fi
+    if ! enrol_site; then [ "$en_asked" = 0 ] || warn "enrolment: $enrol_note"; return 1; fi
+    enrol_key || return 1
+    client_version=dev; if [ -r "$here/VERSION" ]; then client_version=$(tr -cd 'A-Za-z0-9._+-' < "$here/VERSION"); fi
+    # (a request already open is waited on again, not asked about: a second one would only queue behind it)
+    if [ -z "$invite" ] && [ -z "$enrol_pending" ]; then enrol_prompt || return 1; fi
+    if [ -n "$invite" ]; then enrol_redeem || return 1
+    elif [ -n "$enrol_pending" ]; then say "request: $enrol_pending is still open"; enrol_poll "$enrol_pending" || return 1
+    else { enrol_request && enrol_poll "$enrol_id"; } || return 1
+    fi
+    check_server
+}
+
 # ---- modes ----------------------------------------------------------------------------------------------------------
 do_install() {
     command -v ssh >/dev/null 2>&1 || die 'OpenSSH (ssh) is required'
     case "$os" in Darwin|Linux) ;; *) die "unsupported system: $os (macOS and Linux only)" ;; esac
-    load_site; src=$here/client
+    resolve_options; load_site; check_invite; src=$here/client
     head_ "lanes client $(cat "$here/VERSION" 2>/dev/null || echo dev) -> $server_user@$server_alias"
     choose_device; choose_key; ensure_key
     install_client; src=$target
     install_ssh
     find_terminal
     head_ 'Checking the server…'
-    check_server
+    if tailnet_site && ! check_tailscale; then server_state=tailnet; else
+        # MagicDNS answers only inside the tailnet, which the login above may just have joined: look at the name again.
+        if tailnet_site && [ -n "$magicdns_note" ] && name_resolves "${server_name%.}"; then install_ssh; fi
+        check_server
+    fi
+    if [ "$server_state" = unauthorized ]; then enrol || :; fi
+    case "$server_state" in ok|old) rm -f "$enrol_file" ;; esac      # (an open request is moot once the key works)
     boards=
     if [ "$server_state" = ok ] || [ "$server_state" = old ]; then after_authorized; fi
     report_server
-    if [ "$desktop" = 1 ]; then head_ 'Desktop'; install_desktop; fi
-    if [ "$uploads" = 1 ]; then [ "$desktop" = 1 ] || head_ 'Uploads'; install_uploads; install_helper_service; fi
+    if [ "$desktop" = 1 ]; then head_ 'Desktop'; install_desktop
+    else
+        desktop_off off
+        if [ -n "$off_gone" ]; then head_ 'Desktop'; say "desktop: off — removed $off_gone (--desktop puts it back)"; fi
+    fi
+    if [ "$uploads" = 1 ]; then [ "$desktop" = 1 ] || head_ 'Uploads'; install_uploads; install_helper_service
+    else
+        uploads_off off
+        if [ -n "$off_gone" ]; then
+            head_ 'Uploads'
+            say "uploads: off — stopped and removed $off_gone; \"$(tilde "$(cat "$config/uploads-dir" 2>/dev/null || echo "$HOME/Lanes Uploads")")\" and its files stay (--uploads turns them back on)"
+        fi
+        remove_agent_hand_off off        # (it exists for the helper service alone)
+    fi
     case "$server_state" in
         ok|old)
             head_ 'Ready.'
             say 'Open the window:   lanes-window          (Omarchy: Super+Shift+L · macOS: the Lanes app)'
             say 'In any terminal:   lanes-launch          one lane only: lanes-launch lane <id> · list: lanes-launch ls'
+            say 'Phone or browser:  lanes-launch web phone · lanes-launch web laptop   (in your own terminal: a login token)'
             say 'Keys:  Ctrl-Alt-←/→ board · Ctrl-Alt-↑/↓ lane · Ctrl-Alt-/ find · Ctrl-Alt-u upload box · close the window to detach'
             exit 0 ;;
         unauthorized) exit 3 ;;
@@ -645,7 +1496,7 @@ do_install() {
 }
 
 do_check() {
-    load_site; src=$here/client; choose_device; choose_key
+    resolve_options; load_site; src=$here/client; choose_device; choose_key
     head_ "lanes client check -> $server_user@$server_alias"
     for name in lanes-launch lanes-window lanes-upload; do
         if [ -x "$bin/$name" ]; then say "ok   $name -> $(readlink "$bin/$name" 2>/dev/null || echo "$bin/$name")"; else warn "missing: $bin/$name (run ./install.sh)"; fi
@@ -654,7 +1505,11 @@ do_check() {
     ssh -G lanes 2>/dev/null | awk '$1 == "hostname" { print "  ssh alias lanes -> " $2 }'
     find_terminal
     check_helper
-    check_server; report_server
+    if tailnet_site && ! check_tailscale; then server_state=tailnet; else check_server; fi
+    report_server
+    if [ "$server_state" = unauthorized ] && [ -n "$invite" ]; then
+        say 'invite: --check changes nothing — redeem it with ./install.sh --invite CODE'
+    fi
     case "$server_state" in ok) exit 0 ;; unauthorized) exit 3 ;; *) exit 4 ;; esac
 }
 
@@ -664,40 +1519,21 @@ do_uninstall() {
         case "$(readlink "$bin/$name" 2>/dev/null || :)" in */lanes/client/*|"$here"/client/*) rm -f "$bin/$name"; say "removed $bin/$name" ;; esac
     done
     if [ -e "$bin/coder-launch-legacy" ] && [ ! -e "$bin/coder-launch" ]; then mv "$bin/coder-launch-legacy" "$bin/coder-launch"; say 'restored the previous coder-launch'; fi
-    if [ "$os" = Darwin ]; then
-        for agent in "$label" "$helper_label"; do
-            launchctl bootout "gui/$(id -u)/$agent" >/dev/null 2>&1 || :
-            rm -f "$HOME/Library/LaunchAgents/$agent.plist"
-        done
-        rm -rf "$HOME/Applications/Lanes.app" "$HOME/Applications/Lanes Upload.app" "$HOME/Applications/Lanes Helper.app"
-    else
-        units=${XDG_CONFIG_HOME:-$HOME/.config}/systemd/user
-        systemctl --user disable --now lanes-upload.path >/dev/null 2>&1 || :
-        systemctl --user disable --now lanes-helper.service >/dev/null 2>&1 || :
-        rm -f "$units/lanes-upload.path" "$units/lanes-upload.service" "$units/lanes-helper.service"
-        systemctl --user daemon-reload >/dev/null 2>&1 || :
-        rm -f "$HOME/.local/share/applications/lanes.desktop"
-        for main in "$HOME/.config/hypr/hyprland.lua" "$HOME/.config/hypr/hyprland.conf"; do
-            [ -f "$main" ] && grep -q -F -e 'require("hypr.lanes")' -e 'source = ~/.config/hypr/lanes.conf' "$main" || continue
-            cp -p "$main" "$main.pre-lanes-uninstall.$stamp"
-            grep -v -F -e 'lanes workspace server (remove this line' -e 'require("hypr.lanes")' -e 'source = ~/.config/hypr/lanes.conf' \
-                "$main.pre-lanes-uninstall.$stamp" > "$main" || :
-            say "Hyprland: removed the lanes line from $(tilde "$main") (backup kept)"
-        done
-        rm -f "$HOME/.config/hypr/lanes.lua" "$HOME/.config/hypr/lanes.conf"
-        command -v hyprctl >/dev/null 2>&1 && hyprctl reload >/dev/null 2>&1 || :
-    fi
+    uploads_off uninstall; uploads_gone=$off_gone
+    desktop_off uninstall; [ -z "$uploads_gone" ] || off_gone="$uploads_gone${off_gone:+, $off_gone}"
+    if [ -n "$off_gone" ]; then say "removed $off_gone"; fi
     if grep -q '^Include config.d/lanes.conf' "$HOME/.ssh/config" 2>/dev/null; then
         cp -p "$HOME/.ssh/config" "$HOME/.ssh/config.pre-lanes-uninstall.$stamp"
         grep -v -e '^Include config.d/lanes.conf' -e '^# lanes workspace server (added ' "$HOME/.ssh/config.pre-lanes-uninstall.$stamp" > "$HOME/.ssh/config" || :
         chmod 600 "$HOME/.ssh/config"; say '~/.ssh/config: removed the Include line (backup kept)'
     fi
     rm -f "$HOME/.ssh/config.d/lanes.conf"
+    remove_agent_hand_off
     rm -rf "$share/client" "$state"
     # A Linux account can run both roles. Keep server catalogs and any files
     # the client did not create in the shared configuration directory.
-    rm -f "$config/device" "$config/ghostty.conf" "$config"/ghostty.*.conf "$config"/ghostty-palette*.conf \
-        "$config/client-site.conf" "$config/client-known-hosts" "$config/site.cache" \
+    rm -f "$config/device" "$config/install-options" "$config/ghostty.conf" "$config"/ghostty.*.conf "$config"/ghostty-palette*.conf \
+        "$config/client-site.conf" "$config/client-known-hosts" "$config/site.cache" "$enrol_file" \
         "$config/upload-allow" "$config/uploads-dir" "$config/upload-watch.log"
     rmdir "$config" 2>/dev/null || :
     say 'stopped the upload agents (watch folder, upload helper service); removed the client, its settings and its logs'