@vibelord/lanes 1.1.0 → 1.2.0

package/payload/lanes/libexec/agent_state.py

@@ -8,7 +8,8 @@ braille spinner while working, and rings BEL on turn completion. Claude's title
 
 The agent{} status vocabulary is fixed here and reused by statusd, the sidebar, the hook sidecar and the phone:
 working | needs_input | needs_approval | done | errored | shell | idle. It is a NEW key beside status.json's
-six-word `state`, never a replacement for it.
+six-word `state`, never a replacement for it. So are the attention SECTION each word belongs to and its RANK, and
+`settle`, the debounce statusd applies between `merge`'s verdict and what it publishes (cockpit v3 S1).
 
 Two stale-signal traps, both MEASURED 2026-10-04 on this host: (1) a Claude session file outlives its pid, and pids
 wrap (pid_max 4194304, live pids already ~2.3M), so a recycled pid would resurrect a dead session — every file
@@ -37,6 +38,15 @@ SHELL_TITLES = {'', 'work', 'bash', 'sh', 'zsh', 'fish'}
 STATUS_FROM_CLAUDE = {'busy': 'working', 'idle': 'needs_input', 'shell': 'shell', 'waiting': 'needs_input'}
 STATUSES = ('working', 'needs_input', 'needs_approval', 'done', 'errored', 'shell', 'idle')
 SHELL_COMMANDS = {'bash', 'sh', 'dash', 'zsh', 'fish', 'ksh', 'tcsh', 'csh'}
+# The attention section each status belongs to (None = the workspace's other lanes) and how urgent a section is: the
+# ONE table statusd's `settle` and the sidebar's sections (`sidebar.SECTION_OF`, its ATTENTION order) read.
+SECTION = {'needs_approval': 'needs', 'errored': 'needs', 'needs_input': 'needs', 'working': 'working', 'done': 'done',
+           'shell': None, 'idle': None}
+RANK = {'needs': 3, 'working': 2, 'done': 1, None: 0}
+# Seconds a LOWER-ranked word must hold before the published status leaves a section, keyed by the section LEFT.
+# Entering a higher section never waits. GONE_DWELL: seconds without any agent signal before agent{} is dropped.
+DWELL = {'needs': 8, 'working': 5, 'done': 5, None: 0}
+GONE_DWELL = 5
 
 
 def pane_has_child(proc_root, pid):
@@ -244,3 +254,66 @@ def merge(pane_row, claude_by_pane, sidecar):
             title['since'] = 0
         return title
     return None
+
+
+def _stamp(value):
+    """A usable epoch second from a published or source field, or None (absent, bool, zero, negative, not a number)."""
+    if isinstance(value, bool) or not isinstance(value, (int, float)) or value <= 0:
+        return None
+    return int(value)
+
+
+def settle(prev, raw, now):
+    """The agent{} statusd publishes for one lane this cycle: `merge`'s verdict `raw` debounced against `prev`, the
+    agent{} it published last cycle (statusd's previous payload — status.json itself after a restart), at `now` on
+    statusd's clock. None = publish no agent key. Pure; neither input is mutated.
+
+    Until cockpit v3 (plan context item 4, read in the code 2026-10-06) statusd published `merge`'s word every 3 s
+    cycle with no hysteresis, so a lane whose signal flips (a turn ending and restarting, a dialog opened and closed, a
+    Codex title losing its spinner for a frame) moved between the sidebar's sections every cycle, and its `since`
+    restarted on every flip — for a Codex lane read from its title, on every output (`window_activity`). Rules (S1,
+    LNS-59), by SECTION and RANK:
+
+      * higher section than the one published: publish now (a question or an approval is never delayed);
+      * same section: publish now, `stable_since` kept (needs_input -> needs_approval changes only the urgency);
+      * lower section: publish only once the raw word has held for DWELL[section left] — `now - raw_since`;
+      * no agent at all: the published agent{} stays until GONE_DWELL has passed, then the key goes.
+
+    Published keys: `merge`'s own (harness, name, session_id, pid, source, event) from the verdict that was PUBLISHED —
+    a held status keeps the dict it was published with — plus `status` (the debounced word), `since` (when that status
+    began: the source's own start, never later than the cycle that first saw it, and kept while the status is
+    unchanged, so a moving source stamp is no longer a clock), `raw_status` (`merge`'s word this cycle, None while the
+    agent is gone), `raw_since` (statusd's clock when that word was first seen; reset only when it differs from the
+    previous `raw_status`, never a source timestamp) and `stable_since` (statusd's clock when the lane entered the
+    section it is published in). All stamps are integer seconds, so a steady lane publishes byte-identically and
+    status.json is not rewritten. A `prev` that is not an agent{} (a zmx row's lane-run record, an unknown word) is no
+    previous cycle; one written before these keys existed is adopted with `raw_since`/`stable_since` = `now`."""
+    now = int(now)
+    if not (isinstance(raw, dict) and raw.get('status') in STATUSES):
+        raw = None
+    if not (isinstance(prev, dict) and prev.get('status') in STATUSES):
+        prev = None
+    if prev is None:
+        return None if raw is None else _published(raw, now, now)
+    word = raw['status'] if raw else None
+    last = prev['raw_status'] if 'raw_status' in prev else prev['status']   # a pre-v3 entry: its status
+    raw_since = (_stamp(prev.get('raw_since')) if word == last else None) or now
+    stable = _stamp(prev.get('stable_since')) or now
+    held = dict(prev, raw_status=word, raw_since=raw_since, stable_since=stable)
+    if raw is None:
+        return None if now - raw_since >= GONE_DWELL else held
+    old, new = SECTION[prev['status']], SECTION[word]
+    if new == old:
+        kept = _stamp(prev.get('since')) if word == prev['status'] else None
+        return dict(_published(raw, raw_since, stable), since=kept) if kept else _published(raw, raw_since, stable)
+    if RANK[new] > RANK[old] or now - raw_since >= DWELL[old]:
+        return _published(raw, raw_since, now)
+    return held
+
+
+def _published(raw, raw_since, stable_since):
+    """`raw` as published: its `since` the start of the status (the source's, capped at `raw_since`, the cycle that
+    first saw the word), then the three settle keys."""
+    source = _stamp(raw.get('since'))
+    return dict(raw, since=min(source, raw_since) if source else raw_since, raw_status=raw['status'],
+                raw_since=raw_since, stable_since=stable_since)

package/payload/lanes/libexec/cursor_sync.py

@@ -9,6 +9,7 @@ The repository's `.vscode/terminals.json` stays the source of truth for WHICH la
     view shows the lane);
   * the ORIGINAL command and the exact binding are preserved next to it in a top-level `lanes` block, which the
     extension and Throttle ignore:  lanes.terminals[<name>] = {id, holder, tmux{socketName,sessionName}, create}.
+    An entry's optional `displayName` (the container's display layer for the lane, LNS-33) is carried as is.
 
 Text is edited minimally (command strings replaced in place, the `lanes` block inserted before the final brace) so
 git diffs stay small. Dry-run by default: prints a unified diff. `--write` applies (with a timestamped backup).
@@ -179,6 +180,11 @@ def normalized_text(text, lanes_by_name, canonicalize=None):
                     entry.pop('create', None)
                     entry['create'] = recipe
                     entry['createPrevious'] = create
+        if 'displayName' in previous:
+            # LNS-33: the container's display layer (lanes_lib._workspace_lanes reads it; the host manifest's
+            # displayNames win over it). Carried verbatim and last, never dropped: this tool rebuilds the entry from
+            # the registry and validates nothing it does not own — the reader ignores a value that is no lane name.
+            entry['displayName'] = previous['displayName']
         block['terminals'][term['name']] = entry
         commands[term['name']] = ENTRY + lane['id']
     # Nothing to do: leave the file byte-identical (never reformat somebody else's JSON).

package/payload/lanes/libexec/device_sync.py

@@ -1,4 +1,13 @@
-"""Reconcile catalog tabs without switching focus or touching persistent agents."""
+"""Reconcile catalog tabs without switching focus or touching persistent agents.
+
+The one tab this ever closes (cockpit v3 R4, LNS-77) is one whose panes IDENTIFY a workspace the owner's profile hides
+(`hidden`): its sidebar and view.sh panes are viewers — the lanes they show live in containers, so closing the tab loses
+nothing, and the workspace comes back as a new tab when it is shown again. A tab that only carries such a title, an
+unmanaged tab, and every other identity are left open. Such a close never leaves the device without a workspace tab:
+it waits while the hidden boards' tabs are the only workspace tabs the device HAS — counted over the tabs that exist,
+not the specs, because a board added while no client was attached has no tab yet (W9 review F2) — and a reconcile
+whose specs want no workspace at all is refused. Closing the tab a client is looking at moves that client to a
+neighbouring tab (the person hid it)."""
 import fcntl
 import json
 import shlex
@@ -28,7 +37,9 @@ def observe(device, call):
 
 
 def identities(device, tabs, panes, registry, mobile):
-    """Read workspace IDs from the launched commands, independent of tab labels."""
+    """Read workspace IDs from the launched commands, independent of tab labels — and of the tree path: a tree file
+    is matched by its suffix (lanes_lib.tree_file_at), so a pane started from a `pkg/<version>` layout written before
+    W9 U1, from one written through the `current` link since, or from a checkout keeps its identity across updates."""
     by_tab = {}
     for pane in panes:
         if pane.get('is_plugin'):
@@ -38,10 +49,10 @@ def identities(device, tabs, panes, registry, mobile):
         except ValueError:
             continue
         for script in ('sidebar', 'view.sh'):
-            path = str(L.REPO / 'libexec' / script)
-            if path not in args:
+            at = L.tree_file_at(args, 'libexec/' + script)
+            if at is None:
                 continue
-            tail = args[args.index(path) + 1:]
+            tail = args[at + 1:]
             if len(tail) < 2 or tail[0] != device:
                 continue
             workspace = tail[1]
@@ -51,9 +62,9 @@ def identities(device, tabs, panes, registry, mobile):
                 role = 'picker' if mobile and script == 'sidebar' else 'view'
                 key = f'workspace/{workspace}/{role}'
             by_tab.setdefault(pane['tab_id'], set()).add(key)
-        holder = str(L.REPO / 'holders/ssh.sh')
-        if holder in args:
-            tail = args[args.index(holder) + 1:]
+        at = L.tree_file_at(args, 'holders/ssh.sh')
+        if at is not None:
+            tail = args[at + 1:]
             for workspace in registry.get('ssh_workspaces', []):
                 if (len(tail) == 3 and tail[:2] == [workspace['host'], workspace['command']]
                         and any(pane['id'] == tail[2] for pane in workspace['panes'])):
@@ -72,7 +83,16 @@ def identities(device, tabs, panes, registry, mobile):
     return result
 
 
-def reconcile(device, registry, specs, mobile, call):
+def reconcile(device, registry, specs, mobile, call, hidden=()):
+    """Make the device's tabs the `specs` (bin/lanes tab_specs): add each missing one (only while a client is attached),
+    rename a changed title, order them; close the tab of each workspace id in `hidden` (the boards the owner's profile
+    hides, cockpit v3 R4) whose identity is `workspace/<id>/…` and that no spec wants — an unknown id is ignored. ->
+    the changes made, as words. Two guards keep a workspace tab on the device:
+      * specs that want no workspace at all with such a tab to close: refused (L.LanesError, before any change);
+      * no workspace tab the device has would stay open — every EXISTING `workspace/…` tab is one to close, the
+        shown boards having none yet (one added while no client was attached, W9 review F2): nothing is closed and
+        the words say so (`kept <titles> open although hidden: …`); the rest runs — the missing tabs are added
+        once a client is attached — and a later reconcile, counting again, closes them."""
     lock = L.STATE / 'locks' / f'device-sync.{device}.lock'
     lock.parent.mkdir(parents=True, exist_ok=True)
     with lock.open('a') as handle:
@@ -88,6 +108,22 @@ def reconcile(device, registry, specs, mobile, call):
                 raise L.LanesError(f'{device}: {args[0]} failed: {error or "no answer"}')
             return output
 
+        keys, hidden = {spec['key'] for spec in specs}, set(hidden)
+        doomed = [tab for key, tab in known.items()
+                  if key.startswith('workspace/') and key.split('/')[1] in hidden and key not in keys]
+        if doomed and not any(key.startswith('workspace/') for key in keys):
+            raise L.LanesError(f'{device}: closing every workspace tab is refused (one workspace stays shown); '
+                               'no tab was closed')
+        if doomed and len([key for key in known if key.startswith('workspace/')]) - len(doomed) == 0:
+            them, they = ('it', 'it closes') if len(doomed) == 1 else ('them', 'they close')
+            changes.append(f"kept {', '.join(tab['name'] for tab in doomed)} open although hidden: no other workspace "
+                           f'has a tab yet (closing {them} would leave none); {they} once a shown workspace has one')
+            doomed = []
+        for tab in doomed:
+            action(['close-tab', '--tab-id', str(tab['tab_id'])])
+            tabs = [t for t in tabs if t['tab_id'] != tab['tab_id']]
+            changes.append('closed ' + tab['name'])
+
         for spec in specs:
             tab = known.get(spec['key'])
             if tab is None:
@@ -115,7 +151,8 @@ def reconcile(device, registry, specs, mobile, call):
             wanted.append(tab['tab_id'])
 
         # Sort managed tabs by adjacent moves using stable IDs. Each observation
-        # must answer. Unmanaged tabs remain open; no close/rebuild/focus action exists.
+        # must answer. Unmanaged tabs remain open; no rebuild/focus action exists, and the
+        # only close is a hidden workspace's identified tab above.
         for position, tab_id in enumerate(wanted):
             for _ in range(len(tabs) + 1):
                 rc, output, error = call(['-s', device, 'action', 'list-tabs', '--json'], 20)

package/payload/lanes/libexec/economy_poll.py

@@ -666,6 +666,7 @@ def main(argv=None):
         report(diagnostics, None, always=True)
         return 0
     control_url(env)   # a malformed URL stops the unit at start, not once per tick
+    L.record_tree('economy', state)   # W9 U0: the unit's tree; `--once`/`--dry-run` (a person's diagnostic) never
     last = None
     while True:
         diagnostics = {}

package/payload/lanes/libexec/enrold.py

@@ -66,11 +66,15 @@ members/ and authorized_keys, so the CLI and this service never interleave:
                             The opt-in lanes-notify service (notify.py, W8 A5) reads them through load_requests and
                             pushes one note per new pending request.
   members/<device>.json     members.py's schema, via invite|request, written through keys.py (save_member, then
-                            write_authorized_keys) — never devices/.
+                            write_authorized_keys) — never devices/. `client_version` (W9 K1, LNS-86) is the
+                            release the body named (client_version(): the redeem's, or on approval the request's);
+                            absent when it named none.
   enrol-mode                {version: 1, mode: request|invite, set_at, set_by}, written by `lanes enrol mode` (enrol.py,
                             through write_mode; `auto` removes it); read on every request, never written here.
   enrol.log                 append-only, one line per attempt: `<UTC> <event> <id> <device> <login> fp=<SHA256:…> <result>`
-                            (`-` for an unknown field). A code is never written anywhere, not even its id half on a miss.
+                            (`-` for an unknown field); every line redeem() writes for its attempt adds ` client=<v>`
+                            when the body named a release (W9 K1). A code is never written anywhere, not even its id
+                            half on a miss.
                             A redeem or approval re-renders the whole block from the members keys.load_members accepts,
                             so a member file it cannot use loses its line (fail closed): each such file is one line
                             `<event> <id> <its device> <login> fp=- dropped-member` before the attempt's own, and the
@@ -132,7 +136,7 @@ ACTIONS = ('approve', 'deny')
 HTML_POLICY = "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'"
 _HEX64 = re.compile(r'[0-9a-f]{64}')
 _REQUEST_ID = re.compile(r'[a-z0-9]{1,32}')
-_CLIENT_VERSION = re.compile(r'[A-Za-z0-9._+-]{1,32}')
+_CLIENT_VERSION = M.CLIENT_VERSION     # a body's client_version: the rule the member record is validated by
 _STAMP = re.compile(r'\d{4}-\d\d-\d\dT\d\d:\d\d:\d\dZ', re.ASCII)
 _LOG_UNSAFE = re.compile(r'[^A-Za-z0-9_.@:+=/-]')
 _SITE_LINE = re.compile(r'^(LANES_[A-Z_]+)=([A-Za-z0-9_.:@/-]*)$')
@@ -294,10 +298,13 @@ def _log_field(value):
     return _LOG_UNSAFE.sub('?', str(value))[:128] if value else '-'
 
 
-def audit(event, ident, device, login, fingerprint, result, now=None):
-    """Append one line to enrol.log (0600). Never raises: a log that cannot be written is said on stderr."""
+def audit(event, ident, device, login, fingerprint, result, now=None, client=None):
+    """Append one line to enrol.log (0600). Never raises: a log that cannot be written is said on stderr. `client`
+    (a redeem attempt's client_version, W9 K1) ends the line as `client=<it>` when given; no field otherwise."""
     line = ' '.join((stamp(time.time() if now is None else now), _log_field(event), _log_field(ident),
                      _log_field(device), _log_field(login), 'fp=' + _log_field(fingerprint), _log_field(result)))
+    if client is not None:
+        line += ' client=' + _log_field(client)
     try:
         L.STATE.mkdir(parents=True, exist_ok=True)
         handle = os.open(log_path(), os.O_WRONLY | os.O_APPEND | os.O_CREAT, 0o600)
@@ -510,14 +517,26 @@ def _block_lacks(path, members, device):
 
 # ------------------------------------------------------------------------------------------------------- redeem
 
+def client_version(value):
+    """The client's release as an enrolment body states it (`client_version`; install.sh sends its VERSION, `dev`
+    without one), else None: a string matching members.CLIENT_VERSION. Anything else (absent, null, a number, a blank,
+    a terminal escape, over 32 characters) is not stored and refuses nothing. One rule for the request file
+    (create_request), the member record (redeem, and an approval from its request) and the redeem audit line."""
+    return value if isinstance(value, str) and _CLIENT_VERSION.fullmatch(value) else None
+
+
 def redeem(fields, caller=None, now=None):
-    """POST /redeem -> (status, payload). `caller` is the TRUSTED tailnet identity (None outside request mode)."""
+    """POST /redeem -> (status, payload). `caller` is the TRUSTED tailnet identity (None outside request mode). Every
+    enrol.log line of the attempt ends `client=<release>` when the body named one (client_version, W9 K1, LNS-86), and
+    the member record keeps it; a line the HTTP layer writes before a body is in hand (rate-limited; a body refused as
+    bad-request, too-large or length-required) carries none."""
     now = time.time() if now is None else now
     caller = caller or NOBODY
+    client = client_version(fields.get('client_version'))
     try:
         device = M.device_name(fields.get('device'))
     except L.LanesError:
-        audit('redeem', None, None, caller.login, None, 'invalid-device', now)
+        audit('redeem', None, None, caller.login, None, 'invalid-device', now, client)
         return 400, {'error': 'invalid-device'}
     try:
         pubkey = K.parse_pubkey(fields['pubkey']) if isinstance(fields.get('pubkey'), str) else None
@@ -526,21 +545,21 @@ def redeem(fields, caller=None, now=None):
     fingerprint = K.fingerprint(pubkey) if pubkey else None
     match = match_invite(fields.get('code'), now)
     if match is None or pubkey is None:
-        audit('redeem', None, device, caller.login, fingerprint, INVALID, now)
+        audit('redeem', None, device, caller.login, fingerprint, INVALID, now, client)
         return 403, {'error': INVALID}
     try:
         with K.members_lock():
-            return _redeem_locked(match, device, pubkey, fingerprint, caller, now)
+            return _redeem_locked(match, device, pubkey, fingerprint, caller, now, client)
     except L.LanesError:                                    # only the lock raises out of _redeem_locked
-        audit('redeem', match[0], device, caller.login, fingerprint, 'busy', now)
+        audit('redeem', match[0], device, caller.login, fingerprint, 'busy', now, client)
         return 503, {'error': 'busy'}
 
 
-def _redeem_locked(match, device, pubkey, fingerprint, caller, now):
+def _redeem_locked(match, device, pubkey, fingerprint, caller, now, client=None):
     invite_id, path, digest = match
     invite = _read_doc(path)
     if invite is None or not invite_live(invite, now) or not hmac.compare_digest(digest, invite['code_sha256']):
-        audit('redeem', None, device, caller.login, fingerprint, INVALID, now)     # used while we waited
+        audit('redeem', None, device, caller.login, fingerprint, INVALID, now, client)     # used while we waited
         return 403, {'error': INVALID}
     try:
         ak, data = _authorized_keys()
@@ -549,19 +568,19 @@ def _redeem_locked(match, device, pubkey, fingerprint, caller, now):
         owner = invite_owner(invite, caller)
         record = K.member_record(device, pubkey, via='invite', now=now, owner=owner,
                                  approved_by=minter_login(invite), invite_id=invite_id,
-                                 workspaces=_workspaces(invite.get('workspaces')),
+                                 workspaces=_workspaces(invite.get('workspaces')), client_version=client,
                                  **({'invited_as': invited_as(invite)} if caller.login else {}))
         original = path.read_bytes()
     except (OSError, L.LanesError) as error:
         print(f'lanes-enrold: redeem {invite_id}: {error}', file=sys.stderr, flush=True)
-        audit('redeem', invite_id, device, caller.login, fingerprint, 'server-error', now)
+        audit('redeem', invite_id, device, caller.login, fingerprint, 'server-error', now, client)
         return 503, {'error': 'server-error'}
     who = owner['login'] if owner else caller.login
     if taken:
-        audit('redeem', invite_id, device, who, fingerprint, 'device-taken', now)
+        audit('redeem', invite_id, device, who, fingerprint, 'device-taken', now, client)
         return 409, {'error': 'device-taken'}
     if any(member['pubkey'] == pubkey for member in members):
-        audit('redeem', invite_id, device, who, fingerprint, 'key-taken', now)
+        audit('redeem', invite_id, device, who, fingerprint, 'key-taken', now, client)
         return 409, {'error': 'key-taken'}
     consumed = dict(invite, redeemed_by={'device': device, 'login': who, 'pubkey_sha256': fingerprint},
                     redeemed_at=stamp(now))
@@ -569,7 +588,7 @@ def _redeem_locked(match, device, pubkey, fingerprint, caller, now):
         L.atomic_write(path, _json_bytes(consumed), mode=0o600)    # used up FIRST: a crash never leaves it reusable
     except OSError as error:
         print(f'lanes-enrold: cannot mark invite {invite_id} used: {error.strerror}', file=sys.stderr, flush=True)
-        audit('redeem', invite_id, device, who, fingerprint, 'server-error', now)
+        audit('redeem', invite_id, device, who, fingerprint, 'server-error', now, client)
         return 503, {'error': 'server-error'}
     report_dropped('redeem', invite_id, who, problems, now)          # the writes below re-render the block
     try:
@@ -583,13 +602,13 @@ def _redeem_locked(match, device, pubkey, fingerprint, caller, now):
                 L.atomic_write(path, original, mode=0o600)
             except OSError as undo:
                 print(f'lanes-enrold: undo of {invite_id} incomplete: {undo.strerror}', file=sys.stderr, flush=True)
-        audit('redeem', invite_id, device, who, fingerprint, 'server-error', now)
+        audit('redeem', invite_id, device, who, fingerprint, 'server-error', now, client)
         return 503, {'error': 'server-error'}
     if owner is None:                                               # said, never silent (DEF-1644)
         print(f'lanes-enrold: invite {invite_id} names no login (no trusted tailnet login, no email address, and its '
               f'name is not a login): members/{device}.json has no owner — `lanes keys owner {device} <login>` '
               'names one', file=sys.stderr, flush=True)
-    audit('redeem', invite_id, device, who, fingerprint, 'ok', now)
+    audit('redeem', invite_id, device, who, fingerprint, 'ok', now, client)
     return 200, {'device': device, 'owner': owner, 'ssh_ready': True}
 
 
@@ -677,8 +696,7 @@ def create_request(fields, caller, now=None):
                    {'login': login, 'name': None, 'email': _address(login)})
     if owner is None:
         return 403, {'error': 'no-identity'}
-    client = fields.get('client_version')
-    client = client if isinstance(client, str) and _CLIENT_VERSION.fullmatch(client) else None
+    client = client_version(fields.get('client_version'))
     try:
         with K.members_lock():
             pending = [r for r in load_requests() if request_state(r, now) == 'pending']
@@ -780,7 +798,7 @@ def _approve_locked(document, approver, now):
     owner = M.validate_owner({'login': document['login'], 'name': document.get('name'),
                               'email': document.get('email')})
     record = K.member_record(device, pubkey, via='request', now=now, owner=owner, approved_by=approver,
-                             request_id=document['id'])
+                             request_id=document['id'], client_version=client_version(document.get('client_version')))
     try:
         K.save_member(record)
     except OSError as error:
@@ -1248,6 +1266,7 @@ def main(argv=None):
         parser.error(f'{port} is not a port number')
     service = Service.from_environ(os.environ)
     server = Server(('127.0.0.1', port), service)
+    L.record_tree('enrold')   # W9 U0: the tree this service runs from (`lanes version`, doctor)
     print(f'lanes-enrold {version()}: listening on 127.0.0.1:{server.server_address[1]}; request mode '
           f'{service.mode_source()}; '
           f'domains {",".join(service.domains)}', file=sys.stderr, flush=True)

package/payload/lanes/libexec/keys.py

@@ -37,6 +37,11 @@ The account's ~/.ssh/authorized_keys carries ONE managed block, re-rendered whol
   * `lanes keys owner <device> <login> [--name NAME] [--email ADDR]` names the person behind a member (`add`/`adopt`
     write owner null): the one change to a record's owner, and how a key added by hand makes its person an
     `/enrol/pending` approver. It writes only the member file — the block carries no owner.
+  * `lanes keys adopt --login LOGIN` (cockpit v3 R2, LNS-75) records {login: LOGIN} as the owner of every member it
+    adopts, in the same write — a machine from before enrolment and its person in one step; a member that exists keeps
+    its owner (`owner` changes that). `main(args, on_owned=…)`: whenever adopt --login or owner names an owner, the
+    caller is told (login, [devices]) after the write and its return value is the exit code — bin/lanes folds those
+    devices' views into the person's profile (users.py); this module never touches devices/ or users/.
 
 `pubkey_sha256` is OpenSSH's own fingerprint form (`SHA256:` + unpadded base64 of the blob's SHA-256): what
 `ssh-keygen -lf` prints and what sshd logs on `Accepted publickey`, so a log line names its device.
@@ -65,7 +70,7 @@ MAX_DEVICE = M.MAX_DEVICE       # bin/lanes device_name()
 MAX_PUBKEY_FILE = 8192
 LOCK_TIMEOUT = 5
 USAGE = ('usage: lanes keys list | lanes keys add <device> <pubkey-file|-> | lanes keys revoke <device> | '
-         'lanes keys adopt [--dry-run] | lanes keys owner <device> <login> [--name NAME] [--email ADDR]')
+         'lanes keys adopt [--dry-run] [--login LOGIN] | lanes keys owner <device> <login> [--name NAME] [--email ADDR]')
 _ED25519_HEAD = struct.pack('>I', len(KEY_TYPE)) + KEY_TYPE.encode() + struct.pack('>I', 32)
 _BASE64 = re.compile(r'[A-Za-z0-9+/]+={0,2}')
 _KEY_TYPE_WORD = re.compile(r'(?:ssh-|ecdsa-|sk-)[A-Za-z0-9@._-]+')
@@ -504,11 +509,11 @@ def cmd_revoke(path, device):
     return 1 if leftovers else 0
 
 
-def plan_adopt(data, members):
+def plan_adopt(data, members, owner=None):
     """(new member records by device, [(pubkey, device)] whose plain outside lines go, [report lines]) for the
     `lanes:<device>` lines outside the block. Taken: a plain (no options) ssh-ed25519 line whose device holds no other
     key and whose key no other device holds; a line for an existing member with the same key is a duplicate and goes.
-    Everything else stays byte for byte and is named."""
+    Everything else stays byte for byte and is named. A new record's owner is `owner` (validated; None = null)."""
     by_device = {m['device']: m for m in members}
     holders = {m['pubkey']: m['device'] for m in members}
     new, drop, report = {}, set(), []
@@ -539,19 +544,24 @@ def plan_adopt(data, members):
         if pubkey in holders:
             report.append(f'kept {where}: that key is already enrolled as {holders[pubkey]}')
             continue
-        new[device] = member_record(device, pubkey)
+        new[device] = member_record(device, pubkey, owner=owner)
         holders[pubkey] = device
         drop.add((pubkey, device))
-        report.append(f'adopted {device} ({fingerprint(pubkey)}) from line {number}')
+        report.append(f'adopted {device} ({fingerprint(pubkey)}) from line {number}'
+                      + (f", owner {owner['login']}" if owner else ''))
     return new, drop, report
 
 
-def cmd_adopt(path, dry_run=False):
+def cmd_adopt(path, dry_run=False, owner=None, on_owned=None):
+    """Move the plain hand-added `lanes:<device>` lines into members/ (owner `owner`, validated by the caller) and the
+    block. -> 0, or on_owned(login, adopted devices)'s answer when `owner` named the owner of any (never on a dry run)."""
+    unowned = ('; --login names the owner of the keys an adopt moves in — a member that exists keeps its own '
+               '(`lanes keys owner <device> <login>` changes it)') if owner else ''
     with members_lock():
         members, problems = load_members()
         _warn_problems(problems)
         data = _read(path)
-        new, drop, report = plan_adopt(data, members)
+        new, drop, report = plan_adopt(data, members, owner)
 
         def goes(raw):
             parsed = parse_line(raw.decode('utf-8', 'surrogateescape'))
@@ -562,7 +572,7 @@ def cmd_adopt(path, dry_run=False):
             for line in report:
                 print('would: ' + line if not line.startswith('adopted') else 'would adopt ' + line[len('adopted '):])
             if not drop:
-                print('nothing to adopt')
+                print('nothing to adopt' + unowned)
             return 0
         for record in new.values():
             save_member(record)                            # the records before their lines (see cmd_revoke)
@@ -573,19 +583,22 @@ def cmd_adopt(path, dry_run=False):
     for line in report:
         print(line)
     if not drop:
-        print('nothing to adopt' + ('; the block was re-rendered from members/' if changed else ''))
+        print('nothing to adopt' + ('; the block was re-rendered from members/' if changed else '') + unowned)
     else:
         print(f'{len(new)} adopted; the lanes-managed block of {path} holds {len(members) + len(new)} key(s); '
               'the file before the first adopt is kept as authorized_keys.bak-<UTC>')
+    if owner and new and on_owned:
+        return on_owned(owner['login'], sorted(new))
     return 0
 
 
-def cmd_owner(device, login, name=None, email=None):
+def cmd_owner(device, login, name=None, email=None, on_owned=None):
     """Name the person behind member `device`: its owner becomes {login, name, email}. The only change to who owns a key
     added by hand (`add`/`adopt` write owner null), and so how its person becomes a `/enrol/pending` approver, which
     matches the tailnet login a member record's owner names (DEF-1643). The record keeps every other field and its
     order; the block carries no owner, so authorized_keys is not touched. Refuses an owner members.py would not store,
-    a device with no record, and a record that does not load (fix it first) — never echoing a value."""
+    a device with no record, and a record that does not load (fix it first) — never echoing a value. Then, also when
+    nothing changed, -> on_owned(login, [device])'s answer (0 without one)."""
     device = device_name(device)
     owner = M.validate_owner({'login': login, 'name': name, 'email': email})
     with members_lock():
@@ -599,14 +612,15 @@ def cmd_owner(device, login, name=None, email=None):
         before = M.valid_owner(current.get('owner'))
         if before == owner:
             print(f"{device} is already owned by {owner['login']}; nothing changed")
-            return 0
-        record = dict(current, owner=owner)
-        if record.get('pubkey_sha256') is None:            # a record written before A2 carries no fingerprint
-            record['pubkey_sha256'] = fingerprint(record['pubkey'])
-        save_member(record)
-    print(f"owner of {device}: {before['login'] if before else 'none'} -> {owner['login']}"
-          + (f" ({owner['name']})" if owner['name'] else ''))
-    return 0
+        else:
+            record = dict(current, owner=owner)
+            if record.get('pubkey_sha256') is None:        # a record written before A2 carries no fingerprint
+                record['pubkey_sha256'] = fingerprint(record['pubkey'])
+            save_member(record)
+    if before != owner:
+        print(f"owner of {device}: {before['login'] if before else 'none'} -> {owner['login']}"
+              + (f" ({owner['name']})" if owner['name'] else ''))
+    return on_owned(owner['login'], [device]) if on_owned else 0
 
 
 def _owner_args(rest):
@@ -621,7 +635,22 @@ def _owner_args(rest):
     return rest[0], rest[1], options.get('--name'), options.get('--email')
 
 
-def main(args):
+def _adopt_args(rest):
+    """[--dry-run] [--login LOGIN], each at most once, in either order -> (dry_run, login or None)."""
+    dry_run, login, index = False, None, 0
+    while index < len(rest):
+        if rest[index] == '--dry-run' and not dry_run:
+            dry_run, index = True, index + 1
+        elif rest[index] == '--login' and login is None and index + 1 < len(rest):
+            login, index = rest[index + 1], index + 2
+        else:
+            raise L.LanesError(USAGE)
+    return dry_run, login
+
+
+def main(args, on_owned=None):
+    """`lanes keys …`. `on_owned(login, devices) -> exit code` is called after adopt --login or owner named an owner
+    (bin/lanes passes its profile fold); None (this module run on its own) calls nothing."""
     path = authorized_keys_path()
     verb, rest = (args[0], args[1:]) if args else (None, [])
     if verb == 'list' and not rest:
@@ -630,10 +659,12 @@ def main(args):
         return cmd_add(path, *rest)
     if verb == 'revoke' and len(rest) == 1:
         return cmd_revoke(path, rest[0])
-    if verb == 'adopt' and rest in ([], ['--dry-run']):
-        return cmd_adopt(path, dry_run=bool(rest))
+    if verb == 'adopt':
+        dry_run, login = _adopt_args(rest)
+        owner = None if login is None else M.validate_owner({'login': login})   # refused before anything is read
+        return cmd_adopt(path, dry_run=dry_run, owner=owner, on_owned=on_owned)
     if verb == 'owner':
-        return cmd_owner(*_owner_args(rest))
+        return cmd_owner(*_owner_args(rest), on_owned=on_owned)
     raise L.LanesError(USAGE)