@vibelord/lanes 1.1.1 → 1.3.0

package/payload/lanes/bin/lanes

@@ -6,10 +6,23 @@
   lanes resolve <lane-id>        exact target of one lane as JSON (contract for the web harness)
   lanes status                   one-line-per-workspace health summary
   lanes attach <device> [--client ID] [--mobile] [--viewports N]
-               [--ascii] [--glyphs unicode|ascii|emoji] [--theme dark|light|auto] [--color truecolor|16|none]
-               [--default-device NAME] [--client-version V]
+               [--ascii] [--glyphs unicode|ascii|emoji] [--theme dark|light|auto] [--color truecolor|256|16|none]
+               [--notify 1|0] [--dim 90|2] [--editor micro|hx|nvim|vim|auto] [--device-only] [--default-device NAME]
+               [--client-version V]
                                  attach this terminal to the device's view session (creates it if needed); the look
-                                 flags are remembered in devices/<device>.json and reach its running sidebars in a tick.
+                                 flags (--notify 0: no desktop notification; --dim 2: SGR 2 for 16-colour dim text)
+                                 are remembered and win over LANES_COLOR/THEME/GLYPHS/NOTIFY/DIM, which a session
+                                 created here inherits from this shell. On a device with an owner (a member record, its
+                                 machine's for a window like mac-2, or `lanes device claim`) --theme/--color/--glyphs/
+                                 --ascii go to that person's profile users/<login>.json, which every device they own
+                                 shares, and leave devices/<device>.json; --device-only keeps them in the device file,
+                                 for this device alone (marked as its own: only such a key wins over the profile
+                                 there, and the flag without --device-only hands it back). A look a device with an
+                                 owner recorded before profiles existed paints there only where the profile sets none
+                                 (`lanes user show` names it; `lanes device claim <device> --login <owner>` folds it
+                                 in). --notify/--dim/--editor, and every flag on a device without an owner, are
+                                 remembered in devices/<device>.json, which reaches its running sidebars in a tick.
+                                 --editor is the editor quick edit (Ctrl-Alt-e) starts on this device (auto: none chosen)
                                  lanes-launch passes its machine's device and its version: one dim line says when that
                                  client is older than this server (`lanes-launch update`)
   lanes prepare <device> [--mobile|--desktop]
@@ -36,6 +49,11 @@
   lanes open <lane-id>           attach this terminal straight to one lane (no multiplexer in between)
   lanes register <lane-id> [ws]  add an unregistered session to a workspace without restarting it
                                  use lanes ls --unregistered [--json] to find its ID
+  lanes unregister <lane-id>     take a session added that way out of its workspace again (the sidebar's `u`): nothing
+                                 stops; a running one is listed under Unregistered with the same id and name (lanes
+                                 register undoes it); refused while tmux cannot check it. A record no workspace lists
+                                 any more is removed from registered-sessions.json. A lane declared in a repository's
+                                 terminals.json is refused with the file to edit
   lanes workspaces               print the board ids (what the client installer reads)
   lanes workspaces add <id> --container <name> --repo <path> [--title T] [--session S] [--write]
                                  add a board to the site catalog (catalog.json + a new workspaces.<id>.json whose one
@@ -45,6 +63,24 @@
                                  a no-op, a difference is reported and exits 1. A repository belongs to one board: one
                                  another board already declares (same container and folder) is refused, as cursor-sync
                                  would rewrite its terminals.json for both. Then: install-container, sync, doctor
+  lanes workspaces hide|show|order <id…> [--device D | --login L]
+                                 arrange a person's boards on every device they own, in their profile users/<login>.json:
+                                 hide / show takes boards off their tabs / puts them back (a hide that would leave no
+                                 board is refused; show also takes off an id no board has any more), order puts the
+                                 boards named first, in that order, the rest following in catalog order (it replaces
+                                 the order). The person is the owner of --device D (a window like mac-2: its machine's),
+                                 else of $LANES_DEVICE, or --login L. Ids are the ones `lanes workspaces` prints. Exit 1
+                                 when the profile stayed busy (run it again)
+  lanes lane pin|unpin|hide|show <lane-id> [--device D | --login L]
+                                 the same person's pinned lanes (listed first in their section) and hidden lanes (left
+                                 out of their lists): pin takes a lane a board lists or a running unregistered session,
+                                 hide a registered lane only (an unregistered session that runs is always listed);
+                                 unpin and show also take a lane that left the boards
+  lanes here <device>            show on <device> the lane its owner opened last on any of their devices (the profile's
+                                 last opened lane): its board's first viewport points at it and, when the view runs, the
+                                 board's tab comes to the front. Says why when it cannot (nothing opened yet, the lane
+                                 is gone, its board is hidden). Asked for, never automatic: `lanes-launch here` runs it
+                                 for the client's own device
   lanes onboard <login> --container <name> [--workspace <id> --repo <path> [--title T]]
                 [--write] [--no-mcp]
                                  provision a user's container and agents in one verb. Dry-run by default (every diff and
@@ -62,18 +98,65 @@
                                  writing nothing: the agent could not read files this account writes. Prints a
                                  key: value table (a stopped run names every step it did not reach: not-run) and keeps
                                  ~/.local/state/lanes/onboard/<login>-<UTC>.json. Re-running changes nothing that is
-                                 done. --no-mcp leaves out lane-mcp (plan W6, not shipped yet).
+                                 done. --no-mcp leaves out lane-mcp and the agents' MCP entries (install-container's).
                                  Exit 1 only when a step failed; an unknown container or a board that disagrees stops it
-  lanes layout <device> [--mobile]   print the generated zellij layout
-  lanes rebuild <device>         recreate a device's view session (agents are never touched)
-  lanes upgrade-session [device…]  sync catalog tabs and labels to live sessions without a rebuild
-  lanes ensure                   recreate any known device session that is missing (never when zellij did not answer:
-                                 an unknown session list is not an empty one)
+  lanes layout <device> [--mobile]   print the generated zellij layout (its tree files named through
+                                 ~/.local/share/lanes/current while that link names this tree: a pane started from it
+                                 runs the release the link names then)
+  lanes rebuild <device>         recreate a device's view session (agents are never touched). Waits up to 120 s while
+                                 another lanes process acts on the view sessions (the view-session lock,
+                                 ~/.local/state/lanes/locks/sessions.lock), then exits 1 naming it
+  lanes upgrade-session [device…]  sync catalog tabs and labels to live sessions without a rebuild; the owner's profile
+                                 orders the workspace tabs and its hidden boards' tabs are closed (lanes untouched)
+  lanes ensure [--if-layout-changed]
+                                 recreate any known device session that is missing (never when zellij did not answer:
+                                 an unknown session list is not an empty one). --if-layout-changed (the server update's
+                                 last step) also compares every running view with the layout this release generates
+                                 for it: when a tab the view still has would get other panes, the view is rebuilt
+                                 (`lanes rebuild`) if `zellij action list-clients` shows no client attached; with a
+                                 client — or no answer — it keeps running and gets ~/.local/state/lanes/clients/
+                                 <device>.update-ready, which its sidebars show as `update ready · reload (r)` (r
+                                 rebuilds it). Tabs `lanes sync` adds, renames or orders in a running view are no
+                                 change. Without the flag only a device with that file is compared, so
+                                 lanes-ensure.timer rebuilds it once its last client has left. The whole run holds the
+                                 view-session lock (as rebuild, attach/prepare/web's create, offboard and device forget
+                                 do): with the flag it waits up to 120 s for another holder, without it 10 s, then
+                                 skips the run (exit 0: the timer runs again in a minute). Exit 1 when a view could
+                                 not be recreated (the run stops there) or rebuilt (the other views are still done), or
+                                 the flag's wait ran out; 2 for any other argument
   lanes reattach                 make every view re-attach its lane (after changing flags); agents untouched
+  lanes reload-views             ask every running viewport to start again from the installed release at its next lane
+                                 switch or reconnect (SIGUSR2 to each view.sh that handles it; an attached lane client
+                                 is never dropped). A view.sh of an older release, which that signal would end, is left
+                                 alone and named: `lanes rebuild <device>` moves it. Sidebars swap by themselves. The
+                                 server update runs it after the switch (./install.sh --server --update-only)
+  lanes update [--now | --timer | --status | --rollback]
+                                 install the newest npm release on an npm-installed server (what lanes-update.timer runs
+                                 15 min after boot and every 30 min, as --timer): ask the registry which release the
+                                 dist-tag `latest` names (`lanes-stable` with channel=stable in
+                                 ~/.config/lanes/update.conf) and, when it is newer than the installed one and not the one
+                                 a rollback left, run `npx --yes @vibelord/lanes@<release> --server --update-only` with the
+                                 npx the npm wrapper recorded at install (~/.local/state/lanes/update/npx). A last update
+                                 that ended partial gets its post-commit again first (the timer: once per release). A
+                                 check that answered less than 20 min ago is not repeated; --now asks anyway. One at a
+                                 time (~/.local/state/lanes/locks/update.lock). --rollback: install the release
+                                 ~/.local/share/lanes/current.previous names again, in place (no network), run its
+                                 post-commit and mark the release left `bad`: no update installs it again. --status:
+                                 print ~/.local/state/lanes/update/last.json, where every check is recorded (`check`).
+                                 A checkout server is left alone (git pull). Exit 0 nothing to do or ok, 4 partial,
+                                 3 refused (another update running, a checkout, no installed release; 0 under --timer),
+                                 1 failed (no release from the registry, no recorded npx, the install failed), 2 usage
   lanes upload <ws> | --active <device> [--paste]
                                  read a tar stream on stdin into that board's uploads/ folder (the same folder Cursor
                                  users drop files into); prints the in-container paths. --paste also types the path(s)
-                                 into the lane that device is looking at. `lanes workspaces` lists board ids.
+                                 into the lane that device is looking at. `lanes workspaces` lists board ids. Each file
+                                 also goes to the docs store with a sha256 receipt (stderr `# docs:` lines), for the
+                                 login that owns the device; the Docs page's upload (POST /up) lands the same way.
+  lanes docs push <id>           the hook for pushing one docs-store document to the data service's publication surface
+                                 — NOT BUILT: it prints the document's receipt (receipt.json: id, sha256, bytes, url,
+                                 at; looked up by id in every login's store, for the operator), says `not configured`
+                                 on stderr and exits 2. It sends nothing and writes nothing. Exit 1: no document with
+                                 that id, an id that is not one, or another argument (this usage)
   lanes cursor-sync [ws…] [--write] [--diff] [--canonicalize] [--identity]
                                  make Cursor/VS Code terminals open exactly the board's lanes through `lane open`
                                  (dry-run by default: prints the git-style diff; --write applies with a backup).
@@ -81,16 +164,39 @@
                                  attach-only, missing script) with the canonical one whose `tmux new -e` flags give the
                                  lane LANE_ID/LANE_WS and the lanes/<ws>/<id> trace; --identity adds those flags to a
                                  working plain `tmux -L S new -ADs N [-c D] CMD` recipe, keeping CMD. The old recipe is
-                                 kept as createPrevious. Only these -e flags give a lane its identity (DEF-1559)
+                                 kept as createPrevious. Only these -e flags give a lane its identity (DEF-1559). An
+                                 entry's displayName (the repository's own lane name) is carried unchanged
   lanes cursor-commit [ws…] [--push]
                                  commit the normalized terminals.json on top of each repo's REMOTE branch tip and push it,
                                  with git plumbing only (no working tree or index is touched). Dry-run without --push.
-  lanes hello [device]           what the client installer calls to prove the path, the key and the server version
+  lanes hello [device] [--client-version V]
+                                 what the client installer calls to prove the path, the key and the server version:
+                                 `ok device=D version=S boards=N`; a client that passes its release V, older than S
+                                 (major.minor.patch as numbers), gets ` update=S` appended — the release to update to
+  lanes version [--json]         which release runs here, in one line: `lanes 1.2.0 (abc1234) · tree pkg/1.2.0 ·
+                                 current ✓ · statusd runs 1.1.0 ✗ · enrold notify ✓` — this tree's VERSION and the npm
+                                 stamp's commit, the tree, whether ~/.local/share/lanes/current names it (✗ with the
+                                 tree it does name), then the tree each long-running process recorded at its last start
+                                 (~/.local/state/lanes/run/<name>.tree: statusd, enrold, docsd, notify, economy, studio_host,
+                                 the newest sidebar), ✗ for one that is not the current tree (`runs 1.1.0 ✗`) or that
+                                 started before its tree's code (VERSION, bin/, libexec/) last changed — a checkout
+                                 updated in place by `git pull` keeps its path (`started before its tree changed ✗`) —
+                                 restart that service. A stopped process keeps its last record. --json: {schema:
+                                 lanes.version/1, version, commit, tree, current, running{<name>: {tree, version,
+                                 started, current, changed}}, client_min (the release `lanes attach` stops telling
+                                 lanes-launch to update at)}. Exit 0
   lanes client-config            site facts for clients (KEY=VALUE from ~/.config/lanes/site.conf on the server)
   lanes install-container <name> [--no-mcp]
-                                 install the `lane` contract (lane, lane-run, lane-signal, hooks/) + pinned zmx into a
-                                 container's home volume (additive; installs no agent hook). --no-mcp is accepted for
-                                 lane-mcp (plan W6); no MCP server ships yet, so today it changes nothing
+                                 install the `lane` contract (lane, lane_core.py, lane-run, lane-signal, lane-edit,
+                                 lane-mcp, vimrc, VERSION, hooks/) + pinned zmx into a container's home volume
+                                 (additive; installs no agent hook and no editor: lane-edit runs $LANES_EDITOR or the
+                                 first of micro hx nvim vim vi there) and add the Lanes MCP server to the agents'
+                                 configs: mcpServers.lanes in ~/.claude.json and [mcp_servers.lanes] in
+                                 ~/.codex/config.toml, both starting /home/coder/.lz/bin/lane-mcp — only where missing,
+                                 the file kept as <file>.bak-<UTC> first, atomic (a `lanes` entry that starts something
+                                 else is left alone, exit 1; on a uid split nothing is written there, exit 1). --no-mcp
+                                 leaves out lane-mcp and the entries (lane-edit and its vimrc still ship) and removes
+                                 nothing an earlier install wrote. In the container: lane mcp install
   lanes hooks install --agent claude|codex (--container <name> | --home <dir>) [--dry-run | --write]
                                  merge the lane-signal hooks into that home's ~/.claude/settings.json or ~/.codex/hooks.json
                                  (+ a top-level Codex notify when none is set); prints the diff, writes only with --write
@@ -98,7 +204,10 @@
                                  --write into a --container whose home the agent could not read from this account (uid
                                  not 1000, or a home volume not owned by 1000) is refused with the reason
   lanes invariant save|check     snapshot / verify every live pane's pid and window size
-  lanes gc                       truncate oversized zmx logs, drop stale dynamic resolve files
+  lanes gc                       truncate oversized zmx logs, drop stale dynamic resolve files, prune old staged trees:
+                                 each pkg root keeps its 3 newest and every tree current, current.previous, this
+                                 lanes, a view layout, a running daemon's run record or a process of this account
+                                 uses (none pruned when /proc cannot be read); `pruned <tree>` / `kept <tree>: <why>`
   lanes sockets [check|repair]   lanes that run but cannot be reached: tmux servers whose socket file was deleted
                                  (someone emptied the container's /tmp); repair = tmux's SIGUSR1, nothing restarts
   lanes pressure                 host memory / io pressure, swap, per-container memory and /tmp use — plain files and
@@ -123,11 +232,32 @@
                                  focused viewport (the first one when the sidebar has the focus) at the next / previous
                                  lane of its board in registry order, wrapping, and wake its view.sh (SIGUSR1) — the
                                  same write as Enter in the sidebar. Reads two zellij listings; moves no focus
+  lanes sidebar-key filter|upload --focused [--device D]
+                                 what Ctrl-Alt-/ and Ctrl-Alt-u run in a floating pane that closes on exit, after their
+                                 three lefts moved the focus to the sidebar: tell the sidebar of the active tab to start
+                                 its filter / arm its upload strip through views/<device>/<ws>.sidebar.cmd (it acts within
+                                 a tick, and before the next key it reads). Types nothing into any pane; on a tab without
+                                 a sidebar (Host, a tool tab), or when the sidebar does not have the focus, it does nothing
   lanes preview --focused [--device D]
                                  what Ctrl-Alt-m runs in a floating pane: the markdown files the focused lane named in
                                  its last 300 lines (guarded tmux capture, resolved against its cwd, existing ones only),
                                  newest first; one is shown at once, several give a numbered menu. glow (pinned in
                                  holders.lock) in the device's dark/light theme, else less -R
+  lanes edit --focused [--device D]
+                                 what Ctrl-Alt-e runs in a floating pane named Edit: quick edit of the focused lane's
+                                 AGENTS.md, CLAUDE.md or .env.local. One Edit pane per view: when another is open it
+                                 gets the focus (same tab) or is named (another tab) and nothing opens. Otherwise the
+                                 focused tmux lane's git checkout (its working directory, else its folder; a worktree's
+                                 .git file leads to the main checkout), read through /proc/<init>/root: AGENTS.md and
+                                 CLAUDE.md of the checkout, of the main checkout too when the lane is in a linked
+                                 worktree, and the main checkout's .env.local. A regular file inside the checkout only
+                                 (a symbolic link is never offered); a missing one is shown `not present` (no file is
+                                 created). One key picks (1-5; Enter when one file is there; q or Esc closes), then
+                                 `docker exec -it -u coder -w <checkout> <container> ~/.lz/bin/lane-edit <file>` replaces
+                                 it (no shell, no docker inspect) with LANES_EDITOR = the device's --editor, else this
+                                 process's LANES_EDITOR, else none (lane-edit's own list). Refused: a container that is
+                                 not running, one without lane-edit (install-container), no checkout. Exit: the
+                                 editor's status, 0 closed or nothing to edit, 1 refused, 2 without --focused
   lanes studio-host status [--json] [--check]
                                  the co-located Throttle Studio Host (opt-in: install/enable-studio-host.sh): binary
                                  digest, config mode, enrolment, units. Exit 0 only when it runs enrolled
@@ -141,17 +271,51 @@
                                  the lanes per create-recipe class (idempotent / attach-only / null / external /
                                  retired-path), lane identity, numeric session names, crowded `default` sockets and
                                  orphan tmux socket files (report only; in a container `lane gc --sockets` removes them),
-                                 any record left in the retired legacy-sessions/ directory, and the browser/phone half:
+                                 any record left in the retired legacy-sessions/ directory, the devices without an owner
+                                 (each keeps its look to itself: `lanes device claim`), and the browser/phone half:
                                  lanes-web / lanes-mobile units (⚠ not enabled, ✗ enabled but not running), the login-token
                                  database the running lanes-web reads (✗ when it is not the one `lanes token` uses) and the
-                                 Tailscale Serve https:8443 mapping (⚠ not checked on a host without a Tailscale name)
-  lanes device list | forget <name>
+                                 Tailscale Serve https:8443 mapping (⚠ not checked on a host without a Tailscale name);
+                                 the docs service: lanes-docsd enabled, active and answering on its loopback port (⚠
+                                 not enabled, ✗ enabled but not running or not answering), the pin gate (⚠ until `lanes
+                                 enrol mode request`), the store (documents, bytes, docs.log), the Mermaid pin (⚠ not
+                                 installed: install/enable-docs.sh; ✗ not the pinned build) and the age switch (✗ set
+                                 without an age binary);
+                                 then the release that runs: ~/.local/share/lanes/current names a tree whose VERSION
+                                 agrees with its pkg/<version> name and npm stamp and that this lanes runs (⚠ without the
+                                 link: the rest compares with this tree); every lanes process that runs now has a run
+                                 record of the current code (✗ with its restart — a daemon or sidebar that runs with no
+                                 record started from an older release; a record whose process does not run is one line
+                                 of information); every device layout runs the current tree (✗ `lanes rebuild
+                                 <device>`; ⚠ when it names it by another path than `lanes rebuild` writes now); every
+                                 installed lanes unit's ExecStart runs it (✗ re-run the server installer); and the
+                                 updates (update/last.json): how long ago `lanes update` last checked and what came of
+                                 it, the last update's result (✗ partial or failed, ⚠ refused, a registry that gave no
+                                 release, lanes-update.timer not enabled — no timers.target.wants link: an update with
+                                 --update-only never enables it — or no check for 2 h: is it on?), a release a rollback
+                                 marked bad; a checkout server is one line of information
+  lanes device list | forget <name> | claim <device> --login L [--name N]
                                  the devices `lanes ensure` recreates view sessions for, each with its owner's login
                                  (from members/<device>.json, or the machine's for a window like mac-2, whenever that
                                  record exists, so it agrees with `lanes keys list`; after a revoke the last one is
                                  kept; blank for none); forget removes devices/<name>.json (a running view session is
-                                 left alone and is not brought back once it ends)
-  lanes keys list | add <device> <pubkey-file|-> | revoke <device> | adopt [--dry-run]
+                                 left alone and is not brought back once it ends); claim names the owner of a device no
+                                 member record speaks for (one from before enrolment): it writes `owner` into
+                                 devices/<device>.json and its windows' (mac-2, …), where every rewrite keeps it, then
+                                 folds their look (never a --device-only key) and seen marks into L's profile; a view L
+                                 owns already keeps the name it records unless --name replaces it. A member record
+                                 decides whenever one exists: a claim that disagrees is refused (`lanes keys owner`),
+                                 one that agrees only folds (a look the device recorded before profiles existed).
+                                 Exit 1 when the profile could not be written (the same claim finishes it)
+  lanes user list | show <login> [--json]
+                                 the people lanes knows — a profile under users/, or a device a member record or a claim
+                                 gives them — with their devices; show prints one profile (look, seen lanes, workspace
+                                 order and hidden boards, pinned and hidden lanes, last opened lane, quiet time, last
+                                 change; --json: the stored document and the devices) and every look one of the
+                                 person's devices keeps in its own file (--device-only, or from before the profile).
+                                 Read-only. Exit 1 when the profile file exists but this release does not read it (the
+                                 reason is printed)
+  lanes keys list | add <device> <pubkey-file|-> | revoke <device> | adopt [--dry-run] [--login LOGIN]
              | owner <device> <login> [--name NAME] [--email ADDR]
                                  who may log in, as a projection of ~/.local/state/lanes/members/<device>.json: one
                                  `restrict,pty ssh-ed25519 <key> lanes:<device>` line per member between the
@@ -163,8 +327,11 @@
                                  neither (exit 1 only when a line outside the block still lets it in); adopt moves
                                  hand-added `lanes:<device>` lines into members/
                                  and the block (first adopt keeps authorized_keys.bak-<UTC>) and re-renders the block;
+                                 --login names the owner of every key it moves in (owner null without it);
                                  owner names the person behind a member (add/adopt record none) — the tailnet login
-                                 `/enrol/pending` must see to let that person approve enrolment requests
+                                 `/enrol/pending` must see to let that person approve enrolment requests. Whenever
+                                 adopt --login or owner names an owner, the views of those devices (and their windows)
+                                 are folded into that person's profile, as `lanes device claim` does
   lanes invite <name> [--email ADDR] [--expires 7d] [--workspaces a,b] [--tailscale-link URL] [--md]
   lanes invite list | revoke <id>
                                  mint a one-time code LN-<id>-<secret> a new machine redeems at lanes-enrold (libexec/
@@ -191,12 +358,17 @@
                                  views `lanes-launch web` opened for it), end its view session (no lane is touched).
                                  Without --yes or off a terminal: the plan, exit 2
 """
+import contextlib
 import json
 import os
+import posixpath
 import pwd
 import re
 import shutil
+import signal
+import stat
 import sys
+import tempfile
 import time
 from pathlib import Path
 
@@ -206,17 +378,28 @@ import lanes_lib as L  # noqa: E402
 SLOTS = ['main', 'b', 'c']
 ZELLIJ_VERSION = '0.45.1'
 ZELLIJ = L.SHARE / 'bin' / f'zellij-{ZELLIJ_VERSION}'
-ZELLIJ_BASE = [str(ZELLIJ), '--config-dir', str(L.REPO / 'zellij'), '--config', str(L.REPO / 'zellij/config.kdl')]
+# A view session outlives the update that flips `current` (W9 U1): its zellij server keeps the argv and the environment
+# it was started with, so the config it reads and the bare `lanes` its keybindings run (clean_env PATH) are named
+# through L.CURRENT — the link for a staged tree it names — never this tree's resolved path.
+ZELLIJ_BASE = [str(ZELLIJ), '--config-dir', str(L.CURRENT / 'zellij'), '--config', str(L.CURRENT / 'zellij/config.kdl')]
 PROC = Path(os.environ.get('LANES_PROC_ROOT') or '/proc')   # injectable for the unit tests
 
 
+# The sidebar's look and notification switches (cockpit v3 P4, LNS-72, DEF-1577): forwarded when set, so the shell that
+# runs `lanes attach|ensure|rebuild` decides them for the view sessions it creates. A device's recorded LOOK_KEYS still
+# win over them (sidebar.resolve_modes / resolve_dim_notify).
+LOOK_ENV = ('LANES_COLOR', 'LANES_THEME', 'LANES_GLYPHS', 'LANES_DIM', 'LANES_NOTIFY')
+
+
 def clean_env(extra=None):
-    """Environment for the view server: nothing from the ssh session leaks into panes."""
+    """Environment for the view server: nothing from the ssh session leaks into panes but the named keys. The Zellij
+    server create_session starts keeps it for the session's life, and every sidebar, view.sh and floating Run pane of
+    that session inherits it (zellij() and cmd_open use it too): LOOK_ENV is how LANES_NOTIFY=0 reaches a sidebar."""
     env = {'HOME': str(Path.home()), 'USER': os.environ.get('USER', 'dev'), 'SHELL': '/bin/bash',
-           'PATH': f"{L.SHARE / 'bin'}:{L.REPO / 'bin'}:/usr/local/bin:/usr/bin:/bin",
+           'PATH': f"{L.SHARE / 'bin'}:{L.CURRENT / 'bin'}:/usr/local/bin:/usr/bin:/bin",
            'LANG': 'C.UTF-8', 'LANES_STATE': str(L.STATE), 'LANES_SHARE': str(L.SHARE), 'LANES_ZELLIJ': str(ZELLIJ)}
-    for key in ('LANES_WORKSPACES', 'XDG_RUNTIME_DIR', 'DBUS_SESSION_BUS_ADDRESS', 'ZELLIJ_SOCKET_DIR'):  # last one: test isolation
-        if os.environ.get(key):
+    for key in ('LANES_WORKSPACES', 'XDG_RUNTIME_DIR', 'DBUS_SESSION_BUS_ADDRESS', 'ZELLIJ_SOCKET_DIR') + LOOK_ENV:
+        if os.environ.get(key):   # ZELLIJ_SOCKET_DIR: test isolation
             env[key] = os.environ[key]
     if 'XDG_RUNTIME_DIR' not in env and Path(f'/run/user/{os.getuid()}').is_dir():
         env['XDG_RUNTIME_DIR'] = f'/run/user/{os.getuid()}'
@@ -230,11 +413,14 @@ def q(text):
 
 # ------------------------------------------------------------------- registry
 
-def cmd_sync(_args):
+def sync_registry():
+    """Rebuild and publish the registry, print the per-board table -> (boards with errors, [(container, why)] whose
+    `~/.lz/registry.json` was refused). `lanes sync` turns either into exit 1; a rename that publishes through it
+    raises the refusal (DEF-1796: that container's `lane open` keeps its previous projection)."""
     with L.registry_lock():
         previous = L.read_json(L.STATE / 'registry.json')
         registry = L.build_registry(previous)
-        L.publish_registry(registry)
+        refused = L.publish_registry(registry) or []
     total = sum(len(w['lanes']) for w in registry['workspaces'])
     failed = [w for w in registry['workspaces'] if w['errors']]
     for workspace in registry['workspaces']:
@@ -242,10 +428,18 @@ def cmd_sync(_args):
         print(f"{mark} {workspace['id']:<18} {len(workspace['lanes']):>3} lanes  {workspace['container']}")
         for error in workspace['errors']:
             print(f'    ⚠ {error}' + ('  (kept previous lanes)' if workspace.get('stale') else ''))
-    print(f"{total} lanes in {len(registry['workspaces'])} workspaces" + (f'; {len(failed)} with errors' if failed else ''))
+    for container, why in refused:   # DEF-1796: that container's `lane open` keeps its previous projection
+        print(f'! container {container}: {why}')
+    print(f"{total} lanes in {len(registry['workspaces'])} workspaces" + (f'; {len(failed)} with errors' if failed else '')
+          + (f'; {len(refused)} container projection(s) not written' if refused else ''))
     if any((L.STATE / 'devices').glob('*.json')):
         cmd_upgrade_session([])
-    return 1 if failed else 0
+    return failed, refused
+
+
+def cmd_sync(_args):
+    failed, refused = sync_registry()
+    return 1 if failed or refused else 0
 
 
 def cmd_register(args):
@@ -257,6 +451,54 @@ def cmd_register(args):
     print(f"Registered {lane['name']} in {lane['workspace']}")
 
 
+def cmd_unregister(args):
+    """lanes unregister <lane-id> — the sidebar's `u` (cockpit v3 S7): take a session added with Add to workspace /
+    `lanes register` out of registered-sessions.json. Nothing is stopped; a running session is listed under
+    Unregistered again with the same id and name. A lane a repository's terminals.json declares is taken out of that
+    file (session_actions.unregister_lane: the Agent API's editor, M4, wired at the fan-in), then synced; its refusals
+    (DeclaredRefused) are said, and a lane of an SSH workspace says which file declares it. A record no workspace
+    lists (its workspace left the catalog, uses another container, or a repository declares the session) is removed
+    from the file all the same (S7 fix cycle 1, DEF-1826)."""
+    if len(args) != 1:
+        raise L.LanesError('Usage: lanes unregister <lane-id>')
+    import registrations
+    import session_actions
+    try:
+        workspace, lane = L.find_lane(L.load_registry(), args[0])
+    except L.LanesError as error:
+        workspace, lane, unknown = None, None, error
+    published = lane is not None and bool(lane.get('registered_session'))
+    if lane is not None and not published and session_actions.declared_in(lane):
+        if not lane.get('source'):   # an SSH workspace's lane: catalog.json, which no editor of ours writes
+            raise L.LanesError(f"{lane['id']} is {session_actions.declared_text(lane)}")
+        done = session_actions.unregister_lane(lane['id'])
+        if done['changed']:
+            cmd_sync([])
+        print(f"Unregistered {lane['name']} from {workspace['id']} ({done['name']} out of {done['source']})")
+        return 0
+    if published or any(item['id'] == args[0] for item in registrations.load()['sessions']):
+        try:
+            record = registrations.unregister(args[0])
+        except registrations.Unpublished as error:
+            undo = error.record
+            if undo.get('identity'):   # the record is out of the file: say how to put it back once it is listed
+                raise L.LanesError(f"{error} (undo once it is listed again: lanes register {undo['id']} "
+                                   f"{undo['workspace']})") from None
+            raise
+        if record.get('identity'):
+            print(f"Unregistered {record['name']} from {record['workspace']}; it is listed under Unregistered again "
+                  f"(undo: lanes register {record['id']} {record['workspace']})")
+        elif published:
+            print(f"Unregistered {record['name']} from {record['workspace']}; no session runs under it now")
+        else:
+            print(f"Removed the registration of {record['name']} ({record['id']}) from {registrations.FILENAME}; "
+                  "no workspace listed it, so nothing else changed")
+        return 0
+    if lane is None:
+        raise unknown
+    raise L.LanesError(f"{lane['id']} is not registered; nothing to unregister")
+
+
 def cmd_ls(args):
     registry = L.load_registry()
     snapshot = L.read_json(L.STATE / 'status.json') or {}
@@ -321,7 +563,12 @@ def tab_layout(lines):
                       '        }', '    }'] + lines + ['}']) + '\n'
 
 
-def tab_specs(device, registry, mobile=False, viewports=1):
+def tab_specs(device, registry, mobile=False, viewports=1, profile=None):
+    """The tabs a view session has, in order: the workspace boards, then ssh workspaces and tools, then the boards whose
+    `position` is `before-host`, then Host. The boards are the ones the device's owner sees (cockpit v3 R4, LNS-77):
+    `profile` (users/<login>.json as users.read gives it, device_profile) hides `workspaces.hidden` and orders the rest
+    by `workspaces.order` (users.arrange: an unknown id is ignored, an unlisted board follows in catalog order, a hidden
+    list that would leave no board hides none); None — a device nobody owns — is the catalog order."""
     result = []
     def add(key, title, lines):
         result.append({'key': key, 'title': title, 'lines': lines, 'layout': tab_layout(lines)})
@@ -333,20 +580,25 @@ def tab_specs(device, registry, mobile=False, viewports=1):
                 add(f"workspace/{workspace['id']}/{role}", title, mobile_workspace_tab(device, workspace, picker))
         else:
             add(f"workspace/{workspace['id']}/view", workspace['title'], workspace_tab_kdl(device, workspace, False, viewports))
-    for workspace in registry['workspaces']:
+    users = users_module() if profile else None
+    boards = users.arrange(registry['workspaces'], profile) if users else registry['workspaces']
+    for workspace in boards:
         if workspace.get('position') != 'before-host': board(workspace)
     for workspace in registry.get('ssh_workspaces', []):
         add('ssh/' + workspace['id'], workspace['title'], ssh_workspace_tab_kdl(workspace))
     for tool in registry.get('tools', []):
         add('tool/' + tool['view'], tool['tab'], tool_tab_kdl(device, tool, mobile=mobile))
-    for workspace in registry['workspaces']:
+    for workspace in boards:
         if workspace.get('position') == 'before-host': board(workspace)
     add('host', 'Host', ['    tab name="Host" {', '        pane command="/bin/bash" {', '            args "-l"', '        }', '    }'])
     return result
 
 
-def layout_kdl(device, mobile=False, viewports=1):
-    specs = tab_specs(device, L.load_registry(), mobile, viewports)
+def layout_kdl(device, mobile=False, viewports=1, profile=None):
+    """The view session's layout (create_session, `lanes layout`): tab_specs for the device's owner's profile — passed
+    by the caller, else read here (device_profile) — with the focus on the first tab."""
+    specs = tab_specs(device, L.load_registry(), mobile, viewports,
+                      device_profile(device) if profile is None else profile)
     lines = []
     for index, spec in enumerate(specs):
         tab = list(spec['lines'])
@@ -356,9 +608,58 @@ def layout_kdl(device, mobile=False, viewports=1):
     return tab_layout(lines)
 
 
+# A tab of a layout layout_kdl wrote: tab_layout indents every tab by four, and only tabs start `    tab name=`.
+LAYOUT_TAB = re.compile(r'    tab name=("(?:[^"\\]|\\.)*")')
+
+
+def layout_parts(text):
+    """(frame, tabs) of a layout layout_kdl wrote: `frame` the lines outside every tab (`layout {`, the
+    default_tab_template, the closing brace), `tabs` {title: [each tab of that title as text]}. The ` focus=true`
+    layout_kdl gives whichever tab comes first is left out of that tab's own line: which tab is first is the catalog's
+    order, which upgrade-session keeps in a running view without a rebuild."""
+    frame, tabs, block = [], {}, None
+    for line in text.splitlines():
+        match = LAYOUT_TAB.match(line)
+        if match:
+            try:
+                title = json.loads(match.group(1))
+            except ValueError:
+                title = match.group(1)
+            block = [line[:match.end()] + line[match.end():].replace(' focus=true', '', 1)]
+            tabs.setdefault(title, []).append(block)
+        elif block is not None and line.startswith('    '):
+            block.append(line)
+        else:
+            block = None
+            frame.append(line)
+    return frame, {title: ['\n'.join(block) for block in blocks] for title, blocks in tabs.items()}
+
+
+def layout_changed(stored, generated):
+    """Whether a view built from the layout `stored` (layouts/<device>.kdl, what create_session wrote; None when there
+    is none) runs differently from `generated` (layout_kdl now) in a way only a rebuild changes (W9 U6, LNS-94): the
+    frame differs (the tab template), or a tab whose title both have is, line for line, none of `generated`'s tabs of
+    that title (another tree path, another pane, size or argument — what a release changes). A tab only one of them has
+    and the order of the tabs are no change: `lanes sync` (upgrade-session, device_sync.reconcile) adds, renames and
+    orders the tabs of a running view, and never changes a tab's panes, so after a board was added or renamed the file
+    no longer names every tab a view shows. A missing or unreadable layout is a change: nothing says what the view
+    runs."""
+    if stored is None:
+        return True
+    frame, tabs = layout_parts(stored)
+    frame_now, tabs_now = layout_parts(generated)
+    return frame != frame_now or any(tab not in tabs_now[title]
+                                     for title, kept in tabs.items() if title in tabs_now for tab in kept)
+
+
+# Every tree file a layout runs is named through L.CURRENT (W9 U1, LNS-89): the `current` link while it names this
+# tree, so an update that flips the link moves every view built through it; this tree's own path for a checkout and
+# for a staged tree the link has moved past. Readers match those commands by suffix (lanes_lib.tree_file_at), so a
+# layout written before — naming its pkg/<version> tree — still identifies.
+
 def mobile_workspace_tab(device, workspace, picker):
     title = workspace['title'] + (' ☰' if picker else '')
-    command = str(L.REPO / 'libexec' / ('sidebar' if picker else 'view.sh'))
+    command = str(L.CURRENT / 'libexec' / ('sidebar' if picker else 'view.sh'))
     args = f'{q(device)} {q(workspace["id"])}' + ('' if picker else ' "main" "--mobile"')
     # The picker's sidebar pane has NO layout name: Zellij reports a non-empty pane name instead of the pane's own
     # OSC 2 title, and that title (the attention counts) is what the phone reads (DEF-1531).
@@ -374,8 +675,9 @@ def stale_picker_layouts():
     `upgrade-session` / `ensure` only add missing tabs and rename titles: a picker tab created from an older layout
     keeps its pane name, which Zellij reports instead of the OSC 2 counts, until `lanes rebuild <device>` (DEF-1531).
     `create_session` is the only writer of layouts/<device>.kdl, so the file is the layout the session was built from.
+    The sidebar is recognised by its tree file, whichever tree path the layout names (W9 U1: pkg/<version> before,
+    `current` since, a checkout's own path).
     """
-    sidebar = str(L.REPO / 'libexec' / 'sidebar')
     stale = []
     for meta_file in sorted((L.STATE / 'devices').glob('*.json')):
         if not (L.read_json(meta_file) or {}).get('mobile'):
@@ -384,13 +686,14 @@ def stale_picker_layouts():
             text = (L.STATE / 'layouts' / f'{meta_file.stem}.kdl').read_text()
         except OSError:
             continue
-        if any('name="Lanes"' in line and f'command={q(sidebar)}' in line for line in text.splitlines()):
+        if any('name="Lanes"' in line and any(L.tree_file_at([command], 'libexec/sidebar') == 0
+                                              for command in layout_commands(line)) for line in text.splitlines()):
             stale.append(meta_file.stem)
     return stale
 
 
 def workspace_tab_kdl(device, workspace, mobile=False, viewports=1, focused=False):
-    sidebar, view = str(L.REPO / 'libexec/sidebar'), str(L.REPO / 'libexec/view.sh')
+    sidebar, view = str(L.CURRENT / 'libexec/sidebar'), str(L.CURRENT / 'libexec/view.sh')
     focus = ' focus=true' if focused else ''
     lines = []
     if mobile:
@@ -413,7 +716,7 @@ def workspace_tab_kdl(device, workspace, mobile=False, viewports=1, focused=Fals
 
 def ssh_workspace_tab_kdl(workspace, indent='    '):
     """Main terminal on the left; up to two worker terminals stacked on the right."""
-    holder = str(L.REPO / 'holders/ssh.sh')
+    holder = str(L.CURRENT / 'holders/ssh.sh')
     panes = workspace['panes']
     lines = [f'{indent}tab name={q(workspace["title"])} split_direction="vertical" {{']
 
@@ -435,7 +738,7 @@ def ssh_workspace_tab_kdl(workspace, indent='    '):
 def tool_tab_kdl(device, tool, indent='    ', mobile=False):
     """One full-size tab for a shared tool (the Throttle monitor). It is a view with a fixed target, so it starts
     only when the tab is first shown and restarts by itself if the tool exits."""
-    view = str(L.REPO / 'libexec/view.sh')
+    view = str(L.CURRENT / 'libexec/view.sh')
     extra = ' "main" "--mobile"' if mobile else ''
     return [f'{indent}tab name={q(tool["tab"])} {{',
             f'{indent}    pane borderless=true name={q(tool["name"])} command={q(view)} {{',
@@ -466,9 +769,38 @@ def live_sessions():
     return names
 
 
+# The view-session lock (L.sessions_lock, DEF-1792). Every caller that decides from live_sessions() (or devices/) and then
+# creates, kills or deletes a view session holds it from that list to the last zellij call: `ensure`, `rebuild`,
+# attach/prepare/web's create, offboard's end_view and `device forget`. A caller that must act waits SESSIONS_WAIT for
+# another to finish (a rebuild is at most kill 30 s + delete 30 s + create 60 s, plus a list); one with a fallback only
+# glances (SESSIONS_GLANCE): the minute timer's plain `ensure` skips its tick, `attach` attaches without creating.
+SESSIONS_WAIT = 120
+SESSIONS_GLANCE = 10
+
+
+def hold_sessions(stack, timeout, doing):
+    """Enter L.sessions_lock(timeout, doing) on `stack` (a contextlib.ExitStack) -> None when held, else the LanesError
+    that says why not (SessionsBusy: another lanes process held it for `timeout` s; a plain LanesError: the lock file
+    could not be opened), so a caller tells the lock it did not get from a failure of the work it does under it."""
+    try:
+        stack.enter_context(L.sessions_lock(timeout, doing))
+    except L.LanesError as error:
+        return error
+    return None
+
+
+# The web front's own path roots (web/Caddyfile): a view session is served at /<device>, so a device of one of these
+# names would sit on a route a service owns — the enrolment service (/enrol/*), the docs service (/lanes-docs/*) and
+# the shell's assets (/lanes-assets/*). Compared casefolded: Caddy's path matcher ignores case.
+RESERVED_DEVICES = ('enrol', 'lanes-assets', 'lanes-docs')
+
+
 def device_name(value):
     if not L.IDENT.match(value or '') or len(value) > 32:
         raise L.LanesError('Invalid device name')
+    if value.casefold() in RESERVED_DEVICES:
+        raise L.LanesError(f'Invalid device name: {value} is a path the web front reserves '
+                           f'({", ".join(RESERVED_DEVICES)})')
     return value
 
 
@@ -491,12 +823,16 @@ def create_session(device, mobile, viewports=1):
     owner = device_owner(device, old)
     if owner:             # who the device belongs to (W8 A2): the member record's, else the one recorded (device_owner)
         meta['owner'] = owner
-    # The look `lanes attach --ascii|--glyphs|--theme|--color` recorded (record_look) is the operator's choice, not
-    # session state: a recreation (ensure after a reboot, rebuild) keeps every valid one, or every sidebar of the
-    # device would flip back to the environment defaults within one tick of this rewrite.
+    # The look `lanes attach --ascii|--glyphs|--theme|--color|--notify|--dim|--editor` recorded (record_look) is the
+    # operator's choice, not session state: a recreation (ensure after a reboot, rebuild) keeps every valid one, or every
+    # sidebar of the device would flip back to the environment defaults within one tick of this rewrite — and the
+    # `device_only` list that marks the device's own (--device-only) keys with them.
     for key, allowed in LOOK_KEYS.values():
         if old.get(key) in allowed:
             meta[key] = old[key]
+    users = users_module()
+    if users and users.device_only(old):
+        meta = users.mark_device_only(meta, users.device_only(old))
     L.atomic_write(meta_file, json.dumps(meta) + '\n')
     command = ZELLIJ_BASE + ['--layout', str(layout_file), 'attach', '--create-background', device]
     if shutil.which('systemd-run'):
@@ -510,6 +846,15 @@ def create_session(device, mobile, viewports=1):
     if rc != 0:
         raise L.LanesError(f'Could not create session {device}: '
                            + ('no answer in 60 s' if rc is None else err.strip() or out.strip() or f'exit {rc}'))
+    # The session runs this release's layout now: nothing `lanes ensure --if-layout-changed` stamped is pending (W9 U6)
+    update_ready_path(device).unlink(missing_ok=True)
+
+
+def update_ready_path(device):
+    """clients/<device>.update-ready (DM-LANES-UPDATE-READY, W9 U6): written by `lanes ensure --if-layout-changed` when
+    this release lays out the running view `device` differently while a client is attached (or zellij did not say);
+    its sidebars offer `update ready · reload (r)` while it exists; create_session removes it."""
+    return L.STATE / 'clients' / f'{device}.update-ready'
 
 
 def device_owner(device, meta):
@@ -527,6 +872,15 @@ def device_owner(device, meta):
     return members.owner_for((device, meta.get('base')), meta.get('owner'))
 
 
+def users_module():
+    """libexec/users.py, or None when it cannot be loaded — for create_session, which must never raise (`lanes ensure`
+    recreates views through it every minute)."""
+    try:
+        return libexec_module('users')
+    except L.LanesError:
+        return None
+
+
 def base_device(device, default):
     """The machine a view belongs to: `mac-2` / `mac-w2`, opened by the client whose default device is `mac`, share
     mac's upload helper (one helper service per machine); every other device is its own base."""
@@ -567,12 +921,20 @@ def viewports_arg(args, default=1):
     return default
 
 
-LOOK_KEYS = {'--theme': ('theme', ('dark', 'light', 'auto')), '--color': ('color', ('truecolor', '16', 'none')),
-             '--glyphs': ('glyphs', ('unicode', 'ascii', 'emoji'))}
+# `256` since cockpit v3 P2 (LNS-70): the sidebar paints the xterm-256 set (tokens.XTERM256, indices 16-255). `notify`
+# and `dim` since P4 (LNS-72, DEF-1577): LANES_NOTIFY's and LANES_DIM's per-device path, in the variables' own words
+# (`dim` is the SGR of the 16-colour dim: 90 or the escape hatch 2).
+LOOK_KEYS = {'--theme': ('theme', ('dark', 'light', 'auto')), '--color': ('color', ('truecolor', '256', '16', 'none')),
+             '--glyphs': ('glyphs', ('unicode', 'ascii', 'emoji')), '--notify': ('notify', ('1', '0')),
+             '--dim': ('dim', ('90', '2')),
+             # The editor quick edit (`lanes edit`, W9 E2) hands lane-edit as LANES_EDITOR; `auto` takes the choice back.
+             # Per device, like notify/dim: never a profile key (users.LOOK), never read by a sidebar.
+             '--editor': ('editor', ('micro', 'hx', 'nvim', 'vim', 'auto'))}
 
 
 def look_args(args):
-    """The look `lanes attach` was asked for: {'glyphs'|'theme'|'color': value}, validated (spec §2.4)."""
+    """The look `lanes attach` was asked for: {'glyphs'|'theme'|'color'|'notify'|'dim'|'editor': value}, validated
+    (spec §2.4)."""
     look = {}
     if '--ascii' in args:
         look['glyphs'] = 'ascii'
@@ -586,20 +948,107 @@ def look_args(args):
 
 
 def record_look(device, args):
-    """`lanes attach DEVICE --ascii|--glyphs M|--theme T|--color C`: remembered in devices/<device>.json, the file every
-    sidebar of that device re-reads when it changes (its reload() stamp), so a RUNNING session follows within one tick.
-    Returns what was recorded: empty when nothing was asked — or when the device has no file yet, because `ensure`
-    builds a session for every devices/*.json and a look flag must never create that stub on its own."""
+    """`lanes attach DEVICE --ascii|--glyphs M|--theme T|--color C|--notify N|--dim D|--editor E [--device-only]`:
+    remembered where the device's sidebars read it (cockpit v3 R2, LNS-75).
+      * A device with an owner (profile_for) shares theme, color and glyphs with every device that person owns: they
+        are written to users/<login>.json (users.update, a 1 s lock) and leave devices/<device>.json — a key left
+        there would sit beneath the profile for this device. `--device-only` keeps them in the device file instead, for
+        this device alone, and names them in its `device_only` list (users.mark_device_only, DEF-1782): only a key that
+        list names wins over the profile there (sidebar.layered_look) and survives a fold (users.migrate). The same
+        flag without --device-only takes its key off the list again. A profile write that is dropped (its lock busy, or
+        a file this release does not write) records none of them anywhere — the device keeps what it had, its marks
+        included — and says so on stderr.
+      * notify and dim are per-device switches (P4), and so is editor (W9 E2: read by `lanes edit` at each Ctrl-Alt-e,
+        never by a sidebar): always the device file, never on the list. A device without an owner records every flag in
+        its file; a device that never used --device-only has no list, so its file is byte for byte what it was before
+        R2.
+    devices/<device>.json is the file every sidebar of the device re-reads when it changes (its reload() stamp), so a
+    RUNNING session follows a device-file change within one tick.
+    Returns what was recorded, in the flags' order: empty when nothing was asked — or when the device has no file yet,
+    because `ensure` builds a session for every devices/*.json and a look flag must never create that stub on its
+    own (nor, for an unknown device, a profile)."""
     look = look_args(args)
     meta_file = L.STATE / 'devices' / f'{device}.json'
     meta = L.read_json(meta_file) if meta_file.exists() else None
     if not look or not isinstance(meta, dict):
         return {}
-    if any(meta.get(key) != value for key, value in look.items()):
-        L.atomic_write(meta_file, json.dumps(dict(meta, **look)) + '\n')
+    alone = '--device-only' in args
+    login = None if alone else profile_for(device)
+    users = libexec_module('users')
+    shared = {}
+    if login:
+        shared = {key: value for key, value in look.items() if key in users.LOOK}
+        if shared and not users.update(login, device, lambda profile: profile['look'].update(shared)):
+            words = ', '.join(f'{key} {value}' for key, value in shared.items())
+            print(f"lanes: the look ({words}) was not saved: {login}'s profile was busy or cannot be written "
+                  f'(`lanes user show {login}` says why); nothing changed — attach again, or add --device-only to keep '
+                  f'it on {device} alone', file=sys.stderr)
+            look = {key: value for key, value in look.items() if key not in shared}
+            shared = {}
+    on_device = {key: value for key, value in look.items() if key not in shared}
+    updated = {key: value for key, value in meta.items() if key not in shared}
+    updated.update(on_device)
+    marked, asked = set(users.device_only(meta)), set(look) & set(users.LOOK)
+    marked = marked | asked if alone else marked - asked
+    if marked or 'device_only' in meta:
+        updated = users.mark_device_only(updated, marked)
+    if updated != meta:
+        L.atomic_write(meta_file, json.dumps(updated) + '\n')
     return look
 
 
+def profile_for(device):
+    """The login whose users/<login>.json profile `device` follows (cockpit v3 R2, LNS-75): its owner exactly as
+    device_owner derives it — the member record of the device or of the machine it is a window of whenever one exists,
+    else the owner devices/<device>.json records (`lanes device claim`) — through users.login_for. None for a device
+    nobody owns, or a name that is not a device: it keeps its look and seen marks to itself. Never raises."""
+    try:
+        return libexec_module('users').login_for(device)
+    except L.LanesError:
+        return None
+
+
+def device_profile(device):
+    """The profile `device` follows (users.read of profile_for's login), or None: a device nobody owns, no profile yet,
+    or a file this release does not read. What tab_specs arranges a view's workspace tabs by (cockpit v3 R4, LNS-77)
+    for create_session and `lanes upgrade-session`. Never raises: `lanes ensure` runs both every minute."""
+    login = profile_for(device)
+    users = users_module() if login else None
+    return users.read(login) if users else None
+
+
+def windows_of(devices):
+    """{window: its devices/<window>.json} for each view whose recorded `base` is one of `devices` (mac-2 and mac-w2
+    are mac's windows: base_device), the devices themselves excluded."""
+    found = {}
+    for meta_file in sorted((L.STATE / 'devices').glob('*.json')):
+        meta = L.read_json(meta_file)
+        if (isinstance(meta, dict) and meta.get('base') in devices and meta_file.stem not in devices
+                and L.IDENT.match(meta_file.stem) and len(meta_file.stem) <= 32):
+            found[meta_file.stem] = meta
+    return found
+
+
+def fold_profile(login, devices):
+    """Fold the views of `devices` and their windows that `login` owns now into `login`'s profile (users.migrate over
+    exactly those: look keys the profile lacks from the most recently attached, seen marks union-max, then their look
+    keys leave the device files) -> 0, or 1 when the profile write was dropped (said on stderr, with the claim that
+    finishes it; no device file was touched). Devices with no view and no seen marks have nothing to fold: 0, silent.
+    What `lanes device claim`, `lanes keys adopt --login` and `lanes keys owner` end with."""
+    users = libexec_module('users')
+    wanted = set(devices) | set(windows_of(set(devices)))
+    owned = [found['device'] for found in users.owned_devices(login) if found['device'] in wanted]
+    if not owned:
+        return 0
+    if users.migrate(login, devices=owned) is None:
+        print(f"⚠ {login}'s profile was not updated: its lock was busy, or its file under users/ is not one this "
+              f'release writes (`lanes user show {login}` says why); {", ".join(owned)} keep their own look until '
+              f'`lanes device claim {owned[0]} --login {login}` runs again', file=sys.stderr)
+        return 1
+    print(f'profile {login}: folded in {", ".join(owned)} — `lanes user show {login}`')
+    return 0
+
+
 def cmd_layout(args):
     print(layout_kdl(device_name(args[0]), '--mobile' in args, viewports_arg(args)), end='')
     return 0
@@ -607,7 +1056,7 @@ def cmd_layout(args):
 
 def cmd_attach(args):
     device = device_name(args[0])
-    look_args(args)          # a bad --theme/--color/--glyphs refuses here, before any session is created
+    look_args(args)          # a bad --theme/--color/--glyphs/--editor refuses here, before any session is created
     # Old muscle memory: `coder-launch worlds`. A workspace id is not a device: open the caller's normal
     # device session and bring that workspace's tab to the front.
     tab = None
@@ -632,15 +1081,22 @@ def cmd_attach(args):
         raise L.LanesError(f'{ZELLIJ} is not installed: run install/host-install.sh')
     if not (L.STATE / 'registry.json').exists():
         cmd_sync([])
-    try:
-        missing = device not in live_sessions()
-    except L.LanesError as error:
-        # Unknown is not missing: create nothing and just try to attach. If the session really is gone, zellij says
-        # so itself (nothing is resurrected: session_serialization is off) and lanes-launch retries.
-        print(f'lanes: {error}', file=sys.stderr)
+    with contextlib.ExitStack() as stack:
+        # Only a glance at the view-session lock (DEF-1792): a person is waiting. Not taken in time is unknown, not
+        # missing — the holder may be rebuilding this very view — so this creates nothing and just attaches.
+        refused = hold_sessions(stack, SESSIONS_GLANCE, f'lanes attach {device}')
         missing = False
-    if missing:
-        create_session(device, '--mobile' in args, viewports_arg(args))
+        if refused:
+            print(f'lanes: {refused}; attaching without creating {device}', file=sys.stderr)
+        else:
+            try:
+                missing = device not in live_sessions()
+            except L.LanesError as error:
+                # Unknown is not missing: create nothing and just try to attach. If the session really is gone, zellij
+                # says so itself (nothing is resurrected: session_serialization is off) and lanes-launch retries.
+                print(f'lanes: {error}', file=sys.stderr)
+        if missing:
+            create_session(device, '--mobile' in args, viewports_arg(args))
     # Record the base and bring the owner (W8 A2) in line, also for sessions that existed before either was known.
     record_base(device, args)
     record_look(device, args)
@@ -704,14 +1160,22 @@ ENV_HOOK = '[ -r "$HOME/.lz/env.sh" ] && . "$HOME/.lz/env.sh"  # lanes-env: temp
 
 def hook_env(home):
     """Make env.sh take effect for NEW shells: the disk temp dir it points at, and ONE marker-guarded line appended to
-    the login files bash/zsh really read. Append only, idempotent, never rewrites a dotfile; remove the line to undo."""
+    the login files bash/zsh really read. Append only, idempotent, never rewrites a dotfile; remove the line to undo.
+    A dotfile (or ~/.tmp) that is a symbolic link is left alone and named: this runs on the host, where a link the
+    container's home holds resolves outside the container (an absolute `/home/coder/dotfiles/.bashrc` is the HOST
+    account's file; DEF-1798)."""
     tmp = home / '.tmp'
-    if not tmp.exists():
+    if tmp.is_symlink():
+        print(f'! {tmp} is a symbolic link — left alone')
+    elif not tmp.exists():
         tmp.mkdir(mode=0o700)
         tmp.chmod(0o700)
-    login = home / '.bash_profile' if (home / '.bash_profile').exists() else home / '.profile'
-    targets = [login, home / '.bashrc'] + ([home / '.zshrc'] if (home / '.zshrc').exists() else [])
+    login = home / '.bash_profile' if os.path.lexists(home / '.bash_profile') else home / '.profile'
+    targets = [login, home / '.bashrc'] + ([home / '.zshrc'] if os.path.lexists(home / '.zshrc') else [])
     for path in targets:
+        if path.is_symlink():
+            print(f'! {path} is a symbolic link — not changed; add this line to the file it points at by hand: {ENV_HOOK}')
+            continue
         text = path.read_text(errors='replace') if path.exists() else ''
         if 'lanes-env' in text:
             continue
@@ -720,44 +1184,130 @@ def hook_env(home):
 
 
 INSTALL_CONTAINER_USAGE = 'usage: lanes install-container <name> [--no-mcp]'
+# lane_core.py first: `lane` imports it, so no moment has a new `lane` beside an old (or no) lane_core.py.
+CONTRACT_FILES = ('lane_core.py', 'lane-mcp', 'lane', 'lane-run', 'lane-signal', 'lane-edit')
+
+
+def lane_core():
+    """container/lane_core.py, the in-container contract's shared helpers, as a module: the agents' MCP entries are
+    written from the host through the same code `lane mcp install` runs in the container."""
+    module = sys.modules.get('lane_core')
+    if module is None:
+        import importlib.util
+        spec = importlib.util.spec_from_file_location('lane_core', str(L.REPO / 'container' / 'lane_core.py'))
+        module = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(module)
+        sys.modules['lane_core'] = module
+    return module
+
+
+def container_dir(home, *parts):
+    """<home>/<parts…> as a real directory, created when missing; LanesError when it, or a component of it below the
+    container home, is a symbolic link. The container owns its home and this runs on the HOST: a link planted there
+    resolves outside the container (DEF-1798, the DEF-1796 class)."""
+    path = Path(home).joinpath(*parts)
+    core = lane_core()
+    try:
+        core.no_links(home, path)
+        path.mkdir(parents=True, exist_ok=True)
+        core.no_links(home, path)
+    except core.LaneError as error:
+        raise L.LanesError(f'{error}: nothing installed through it — remove the link in the container, then run again')
+    return path
+
+
+def install_file(source, target):
+    """Copy `source` (its bytes and mode) to `target` without following anything at the target: an O_EXCL temp file
+    beside it, renamed over whatever the name holds — a planted symbolic link is replaced, never written through
+    (DEF-1798), and a `lane open` starting mid-install runs the old file or the new one, never a half-written one.
+    The directory must be a real one (container_dir)."""
+    fd, tmp = tempfile.mkstemp(prefix=f'.{target.name}.', dir=str(target.parent))
+    try:
+        with os.fdopen(fd, 'wb') as handle, open(source, 'rb') as data:
+            shutil.copyfileobj(data, handle)
+        shutil.copystat(source, tmp)
+        os.replace(tmp, target)
+    except BaseException:
+        try:
+            os.unlink(tmp)
+        except OSError:
+            pass
+        raise
+
+
+def install_mcp_entries(home):
+    """`mcpServers.lanes` in <home>/.claude.json and `[mcp_servers.lanes]` in <home>/.codex/config.toml, both starting
+    /home/coder/.lz/bin/lane-mcp, the Codex table also passing it LANE_ID, LANE_WS, TMUX and TMUX_PANE in `env_vars`
+    (Codex clears an MCP server's environment) (lane_core.mcp_apply: written only where missing, `.bak-<UTC>` first,
+    atomic, the file's own mode) -> exit code. Refused on a uid split (the agent could not read a file this account
+    creates: DEF-1727's rule); a file left alone (not valid JSON/TOML, a `lanes` entry that starts something else)
+    is said and makes the exit 1, while the other agent still gets its entry."""
+    split = uid_split(home)
+    if split:
+        print(f'! MCP entries not written: {split} — the agent could not read what this account would write; run '
+              f'`lanes install-container` from a host account with uid {L.CONTAINER_UID}, or `~/.lz/bin/lane mcp '
+              f'install --write` inside the container')
+        return 1
+    code = 0
+    for result in lane_core().mcp_apply(home):
+        if result['status'] == 'refused':
+            print(f"! {result['path']}: {result['why']}")
+            code = 1
+            continue
+        if result['backup']:
+            print(f"backup {result['backup']}")
+        print(f"MCP ({result['agent']}): " + (f"wrote {result['path']}" if result['status'] == 'added'
+                                               else f"{result['path']} already starts lane-mcp"))
+    return code
 
 
 def cmd_install_container(args):
     names = [word for word in args if word != '--no-mcp']
     if len(names) != 1 or names[0].startswith('-'):
         raise L.LanesError(INSTALL_CONTAINER_USAGE)
-    # --no-mcp leaves out lane-mcp, the in-container MCP server of plan W6. This checkout ships none, so there is
-    # nothing to leave out yet: the flag is accepted so that `lanes onboard --no-mcp` keeps its meaning when it ships.
+    no_mcp = '--no-mcp' in args   # leaves out lane-mcp and the agents' MCP entries; removes nothing already there
     container = names[0]
     info = L.container_info(container)
     if not info.get('home'):
         raise L.LanesError(f'{container}: home volume not found')
-    root = Path(info['home']) / '.lz'
-    for sub in ('bin', 's', 'meta', 'state'):
-        (root / sub).mkdir(parents=True, exist_ok=True)
-    for source in (L.REPO / 'container/lane', L.REPO / 'container/lane-run', L.REPO / 'container/lane-signal'):
-        shutil.copy2(source, root / 'bin' / source.name)
+    home = Path(info['home'])
+    root = home / '.lz'
+    # Every directory is a real one and every file lands by rename (DEF-1798): nothing is written through a link.
+    for sub in ('bin', 's', 'meta', 'state', 'hooks'):
+        container_dir(home, '.lz', sub)
+    for name in CONTRACT_FILES:
+        if not (no_mcp and name == 'lane-mcp'):
+            install_file(L.REPO / 'container' / name, root / 'bin' / name)
+    install_file(L.REPO / 'VERSION', root / 'VERSION')   # what lane-mcp reports as its version
+    # lane-edit (a CONTRACT_FILES member) is what `lanes edit` (Ctrl-Alt-e) execs in the container; vim and nvim start
+    # there with -u ~/.lz/vimrc (W9 E3). Both are ours and replaced on every install, by rename like the rest, whatever
+    # --no-mcp says. ~/.lz/tmp/, where that vim keeps its swap files, is created by lane-edit as the container's own
+    # user (0700), never here.
+    install_file(L.REPO / 'container/vimrc', root / 'vimrc')
     # The hook DEFINITIONS travel with the contract for reference; no hook is installed here — that is the opt-in,
     # per-container `lanes hooks install --agent claude|codex --container <name> --write` (RUNBOOK).
-    (root / 'hooks').mkdir(exist_ok=True)
     for source in sorted((L.REPO / 'container/hooks').glob('*.json')):
-        shutil.copy2(source, root / 'hooks' / source.name)
+        install_file(source, root / 'hooks' / source.name)
     env_file = L.REPO / 'container/env.sh'   # TMPDIR off the RAM-backed /tmp; only NEW shells and agents read it
     if env_file.exists():
-        shutil.copy2(env_file, root / 'env.sh')
-        hook_env(Path(info['home']))
+        install_file(env_file, root / 'env.sh')
+        hook_env(home)
     for binary in sorted((L.SHARE / 'bin').glob('zmx-*')):
         target = root / 'bin' / binary.name
-        if not target.exists():  # a running lane's daemon keeps executing its own version: never overwrite
-            shutil.copy2(binary, target)
+        if not os.path.lexists(target):  # a running lane's daemon keeps executing its own version: never overwrite
+            install_file(binary, target)
     link = Path.home() / '.lz' / container
     link.parent.mkdir(parents=True, exist_ok=True)
     if link.is_symlink() or link.exists():
         link.unlink()
     link.symlink_to(root)
-    print(f'installed {root}/bin/{{lane,lane-run,lane-signal,zmx-*}}, {root}/hooks/'
-          + (f' and {root}/env.sh' if env_file.exists() else '') + f'; host link {link} -> {root}')
-    return 0
+    print(f"installed {root}/bin/{{lane,lane_core.py,lane-run,lane-signal,lane-edit{'' if no_mcp else ',lane-mcp'},zmx-*}}, "
+          f'{root}/VERSION, {root}/vimrc, {root}/hooks/' + (f' and {root}/env.sh' if env_file.exists() else '')
+          + f'; host link {link} -> {root}')
+    if no_mcp:
+        print('--no-mcp: lane-mcp and the agents\' MCP entries left out (anything an earlier install wrote is kept)')
+        return 0
+    return install_mcp_entries(home)
 
 
 HOOK_TARGETS = {'claude': ('claude-settings.json', '.claude/settings.json'),
@@ -914,20 +1464,31 @@ def cmd_hooks(args):
 
 def cmd_rebuild(args):
     device = device_name(args[0])
-    meta = L.read_json(L.STATE / 'devices' / f'{device}.json') or {}
-    if device in live_sessions():
-        # Attached clients see an ordinary exit (0) when their session is killed: leave a stamp so that
-        # lanes-launch (`lanes rebuilt <device>`) reconnects instead of closing the window.
-        L.atomic_write(L.STATE / 'clients' / f'{device}.rebuilt', f'{time.time()}\n')
-        if zellij(['kill-session', device], 30)[0] is None:
-            raise L.LanesError(f'zellij did not answer in 30 s: {device} was NOT rebuilt (no lane was touched)')
-        zellij(['delete-session', '--force', device], 30)
-    create_session(device, bool(meta.get('mobile')) or '--mobile' in args, viewports_arg(args, int(meta.get('viewports') or 1)))
+    with contextlib.ExitStack() as stack:
+        # From the list to the create, under the view-session lock (DEF-1792): between this kill and this create no
+        # `lanes ensure` may find the device missing and create it as well. Re-entered when `ensure` rebuilds.
+        refused = hold_sessions(stack, SESSIONS_WAIT, f'lanes rebuild {device}')
+        if refused:
+            raise L.LanesError(f'{refused}: {device} was NOT rebuilt (no lane was touched); run `lanes rebuild {device}` '
+                               'again')
+        meta = L.read_json(L.STATE / 'devices' / f'{device}.json') or {}
+        if device in live_sessions():
+            # Attached clients see an ordinary exit (0) when their session is killed: leave a stamp so that
+            # lanes-launch (`lanes rebuilt <device>`) reconnects instead of closing the window.
+            L.atomic_write(L.STATE / 'clients' / f'{device}.rebuilt', f'{time.time()}\n')
+            if zellij(['kill-session', device], 30)[0] is None:
+                raise L.LanesError(f'zellij did not answer in 30 s: {device} was NOT rebuilt (no lane was touched)')
+            zellij(['delete-session', '--force', device], 30)
+        create_session(device, bool(meta.get('mobile')) or '--mobile' in args,
+                       viewports_arg(args, int(meta.get('viewports') or 1)))
     print(f'rebuilt view session {device}; no lane was touched')
     return 0
 
 
 def cmd_upgrade_session(args):
+    """Bring each running view session (the named devices, else every device) in line with the catalog and with its
+    owner's profile (device_sync.reconcile): add missing tabs, rename titles, order them, and close the tab of a
+    workspace the profile hides (cockpit v3 R4, LNS-77) — only a tab whose panes identify that workspace."""
     import device_sync
     registry = L.load_registry()
     live = live_sessions()
@@ -939,7 +1500,10 @@ def cmd_upgrade_session(args):
         meta = L.read_json(L.STATE / 'devices' / (device + '.json')) or {}
         mobile, viewports = bool(meta.get('mobile')), int(meta.get('viewports') or 1)
         try:
-            for change in device_sync.reconcile(device, registry, tab_specs(device, registry, mobile, viewports), mobile, zellij):
+            specs = tab_specs(device, registry, mobile, viewports, device_profile(device))
+            shown = {spec['key'].split('/')[1] for spec in specs if spec['key'].startswith('workspace/')}
+            hidden = [workspace['id'] for workspace in registry['workspaces'] if workspace['id'] not in shown]
+            for change in device_sync.reconcile(device, registry, specs, mobile, zellij, hidden=hidden):
                 print(f'{device}: {change}')
         except (L.LanesError, ValueError, KeyError) as error:
             failures.append(str(error))
@@ -962,26 +1526,198 @@ def cmd_reattach(_args):
     return 0
 
 
-def cmd_ensure(_args):
+def catches_signal(pid, signum):
+    """Whether process `pid` belongs to this account and has a handler installed for `signum` (the SigCgt mask of
+    /proc/<pid>/status). A signal a process neither catches nor ignores takes its default action, which for SIGUSR2 is
+    to end it: reload-views signals only a view.sh whose `trap … USR2` is in place."""
+    try:
+        fields = dict(line.split(':', 1) for line in (PROC / str(pid) / 'status').read_text().splitlines()
+                      if ':' in line)
+        uid, mask = int(fields['Uid'].split()[0]), int(fields['SigCgt'].strip(), 16)
+    except (OSError, KeyError, ValueError, IndexError):
+        return False
+    return uid == os.getuid() and bool(mask >> (signum - 1) & 1)
+
+
+# The first release whose view.sh traps SIGUSR2 (cockpit v3 U5, shipped in 1.2.0 — plan D3). A view.sh of an older
+# release has no such trap: the signal's default action ENDS it (RUNBOOK, U5), and with it the viewport.
+VIEW_RELOAD_SINCE = (1, 2, 0)
+
+
+def view_tree(pid, words):
+    """The lanes tree the viewport process `pid` runs (`words`: its command line). First the tree of the view.sh file
+    its shell holds open (/proc/<pid>/fd/*: dash and bash keep the script open while it runs, and the kernel names the
+    file it RESOLVED at start, so a `…/current/libexec/view.sh` start names the tree `current` pointed at then, not the
+    one an update has flipped it to since); else, with no readable fd, the resolved tree of the view.sh path in its
+    command line. None when neither is a lanes tree file."""
+    suffix = '/libexec/view.sh'
+    try:
+        fds = sorted((PROC / str(pid) / 'fd').iterdir())
+    except OSError:
+        fds = []
+    for fd in fds:
+        try:
+            target = os.readlink(fd)
+        except OSError:
+            continue
+        if target.startswith('/') and target.endswith(suffix):   # a pruned tree reads `… (deleted)`: no match
+            return Path(target[:-len(suffix)])
+    at = L.tree_file_at(words, 'libexec/view.sh')
+    return Path(os.path.realpath(words[at])).parent.parent if at is not None else None
+
+
+def view_reloads(tree):
+    """Whether a view.sh of `tree` handles SIGUSR2: its release (`<tree>/VERSION`, lanes_lib.tree_version, compared as
+    major.minor.patch by version_key) is VIEW_RELOAD_SINCE or later. No tree, no VERSION or one that is no release
+    ('dev') is never assumed to: the signal would end a view that does not."""
+    key = version_key(L.tree_version(tree) or '') if tree is not None else None
+    return key is not None and key >= VIEW_RELOAD_SINCE
+
+
+def cmd_reload_views(args):
+    """SIGUSR2 to every running viewport (`views/<device>/<ws>.<slot>.pid`) whose process is a view.sh of a lanes tree
+    (`L.tree_file_at`) that handles it: such a view.sh starts again from the tree `current` names once its lane client
+    next exits (W9 U5), never dropping an attached client. One that does not handle it — a view.sh of a release before
+    that — would be ENDED by the signal (SIGUSR2's default action), so it is left alone and counted: it keeps its
+    release until `lanes rebuild <device>`. Two checks, both required: the release of the tree the process runs
+    (view_tree: the script file it holds open, else its command line's) is VIEW_RELOAD_SINCE or later (view_reloads),
+    and the process has a SIGUSR2 handler installed now (catches_signal: the trap has run). Sidebars swap by themselves
+    (W9 U5). A stale pid file, a recycled pid or another account's process is skipped. Exit 0; 2 for any argument."""
+    if args:
+        print('usage: lanes reload-views')
+        return 2
+    asked, older = 0, {}
+    for pid_file in sorted((L.STATE / 'views').glob('*/*.pid')):
+        try:
+            pid = int(pid_file.read_text().strip())
+            words = [word.decode(errors='replace') for word in (PROC / str(pid) / 'cmdline').read_bytes().split(b'\0')]
+        except (OSError, ValueError):
+            continue
+        if pid <= 1 or L.tree_file_at(words, 'libexec/view.sh') is None:
+            continue
+        if not view_reloads(view_tree(pid, words)) or not catches_signal(pid, signal.SIGUSR2):
+            older.setdefault(pid_file.parent.name, []).append(pid)
+            continue
+        try:
+            os.kill(pid, signal.SIGUSR2)
+        except OSError:
+            continue
+        asked += 1
+    print(f"reload-views: asked {asked} view{'' if asked == 1 else 's'} to restart on the installed release "
+          '(each at its next lane switch or reconnect)')
+    if older:
+        count = sum(len(pids) for pids in older.values())
+        print(f"reload-views: {count} view{'' if count == 1 else 's'} of {', '.join(sorted(older))} "
+              f"{'runs' if count == 1 else 'run'} a view.sh that cannot reload in place (an older release): "
+              "`lanes rebuild <device>` moves "
+              f"{'it' if count == 1 else 'them'}")
+    return 0
+
+
+ENSURE_USAGE = 'usage: lanes ensure [--if-layout-changed]'
+
+
+def view_clients(device):
+    """How many clients are attached to the view session `device`: the rows `zellij action list-clients` prints under
+    its header (`CLIENT_ID ZELLIJ_PANE_ID RUNNING_COMMAND` on 0.45.1; a row starts with the client id — the sidebar's
+    poll_mobile_view reads it the same way). None when zellij did not answer (no answer in 10 s, an error, a session
+    gone since the list): an unknown list is never an empty one."""
+    rc, out, _err = zellij(['-s', device, 'action', 'list-clients'], 10)
+    if rc != 0:
+        return None
+    return sum(1 for line in out.splitlines() if re.match(r'^\s*\d+\s', line))
+
+
+def refresh_view(device, meta):
+    """`lanes ensure --if-layout-changed` for the running view `device` (W9 U6, LNS-94): nothing while its layout file
+    is what this release generates (a stamp left from before — a rollback — is dropped); otherwise rebuilt when zellij
+    answers that no client is attached (cmd_rebuild, which writes the reconnect stamp and the new layout, and drops the
+    stamp through create_session), else stamped once (update_ready_path; never rewritten, so its time is when the
+    change was first found attached). Raises LanesError when the rebuild failed."""
+    stamp = update_ready_path(device)
+    try:
+        stored = (L.STATE / 'layouts' / f'{device}.kdl').read_text()
+    except (OSError, UnicodeDecodeError):
+        stored = None
+    if not layout_changed(stored, layout_kdl(device, bool(meta.get('mobile')), int(meta.get('viewports') or 1))):
+        if stamp.exists():
+            stamp.unlink(missing_ok=True)
+            print(f'{device}: its layout is current again; dropped {stamp.name}')
+        return
+    clients = view_clients(device)
+    if clients == 0:
+        print(f'{device}: its layout changed and no client is attached: rebuilding it')
+        cmd_rebuild([device])
+        return
+    if not stamp.exists():
+        L.atomic_write(stamp, f'{time.time()}\n')
+    attached = 'zellij did not say which clients are attached' if clients is None else (
+        f"{clients} client{'' if clients == 1 else 's'} attached")
+    print(f'{device}: its layout changed; {attached}: left running, its sidebars offer `update ready · reload (r)` '
+          f'({stamp.name})')
+
+
+def cmd_ensure(args):
+    if any(arg != '--if-layout-changed' for arg in args):
+        print(ENSURE_USAGE)
+        return 2
+    every = '--if-layout-changed' in args
+    with contextlib.ExitStack() as stack:
+        # One pass under the view-session lock (DEF-1792), from the list to the last tab sync: no other ensure, rebuild
+        # or create acts on a session between what this run listed and what it does. The update's run waits for one
+        # that holds it; the minute timer's only glances, and skips its tick — the holder is acting on the views now.
+        refused = hold_sessions(stack, SESSIONS_WAIT if every else SESSIONS_GLANCE,
+                                'lanes ensure --if-layout-changed' if every else 'lanes ensure')
+        if isinstance(refused, L.SessionsBusy) and not every:
+            print(f'ensure: skipped: {refused}; nothing was recreated (lanes-ensure.timer runs again in a minute)')
+            return 0
+        if refused:
+            raise L.LanesError(f'{refused}: no view was recreated, compared or rebuilt')
+        return ensure_views(every)
+
+
+def ensure_views(every):
+    """cmd_ensure's pass, under the view-session lock: recreate each device with no live session, compare the running
+    ones (every one with `every`, else only a device the update stamped), then sync the tabs of every live view."""
     # live_sessions() raises when zellij did not answer: then this run ends here and recreates nothing (the timer
     # tries again in a minute). "Missing" is only ever concluded from a list zellij actually gave.
     live = live_sessions()
+    failures = []
     for meta_file in sorted((L.STATE / 'devices').glob('*.json')):
         device = meta_file.stem
+        meta = L.read_json(meta_file) or {}
+        meta = meta if isinstance(meta, dict) else {}
         if device not in live:
-            meta = L.read_json(meta_file) or {}
             create_session(device, bool(meta.get('mobile')), int(meta.get('viewports') or 1))
             print(f'recreated view session {device}')
-    return cmd_upgrade_session([])
+        elif every or update_ready_path(device).exists():
+            # The update asks for every view; the minute timer only finishes what an update left (W9 U6). Before the
+            # tab sync, so a rebuilt view is reconciled like any other; one device's failure never stops the next.
+            try:
+                refresh_view(device, meta)
+            except L.LanesError as error:
+                failures.append(f'{device}: {error}')
+    if not failures:
+        return cmd_upgrade_session([])
+    try:
+        cmd_upgrade_session([])
+    except L.LanesError as error:
+        failures.append(str(error))
+    raise L.LanesError('; '.join(failures))
 
 
-def prepare_view(device, mobile, viewports=1, explicit=False):
+def prepare_view(device, mobile, viewports=1, explicit=False, doing='lanes prepare'):
     """Create the device's view session unless it runs -> 'created' | 'reused'. A running view is never rebuilt:
     a mobile request refuses a desktop view, and an EXPLICIT desktop request (`--desktop`, `lanes web`) refuses a
-    mobile one. Without a flag, `prepare` keeps reusing whatever layout runs."""
-    if device not in live_sessions():
-        create_session(device, mobile, viewports)
-        return 'created'
+    mobile one. Without a flag, `prepare` keeps reusing whatever layout runs. Under the view-session lock (DEF-1792),
+    waited for like `lanes rebuild` waits; `doing` names the command to a process that waits for it."""
+    with contextlib.ExitStack() as stack:
+        refused = hold_sessions(stack, SESSIONS_WAIT, f'{doing} {device}')
+        if refused:
+            raise L.LanesError(f'{refused}: {device} was not prepared; try again shortly')
+        if device not in live_sessions():
+            create_session(device, mobile, viewports)
+            return 'created'
     running_mobile = bool((L.read_json(L.STATE / 'devices' / f'{device}.json') or {}).get('mobile'))
     if mobile and not running_mobile:
         raise L.LanesError(f'{device} already has a desktop layout; choose another device name')
@@ -1232,7 +1968,7 @@ def cmd_web(args):
     prepare = ['lanes', 'prepare', device, flag] + (['--viewports', str(viewports)] if viewports != 1 else [])
     state = 'planned'
     if not print_only:
-        state = prepare_view(device, mobile, viewports, explicit=explicit)
+        state = prepare_view(device, mobile, viewports, explicit=explicit, doing='lanes web')
         record_base(device, args)
         rc, out, err = L.run_bounded(['sh', str(L.REPO / 'install/enable-web.sh'), device, flag], 180)
         if rc != 0:
@@ -1414,8 +2150,12 @@ class UploadReader:
 
 
 def cmd_upload(args):
+    """`lanes upload <workspace> | --active <device> [--device D] [--paste] [--request R]`: a tar stream on stdin into
+    the workspace's `uploads/` AND the docs store (W10 W5, libexec/uploads.py receive_tar): each file lands as it always
+    did — same folder, `-1` collision suffix, `.git/info/exclude` line — and gets a sha256 receipt, `source` ssh, for
+    the login that owns the asking device (users.login_for; none: a docs.log `no-owner` line), under the lane its view
+    shows (uploads.upload_lane). stdout and `<request>.done` stay the landed in-container paths, one per line."""
     import shlex
-    import tarfile
     registry = L.load_registry()
     device = args[args.index('--active') + 1] if '--active' in args else None
     paste_device = args[args.index('--device') + 1] if '--device' in args else device
@@ -1436,34 +2176,20 @@ def cmd_upload(args):
             raise L.LanesError(f'unknown board: {names[0]} (see `lanes workspaces`)')
     else:
         raise L.LanesError('usage: lanes upload <workspace> | --active <device>  [--paste]   (tar stream on stdin)')
-    folder = next((lane.get('folder') for lane in workspace['lanes'] if lane.get('folder')), None) or workspace['cwd']
-    info = registry['containers'].get(workspace['container']) or {}
-    root = L.host_path(info, folder)
-    uploads = root / 'uploads'
-    uploads.mkdir(exist_ok=True)
-    # Keep uploads out of commits without touching a tracked .gitignore: the repository-local exclude file.
-    exclude = root / '.git' / 'info' / 'exclude'
-    # check-ignore: 0 = ignored, 1 = not ignored; an error or no answer (None) is not a reason to append.
-    if (root / '.git').is_dir() and L.run_bounded(['git', '-C', str(root), 'check-ignore', '-q', 'uploads/x'], 10)[0] == 1:
-        exclude.parent.mkdir(exist_ok=True)
-        with open(exclude, 'a') as handle:
-            handle.write('\n# lanes upload: local intake folder, never committed\nuploads/\n')
-    staging = uploads / f'.incoming-{os.getpid()}'
-    staging.mkdir()
-    landed = []
+    uploads_lib, users = libexec_module('uploads'), libexec_module('users')
+    folder, home, parts = uploads_lib.landing(registry, workspace)
+    # The view that asked (a suffixed view's sidecar, else the device named): whose upload it is, and whose lane.
+    view_device = paste_target(spool, request, paste_device) if spool else paste_device
+    login = users.login_for(view_device) if view_device else None
+    lane = uploads_lib.upload_lane(workspace, view_device)
+    uploads = uploads_lib.open_uploads(home, parts)
     try:
         stream = UploadReader(sys.stdin.buffer, spool / f'{request}.progress' if spool else None)
-        with tarfile.open(fileobj=stream, mode='r|') as archive:
-            archive.extractall(staging, filter='data')  # regular files/dirs only, no absolute paths, no links out
-        for entry in sorted(staging.iterdir()):
-            final, n = uploads / entry.name, 1
-            while final.exists():  # never overwrite an earlier upload
-                final = uploads / f'{entry.stem}-{n}{entry.suffix}'
-                n += 1
-            entry.rename(final)
-            landed.append(f"{folder}/uploads/{final.name}")
+        landed = [f'{folder}/uploads/{name}' for name in uploads_lib.receive_tar(
+            stream, uploads, login=login, ws=workspace['id'], lane=lane,
+            say=lambda line: print(line, file=sys.stderr, flush=True))]
     finally:
-        shutil.rmtree(staging, ignore_errors=True)
+        os.close(uploads)
     if not landed:
         # The helper reports the client-side cause (eg. macOS denied Downloads). Publishing a generic .err here
         # races that report: the sidebar consumes it and loses the useful error before the helper can send it.
@@ -1472,7 +2198,6 @@ def cmd_upload(args):
         print(path)
     if '--paste' in args and paste_device:
         # The result files (.done / .err) stay in the base spool, where the asking sidebar looks for them.
-        view_device = paste_target(spool, request, paste_device) if spool else paste_device
         shown = type_into_lane(registry, device_name(view_device), workspace, ' '.join(shlex.quote(p) for p in landed) + ' ')
         print(f'# typed into lane: {shown}' if shown else '# could not type into the lane (not a tmux lane?)', file=sys.stderr)
     if spool:
@@ -1480,6 +2205,32 @@ def cmd_upload(args):
     return 0
 
 
+DOCS_USAGE = 'usage: lanes docs push <id>'
+# What a publication target needs and does not have yet: the data service's token-authenticated publication surface
+# (plan W10 "Operator gates" 3 — decided once that surface is stable). Until then `lanes docs push` is the hook only.
+DOCS_PUSH_UNCONFIGURED = ('lanes docs push: not configured — no publication target exists yet (the data service\'s '
+                          'publication surface is not built; plan W10, operator gate 3): nothing was sent')
+
+
+def cmd_docs(args):
+    """`lanes docs push <id>` (docs cockpit W10 W9, LNS-110): the hook for the data service's publication surface — a
+    STUB, not built. It looks the document up in every login's docs store (docs_store.operator_receipt: the operator is
+    the account the store belongs to, so no login's visibility applies), prints its receipt.json on stdout
+    (DM-LANES-DOCS-RECEIPT, as stored: indent 2), says `not configured` on stderr and returns 2. Nothing is sent,
+    written or logged. No such document, an id that is not one (docs_store.ID_RE) or any other argument: LanesError,
+    exit 1."""
+    if len(args) != 2 or args[0] != 'push':
+        raise L.LanesError(DOCS_USAGE)
+    D = libexec_module('docs_store')
+    found = D.operator_receipt(args[1])
+    if found is None:
+        raise L.LanesError(f'docs push: no document {args[1]} in the docs store ({D.root()})')
+    _meta, receipt = found
+    print(json.dumps(receipt, indent=2, ensure_ascii=False))
+    print(DOCS_PUSH_UNCONFIGURED, file=sys.stderr)
+    return 2
+
+
 def resolve_device(name, args):
     """`coder-launch worlds` style: a board id given where a device is expected means "my default device"."""
     try:
@@ -1544,18 +2295,22 @@ def cmd_upload_result(args):
 
 
 WORKSPACES_USAGE = ('usage: lanes workspaces   |   lanes workspaces add <id> --container <name> --repo <path> '
-                    '[--title T] [--session S] [--write]')
+                    '[--title T] [--session S] [--write]   |   lanes workspaces hide|show|order <id…> '
+                    '[--device D | --login L]')
 
 
 def cmd_workspaces(args):
     """`lanes workspaces` prints the board ids (the client installer reads them); `lanes workspaces add` appends a
     board to the site catalog and writes its manifest (libexec/site_edit.py). Dry run (the printed diff) unless
     --write; an id already in the catalog is verified and never rewritten (exit 1 when it disagrees); a repository
-    another board already declares is refused (LanesError, before any write)."""
+    another board already declares is refused (LanesError, before any write). `hide|show|order` arrange the boards in
+    a person's profile (cmd_workspaces_profile, cockpit v3 R6)."""
     if not args:
         for workspace in L.load_registry()['workspaces']:
             print(workspace['id'])
         return 0
+    if args[0] in ARRANGE_WORKSPACES:
+        return cmd_workspaces_profile(args)
     if args[0] != 'add' or len(args) < 2 or args[1].startswith('-'):
         raise L.LanesError(WORKSPACES_USAGE)
     opts, rest = {}, list(args[2:])
@@ -1819,18 +2574,44 @@ def cmd_onboard(args):
             print(f'backup {backup}')
         return ('changed' if write else 'planned'), f"{board} in {result['catalog']}"
 
+    mcp_before = {}
+
+    def mcp_files():
+        return [home() / lane_core().MCP_FILES[agent] for agent in lane_core().MCP_AGENTS]
+
     def contract_step():
         root = home() / '.lz'
         if not write:
             print(f'would install the lane contract into {root} and link {Path.home() / ".lz" / container}')
             return 'planned', str(root)
+        for path in mcp_files():   # what the lane-mcp step compares against: install-container writes the entries
+            mcp_before[path] = lane_core().read_regular(path, lane_core().EDIT_MAX)   # never a link or a FIFO
         cmd_install_container([container] + (['--no-mcp'] if no_mcp else []))
         return 'ok', str(root)
 
     def mcp_step():
+        """install-container (the contract step) wrote the agents' MCP entries; this step plans them again and says
+        what that changed. A dry run prints the diffs install-container would apply."""
         if no_mcp:
             return 'skipped', '--no-mcp: left out'
-        return 'skipped', 'lane-mcp is not shipped yet (plan W6): install-container has nothing to add'
+        plan = lane_core().mcp_plan(home())
+        files = ', '.join(str(item['path']) for item in plan)
+        refused = '; '.join(f"{item['path']}: {item['why']}" for item in plan if item['why'])
+        pending = [str(item['path']) for item in plan if not item['why'] and item['after'] != item['before']]
+        if not write:
+            for item in plan:
+                if item['why']:
+                    print(f"! {item['path']}: {item['why']}")
+                elif item['after'] == item['before']:
+                    print(f"{item['path']}: the lanes MCP server is already there")
+                else:
+                    sys.stdout.write(lane_core().mcp_diff(item))
+            return ('warn', refused) if refused else (('planned', files) if pending else ('unchanged', files))
+        if refused or pending:
+            return 'warn', refused or f"not written: {', '.join(pending)}"
+        changed = [str(path) for path in mcp_files()
+                   if lane_core().read_regular(path, lane_core().EDIT_MAX) != mcp_before.get(path)]
+        return ('changed', ', '.join(changed)) if changed else ('unchanged', files)
 
     def hooks_step(agent):
         def step():
@@ -1851,7 +2632,7 @@ def cmd_onboard(args):
             return 'planned', 'lanes sync'
         if cmd_sync([]) == 0:
             return 'ok', 'registry published'
-        return 'warn', 'a board has registry errors (listed above)'
+        return 'warn', 'a board has registry errors or a container refused its projection (listed above)'
 
     cursor = {}
 
@@ -1933,10 +2714,10 @@ def cmd_rebuilt(args):
     return 0 if time.time() - stamp < 60 else 1
 
 
-def server_version():
-    """This server's release (lanes/VERSION), as `lanes hello` reports it; 'dev' without the file."""
-    path = L.REPO / 'VERSION'
-    return path.read_text().strip() if path.exists() else 'dev'
+def server_version(repo=None):
+    """A tree's release (default this server's, L.REPO/VERSION), as `lanes hello` and `lanes version` report it; 'dev'
+    when the file is absent, empty or unreadable."""
+    return L.tree_version(repo if repo is not None else L.REPO) or 'dev'
 
 
 VERSION_RE = re.compile(r'(\d+)\.(\d+)\.(\d+)(?:[-+][A-Za-z0-9.]+)?')
@@ -1949,6 +2730,23 @@ def version_key(text):
     return tuple(int(part) for part in match.groups()) if match else None
 
 
+def client_older(client, server):
+    """Whether the release `client` names is older than `server`: both parse (version_key) and the client's
+    major.minor.patch is the lower, compared as numbers (1.9.3 is older than 1.10.0; 1.1.0-rc.1 is not older than
+    1.1.0). `dev`, a missing value or client text that is no version is never older. The one comparison behind both
+    server answers to an older client: `lanes attach`'s notice (client_notice) and `lanes hello`'s update= (W9 K1)."""
+    client_key, server_key = version_key(client), version_key(server)
+    return client_key is not None and server_key is not None and client_key < server_key
+
+
+def client_min(server):
+    """The release a lanes-launch must be at for this server not to tell it to update: the server's major.minor.patch
+    (client_notice compares exactly that — a client below it gets the notice, one at it none); None for a server
+    whose version is no release ('dev'), which tells no client to update."""
+    key = version_key(server)
+    return '.'.join(str(part) for part in key) if key else None
+
+
 # The newest published release whose lanes-launch passes `--client` but no `--client-version` (@vibelord/lanes 1.0.4).
 # A client without the flag is this release or an earlier one, so it is older only than a server past it. A fixed fact
 # about what was published: bumping lanes/VERSION never moves it.
@@ -1966,21 +2764,205 @@ def client_notice(args):
         return None
     if '--client-version' in args:
         client = args[args.index('--client-version') + 1] if '--client-version' in args[:-1] else ''
-        older = version_key(client) is not None and version_key(client) < version_key(server)
-        return f'lanes client {client} is older than the server ({server}) — run lanes-launch update' if older else None
+        return (f'lanes client {client} is older than the server ({server}) — run lanes-launch update'
+                if client_older(client, server) else None)
     if '--client' in args and version_key(server) > LAST_FLAGLESS_CLIENT:
         return f'lanes client is older than the server ({server}) — update it: npx @vibelord/lanes@latest'
     return None
 
 
 def cmd_hello(args):
-    device = resolve_device(args[0], args) if args else '-'
+    """`lanes hello [device] [--client-version V]`: one line, exit 0 — `ok device=<device> version=<server>
+    boards=<n>`, what the client installer reads to prove the SSH path, the key and the server's release. With
+    `--client-version V` older than this server (client_older: major.minor.patch as numbers) the line ends
+    ` update=<server>` (W9 K1, LNS-86): the exact release, as this tree's VERSION names it, that a client updates to
+    (lanes-launch's self-update, W9 K2, installs exactly that and never @latest). An equal or newer client, `dev`
+    on either side, text that is no version, or no flag at all: the line every earlier release printed. The hint is
+    appended, so a reader of the first four fields (install.sh check_server, lanes-launch web) reads them as before.
+    The flag and its value may stand anywhere; the device is the first other argument."""
+    rest, client = list(args), None
+    if '--client-version' in rest:
+        at = rest.index('--client-version')
+        client = rest[at + 1] if at + 1 < len(rest) else None
+        del rest[at:at + 2]
+    device = resolve_device(rest[0], args) if rest else '-'
     version = server_version()
     boards = len(L.load_registry()['workspaces']) if (L.STATE / 'registry.json').exists() else 0
-    print(f'ok device={device} version={version} boards={boards}')
+    update = f' update={version}' if client_older(client, version) else ''
+    print(f'ok device={device} version={version} boards={boards}{update}')
+    return 0
+
+
+# ------------------------------------------------------------------ version (W9 V1, LNS-83)
+# `lanes version` answers "which release runs here, and what still runs an older one": this CLI's tree, the tree the
+# `current` link names (install/services.py writes it; the units run from it after W9 U1), and the tree each
+# long-running process recorded when it last started (L.record_tree, W9 U0). `current` is read from the link ITSELF:
+# L.CURRENT collapses to this tree's own path whenever the link names another tree, so realpath(L.CURRENT) is this tree
+# by construction and could never show a stale CLI. A checkout updated in place (`git pull`, USERGUIDE Update) keeps its
+# path, so a record names the current tree before and after the update: the time of the tree's code says which starts
+# came before it (tree_code_mtime).
+
+# The record_tree names, in the order `lanes version` lists them: statusd first (every view's status comes from it),
+# then the services, then the newest sidebar. A name not listed (a newer tree's process) follows, sorted.
+RUN_ORDER = ('statusd', 'enrold', 'docsd', 'notify', 'economy', 'studio_host', 'sidebar')
+VERSION_SCHEMA = 'lanes.version/1'
+COMMIT_RE = re.compile(r'([0-9a-f]{7})[0-9a-f]{0,33}(-dirty)?')   # scripts/build-payload.mjs: rev-parse HEAD [-dirty]
+# A tree's code, as far as a recorded process runs it: VERSION and the regular files directly in these folders (every
+# record_tree process starts from libexec/ or bin/lanes and imports libexec/*.py).
+TREE_CODE = ('bin', 'libexec')
+
+
+def utc(seconds):
+    return time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime(seconds))
+
+
+def tree_code_mtime(tree):
+    """The newest modification time (epoch seconds) of a tree's code: its VERSION and every regular file directly in
+    bin/ and libexec/ — dotfiles (editor swap files), __pycache__ and every other folder (docs/, web/) are not code. None
+    when there is none (a pruned tree). `git pull` writes each file it changes with the time of the pull, and the npm
+    wrapper re-stages a version (other bytes) as a fresh copy, so a time later than a run record says that process
+    started before its tree's code changed — a checkout updated in place keeps its path. A pull that only deletes files
+    changes no file's time and is not seen."""
+    tree = Path(tree)
+    paths = [tree / 'VERSION']
+    for folder in TREE_CODE:
+        try:
+            with os.scandir(tree / folder) as entries:
+                paths.extend(Path(entry.path) for entry in entries if not entry.name.startswith('.'))
+        except OSError:
+            continue
+    newest = None
+    for path in paths:
+        try:
+            if path.is_file():
+                mtime = path.stat().st_mtime
+                newest = mtime if newest is None else max(newest, mtime)
+        except OSError:
+            continue
+    return newest
+
+
+def run_records(state, reference):
+    """{name: {tree, version, started, current, changed}} for each `<state>/run/<name>.tree`, RUN_ORDER first. `tree`
+    is the record's one absolute path (None for a record that names none), `version` that tree's VERSION now (None once
+    the tree is pruned), `started` the record's mtime in UTC (the process's last start), `changed` the time of the tree's
+    newest code (tree_code_mtime) when it is LATER than that start — the process runs code from before it — else None,
+    and `current` whether the process runs the current code: its tree resolves to `reference` and `changed` is None. A
+    record outlives its process: it says what the last start ran, never that it still runs."""
+    found, code_times = {}, {}
+    try:
+        paths = sorted((Path(state) / L.RUN_DIR).glob('*.tree'))
+    except OSError:
+        paths = []
+    for path in paths:
+        name = path.name[:-len('.tree')]
+        if not L.IDENT.match(name):         # never a name record_tree writes
+            continue
+        try:
+            if not path.is_file():
+                continue
+            lines = path.read_text().splitlines()
+            started = path.stat().st_mtime
+        except (OSError, ValueError):       # ValueError: undecodable bytes
+            continue
+        tree = lines[0] if len(lines) == 1 and lines[0].startswith('/') else None
+        if tree is not None and tree not in code_times:
+            code_times[tree] = tree_code_mtime(tree)
+        code = code_times.get(tree)
+        changed = code if code is not None and code > started else None    # a start AT the code's time is after it
+        found[name] = {'tree': tree, 'version': L.tree_version(tree) if tree else None, 'started': utc(started),
+                       'current': tree is not None and os.path.realpath(tree) == reference and changed is None,
+                       'changed': utc(changed) if changed is not None else None}
+    order = [name for name in RUN_ORDER if name in found] + sorted(set(found) - set(RUN_ORDER))
+    return {name: found[name] for name in order}
+
+
+def version_report(repo=None, state=None, home=None):
+    """The `lanes version --json` document (schema lanes.version/1): {schema, version, commit, tree, current, running,
+    client_min}. `version` is the tree's release ('dev' without one, as `lanes hello`), `commit` the npm wrapper's
+    stamp (None for a checkout), `tree` the resolved tree this CLI runs, `current` the resolved target of
+    ~/.local/share/lanes/current (None without the link), `running` run_records() compared with `current` — or with
+    `tree` when there is no link — and with the time of each tree's code, and `client_min` the release attach stops
+    telling lanes-launch to update at."""
+    repo = Path(repo) if repo is not None else L.REPO
+    try:
+        link = L.current_link(home)
+        current = os.path.realpath(link) if os.path.lexists(link) else None
+    except (KeyError, RuntimeError):        # no HOME and no passwd entry: no link to read
+        current = None
+    version = server_version(repo)
+    return {'schema': VERSION_SCHEMA, 'version': version, 'commit': (L.tree_stamp(repo) or {}).get('commit'),
+            'tree': str(repo), 'current': current,
+            'running': run_records(state if state is not None else L.STATE,
+                                   current if current is not None else os.path.realpath(repo)),
+            'client_min': client_min(version)}
+
+
+def plain(text):
+    """Text for a terminal: every character that is not printable (escape sequences included) becomes `?`."""
+    return ''.join(char if char.isprintable() else '?' for char in str(text))
+
+
+def tree_shown(path, home=None):
+    """A tree as `lanes version` prints it: `pkg/<version>` for an npm-staged tree, `~/…` under the home, else the
+    path."""
+    path = Path(path)
+    if path.parent.name == 'pkg':
+        return plain(f'pkg/{path.name}')
+    try:
+        return plain(f'~/{path.relative_to(Path(home) if home is not None else Path.home())}')
+    except (ValueError, KeyError, RuntimeError):
+        return plain(path)
+
+
+def record_said(record, reference, home=None, past=False):
+    """What a record that does not run the current code says, as `lanes version` and doctor print it after the name:
+    `started before its tree changed` when its tree is `reference` (updated in place after that start), else `runs`
+    (`ran` with `past`) its tree's release — or the tree once that is pruned, or `?` for a record that names none."""
+    if record['tree'] is not None and os.path.realpath(record['tree']) == reference:
+        return 'started before its tree changed'
+    ran = (plain(record['version']) if record['version'] else
+           tree_shown(record['tree'], home) if record['tree'] else '?')
+    return f"{'ran' if past else 'runs'} {ran}"
+
+
+def version_text(report, home=None):
+    """The one line `lanes version` prints, e.g. `lanes 1.2.0 (abc1234) · tree pkg/1.2.0 · current ✓ · statusd runs
+    1.1.0 ✗ · enrold notify ✓`: each record that does not run the current code on its own — `runs <version>` (or its
+    tree once that is pruned, or `?` for a record that names no tree) when its tree is another one, `started before its
+    tree changed` when it is the current tree, updated in place after that start — then the current ones together."""
+    commit = COMMIT_RE.fullmatch(report['commit'] or '')
+    parts = [f"lanes {plain(report['version'])}" + (f' ({commit.group(1)}{commit.group(2) or ""})' if commit else ''),
+             f"tree {tree_shown(report['tree'], home)}"]
+    current = report['current']
+    parts.append('no current link' if current is None else 'current ✓' if current == os.path.realpath(report['tree'])
+                 else f'current {tree_shown(current, home)} ✗')
+    reference = current if current is not None else os.path.realpath(report['tree'])
+    running = report['running']
+    for name, record in running.items():
+        if not record['current']:
+            parts.append(f'{plain(name)} {record_said(record, reference, home)} ✗')
+    fresh = [plain(name) for name, record in running.items() if record['current']]
+    if fresh:
+        parts.append(' '.join(fresh) + ' ✓')
+    return ' · '.join(parts)
+
+
+def cmd_version(args):
+    if any(arg != '--json' for arg in args):
+        print('usage: lanes version [--json]')
+        return 2
+    report = version_report()
+    print(json.dumps(report, indent=1, ensure_ascii=False) if '--json' in args else version_text(report))
     return 0
 
 
+def cmd_update(args):
+    """`lanes update [--now | --timer | --status | --rollback]` (W9 U3, LNS-91): libexec/update.py owns the flow, its
+    refusals and its exit statuses; releases are compared as `lanes hello` compares them (version_key)."""
+    return libexec_module('update').update_main(args, version_key)
+
+
 def cmd_client_config(_args):
     """Site facts a client may want after its first connection (e.g. the public fallback address), so that they
     need not be written into the distributed package. KEY=VALUE lines, LANES_* keys only."""
@@ -2030,9 +3012,227 @@ def cmd_gc(_args):
         if stale.name not in known and time.time() - stale.stat().st_mtime > 3600:
             stale.unlink()
             print(f'removed stale {stale.name}')
+    gc_trees()
     return 0
 
 
+# ------------------------------------------------------------------ staged trees (plan W9 U4, LNS-92)
+# The npm wrapper stages each release at <pkg root>/<version>. Since W9 U4 it prunes only where the `current` link is
+# absent — a client, where nothing runs from an old tree (npm/lanes/lib/plan.mjs prunable; DEF-1768) — and a server's
+# trees are pruned here, by `lanes gc` (the daily lanes-gc.timer), where what still uses one can be seen.
+TREE_KEEP = 3              # the newest staged trees each pkg root keeps, as the wrapper keeps them on a client
+PRUNING = '.pruning-'      # a tree being removed is first renamed to .pruning-<version>-<pid>-<ns> in its root
+DELETED = ' (deleted)'     # what readlink(2) of a /proc link appends once the file it names is gone
+
+
+def home_shown(path, home):
+    """A path as `lanes gc` prints it: `~/…` under the home, else whole (two roots may both be called pkg)."""
+    for base in (Path(home), Path(home).resolve()):
+        try:
+            return plain(f'~/{Path(path).relative_to(base)}')
+        except ValueError:
+            continue
+    return plain(path)
+
+
+def pkg_roots(home):
+    """The folders a server's staged trees are in, resolved, each once and existing only, in this order: the folder of
+    the tree `current` names, of the tree `current.previous` names and of the tree this lanes runs from, each when it is
+    a staged tree (L.staged_tree); then the folder the npm wrapper stages in from this environment (lanes-install.mjs
+    pkgRoot: an absolute $LANES_PKG_ROOT, else $XDG_DATA_HOME/lanes/pkg) and its default, ~/.local/share/lanes/pkg.
+    A timer's environment holds neither variable: the first three find a tree staged elsewhere."""
+    link = L.current_link(home)
+    folders = []
+    for tree in (link, link.with_name('current.previous'), L.REPO):
+        try:
+            resolved = Path(tree).resolve(strict=True)
+        except (OSError, RuntimeError):
+            continue
+        if L.staged_tree(resolved):
+            folders.append(resolved.parent)
+    own, data = os.environ.get('LANES_PKG_ROOT', ''), os.environ.get('XDG_DATA_HOME', '')
+    if own:
+        folders += [Path(own)] if own.startswith('/') else []
+    elif data.startswith('/'):
+        folders.append(Path(data) / 'lanes/pkg')
+    folders.append(Path(home) / '.local/share/lanes/pkg')
+    roots = []
+    for folder in folders:
+        try:
+            resolved = folder.resolve(strict=True)
+        except (OSError, RuntimeError):
+            continue
+        if resolved.is_dir() and resolved not in roots:
+            roots.append(resolved)
+    return roots
+
+
+def staged_entries(root):
+    """[(tree, mtime)] of the trees the npm wrapper staged directly in `root`, newest first (ties: the higher name
+    first): a directory, never a link, whose name does not start with `.` (the wrapper's own `.staging-*`, a tree being
+    pruned) and which holds the wrapper's stamp — a regular file that reads as a JSON object (L.tree_stamp), as the
+    wrapper's own prune asks of it. A checkout, or anything else that is there, never is one."""
+    found = []
+    try:
+        with os.scandir(root) as entries:
+            for entry in entries:
+                stamp = os.path.join(entry.path, L.PACKAGE_STAMP)
+                try:
+                    if entry.name.startswith('.') or not entry.is_dir(follow_symlinks=False) \
+                            or os.path.islink(stamp) or L.tree_stamp(entry.path) is None:
+                        continue
+                    found.append((Path(root) / entry.name, entry.stat(follow_symlinks=False).st_mtime))
+                except OSError:
+                    continue
+    except OSError:
+        return []
+    return sorted(found, key=lambda each: (each[1], each[0].name), reverse=True)
+
+
+def proc_link(path):
+    try:
+        return os.readlink(path)
+    except OSError:
+        return None
+
+
+def process_paths(proc=None):
+    """What this account's processes use now, read from /proc (`proc`, default PROC) — best effort: a process that
+    ends or denies a read mid-scan is skipped -> ({path: pid}, {RUN_SCRIPTS name}), or None when /proc cannot be listed.
+    The paths are every absolute path a process of this uid uses: its exe, its cwd and each file it holds open
+    (/proc/<pid>/exe, cwd, fd/*), as the kernel resolved them when the process opened them — so a script started
+    through `current` before a flip still names its tree: bash and dash read their script through an open descriptor —
+    and each absolute word of its argv (or the value of an `--option=/path` word), as written and resolved now; the
+    lowest pid that uses a path is the one named. The names are the daemons among the processes (run_name)."""
+    proc = Path(proc) if proc is not None else PROC
+    try:
+        pids = sorted((name for name in os.listdir(proc) if name.isdigit()), key=int)
+    except OSError:
+        return None
+    uid, paths, names = os.geteuid(), {}, set()
+    for pid in pids:
+        base = proc / pid
+        try:
+            if base.stat().st_uid != uid:
+                continue
+            fds = os.listdir(base / 'fd')
+        except OSError:
+            continue
+        used = [proc_link(base / 'exe'), proc_link(base / 'cwd')] + [proc_link(base / 'fd' / fd) for fd in fds]
+        try:
+            raw = (base / 'cmdline').read_bytes()
+        except OSError:
+            raw = b''
+        words = [os.fsdecode(word) for word in (raw[:-1] if raw.endswith(b'\0') else raw).split(b'\0')] if raw else []
+        name = run_name(words)
+        if name is not None:
+            names.add(name)
+        for word in words:
+            for part in (word, word.partition('=')[2]):
+                if part.startswith('/'):
+                    used += [part, os.path.realpath(part)]
+        for path in used:
+            path = path[:-len(DELETED)] if path and path.endswith(DELETED) else path
+            if path and path.startswith('/'):
+                paths.setdefault(os.path.normpath(path), int(pid))
+    return paths, names
+
+
+def staged_tree_plan(home=None, proc=None):
+    """[(tree, reason)] for every staged tree of pkg_roots, root by root and newest first: why `lanes gc` keeps it, or
+    None when it is pruned. Kept: the TREE_KEEP newest of each root (by mtime, as the wrapper counts them on a client),
+    and any older one that `current` or `current.previous` (the rollback target) names, that this lanes runs from,
+    that a view layout (`layouts/<device>.kdl`) names — a release before W9 U1 wrote `pkg/<version>` into one, and the
+    view keeps running it until it is rebuilt — that a running daemon's run record names (run/<name>.tree: one started
+    through `current` before the last flip, whose argv now resolves to the new tree), or that a process of this account
+    uses (process_paths, read only when an older tree has no other reason). When /proc cannot be listed no older tree
+    is pruned. The units are not read: since W9 U1 each names `current`, and every install that moves the link renders
+    them all."""
+    home = Path(home) if home is not None else Path.home()
+    link = L.current_link(home)
+    named = {}
+    for each, reason in ((link, 'current names it'),
+                         (link.with_name('current.previous'), 'current.previous names it (the rollback target)'),
+                         (L.REPO, 'this lanes runs from it')):
+        if os.path.lexists(each):
+            named.setdefault(os.path.realpath(each), reason)
+    layouts = []
+    for kdl in sorted((L.STATE / 'layouts').glob('*.kdl')):
+        try:
+            text = kdl.read_text()
+        except (OSError, ValueError):
+            continue
+        said = f'the view layout of {plain(kdl.stem)} names it'
+        layouts.append((said, text))
+        for tree in layout_trees(text):
+            named.setdefault(os.path.realpath(tree), said)
+    plan = []
+    for root in pkg_roots(home):
+        for index, (tree, _mtime) in enumerate(staged_entries(root)):
+            forms = {str(tree), os.path.realpath(tree)}
+            plan.append([tree, forms, f'one of the {TREE_KEEP} newest' if index < TREE_KEEP else
+                         next((named[form] for form in forms if form in named), None)
+                         or next((said for said, text in layouts if any(form + '/' in text for form in forms)), None)])
+    if not all(reason for _tree, _forms, reason in plan):
+        scan = process_paths(proc)
+        paths, live = scan if scan is not None else ({}, set())
+        records = {}
+        for name, record in run_records(L.STATE, '').items():
+            if name in live and record['tree']:
+                records.setdefault(os.path.realpath(record['tree']), f'{name} runs from it (run/{name}.tree)')
+        for entry in plan:
+            tree, forms, reason = entry
+            if reason is None:
+                entry[2] = ('the process table could not be read' if scan is None else
+                            next((records[form] for form in forms if form in records), None)
+                            or next((f'process {pid} uses it' for path, pid in paths.items()
+                                     if any(path == form or path.startswith(form + '/') for form in forms)), None))
+    return [(tree, reason) for tree, _forms, reason in plan]
+
+
+def gc_trees(home=None, proc=None):
+    """`lanes gc`'s staged-tree sweep (plan W9 U4): what an earlier sweep left half-removed (`.pruning-*`) goes first;
+    then each tree staged_tree_plan gives no reason to keep is renamed to `.pruning-<version>-…` — one rename(2), so no
+    half-removed tree is ever left under its version name, which the wrapper would reuse by its stamp — and removed.
+    One line for each tree past the newest: `pruned <tree>`, or `kept <tree>: <reason>`; `skip <tree>: <error>`."""
+    try:
+        home = Path(home) if home is not None else Path.home()
+    except (KeyError, RuntimeError):     # no HOME and no passwd entry: no link and no default root to read
+        return
+    for root in pkg_roots(home):
+        try:
+            with os.scandir(root) as entries:
+                remains = sorted(entry.path for entry in entries
+                                 if entry.name.startswith(PRUNING) and entry.is_dir(follow_symlinks=False))
+        except OSError:
+            remains = []
+        for path in remains:
+            try:
+                shutil.rmtree(path)
+                print(f'pruned {home_shown(path, home)} (left by an earlier lanes gc)')
+            except OSError as error:
+                print(f'skip {home_shown(path, home)}: {error.strerror or error}')
+    for tree, reason in staged_tree_plan(home, proc):
+        shown = home_shown(tree, home)
+        if reason == f'one of the {TREE_KEEP} newest':
+            continue
+        if reason is not None:
+            print(f'kept {shown}: {reason}')
+            continue
+        aside = tree.with_name(f'{PRUNING}{tree.name}-{os.getpid()}-{time.time_ns()}')
+        try:
+            os.rename(tree, aside)
+        except OSError as error:
+            print(f'skip {shown}: {error.strerror or error}')
+            continue
+        try:
+            shutil.rmtree(aside)
+        except OSError as error:
+            print(f'skip {shown}: {error.strerror or error} (left as {aside.name}; the next lanes gc removes it)')
+            continue
+        print(f'pruned {shown}')
+
+
 def cmd_tmp(args):
     return libexec_module('tmpscan').run(args)   # verbs, options and the usage text are tmpscan's
 
@@ -2046,7 +3246,364 @@ def cmd_studio_host(args):
 
 
 def cmd_keys(args):
-    return libexec_module('keys').main(args)          # verbs, refusals and exit codes are keys.py's
+    # verbs, refusals and exit codes are keys.py's; a verb that names an owner (adopt --login, owner) ends by folding
+    # the views of the devices it named into that person's profile (cockpit v3 R2), and a dropped fold is its exit 1
+    return libexec_module('keys').main(args, on_owned=fold_profile)
+
+
+USER_USAGE = 'usage: lanes user list | lanes user show <login> [--json]'
+
+
+def shown(text):
+    """A file name for a terminal line: as it is when printable, else Python's escaped form (no control character from
+    a directory listing reaches the terminal)."""
+    return text if text.isprintable() else ascii(text)
+
+
+def shown_utc(epoch):
+    """A time as `lanes user show` and `lanes here` print it: `2026-10-07 09:46:40Z` (utc() is the ISO form the JSON
+    of `lanes version` carries)."""
+    return time.strftime('%Y-%m-%d %H:%M:%SZ', time.gmtime(epoch))
+
+
+def look_words(look):
+    """`theme dark · glyphs ascii`: a validated look (users.LOOK keys and values) in LOOK order."""
+    return ' · '.join(f'{key} {look[key]}' for key in ('theme', 'color', 'glyphs') if key in look)
+
+
+def device_looks(users, devices):
+    """{device: {'device_only': {…}, 'unfolded': {…}}} for each of `devices` whose devices/<device>.json keeps a
+    look of its own (users.device_only / users.unfolded: validated values only), for `lanes user show` (DEF-1782):
+    the keys that paint on that device whatever — or wherever — the profile says. Read-only."""
+    looks = {}
+    for device in devices:
+        meta = L.read_json(L.STATE / 'devices' / f'{device}.json')
+        own, early = users.device_only(meta), users.unfolded(meta)
+        if own or early:
+            looks[device] = {'device_only': own, 'unfolded': early}
+    return looks
+
+
+def profile_lines(profile):
+    """[(label, value)] of one profile as `lanes user show` prints it (every value validated by users.normalize)."""
+    look, seen = profile['look'], profile['seen']
+    last, quiet = profile['last_opened'], profile['notify'].get('quiet_s')
+    by = f" by {profile['updated_by_device']}" if profile['updated_by_device'] else ''
+    return [('look', look_words(look) or 'nothing set (the device file, the environment and the defaults decide)'),
+            ('seen', f"{len(seen)} lane{'s' if len(seen) != 1 else ''}" if seen else 'none'),
+            ('workspaces', f"order {' '.join(profile['workspaces']['order']) or '-'} · "
+                           f"hidden {' '.join(profile['workspaces']['hidden']) or '-'}"),
+            ('lanes', f"pinned {' '.join(profile['lanes']['pins']) or '-'} · "
+                      f"hidden {' '.join(profile['lanes']['hidden']) or '-'}"),
+            ('last opened', f"{last['lane']} on {last['device']} at {shown_utc(last['at'])}" if last else 'none'),
+            ('notify', f'quiet {quiet} s' if quiet is not None else 'default'),
+            ('updated', f"{shown_utc(profile['updated_at'])}{by}" if profile['updated_at'] else 'never')]
+
+
+def cmd_user(args):
+    """`lanes user list | show <login> [--json]` (cockpit v3 R2, LNS-75): the people lanes knows and one person's
+    profile (users/<login>.json, libexec/users.py). A person is a login with a profile, or the owner of a device
+    (users.device_logins: a view, a member record or seen marks, owned as device_owner derives it). show also names
+    every look a device of the person keeps in its own devices/<device>.json (device_looks: --device-only keys, and
+    keys from before the profile, with the claim that folds them in; DEF-1782) — why one device paints differently.
+    Read-only: neither verb writes a file. Every value printed was validated (users.normalize, members.validate_owner,
+    users.device_only/unfolded); a file name that is no profile is printed escaped."""
+    users = libexec_module('users')
+    if args == ['list']:
+        profiles, problems = users.load_all()
+        people = {profile['login']: {'profile': profile, 'devices': [], 'name': profile['name']}
+                  for profile in profiles}
+        for device, login in users.device_logins().items():
+            if login:
+                person = people.setdefault(login, {'profile': None, 'devices': [], 'name': None})
+                person['devices'].append(device)
+                if not person['name']:
+                    person['name'] = (users.owner_of(device) or {}).get('name')
+        for login, person in sorted(people.items()):
+            profile = person['profile']
+            if profile is None:
+                state = 'no profile yet'
+            else:
+                by = f" by {profile['updated_by_device']}" if profile['updated_by_device'] else ''
+                state = f"profile updated {shown_utc(profile['updated_at'])}{by}" if profile['updated_at'] else 'profile'
+            print(f"{login:<32} {person['name'] or '-':<24} {', '.join(person['devices']) or '-':<32} {state}")
+        if not people:
+            print(f'no users: no profile in {users.users_dir()} and no device with an owner — '
+                  '`lanes device claim <device> --login <login>` gives a device one')
+        for name, reason in problems:
+            print(f'⚠ users/{shown(name)}: {reason} — not read and never overwritten (fix or remove the file)',
+                  file=sys.stderr)
+        return 0
+    rest = [word for word in args[1:] if word != '--json']
+    if args[:1] != ['show'] or len(rest) != 1 or len(args) - len(rest) > 2:
+        raise L.LanesError(USER_USAGE)
+    login = rest[0]
+    profile, problem = users.inspect(login)              # refuses a login that can have no profile, never echoing it
+    devices = [device for device, owner in users.device_logins().items() if owner == login]
+    if profile is None and problem is None and not devices:
+        raise L.LanesError(f'no user {login}: no profile and no device it owns (lanes user list)')
+    looks = device_looks(users, devices)
+    if '--json' in args:
+        print(json.dumps({'login': login, 'devices': devices, 'device_looks': looks, 'profile': profile,
+                          'problem': problem}, indent=2, ensure_ascii=False))
+        return 1 if problem else 0
+    name = profile['name'] if profile else next(
+        (owner['name'] for owner in map(users.owner_of, devices) if owner and owner.get('name')), None)
+    lines = [('login', login)] + ([('name', name)] if name else []) + [('devices', ', '.join(devices) or '-')]
+    for device, look in looks.items():
+        if look['unfolded']:
+            lines.append(('device look', f"{device}: {look_words(look['unfolded'])} — from before the profile: "
+                                         'painted only where the profile sets none; '
+                                         f'`lanes device claim {device} --login {login}` folds it in'))
+        if look['device_only']:
+            lines.append(('device look', f"{device}: {look_words(look['device_only'])} — --device-only: wins over "
+                                         f'the profile on {device}; the same flag without --device-only hands it back'))
+    if problem:
+        lines.append(('profile', f'users/{users.stem(login)}.json: {problem} — not read and never overwritten (fix or '
+                                 'remove the file)'))
+    elif profile is None:
+        lines.append(('profile', f'none yet — `lanes device claim <device> --login {login}` or a look flag on '
+                                 '`lanes attach` starts it'))
+    else:
+        lines += profile_lines(profile) + [('file', str(users.path(login)))]
+    for label, value in lines:
+        print(f'{label:<12} {value}')
+    return 1 if problem else 0
+
+
+# ------------------------------------------------------------------ arrangement (cockpit v3 R6)
+# A person's boards and lanes are arranged once for every device they own: `lanes workspaces hide|show|order` and
+# `lanes lane pin|unpin|hide|show` write the `workspaces` and `lanes` lists of their profile users/<login>.json
+# (DM-LANES-USER-PROFILE) through users.update — its 1 s lock and merge, never a file this release does not read — and
+# `lanes here <device>` shows on that device the lane they opened last anywhere (`last_opened`). The person is the owner
+# of --device D (profile_for, as `lanes attach` derives it; else $LANES_DEVICE's) or --login L. Readers: the tabs of
+# every device of the person (workspace order and hidden boards, cockpit v3 R4) and their sidebars (pinned and hidden
+# lanes, R5). Nothing follows the person from device to device by itself: `lanes here` is asked for (v1).
+
+ARRANGE_WORKSPACES = ('hide', 'show', 'order')
+LANE_VERBS = ('pin', 'unpin', 'hide', 'show')
+LANE_USAGE = 'usage: lanes lane pin|unpin|hide|show <lane-id> [--device D | --login L]'
+HERE_USAGE = 'usage: lanes here <device>'
+
+
+def target_args(args, usage):
+    """The words of `args` and the person they arrange -> (words, device, login): `--device D` or `--login L`, at most
+    one of them and each once, anywhere among the words; any other option is the usage."""
+    words, options, rest = [], {}, list(args)
+    while rest:
+        word = rest.pop(0)
+        if word in ('--device', '--login'):
+            if not rest or options:
+                raise L.LanesError(usage)
+            options[word] = rest.pop(0)
+        elif word.startswith('-'):
+            raise L.LanesError(usage)
+        else:
+            words.append(word)
+    return words, options.get('--device'), options.get('--login')
+
+
+def profile_target(users, device, login, usage):
+    """The login whose profile an arranging verb writes. --login L: a person lanes knows (a profile, or a device they
+    own — `lanes user list`). Else the device --device names, or $LANES_DEVICE: its owner (profile_for; a window such
+    as mac-2 is its machine's owner's). The device only names the person: the write is the CLI's, stamped
+    `cli:<command>` (arrange), never that device's — a verb run over SSH is nobody at the desk, and the push notifier
+    must not mute that person's pushes for it (W9 review F3). Refused, never echoing an invalid value: no person
+    named, a device nobody owns, an unknown login, or a profile file this release does not read (it is never
+    overwritten)."""
+    if login is None:
+        device = device if device is not None else os.environ.get('LANES_DEVICE') or None
+        if device is None:
+            raise L.LanesError(f'{usage} — name the device (--device D, or LANES_DEVICE) or the person (--login L)')
+        device = device_name(device)
+        login = profile_for(device)
+        if not login:
+            raise L.LanesError(f'{device} has no owner, so it follows no profile: `lanes device claim {device} --login '
+                               '<login>` names one, or name the person with --login <login>')
+    profile, problem = users.inspect(login)              # refuses a login that can have no profile, never echoing it
+    if problem:
+        raise L.LanesError(f'users/{users.stem(login)}.json: {problem} — not read and never overwritten (fix or remove '
+                           'the file); nothing changed')
+    if device is None and profile is None and login not in users.device_logins().values():
+        raise L.LanesError(f'no user {login}: no profile and no device it owns (lanes user list)')
+    return login
+
+
+def arrange(users, login, command, change):
+    """users.update(login, `cli:<command>`, change) -> 0, then the profile row it changed is printed by the caller; 1
+    when the write was dropped (the lock stayed busy for users.LOCK_S, or the store cannot be written), said on
+    stderr. A refusal `change` raises under the lock propagates, and nothing is written. The stamp is the CLI writer
+    (users.cli_writer), never a device: see profile_target."""
+    if users.update(login, users.cli_writer(command), change):
+        return 0
+    print(f"lanes: {login}'s profile was busy or cannot be written (`lanes user show {login}` says why); nothing "
+          'changed — run it again', file=sys.stderr)
+    return 1
+
+
+def arranged(users, login, label, groups):
+    """Print what an arranging verb did — `<words> for <login>: <ids>` per (words, ids) group with ids — and the
+    profile's row `label` as `lanes user show` prints it."""
+    for words, ids in groups:
+        if ids:
+            print(f"{words} for {login}: {' '.join(ids)}")
+    profile = users.read(login) or users.empty(login)
+    print(next(f'{name:<12} {value}' for name, value in profile_lines(profile) if name == label))
+
+
+def cmd_workspaces_profile(args):
+    """`lanes workspaces hide|show|order <id…> [--device D | --login L]` (cockpit v3 R6, LNS-79): the person's board
+    arrangement, on every device they own. hide adds boards to `workspaces.hidden` — refused when no board would stay
+    visible (decided under the profile's lock); show takes ids off it, also one no board has any more (no registry is
+    read); order REPLACES `workspaces.order` with the ids given (each once; the boards it leaves out follow in catalog
+    order, as the reader places them). hide and order take the board ids `lanes workspaces` prints: an SSH workspace or
+    a tool tab is the site's, not arranged per person. -> 0, 1 when the write was dropped (arrange)."""
+    words, device, login = target_args(args, WORKSPACES_USAGE)
+    verb, ids = words[0], words[1:]
+    if not ids:
+        raise L.LanesError(WORKSPACES_USAGE)
+    users = libexec_module('users')
+    for board in ids:
+        users.check_workspace(board)                       # never echoes an invalid value
+    if verb == 'order':
+        twice = next((board for index, board in enumerate(ids) if board in ids[:index]), None)
+        if twice:
+            raise L.LanesError(f'{twice} is named twice; nothing changed')
+    ids = list(dict.fromkeys(ids))
+    boards = [] if verb == 'show' else [workspace['id'] for workspace in L.load_registry()['workspaces']]
+    unknown = next((board for board in ids if verb != 'show' and board not in boards), None)
+    if unknown:
+        raise L.LanesError(f'no board {unknown} (lanes workspaces lists them); nothing changed')
+    login = profile_target(users, device, login, WORKSPACES_USAGE)
+    groups = []
+
+    def change(profile):
+        hidden, order = profile['workspaces']['hidden'], profile['workspaces']['order']
+        if verb == 'order':
+            follow = '(the other boards follow in catalog order)'
+            groups[:] = [('order', ids + [follow]) if order != ids else ('order was already', ids)]
+            profile['workspaces']['order'] = list(ids)
+            return
+        if verb == 'hide':
+            new = [board for board in ids if board not in hidden]
+            if len(hidden) + len(new) > users.MAX_WORKSPACES:
+                raise L.LanesError(f'a profile keeps at most {users.MAX_WORKSPACES} hidden boards; nothing changed')
+            if not [board for board in boards if board not in hidden + new]:
+                raise L.LanesError('that would hide every board: at least one stays visible (`lanes workspaces show '
+                                   '<id>` shows one again); nothing changed')
+            hidden.extend(new)
+            groups[:] = [('hidden', new), ('already hidden', [board for board in ids if board not in new])]
+            return
+        shown = [board for board in ids if board in hidden]
+        profile['workspaces']['hidden'] = [board for board in hidden if board not in shown]
+        groups[:] = [('shown again', shown), ('not hidden', [board for board in ids if board not in shown])]
+
+    code = arrange(users, login, 'workspaces', change)
+    if code == 0:
+        arranged(users, login, 'workspaces', groups)
+    return code
+
+
+def cmd_lane(args):
+    """`lanes lane pin|unpin|hide|show <lane-id> [--device D | --login L]` (cockpit v3 R6, LNS-79): the person's
+    `lanes.pins` / `lanes.hidden`, on every device they own. pin takes a lane the boards list (registered, or a live
+    unregistered session); hide only a registered one — the sidebar always lists an unregistered session that runs, so
+    hiding it would be a silent no-op; unpin and show take any lane id off the list, also one that left the boards. At
+    most users.MAX_LANES per list (refused beyond, never truncated). -> 0, 1 when the write was dropped (arrange)."""
+    words, device, login = target_args(args, LANE_USAGE)
+    if len(words) != 2 or words[0] not in LANE_VERBS:
+        raise L.LanesError(LANE_USAGE)
+    verb, lane_id = words
+    users = libexec_module('users')
+    users.check_lane(lane_id)                              # never echoes an invalid value
+    if verb in ('pin', 'hide'):
+        registry = L.load_registry()
+        L.find_lane(registry, lane_id)                     # Unknown lane: <id>
+        registered = any(lane['id'] == lane_id for workspace in registry['workspaces'] for lane in workspace['lanes'])
+        if verb == 'hide' and not registered:
+            raise L.LanesError(f'{lane_id} is not registered in a workspace: an unregistered session that runs is always '
+                               f'listed — `lanes register {lane_id}` adds it to its workspace first; nothing changed')
+    login = profile_target(users, device, login, LANE_USAGE)
+    key = 'pins' if verb in ('pin', 'unpin') else 'hidden'
+    adds = verb in ('pin', 'hide')
+    said = {'pin': ('pinned', 'already pinned'), 'unpin': ('unpinned', 'not pinned'),
+            'hide': ('hidden', 'already hidden'), 'show': ('shown again', 'not hidden')}[verb]
+    groups = []
+
+    def change(profile):
+        listed = profile['lanes'][key]
+        changed = (lane_id not in listed) if adds else (lane_id in listed)
+        if changed and adds:
+            if len(listed) >= users.MAX_LANES:
+                raise L.LanesError(f"a profile keeps at most {users.MAX_LANES} {'pinned' if key == 'pins' else key} "
+                                   f'lanes and {login}\'s has that many: {"unpin" if key == "pins" else "show"} one '
+                                   'first; nothing changed')
+            listed.append(lane_id)
+        elif changed:
+            listed.remove(lane_id)
+        groups[:] = [(said[0] if changed else said[1], [lane_id])]
+
+    code = arrange(users, login, 'lane', change)
+    if code == 0:
+        arranged(users, login, 'lanes', groups)
+    return code
+
+
+def cmd_here(args):
+    """`lanes here <device>` (cockpit v3 R6, LNS-79; `lanes-launch here` from a client): show on `device` the lane its
+    owner opened last on any of their devices — the profile's `last_opened`, which a sidebar's Enter and `lanes
+    next|prev` write when they open a lane with an agent — exactly as those do: its board's first viewport is pointed
+    at it (lanes_lib.show_lane: the target file, SIGUSR1 to a running view.sh), and a lane with an agent is marked seen
+    on the device and in the profile (mark_profile_seen: the mark and `last_opened` now name this device). When a view
+    was woken, the board's tab is brought to the front (one bounded `zellij action go-to-tab-name`, as `lanes attach
+    <workspace>` does). Says why it opens nothing (LanesError, exit 1): an unknown device, one nobody owns, no lane
+    opened yet, a lane no board lists any more, or a board the person hides (cockpit v3 R4). Never follows by itself.
+    -> 0."""
+    if len(args) != 1 or args[0].startswith('-'):
+        raise L.LanesError(HERE_USAGE)
+    device = device_name(args[0])
+    if not isinstance(L.read_json(L.STATE / 'devices' / f'{device}.json'), dict):
+        raise L.LanesError(f'no device {device!r} is known (lanes device list)')
+    login = profile_for(device)
+    if not login:
+        raise L.LanesError(f'{device} has no owner, so there is no profile to follow: `lanes device claim {device} '
+                           '--login <login>` names one')
+    users = libexec_module('users')
+    profile, problem = users.inspect(login)
+    if problem:
+        raise L.LanesError(f'users/{users.stem(login)}.json: {problem} — not read and never overwritten (fix or remove '
+                           'the file)')
+    last = (profile or {}).get('last_opened')
+    if not last:
+        raise L.LanesError(f'nothing to open: {login} has opened no lane with an agent yet (its profile records the last '
+                           'one opened)')
+    when = f"on {last['device']} at {shown_utc(last['at'])}"
+    try:
+        workspace, lane = L.find_lane(L.load_registry(), last['lane'])
+    except L.LanesError:
+        raise L.LanesError(f"{last['lane']}, the lane {login} opened last ({when}), is not listed any more; nothing to "
+                           'open') from None
+    if workspace['id'] in profile['workspaces']['hidden']:
+        raise L.LanesError(f"{lane['name']} is on {workspace['title']}, which {login} hides on every device: `lanes "
+                           f"workspaces show {workspace['id']} --device {device}` shows it again")
+    status = (L.read_json(L.STATE / 'status.json') or {}).get('lanes') or {}
+    agent = (status.get(lane['id']) or {}).get('agent') if isinstance(status, dict) else None
+    if isinstance(agent, dict) and agent:
+        seen = L.record_seen(L.STATE / 'clients' / f'{device}.seen.json', lane['id'], agent.get('since'), set(status))
+        mark_profile_seen(device, lane['id'], seen[lane['id']], 'here')
+    woken = L.show_lane(str(L.STATE / 'views' / device), workspace['id'], 'main', lane['id'])
+    print(f"{device}: {lane['name']} ({workspace['title']}) — the lane {login} opened last, {when}")
+    if lane['id'] in profile['lanes']['hidden']:
+        print(f"{lane['name']} is hidden from your lists: `lanes lane show {lane['id']} --device {device}` lists it "
+              'again')
+    if not woken:
+        print(f"{device}'s view of {workspace['title']} is not running: it shows {lane['name']} when it starts")
+        return 0
+    rc, out, err = zellij(['-s', device, 'action', 'go-to-tab-name', workspace['title']], 10)
+    if rc != 0:
+        reason = 'no answer in 10 s' if rc is None else (err.strip() or out.strip() or f'exit {rc}')
+        print(f"the {workspace['title']} tab was not brought to the front ({reason}); Ctrl-Alt-←/→ reaches it")
+    return 0
 
 
 def cmd_invite(args):
@@ -2083,18 +3640,25 @@ def revoke_web_token(device, windows=()):
 
 def end_view(device):
     """Offboard step 4 -> (status, sentence): end the view session `device` the way `lanes rebuild` does (kill, then
-    delete the serialized session) without its reconnect stamp and without recreating it. No lane is touched."""
-    try:
-        live = live_sessions()
-    except L.LanesError as error:
-        return 'failed', f'whether the view session {device} runs is unknown ({error}); `lanes offboard {device} --yes` again'
-    if device not in live:
-        return 'none', f'no view session {device} is running'
-    rc = zellij(['kill-session', device], 30)[0]
-    if rc != 0:
-        return 'failed', (f'the view session {device} did not end ('
-                          + ('no answer in 30 s' if rc is None else f'exit {rc}') + f'); `lanes offboard {device} --yes` again')
-    zellij(['delete-session', '--force', device], 30)
+    delete the serialized session) without its reconnect stamp and without recreating it, under the view-session lock
+    (DEF-1792). No lane is touched."""
+    with contextlib.ExitStack() as stack:
+        refused = hold_sessions(stack, SESSIONS_WAIT, f'lanes offboard {device}')
+        if refused:
+            return 'failed', f'the view session {device} was not ended ({refused}); `lanes offboard {device} --yes` again'
+        try:
+            live = live_sessions()
+        except L.LanesError as error:
+            return 'failed', (f'whether the view session {device} runs is unknown ({error}); '
+                              f'`lanes offboard {device} --yes` again')
+        if device not in live:
+            return 'none', f'no view session {device} is running'
+        rc = zellij(['kill-session', device], 30)[0]
+        if rc != 0:
+            return 'failed', (f'the view session {device} did not end ('
+                              + ('no answer in 30 s' if rc is None else f'exit {rc}')
+                              + f'); `lanes offboard {device} --yes` again')
+        zellij(['delete-session', '--force', device], 30)
     return 'done', f'ended view session {device} (no lane was touched)'
 
 
@@ -2232,14 +3796,118 @@ def socket_report(containers, live_by_container):
     return warnings
 
 
+DEVICE_USAGE = 'usage: lanes device list | lanes device forget <name> | lanes device claim <device> --login L [--name N]'
+
+
+def claim_args(rest):
+    """[device, --login L (, --name N)] in any order of the two options, each once, --login required ->
+    (device, login, name). Anything else is the usage."""
+    if len(rest) not in (3, 5):
+        raise L.LanesError(DEVICE_USAGE)
+    options = {}
+    for flag, value in zip(rest[1::2], rest[2::2]):
+        if flag not in ('--login', '--name') or flag in options:
+            raise L.LanesError(DEVICE_USAGE)
+        options[flag] = value
+    if '--login' not in options:
+        raise L.LanesError(DEVICE_USAGE)
+    return rest[0], options['--login'], options.get('--name')
+
+
+def deciding_member(members, device, meta):
+    """(name, owner or None) of the member record that decides who owns `device` — members/<device>.json, else
+    members/<base>.json (members.owner_for's order) — or None while neither exists. A record that exists but does not
+    load is refused here (owner_for would keep the recorded owner beside it, but a claim must not be written while it
+    is there)."""
+    base = meta.get('base')
+    for name in [device] + ([base] if isinstance(base, str) and base != device else []):
+        if not L.IDENT.match(name) or len(name) > 32:      # a corrupt base names no member file
+            continue
+        try:
+            document = members.read(name)
+        except L.LanesError as error:
+            raise L.LanesError(f'{error} — while it exists it, not a claim, decides who owns {device}: fix or remove it '
+                               'first; nothing changed') from None
+        if document is not None:
+            return name, members.valid_owner(document.get('owner'))
+    return None
+
+
+def claimed_owner(before, owner, renamed):
+    """The owner a claim records on a view whose valid recorded owner is `before` (or None): `owner` ({login, name,
+    email: null}) for a view another login or nobody holds; for the login it records already, that record itself — its
+    name and email kept — with only the name replaced when the claim gave --name (`renamed`). So a claim run again
+    without --name, as fold_profile's repair hint words it, changes nothing that is done."""
+    if before and before['login'] == owner['login']:
+        return dict(before, name=owner['name']) if renamed else before
+    return owner
+
+
+def owner_words(owner):
+    """`login (name)` — or the login alone — of a validated owner, or `none`."""
+    if not owner:
+        return 'none'
+    return owner['login'] + (f" ({owner['name']})" if owner['name'] else '')
+
+
+def cmd_device_claim(rest):
+    """`lanes device claim <device> --login L [--name N]` (cockpit v3 R2, LNS-75): name the owner of a view no member
+    record speaks for — a device from before enrolment (W8) — so it follows L's profile. Writes `owner` into
+    devices/<device>.json, where device_owner keeps it across every rewrite (create_session, record_base) while no
+    member record exists, and into each of its windows' files (views whose recorded base is the device) that have no
+    member record of their own; then folds those views into L's profile (fold_profile). A member record decides
+    ownership whenever one exists (DM-LANES-DEVICE-OWNER): a claim that disagrees with it is refused with the verb that
+    changes it, one that agrees writes no owner and only folds. A view L already owns keeps its recorded name and email
+    unless --name replaces the name (claimed_owner), so re-running a claim — with or without --name — changes nothing
+    that is done and finishes a fold that was dropped -> 0, or 1 when the profile could not be written."""
+    device, login, name = claim_args(rest)
+    device = device_name(device)
+    meta_file = L.STATE / 'devices' / f'{device}.json'
+    meta = L.read_json(meta_file) if meta_file.exists() else None
+    if not isinstance(meta, dict):
+        raise L.LanesError(f'no device {device!r} is known (lanes device list): a claim names the owner of a view '
+                           'lanes keeps')
+    members = libexec_module('members')
+    owner = members.validate_owner({'login': login, 'name': name})
+    login = owner['login']
+    decided = deciding_member(members, device, meta)
+    if decided:
+        record, current = decided
+        if not current or current['login'] != login:
+            who = current['login'] if current else 'nobody: a key added by hand'
+            raise L.LanesError(f'members/{record}.json decides who owns {device} ({who}); a claim never overrides a '
+                               f'member record — `lanes keys owner {record} {login}` names its owner; nothing changed')
+        print(f"{device} is already {login}'s: members/{record}.json names {login}")
+    else:
+        before = members.valid_owner(meta.get('owner'))
+        after = claimed_owner(before, owner, name is not None)
+        if before == after:
+            print(f"{device} is already owned by {login} ("
+                  + (f"{before['name']}, " if before['name'] else '') + f'devices/{device}.json)')
+        else:
+            L.atomic_write(meta_file, json.dumps(dict(meta, owner=after)) + '\n')
+            print(f'owner of {device}: {owner_words(before)} -> {owner_words(after)}')
+    for window, window_meta in windows_of({device}).items():
+        before = members.valid_owner(window_meta.get('owner'))
+        after = claimed_owner(before, owner, name is not None)
+        if (members.members_dir() / f'{window}.json').exists():
+            print(f'kept {window} (a window of {device}): members/{window}.json decides who owns it')
+        elif not decided and before != after:
+            L.atomic_write(L.STATE / 'devices' / f'{window}.json', json.dumps(dict(window_meta, owner=after)) + '\n')
+            print(f'owner of {window} (a window of {device}): {owner_words(before)} -> {owner_words(after)}')
+    return fold_profile(login, [device])
+
+
 def cmd_device(args):
-    """lanes device list | lanes device forget <name>: the devices/<name>.json files `lanes ensure` (lanes-ensure.timer)
-    recreates a view session from, and `sync`/`upgrade-session` update. Forgetting removes that file only: a running
-    view session is never ended here. list prints the owner's login as the next rewrite records it (device_owner: the
-    member record's whenever one exists, so it agrees with `lanes keys list`; else the validated recorded one), blank
-    for none — a devices/*.json or members/*.json value never reaches the terminal unchecked."""
-    usage = 'usage: lanes device list | lanes device forget <name>'
+    """lanes device list | forget <name> | claim <device> --login L [--name N]: the devices/<name>.json files `lanes
+    ensure` (lanes-ensure.timer) recreates a view session from, and `sync`/`upgrade-session` update. Forgetting removes
+    that file only: a running view session is never ended here. list prints the owner's login as the next rewrite
+    records it (device_owner: the member record's whenever one exists, so it agrees with `lanes keys list`; else the
+    validated recorded one), blank for none — a devices/*.json or members/*.json value never reaches the terminal
+    unchecked. claim: cmd_device_claim."""
     devices = L.STATE / 'devices'
+    if args[:1] == ['claim']:
+        return cmd_device_claim(args[1:])
     if args == ['list']:
         try:
             live = live_sessions()
@@ -2257,17 +3925,23 @@ def cmd_device(args):
                   + (f"  base {base}" if base else ''))
         return 0
     if len(args) != 2 or args[0] != 'forget':
-        raise L.LanesError(usage)
+        raise L.LanesError(DEVICE_USAGE)
     device = device_name(args[1])
     meta_file = devices / f'{device}.json'
-    if not meta_file.exists():
-        raise L.LanesError(f'no device {device!r} is known (lanes device list)')
-    meta = L.read_json(meta_file) or {}
-    try:
-        live = device in live_sessions()
-    except L.LanesError:
-        live = None
-    meta_file.unlink()
+    with contextlib.ExitStack() as stack:
+        # Under the view-session lock (DEF-1792): a `lanes ensure` pass that listed this device before the unlink and
+        # recreated its view after it would write devices/<device>.json again (create_session), undoing the forget.
+        refused = hold_sessions(stack, SESSIONS_WAIT, f'lanes device forget {device}')
+        if refused:
+            raise L.LanesError(f'{refused}: {device} was not forgotten')
+        if not meta_file.exists():
+            raise L.LanesError(f'no device {device!r} is known (lanes device list)')
+        meta = L.read_json(meta_file) or {}
+        try:
+            live = device in live_sessions()
+        except L.LanesError:
+            live = None
+        meta_file.unlink()
     kind = 'phone' if meta.get('mobile') else f"desktop, {int(meta.get('viewports') or 1)} viewports"
     print(f'forgot {device} ({kind}): `lanes ensure` (lanes-ensure.timer) no longer recreates its view session, and '
           '`lanes sync` / `upgrade-session` no longer update it')
@@ -2281,6 +3955,25 @@ def cmd_device(args):
     return 0
 
 
+def unit_properties(units):
+    """One bounded `systemctl --user show` of `units` (Id, LoadState, ActiveState, UnitFileState, MainPID) ->
+    ({unit: {property: value}}, None), or (None, why) when systemctl did not answer or failed. Read-only."""
+    argv = ['systemctl', '--user', 'show', '-p', 'Id', '-p', 'LoadState', '-p', 'ActiveState', '-p', 'UnitFileState',
+            '-p', 'MainPID', *units]
+    rc, out, err = L.run_bounded(argv, 10, env=clean_env())
+    if rc != 0:
+        return None, 'did not answer in 10 s' if rc is None else err.strip() or f'exit {rc}'
+    found = {}
+    for block in out.strip().split('\n\n'):
+        props = dict(line.partition('=')[::2] for line in block.splitlines() if '=' in line)
+        found[props.get('Id', '')] = props
+    return found, None
+
+
+def unit_enabled(props):
+    return props.get('UnitFileState', '').startswith(('enabled', 'linked', 'alias'))
+
+
 def web_doctor():
     """`lanes doctor`'s browser/phone lines -> [(mark, text)], mark ✓ | ⚠ | ✗ (LNS-50). One bounded
     `systemctl --user show` for both web units, a read of the running lanes-web's environment, `tailscale status --json`
@@ -2294,20 +3987,14 @@ def web_doctor():
     if not shutil.which('systemctl'):
         lines.append(('⚠', 'web units not checked — no systemctl on this host (`lanes web` needs systemd user services)'))
     else:
-        argv = ['systemctl', '--user', 'show', '-p', 'Id', '-p', 'LoadState', '-p', 'ActiveState', '-p', 'UnitFileState',
-                '-p', 'MainPID', *WEB_UNITS]
-        rc, out, err = L.run_bounded(argv, 10, env=clean_env())
-        if rc != 0:
-            lines.append(('✗', f"web units NOT checked — systemctl --user {'did not answer in 10 s' if rc is None else err.strip() or f'exit {rc}'}"))
+        units, why = unit_properties(WEB_UNITS)
+        if units is None:
+            lines.append(('✗', f'web units NOT checked — systemctl --user {why}'))
         else:
-            units = {}
-            for block in out.strip().split('\n\n'):
-                props = dict(line.partition('=')[::2] for line in block.splitlines() if '=' in line)
-                units[props.get('Id', '')] = props
             for unit in WEB_UNITS:
                 props = units.get(unit, {})
                 active = props.get('ActiveState') or 'unknown'
-                enabled = props.get('UnitFileState', '').startswith(('enabled', 'linked', 'alias'))
+                enabled = unit_enabled(props)
                 enabled_any = enabled_any or enabled
                 if enabled and active == 'active':
                     lines.append(('✓', f'{unit} active'))
@@ -2352,6 +4039,469 @@ def web_doctor():
     return lines
 
 
+# ------------------------------------------------------------------ doctor: the docs service (W10 W8, LNS-109)
+DOCS_UNIT = 'lanes-docsd.service'
+DOCS_PROBE_S = 2                    # seconds the loopback connect to lanes-docsd may take
+ENABLE_DOCS = 'install/enable-docs.sh'
+
+
+def home_shown(path, home=None):
+    """`path` as `~/…` under the home, else as it is (plain)."""
+    try:
+        return plain(f'~/{Path(path).relative_to(Path(home) if home is not None else Path.home())}')
+    except (ValueError, KeyError, RuntimeError):
+        return plain(path)
+
+
+def byte_size(count):
+    """A size for a person: `812 B`, `3.4 KiB`, `17.0 MiB`, `1.2 GiB`."""
+    if count < 1024:
+        return f'{count} B'
+    for unit in ('KiB', 'MiB', 'GiB'):
+        count /= 1024
+        if count < 1024 or unit == 'GiB':
+            return f'{count:.1f} {unit}'
+
+
+def tree_bytes(root):
+    """(regular files, their bytes) under the directory `root`, never through a link (a link at `root` itself counts
+    nothing); (0, 0) when it does not exist. Unreadable entries are skipped."""
+    if os.path.islink(root):
+        return 0, 0
+    files = total = 0
+    stack = [os.fspath(root)]
+    while stack:
+        try:
+            with os.scandir(stack.pop()) as entries:
+                for entry in entries:
+                    try:
+                        if entry.is_dir(follow_symlinks=False):
+                            stack.append(entry.path)
+                        elif entry.is_file(follow_symlinks=False):
+                            files, total = files + 1, total + entry.stat(follow_symlinks=False).st_size
+                    except OSError:
+                        continue
+        except OSError:
+            continue
+    return files, total
+
+
+def docs_port():
+    """(port, None): the port lanes-docsd listens on — LANES_DOCS_PORT from its drop-in (docs_store.unit_environment,
+    the files `lanes upload` reads too), else docsd.DEFAULT_PORT — or (None, why) for a setting that is not a port."""
+    value = libexec_module('docs_store').unit_environment().get('LANES_DOCS_PORT') or ''
+    if not value:
+        return libexec_module('docsd').DEFAULT_PORT, None
+    if value.isdigit() and 0 < int(value) <= 65535:
+        return int(value), None
+    return None, f'LANES_DOCS_PORT={plain(value)[:20]} in its drop-in is not a port number'
+
+
+def port_answers(port, timeout=DOCS_PROBE_S):
+    """Whether 127.0.0.1:<port> accepts a TCP connection within `timeout` s. It connects and closes without sending a
+    byte, so lanes-docsd answers nothing and writes no docs.log line (its handler reads an empty request line)."""
+    import socket as sockets
+    try:
+        with sockets.create_connection(('127.0.0.1', port), timeout=timeout):
+            return True
+    except OSError:
+        return False
+
+
+def docs_unit_line(probe):
+    restart = f'journalctl --user -u {DOCS_UNIT}; systemctl --user restart {DOCS_UNIT}'
+    if not shutil.which('systemctl'):
+        return ('⚠', f'{DOCS_UNIT} not checked — no systemctl on this host')
+    units, why = unit_properties([DOCS_UNIT])
+    if units is None:
+        return ('✗', f'{DOCS_UNIT} NOT checked — systemctl --user {why}')
+    props = units.get(DOCS_UNIT, {})
+    active, enabled = props.get('ActiveState') or 'unknown', unit_enabled(props)
+    if active != 'active':
+        if enabled:
+            return ('✗', f'{DOCS_UNIT} enabled but {plain(active)} — {restart}')
+        return ('⚠', f'{DOCS_UNIT} not enabled, so there is no docs page — the full server install enables it (an '
+                     f'update with --update-only enables nothing): systemctl --user enable --now {DOCS_UNIT}')
+    port, why = docs_port()
+    if port is None:
+        return ('✗', f'{DOCS_UNIT} active, but {why} — fix it with systemctl --user edit {DOCS_UNIT}')
+    where = f'127.0.0.1:{port}'
+    if not probe(port):
+        return ('✗', f'{DOCS_UNIT} active, but {where} does not answer — {restart}')
+    if not enabled:
+        return ('⚠', f'{DOCS_UNIT} active on {where} but not enabled: a reboot loses it — systemctl --user enable '
+                     f'{DOCS_UNIT}')
+    return ('✓', f'{DOCS_UNIT} active, answering on {where}')
+
+
+def docs_pin_line():
+    """The pin gate as docsd reads it on every request (enrold.read_mode): an operator gate, so never a ✗."""
+    mode, problem = libexec_module('enrold').read_mode()
+    if mode == 'request':
+        return ('✓', 'docs: pinned — lanes-docsd answers members through Tailscale Serve (lanes enrol mode request)')
+    said = problem or ('pinned invite only' if mode == 'invite' else 'unpinned: auto')
+    return ('⚠', f'docs: refuses until the Serve header check is pinned ({plain(said)}): every request is 403 '
+                 'not-pinned — run the check (RUNBOOK "Enrolment service", Operator verification), then lanes enrol '
+                 'mode request (RUNBOOK "Docs service")')
+
+
+def docs_store_line(home=None):
+    D = libexec_module('docs_store')
+    counts = D.read_counts()
+    documents = sum(entry['n'] for entry in counts.values())
+    _files, size = tree_bytes(D.root())
+    try:
+        log = f'docs.log {byte_size(D.log_path().lstat().st_size)}'
+    except FileNotFoundError:
+        log = 'no docs.log yet'
+    except OSError as error:
+        log = f'docs.log not readable ({error.strerror or error})'
+    return ('', f"docs store: {documents} document{'' if documents == 1 else 's'} in {len(counts)} "
+                f"lane{'' if len(counts) == 1 else 's'} (counts.json), {byte_size(size)} under "
+                f'{home_shown(D.root(), home)}; {log}')
+
+
+def docs_mermaid_line(home=None):
+    """holders.lock's opt-in `mermaid` pin against the file install/enable-docs.sh installs: the member digest, read
+    without following a link or blocking on a FIFO."""
+    import hashlib
+    SH = libexec_module('studio_host')
+    script = f"sh {home_shown(L.CURRENT, home)}/{ENABLE_DOCS}"
+    try:
+        pin = SH.parse_lock((L.REPO / 'holders.lock').read_text()).get('mermaid')
+        why = 'no mermaid line' if pin is None else '' if pin.opt_in else 'the mermaid line is not an opt-in pin'
+    except (OSError, ValueError, SH.Refusal) as error:
+        pin, why = None, str(error)
+    if why:
+        return ('✗', f'docs: Mermaid not checked — {L.REPO / "holders.lock"}: {plain(why)}')
+    target = L.SHARE / 'vendor' / f'mermaid-{pin.version}.min.js'
+    shown, version = home_shown(target, home), plain(pin.version)
+    try:
+        fd = os.open(target, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK | getattr(os, 'O_CLOEXEC', 0))
+    except FileNotFoundError:
+        return ('⚠', f'docs: Mermaid {version} not installed ({shown}), so diagrams show as source — run {script} '
+                     '(every server install and update runs it)')
+    except OSError as error:
+        return ('✗', f'docs: Mermaid {version} refused — {shown} is not a regular file '
+                     f'({error.strerror or error}) — {script} replaces it from a verified download')
+    try:
+        if not stat.S_ISREG(os.fstat(fd).st_mode):
+            return ('✗', f'docs: Mermaid {version} refused — {shown} is not a regular file — {script} replaces it '
+                         'from a verified download')
+        digest = hashlib.sha256()
+        for chunk in iter(lambda: os.read(fd, 1 << 20), b''):
+            digest.update(chunk)
+    finally:
+        os.close(fd)
+    actual = digest.hexdigest()
+    if actual != pin.binary_sha256:
+        return ('✗', f'docs: Mermaid {version} refused — {shown} is not the pinned build (sha256 {actual[:12]}…, '
+                     f'holders.lock {pin.binary_sha256[:12]}…): browsers refuse it by its integrity, so diagrams '
+                     f'show as source — {script} replaces it from a verified download')
+    return ('✓', f'docs: Mermaid {version} pinned ({shown}, sha256 {actual[:12]}…)')
+
+
+def docs_age_line():
+    """The store's encryption switch (docs_store.age_settings: this environment, else lanes-docsd's drop-in, as
+    `lanes upload` reads it) and the `age` on this PATH. The recipient is never printed."""
+    D = libexec_module('docs_store')
+    binary = D.age_binary()
+    has = f'age at {plain(binary)}' if binary else 'no age binary on PATH'
+    try:
+        recipient, identity = D.age_settings()
+    except D.DocsError as error:
+        return ('✗', f'docs: age encryption NOT usable — {error}: every upload and publish fails until it is fixed '
+                     f'({home_shown(D.dropin_dir())})')
+    if recipient is None:
+        return ('', f'docs: age encryption off (LANES_DOCS_AGE_RECIPIENT unset; {has})')
+    if binary is None:
+        return ('✗', 'docs: age encryption on (LANES_DOCS_AGE_RECIPIENT set) but there is no age binary on PATH: every '
+                     'upload and publish fails (encrypt-failed) — install age or remove the setting (the server '
+                     'install refuses it)')
+    opens = ('lanes-docsd opens them with LANES_DOCS_AGE_IDENTITY' if identity else
+             'no LANES_DOCS_AGE_IDENTITY, so their downloads answer 409 encrypted')
+    return ('✓', f'docs: age encryption on — new store copies are age output ({has}); {opens}')
+
+
+def docs_doctor(home=None, probe=None):
+    """`lanes doctor`'s docs lines (W10 W8, LNS-109) -> [(mark, text)], mark ✓ | ✗ | ⚠ | '' (information), in this
+    order; read-only (one bounded `systemctl --user show`, one loopback connect, file reads):
+      lanes-docsd.service — enabled, active and its loopback port (docs_port) accepting a connection ✓ · enabled but not
+        active, or active while its port refuses ✗ · active but not enabled ⚠ (a reboot loses it) · not enabled ⚠ (the
+        full server install enables it; an update with --update-only enables nothing) · systemctl silent ✗ · no
+        systemctl ⚠. `probe` (port -> bool) stands in for port_answers.
+      the pin gate — `request` ✓ `docs: pinned` · else ⚠ `docs: refuses until the Serve header check is pinned`
+      the store — information: documents and lanes from counts.json, the bytes under docs/, docs.log's size
+      the Mermaid pin — the pinned member digest ✓ · absent ⚠ (run install/enable-docs.sh) · another digest or not a
+        regular file ✗ (refused: browsers refuse it by its integrity) · no valid pin ✗
+      the `age` switch — unset: information · set with an `age` on PATH ✓ · set without one, or no recipient ✗"""
+    home = Path(home) if home is not None else Path.home()
+    return [docs_unit_line(port_answers if probe is None else probe), docs_pin_line(), docs_store_line(home),
+            docs_mermaid_line(home), docs_age_line()]
+
+
+# ------------------------------------------------------------------ doctor: the release that runs (W9 V3, LNS-85)
+# `lanes version` says which tree each process last started from; doctor judges it, with the reference `lanes version`
+# uses (the tree the `current` link names; this tree when there is none). A run record outlives its process, so only a
+# record whose process runs now is a fault (a stopped economy poller keeps its last one); a lanes process that runs
+# with NO record started from a release before the records (W9 U0) — what a server install that only `enable --now`s
+# statusd leaves running. Layouts and units are judged by the tree they resolve to; a layout that names the current tree
+# by another path than `lanes rebuild` writes now (a pinned pkg/<version> written before W9 U1, which writes through
+# `current`) is a warning: it runs the current tree, but the next update leaves its views behind.
+
+# record_tree names by the script their process runs, in the argv Lanes starts it with (every release so far): the
+# units' `/usr/bin/python3 -S -E <tree>/libexec/<script> …` and the sidebar wrapper's `python3 -S -E
+# <tree>/libexec/sidebar.py …`. Anything else that names the file — an editor, a pager, a grep, the script run by
+# hand another way — and a one-shot that never records (RUN_ONESHOTS) is not that daemon (DEF-1785). studio_host
+# records a oneshot step (install/enable-studio-host.sh), never a running process.
+RUN_SCRIPTS = {'statusd': 'statusd.py', 'enrold': 'enrold.py', 'docsd': 'docsd.py', 'notify': 'notify.py',
+               'economy': 'economy_poll.py', 'sidebar': 'sidebar.py'}
+RUN_INTERPRETER = re.compile(r'python3(?:\.\d+)?')   # argv[0]'s name, by path or not: python3, a versioned python3.N
+RUN_FLAGS = ['-S', '-E']                             # the interpreter flags of every launch, in this order
+# The arguments that make a run a one-shot that never records, as each record_tree comment names them. statusd reads
+# its first argument itself (`sys.argv[1] == '--once'`); notify and economy_poll use argparse, which takes the option
+# anywhere and by any prefix it can tell apart (`--dry`; none of these prefixes another option of its script).
+RUN_ONESHOTS = {'statusd': ('--once',), 'notify': ('--test',), 'economy': ('--once', '--dry-run')}
+RUN_FIRST_ARGUMENT = {'statusd'}
+RUN_UNITS = {'statusd': 'lanes-statusd.service', 'enrold': 'lanes-enrold.service', 'docsd': 'lanes-docsd.service',
+             'notify': 'lanes-notify.service', 'economy': 'lanes-economy.service'}   # what restarts each daemon; a sidebar restarts with its view
+LAYOUT_COMMAND = re.compile(r'command=("(?:[^"\\]|\\.)*")')     # q(): a JSON string
+LAYOUT_FILES = L.LAYOUT_FILES                                   # the tree files a generated layout runs
+UNIT_ENTRY = re.compile(r'"@REPO@/([^"]+)"')                    # a unit template's tree file (install/services.py)
+CURRENT_SHOWN = '~/' + L.CURRENT_LINK
+
+
+def run_name(argv):
+    """The RUN_SCRIPTS name of the daemon a process with this `argv` is, or None. It is one only in the shape Lanes
+    starts it: argv[0] a python3 interpreter, then exactly RUN_FLAGS, then an absolute `<tree>/libexec/<script>`, and
+    no one-shot among the script's arguments, read as that script reads them."""
+    if len(argv) < 4 or not RUN_INTERPRETER.fullmatch(os.path.basename(argv[0])) or argv[1:3] != RUN_FLAGS \
+            or not os.path.isabs(argv[3]):
+        return None
+    name = next((name for name, script in RUN_SCRIPTS.items() if argv[3].endswith('/libexec/' + script)), None)
+    args, oneshots = argv[4:], RUN_ONESHOTS.get(name, ())
+    if name in RUN_FIRST_ARGUMENT:
+        oneshot = bool(args) and args[0] in oneshots
+    else:
+        oneshot = any(len(word) > 2 and flag.startswith(word) for word in args for flag in oneshots)
+    return None if oneshot else name
+
+
+def lanes_processes(table):
+    """The RUN_SCRIPTS names of this account's daemons that run now, from a `ps -eo pid=,comm=,args=` table. A row that
+    names a /libexec/<script> is only a candidate: its argv is read from /proc/<pid>/cmdline — the words as exec'd, a
+    tree path with a space intact, where the table joins them with spaces — and judged by run_name, for a /proc/<pid>
+    that is this account's (gone since the sweep: none)."""
+    found = set()
+    for line in table.splitlines():
+        pid, _, rest = line.strip().partition(' ')
+        if not pid.isdigit() or not any(f'/libexec/{script}' in rest for script in RUN_SCRIPTS.values()):
+            continue
+        try:
+            if (PROC / pid).stat().st_uid != os.geteuid():
+                continue
+            cmdline = (PROC / pid / 'cmdline').read_bytes()
+        except OSError:
+            continue
+        words = cmdline[:-1] if cmdline.endswith(b'\0') else cmdline   # each word NUL-terminated
+        name = run_name([os.fsdecode(word) for word in words.split(b'\0')])
+        if name is not None:
+            found.add(name)
+    return found
+
+
+def current_doctor(report, home=None):
+    """(mark, text): `current` names a tree that exists, whose VERSION agrees with its staged `<version>` directory name
+    (an npm-staged tree, L.staged_tree: `pkg/<version>`, or `$LANES_PKG_ROOT/<version>` with the stamp) and its npm
+    stamp, and that this lanes runs."""
+    tree, current = os.path.realpath(report['tree']), report['current']
+    if current is None:
+        return ('⚠', f'no {CURRENT_SHOWN} link (the server installer writes it): layouts, units and run records are '
+                     f'compared with this tree, {tree_shown(tree, home)}')
+    shown = tree_shown(current, home)
+    if not os.path.isdir(current):
+        return ('✗', f'current → {shown} does not exist — re-run the server installer')
+    version = L.tree_version(current)
+    if version is None:
+        return ('✗', f'current → {shown} has no VERSION — re-run the server installer')
+    named = Path(current).name if L.staged_tree(current) else version
+    stamped = (L.tree_stamp(current) or {}).get('version') or version
+    if (named, stamped) != (version, version):
+        return ('✗', f'current → {shown}, but its VERSION says {plain(version)}'
+                     + (f' and its npm stamp {plain(stamped)}' if stamped != version else '')
+                     + ' — re-run the server installer')
+    if current != tree:
+        return ('✗', f'current → {shown} ({plain(version)}), but this lanes runs {tree_shown(tree, home)} '
+                     f'({plain(report["version"])}) — run {CURRENT_SHOWN}/bin/lanes; when ~/.local/bin/lanes is this '
+                     'one, re-run the server installer')
+    return ('✓', f'current → {shown} ({plain(version)}), the release this lanes runs')
+
+
+def records_doctor(report, table, reference, home=None):
+    """[(mark, text)]: every lanes process that runs has a record of the current code. A record whose process is not
+    running is information, never a fault; without a process table (`table` None) every daemon's counts."""
+    running = report['running']
+    live = lanes_processes(table) if table is not None else set(RUN_SCRIPTS)
+    faults, stopped, restart = [], [], []
+    for name, record in running.items():
+        if record['current']:
+            continue
+        if name in live:
+            faults.append(f'{plain(name)} {record_said(record, reference, home)}')
+            restart.append(name)
+        else:
+            stopped.append(f'{plain(name)} {record_said(record, reference, home, past=True)}')
+    if table is not None:
+        for name in [name for name in RUN_ORDER if name in live and name not in running]:
+            faults.append(f'{name} runs without a run record (started by an older release)')
+            restart.append(name)
+    lines = []
+    if faults:
+        units = [RUN_UNITS[name] for name in RUN_ORDER if name in restart and name in RUN_UNITS]
+        hints = ([f"systemctl --user restart {' '.join(units)}"] if units else []) + \
+                (['lanes rebuild <device>'] if 'sidebar' in restart else [])
+        lines.append(('✗', 'processes run the current release — ' + '; '.join(faults)
+                      + ('' if table is not None else ' (the process table was not read: every older record counts)')
+                      + (' — ' + '; '.join(hints) if hints else '')))
+    else:
+        fresh = [plain(name) for name, record in running.items() if record['current']]
+        lines.append(('✓', 'processes run the current release' + (': ' + ' '.join(fresh) if fresh else '')))
+    if stopped:
+        lines.append(('', 'not running now, so not judged (a record stays until its process starts again): '
+                          + '; '.join(stopped)))
+    return lines
+
+
+def layout_commands(text):
+    """The pane commands of a generated layout's text, in order, as q() wrote them (a JSON string after `command=`);
+    one that does not decode is skipped."""
+    commands = []
+    for match in LAYOUT_COMMAND.finditer(text):
+        try:
+            commands.append(json.loads(match.group(1)))
+        except ValueError:
+            continue
+    return commands
+
+
+def layout_trees(text):
+    """The trees a generated layout runs: each pane command naming one of LAYOUT_FILES, without that file."""
+    trees = []
+    for command in layout_commands(text):
+        for name in LAYOUT_FILES:
+            if command.endswith('/' + name) and command[:-len(name) - 1] not in trees:
+                trees.append(command[:-len(name) - 1])
+    return trees
+
+
+def layout_tree_now():
+    """The tree path `lanes rebuild` writes into a layout now, read from the generator itself: L.CURRENT (W9 U1) —
+    the `current` link for a staged tree it names, else this tree's own path."""
+    return layout_trees('\n'.join(workspace_tab_kdl('probe', {'id': 'probe', 'title': 'probe'})))[0]
+
+
+def layouts_doctor(reference, home=None):
+    """(mark, text): each device's layout (devices/<device>.json with a layouts/<device>.kdl) runs the current tree
+    (✗ with `lanes rebuild <device>`), through the path `lanes rebuild` writes now (⚠ when it names the current tree by
+    another path). A layout that runs no tree file (or none at all) says nothing."""
+    now, faults, pinned, fresh = layout_tree_now(), [], {}, []
+    for meta in sorted((L.STATE / 'devices').glob('*.json')):
+        device = plain(meta.stem)
+        try:
+            trees = layout_trees((L.STATE / 'layouts' / f'{meta.stem}.kdl').read_text())
+        except (OSError, ValueError):
+            continue
+        if not trees:
+            continue
+        other = [tree for tree in trees if os.path.realpath(tree) != reference]
+        if other:
+            ran = [plain(L.tree_version(tree) or tree_shown(tree, home)) for tree in other]
+            faults.append((device, f"{device} runs {', '.join(ran)}"))
+            continue
+        fresh.append(device)
+        for tree in trees:
+            if tree != now:
+                pinned.setdefault(tree_shown(tree, home), []).append(device)
+    if faults:
+        return ('✗', 'view layouts run the current release — ' + '; '.join(said for _device, said in faults)
+                     + ' — ' + '; '.join(f'lanes rebuild {device}' for device, _said in faults))
+    if pinned:
+        devices = list(dict.fromkeys(device for named in pinned.values() for device in named))
+        return ('⚠', '; '.join(f"view layouts of {' '.join(named)} name {shown} by its own path"
+                               for shown, named in pinned.items())
+                     + f', not as lanes rebuild writes them now ({tree_shown(now, home)}): the next update leaves those '
+                       'views on it — ' + '; '.join(f'lanes rebuild {device}' for device in devices))
+    return ('✓', 'view layouts run the current release' + (': ' + ' '.join(fresh) if fresh else ''))
+
+
+def unit_dirs(home=None):
+    """Where install/services.py writes the units: the user manager's $XDG_CONFIG_HOME/systemd/user (this shell's
+    XDG_CONFIG_HOME stands in for it: doctor never asks systemctl here) and ~/.config/systemd/user."""
+    home = Path(home) if home is not None else Path.home()
+    xdg = os.environ.get('XDG_CONFIG_HOME', '')
+    folders = ([Path(xdg) / 'systemd/user'] if xdg.startswith('/') else []) + [home / '.config/systemd/user']
+    return list(dict.fromkeys(folders))
+
+
+def unit_trees(home=None):
+    """{unit: tree or None} for each lanes unit of this release whose template's ExecStart runs a tree file
+    (`"@REPO@/<file>"`) and that is installed (the first of unit_dirs that has it): the tree its ExecStart names,
+    unescaped as services.unit_value escaped it, or None when it names no `<tree>/<file>` (written by hand)."""
+    found = {}
+    for template in sorted((L.REPO / 'systemd').glob('lanes*.service')):
+        entry = next((UNIT_ENTRY.search(line) for line in template.read_text().splitlines()
+                      if line.startswith('ExecStart=') and UNIT_ENTRY.search(line)), None)
+        if entry is None:
+            continue
+        pattern = re.compile(r'"((?:[^"\\]|\\.)*)/' + re.escape(entry.group(1)) + '"')
+        for folder in unit_dirs(home):
+            try:
+                text = (folder / template.name).read_text()
+            except (OSError, ValueError):
+                continue
+            match = next((pattern.search(line) for line in text.splitlines()
+                          if line.startswith('ExecStart=') and pattern.search(line)), None)
+            found[template.name] = (re.sub(r'\\(.)', r'\1', match.group(1).replace('$$', '$').replace('%%', '%'))
+                                    if match else None)
+            break
+    return found
+
+
+def units_doctor(reference, home=None):
+    """(mark, text): every installed lanes unit's ExecStart runs the current tree (✗: re-run the server installer)."""
+    trees = unit_trees(home)
+    if not trees:
+        shown = ' or '.join(tree_shown(folder, home) for folder in unit_dirs(home))
+        return ('⚠', f'lanes units not checked: none in {shown} (the server installer writes them)')
+    other = {}
+    for unit, tree in trees.items():
+        if tree is None:
+            other.setdefault(None, []).append(unit)
+        elif os.path.realpath(tree) != reference:
+            other.setdefault(plain(L.tree_version(tree) or tree_shown(tree, home)), []).append(unit)
+    if not other:
+        return ('✓', f'lanes units run the current release ({len(trees)} units)')
+    said = []
+    for ran, units in other.items():
+        names, one = ' '.join(units[:3]) + (' …' if len(units) > 3 else ''), len(units) == 1
+        said.append(f"{names} name{'s' if one else ''} no lanes tree" if ran is None else
+                    f"{len(units)} unit{'' if one else 's'} run{'s' if one else ''} {ran} ({names})")
+    return ('✗', 'lanes units run the current release — ' + '; '.join(said) + ' — re-run the server installer')
+
+
+def release_doctor(table, home=None):
+    """`lanes doctor`'s release lines -> [(mark, text)], mark ✓ | ✗ | ⚠ | '' (information) (W9 V3, LNS-85): `current`
+    and its VERSION, the run records against the processes in `table` (`ps -eo pid=,comm=,args=`; None when ps did
+    not answer), the device layouts, the units, then the updates (W9 U3: libexec/update.py doctor_line, with the unit
+    folders it looks for lanes-update.timer's enable link in; no line without an installed release). Read-only: files
+    and the one process table doctor already swept."""
+    report = version_report(home=home)
+    reference = report['current'] or os.path.realpath(report['tree'])
+    updates = libexec_module('update').doctor_line(L.STATE, home, units=unit_dirs(home))
+    return [current_doctor(report, home), *records_doctor(report, table, reference, home),
+            layouts_doctor(reference, home), units_doctor(reference, home), *([updates] if updates else [])]
+
+
 def cmd_doctor(_args):
     problems = 0
 
@@ -2449,6 +4599,18 @@ def cmd_doctor(_args):
         print('  view sessions:', ', '.join(sorted(live_sessions())) or 'none')
     except (OSError, L.LanesError) as error:
         check(False, 'zellij reachable', str(error))
+    # Cockpit v3 R2 (LNS-75): a device nobody owns follows no profile — its look and seen marks stay its own. Owner as
+    # device_owner derives it (a member record, its machine's for a window, or a recorded claim); a warning, never a ✗.
+    ownerless = []
+    for meta_file in sorted((L.STATE / 'devices').glob('*.json')):
+        meta = L.read_json(meta_file)
+        if (L.IDENT.match(meta_file.stem) and len(meta_file.stem) <= 32
+                and not device_owner(meta_file.stem, meta if isinstance(meta, dict) else {})):
+            ownerless.append(meta_file.stem)
+    if ownerless:
+        print(f'⚠ devices without an owner: {", ".join(ownerless[:8])}{" …" if len(ownerless) > 8 else ""} — each keeps '
+              'its look and seen marks to itself; `lanes device claim <device> --login <login>` names one (`lanes keys '
+              'owner <device> <login>` when members/ holds its key)')
     stale_pickers = stale_picker_layouts()
     check(not stale_pickers, 'phone picker panes report their own title (DEF-1531)',
           'built from a layout that names the picker pane, so the phone shows no counts; upgrade-session does not '
@@ -2458,6 +4620,19 @@ def cmd_doctor(_args):
             print(f'⚠ {text}')
         else:
             check(mark == '✓', text)
+    # The docs service (W10 W8, LNS-109): lanes-docsd and its port, the pin gate, the store, the Mermaid pin, `age`.
+    for mark, text in docs_doctor():
+        if mark in ('⚠', ''):
+            print(f'{mark or " "} {text}')
+        else:
+            check(mark == '✓', text)
+    # The release that runs (W9 V3): `current`, the run records against the one process-table sweep above, the
+    # device layouts, the units.
+    for mark, text in release_doctor(table if rc == 0 else None):
+        if mark in ('⚠', ''):
+            print(f'{mark or " "} {text}')
+        else:
+            check(mark == '✓', text)
     print('PRESSURE')
     health = L.compute_health()
     print('\n'.join(pressure_lines(health, L.read_json(L.STATE / 'containers.json') or {})))
@@ -2472,7 +4647,11 @@ def cmd_rename(args):
     Rename a lane's display name.
     - Unregistered sessions: writes user-sessions metadata + updates resolve.dynamic.
     - Registered sessions (adopted): writes the record's name in registered-sessions.json and publishes.
-    - Repository lanes: writes a displayNames override to the workspace manifest and syncs the registry.
+    - Repository lanes: writes a displayNames override to the workspace manifest and syncs the registry. Two layers
+      name such a lane (LNS-33): this host override wins over the container's own `lanes.terminals[<name>]
+      .displayName` in terminals.json, which rename never writes; renaming back to the lane's default (that
+      container name when declared, else the terminal's title) removes the override. The id never changes. A
+      container name another lane of the board answers to is not that lane's default: the reader drops it.
     """
     if len(args) < 2:
         raise L.LanesError('usage: lanes rename <lane-id> <new-name>')
@@ -2512,8 +4691,11 @@ def cmd_rename(args):
     if not lane.get('repo'):
         raise L.LanesError('No repository for this lane; set displayNames in the workspace manifest manually')
     registry_name = lane.get('registry_name') or lane.get('name', '')
-    SA.rename_registered(L.manifest_path(workspace_obj['id']), lane['repo'], registry_name, new_name)
-    cmd_sync([])   # rebuild registry so all consumers see the new name
+    SA.rename_registered(L.manifest_path(workspace_obj['id']), lane['repo'], registry_name, new_name,
+                         declared_display=lane.get('declared_display'))
+    _failed, refused = sync_registry()   # rebuild registry so all consumers see the new name
+    if refused:   # saved and published, except where a container refused its own `~/.lz/registry.json` (DEF-1796)
+        raise L.ProjectionRefused('Rename', refused)
     print(f"renamed registered lane {lane_id!r} ({registry_name!r}) → {new_name!r}")
     return 0
 
@@ -2555,11 +4737,9 @@ def preview_renderer():
     return 'less -R (no glow on the view server PATH; ./install.sh --server installs the pinned one)'
 
 
-def focused_view(device):
-    """(view device, workspace, slot) behind the focused pane of `device`'s active tab. The floating preview pane holds
-    the focus while this runs, so the TILED view pane zellij marks focused decides; a focused sidebar (or none
-    marked) means the tab's first viewport. A tab without a board (Host, tools) is said, never guessed."""
-    import shlex
+def view_listings(device):
+    """(tabs, panes): `zellij action list-tabs -j` and `list-panes -j -a` of `device`'s view session. Raises when either
+    did not answer or is not JSON: an unknown listing is never an empty one."""
     listings = []
     for action in ('list-tabs', 'list-panes'):
         rc, out, err = zellij(['-s', device, 'action', action, '-j'] + (['-a'] if action == 'list-panes' else []), 10)
@@ -2569,10 +4749,26 @@ def focused_view(device):
             listings.append(json.loads(out))
         except ValueError:
             raise L.LanesError(f'zellij answered {action} for {device} with something that is not JSON')
-    tabs, panes = listings
-    active = next((t.get('tab_id') for t in tabs if isinstance(t, dict) and t.get('active')), None)
-    view_sh, sidebar = str(L.REPO / 'libexec/view.sh'), str(L.REPO / 'libexec/sidebar')
-    views, boards = [], []
+    return listings[0], listings[1]
+
+
+def active_tab(tabs):
+    """The tab_id list-tabs marks active, else None (a session no client is attached to marks none, measured)."""
+    return next((t.get('tab_id') for t in tabs if isinstance(t, dict) and t.get('active')), None)
+
+
+def active_tab_panes(device, listings=None):
+    """[(kind, (view device, workspace, slot), focused)] for the board panes of `device`'s active tab, TILED only (a
+    floating pane — the Run pane asking — is never one): kind `view` (a viewport's view.sh; its slot) or `sidebar`
+    (slot 'main'). Two bounded zellij listings (view_listings), or `listings` when the caller already holds them. While
+    a floating pane holds the focus, zellij 0.45.1 still marks the tiled pane under it focused (measured 2026-10-06,
+    cockpit v3 S4), which is what `focused` reports."""
+    import shlex
+    tabs, panes = listings or view_listings(device)
+    active = active_tab(tabs)
+    # By tree file, never by this CLI's tree path (W9 U1): the panes may run the pkg/<version> tree of a layout built
+    # before, the `current` link of one built since, or a checkout (lanes_lib.tree_file_at).
+    found = []
     for pane in panes:
         if not isinstance(pane, dict) or pane.get('is_plugin') or pane.get('is_floating') or pane.get('tab_id') != active:
             continue
@@ -2580,17 +4776,29 @@ def focused_view(device):
             args = shlex.split(pane.get('terminal_command') or pane.get('pane_command') or '')
         except ValueError:
             continue
-        for script in (view_sh, sidebar):
-            tail = args[args.index(script) + 1:] if script in args else []
+        for script in ('libexec/view.sh', 'libexec/sidebar'):
+            at = L.tree_file_at(args, script)
+            tail = args[at + 1:] if at is not None else []
             if len(tail) < 2 or not all(L.IDENT.match(part) for part in tail[:2]):
                 continue
-            if script == view_sh:
+            if script == 'libexec/view.sh':
                 slot = tail[2] if len(tail) > 2 and tail[2] in SLOTS else 'main'
-                views.append((not pane.get('is_focused'), SLOTS.index(slot), (tail[0], tail[1], slot)))
+                found.append(('view', (tail[0], tail[1], slot), bool(pane.get('is_focused'))))
             else:
-                boards.append((tail[0], tail[1], 'main'))
+                found.append(('sidebar', (tail[0], tail[1], 'main'), bool(pane.get('is_focused'))))
+    return found
+
+
+def focused_view(device, listings=None):
+    """(view device, workspace, slot) behind the focused pane of `device`'s active tab. The floating preview pane holds
+    the focus while this runs, so the TILED view pane zellij marks focused decides; a focused sidebar (or none
+    marked) means the tab's first viewport. A tab without a board (Host, tools) is said, never guessed. `listings`:
+    view_listings(device) when the caller already holds them (`lanes edit` reads them once, for its guard first)."""
+    panes = active_tab_panes(device, listings)
+    views = [(not focused, SLOTS.index(where[2]), where) for kind, where, focused in panes if kind == 'view']
     if views:
         return min(views)[2]
+    boards = [where for kind, where, _focused in panes if kind == 'sidebar']
     if boards:
         return boards[0]
     raise L.LanesError('the focused tab shows no board (Host or a tool tab): nothing to preview')
@@ -2707,7 +4915,8 @@ def cmd_preview(args):
 # closes when it exits. They used to walk the focus left three times and type J/K into whatever pane that reached
 # (the sidebar, or — on a tab without one — the lane itself). Now nothing is typed and no focus moves: the viewport
 # zellij marks focused is pointed at the neighbouring lane exactly as the sidebar's open_lane points it
-# (lanes_lib.show_lane), and a lane with an agent is marked seen on the device as open_lane marks it.
+# (lanes_lib.show_lane), and a lane with an agent is marked seen on the device as open_lane marks it — and, on a device
+# with an owner, in that person's profile too (cockpit v3 R3, mark_profile_seen).
 
 
 def step_lane(args, step):
@@ -2738,12 +4947,34 @@ def step_lane(args, step):
     status = (L.read_json(L.STATE / 'status.json') or {}).get('lanes') or {}
     agent = (status.get(lane_id) or {}).get('agent') if isinstance(status, dict) else None
     if isinstance(agent, dict) and agent:
-        L.record_seen(L.STATE / 'clients' / f'{view_device}.seen.json', lane_id, agent.get('since'), set(status))
+        seen = L.record_seen(L.STATE / 'clients' / f'{view_device}.seen.json', lane_id, agent.get('since'), set(status))
+        mark_profile_seen(view_device, lane_id, seen[lane_id], verb)
     if not L.show_lane(str(L.STATE / 'views' / view_device), workspace, slot, lane_id):
         print('view not running yet')
     return 0
 
 
+def mark_profile_seen(device, lane_id, at, verb):
+    """`lanes next|prev` opened a lane with an agent on `device` (cockpit v3 R3, LNS-76): on a device with an owner the
+    mark and `last_opened` {lane, device, at} also go to that person's profile (users.update as the device, its 1 s
+    lock), as the sidebar's mark_seen writes them, so their other devices leave Done on the next tick. The device's own
+    seen file was already written. A dropped write (a busy or unreadable profile) is said on stderr and changes nothing
+    else: the lane is still shown, and seen on this device. -> False only for that drop."""
+    login = profile_for(device)
+    if not login:
+        return True
+    users = libexec_module('users')
+
+    def mark(profile):
+        profile['seen'][lane_id] = max(at, profile['seen'].get(lane_id, at))
+        profile['last_opened'] = {'lane': lane_id, 'device': device, 'at': at}
+    if users.update(login, device, mark):
+        return True
+    print(f"lanes {verb}: {login}'s profile was busy or cannot be written (`lanes user show {login}` says why) — "
+          f'{lane_id} is seen on {device} only', file=sys.stderr)
+    return False
+
+
 def cmd_next(args):
     return step_lane(args, +1)
 
@@ -2752,13 +4983,333 @@ def cmd_prev(args):
     return step_lane(args, -1)
 
 
-COMMANDS = {'rebuilt': cmd_rebuilt, 'hello': cmd_hello, 'client-config': cmd_client_config, 'cursor-commit': cmd_cursor_commit, 'upgrade-session': cmd_upgrade_session, 'upload-requests': cmd_upload_requests, 'upload-result': cmd_upload_result, 'upload': cmd_upload, 'workspaces': cmd_workspaces, 'cursor-sync': cmd_cursor_sync, 'reattach': cmd_reattach, 'gc': cmd_gc, 'install-container': cmd_install_container, 'open': cmd_open, 'sync': cmd_sync, 'ls': cmd_ls, 'resolve': cmd_resolve, 'status': cmd_status, 'layout': cmd_layout,
+# ------------------------------------------------------------------ sidebar-key
+# Ctrl-Alt-/ and Ctrl-Alt-u (zellij/config.kdl, cockpit v3 S4) walk the focus left to the sidebar, then run
+# `lanes sidebar-key filter|upload --focused` in a floating pane that closes when it exits. They used to end in
+# WriteChars "/" / "U", which typed into whatever pane held the focus by then — on a tab without a sidebar (Host,
+# Throttle, the phone's view tab) the pane itself, a shell or an agent's input. Now nothing is typed: the key is a
+# file, views/<device>/<ws>.sidebar.cmd (DM-LANES-SIDEBAR-CMD, lanes_lib.send_sidebar_key), written only for a sidebar
+# on the active tab that holds the focus; that sidebar acts on it within a tick and before the next key it reads.
+
+
+def cmd_sidebar_key(args):
+    key = args[0] if args else ''
+    if key not in L.SIDEBAR_KEYS or '--focused' not in args[1:]:
+        print('usage: lanes sidebar-key filter|upload --focused [--device D]   (Ctrl-Alt-/ and Ctrl-Alt-u run this)')
+        return 2
+    device = args[args.index('--device') + 1] if '--device' in args else os.environ.get('ZELLIJ_SESSION_NAME', '')
+    try:
+        device = device_name(device)
+        sidebars = [(where, focused) for kind, where, focused in active_tab_panes(device) if kind == 'sidebar']
+        if not sidebars:
+            raise L.LanesError('this tab has no sidebar (Host or a tool tab): nothing to do')
+        (view_device, workspace, _slot), focused = sidebars[0]
+        if not focused:
+            raise L.LanesError('the sidebar does not have the focus (it was in a floating pane): nothing to do')
+    except L.LanesError as error:
+        print(f'lanes sidebar-key: {error}')
+        return 1
+    L.send_sidebar_key(L.STATE / 'views' / view_device, workspace, key)
+    return 0
+
+
+# ------------------------------------------------------------------ edit
+# Ctrl-Alt-e (zellij/config.kdl, W9 E1, LNS-95) runs `lanes edit --focused` in a floating pane named EDIT_PANE. Zellij
+# has no single-instance Run (LaunchOrFocus is for plugins only) and catches Ctrl-Alt-e in every unlocked mode,
+# whichever pane has the focus (the open editor's included), so each press opens one more pane. Two editors on one
+# file lose work: the one quit last writes its stale buffer over the other's save, and only vim and nvim warn (swap
+# files). So the verb is its own guard, before it resolves anything: one Edit pane per view session (DEF-1793).
+
+EDIT_PANE = 'Edit'   # the binding's `name`; test_server_cli EditWiring pins the two to one value
+
+
+def edit_pane(pane):
+    """Whether a list-panes entry is an Edit pane: a live terminal pane zellij started as `lanes edit` (it keeps the
+    command it started, renamed or embedded since), or a floating one named EDIT_PANE (zellij keeps a given name over
+    the title its program sets: measured 0.45.1, an OSC 2 title left `title` "Edit"). A TILED pane titled Edit is
+    not one: a pane without a given name shows whatever title its program set."""
+    if not isinstance(pane, dict) or pane.get('is_plugin') or pane.get('exited'):
+        return False
+    words = str(pane.get('terminal_command') or '').split()   # zellij joins the Run argv with spaces (measured)
+    if len(words) >= 2 and Path(words[0]).name == 'lanes' and words[1] == 'edit':
+        return True
+    return bool(pane.get('is_floating')) and pane.get('title') == EDIT_PANE
+
+
+def edit_pane_open(device, tabs, panes):
+    """The Edit pane already open in `device`'s view session that this process does not run in, or None; one in the
+    active tab first. This process's own pane is ZELLIJ_PANE_ID (zellij gives each pane it starts its bare terminal
+    id, measured 0.45.1) when it runs in that session; run by hand, or with --device from another session, every
+    Edit pane counts. Every other one counts whichever is older: two presses at once both stand down (press again)
+    rather than both open an editor."""
+    own = os.environ.get('ZELLIJ_PANE_ID', '') if os.environ.get('ZELLIJ_SESSION_NAME') == device else ''
+    own = own.removeprefix('terminal_')
+    others = [pane for pane in (panes if isinstance(panes, list) else [])
+              if edit_pane(pane) and (not own or str(pane.get('id')) != own)]
+    active = active_tab(tabs)
+    others.sort(key=lambda pane: active is None or pane.get('tab_id') != active)
+    return others[0] if others else None
+
+
+def edit_defer(device, tabs, pane):
+    """Hand this press to the Edit pane already open. In the active tab it gets the focus and this pane closes (exit
+    0, nothing said); in another tab, or when zellij will not focus it, it is named and the pane waits for Enter
+    (exit 1). Either way nothing opens."""
+    active = active_tab(tabs)
+    if active is not None and pane.get('tab_id') == active:
+        rc, _out, err = zellij(['-s', device, 'action', 'focus-pane-id', f"terminal_{pane.get('id')}"], 5)
+        if rc == 0:
+            return 0
+        where = f'in this tab, and zellij did not focus it ({err.strip() or "no answer"})'
+    else:
+        name = next((t.get('name') for t in tabs if isinstance(t, dict) and t.get('tab_id') == pane.get('tab_id')), '')
+        where = f'in tab "{name}"' if name else 'in another tab'
+    print(f'An Edit pane is already open {where}. One per view: quit that editor, then press Ctrl-Alt-e again.')
+    preview_hold()
+    return 1
+
+
+# Past the guard (W9 E2, LNS-96): the focused lane as `lanes preview` finds it (tmux lanes; the container by the
+# registry's name and the init pid statusd recorded in containers.json: no docker inspect), the git checkout its
+# working directory is in (lanes_lib.repo_roots, through /proc/<init>/root), the files below offered in a one-key
+# picker painted with the sidebar's tokens, and the editor started INSIDE the container as uid 1000 (`coder`) by
+# execvp, argv only: `docker exec -it -u coder -w <checkout> ... <container> ~/.lz/bin/lane-edit <path>` (E3, LNS-97).
+# No file is created. `.env.local` is named by its label, never by its path, in anything printed.
+
+EDIT_FILES = ('AGENTS.md', 'CLAUDE.md')     # the checkout's own pair, then the main checkout's when it is another one
+EDIT_ENV_FILE = '.env.local'                 # the main checkout's only
+EDIT_MAIN = ' (main checkout)'               # the label suffix of a main-checkout file when the lane is in a worktree
+LANE_EDIT = L.CONTAINER_HOME + '/.lz/bin/lane-edit'   # where cmd_install_container copies container/lane-edit
+EDIT_QUIT = (b'', b'q', b'Q', b'\x1b', b'\x03', b'\x04')   # end of input, q, Esc, Ctrl-C, Ctrl-D (raw mode)
+
+
+def edit_candidate(root, checkout, name, label):
+    """{label, root, container_path, present} for the file `name` of the container checkout `checkout`. Present only
+    as a regular file that is no symbolic link, inside the checkout once both are resolved in the container
+    (lanes_lib.container_realpath), on a path without control characters. Any error reads as not present and is never
+    printed (it would carry the path)."""
+    path, base = posixpath.join(checkout, name), checkout
+    present = False
+    if not L.CONTROL_CHARS.search(path):
+        try:
+            base = L.container_realpath(root, checkout)
+            path = posixpath.join(L.container_realpath(root, posixpath.dirname(path)), name)
+        except L.LanesError:
+            base = None
+        found = L.container_lstat(root, path) if base else None
+        present = bool(found and stat.S_ISREG(found.st_mode) and path.startswith(base.rstrip('/') + '/'))
+    return {'label': label, 'root': base or checkout, 'container_path': path, 'present': present}
+
+
+def edit_candidates(roots, root):
+    """The files quick edit offers for (worktree root, main checkout), in picker order: AGENTS.md and CLAUDE.md of the
+    worktree, the main checkout's pair when it is another folder, then the main checkout's .env.local."""
+    worktree, main = roots
+    other = main != worktree
+    rows = [(worktree, name, name) for name in EDIT_FILES]
+    rows += [(main, name, name + EDIT_MAIN) for name in EDIT_FILES] if other else []
+    rows.append((main, EDIT_ENV_FILE, EDIT_ENV_FILE + (EDIT_MAIN if other else '')))
+    return [edit_candidate(root, checkout, name, label) for checkout, name, label in rows]
+
+
+def edit_roots(lane, board, root):
+    """repo_roots of the lane's working directory (statusd's pane cwd), else of its repository folder, else of its
+    board's cwd: an agent that cd'd out of the checkout still edits its lane's files. The first error when none is in
+    a checkout."""
+    status = ((L.read_json(L.STATE / 'status.json') or {}).get('lanes') or {}).get(lane['id']) or {}
+    tried, first = [], None
+    for cwd in (status.get('cwd'), lane.get('folder'), board.get('cwd')):
+        if not cwd or cwd in tried:
+            continue
+        tried.append(cwd)
+        try:
+            return L.repo_roots(cwd, root)
+        except L.LanesError as error:
+            first = first or error
+    raise first or L.LanesError('the lane has no usable working directory')
+
+
+def edit_look(device):
+    """(SGR table, glyph set) the picker paints with: the device's sidebar look — sidebar.resolve_modes over
+    devices/<device>.json and this pane's environment, then tokens.sgr_table / glyph_set — in the variant its theme
+    names, else the one its sidebar published (clients/<device>.theme), else dark."""
+    tokens = libexec_module('tokens')
+    meta = L.read_json(L.STATE / 'devices' / f'{device}.json')
+    color, theme, glyphs = libexec_module('sidebar').resolve_modes(os.environ, meta if isinstance(meta, dict) else {})
+    if theme not in ('dark', 'light'):
+        try:
+            theme = (L.STATE / 'clients' / f'{device}.theme').read_text().strip()
+        except OSError:
+            theme = ''
+    return tokens.sgr_table(color, theme if theme in ('dark', 'light') else 'dark'), tokens.glyph_set(glyphs)
+
+
+def edit_picker(name, roots, candidates, tone, glyphs):
+    """The picker: the lane and its checkout(s), one numbered row per candidate (a missing one dim, `not present`, its
+    number never taken), and the keys. Nothing present: the rows and `Nothing to edit in …` instead of the keys."""
+    reset, dim, sep = tone['reset'], tone['ink-dim'], f" {glyphs['marks']['sep']} "
+    worktree, main = roots
+    lines = [f"{tone['ink']}{tone['bold']}Edit{sep}{plain(name)}{reset}", f'{dim}  {plain(worktree)}{reset}']
+    if main != worktree:
+        lines.append(f'{dim}  main checkout {plain(main)}{reset}')
+    lines.append('')
+    for number, row in enumerate(candidates, 1):
+        if row['present']:
+            lines.append(f"  {tone['accent']}{number}{reset}  {tone['ink']}{plain(row['label'])}{reset}")
+        else:
+            lines.append(f"{dim}  {number}  {plain(row['label'])}  not present{reset}")
+    numbers = [str(number) for number, row in enumerate(candidates, 1) if row['present']]
+    lines.append('')
+    if not numbers:
+        lines.append(f'{dim}Nothing to edit in {plain(worktree)}: lanes edit creates no file{reset}')
+    else:
+        keys = f"{numbers[0]} or {glyphs['marks']['enter']}" if len(numbers) == 1 else ' '.join(numbers)
+        lines.append(f'{dim}{keys} edit{sep}q or Esc close{reset}')
+    return '\n'.join(lines) + '\n'
+
+
+@contextlib.contextmanager
+def key_reader(stream=None):
+    """A read() of one key byte (b'' at the end of input). A terminal takes raw input for the duration (one byte, no
+    echo, no Enter needed, Ctrl-C a byte) and is restored after; anything else (a pipe, a test's StringIO) is read as it
+    is. The switch is TCSANOW, never tty.setraw's TCSAFLUSH: a key already typed (while the pane started, or while the
+    picker painted) is the first key read, not discarded (DEF-1836). Output processing stays on (setraw clears OPOST),
+    so the caller paints the picker inside the block: once it shows, the terminal is raw."""
+    stream = stream or sys.stdin
+    try:
+        fd = stream.fileno()
+        terminal = os.isatty(fd)
+    except (AttributeError, OSError, ValueError):
+        terminal = False
+    if not terminal:
+        def read():
+            key = stream.read(1)
+            return key.encode() if isinstance(key, str) else (key or b'')
+        yield read
+        return
+    import termios
+    saved = termios.tcgetattr(fd)
+    raw = termios.tcgetattr(fd)   # tty.setraw's input, control and local flags; its oflag and `when` are not taken
+    raw[0] &= ~(termios.BRKINT | termios.ICRNL | termios.INPCK | termios.ISTRIP | termios.IXON)
+    raw[2] = raw[2] & ~(termios.CSIZE | termios.PARENB) | termios.CS8
+    raw[3] &= ~(termios.ECHO | termios.ICANON | termios.IEXTEN | termios.ISIG)
+    raw[6][termios.VMIN], raw[6][termios.VTIME] = 1, 0
+    try:
+        termios.tcsetattr(fd, termios.TCSANOW, raw)
+        yield lambda: os.read(fd, 1)
+    finally:
+        termios.tcsetattr(fd, termios.TCSADRAIN, saved)
+
+
+def pick_key(candidates, read):
+    """The index of the candidate one key picks, or None to close. `1`…`5` take that row when it is present; Enter takes
+    the only present one (and nothing when several are); q, Esc, Ctrl-C, Ctrl-D and the end of input close; every
+    other key (a missing row's number included) is ignored."""
+    present = [index for index, row in enumerate(candidates) if row.get('present')]
+    while True:
+        key = read()
+        if key in EDIT_QUIT:
+            return None
+        if key in (b'\r', b'\n') and len(present) == 1:
+            return present[0]
+        if len(key) == 1 and key.isdigit() and int(key) - 1 in present:
+            return int(key) - 1
+
+
+def edit_editor(device):
+    """The LANES_EDITOR lane-edit gets: the device's `lanes attach --editor` choice, else this process's LANES_EDITOR
+    (without control characters), else empty (lane-edit then takes the first of micro hx nvim vim vi). The Ctrl-Alt-e
+    pane runs with the view server's environment, which clean_env builds without LANES_EDITOR: there the device's
+    choice is the one that counts; the variable serves a `lanes edit` run by hand."""
+    meta = L.read_json(L.STATE / 'devices' / f'{device}.json')
+    chosen = meta.get('editor') if isinstance(meta, dict) else None
+    if chosen in LOOK_KEYS['--editor'][1] and chosen != 'auto':
+        return chosen
+    value = os.environ.get('LANES_EDITOR', '')
+    return '' if L.CONTROL_CHARS.search(value) else value
+
+
+def edit_argv(container, root, path, editor, label):
+    """`docker exec` of lane-edit on `path` in `container`, as uid 1000 in `root`, argv only (no shell)."""
+    return ['docker', 'exec', '-it', '-u', 'coder', '-w', root, '-e', 'TERM=xterm-256color', '-e', 'COLORTERM=truecolor',
+            '-e', 'LANG=C.UTF-8', '-e', f'LANES_EDITOR={editor}', '-e', f'LANES_EDIT_LABEL={label}', container, LANE_EDIT,
+            path]
+
+
+def edit_container(lane):
+    """(container, /proc/<init>/root) of a running container, from the registry's name and containers.json's pid;
+    refused when it is not running or lane-edit is not installed there."""
+    container = lane.get('container') or ''
+    info = (L.read_json(L.STATE / 'containers.json') or {}).get(container) or {}
+    root = PROC / str(info.get('pid') or 0) / 'root'
+    try:
+        running = bool(info.get('pid')) and stat.S_ISDIR(os.stat(root).st_mode)
+    except FileNotFoundError:
+        running = False
+    except OSError as error:
+        raise L.LanesError(f'container {container}: its files cannot be read through /proc ({error.strerror})')
+    if not running:
+        raise L.LanesError(f'container {container} is not running')
+    found = L.container_lstat(root, L.container_realpath(root, LANE_EDIT))
+    if not (found and stat.S_ISREG(found.st_mode)):
+        raise L.LanesError(f'lane-edit is not installed in {container}: run lanes install-container {container}')
+    return container, root
+
+
+def cmd_edit(args):
+    if '--focused' not in args:
+        print('usage: lanes edit --focused [--device D]   (the Ctrl-Alt-e floating pane runs this)')
+        return 2
+    device = args[args.index('--device') + 1] if '--device' in args else os.environ.get('ZELLIJ_SESSION_NAME', '')
+    try:
+        device = device_name(device)
+        tabs, panes = view_listings(device)
+        other = edit_pane_open(device, tabs, panes)
+        if other is not None:
+            return edit_defer(device, tabs, other)
+        view_device, workspace, slot = focused_view(device, (tabs, panes))
+        board, lane = L.find_lane(L.load_registry(), lane_shown(view_device, workspace, slot))
+        if lane.get('holder') != 'tmux':
+            raise L.LanesError(f"{lane['name']} is a {lane.get('holder')} lane: quick edit opens tmux lanes only")
+        container, root = edit_container(lane)
+        roots = edit_roots(lane, board, root)
+        candidates = edit_candidates(roots, root)
+        tone, glyphs = edit_look(device)
+    except L.LanesError as error:
+        print(f'lanes edit: {error}')
+        preview_hold()
+        return 1
+    picker = edit_picker(lane['name'], roots, candidates, tone, glyphs)
+    if not any(row['present'] for row in candidates):
+        print(picker, end='', flush=True)
+        preview_hold()
+        return 0
+    with key_reader() as read:   # raw before the picker shows: a key pressed once it is on screen is never lost
+        print(picker, end='', flush=True)
+        choice = pick_key(candidates, read)
+    if choice is None:
+        return 0
+    row = candidates[choice]
+    argv = edit_argv(container, row['root'], row['container_path'], edit_editor(device), row['label'])
+    try:
+        os.execvp(argv[0], argv)
+    except OSError as error:   # its text names docker, never the file; the label says which file it was
+        print(f"lanes edit: could not start docker for {row['label']}: {error.strerror or 'failed'}")
+        preview_hold()
+        return 1
+    return 0   # only reached when execvp is a test double
+
+
+COMMANDS = {'rebuilt': cmd_rebuilt, 'hello': cmd_hello, 'client-config': cmd_client_config, 'cursor-commit': cmd_cursor_commit, 'upgrade-session': cmd_upgrade_session, 'upload-requests': cmd_upload_requests, 'upload-result': cmd_upload_result, 'upload': cmd_upload, 'workspaces': cmd_workspaces, 'cursor-sync': cmd_cursor_sync, 'reattach': cmd_reattach, 'reload-views': cmd_reload_views, 'gc': cmd_gc, 'install-container': cmd_install_container, 'open': cmd_open, 'sync': cmd_sync, 'ls': cmd_ls, 'resolve': cmd_resolve, 'status': cmd_status, 'layout': cmd_layout,
             'prepare': cmd_prepare, 'web': cmd_web, 'attach': cmd_attach, 'rebuild': cmd_rebuild, 'ensure': cmd_ensure, 'invariant': cmd_invariant,
             'doctor': cmd_doctor, 'pressure': cmd_pressure, 'sockets': cmd_sockets, 'tmp': cmd_tmp,
-            'guard': cmd_guard, 'rename': cmd_rename, 'register': cmd_register, 'hooks': cmd_hooks, 'economy': cmd_economy,
-            'preview': cmd_preview, 'device': cmd_device, 'next': cmd_next, 'prev': cmd_prev, 'studio-host': cmd_studio_host,
+            'guard': cmd_guard, 'rename': cmd_rename, 'register': cmd_register, 'unregister': cmd_unregister,
+            'hooks': cmd_hooks, 'economy': cmd_economy,
+            'preview': cmd_preview, 'edit': cmd_edit, 'device': cmd_device, 'next': cmd_next, 'prev': cmd_prev,
+            'sidebar-key': cmd_sidebar_key, 'studio-host': cmd_studio_host,
             'keys': cmd_keys, 'invite': cmd_invite, 'enrol': cmd_enrol, 'offboard': cmd_offboard,
-            'token': cmd_token, 'onboard': cmd_onboard}
+            'token': cmd_token, 'onboard': cmd_onboard, 'user': cmd_user, 'lane': cmd_lane, 'here': cmd_here,
+            'version': cmd_version, 'update': cmd_update, 'docs': cmd_docs}
 
 if __name__ == '__main__':
     if len(sys.argv) < 2 or sys.argv[1] not in COMMANDS: