agentbox-app 0.1.13 → 0.1.16

package/main/memory-gate-server.mjs

@@ -95,6 +95,11 @@ export class MemoryGateServer {
     socketPath = defaultSocketPath(),
     historyFile = null,
     history = null,
+    // One appended line per grant, so what the slots cost can be read later.
+    // Without it the only duration anywhere is a transcript's, which is waiting
+    // and running added together and cannot be separated.
+    grantLogFile = null,
+    grantLogMaxBytes = 4 * 1024 * 1024,
     gate = {},
     scoreFor = null,
     // WHOSE CODEX THREAD IS THIS (w-e5225b62ba). A Claude worker carries its row
@@ -128,6 +133,8 @@ export class MemoryGateServer {
   } = {}) {
     this.socketPath = socketPath;
     this.historyFile = historyFile;
+    this.grantLogFile = grantLogFile;
+    this.grantLogMaxBytes = grantLogMaxBytes;
     this.history = history ?? loadHistory(historyFile);
     this.clock = clock;
     this.idleReleaseMs = idleReleaseMs;
@@ -355,6 +362,10 @@ export class MemoryGateServer {
         res.end('');
       } else {
         this.counts.refused++;
+        this._writeGrant({
+          refused: true, cls: decision.cls, waitMs: decision.waitedMs, ranMs: null, peakMb: null,
+          pressure: decision.pressure, command,
+        });
         res.end(denyOutput(decision.reason));
       }
     });
@@ -372,6 +383,16 @@ export class MemoryGateServer {
     this.grants.delete(id);
     const was = this.gate.finish(id);
     if (!was) return;
+    this._writeGrant({
+      refused: false,
+      cls: was.cls,
+      waitMs: was.waitedMs ?? 0,
+      ranMs: this.clock() - was.startedAt,
+      peakMb: grant?.ambiguous ? null : was.peakMb,
+      shared: !!grant?.ambiguous,
+      pressure: was.pressureAt,
+      command: was.command,
+    });
     // A SHARED READING IS NOT NO READING (w-5601e99977). Every Codex thread of
     // a login runs under one `codex app-server`, so two Codex commands at once
     // are measured together and neither may claim the figure. How long each
@@ -500,6 +521,47 @@ export class MemoryGateServer {
     this.lastPids = new Set(procs.map((p) => p.pid));
   }
 
+  /**
+   * One line per grant: what it was, how long it queued, how long it ran and
+   * its measured peak. `shared` says the peak is null because two commands on
+   * one agent process were measured together, without which a week of this
+   * reads as two commands where there was one.
+   *
+   * Every shell command on the Mac waits on this path, so a write that fails
+   * is logged and swallowed rather than returned to the agent.
+   */
+  _writeGrant({ refused, cls, waitMs, ranMs, peakMb, shared = false, pressure = null, command }) {
+    if (!this.grantLogFile) return;
+    try {
+      if (this.grantBytes === undefined) {
+        try { this.grantBytes = fs.statSync(this.grantLogFile).size; } catch { this.grantBytes = 0; }
+      }
+      // Bounded, and the one before it is kept, so a week is still readable
+      // across the two even when a busy day fills one.
+      if (this.grantBytes >= this.grantLogMaxBytes) {
+        fs.renameSync(this.grantLogFile, `${this.grantLogFile}.1`);
+        this.grantBytes = 0;
+      }
+      const line = `${JSON.stringify({
+        t: this.clock(),
+        cls: cls ?? null,
+        waitMs: Number.isFinite(waitMs) ? waitMs : null,
+        ranMs: Number.isFinite(ranMs) ? ranMs : null,
+        peakMb: Number.isFinite(peakMb) ? peakMb : null,
+        // Only a wait that happened while this was `normal` is evidence about
+        // the slot count; under `tight` nothing heavy starts whatever it is.
+        pressure: pressure ?? null,
+        ...(shared ? { shared: true } : {}),
+        ...(refused ? { refused: true } : {}),
+        cmd: String(command ?? '').slice(0, 300),
+      })}\n`;
+      fs.appendFileSync(this.grantLogFile, line);
+      this.grantBytes += Buffer.byteLength(line);
+    } catch (err) {
+      this.log(`memory gate: could not write the grant log: ${err.message}`);
+    }
+  }
+
   _saveHistory() {
     if (!this.historyFile || !this.dirty) return;
     try {

package/main/memory-gate.mjs

@@ -206,7 +206,15 @@ export class MemoryGate {
     for (const w of [...this.waiting.values()]) {
       if (now - w.arrived >= this.maxWaitMs) {
         this.waiting.delete(w.id);
-        for (const r of w.replies) r({ allow: false, reason: refusal(now - w.arrived, this.pressure) });
+        for (const r of w.replies) {
+          r({
+            reason: refusal(now - w.arrived, this.pressure),
+            allow: false,
+            cls: w.cls,
+            waitedMs: now - w.arrived,
+            pressure: this.pressure,
+          });
+        }
       }
     }
     if (this.pressure === 'critical') return;
@@ -241,6 +249,11 @@ export class MemoryGate {
     this.running.set(w.id, {
       id: w.id, item: w.item, product: w.product, command: w.command, cls: w.cls,
       urgent: w.urgent, session: w.session, background: w.background, startedAt: now, peakMb: null, shared: null,
+      // Only the coordinator reads these, to write down what the grant cost.
+      // The pressure is what makes the wait mean anything: under `normal` only
+      // full slots can hold a command back, so the wait is evidence about
+      // `slots`; under `tight` nothing heavy starts whatever the count is.
+      waitedMs: now - w.arrived, pressureAt: this.pressure,
     });
     for (const r of w.replies) r({ allow: true, cls: w.cls });
   }

package/main/menu.mjs

@@ -159,8 +159,10 @@ export function installMenu({ onApproval, onReload, onZoom } = {}) {
     {
       label: 'Agents',
       submenu: [
-        { label: 'Allow Pending Approval', accelerator: 'Command+Y', click: () => onApproval?.(true) },
-        { label: 'Deny Pending Approval', accelerator: 'Command+N', click: () => onApproval?.(false) },
+        // CommandOrControl like every other accelerator here: Command alone
+        // left the approval card's hint naming two dead keys on Linux.
+        { label: 'Allow Pending Approval', accelerator: 'CommandOrControl+Y', click: () => onApproval?.(true) },
+        { label: 'Deny Pending Approval', accelerator: 'CommandOrControl+N', click: () => onApproval?.(false) },
       ],
     },
     {

package/main/message-priority.mjs

@@ -48,8 +48,8 @@ export function wantsPriority(item, product, me) {
   // AND NEVER OVER THE LEVEL THE SENDER PICKED (w-7ba439c883). A message now
   // crosses carrying how urgent the person who wrote it thought it was, and a
   // guess from here would overwrite it: the sender's line is composeItem's, so
-  // it claims no authority the fold would defend, and a level written from here
-  // counts for nothing anyway (an agent's tag, shared/rank.mjs itemPriority).
+  // it claims no authority the fold would defend, and a guess from here is not
+  // what the sender said.
   // A row nobody chose a level for is composeItem's 0, so a number above it is
   // exactly "somebody picked one", and `by` says it was not this Mac.
   if (set?.by && set.by !== me && Number.isFinite(item.priority) && item.priority > 0) return false;

package/main/mic.mjs

@@ -0,0 +1,38 @@
+// Getting the microphone with one press, for a voice note.
+//
+// macOS asks on behalf of the app that opened Agentbox (Terminal, when it is
+// run from a checkout), and once that app has been refused it never shows its
+// Allow box again: asking just answers no. So the press clears that one
+// refusal, for that one app and the microphone only, and asks again, which
+// brings the Allow box back. Only ever on the press, never on its own.
+import { execFile } from 'node:child_process';
+
+export const SETTINGS_URL = 'x-apple.systempreferences:com.apple.preference.security?Privacy_Microphone';
+
+const NAMES = {
+  'com.apple.Terminal': 'Terminal',
+  'com.googlecode.iterm2': 'iTerm',
+  'com.microsoft.VSCode': 'VS Code',
+  'dev.warp.Warp-Stable': 'Warp',
+  'com.mitchellh.ghostty': 'Ghostty',
+};
+
+/** The app macOS asks about, from the bundle id macOS gave this process. */
+export function micOwner(env = process.env) {
+  const id = env.__CFBundleIdentifier;
+  if (typeof id !== 'string' || !/^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)+$/.test(id)) return { id: null, name: null };
+  return { id, name: NAMES[id] ?? id.split('.').at(-1) };
+}
+
+/** 'granted', or 'settings' once the Settings page has been opened instead. */
+export async function getMic({ systemPreferences, openExternal, owner = micOwner(), run = execFile }) {
+  const status = systemPreferences.getMediaAccessStatus('microphone');
+  if (status === 'granted') return 'granted';
+  if (status === 'denied' && owner.id) {
+    await new Promise((resolve) => run('tccutil', ['reset', 'Microphone', owner.id], { timeout: 10_000 }, () => resolve()));
+  }
+  const granted = await systemPreferences.askForMediaAccess('microphone').catch(() => false);
+  if (granted) return 'granted';
+  openExternal(SETTINGS_URL);
+  return 'settings';
+}

package/main/new-chats-watch.mjs

@@ -0,0 +1,110 @@
+// NEW CHATS COME IN ON THEIR OWN, when somebody ticked "Keep bringing in new
+// chats from Claude Code and Codex" on setup's last screen or turned it on in
+// Settings (`importNew`, from the moment `importNewSince`).
+//
+// A chat comes in when it was started after that moment, in a folder one of
+// the projects points at, and has gone quiet. Claude Code may still have it
+// open: people leave it open for hours, and a reply here to an open chat
+// carries on a copy (Supervisor#importedThreadFor). It is filed the way setup
+// files one: waiting on you to Needs you, finished to Done. Nothing asks about
+// a chat first; asking rows are what the old Codex watch was removed for.
+import { productsForThread } from '../shared/codex-import.mjs';
+import { isShared } from '../shared/team-rules.mjs';
+import { appSessionFolders } from './agent-homes.mjs';
+import { outsideAgentsMode } from './settings.mjs';
+import { claudeSessionOpen } from './claude-session-open.mjs';
+import { readCodexThreadsOffThread } from './codex-threads.mjs';
+import { readRecentThreads } from './importable-threads.mjs';
+
+export const NEW_CHATS_POLL_MS = 60_000;
+/** How long a chat has to have been still before it comes in. */
+export const QUIET_MS = 10 * 60_000;
+const PASS_DEADLINE_MS = 90_000;
+
+function idsWithRows(items) {
+  const ids = new Set();
+  for (const item of items ?? []) {
+    for (const label of item?.labels ?? []) {
+      if (typeof label !== 'string') continue;
+      if (label.startsWith('thread:')) ids.add(label.slice(7));
+      else if (label.startsWith('codex:')) ids.add(label.slice(6));
+    }
+  }
+  return ids;
+}
+
+/** Which of `threads` come in now, grouped by the project each lands in. */
+export function newChatsToBring(threads, { products, items, since, now, isOpen = () => false, openShownLive = false }) {
+  const had = idsWithRows(items);
+  const bySlug = new Map();
+  for (const t of threads ?? []) {
+    const id = String(t?.id ?? '').trim();
+    if (!id || had.has(id)) continue;
+    if (!(Number(t.startedAt) > since)) continue;
+    if (now - Number(t.when ?? 0) < QUIET_MS) continue;
+    if (t.source === 'codex' ? t.live : openShownLive && isOpen(t)) continue;
+    const slug = productsForThread(t, products)[0]?.slug;
+    if (!slug) continue;
+    if (!bySlug.has(slug)) bySlug.set(slug, []);
+    bySlug.get(slug).push(t);
+    had.add(id);
+  }
+  return bySlug;
+}
+
+export async function scanNewChats({ store, config, readThreads, isOpen, now = Date.now() }) {
+  if (config?.importNew !== true) return { brought: 0 };
+  const since = Number(config.importNewSince) || now;
+  // Only as far back as the switch, and never further than the import card reads.
+  const days = Math.min(10, Math.max(1, Math.ceil((now - since) / 86400e3) + 1));
+  // Never a project shared with a team: teammates would read chats nobody chose to share.
+  const products = store.listProducts().filter((p) => !isShared(p));
+  const folders = products.map((p) => p.repoPath).filter(Boolean);
+  const threads = await readThreads({ days, since, folders, now });
+  // An open session already has its own row when "Show while they run" is on.
+  const openShownLive = outsideAgentsMode(config) !== 'off';
+  const picks = newChatsToBring(threads, { products, items: store.listItems(), since, now, isOpen, openShownLive });
+  let brought = 0;
+  for (const [slug, list] of picks) {
+    brought += store.importThreadRows(slug, list, { now, land: 'sorted' }).added;
+    brought += store.importCodexThreads(slug, list, { now, land: 'sorted' }).added;
+  }
+  return { brought };
+}
+
+export function startNewChatsWatch({
+  store, config, readThreads, isOpen,
+  everyMs = NEW_CHATS_POLL_MS, firstDelayMs = 30_000, deadlineMs = PASS_DEADLINE_MS, log = console.warn,
+}) {
+  // One pass at a time, and a pass that never answers is given up on so the
+  // next one still runs.
+  let running = null;
+  const run = () => {
+    if (running) return running;
+    let timer = null;
+    const deadline = new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new Error(`no answer in ${Math.round(deadlineMs / 1000)}s`)), deadlineMs);
+    });
+    running = Promise.race([scanNewChats({ store, config, readThreads, isOpen }), deadline])
+      .catch((e) => log('new chats watch:', e?.message ?? e))
+      .finally(() => { clearTimeout(timer); running = null; });
+    return running;
+  };
+  const first = setTimeout(run, firstDelayMs);
+  const timer = setInterval(run, everyMs);
+  return {
+    scanNow: run,
+    stop: () => { clearTimeout(first); clearInterval(timer); },
+  };
+}
+
+/** The watch as the app runs it, on the desktop (main/main.mjs) and in the browser copy (bin/agentbox.mjs). */
+export function watchNewChatsFor({ store, config, supervisor, ...timing }) {
+  return startNewChatsWatch({
+    store,
+    config,
+    readThreads: (opts) => readRecentThreads({ ...opts, config, supervisor, readCodex: readCodexThreadsOffThread }),
+    isOpen: (t) => claudeSessionOpen(t.id, appSessionFolders({ config, supervisor }).dirs),
+    ...timing,
+  });
+}

package/main/new-user-window.mjs

@@ -0,0 +1,25 @@
+// A throwaway copy's window says so, and stands where you can see both.
+//
+// "Open Agentbox as a new user" (main/fresh-user.mjs) launches the app again
+// inside a throwaway home, beside the one it was opened from. The offset is a
+// window's shoulder rather than a tile: the point is to see there are two, with
+// the real one still readable behind. A copy that cannot fit the offset is left
+// centred rather than pushed half off the screen, which a 1440-wide laptop is.
+
+/** How far down and across a second copy stands. */
+export const OFFSET = 48;
+
+/** The window options a copy adds, given whether it is a throwaway one. */
+export function newUserWindow({ fresh, name, screen, width = 1440, height = 900 } = {}) {
+  if (!fresh) return { title: name };
+  const title = `${name} (new user)`;
+  if (!screen) return { title };
+  const centred = {
+    x: Math.round(screen.x + (screen.width - width) / 2),
+    y: Math.round(screen.y + (screen.height - height) / 2),
+  };
+  const x = centred.x + OFFSET;
+  const y = centred.y + OFFSET;
+  if (x + width > screen.x + screen.width || y + height > screen.y + screen.height) return { title };
+  return { title, x, y };
+}

package/main/notify.mjs

@@ -52,10 +52,15 @@ export function markFor({ root, createFromPath }) {
 // with one sound instead of four rewrites and four chimes.
 const COALESCE_MS = 1500;
 
-export function createNotifier({ window, Notification, powerMonitor, icon = null, coalesceMs = COALESCE_MS }) {
+// `onChange` hears that what it has told you about changed: the tray counts
+// all of it (main/corner-tag.mjs), so a banner never speaks for a thread the
+// tray leaves out.
+export function createNotifier({ window, Notification, powerMonitor, icon = null, coalesceMs = COALESCE_MS, onChange = () => {} }) {
   // Everything she has not seen since she last had the window, keyed by id so
   // a repeated push is idempotent. Insertion order is arrival order.
   const unseen = new Map();
+  const toldAt = new Map();
+  const changed = () => { try { onChange(); } catch { /* the tray catches up on its next look */ } };
   let live = null;      // the one notification currently on screen, if any
   let timer = null;
   // HOW MANY TIMES SHE HAS BEEN INTERRUPTED SINCE SHE LAST HAD THE WINDOW.
@@ -83,11 +88,14 @@ export function createNotifier({ window, Notification, powerMonitor, icon = null
   // dropped rather than banked: showing them later, when she steps away, would
   // be telling her about work she already watched arrive.
   const seen = () => {
+    const had = unseen.size > 0;
     unseen.clear();
+    toldAt.clear();
     if (timer) { clearTimeout(timer); timer = null; }
     spoke = false;
     spokeAsk = false;
     takeDown();
+    if (had) changed();
   };
 
   const speak = () => {
@@ -156,34 +164,42 @@ export function createNotifier({ window, Notification, powerMonitor, icon = null
       // Asked before banking anything, so that a burst arriving while she is
       // at the app is dropped rather than saved up for when she leaves.
       if (atTheApp({ focused: focused(), idleMs: idleMs() })) return seen();
+      let banked = false;
       for (const a of arrivals) {
         if (!a || !a.id || unseen.has(a.id)) continue;
         unseen.set(a.id, a);
+        toldAt.set(a.id, Date.now());
+        banked = true;
       }
+      if (banked) changed();
       if (!unseen.size || timer) return;
       timer = setTimeout(speak, coalesceMs);
     },
     // The window came forward. Whatever was on screen is now behind her.
     seen,
+    // What it has told you about, or is about to, since you were last at the
+    // app, and when each arrived.
+    told: () => [...toldAt].map(([id, at]) => ({ id, at })),
     // Tests, and nothing else.
     _pending: () => [...unseen.values()],
     _spoken: () => ({ spoke, spokeAsk }),
   };
 }
 
-// `onArrivals` hears every arrival too, for the phone's alerts
-// (main/phone-link.mjs), which make their own call about speaking.
-export function installNotifier({ app, window, Notification, powerMonitor, ipcMain, nativeImage, onArrivals = () => {} }) {
+// `onArrivals` hears every arrival too, with the inbox they arrived in, for
+// the phone's alerts (main/phone-alerts.mjs), which make their own call.
+const needsYouOf = (payload) => (Array.isArray(payload.needsYou) ? payload.needsYou : []);
+export function installNotifier({ app, window, Notification, powerMonitor, ipcMain, nativeImage, onArrivals = () => {}, onChange = () => {} }) {
   if (Notification.isSupported && !Notification.isSupported()) {
-    ipcMain.handle('zero:notify', (_e, payload = {}) => { try { onArrivals(Array.isArray(payload.arrivals) ? payload.arrivals : []); } catch {} });
-    return { add() {}, seen() {} };
+    ipcMain.handle('zero:notify', (_e, payload = {}) => { try { onArrivals(Array.isArray(payload.arrivals) ? payload.arrivals : [], needsYouOf(payload)); } catch {} });
+    return { add() {}, seen() {}, told: () => [] };
   }
   // app.getAppPath() is the repo from source and the asar inside the bundle
   // when it is packaged, and the mark sits at the same place in both.
   const icon = nativeImage
     ? markFor({ root: app.getAppPath(), createFromPath: (p) => nativeImage.createFromPath(p) })
     : null;
-  const notifier = createNotifier({ window, Notification, powerMonitor, icon });
+  const notifier = createNotifier({ window, Notification, powerMonitor, icon, onChange });
   window.on('focus', () => notifier.seen());
   // Unlocking with Agentbox already the front app never fires 'focus' (it never
   // lost it), so without this the banner that fired while the screen was
@@ -191,7 +207,7 @@ export function installNotifier({ app, window, Notification, powerMonitor, ipcMa
   try { powerMonitor.on('unlock-screen', () => { if (window.isFocused()) notifier.seen(); }); } catch {}
   ipcMain.handle('zero:notify', (_e, payload = {}) => {
     const arrivals = Array.isArray(payload.arrivals) ? payload.arrivals : [];
-    try { onArrivals(arrivals); } catch {}
+    try { onArrivals(arrivals, needsYouOf(payload)); } catch {}
     notifier.add(arrivals);
   });
   return notifier;

package/main/phone-alerts.mjs

@@ -0,0 +1,117 @@
+// ALERTS ON HER PHONE'S LOCK SCREEN, SENT BY THIS MAC.
+//
+// The arrivals are the desktop banner's (main/notify.mjs, from App.tsx's
+// inbox), and so are the rules (shared/notify-rules.mjs): nothing while she
+// has used this Mac in the last five minutes, once per stretch away, once
+// more for a permission card. They go out from the phone pass, after it has
+// published, so the thread an alert opens is already on the phone. The
+// server-side sender in docs/mobile/PLAN.md, which alerts with every Mac
+// shut, is a later phase.
+//
+// The words are the phone banner's (phoneBanner): the thread's title in bold,
+// asked for on 2026-10-13 and again on 2026-10-23, and nothing else of it.
+import { atTheComputer, shouldSpeak, phoneBanner } from '../shared/notify-rules.mjs';
+
+export const EXPO_PUSH = 'https://exp.host/--/api/v2/push/send';
+// Arrivals this close together are one alert.
+export const FOLD_MS = 3000;
+const DEADLINE_MS = 10_000;
+const ALERTED_KEPT_MS = 30 * 24 * 3600_000;
+
+// renderer/src/phone-rows.ts phoneSlug, which the phone opens a thread by.
+const phoneSlugOf = (device, project) => `${project}@${device}`;
+const stampOf = (item) => `${item.status ?? ''}:${item.wrote?.status?.ts ?? item.updatedAt ?? ''}`;
+
+/** One request for every phone; Expo answers a ticket for each, in order. */
+export async function sendToExpo(messages, { fetchImpl = fetch, url = EXPO_PUSH, deadlineMs = DEADLINE_MS } = {}) {
+  const res = await fetchImpl(url, { method: 'POST', headers: { 'content-type': 'application/json', accept: 'application/json' }, body: JSON.stringify(messages), signal: AbortSignal.timeout(deadlineMs) });
+  const said = await res.json().catch(() => null);
+  if (!res.ok || !Array.isArray(said?.data)) throw new Error(`Expo answered ${res.status}${said?.errors?.[0]?.message ? `: ${said.errors[0].message}` : ''}`);
+  return said.data;
+}
+
+export function createPhoneAlerts({ backend, owner, device, state, save, now, log, idleMs, send = sendToExpo, still = () => {} }) {
+  state.alerted ??= {};
+  // In memory, as the desktop's banner keeps them: an arrival is news once.
+  const queued = new Map();
+  let firstAt = 0;
+  let needsYou = [];
+  let spoke = false;
+  let spokeAsk = false;
+  const said = new Set();
+  const once = (kind, line) => { if (!said.has(kind)) log(line); said.add(kind); };
+  const away = () => { try { return !atTheComputer({ idleMs: idleMs() }); } catch { return true; } };
+
+  function seen() {
+    queued.clear();
+    spoke = false;
+    spokeAsk = false;
+  }
+
+  /** What the desktop's notifier was told arrived, and the inbox it arrived in. */
+  function arrived(list, inbox = []) {
+    if (!Array.isArray(list) || !list.length) return;
+    if (!away()) return seen();
+    if (Array.isArray(inbox)) needsYou = inbox.filter((r) => r && typeof r.id === 'string' && typeof r.product === 'string');
+    for (const a of list) {
+      if (!a || typeof a.id !== 'string' || typeof a.product !== 'string') continue;
+      const ask = a.kind === 'approval';
+      const item = ask ? a.item : a.id;
+      if (typeof item !== 'string') continue;
+      if (!queued.size) firstAt = now();
+      queued.set(ask ? `ask:${a.id}` : `${a.product}:${a.id}`, { ask, product: a.product, item, title: a.title, thread: a.thread });
+    }
+  }
+
+  // `carried(slug, id)` is the thread's row when the phone has it, else null.
+  async function pass(carried) {
+    if (!away()) return seen();
+    if (!queued.size || now() - firstAt < FOLD_MS) return;
+    const fresh = [];
+    for (const [key, q] of queued) {
+      const row = carried(q.product, q.item);
+      if (!row) continue;
+      const stamp = q.ask ? 'asked' : stampOf(row);
+      if (state.alerted[key]?.stamp !== stamp) fresh.push({ key, stamp, ...q, named: row.title });
+    }
+    queued.clear();
+    if (!fresh.length || !shouldSpeak({ spoke, spokeAsk, waiting: fresh.map((f) => ({ kind: f.ask ? 'approval' : 'item' })) })) return;
+    still();
+    let phones;
+    try { phones = await backend.pushDevices(owner); } catch (err) { once('read', `phone: could not read the phones to alert: ${err?.message ?? err}`); return; }
+    if (!phones.length) return;
+    const threads = [...new Set(fresh.map((f) => `${f.product}\0${f.item}`))];
+    const [product, item] = threads[0].split('\0');
+    const badge = new Set(needsYou.filter((r) => carried(r.product, r.id)).map((r) => `${r.product}\0${r.id}`)).size;
+    const data = threads.length === 1 ? { product: phoneSlugOf(device, product), id: item } : {};
+    const say = phoneBanner(fresh.map((f) => (f.ask
+      ? { kind: 'approval', title: f.title, thread: f.thread || f.named }
+      : { kind: 'item', title: f.title || f.named })));
+    const messages = phones.map((p) => ({ to: p.token, title: say.title, body: say.body, sound: 'default', badge, priority: 'high', channelId: 'default', data }));
+    still();
+    let tickets;
+    try { tickets = await send(messages); } catch (err) { once('send', `phone: could not send an alert: ${err?.message ?? err}`); return; }
+    let reached = 0;
+    for (const [i, t] of (tickets ?? []).entries()) {
+      if (t?.status === 'ok') { reached += 1; continue; }
+      const why = t?.details?.error ?? t?.message ?? 'no answer';
+      if (why === 'DeviceNotRegistered') {
+        try { await backend.dropPushDevice(messages[i].to, owner); } catch (err) { once('drop', `phone: could not forget a phone that stopped taking alerts: ${err?.message ?? err}`); }
+      } else once(`ticket:${why}`, `phone: Expo did not take an alert: ${why}`);
+    }
+    if (!reached) return;
+    said.clear();
+    spoke = true;
+    if (fresh.some((f) => f.ask)) spokeAsk = true;
+    for (const f of fresh) state.alerted[f.key] = { stamp: f.stamp, at: now() };
+    for (const [k, v] of Object.entries(state.alerted)) if (!(now() - (v?.at ?? 0) < ALERTED_KEPT_MS)) delete state.alerted[k];
+    save();
+  }
+
+  return {
+    arrived,
+    pass,
+    /** She answered from her phone, so she has seen what it holds. */
+    phoneUsed: () => { spoke = false; spokeAsk = false; },
+  };
+}