ccdeck 3.22.7 → 3.22.9

package/dist/web/index.html

@@ -40,8 +40,8 @@
         document.documentElement.setAttribute("data-theme", stored === "light" ? "light" : "dark");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-AeLjqiYS.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-D0ZefIva.css">
+    <script type="module" crossorigin src="/assets/index-ZxHH_c65.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-CSxMSfQm.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json

@@ -1,11 +1,9 @@
 {
   "name": "ccdeck",
-  "version": "3.22.7",
+  "version": "3.22.9",
   "description": "Live deck of Claude Code and Codex agents — watch tool calls, token spend and every Claude Code subagent on one calm canvas. Run it with npx ccdeck.",
   "type": "module",
   "bin": {
-    "agents-deck": "bin/agent-dag.js",
-    "agent-dag": "bin/agent-dag.js",
     "ccdeck": "bin/agent-dag.js"
   },
   "files": [

package/src/server/boot-lock.mjs

@@ -0,0 +1,137 @@
+// Two starts at the same moment used to become two decks.
+//
+// THE GAP. A start asks the registry "is one of my decks already up?", and a
+// deck can answer that only once it has written <config>/agent-dag/<pid>.json —
+// which happens after its server has bound and its startup report has run, up
+// to eight seconds later (BOOT_DEADLINE_MS). Two starts inside that window both
+// read an empty registry, both start, and the second finds 4317 taken and takes
+// a random port. The login item and a terminal opened at login are exactly two
+// starts inside one window, and that is how one machine came to show up twice
+// on a colleague's Local network list.
+//
+// So asking and starting become one step: a start takes this lock before it
+// asks, and gives it back only once its own record is on disk. A second start
+// inside the window waits for the first to register, and then finds it.
+//
+// A FILE, CREATED EXCLUSIVELY. `open(…, "wx")` is O_CREAT|O_EXCL on POSIX and
+// CREATE_NEW on Windows: one process wins and everybody else gets EEXIST, on all
+// three platforms and without a native module. It is held for seconds, not for
+// the life of the deck — once a deck is registered the registry and its token
+// handshake already answer "is a deck up", and a lock held forever would need
+// that liveness proof all over again.
+//
+// A HOLDER THAT DIED IS NOT A HOLDER. A start killed inside its boot window
+// leaves the file behind, and the next start must not wait on it forever. Two
+// ways out, and each covers the other's blind spot: the holder's pid no longer
+// answers (a crash), or the lock is older than any boot takes (a pid the OS has
+// recycled into something else, which answers signal 0 forever — #695).
+//
+// One race is left and it is named rather than hidden: two starts that both
+// judge the SAME dead lock stale can interleave so that the second removes the
+// lock the first has just taken. That needs three starts inside one boot window
+// right after a crash, and what it costs is the behaviour every version before
+// this one had.
+//
+// UNGUARDED RATHER THAN STUCK. A directory this process cannot write — a
+// read-only home, a permissions mistake — is answered by starting without the
+// lock, which is also what every earlier version did. Refusing to start a deck
+// over a lock file would be a worse bug than the one this fixes.
+import * as nodeFs from "node:fs";
+import { join } from "node:path";
+import { randomBytes } from "node:crypto";
+import { isProcessAlive } from "./deck-probe.mjs";
+
+/** Beside the registry records, and not a `.json`: hook/hook.js and the stale
+ *  sweep read only `*.json` in that directory, so neither ever sees it. */
+export const BOOT_LOCK_FILE = "boot.lock";
+
+/** Longer than any boot. BOOT_DEADLINE_MS bounds the report at 8s, and a start
+ *  that replaces a running deck spends up to three stop rungs on top of it. */
+export const BOOT_LOCK_STALE_MS = 30_000;
+
+/** An empty lock is one being written this instant — unless it has looked like
+ *  that for longer than a write of forty bytes can take. */
+const HALF_WRITTEN_MS = 2_000;
+
+function readHolder(file, fs) {
+  try {
+    const d = JSON.parse(fs.readFileSync(file, "utf8"));
+    return Number.isInteger(d?.pid) && Number.isFinite(d?.at) ? d : null;
+  } catch {
+    return null;
+  }
+}
+
+function modifiedAt(file, fs) {
+  try { return fs.statSync(file).mtimeMs; } catch { return null; }
+}
+
+/**
+ * Has whoever holds this lock stopped being able to let go of it?
+ *
+ * `self` is here for the recycled-pid case pointed the other way: a lock left by
+ * a dead process whose pid this one now has answers signal 0 — it is us — and
+ * would be waited on until it went stale.
+ */
+export function holderIsGone(holder, { now, alive, staleMs = BOOT_LOCK_STALE_MS, mtime = null, self = process.pid }) {
+  if (!holder) return mtime == null || now - mtime > HALF_WRITTEN_MS;
+  if (holder.pid === self) return true;
+  if (now - holder.at > staleMs) return true;
+  return !alive(holder.pid);
+}
+
+/** Give the lock back, if it is still ours. A lock judged stale and taken by
+ *  somebody else carries their nonce now, and removing it would hand the gap
+ *  straight back to a third start. Idempotent: the second call finds nothing. */
+function release(file, nonce, fs) {
+  try {
+    if (JSON.parse(fs.readFileSync(file, "utf8"))?.nonce !== nonce) return false;
+    fs.unlinkSync(file);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Take the boot lock for this registry directory, waiting for a live holder to
+ * finish booting.
+ *
+ * Resolves `{ held, waited, release }`. `held` is false only on the unguarded
+ * path; `waited` says another start was in its boot window when this one began,
+ * which the caller has no use for beyond the tests. `release` is synchronous so
+ * it can run from a process `exit` handler.
+ */
+export async function takeBootLock({
+  dir,
+  pid = process.pid,
+  now = Date.now,
+  alive = isProcessAlive,
+  staleMs = BOOT_LOCK_STALE_MS,
+  pollMs = 100,
+  fs = nodeFs,
+  sleep = (ms) => new Promise(r => setTimeout(r, ms)),
+} = {}) {
+  const file = join(dir, BOOT_LOCK_FILE);
+  const nonce = randomBytes(8).toString("hex");
+  let waited = false;
+  // 0700 like the registry beside it — installer.mjs asserts the same mode on
+  // the same directory, and whichever runs first creates it.
+  try { fs.mkdirSync(dir, { recursive: true, mode: 0o700 }); } catch { /* the open below decides */ }
+  for (;;) {
+    try {
+      const fd = fs.openSync(file, "wx", 0o600);
+      try { fs.writeSync(fd, JSON.stringify({ pid, at: now(), nonce })); } finally { fs.closeSync(fd); }
+      return { held: true, waited, release: () => release(file, nonce, fs) };
+    } catch (err) {
+      if (err?.code !== "EEXIST") return { held: false, waited, reason: err?.code ?? "open_failed", release: () => false };
+    }
+    const holder = readHolder(file, fs);
+    if (holderIsGone(holder, { now: now(), alive, staleMs, mtime: modifiedAt(file, fs), self: pid })) {
+      try { fs.unlinkSync(file); } catch { /* another start cleared it first */ }
+      continue;
+    }
+    waited = true;
+    await sleep(pollMs);
+  }
+}

package/src/server/installer.mjs

@@ -750,8 +750,8 @@ export async function writeDiscovery({ port, workspace, token, persist = null, c
     // that when the deck on the port is the deck it would itself have built. A
     // `--no-claude` deck has no hooks, no accounts panel and no switcher, and
     // until this field existed it was indistinguishable from one that has all
-    // three. An older deck has no such field, so it is excluded by
-    // construction — see runningDeck.
+    // three. An older deck has no such field, so it never passes for one and is
+    // replaced instead — see secondStart.
     claude: claude !== false,
     // What this deck IS, so a launcher that attaches can say whether the deck
     // it found is the version the user just asked for. Never a decision: a

package/src/server/invoked-as.mjs

@@ -59,8 +59,10 @@ import { bareSpecName, isNpxInstall, npxRestartSpec } from "./self-update.mjs";
  *  invoked-as.test.ts pins them against each other rather than assuming it. */
 export const PREFERRED = "ccdeck";
 
-/** Every command an install of this package provides, which is every name that
- *  can be typed. package.json's `bin` block is the other half of this list. */
+/** Every name somebody can have typed to reach this build. A global install
+ *  provides only `ccdeck` now — package.json's `bin` block — but `npx
+ *  agents-deck` and `npx agent-dag` still reach it through the old packages,
+ *  which depend on it, and those are the runs the notice below is for. */
 export const COMMANDS = [PREFERRED, "agents-deck", "agent-dag"];
 
 /** `value` when it is one of those three, and null for everything else — a shim

package/src/server/lan-sync.mjs

@@ -441,7 +441,27 @@ export function inviteProof(code, transcript) {
  * still reads as two machines when the hostnames differ, which they do.
  */
 export function hostId({ hostname = os.hostname(), home = os.homedir() } = {}) {
-  return createHash("sha256").update(`${hostname}\u0000${home}`).digest("hex").slice(0, 12);
+  return createHash("sha256").update(`${machineName(hostname)}\u0000${home}`).digest("hex").slice(0, 12);
+}
+
+/**
+ * The part of a hostname that names the machine, rather than the network it is
+ * on at the moment.
+ *
+ * macOS answers `os.hostname()` with `Petrus-MacBook-Pro.local` at one moment
+ * and `Petrus-MacBook-Pro` at another, and a DHCP server can hang its own
+ * domain on the end — `.lan`, `.home`, `.fritz.box`. hostId hashed whatever it
+ * was handed, so two decks on one computer started either side of such a change
+ * disagreed about which machine they were on. Sharing a key, each read the other
+ * as an `id-clash` — the copied-~/.claude case beaconVerdict heals — and one of
+ * them took a new key: one machine, two fingerprints, two rows on every
+ * colleague's panel. The first label, case folded, is the name the machine
+ * keeps through all of that. An address used as a hostname is kept whole,
+ * since its first label is only the first octet.
+ */
+export function machineName(hostname) {
+  const h = String(hostname ?? "").trim().toLowerCase().replace(/\.$/, "");
+  return /^\d+(\.\d+){3}$/.test(h) ? h : h.split(".")[0];
 }
 
 export function beaconPayload({ name, fp, port, instance, host }) {

package/src/server/login-service.mjs

@@ -314,6 +314,30 @@ export function lingerState({ platform = process.platform, run = spawnSync, user
   } catch { return "unknown"; }
 }
 
+/**
+ * The variables that decide WHICH deck a start is, for the login item's job.
+ *
+ * A login item runs in the environment the service manager builds, not the
+ * shell's. Somebody who exports CLAUDE_CONFIG_DIR, CCDECK_HOME or CODEX_HOME got
+ * a deck keyed to those directories from the terminal and one keyed to the
+ * defaults at login: two registries that cannot see each other, so two decks
+ * and two LAN keys on one machine — the one-deck rule in running-deck.mjs holds
+ * per registry and cannot reach across. Carried into the job so both starts are
+ * the same deck. Only the ones that are set: an unset variable written into the
+ * job as "" would be a different setting, not the same absent one.
+ *
+ * Windows is not given these. A Task Scheduler job has no environment block in
+ * its XML; it inherits the user's persistent variables, which is where a
+ * Windows user sets them (`setx`) for them to outlive the shell anyway.
+ */
+export const SCOPE_VARS = Object.freeze(["CLAUDE_CONFIG_DIR", "CCDECK_HOME", "CODEX_HOME"]);
+
+export function scopeEnv(env = process.env) {
+  return Object.fromEntries(
+    SCOPE_VARS.filter(k => typeof env?.[k] === "string" && env[k].trim() !== "").map(k => [k, env[k]]),
+  );
+}
+
 /**
  * Write the login item and register it.
  *

package/src/server/running-deck.mjs

@@ -1,4 +1,4 @@
-// Why a second `ccdeck` must not quietly become a second deck.
+// Why a second `ccdeck` must never leave a second deck behind it.
 //
 // THE DEFECT. `startServer` is handed `portRange: [4318, 4400]` and answers a
 // refused bind on 4317 by taking a random port out of it. That fallback is
@@ -15,7 +15,7 @@
 //
 // THE QUESTION IS NOT "IS THE PORT FREE". It is "is one of MY decks already
 // running", and the registry answers that without touching a port: every deck
-// writes ~/.claude/agent-dag/<pid>.json with its pid, port, token and shape.
+// writes <config>/agent-dag/<pid>.json with its pid, port, token and shape.
 //
 // A PID IS NOT EVIDENCE, and that is #695's whole lesson. A record left behind
 // by a deck that is gone — SIGKILL, an OOM kill, a power cut, a console window
@@ -28,12 +28,26 @@
 // seen. A collector, a container, a stranger on a recycled port cannot answer.
 // The deck that wrote the file can.
 //
-// THE DECK FOUND MUST ALSO BE THE DECK WE WOULD HAVE BUILT. Attaching a plain
-// `ccdeck` to a deck started with `--workspace ~/proj` would open a canvas
-// filtered to a directory the user never mentioned, and attaching to a
-// `--no-claude` deck would open one with no accounts panel and no hooks. So the
-// shape is compared field for field, and anything that does not match starts
-// its own deck exactly as before.
+// ONE DECK, WHATEVER THE SHAPE. The first answer to "a deck is up" attached
+// only to a deck that was exactly the one this start would have built, and
+// built a second one beside anything else. So a flag, an older version, or an
+// environment that decided `codex` or the log path differently — a login item
+// runs under the service manager's environment, not the shell's — each left
+// two decks running on one machine, with two LAN keys and two rows on every
+// colleague's panel. It was reported from the field exactly that way. Now a
+// start keeps at most one:
+//
+//   the deck found serves what this start asked for, and is not older  → attach
+//   anything else                                                        → stop it, start
+//
+// The newest start wins, because it is the one somebody just asked for. The
+// rule is secondStart, a function of what is running and what was asked, so it
+// can be pinned without starting a process.
+//
+// PER CLAUDE CONFIG DIRECTORY, which is where the registry lives. For nearly
+// everybody that is one per user; somebody who points CLAUDE_CONFIG_DIR at a
+// second directory has a second registry, and has been getting a second deck
+// with its own identity on purpose since deck-home.mjs was written.
 //
 // WHAT THIS FILE DOES NOT IMPORT: src/server/index.mjs. That module is the whole
 // server, and it arms its timers the moment it is loaded — but this one is read
@@ -63,67 +77,86 @@ export function deckRegistryDir(env = process.env, home = undefined) {
 }
 
 /**
- * The flags that mean "I want a deck of my own", as opposed to "show me the
- * deck".
- *
- * Every one of them changes what the deck IS — which sessions it captures,
- * which log it appends to, which of the two CLIs it serves, which port it
- * binds. A command line carrying any of them is a request that an existing deck
- * cannot satisfy, so it is never answered by attaching to one.
+ * Would this record's deck serve what we were about to build?
  *
- * `--no-open` is deliberately absent: it changes what the LAUNCHER does once it
- * has a URL, not what the deck is, and it is honoured on the attach path too.
- * `--all` is absent because it has been a no-op since it became the default.
+ * Compared field for field rather than by a version or a heuristic. `claude`
+ * and `codex` are strict identity against a boolean, so a record written before
+ * either field existed carries `undefined` and fails — and a deck that old is
+ * replaced rather than attached to, which is what a start does with any deck
+ * it cannot vouch for.
  */
-export const SHAPING_FLAGS = Object.freeze([
-  "port", "workspace", "scope", "history", "noPersist",
-  "codex", "noCodex", "claude", "noClaude",
-]);
+export function sameShape(record, want = {}) {
+  if (!record) return false;
+  return (record.workspace ?? "") === (want.workspace ?? "")
+    && (record.persist ?? null) === (want.persist ?? null)
+    && record.codex === (want.codex !== false)
+    && record.claude === (want.claude !== false);
+}
 
 /**
- * Is this command line one that must build its own deck?
+ * Is `running` a version older than `ours`?
  *
- * Only a shaping flag, and `--new` — the deliberate escape hatch for the person
- * who really does want two.
- *
- * A TYPO IS NOT ONE, and the first version of this had it the other way round.
- * `unknown` and `incomplete` both forced a new deck, on the argument that an
- * attach prints no startup report and would swallow the warning that names the
- * bad token. The consequence of that argument was `ccdeck --stpo` — a typo in
- * the flag that STOPS a deck — building a second one, which is the exact
- * outcome this whole module exists to prevent, reached through the guard meant
- * to protect it.
+ * Numeric, field by field, because "3.9.0" sorts after "3.22.0" as a string. A
+ * running deck that publishes no version at all predates the field, which makes
+ * it older than anything that does. Our own version unreadable is the one case
+ * with nothing to compare, and it answers no: a start that cannot say what it
+ * is has no grounds to replace anything.
+ */
+export function olderVersion(running, ours) {
+  const parse = (v) => {
+    const m = /^(\d+)\.(\d+)\.(\d+)/.exec(String(v ?? ""));
+    return m ? m.slice(1).map(Number) : null;
+  };
+  const o = parse(ours);
+  if (!o) return false;
+  const r = parse(running);
+  if (!r) return true;
+  for (let i = 0; i < 3; i++) if (r[i] !== o[i]) return r[i] < o[i];
+  return false;
+}
+
+/**
+ * Does this running deck already serve what this start asked for?
  *
- * The warning was the real requirement, not the new process, so the attach path
- * prints it instead: see the call to reportUnknownFlags beside the attach in
- * bin/deck.js. Nothing is swallowed, and no misspelling can leave a rival deck
- * on a random port behind it.
+ * The shape, the port when one was named, and a version no older than ours.
+ * `port` is the one `--port` asked for, or null when none was; 0 is "any free
+ * port", which every running deck satisfies.
  */
-export function asksForOwnDeck(flags = {}) {
-  if (flags.new === true) return true;
-  return SHAPING_FLAGS.some((k) => flags[k] !== undefined);
+export function serves(record, { want = {}, port = null, ours = "" } = {}) {
+  return sameShape(record, want)
+    && (port == null || port === 0 || record.port === port)
+    && !olderVersion(record.version, ours);
 }
 
 /**
- * Would this record's deck serve what we were about to build?
+ * What a start does about the decks already running.
  *
- * Compared field for field rather than by a version or a heuristic. `claude`
- * and `codex` are strict identity against a boolean, so a record written before
- * either field existed carries `undefined`, fails, and its deck is left alone —
- * which is the old behaviour, reached by construction rather than by a version
- * check nobody would remember to update.
+ *   { act: "start",   stop: [] }        nothing is running
+ *   { act: "attach",  deck, stop }      open `deck`; stop the rest — leftovers
+ *                                       from before this rule
+ *   { act: "replace", stop }            stop every one of them, then start
+ *   { act: "yield",   deck, stop: [] }  a respawn found somebody else's deck
+ *
+ * `fresh` is `--new`: replace even a deck that would have served. `respawn` is
+ * the supervisor bringing a crashed or restarted worker back — that is THIS
+ * deck returning, so anything already running got there in the gap, was asked
+ * for more recently, and keeps its place.
+ *
+ * The deck kept on an attach is the first that serves, in the registry's port
+ * order, so the answer is the same every time it is asked.
  */
-export function sameShape(record, want = {}) {
-  if (!record) return false;
-  return (record.workspace ?? "") === (want.workspace ?? "")
-    && (record.persist ?? null) === (want.persist ?? null)
-    && record.codex === (want.codex !== false)
-    && record.claude === (want.claude !== false);
+export function secondStart({ live = [], want = {}, port = null, ours = "", fresh = false, respawn = false } = {}) {
+  if (!live.length) return { act: "start", stop: [] };
+  if (respawn) return { act: "yield", deck: live[0], stop: [] };
+  const keep = fresh ? null : live.find(d => serves(d, { want, port, ours })) ?? null;
+  if (keep) return { act: "attach", deck: keep, stop: live.filter(d => d !== keep) };
+  return { act: "replace", stop: [...live] };
 }
 
 /** A record complete enough to be worth a challenge. A missing token is a deck
- *  older than the handshake: it cannot prove anything, so it cannot be attached
- *  to, and it keeps the behaviour it has always had. */
+ *  older than the handshake: it cannot prove anything, so it can be neither
+ *  attached to nor stopped by token, and it keeps the behaviour it has always
+ *  had. */
 function usable(d) {
   return Boolean(d)
     && Number.isInteger(d.pid)
@@ -134,13 +167,13 @@ function usable(d) {
 /**
  * Every registered deck whose pid is still there, ordered.
  *
- * NOT PROVED — this is the cheap half, a directory listing and a signal-0 each,
- * and its three callers want different things from it. `detach.mjs` wants only
- * the count, to decide whether deck.log belongs to a deck that is still running
- * or to nobody; a round trip per record to answer that would be absurd. Ordered by port with pid breaking the tie, which is the rule
- * electWriters uses for the log and is here for the same reason: several decks
- * can qualify, and the answer has to be the same one every time it is asked
- * rather than whatever `readdir` happened to return first.
+ * NOT PROVED — this is the cheap half, a directory listing and a signal-0 each.
+ * `detach.mjs` wants only the count, to decide whether deck.log belongs to a
+ * deck that is still running or to nobody; a round trip per record to answer
+ * that would be absurd. Ordered by port with pid breaking the tie, which is the
+ * rule electWriters uses for the log and is here for the same reason: several
+ * decks can qualify, and the answer has to be the same one every time it is
+ * asked rather than whatever `readdir` happened to return first.
  *
  * A failure to read the directory is "no decks", not an error. This runs on the
  * boot path of a program whose job is to start, and there is no reading of that
@@ -167,39 +200,16 @@ export async function registeredDecks({
   return out.sort((a, b) => a.port - b.port || a.pid - b.pid);
 }
 
-/**
- * The deck already serving what this process was about to serve, or null.
- *
- * Only records that already match the shape are challenged, and the walk stops
- * at the first that proves itself. On the ordinary machine that is one loopback
- * round trip; on a machine with no deck running it is a directory listing and
- * nothing else. That is why this is not `liveDecks().find(…)`: the boot path
- * must not pay a round trip per deck to answer a question the first one settles.
- */
-export async function runningDeck({
-  want = {},
-  dir = deckRegistryDir(),
-  fs = { readdir, readFile },
-  self = process.pid,
-  alive = isProcessAlive,
-  prove = challengeDeck,
-} = {}) {
-  for (const d of await registeredDecks({ dir, fs, self, alive })) {
-    if (!sameShape(d, want)) continue;
-    if (await prove(d.port, d.token)) return d;
-  }
-  return null;
-}
-
 /**
  * Every deck on this machine that answered a challenge, in port order.
  *
- * The list `--status` prints and the list `--stop` chooses from. Everything is
- * challenged here, unlike runningDeck: a list that quietly omitted a deck it
- * could not be bothered to ask about would be worse than no list, because the
- * whole reason to run `--status` is to find the process you did not know was
- * there. The round trips go out together — one deadline for the lot, not one
- * after another — since they are independent and each is bounded at 400ms.
+ * What a start decides by, the list `--status` prints and the list `--stop`
+ * ends. Everything is challenged: a start that is about to stop a deck must
+ * know it is one, and a list that quietly omitted a deck it could not be
+ * bothered to ask about would be worse than no list, because the whole reason
+ * to run `--status` is to find the process you did not know was there. The
+ * round trips go out together — one deadline for the lot, not one after
+ * another — since they are independent and each is bounded at 400ms.
  */
 export async function liveDecks({
   dir = deckRegistryDir(),
@@ -216,19 +226,18 @@ export async function liveDecks({
 /**
  * What to say about the version of the deck we attached to.
  *
- * A mismatch does NOT stop the attach, and that is the deliberate half. Someone
- * who runs `npx ccdeck@latest` while an older deck is up has asked for the new
- * one, but the way to give it to them is not to stand a rival deck on a random
- * port beside the old one — that is the failure this whole module removes. So
- * they are attached and TOLD, with the one sentence that gets them the version
- * they asked for.
+ * An attach only ever keeps a deck at least as new as the one launched — an
+ * older one is replaced — so a difference here is somebody running an older
+ * copy, an npx cache or a second install, beside a newer deck. That deck is
+ * kept and they are told, because the newer one is what they would have wanted.
  *
- * Empty when the versions agree, and empty when the running deck is too old to
- * report one: "unknown" beside a number is noise, and there is nothing useful
- * to do about it either way.
+ * Empty when the versions agree, and empty when either side is too old to
+ * report one: "unknown" beside a number is noise.
  */
 export function versionNote(running, ours) {
   if (typeof running !== "string" || running === "" || typeof ours !== "string" || ours === "") return "";
   if (running === ours) return "";
-  return `running v${running}, you launched v${ours} — restart it from the deck to upgrade`;
+  return olderVersion(running, ours)
+    ? `running v${running}, older than the v${ours} you launched`
+    : `running v${running}, newer than the v${ours} you launched — kept it`;
 }