ccdeck 3.38.0 → 3.38.2

package/dist/web/index.html

@@ -64,8 +64,8 @@
           stored === "light" || (stored !== "dark" && light) ? "light" : "dark");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-C_h8mR-c.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-0cUs2Jed.css">
+    <script type="module" crossorigin src="/assets/index-5Bss6_uX.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-6_mJZ_aP.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccdeck",
-  "version": "3.38.0",
+  "version": "3.38.2",
   "description": "Local dashboard for Claude Code and Codex CLI sessions: which Claude Code session needs input, every tool call and Claude Code subagent live, token cost and quota, several Claude accounts. Run npx ccdeck.",
   "type": "module",
   "bin": {

package/release-notes.json

@@ -70,7 +70,9 @@
     "3.36.8",
     "3.36.9",
     "3.37.0",
-    "3.38.0"
+    "3.38.0",
+    "3.38.1",
+    "3.38.2"
   ],
   "3.37.1": [
     {

package/src/server/deck-prefs.mjs

@@ -133,8 +133,11 @@ export const DEFAULTS = Object.freeze({
     // WHAT MAKES IT SURVIVABLE IS THE GATE THAT NEVER CHANGED: `shared` is
     // empty, so a deck that pairs is offered NOTHING until somebody ticks a
     // login here. Pairing is a name in a list; a login is the thing worth
-    // having, and it still takes a deliberate tick on this machine. A deck on a
-    // network it does not own turns this off in the dialog, in one press.
+    // having, and it still takes a deliberate tick on this machine. The other
+    // direction is not gated by a tick here, since 3.38.1: a deck the switch
+    // pairs adds and repairs the logins a person ticked on it, as any paired
+    // deck does (see roundWith), and never replaces one that works. So a deck
+    // on a network it does not own turns this off in the dialog, in one press.
     autoAsk: true,
     autoAccept: true,
     pairingMode: "automatic",

package/src/server/event-ring.mjs

@@ -9,6 +9,9 @@
 // readers get a copy or an answer rather than the array. The bodies are
 // unchanged.
 import { ENVELOPE_CHARS, MAX_BUFFER, MAX_BUFFER_CHARS, MAX_RING_ENTRIES, isEnrichment, payloadChars } from "./ring-bounds.mjs";
+// The newest enrichment of each kind per session that eviction takes off the
+// head, for a page that connects after it went — see evicted-enrichment.mjs.
+import { clearEvicted, noteEvicted } from "./evicted-enrichment.mjs";
 
 // ─── The event ring buffer ─────────────────────────────────────────────────
 // Its two bounds, MAX_BUFFER and MAX_BUFFER_CHARS, and the charge an event is
@@ -62,6 +65,8 @@ export function clearEventBuffer() {
   events.length = 0;
   bufferedChars = 0;
   bufferedHookEvents = 0;
+  // And what eviction kept back from it: a cleared deck has nothing to resend.
+  clearEvicted();
 }
 
 /**
@@ -206,9 +211,13 @@ export function admitEvent(raw, source, receivedAt) {
     drop++;
   }
   if (drop > 0) {
-    events.splice(0, drop);
+    const evicted = events.splice(0, drop);
     bufferedChars -= freed;
     bufferedHookEvents -= freedHookEvents;
+    // What leaves is gone for every page that had not been sent it — except
+    // the enrichment, whose newest value per session is kept back for those
+    // pages, because an idle session never sends it again.
+    for (const e of evicted) if (e[ENRICHMENT]) noteEvicted(e, e[CHARS]);
   }
   return evt;
 }

package/src/server/event-routes.mjs

@@ -22,6 +22,9 @@ import { noteLogWriter } from "./event-log.mjs";
 import { deckProviders } from "./deck-scope.mjs";
 // The names only the server may send — see ring-bounds.mjs.
 import { isReservedEventName } from "./ring-bounds.mjs";
+// The enrichment the ring evicted, handed to a page that connects behind its
+// head — see withEvictedEnrichment.
+import { evictedEnrichment } from "./evicted-enrichment.mjs";
 // The SSE subscribers and the backpressure every frame to them is written
 // under — see sse-clients.mjs.
 import { dropSse, sseClients, trayClients, writeResume, writeSse } from "./sse-clients.mjs";
@@ -253,6 +256,11 @@ export function handleSse(req, res) {
   // guard is `env.seq <= state.lastSeq`, so the gap costs it a step forward and
   // nothing else. What the byte budget changed is how often and how far the
   // head moves, not what happens to a client that lands behind it.
+  //
+  // One thing in the gap is not history: the newest model, name, usage and the
+  // rest of each session's last-value-wins enrichment, which an idle session
+  // never sends again. That is put back in front of the replay — see
+  // withEvictedEnrichment.
   const asked = Number(req.headers["last-event-id"] ?? 0);
   const lastId = Number.isFinite(asked) ? asked : 0;
 
@@ -311,7 +319,8 @@ async function resumeSse(req, res, lastId, { tray = false } = {}) {
     // means a slow resumer pins one ring's worth of envelopes for as long as its
     // pass lasts, which the budget bounds too: that pin used to be unbounded for
     // the same reason the ring was.
-    const batch = ringSnapshot();
+    // Behind the ring's head, the enrichment that fell off it goes first.
+    const batch = withEvictedEnrichment(ringSnapshot(), sentThrough);
     for (const e of batch) {
       if (e.seq <= sentThrough) continue;
       if (closed || res.destroyed) return;
@@ -372,3 +381,38 @@ async function resumeSse(req, res, lastId, { tray = false } = {}) {
   ping = setInterval(() => writeSse(res, `: ping\n\n`), 15000);
   if (!await flushed) dropSse(res);
 }
+
+/**
+ * A replay pass's snapshot, with what this page lost to eviction put in front
+ * of it.
+ *
+ * When the ring's oldest event is newer than the next one this page needs —
+ * a fresh tab on a busy deck, a reload, a laptop waking — everything between
+ * was evicted, and a session's model, name, usage, context, activity line and
+ * job went with it if they were in there: they are sent when they change, so
+ * an idle session's card would be drawn without them for as long as it stayed
+ * idle. The newest value of each, for every session this snapshot holds an
+ * event of (the cards the page will draw), is put in front under its own seq
+ * (see evicted-enrichment.mjs), so the loop below sends it as one more replay
+ * frame, in order, before the ring. Every pass asks, against what this page
+ * has been sent so far: a slow replay the head overtook between passes is
+ * handed what it lost then too, and one that is caught up is handed nothing.
+ *
+ * The page holds a value that arrives before its card and gives it to the
+ * card when the card is made (parked-enrichment.ts).
+ */
+function withEvictedEnrichment(batch, sentThrough) {
+  if (batch.length === 0 || batch[0].seq <= sentThrough + 1) return batch;
+  try {
+    const sessions = new Set();
+    for (const e of batch) {
+      const sid = e.payload?.session_id;
+      if (typeof sid === "string" && sid) sessions.add(sid);
+    }
+    const lost = evictedEnrichment({ after: sentThrough, before: batch[0].seq, sessions });
+    return lost.length > 0 ? lost.concat(batch) : batch;
+  } catch {
+    // A page is never refused its replay for this.
+    return batch;
+  }
+}

package/src/server/evicted-enrichment.mjs

@@ -0,0 +1,213 @@
+// The newest value of each last-value-wins enrichment the ring has evicted,
+// per session — what a page that connects behind the ring's head is handed
+// ahead of the replay, so it is not left without them.
+//
+// WHY THESE GO MISSING. A session's model, name, usage, context, activity line
+// and background job (LAST_VALUE_WINS in ring-bounds.mjs) are each sent when
+// they change, and the scanners gate most of them on that: an idle session's
+// ModelObserved and SessionNamed went out once, near its start. The ring keeps
+// the newest MAX_BUFFER hook events, so on a busy deck those events fall off
+// its head while the session's later hook events are still held. A reload or a
+// second tab is replayed what is left: the card is drawn, from its surviving
+// hook events, with no model chip, no name and a stale token count, and nothing
+// sends them again until the session does something.
+//
+// WHAT IS KEPT. Every enrichment envelope the ring evicts is folded here into
+// the newest value of its kind for its session (foldEnrichment), and keeps the
+// seq, time and source of the last one folded. A page whose Last-Event-ID is
+// older than what was evicted is sent these BEFORE the ring, under their own
+// seq — see withEvictedEnrichment in event-routes.mjs — so the page applies
+// them exactly where the ring would have, and every newer event still in the
+// ring lands on top of them as it would have. Nothing is pushed into the ring,
+// nothing is broadcast to the pages already connected and nothing is logged;
+// and because each keeps its own `receivedAt`, none of them reads to the page
+// as the session being heard from just now.
+//
+// Fed by admitEvent (event-ring.mjs) as it evicts, and emptied with the ring by
+// clearEventBuffer, so a Clear forgets these as it forgets the ring.
+import { payloadChars } from "./ring-bounds.mjs";
+
+/** The kinds kept: the session's own last-value-wins enrichment, each read by
+ *  its applier in transcript-events.ts. Named here rather than read off
+ *  LAST_VALUE_WINS, because the fold below is written for exactly these and a
+ *  kind added there is not folded right by rules it was never written for. */
+const KINDS = new Set([
+  "ModelObserved", "UsageObserved", "ContextObserved", "SessionNamed",
+  "ActivityObserved", "JobObserved",
+]);
+
+/** The most sessions kept, least recently folded dropped first — the deck's
+ *  own working number for the sessions it tracks (MAX_TRACKED_SESSIONS in
+ *  session-tracking.mjs), well above the 200 cards a page draws. */
+export const MAX_EVICTED_SESSIONS = 256;
+
+/** What everything kept may weigh, in the characters payloadChars charges,
+ *  and what one value may. Real values are a few kilobytes — a usage total
+ *  split by model, a context breakdown with its memory files, a session's
+ *  subagent models — so the cap on one value is only ever met by a payload no
+ *  scanner wrote; `POST /api/event` takes enrichment names from anyone, and
+ *  this must not become a second ring with no budget. */
+export const MAX_EVICTED_CHARS = 8 * 1024 * 1024;
+export const MAX_EVICTED_VALUE_CHARS = 256 * 1024;
+
+// sid -> Map<hook_event_name, { seq, epoch, receivedAt, source, payload, chars }>,
+// both in least-recently-folded order.
+const kept = new Map();
+let keptChars = 0;
+
+const isObject = v => v !== null && typeof v === "object" && !Array.isArray(v);
+const nonEmpty = v => typeof v === "string" && v.trim() !== "";
+
+/** The facts the reducer stamps off whatever payload carries them
+ *  (stampSessionFacts), each with the test it is stamped under: anything else
+ *  says nothing, so it never replaces a value that does. */
+const STAMPED = [
+  ["model_context_window", v => typeof v === "number" && v > 0],
+  ["approval_policy", v => typeof v === "string" && v !== ""],
+  ["context_tokens", v => typeof v === "number" && v >= 0],
+];
+
+const JOB_STATES = new Set(["working", "blocked", "done", "failed", "stopped"]);
+const validActivity = a => isObject(a) && typeof a.text === "string" && a.text.trim() !== "" && Number.isFinite(a.at);
+
+/**
+ * Two enrichment payloads of one kind, for one session, as the one payload
+ * that leaves a card where the two in a row would have.
+ *
+ * The rules are the reducer's own (transcript-events.ts), and the page folds
+ * what waits for a card by the same ones (parked-enrichment.ts):
+ *   - a field the newer payload leaves out, or leaves undefined, says nothing;
+ *   - the stamped facts, a ModelObserved's model and a SessionNamed's two
+ *     names count only when they hold a value;
+ *   - a context breakdown merges key by key, and subagent models by subagent;
+ *   - a SessionNamed title that repeats the name is dropped, as the card drops it;
+ *   - an activity line never goes backwards in time;
+ *   - a job of `null` is the job gone, and one the reducer would refuse says nothing;
+ *   - a usage total replaces the last one whole, its split by model included,
+ *     and a UsageObserved without one says nothing about either.
+ */
+export function foldEnrichment(prev, next) {
+  if (!isObject(prev)) return next;
+  const out = { ...prev };
+  for (const [k, v] of Object.entries(next)) if (v !== undefined) out[k] = v;
+  const keep = k => { if (k in prev) out[k] = prev[k]; else delete out[k]; };
+  for (const [k, ok] of STAMPED) if (!ok(next[k])) keep(k);
+  switch (next.hook_event_name) {
+    case "ModelObserved":
+      if (!(typeof next.model === "string" && next.model !== "")) keep("model");
+      if (isObject(prev.subagentModels) || isObject(next.subagentModels)) {
+        out.subagentModels = {
+          ...(isObject(prev.subagentModels) ? prev.subagentModels : {}),
+          ...(isObject(next.subagentModels) ? next.subagentModels : {}),
+        };
+      }
+      break;
+    case "ContextObserved": {
+      if (!isObject(next.context)) { keep("context"); break; }
+      const ctx = isObject(prev.context) ? { ...prev.context } : {};
+      for (const [k, v] of Object.entries(next.context)) if (typeof v === "number" || Array.isArray(v)) ctx[k] = v;
+      out.context = ctx;
+      break;
+    }
+    case "SessionNamed": {
+      const name = nonEmpty(next.sessionName) ? next.sessionName : (prev.sessionName ?? null);
+      let title = nonEmpty(next.sessionTitle) ? next.sessionTitle : (prev.sessionTitle ?? null);
+      if (nonEmpty(name) && nonEmpty(title) && title.trim().toLowerCase() === name.trim().toLowerCase()) title = null;
+      out.sessionName = name;
+      out.sessionTitle = title;
+      break;
+    }
+    case "ActivityObserved":
+      if (!validActivity(next.activity) || (validActivity(prev.activity) && next.activity.at < prev.activity.at)) keep("activity");
+      break;
+    case "JobObserved":
+      if (!(next.job === null || (isObject(next.job) && JOB_STATES.has(next.job.state)))) keep("job");
+      break;
+    case "UsageObserved":
+      if (!isObject(next.usage)) { keep("usage"); keep("usageByModel"); }
+      else if (next.usageByModel === undefined) delete out.usageByModel;
+      break;
+  }
+  return out;
+}
+
+function drop(sid, name) {
+  const kinds = kept.get(sid);
+  const entry = kinds?.get(name);
+  if (!entry) return;
+  keptChars -= entry.chars;
+  kinds.delete(name);
+  if (kinds.size === 0) kept.delete(sid);
+}
+
+function dropSession(sid) {
+  for (const name of [...(kept.get(sid)?.keys() ?? [])]) drop(sid, name);
+}
+
+/**
+ * One envelope the ring has just evicted. Anything that is not one of KINDS,
+ * or names no session, is not kept. `charged` is what the ring charged the
+ * envelope, so a payload no scanner could have written is let go without
+ * being walked a second time — and takes the older value of its kind with it,
+ * since a page told the older one would be told something the deck has since
+ * heard replaced.
+ */
+export function noteEvicted(evt, charged = 0) {
+  const p = evt?.payload;
+  if (!isObject(p) || !KINDS.has(p.hook_event_name)) return;
+  const sid = p.session_id;
+  if (typeof sid !== "string" || sid === "") return;
+  const name = p.hook_event_name;
+  if (charged > MAX_EVICTED_VALUE_CHARS) { drop(sid, name); return; }
+  const prev = kept.get(sid)?.get(name);
+  const payload = foldEnrichment(prev?.payload, p);
+  const chars = payloadChars(payload);
+  drop(sid, name);
+  if (chars > MAX_EVICTED_VALUE_CHARS) return;
+  // Re-inserted, so both maps' own order is the order things were last folded
+  // in and the caps below drop the session heard from longest ago.
+  const kinds = kept.get(sid) ?? new Map();
+  kept.delete(sid);
+  kept.set(sid, kinds);
+  kinds.set(name, { seq: evt.seq, epoch: evt.epoch, receivedAt: evt.receivedAt, source: evt.source, payload, chars });
+  keptChars += chars;
+  while (kept.size > MAX_EVICTED_SESSIONS || keptChars > MAX_EVICTED_CHARS) {
+    const oldest = kept.keys().next().value;
+    if (oldest === undefined) break;
+    dropSession(oldest);
+  }
+}
+
+/** Forget everything kept — the ring was cleared. */
+export function clearEvicted() {
+  kept.clear();
+  keptChars = 0;
+}
+
+/**
+ * What a page is missing, as envelopes, oldest first: for each of `sessions`,
+ * the newest value of each kind whose last fold is newer than `after` (what
+ * the page was last sent) and older than `before` (the oldest seq the page is
+ * about to be replayed). A page that saw every one of them is sent none.
+ *
+ * @param {{ after: number, before: number, sessions: Set<string> }} range
+ */
+export function evictedEnrichment({ after, before, sessions }) {
+  const out = [];
+  for (const sid of sessions) {
+    const kinds = kept.get(sid);
+    if (!kinds) continue;
+    for (const e of kinds.values()) {
+      if (e.seq <= after || e.seq >= before) continue;
+      out.push({ seq: e.seq, epoch: e.epoch, receivedAt: e.receivedAt, source: e.source, payload: e.payload });
+    }
+  }
+  return out.sort((a, b) => a.seq - b.seq);
+}
+
+/** What is kept right now, for the suite: sessions, values and their weight. */
+export function evictedStats() {
+  let values = 0;
+  for (const kinds of kept.values()) values += kinds.size;
+  return { sessions: kept.size, values, chars: keptChars };
+}

package/src/server/lan-engine.mjs

@@ -397,7 +397,8 @@ export function createEngine({
    * is new.
    *
    * Or one the accept switch chose for them, which `auto` says and the pin
-   * keeps — see addTrusted, and roundWith for what such a deck may not do.
+   * keeps — see addTrusted, and sharedWith in lan-sync.mjs for what such a
+   * deck is not handed.
    */
   const pin = ({ fp, pub, name }, { auto = false } = {}) => {
     const { list, added } = addTrusted(cfg.trusted, { fp, pub, name, at: now(), ...(auto ? { auto: true } : {}) });
@@ -727,11 +728,11 @@ export function createEngine({
       if (!stillPaired()) throw new Error("peer no longer paired");
       if (theirs?.t !== "manifest" || !Array.isArray(theirs.accounts)) throw new Error("no manifest");
       const list = keepManifest(conn.key, theirs, conn.peerFp);
-      // FROM A DECK SOMEBODY HERE CHOSE, NEITHER AN ADD NOR A HEAL NEEDS MY
-      // TICK. Adding is the case the owner asked for by name: an account that
-      // appears among the decks I paired with appears on all of them, which is
-      // the whole of "I do not want to paste blobs any more". What can reach
-      // this is what a deck somebody here pressed accept on chose to offer.
+      // FROM ANY PAIRED DECK, NEITHER AN ADD NOR A HEAL NEEDS MY TICK. Adding
+      // is the case the owner asked for by name: an account that appears among
+      // the decks I paired with appears on all of them, which is the whole of
+      // "I do not want to paste blobs any more". What can reach this is what a
+      // paired deck chose to offer.
       //
       // A heal used to need the tick, on the reasoning that it replaces a slot
       // I already have. It replaces only one claude-swap has quarantined, with
@@ -746,13 +747,28 @@ export function createEngine({
       // so this is the ordinary case between one person's machines, not an
       // edge.
       //
-      // WHICH IS ONLY TRUE OF A DECK SOMEBODY CHOSE. The accept switch presses
-      // accept for the owner, so "somebody here pressed accept" is not a
-      // premise about a deck it paired: nobody here chose that deck, and the
-      // logins this store holds would be whatever it decided to offer. What a
-      // deck the switch paired offers comes in — added or healed — only for an
-      // account ticked here, and a person's own press or invite takes the mark
-      // off its pin (see addTrusted).
+      // A DECK THE SWITCH PAIRED INCLUDED, which is what 3.33.0 got wrong. It
+      // held such a deck to the tick — what it offered came in only for an
+      // account ticked here — on the reasoning that nobody here chose it. On
+      // the shipped defaults that was a deadlock rather than a gate. The
+      // accept switch ships on, so two of one person's machines pair by it;
+      // the setup dialog lists only this deck's own accounts, so a login this
+      // deck lacks cannot be ticked here; so an add from such a deck could
+      // never pass. A Mac ticked eight working logins, the deck it had paired
+      // with by the switch received none of them, ever, and its round line
+      // read "all logins fine". The owner chose fully automatic (2026-10-06):
+      // whoever made the pairing, a round takes everything plan() returns.
+      //
+      // What stands between a deck nobody here chose and this store does not
+      // rest on the tick, and none of it moved. plan() never replaces a login
+      // that works here (syncAction never asks for a forced import). A giving
+      // deck hands a deck its switch paired only what a PERSON ticked on it,
+      // not what an arrival ticked onward (sharedWith in lan-sync.mjs). And
+      // nothing that arrives from one is ticked onward here (ticksOnArrival).
+      // What it costs is the switch's own: on a network the owner does not
+      // control, a deck the switch pairs can add the logins ticked on it — so
+      // the dialog and the README say to turn the switch off there.
+      //
       // OVER `list`, NOT THE RAW ARRAY. `offered`, which keepManifest runs the
       // list through above (see lan-manifest.mjs), slices to 50 and type-
       // filters `key` and `email`; this line read `theirs.accounts` and got
@@ -763,15 +779,7 @@ export function createEngine({
       // the store lock, while the panel drew 50 and every other paired deck
       // waited behind it. `step.key` also reached transferChallenge and
       // importAccount untyped, which `offered`'s filter would have caught.
-      const chosen = () => trustedPeer(cfg.trusted, conn.peerFp)?.auto !== true;
-      const takes = step => chosen() || cfg.shared.includes(step.key);
-      const wanted = plan(mine, list).filter(takes);
-      // TWO CHECKS, BECAUSE THEY END DIFFERENT THINGS. Losing the session —
-      // LAN switched off, the peer unpaired (`stillPaired`, above) — ends the
-      // round. From a deck the switch paired, an account unticked mid-round
-      // ends only that step: the next one may still be ticked, and the skipped
-      // row says why rather than vanishing.
-      const stillWanted = takes;
+      const wanted = plan(mine, list);
       /** One login, asked for and opened: a `want` carrying its own proof that
        *  names the account (see transferChallenge), and the `have` opened under
        *  the additional data it was sealed with. The login, or why there is
@@ -790,15 +798,16 @@ export function createEngine({
         return blob ? { blob } : { why: "could not open" };
       };
       let cut = false;
+      // Losing the session — LAN switched off, the peer unpaired — ends the
+      // round, checked before each question and again before each import. A
+      // tick changed here mid-round ends nothing: no step reads one.
       for (const step of wanted) {
         if (!stillPaired()) { cut = true; break; }
-        if (!stillWanted(step)) { done.push({ ...step, ok: false, why: "not shared" }); continue; }
         const { blob, why } = await wantLogin(step);
         if (!blob) { done.push({ ...step, ok: false, why }); continue; }
-        // Unpairing, disabling LAN, or unticking a heal while export was in
-        // progress takes effect before the received credential touches disk.
+        // Unpairing or disabling LAN while export was in progress takes effect
+        // before the received credential touches disk.
         if (!stillPaired()) { cut = true; break; }
-        if (!stillWanted(step)) { done.push({ ...step, ok: false, why: "not shared" }); continue; }
         // A verdict rather than a boolean, because "refused" and "kept the
         // slot it already has" are different things to tell somebody and the
         // second one used to be reported as success. A bare `true` is still
@@ -825,11 +834,11 @@ export function createEngine({
         // be asleep or on another network. Nothing new is exposed — the login
         // came FROM the group, so the group has it.
         //
-        // ONLY AN ADD, and only from the local network. A heal already needed
-        // the tick to happen at all (the filter above), so there is nothing to
-        // add for one; and a tailnet reaches further than the person's own
-        // machines, which is a decision they make for themselves rather than
-        // one an arrival makes for them.
+        // ONLY AN ADD, only from the local network, and only from a deck
+        // somebody here chose — see ticksOnArrival for why each. A healed slot
+        // was here already and its tick is somebody's decision either way; a
+        // tailnet reaches further than the person's own machines; and what a
+        // deck the switch paired brings is not passed on in this deck's name.
         // The store can finish an import after the owner disabled LAN or
         // revoked this peer. Keep the imported slot, but do not turn it into
         // a newly shared credential on behalf of an obsolete transfer.
@@ -1026,9 +1035,6 @@ export function createEngine({
     const card = id => ({
       ...heardOf(id),
       pairedAt: trustedPeer(cfg.trusted, id)?.at ?? null,
-      // And whether a switch said that yes rather than a person, which is
-      // what the dialog needs to say which logins will not arrive from it.
-      ...(trustedPeer(cfg.trusted, id)?.auto ? { autoPaired: true } : {}),
     });
     for (const p of [...beacon.peers.values(), ...dials.rows()]) {
       if (!stillListed(p, now())) continue;

package/src/server/lan-reach.mjs

@@ -536,6 +536,27 @@ export function reachability({ platform, probe, aliases = [], exePath = "", inbo
   return windowsReach({ probe, aliases, exePath, inbound });
 }
 
+/**
+ * The verdict as the status route serves it: `said` is the last one taken, and
+ * `inboundAt` is when a connection from another machine last got in, as the
+ * engine knows it NOW.
+ *
+ * A VERDICT IS TAKEN AT MOST EVERY FIVE MINUTES (see refreshReach in
+ * lan-deck.mjs), and a complaint in it was true only of the moment it was
+ * taken. Reported from the Omarchy box this module's Linux block describes:
+ * its owner ran the two `ufw allow` lines, decks connected straight away —
+ * ufw applies a rule the moment it is added — and the panel went on saying
+ * "ufw is running here…" until the cached verdict expired, because it was
+ * taken before anything had connected. The connection that got in is the
+ * same measurement every platform here already puts above whatever it read,
+ * so it outranks a verdict taken before it, too. The answer is the one the
+ * next probe will give; every other answer is served as it was.
+ */
+export function servedReach(said, inboundAt) {
+  if (!said?.blocked || !inboundAt) return said ?? null;
+  return { blocked: false, why: "inbound seen", category: said.category ?? "", alias: said.alias ?? "" };
+}
+
 // ── the machine nothing can be asked about ──────────────────────────────────
 //
 // Every block above depends on the operating system answering a question.

package/src/server/lan-routes.mjs

@@ -10,6 +10,7 @@
 import { cleanAlias, isAliasKey, lanEnabled, withAlias, withManualEntry } from "./deck-prefs.mjs";
 import { heldPrefs } from "./prefs-state.mjs";
 import { lanEngine, lastReach, refreshReach, tailnet } from "./lan-deck.mjs";
+import { servedReach } from "./lan-reach.mjs";
 import { IDLE_MS as TAILNET_IDLE_MS } from "./tailscale.mjs";
 import { readBody, send } from "./http-io.mjs";
 
@@ -21,7 +22,9 @@ export function handleLanStatus(req, res) {
   // Behind the answer, like the reach probe: the dialog's poll is what finds a
   // Tailscale somebody installed while the deck was running.
   if (lanEnabled(heldPrefs.current())) void tailnet.freshen(TAILNET_IDLE_MS);
-  return send(res, 200, { ok: true, ...lanEngine.status(), reach: lastReach() });
+  // Read against what has got in since it was taken — see servedReach.
+  const status = lanEngine.status();
+  return send(res, 200, { ok: true, ...status, reach: servedReach(lastReach(), status.inboundAt) });
 }
 
 /**

package/src/server/lan-sync.mjs

@@ -464,11 +464,12 @@ export function trustedPeer(trusted, fp) {
  * told nothing changed.
  *
  * `auto` SAYS A SWITCH MADE THE PIN, not a person — the accept switch pressing
- * accept for the owner. A pin that says so may take what this deck shares and
- * may not place logins here: see roundWith in lan-engine.mjs. A person's pin
- * of the same key takes the mark away, because pressing accept, or pairing by
- * invite, is the choice the switch only stood in for; a switch never puts it
- * back on a pin a person made.
+ * accept for the owner. A pin that says so is handed only what a person ticked
+ * here (see sharedWith), and what it brings is not ticked onward here (see
+ * ticksOnArrival in lan-engine.mjs); it places logins here like any paired
+ * deck, since 3.38.1 — see roundWith. A person's pin of the same key takes the
+ * mark away, because pressing accept, or pairing by invite, is the choice the
+ * switch only stood in for; a switch never puts it back on a pin a person made.
  */
 export function addTrusted(trusted, entry) {
   const list = Array.isArray(trusted) ? trusted : [];