ccdeck 3.38.1 → 3.38.3

package/dist/web/index.html

@@ -64,8 +64,8 @@
           stored === "light" || (stored !== "dark" && light) ? "light" : "dark");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-DnnkOgia.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-D-HX6Mea.css">
+    <script type="module" crossorigin src="/assets/index-ClJbck-M.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-6_mJZ_aP.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccdeck",
-  "version": "3.38.1",
+  "version": "3.38.3",
   "description": "Local dashboard for Claude Code and Codex CLI sessions: which Claude Code session needs input, every tool call and Claude Code subagent live, token cost and quota, several Claude accounts. Run npx ccdeck.",
   "type": "module",
   "bin": {

package/release-notes.json

@@ -71,7 +71,14 @@
     "3.36.9",
     "3.37.0",
     "3.38.0",
-    "3.38.1"
+    "3.38.1",
+    "3.38.2"
+  ],
+  "3.38.3": [
+    {
+      "title": "🧾 Subagent costs count their whole reply",
+      "body": "A subagent's request was counted from the first moment of its reply, before most of it had been written, so much of its output was left out of the deck's token and cost counts, and a subagent turn in fast mode was priced at the standard rate. Each request is now counted from its finished reply. Days with subagents will read higher than before: that is the part that was missing, not a new charge. Projects counts its history again once after the update, so past days come out right too. Codex sessions on GPT-6 Sol, GPT-6.1 Sol and GPT-6 Luna now show a cost instead of not priced."
+    }
   ],
   "3.37.1": [
     {

package/src/server/account-projects.mjs

@@ -33,7 +33,8 @@ import { readSwapLog, accountAtTime, trackedSince, seedActive, markGap } from ".
 // and a session's card cannot disagree about which lines billed anything, nor
 // about the speed they were billed at — see transcript-scan.mjs.
 import {
-  billedSpeed, hasSpend, MAX_SPEEDS_PER_MODEL, repeatsRequestUsage, UNRECOGNISED_SPEED,
+  billedSpeed, hasSpend, MAX_SPEEDS_PER_MODEL, UNRECOGNISED_SPEED,
+  requestBilling, streamingRequestId, BILL_LINE, REBILL_REQUEST, SKIP_LINE,
 } from "./transcript-scan.mjs";
 
 /** The pseudo-account for messages the swap log cannot place — everything
@@ -41,7 +42,7 @@ import {
  *  a per-account total is never quietly inflated by work that is not that
  *  account's. A NUL keeps it from ever colliding with a real `email@@org` key. */
 export const UNATTRIBUTED = "\u0000unattributed";
-const STATE_VERSION = 4;
+const STATE_VERSION = 5;
 
 /** Where the tally and cursors live, beside cswap-auto's own state. */
 export function statePath(home = homedir()) {
@@ -104,6 +105,16 @@ function addInto(dst, src) {
   return dst;
 }
 
+/** Take `src`'s six counters back out of `dst`. */
+function takeFrom(dst, src) {
+  dst.i -= src.i; dst.o -= src.o; dst.cr -= src.cr;
+  dst.cc -= src.cc; dst.c1h -= src.c1h; dst.c5m -= src.c5m;
+}
+
+function isZero(c) {
+  return !c.i && !c.o && !c.cr && !c.cc && !c.c1h && !c.c5m;
+}
+
 /** The share of `counters` billed at `speed` (#754), created on first sight:
  *  `s[speed]`, a SUBSET of the counters it sits on, the way the 1h/5m split is
  *  of `cc`, so the totals read exactly as they did and the client prices the
@@ -112,11 +123,18 @@ function addInto(dst, src) {
  *  past the cap is kept as UNRECOGNISED_SPEED, which no rate table names, so it
  *  is counted and left unpriced rather than priced at the standard rate. */
 function speedShareOf(counters, speed) {
+  const key = speedShareKey(counters, speed);
+  return counters.s[key];
+}
+
+/** The key `speed`'s share is kept under in `counters`, the share created on
+ *  first sight — see speedShareOf. */
+function speedShareKey(counters, speed) {
   const shares = counters.s ??= {};
-  if (Object.hasOwn(shares, speed)) return shares[speed];
+  if (Object.hasOwn(shares, speed)) return speed;
   const key = Object.keys(shares).length < MAX_SPEEDS_PER_MODEL ? speed : UNRECOGNISED_SPEED;
   if (!Object.hasOwn(shares, key)) shares[key] = zero();
-  return shares[key];
+  return key;
 }
 
 function zero() { return { i: 0, o: 0, cr: 0, cc: 0, c1h: 0, c5m: 0 }; }
@@ -223,22 +241,28 @@ export function projectPath(cwd) {
  *
  * `timeline` is the sorted swap log; the account is whoever it says was active
  * at this line's timestamp, or UNATTRIBUTED when the timestamp precedes it.
- * `from` names the transcript's project directory — see folderOf.
+ * `from` names the transcript's project directory — see folderOf — and, as
+ * `requests` and `path`, where the request this file is still waiting on a
+ * final record for is kept between passes.
  */
 export function foldLine(tally, line, timeline, from) {
   if (!line || !line.includes('"usage"')) return;
   let obj = null;
   try { obj = JSON.parse(line); } catch { return; }
-  // Claude writes one assistant record for each content block in a request,
-  // and every block repeats the request's usage, so only block 0 is billable
-  // — see repeatsRequestUsage.
-  if (repeatsRequestUsage(obj)) return;
+  // A request is billed once, from its final record, which in a subagent's
+  // file follows a streaming snapshot — see requestBilling. A call that keeps
+  // no requests for the file never sees one replaced, and bills block 0.
+  const requests = from?.requests ?? null;
+  const streaming = requests?.[from.path] ?? null;
+  const billing = requestBilling(obj, streaming?.id ?? null);
+  if (billing === SKIP_LINE) return;
   const usage = obj?.message?.usage;
   if (!usage || typeof usage !== "object") return;
   const ts = Date.parse(obj?.timestamp);
   if (!Number.isFinite(ts)) return;
   const c = countersFrom(usage);
   if (!hasSpend(asUsageTotals(c))) return;   // a usage block that billed nothing
+  if (billing === REBILL_REQUEST) refund(tally, streaming);
   const model = typeof obj?.message?.model === "string" ? obj.message.model : "";
   const lineCwd = (typeof obj?.cwd === "string" && obj.cwd) ? obj.cwd : "";
   const cwd = projectPath(folderOf(lineCwd, from));   // a worktree counts under the repo it checks out
@@ -251,7 +275,41 @@ export function foldLine(tally, line, timeline, from) {
   // board prices it so (#754). Kept as a share rather than a model of its own,
   // so a row's tokens and its model read exactly as before.
   const speed = billedSpeed(obj);
-  if (speed) addInto(speedShareOf(counters, speed), c);
+  const share = speed ? speedShareKey(counters, speed) : null;
+  if (share) addInto(counters.s[share], c);
+  if (billing === REBILL_REQUEST) dropIfEmpty(tally, streaming);
+  if (billing === BILL_LINE || !requests) return;
+  // What a request still streaming was charged, and where, so its final
+  // record can take that back, in this pass or a later one.
+  const id = streamingRequestId(obj);
+  if (id === null) delete requests[from.path];
+  else requests[from.path] = { id, at: [key, cwd, day, model], s: share, c };
+}
+
+/** Take a streaming request's charge back out of the row it was charged to,
+ *  for its later record to charge in its place. A row pruned since has
+ *  nothing left to take back. */
+function refund(tally, { at: [key, cwd, day, model], s, c }) {
+  const counters = tally[key]?.[cwd]?.[day]?.[model];
+  if (!counters) return;
+  takeFrom(counters, c);
+  if (s && counters.s?.[s]) takeFrom(counters.s[s], c);
+}
+
+/** Remove what a refund left at zero — a speed share, or a whole row whose
+ *  request's final record landed on another day or account — so the report
+ *  never lists an empty row. */
+function dropIfEmpty(tally, { at: [key, cwd, day, model], s }) {
+  const days = tally[key]?.[cwd];
+  const counters = days?.[day]?.[model];
+  if (!counters) return;
+  if (s && counters.s?.[s] && isZero(counters.s[s])) delete counters.s[s];
+  if (counters.s && !Object.keys(counters.s).length) delete counters.s;
+  if (!isZero(counters)) return;
+  delete days[day][model];
+  if (!Object.keys(days[day]).length) delete days[day];
+  if (!Object.keys(days).length) delete tally[key][cwd];
+  if (!Object.keys(tally[key]).length) delete tally[key];
 }
 
 /** Read the bytes of `path` from `start` to `size`, folding each COMPLETE line,
@@ -423,7 +481,7 @@ export function createProjectRollup({
   setInterval: setIv = setInterval,
   clearInterval: clearIv = clearInterval,
 } = {}) {
-  let state = { version: STATE_VERSION, cursors: {}, tally: {}, folders: {} };
+  let state = { version: STATE_VERSION, cursors: {}, tally: {}, folders: {}, requests: {} };
   let timer = null;
   let running = false;
   let dirty = false;
@@ -437,14 +495,17 @@ export function createProjectRollup({
       if (disk && disk.version === STATE_VERSION && disk.tally && disk.cursors) {
         state = disk;
         state.folders ??= {};
-      } else if (disk && (disk.version === 1 || disk.version === 2 || disk.version === 3)) {
+        state.requests ??= {};
+      } else if (disk && [1, 2, 3, 4].includes(disk.version)) {
         // Version 1 counted every API content block; version 2 keyed each row
         // by the line's own cwd, a row per folder the agent cd'd into (#1278);
         // version 3 kept no speed, so every fast turn read at the standard
-        // rate. None of them can be re-keyed, since it no longer knows which
-        // transcript a count came from. Keep the heartbeat so a restart gap
-        // remains fenced, but rebuild the tally from transcripts.
-        state = { version: STATE_VERSION, cursors: {}, tally: {}, folders: {}, lastAlive: disk.lastAlive };
+        // rate; version 4 billed a subagent's request from its streaming
+        // snapshot, most of its output and its speed missing (#1883). None of
+        // them can be re-keyed, since it no longer knows which transcript a
+        // count came from. Keep the heartbeat so a restart gap remains fenced,
+        // but rebuild the tally from transcripts.
+        state = { version: STATE_VERSION, cursors: {}, tally: {}, folders: {}, requests: {}, lastAlive: disk.lastAlive };
         dirty = true;
       }
     } catch { /* first run: empty state */ }
@@ -474,9 +535,9 @@ export function createProjectRollup({
     // resync the cursor to the current end: the replaced content is lost, never
     // counted twice. Transcripts append and do not shrink in normal use, so this
     // is the rare, safe side to err on.
-    if (st.size < offset) { state.cursors[path] = st.size; dirty = true; return; }
+    if (st.size < offset) { state.cursors[path] = st.size; delete state.requests[path]; dirty = true; return; }
     if (st.size <= offset) return;
-    const from = { slug, folders: state.folders };
+    const from = { slug, folders: state.folders, requests: state.requests, path };
     let fh = null;
     try {
       fh = await open(path, "r");
@@ -504,9 +565,11 @@ export function createProjectRollup({
       const timeline = await readSwapLog(swapLog);
       const files = await listTranscripts(roots);
       for (const [path, slug] of files) await foldFile(path, slug, timeline);
-      // Forget cursors for files that are gone, and the folders of project
-      // directories with no transcript left, so neither map grows forever.
+      // Forget the cursors and streaming requests of files that are gone, and
+      // the folders of project directories with no transcript left, so none of
+      // the three maps grows forever.
       for (const p of Object.keys(state.cursors)) if (!files.has(p)) { delete state.cursors[p]; dirty = true; }
+      for (const p of Object.keys(state.requests)) if (!files.has(p)) { delete state.requests[p]; dirty = true; }
       const slugs = new Set(files.values());
       for (const s of Object.keys(state.folders)) if (!slugs.has(s)) { delete state.folders[s]; dirty = true; }
       // Heartbeat: record that the deck was alive now, so a later boot can see

package/src/server/event-ring.mjs

@@ -9,6 +9,9 @@
 // readers get a copy or an answer rather than the array. The bodies are
 // unchanged.
 import { ENVELOPE_CHARS, MAX_BUFFER, MAX_BUFFER_CHARS, MAX_RING_ENTRIES, isEnrichment, payloadChars } from "./ring-bounds.mjs";
+// The newest enrichment of each kind per session that eviction takes off the
+// head, for a page that connects after it went — see evicted-enrichment.mjs.
+import { clearEvicted, noteEvicted } from "./evicted-enrichment.mjs";
 
 // ─── The event ring buffer ─────────────────────────────────────────────────
 // Its two bounds, MAX_BUFFER and MAX_BUFFER_CHARS, and the charge an event is
@@ -62,6 +65,8 @@ export function clearEventBuffer() {
   events.length = 0;
   bufferedChars = 0;
   bufferedHookEvents = 0;
+  // And what eviction kept back from it: a cleared deck has nothing to resend.
+  clearEvicted();
 }
 
 /**
@@ -206,9 +211,13 @@ export function admitEvent(raw, source, receivedAt) {
     drop++;
   }
   if (drop > 0) {
-    events.splice(0, drop);
+    const evicted = events.splice(0, drop);
     bufferedChars -= freed;
     bufferedHookEvents -= freedHookEvents;
+    // What leaves is gone for every page that had not been sent it — except
+    // the enrichment, whose newest value per session is kept back for those
+    // pages, because an idle session never sends it again.
+    for (const e of evicted) if (e[ENRICHMENT]) noteEvicted(e, e[CHARS]);
   }
   return evt;
 }

package/src/server/event-routes.mjs

@@ -22,6 +22,9 @@ import { noteLogWriter } from "./event-log.mjs";
 import { deckProviders } from "./deck-scope.mjs";
 // The names only the server may send — see ring-bounds.mjs.
 import { isReservedEventName } from "./ring-bounds.mjs";
+// The enrichment the ring evicted, handed to a page that connects behind its
+// head — see withEvictedEnrichment.
+import { evictedEnrichment } from "./evicted-enrichment.mjs";
 // The SSE subscribers and the backpressure every frame to them is written
 // under — see sse-clients.mjs.
 import { dropSse, sseClients, trayClients, writeResume, writeSse } from "./sse-clients.mjs";
@@ -253,6 +256,11 @@ export function handleSse(req, res) {
   // guard is `env.seq <= state.lastSeq`, so the gap costs it a step forward and
   // nothing else. What the byte budget changed is how often and how far the
   // head moves, not what happens to a client that lands behind it.
+  //
+  // One thing in the gap is not history: the newest model, name, usage and the
+  // rest of each session's last-value-wins enrichment, which an idle session
+  // never sends again. That is put back in front of the replay — see
+  // withEvictedEnrichment.
   const asked = Number(req.headers["last-event-id"] ?? 0);
   const lastId = Number.isFinite(asked) ? asked : 0;
 
@@ -311,7 +319,8 @@ async function resumeSse(req, res, lastId, { tray = false } = {}) {
     // means a slow resumer pins one ring's worth of envelopes for as long as its
     // pass lasts, which the budget bounds too: that pin used to be unbounded for
     // the same reason the ring was.
-    const batch = ringSnapshot();
+    // Behind the ring's head, the enrichment that fell off it goes first.
+    const batch = withEvictedEnrichment(ringSnapshot(), sentThrough);
     for (const e of batch) {
       if (e.seq <= sentThrough) continue;
       if (closed || res.destroyed) return;
@@ -372,3 +381,38 @@ async function resumeSse(req, res, lastId, { tray = false } = {}) {
   ping = setInterval(() => writeSse(res, `: ping\n\n`), 15000);
   if (!await flushed) dropSse(res);
 }
+
+/**
+ * A replay pass's snapshot, with what this page lost to eviction put in front
+ * of it.
+ *
+ * When the ring's oldest event is newer than the next one this page needs —
+ * a fresh tab on a busy deck, a reload, a laptop waking — everything between
+ * was evicted, and a session's model, name, usage, context, activity line and
+ * job went with it if they were in there: they are sent when they change, so
+ * an idle session's card would be drawn without them for as long as it stayed
+ * idle. The newest value of each, for every session this snapshot holds an
+ * event of (the cards the page will draw), is put in front under its own seq
+ * (see evicted-enrichment.mjs), so the loop below sends it as one more replay
+ * frame, in order, before the ring. Every pass asks, against what this page
+ * has been sent so far: a slow replay the head overtook between passes is
+ * handed what it lost then too, and one that is caught up is handed nothing.
+ *
+ * The page holds a value that arrives before its card and gives it to the
+ * card when the card is made (parked-enrichment.ts).
+ */
+function withEvictedEnrichment(batch, sentThrough) {
+  if (batch.length === 0 || batch[0].seq <= sentThrough + 1) return batch;
+  try {
+    const sessions = new Set();
+    for (const e of batch) {
+      const sid = e.payload?.session_id;
+      if (typeof sid === "string" && sid) sessions.add(sid);
+    }
+    const lost = evictedEnrichment({ after: sentThrough, before: batch[0].seq, sessions });
+    return lost.length > 0 ? lost.concat(batch) : batch;
+  } catch {
+    // A page is never refused its replay for this.
+    return batch;
+  }
+}

package/src/server/evicted-enrichment.mjs

@@ -0,0 +1,213 @@
+// The newest value of each last-value-wins enrichment the ring has evicted,
+// per session — what a page that connects behind the ring's head is handed
+// ahead of the replay, so it is not left without them.
+//
+// WHY THESE GO MISSING. A session's model, name, usage, context, activity line
+// and background job (LAST_VALUE_WINS in ring-bounds.mjs) are each sent when
+// they change, and the scanners gate most of them on that: an idle session's
+// ModelObserved and SessionNamed went out once, near its start. The ring keeps
+// the newest MAX_BUFFER hook events, so on a busy deck those events fall off
+// its head while the session's later hook events are still held. A reload or a
+// second tab is replayed what is left: the card is drawn, from its surviving
+// hook events, with no model chip, no name and a stale token count, and nothing
+// sends them again until the session does something.
+//
+// WHAT IS KEPT. Every enrichment envelope the ring evicts is folded here into
+// the newest value of its kind for its session (foldEnrichment), and keeps the
+// seq, time and source of the last one folded. A page whose Last-Event-ID is
+// older than what was evicted is sent these BEFORE the ring, under their own
+// seq — see withEvictedEnrichment in event-routes.mjs — so the page applies
+// them exactly where the ring would have, and every newer event still in the
+// ring lands on top of them as it would have. Nothing is pushed into the ring,
+// nothing is broadcast to the pages already connected and nothing is logged;
+// and because each keeps its own `receivedAt`, none of them reads to the page
+// as the session being heard from just now.
+//
+// Fed by admitEvent (event-ring.mjs) as it evicts, and emptied with the ring by
+// clearEventBuffer, so a Clear forgets these as it forgets the ring.
+import { payloadChars } from "./ring-bounds.mjs";
+
+/** The kinds kept: the session's own last-value-wins enrichment, each read by
+ *  its applier in transcript-events.ts. Named here rather than read off
+ *  LAST_VALUE_WINS, because the fold below is written for exactly these and a
+ *  kind added there is not folded right by rules it was never written for. */
+const KINDS = new Set([
+  "ModelObserved", "UsageObserved", "ContextObserved", "SessionNamed",
+  "ActivityObserved", "JobObserved",
+]);
+
+/** The most sessions kept, least recently folded dropped first — the deck's
+ *  own working number for the sessions it tracks (MAX_TRACKED_SESSIONS in
+ *  session-tracking.mjs), well above the 200 cards a page draws. */
+export const MAX_EVICTED_SESSIONS = 256;
+
+/** What everything kept may weigh, in the characters payloadChars charges,
+ *  and what one value may. Real values are a few kilobytes — a usage total
+ *  split by model, a context breakdown with its memory files, a session's
+ *  subagent models — so the cap on one value is only ever met by a payload no
+ *  scanner wrote; `POST /api/event` takes enrichment names from anyone, and
+ *  this must not become a second ring with no budget. */
+export const MAX_EVICTED_CHARS = 8 * 1024 * 1024;
+export const MAX_EVICTED_VALUE_CHARS = 256 * 1024;
+
+// sid -> Map<hook_event_name, { seq, epoch, receivedAt, source, payload, chars }>,
+// both in least-recently-folded order.
+const kept = new Map();
+let keptChars = 0;
+
+const isObject = v => v !== null && typeof v === "object" && !Array.isArray(v);
+const nonEmpty = v => typeof v === "string" && v.trim() !== "";
+
+/** The facts the reducer stamps off whatever payload carries them
+ *  (stampSessionFacts), each with the test it is stamped under: anything else
+ *  says nothing, so it never replaces a value that does. */
+const STAMPED = [
+  ["model_context_window", v => typeof v === "number" && v > 0],
+  ["approval_policy", v => typeof v === "string" && v !== ""],
+  ["context_tokens", v => typeof v === "number" && v >= 0],
+];
+
+const JOB_STATES = new Set(["working", "blocked", "done", "failed", "stopped"]);
+const validActivity = a => isObject(a) && typeof a.text === "string" && a.text.trim() !== "" && Number.isFinite(a.at);
+
+/**
+ * Two enrichment payloads of one kind, for one session, as the one payload
+ * that leaves a card where the two in a row would have.
+ *
+ * The rules are the reducer's own (transcript-events.ts), and the page folds
+ * what waits for a card by the same ones (parked-enrichment.ts):
+ *   - a field the newer payload leaves out, or leaves undefined, says nothing;
+ *   - the stamped facts, a ModelObserved's model and a SessionNamed's two
+ *     names count only when they hold a value;
+ *   - a context breakdown merges key by key, and subagent models by subagent;
+ *   - a SessionNamed title that repeats the name is dropped, as the card drops it;
+ *   - an activity line never goes backwards in time;
+ *   - a job of `null` is the job gone, and one the reducer would refuse says nothing;
+ *   - a usage total replaces the last one whole, its split by model included,
+ *     and a UsageObserved without one says nothing about either.
+ */
+export function foldEnrichment(prev, next) {
+  if (!isObject(prev)) return next;
+  const out = { ...prev };
+  for (const [k, v] of Object.entries(next)) if (v !== undefined) out[k] = v;
+  const keep = k => { if (k in prev) out[k] = prev[k]; else delete out[k]; };
+  for (const [k, ok] of STAMPED) if (!ok(next[k])) keep(k);
+  switch (next.hook_event_name) {
+    case "ModelObserved":
+      if (!(typeof next.model === "string" && next.model !== "")) keep("model");
+      if (isObject(prev.subagentModels) || isObject(next.subagentModels)) {
+        out.subagentModels = {
+          ...(isObject(prev.subagentModels) ? prev.subagentModels : {}),
+          ...(isObject(next.subagentModels) ? next.subagentModels : {}),
+        };
+      }
+      break;
+    case "ContextObserved": {
+      if (!isObject(next.context)) { keep("context"); break; }
+      const ctx = isObject(prev.context) ? { ...prev.context } : {};
+      for (const [k, v] of Object.entries(next.context)) if (typeof v === "number" || Array.isArray(v)) ctx[k] = v;
+      out.context = ctx;
+      break;
+    }
+    case "SessionNamed": {
+      const name = nonEmpty(next.sessionName) ? next.sessionName : (prev.sessionName ?? null);
+      let title = nonEmpty(next.sessionTitle) ? next.sessionTitle : (prev.sessionTitle ?? null);
+      if (nonEmpty(name) && nonEmpty(title) && title.trim().toLowerCase() === name.trim().toLowerCase()) title = null;
+      out.sessionName = name;
+      out.sessionTitle = title;
+      break;
+    }
+    case "ActivityObserved":
+      if (!validActivity(next.activity) || (validActivity(prev.activity) && next.activity.at < prev.activity.at)) keep("activity");
+      break;
+    case "JobObserved":
+      if (!(next.job === null || (isObject(next.job) && JOB_STATES.has(next.job.state)))) keep("job");
+      break;
+    case "UsageObserved":
+      if (!isObject(next.usage)) { keep("usage"); keep("usageByModel"); }
+      else if (next.usageByModel === undefined) delete out.usageByModel;
+      break;
+  }
+  return out;
+}
+
+function drop(sid, name) {
+  const kinds = kept.get(sid);
+  const entry = kinds?.get(name);
+  if (!entry) return;
+  keptChars -= entry.chars;
+  kinds.delete(name);
+  if (kinds.size === 0) kept.delete(sid);
+}
+
+function dropSession(sid) {
+  for (const name of [...(kept.get(sid)?.keys() ?? [])]) drop(sid, name);
+}
+
+/**
+ * One envelope the ring has just evicted. Anything that is not one of KINDS,
+ * or names no session, is not kept. `charged` is what the ring charged the
+ * envelope, so a payload no scanner could have written is let go without
+ * being walked a second time — and takes the older value of its kind with it,
+ * since a page told the older one would be told something the deck has since
+ * heard replaced.
+ */
+export function noteEvicted(evt, charged = 0) {
+  const p = evt?.payload;
+  if (!isObject(p) || !KINDS.has(p.hook_event_name)) return;
+  const sid = p.session_id;
+  if (typeof sid !== "string" || sid === "") return;
+  const name = p.hook_event_name;
+  if (charged > MAX_EVICTED_VALUE_CHARS) { drop(sid, name); return; }
+  const prev = kept.get(sid)?.get(name);
+  const payload = foldEnrichment(prev?.payload, p);
+  const chars = payloadChars(payload);
+  drop(sid, name);
+  if (chars > MAX_EVICTED_VALUE_CHARS) return;
+  // Re-inserted, so both maps' own order is the order things were last folded
+  // in and the caps below drop the session heard from longest ago.
+  const kinds = kept.get(sid) ?? new Map();
+  kept.delete(sid);
+  kept.set(sid, kinds);
+  kinds.set(name, { seq: evt.seq, epoch: evt.epoch, receivedAt: evt.receivedAt, source: evt.source, payload, chars });
+  keptChars += chars;
+  while (kept.size > MAX_EVICTED_SESSIONS || keptChars > MAX_EVICTED_CHARS) {
+    const oldest = kept.keys().next().value;
+    if (oldest === undefined) break;
+    dropSession(oldest);
+  }
+}
+
+/** Forget everything kept — the ring was cleared. */
+export function clearEvicted() {
+  kept.clear();
+  keptChars = 0;
+}
+
+/**
+ * What a page is missing, as envelopes, oldest first: for each of `sessions`,
+ * the newest value of each kind whose last fold is newer than `after` (what
+ * the page was last sent) and older than `before` (the oldest seq the page is
+ * about to be replayed). A page that saw every one of them is sent none.
+ *
+ * @param {{ after: number, before: number, sessions: Set<string> }} range
+ */
+export function evictedEnrichment({ after, before, sessions }) {
+  const out = [];
+  for (const sid of sessions) {
+    const kinds = kept.get(sid);
+    if (!kinds) continue;
+    for (const e of kinds.values()) {
+      if (e.seq <= after || e.seq >= before) continue;
+      out.push({ seq: e.seq, epoch: e.epoch, receivedAt: e.receivedAt, source: e.source, payload: e.payload });
+    }
+  }
+  return out.sort((a, b) => a.seq - b.seq);
+}
+
+/** What is kept right now, for the suite: sessions, values and their weight. */
+export function evictedStats() {
+  let values = 0;
+  for (const kinds of kept.values()) values += kinds.size;
+  return { sessions: kept.size, values, chars: keptChars };
+}

package/src/server/lan-engine.mjs

@@ -41,7 +41,7 @@
 // anything.
 import {
   addTrusted, ANNOUNCE_MS, credentialAad, dropTrusted, identityFrom, open, peerWhy, plan, PRESENT_MS,
-  stillListed, transferChallenge, trustedPeer,
+  sharedWith, stillListed, transferChallenge, trustedPeer,
 } from "./lan-sync.mjs";
 import { mintInvite, readInvite } from "./lan-invite.mjs";
 import { createInviteOffer } from "./lan-invite-offer.mjs";
@@ -1028,13 +1028,25 @@ export function createEngine({
       had.met = had.met || row.met;
       if (row.name && !had.name) had.name = row.name;
     };
+    // WHAT IS TICKED HERE AND NOT OFFERED THAT DECK, so its dialog draws no
+    // lane going out for it: what an arrival ticked, when the accept switch
+    // paired it — see sharedWith in lan-sync.mjs. The page never sees `onward`
+    // or which pin a switch made, so the engine says the difference itself,
+    // and only where there is one, which on most decks is nowhere.
+    const notOfferedTo = id => {
+      const offered = sharedWith(cfg, id);
+      const held = cfg.shared.filter(key => !offered.includes(key));
+      return held.length ? { notOffered: held } : {};
+    };
     // WHAT THE DECK'S OWN DIALOG DRAWS, by identity: the card it sent,
-    // the logins it offered last, and when somebody here said yes. All
-    // three are keyed by the fingerprint that proved itself, so both
-    // halves of a merged row read the same answer.
+    // the logins it offered last, when somebody here said yes, and what
+    // this deck does not offer it. All four are keyed by the fingerprint
+    // that proved itself, so both halves of a merged row read the same
+    // answer.
     const card = id => ({
       ...heardOf(id),
       pairedAt: trustedPeer(cfg.trusted, id)?.at ?? null,
+      ...notOfferedTo(id),
     });
     for (const p of [...beacon.peers.values(), ...dials.rows()]) {
       if (!stillListed(p, now())) continue;