clauderipple 0.12.1 → 0.12.2

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.12.2 — 2026-10-22
+
+### Fixed
+
+- **Back on Wi-Fi only when a known Wi-Fi is in range.** After a hotspot failover, the way back
+  no longer drops the hotspot for a Wi-Fi that is not there, which cut the connection on the move.
+
+### Changed
+
+- **Naming a model on a delegation is now explained to the main chat.** `ripple:auto`'s
+  description says that `[[ripple: opus@high]]` (or a worker's name) on the first line runs that
+  model past every ClaudeRipple rule and still shows in the agents panel, so a session no longer
+  starts models outside it to get one. It also says what a brief should state, to check that the
+  report did what was asked, and to resume a worker only within 5 minutes of its last reply.
+
 ## 0.12.1 — 2026-10-21
 
 ### Changed

package/dist/app/package.json

@@ -1,5 +1,5 @@
 {
   "private": true,
-  "version": "0.12.1",
+  "version": "0.12.2",
   "type": "commonjs"
 }

package/dist/mod/hooks/workers.ts

@@ -11,7 +11,11 @@ export const AUTO_DESCRIPTION = 'Delegate any task here; ClaudeRipple picks the
   'If you know how hard the task is, put [[ripple: light]], [[ripple: standard]], [[ripple: hard]] or [[ripple: max]] on the prompt\'s first line: ' +
   'light = lookups, mechanical edits, one small fix; standard = carry out a designed change (even across several files), research, summarize, read-only review; ' +
   'hard = subtle debugging, security review, or work where a wrong call is costly; max = planning, design or architecture where the deliverable is the decision itself. ' +
-  'Size, file count or the brief\'s warnings do not by themselves make a task hard. Leave the marker out when unsure, and ClaudeRipple judges it.'
+  'Size, file count or the brief\'s warnings do not by themselves make a task hard. Leave the marker out when unsure, and ClaudeRipple judges it. ' +
+  'To run one particular model instead (the user asked for it, or a comparison needs it), name it on the first line: [[ripple: opus@high]] for a Claude model (opus, sonnet, haiku), or [[ripple: <worker agent name>@<effort>]]. ' +
+  'It runs as named, past every ClaudeRipple rule, and still shows in the agents panel; never start a model another way, such as claude -p, to get around the rules. ' +
+  'A brief states the scope, what must not be touched, the done criteria and how to verify them. Read the report for whether it did what was asked before using it. ' +
+  'Continue a worker with SendMessage only within 5 minutes of its last reply; later its cache has lapsed, so start a new one with a summary of what is done and what is left.'
 
 /**
  * The tier markers the main chat may write on a ripple:auto prompt, as the judge's verdict they

package/dist/router/src/tether-win.js

@@ -76,6 +76,13 @@ export function parseProfileNames(text) {
     }
     return names;
 }
+/** `netsh wlan show networks mode=ssid`: SSID is the protocol label, not the translated fields below it. */
+export function parseVisibleSsids(text) {
+    return [...new Set(text.split(/\r?\n/).flatMap((line) => {
+            const name = /^\s*SSID\s+\d+\s*:\s?(.*)$/.exec(line)?.[1]?.trim();
+            return name ? [name] : [];
+        }))];
+}
 function xmlText(s) {
     return s.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&#(\d+);/g, (_, n) => String.fromCodePoint(Number(n))).replace(/&amp;/g, "&");
 }
@@ -103,6 +110,8 @@ export async function listWifiProfiles(run) {
         const r = await run(NETSH, ["wlan", "export", "profile", `folder="${dir}"`], { verbatim: true });
         if (needsLocation(r))
             return { profiles: [], location: true };
+        if (r.code !== 0)
+            return { profiles: [], error: (r.stderr || r.stdout).trim().slice(0, 200) || `profile export exited ${r.code}` };
         const parsed = [];
         for (const f of fs.readdirSync(dir)) {
             if (!f.toLowerCase().endsWith(".xml"))
@@ -191,8 +200,21 @@ export class WinTetherBackend {
         if (list.location)
             return "Windows needs Location on for Wi-Fi commands";
         if (list.error)
-            return null; // cannot tell: try anyway
-        return autoProfiles(list.profiles, ssid).length ? null : "no other Wi-Fi on this PC is set to connect automatically";
+            throw new Error(`saved Wi-Fi profiles failed: ${list.error}`);
+        const known = autoProfiles(list.profiles, ssid).filter((p) => p.ssid !== ssid);
+        if (!known.length)
+            return "no other Wi-Fi on this PC is set to connect automatically";
+        if (!this.adapter)
+            throw new Error("no Wi-Fi adapter for visibility scan");
+        const shown = await this.run(NETSH, ["wlan", "show", "networks", "mode=ssid", `interface="${this.adapter}"`], { verbatim: true, timeoutMs: 20_000 });
+        if (needsLocation(shown))
+            return "Windows needs Location on to scan for known Wi-Fi; visibility is unknown";
+        if (shown.code !== 0)
+            throw new Error(`netsh Wi-Fi scan failed: ${(shown.stderr || shown.stdout).trim().slice(0, 200) || `exit ${shown.code}`}`);
+        const visible = parseVisibleSsids(shown.stdout);
+        if (!visible.length)
+            return "no known Wi-Fi in range (netsh returned no usable SSIDs; empty, redacted or unsupported scan)";
+        return known.some((p) => visible.includes(p.ssid)) ? null : "no known Wi-Fi in range";
     }
     async leave() {
         if (!this.adapter)

package/dist/router/src/tether.js

@@ -11,13 +11,14 @@
 //   failover  on Wi-Fi (or none), 3 of the last 5 probe rounds failed → `sudo -n networksetup
 //             -setairportnetwork <dev> <hotspot>`; macOS takes the password from the System keychain.
 //   return    on the hotspot, at 5, 10, 20, 30, 40, 50 and 60 min after landing and every 10 min
-//             after that, while no model call runs → disassociate (CoreWLAN through JXA, as the
+//             after that, only if another known Wi-Fi is visible, while no model call runs →
+//             disassociate (CoreWLAN through JXA, as the
 //             console user — the router is a launchd agent in the user's session) so macOS
 //             auto-joins the best known network in range; probe it; if that does not give working
 //             Wi-Fi within 20s, rejoin the hotspot and wait for the next point. The times are fixed
 //             from landing rather than a doubling backoff (owner's decision, 2026-10-20): at most
-//             ~10 min on the hotspot after arriving at a known Wi-Fi, and a brief drop every 10 min
-//             on the move, instead of a cap of 15 min.
+//             ~10 min on the hotspot after arriving at a known Wi-Fi. On the move, a read-only scan
+//             replaces the old blind drop (2026-10-21): no known Wi-Fi in range → no leave, no hold.
 //   gap       a return still postponed RETURN_FORCE_AFTER_MS past due (calls back-to-back, so never
 //             a quiet moment — 2026-10-20) makes the gap itself: new model calls are held (hold.ts:
 //             they wait, they are not refused), the running ones get up to RETURN_DRAIN_WAIT_MS to
@@ -43,18 +44,36 @@ export const NETWORKSETUP = "/usr/sbin/networksetup";
 export const OSASCRIPT = "/usr/bin/osascript";
 /** wifihop's exact call (verified in its source, `mac_disassociate_js`): a zero-argument ObjC method is invoked by reading it. */
 export const DISASSOCIATE_JS = 'ObjC.import("CoreWLAN"); $.CWWiFiClient.sharedWiFiClient.interface.disassociate; "ok";';
+/** Read-only directed scans: a non-empty set proves visibility even if CWNetwork.ssid is redacted. */
+export const SCAN_KNOWN_JS = `function run(argv) {
+  ObjC.import("CoreWLAN");
+  var wifi = $.CWWiFiClient.sharedWiFiClient.interfaceWithName(argv[0]);
+  var names = JSON.parse(argv[1]);
+  for (var n = 0; n < names.length; n++) {
+    var error = Ref();
+    var found = wifi.scanForNetworksWithNameError(names[n], error);
+    var count = Number(found.count);
+    if (!isFinite(count) || count < 0) {
+      throw new Error("CoreWLAN scan unavailable: " + (ObjC.unwrap(error[0].localizedDescription) || "no result set"));
+    }
+    if (count > 0) return "visible";
+  }
+  return "none";
+}`;
 export const PROBE_URLS = {
     apple: "http://captive.apple.com/hotspot-detect.html",
     google: "http://connectivitycheck.gstatic.com/generate_204",
 };
 export const PROBE_TIMEOUT_MS = 4_000;
 export const MIN_SWITCH_INTERVAL_MS = 60_000;
+/** How long a scan that saw a known Wi-Fi stands for a return still waiting on busy calls. */
+export const KNOWN_VISIBLE_TRUST_MS = 60_000;
 export const RETURN_PROBE_MS = 20_000;
 /**
  * When to try the way back, counted from the moment the Mac landed on the hotspot: 5, 10, 20, 30,
  * 40, 50 and 60 min, then every 10 min for as long as it stays there (owner's decision, 2026-10-20 —
  * a fixed schedule rather than a doubling one: at most ~10 min on the hotspot after arriving at a
- * known Wi-Fi, and only a brief drop every 10 min on the move).
+ * known Wi-Fi). Each point scans first; without a visible known network it never drops the hotspot.
  */
 export const RETURN_SCHEDULE_MINUTES = [5, 10, 20, 30, 40, 50, 60];
 /** After the last scheduled point, every this long. */
@@ -90,6 +109,10 @@ export function parseWifiDevice(text) {
     }
     return null;
 }
+/** `networksetup -listpreferredwirelessnetworks`: preserve SSID spaces, discard only the indent. */
+export function parsePreferredNetworks(text) {
+    return [...new Set(text.split(/\r?\n/).filter((line) => line.startsWith("\t")).map((line) => line.slice(1)).filter(Boolean))];
+}
 /** The interface's IPv4 address, or null when it has none (not associated, or no DHCP yet). */
 export function wifiIPv4(ifaces, device) {
     return ifaces[device]?.find((a) => a.family === "IPv4" && !a.internal)?.address ?? null;
@@ -279,6 +302,22 @@ class MacTetherBackend {
             this.log.warn(`tether: networksetup said: ${(r.stdout + r.stderr).trim().slice(0, 200)}`);
         return failed;
     }
+    async returnBlocked(ssid) {
+        const preferred = await this.run(NETWORKSETUP, ["-listpreferredwirelessnetworks", this.device]);
+        if (preferred.code !== 0)
+            throw new Error(`preferred Wi-Fi list failed: ${(preferred.stderr || preferred.stdout).trim().slice(0, 200) || `exit ${preferred.code}`}`);
+        const names = parsePreferredNetworks(preferred.stdout).filter((name) => name !== ssid);
+        if (!names.length)
+            return "no known Wi-Fi in range";
+        const r = await this.run(OSASCRIPT, ["-l", "JavaScript", "-e", SCAN_KNOWN_JS, this.device, JSON.stringify(names)], { timeoutMs: 30_000 });
+        if (r.code !== 0)
+            throw new Error(`CoreWLAN scan failed: ${(r.stderr || r.stdout).trim().slice(0, 200) || `exit ${r.code}`}`);
+        if (r.stdout.trim() === "visible")
+            return null;
+        if (r.stdout.trim() === "none")
+            return "no known Wi-Fi in range";
+        throw new Error("CoreWLAN scan returned an unsupported result");
+    }
     async leave() {
         const r = await this.run(OSASCRIPT, ["-l", "JavaScript", "-e", DISASSOCIATE_JS], { timeoutMs: 15_000 });
         return r.code === 0 ? null : (r.stderr || r.stdout).trim().slice(0, 200);
@@ -297,6 +336,8 @@ export class TetherController {
     state = "off";
     pinned = false;
     lastSwitchAt = 0;
+    /** When a scan last saw a known Wi-Fi other than the hotspot. */
+    knownVisibleAt = -Infinity;
     lastSwitch = null;
     lastProbe = null;
     /** When the Mac landed on the hotspot (ours or by hand); null off the hotspot. The schedule counts from here. */
@@ -570,16 +611,31 @@ export class TetherController {
     async tryReturn(settings) {
         if (this.now() - this.lastSwitchAt < MIN_SWITCH_INTERVAL_MS)
             return;
+        // A return postponed for busy calls comes back every tick; one scan that saw a known Wi-Fi is
+        // trusted for a minute rather than repeated each time (a scan takes seconds on the radio).
+        if (this.now() - this.knownVisibleAt >= KNOWN_VISIBLE_TRUST_MS) {
+            let blocked;
+            try {
+                blocked = await this.backend.returnBlocked(settings.hotspotSsid);
+            }
+            catch (e) {
+                blocked = `known Wi-Fi scan failed: ${e instanceof Error ? e.message : String(e)}`;
+            }
+            if (blocked) {
+                this.backOff(blocked);
+                return;
+            }
+            this.knownVisibleAt = this.now();
+        }
+        // A scan is asynchronous: a pin/stop/settings change or an OS join meanwhile cancels the return.
+        const current = this.deps.settings();
+        if (this.stopped || this.pinned || !current.enabled || current.hotspotSsid !== settings.hotspotSsid || !this.onHotspot(this.currentIp()))
+            return;
         const idle = this.idle();
         if (!idle && (this.now() - this.nextReturnAt < RETURN_FORCE_AFTER_MS || this.hold.closed)) {
             this.decide(`Wi-Fi return postponed: a model call is running or just started (after ${RETURN_FORCE_AFTER_MS / 1000}s of this, new calls are held to make a gap)`);
             return;
         }
-        const blocked = (await this.backend.returnBlocked?.(settings.hotspotSsid)) ?? null;
-        if (blocked) {
-            this.backOff(blocked);
-            return;
-        }
         if (idle)
             await this.leaveHotspot(settings);
         else
@@ -704,7 +760,7 @@ export class TetherController {
         const landed = this.landedOnHotspotAt ?? this.now();
         this.nextReturnAt = nextReturnPoint(landed, this.now());
         this.lastLogged = "";
-        this.decide(`staying on the hotspot (${reason}); next try in ${Math.round((this.nextReturnAt - this.now()) / 1000)}s`);
+        this.decide(`staying on the hotspot: ${reason}; next try in ${Math.round((this.nextReturnAt - this.now()) / 1000)}s`);
     }
     recordSwitch(to, ok, reason) {
         this.lastSwitch = { at: new Date(this.now()).toISOString(), to, ok, reason };

package/dist/router/src/version.js

@@ -5,4 +5,4 @@
 // from the manifests. Until 0.1.1 the router and the CLI each carried their own literal, and both
 // still said "0.1.0" in the 0.1.1 release: after an update nobody could tell which router was
 // running, and the tray app had nothing to compare (2026-09-15, reported from a Windows install).
-export const VERSION = "0.12.1";
+export const VERSION = "0.12.2";

package/docs/ARCHITECTURE.md

@@ -1643,6 +1643,7 @@ plan unless marked otherwise.
 | ChatGPT accounts that had bought Codex credits were rested by the router the moment a window read 100%, though OpenAI serves them from credits past the window | `exhaustedForMs` ignores a full window while `credits.has_credits` or `unlimited` holds (and `overage_limit_reached` does not); an actual 429 still rests the account until the window resets. |
 | After ~120 host↔relay reconnects no phone could connect for minutes — web and native sat at "connecting" while the host's control socket was open and answering pings, and a host restart did not help (the simulator's own log: every attempt 19:10–19:17 timed out waiting for the relay's `open`, then the next one worked with no change on the phone; 2026-10-15). Measured on the deployed relay with throwaway server ids: a replaced host control socket whose other end never answers the close stays in `getWebSockets("host")`, in acceptance order, for 8+ minutes, and the room sent every phone's `connect` to `sockets("host")[0]` — that dead socket — through any number of reconnects and a restart | The room routes a phone only to the **newest** host socket (each is tagged `at:<accepted ms>`), and only while it pinged within `HOST_SILENT_MS` (the runtime's auto-response timestamp); a silent newest socket is closed `4408` and the phone hears `4404 host offline` at once. The host walks the phone's path itself after every hello and every 5 min (a client socket to its own room must come back `open` within 10 s) and reconnects when it does not; a ping timer that ran late (sleep, blocked event loop) is not taken for a dead socket. Close codes, reasons and ISO timestamps are in `host.log`. In-process tests reproduce the sequence over a network that keeps dead sockets listed (`relay-reconnect.test.ts`). |
 | Return to Wi-Fi postponed forever while subagents keep working (2026-10-20): on the iPhone hotspot, the way back ran only with no model call in flight and none started in the last 20s; with Claude and subagents working back-to-back it logged "Wi-Fi return postponed" at 19:22:54 and never went back to the home Wi-Fi | A return still postponed `RETURN_FORCE_AFTER_MS` (120s) past due makes the gap itself (§8 "Making the gap"): new model calls are **held** at a gate in the proxy and the OpenAI ingress (`hold.ts`) — they wait unread, nothing is written, nothing refused or 503'd, each at most 120s — the running ones get up to 60s to finish, then the usual leave → probe runs and the gate is released whatever the outcome; calls that do not finish in time → release, next scheduled point (the fixed 5/10/20/30/40/50/60-minute return schedule of §8, 2026-10-20). The release is in a `finally` (a thrown error releases it), `stop()` releases it, the gate has its own failsafe timer, and a draining router closes it so a held call meets the retryable 503 instead of being cut. Tests: `tether.test.ts`, `hold.test.ts`. |
+| Blind returns repeatedly cut the only connection while travelling with the lid closed (2026-10-21 18:40–19:08 KST, owner-reported router.log): at each point, "trying to go back to Wi-Fi: leaving the hotspot so macOS joins the best known network", then "no network was joined", "networksetup said: Failed to join network PBJ" → `join-failed`. No known Wi-Fi was in range, and an idle iPhone stops advertising; with the lid closed macOS did not reliably rejoin it. The owner pinned the network as a stopgap. | Never leave the hotspot speculatively. Before either quiet return or the hold gate, a read-only backend check must prove another saved Wi-Fi is visible (on Windows, also an automatic profile). No match → "staying on the hotspot: no known Wi-Fi in range", once per point, then the next point on the unchanged schedule. Scan/list failure, unsupported response or Location refusal → stay and log why; never hold calls or disconnect on unknown visibility. macOS: preferred SSIDs + directed CoreWLAN JXA scans, Windows: saved profile SSIDs intersected with `netsh wlan show networks` (§8, measurements 2026-10-21). |
 | Android hotspot never recognised (2026-10-20, found by reading the code for an owner with Windows laptops and Android phones in mind): "on the hotspot" was the iPhone range 172.20.10.0/28 alone, on macOS and Windows. An Android hotspot hands out 192.168.43.x (≤ Android 10) or a random /24 (Android 11+; 192.168/16, 172.16/12, 10/8 by Android 14), so after our own failover `join()` saw no hotspot address and reported `join-failed`/`hotspot-not-visible`, while on the phone the controller read Wi-Fi and never planned the way back, and a by-hand join was never recognised | The product does not assume an iPhone. After our own join of the configured SSID is accepted by the OS, a new, non-link-local address within the settle time is the join, and its subnet (address + netmask from `os.networkInterfaces()`: no Location, no elevation) is kept in `<home>/tether.json` for that hotspot name; "on the hotspot" = iPhone range OR that network (§8). Only our own join replaces it, and a subnet equal to the Wi-Fi watched before is not remembered (logged as ambiguous) so home Wi-Fi is never read as the hotspot. Hints name both phones where the step differs. Not yet run with a real Android phone. |
 | An expired Claude login on the Mac wrote `[desktop state] …로그인이 만료되었습니다…` every few seconds per Claude app session and read the keychain (a synchronous child process) for every request, while phones learned of it only by a failed send (2026-10-15) | A login problem is one host state: logged when it starts and ends, sent to phones as `HostInfo.desktopProblem` (a banner), and the keychain is reread at most every 30 s while expired or after a 401. Per-session Remote Control errors log once per change. The host never refreshes the login itself. |
 
@@ -1796,9 +1797,9 @@ join) is **not** remembered — the two could not be told apart — and is logge
 as Wi-Fi before; not remembering it"); that join reads as Wi-Fi and no way back is planned. The
 default gateway was not used: it needs a process per OS (`route -n get default`, `Get-NetRoute`) and
 says nothing the subnet does not. Limits: a by-hand join is recognised only on a network learned
-before; a Wi-Fi elsewhere that happens to use the learned /24 reads as the hotspot, so the way back
-drops it for a few seconds at each scheduled point and the OS rejoins it (no harm beyond those drops;
-`tether.pin` stops them). Failover (on Wi-Fi or no
+before; a Wi-Fi elsewhere that happens to use the learned /24 reads as the hotspot. The way back
+can drop it only when another saved SSID is visible (visibility guard, 2026-10-21, below);
+`tether.pin` stops switching entirely. Failover (on Wi-Fi or no
 address, outage): wait at most 30s for an in-flight call, then `sudo -n networksetup
 -setairportnetwork <dev> <NAME>` (macOS takes the password from the System keychain). The probe window
 lives in the process, so it only works if the router is not restarted every few seconds while the
@@ -1811,8 +1812,9 @@ to it for the timeout duration" unless auto shutdown is off — AOSP `SoftApConf
 android-11.0.0_r1, `isAutoShutdownEnabled`). Return (on the hotspot):
 on a fixed schedule counted from landing there — 5, 10, 20, 30, 40, 50 and 60 minutes, then every
 10 minutes for as long as it stays (owner's decision, 2026-10-20: at most ~10 minutes on the hotspot
-after reaching a known Wi-Fi, and only a brief drop every 10 minutes on the move — a doubling
-backoff held it for up to 15 minutes) — and only with no call in flight and none started in the
+after reaching a known Wi-Fi — a doubling backoff held it for up to 15 minutes). **Since
+2026-10-21 each point first checks whether another saved Wi-Fi is actually in range, without
+leaving the hotspot** (below). Only with a positive check, no call in flight and none started in the
 last 20s, disassociate via JXA as the console user (wifihop's exact call: `ObjC.import("CoreWLAN");
 $.CWWiFiClient.sharedWiFiClient.interface.disassociate`) so macOS auto-joins the best known network;
 two good probes within 20s keep it; otherwise stay on (or rejoin) the hotspot and move to the next
@@ -1823,11 +1825,57 @@ switching. Every decision is logged once, with its reason. "Ask to join hotspots
 (macOS 26+, Apple 109321) covers the no-Wi-Fi-at-all case by itself; its setting lives in a root-only
 file (`com.apple.airport.preferences.plist`: permission denied, measured), so it is only hinted at.
 
+**Visibility before return (2026-10-21).** The blind drop was not brief: while travelling with
+the lid closed and no known Wi-Fi, the owner reported this sequence in router.log, 18:40–19:08 KST:
+"trying to go back to Wi-Fi: leaving the hotspot so macOS joins the best known network" → "no
+network was joined" → "networksetup said: Failed to join network PBJ" → `join-failed`. An idle iPhone
+stops advertising (above), and closed-lid macOS did not reliably rejoin; the owner pinned the
+network via the API as a stopgap. Both return paths now share a read-only check **before any hold
+is engaged or network is left** (`TetherBackend.returnBlocked`). No other known SSID visible →
+"staying on the hotspot: no known Wi-Fi in range", once per scheduled point, then the next fixed
+point; no disconnect, join or hold. Failed/unsupported scans (including Location refusal) are
+unknown visibility, never permission to disconnect: the reason is logged and the point is skipped.
+The schedule and `MIN_SWITCH_INTERVAL_MS` are unchanged. Activity, pin, stop, current network and
+settings are checked after the asynchronous scan, so a new call or a cancellation is not overlooked.
+
+Read-only measurements on the owner's Mac (2026-10-21, `sw_vers`: macOS **27.0.1**, build **26A434**;
+`stat /dev/console` and `id`: console and executing user **pbj, uid 501**; Wi-Fi **en0**, IPv4
+**172.20.10.10** before/after scanning, no join/disassociate/permission change):
+- `networksetup -listpreferredwirelessnetworks en0` returned "Preferred networks on en0:" followed
+  by **48** tab-indented SSIDs, including the configured hotspot **PBJ**. **47** remain after excluding it.
+- CoreWLAN through `/usr/bin/osascript -l JavaScript`, the same user/session path as disassociate:
+  `scanForNetworksWithNameError($(), null)` returned **12** CWNetworks with **unredacted SSIDs**,
+  including PBJ; none of the other preferred SSIDs matched. JXA's ObjC nil is `$()`: passing plain
+  JavaScript `null` as the name gave no usable count (`undefined`), not an empty scan. An early
+  diagnostic attempting to serialize the ObjC error/result also exited **139**; nonzero exit or
+  missing/invalid output must therefore stay safe, not mean visibility.
+- Directed `scanForNetworksWithNameError(name, null)` for all **48** preferred names returned
+  **PBJ: count 1, SSIDs ["PBJ"]** and **each other name: count 0, SSIDs []**. The absent control
+  `__ClaudeRipple_absent_20261021__` also returned **0**. No SSID was redacted in these successful
+  scans; **redacted directed results have not been measured**. The implementation uses directed
+  set counts, not the returned SSID, so a non-empty set can prove the named SSID's visibility even
+  if a different OS/permission context redacts that field. The returned set's `count` bridges to a JXA string
+  here (`"1"`/`"0"`), so it is converted to Number; unavailable/non-finite results fail closed.
+- The actual `SCAN_KNOWN_JS` implementation was executed read-only with those lists: **47 preferred
+  SSIDs except PBJ → `none`; [PBJ] → `visible`; [absent control] → `none`**. It passes names as a JSON
+  argv value, never interpolated code, selects en0 explicitly, and has a 30s runner timeout.
+- `system_profiler SPAirPortDataType -json` returned **24** entries in
+  `spairport_airport_other_local_wireless_networks`; **every `_name` was `<redacted>`**, as was the
+  current network. These were successive snapshots while travelling, not simultaneous counts.
+  This path cannot identify a saved SSID here and is not used.
+
+Windows uses `netsh wlan show networks mode=ssid interface="<adapter>"` and saved profiles from
+`show profiles` plus exported XML (SSID and auto/manual mode), excluding the hotspot. Only a visible
+SSID with an automatic profile permits return; names of profiles alone are not SSID evidence.
+Location denial, command errors and an empty/redacted/unsupported listing all stay on the hotspot,
+with a reason. Unit tests use injected runners only. **Unverified:** Windows live behaviour and
+an actual return with another known Wi-Fi in range; no real switch was made for this change.
+
 **Making the gap (2026-10-20).** "No call in flight and none in the last 20s" never came while Claude
 and subagents worked back-to-back: the return was postponed from 19:22:54 on and the Mac stayed on
 the hotspot (§5). So a return still postponed `RETURN_FORCE_AFTER_MS` (120s) past due stops waiting
 for a quiet moment and makes one (`returnWithGap`, tether.ts), after the same `MIN_SWITCH_INTERVAL`
-and `returnBlocked` checks: (1) engage the hold gate (`hold.ts`), shared by the proxy (`/v1/messages*`)
+and positive visibility/`returnBlocked` checks (2026-10-21): (1) engage the hold gate (`hold.ts`), shared by the proxy (`/v1/messages*`)
 and the OpenAI ingress (Responses/Chat calls). A new model call that arrives while it is engaged
 waits before its body is read and before it is counted in `messagesInFlight` — no bytes written, not
 refused, not 503 — until the gate is released or `HOLD_MAX_MS` (120s) has passed for that call, then
@@ -1941,7 +1989,9 @@ anyway netsh says so ("…need location permission… ms-settings:privacy-locati
 interface="<adapter>"` (Windows keeps the password in the profile; no profile → `no-hotspot-profile`,
 "join it once from the Wi-Fi menu"). netsh returns once the request is queued, so the address decides:
 none within 15s → `hotspot-not-visible`. Return: only if some other profile has
-`connectionMode=auto` (else no attempt, a hint, the same return schedule); `netsh wlan disconnect` lets
+`connectionMode=auto` **and its SSID is visible in `netsh wlan show networks`** (2026-10-21, visibility
+check above; unknown visibility never disconnects or holds calls). Otherwise no attempt, a logged
+reason, the same return schedule; `netsh wlan disconnect` lets
 auto-config join the best automatic network; whether a netsh disconnect suppresses that on Vista+ is
 undocumented (WlanDisconnect's "on-demand profile" note is for XP), so with no address after 8s the
 first automatic profile is joined by name. Profile names come from `show profiles` (the text after

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clauderipple",
-  "version": "0.12.1",
+  "version": "0.12.2",
   "description": "Use GPT (any ChatGPT plan with Codex), DeepSeek and 400+ other models in the Claude Desktop Code tab and Claude Code while staying signed in to your Claude subscription — no third-party gateway mode. Several ChatGPT accounts that take over when one runs out, in Codex too.",
   "license": "GPL-3.0-only",
   "workspaces": [