company-skill 4.6.7 → 4.6.8

package/scripts/dashboard.js

@@ -200,6 +200,25 @@ function priceFor(model) {
   return { i: 10, o: 50, w: 12.5, r: 1, est: true }; // unknown: best known rates
 }
 
+// Pure: sum cost + tokens across the run's session ids using a usage map.
+// usageById maps a session id to its summarized usage ({ cost, total }).
+// Only ids present in the map contribute; missing ids are skipped, not zero-padded.
+function aggregateRunSpend(manifestSessionIds, usageById) {
+  // Dedup ids internally so a duplicated id can never double-count, even if a
+  // caller (or a corrupt manifest) passes the same session id twice.
+  const ids = Array.isArray(manifestSessionIds) ? Array.from(new Set(manifestSessionIds)) : [];
+  const map = usageById || {};
+  let cost = 0, tokens = 0, matched = 0;
+  for (const id of ids) {
+    const u = map[id];
+    if (!u) continue;
+    matched += 1;
+    cost += Number(u.cost) || 0;
+    tokens += Number(u.total) || 0;
+  }
+  return { cost, tokens, sessionCount: matched };
+}
+
 function summarizeBreakdowns(breakdowns) {
   const models = [];
   let inT = 0, outT = 0, cw = 0, cr = 0, cost = 0;
@@ -282,6 +301,22 @@ function projectDir() {
   return null;
 }
 
+// Reverse a ~/.claude/projects/<slug> dir to a readable path tail.
+// The slug encodes the cwd with /. -> -, so reversal is lossy; we only need a
+// short readable tail (last 2 path-ish segments). Tolerate failure with '-'.
+function projectFromDir(dir) {
+  try {
+    if (!dir) return '-';
+    const slug = path.basename(dir);
+    const parts = slug.split('-').filter(Boolean);
+    if (!parts.length) return '-';
+    const tail = parts.slice(-2).join('/');
+    return tail || '-';
+  } catch (_) {
+    return '-';
+  }
+}
+
 function newestSessionFile(dir) {
   let best = null;
   let entries = [];
@@ -523,8 +558,8 @@ function buildCompanyState() {
     // Full description sent; client truncates in collapsed view, wraps in expanded view
     description: String(c.description || '').slice(0, 500),
     passes: !!c.passes,
-    // Send evidence text (truncated to 400 chars) so expanded view can show it
-    evidence: (c.evidence && String(c.evidence).trim()) ? String(c.evidence).slice(0, 400) : null
+    // Send full evidence (capped at 4000 chars) so expanded view shows the complete text
+    evidence: (c.evidence && String(c.evidence).trim()) ? String(c.evidence).slice(0, 4000) : null
   }));
 
   const goal = cachedReadFile(path.join(COMPANY_DIR, 'GOAL.md'));
@@ -765,9 +800,12 @@ function buildOrgTree(projDir, sessionId, liveAgents) {
 
   if (departments.length > 0) {
     // Render the COMPANY.md org chart with live-status overlay
-    for (const dept of departments) {
+    for (let deptIdx = 0; deptIdx < departments.length; deptIdx++) {
+      const dept = departments[deptIdx];
       const lead = dept.lead;
-      const leadId = 'dept-' + dept.name.replace(/\s+/g, '-').toLowerCase().slice(0, 30);
+      // Prefix with the department index so two depts sharing a 30-char name prefix
+      // never collapse to the same node id (slug-truncation collision).
+      const leadId = 'dept-' + deptIdx + '-' + dept.name.replace(/\s+/g, '-').toLowerCase().slice(0, 30);
 
       // Map live agents onto this department's roles by name similarity
       // DEPARTMENT-SCOPED: only use agents whose type/desc matches this dept's role names
@@ -790,13 +828,13 @@ function buildOrgTree(projDir, sessionId, liveAgents) {
           if (score > bestScore) { best = agent; bestScore = score; }
         }
         roleAgentMap.set(role.name, bestScore >= 20 ? best : null);
-        if (best && bestScore >= 20) mappedAgentIds.add(best.id);
+        // C27: record the canonical org-role on the agent so the table and tree show the same label
+        if (best && bestScore >= 20) { mappedAgentIds.add(best.id); best.orgRole = role.name; }
       }
 
-      // Compute lead node status from whether any dept agent is live
-      const anyDeptLive = dept.roles.some(r => roleAgentMap.get(r.name) !== null);
+      // Lead is active ONLY if an agent actually maps to the lead role, never on sibling liveness
       const leadAgent = roleAgentMap.get(lead.name);
-      const leadStatus = leadAgent ? (leadAgent.active ? 'active' : 'idle') : (anyDeptLive ? 'active' : 'idle');
+      const leadStatus = leadAgent ? (leadAgent.active ? 'active' : 'idle') : 'idle';
 
       // Tier-1: department lead node
       nodes.push({
@@ -913,19 +951,26 @@ function readRegistry() {
   return { sessions: {} };
 }
 
-function writeRegistryEntry(sessionId, entry) {
-  // Atomic read-modify-write: read fresh, update own key, write temp, rename
-  const reg = readRegistry();
-  reg.sessions[sessionId] = entry;
-  const tmp = REGISTRY_FILE + '.tmp.' + process.pid;
+// Atomic write of a registry object: temp file then rename. Shared by the
+// normal writers and the exit-time prunes so no path does a torn writeFileSync.
+function atomicWriteRegistryFile(file, obj) {
+  const tmp = file + '.tmp.' + process.pid;
   try {
-    fs.writeFileSync(tmp, JSON.stringify(reg, null, 2));
-    fs.renameSync(tmp, REGISTRY_FILE);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(tmp, JSON.stringify(obj, null, 2));
+    fs.renameSync(tmp, file);
   } catch (_) {
     try { fs.unlinkSync(tmp); } catch (_2) { /* ignore */ }
   }
 }
 
+function writeRegistryEntry(sessionId, entry) {
+  // Atomic read-modify-write: read fresh, update own key, write temp, rename
+  const reg = readRegistry();
+  reg.sessions[sessionId] = entry;
+  atomicWriteRegistryFile(REGISTRY_FILE, reg);
+}
+
 let ownEntry = null;
 if (SESSION_ID) {
   ownEntry = {
@@ -938,10 +983,30 @@ if (SESSION_ID) {
   };
 }
 
+// Global entry mirrors ownEntry plus the cross-project fields /all groups by.
+// runId comes from the run manifest when present; project is the readable cwd.
+function buildGlobalEntry() {
+  if (!ownEntry) return null;
+  let runId = null;
+  try { const m = readRunManifest(); runId = (m && m.runId) || null; } catch (_) { /* ignore */ }
+  return {
+    sessionId: SESSION_ID,
+    port: ownEntry.port,
+    url: ownEntry.url,
+    pid: ownEntry.pid,
+    project: projectFromDir(projectDir()),
+    companyDir: COMPANY_DIR,
+    runId,
+    startedAt: ownEntry.startedAt,
+    lastSeen: ownEntry.lastSeen,
+  };
+}
+
 function refreshRegistryLastSeen() {
   if (!SESSION_ID || !ownEntry) return;
   ownEntry.lastSeen = new Date().toISOString();
   writeRegistryEntry(SESSION_ID, ownEntry);
+  writeGlobalRegistryEntry(SESSION_ID, buildGlobalEntry());
 }
 
 // Remove own entry only if the stored pid matches this process (prune-own-pid-only).
@@ -954,7 +1019,7 @@ function pruneOwnRegistryEntry() {
     // Only remove if the entry still belongs to this pid
     if (!stored || stored.pid !== process.pid) return;
     delete reg.sessions[SESSION_ID];
-    fs.writeFileSync(REGISTRY_FILE, JSON.stringify(reg, null, 2));
+    atomicWriteRegistryFile(REGISTRY_FILE, reg);
   } catch (_) { /* ignore */ }
 }
 process.on('exit', pruneOwnRegistryEntry);
@@ -969,52 +1034,159 @@ if (SESSION_ID && ownEntry) {
     ownEntry.lastSeen = new Date().toISOString();
     // Use the atomic write helper; re-adds the full entry if it went missing
     writeRegistryEntry(SESSION_ID, ownEntry);
+    writeGlobalRegistryEntry(SESSION_ID, buildGlobalEntry());
   }, 15000);
   _heartbeat.unref();
 }
 
-// ---------- per-session restart toggle ----------
-// Config file: .company/context-guard-config.json
-// Shape: { "sessions": { "<sessionId>": { "enforceRestart": true|false } } }
-const TOGGLE_CONFIG = path.join(COMPANY_DIR, 'context-guard-config.json');
+// ---------- global cross-project registry ----------
+// One home-level index every company dashboard writes to IN ADDITION to its
+// per-project dashboard-registry.json. It lists exactly the company dashboards
+// running or recently seen, with their project, so a /all roll-up can enumerate
+// "all projects using the skill" without scanning every Claude Code project.
+// Decided location: ~/.claude/company-dashboards.json (co-located with projects).
+const GLOBAL_REGISTRY_FILE = path.join(os.homedir(), '.claude', 'company-dashboards.json');
 
-function readToggleConfig() {
+function readGlobalRegistry() {
   try {
-    return JSON.parse(fs.readFileSync(TOGGLE_CONFIG, 'utf8') || '{}');
-  } catch (_) {
-    return { sessions: {} };
-  }
+    const raw = fs.readFileSync(GLOBAL_REGISTRY_FILE, 'utf8');
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === 'object' && parsed.sessions) {
+      const now = Date.now();
+      for (const [sid, entry] of Object.entries(parsed.sessions)) {
+        const ts = entry.lastSeen || entry.startedAt;
+        if (ts && (now - new Date(ts).getTime()) > REGISTRY_STALE_MS) {
+          delete parsed.sessions[sid];
+        }
+      }
+      return parsed;
+    }
+  } catch (_) { /* ignore */ }
+  return { sessions: {} };
 }
 
-function writeToggleConfig(cfg) {
-  const tmp = TOGGLE_CONFIG + '.tmp.' + process.pid;
+// Atomic read-modify-write of the global registry. Best-effort: any failure is
+// swallowed so a registry hiccup can never crash or stall the dashboard.
+function writeGlobalRegistryEntry(sessionId, entry) {
   try {
-    fs.writeFileSync(tmp, JSON.stringify(cfg, null, 2));
-    fs.renameSync(tmp, TOGGLE_CONFIG);
-  } catch (_) {
-    try { fs.unlinkSync(tmp); } catch (_2) { /* ignore */ }
+    const reg = readGlobalRegistry();
+    reg.sessions[sessionId] = entry;
+    atomicWriteRegistryFile(GLOBAL_REGISTRY_FILE, reg);
+  } catch (_) { /* never crash the dashboard on a registry write */ }
+}
+
+function pruneOwnGlobalEntry() {
+  if (!SESSION_ID) return;
+  try {
+    const reg = readGlobalRegistry();
+    const stored = reg.sessions[SESSION_ID];
+    if (!stored || stored.pid !== process.pid) return;
+    delete reg.sessions[SESSION_ID];
+    atomicWriteRegistryFile(GLOBAL_REGISTRY_FILE, reg);
+  } catch (_) { /* ignore */ }
+}
+process.on('exit', pruneOwnGlobalEntry);
+
+// Pure aggregator: given the global registry entries and a session-id -> ccusage
+// usage map, sum totals and group sessions by project. No ccusage call here so a
+// test can feed controlled inputs. A session whose usage row is missing keeps a
+// null cost/tokens/cacheRead (rendered as "?", never 0) and is flagged missing.
+function aggregateAllProjects(registryEntries, sessionUsageById) {
+  const entries = Array.isArray(registryEntries) ? registryEntries : [];
+  const usage = sessionUsageById || {};
+  const totals = { cost: 0, tokens: 0, cacheRead: 0 };
+  const byProject = new Map();
+  for (const e of entries) {
+    if (!e || !e.sessionId) continue;
+    const project = e.project || '-';
+    const u = usage[e.sessionId];
+    const has = !!u;
+    const cost = has ? Number(u.cost) || 0 : null;
+    const tokens = has ? Number(u.total) || 0 : null;
+    const cacheRead = has ? Number(u.cacheRead) || 0 : null;
+    if (has) {
+      totals.cost += cost;
+      totals.tokens += tokens;
+      totals.cacheRead += cacheRead;
+    }
+    if (!byProject.has(project)) {
+      byProject.set(project, { project, cost: 0, tokens: 0, cacheRead: 0, sessions: [] });
+    }
+    const grp = byProject.get(project);
+    if (has) { grp.cost += cost; grp.tokens += tokens; grp.cacheRead += cacheRead; }
+    grp.sessions.push({
+      sessionId: e.sessionId,
+      shortId: String(e.sessionId).slice(0, 8),
+      port: e.port || null,
+      url: e.url || null,
+      cost, tokens, cacheRead, missing: !has,
+    });
   }
+  const projects = Array.from(byProject.values()).sort((a, b) => (b.cost || 0) - (a.cost || 0));
+  return { totals, projects };
+}
+
+// Scheme guard for the /all back-link href. The session url comes verbatim from
+// the world-writable global registry, so a planted javascript:/data:/file: url
+// must never reach an href. Returns the url only when it parses as http(s),
+// otherwise null so the caller renders plain text instead of a clickable link.
+function safeHttpUrl(url) {
+  if (!url) return null;
+  try {
+    const p = new URL(String(url)).protocol;
+    return (p === 'http:' || p === 'https:') ? String(url) : null;
+  } catch (e) { return null; }
 }
 
-// Returns the enforceRestart value for a session. Defaults to true when absent.
-function getEnforceRestart(sid) {
-  if (!sid) return true;
-  const cfg = readToggleConfig();
-  const s = cfg && cfg.sessions && cfg.sessions[sid];
-  if (s && typeof s === 'object' && s.enforceRestart === false) return false;
-  return true;
+// Read the global registry, pull per-session ccusage usage, and aggregate. The
+// server route wraps this; aggregateAllProjects stays pure for testing.
+function buildAllState() {
+  const reg = readGlobalRegistry();
+  const entries = Object.values(reg.sessions || {});
+  const ids = entries.map((e) => e && e.sessionId).filter(Boolean);
+  const session = getCcusage('session');
+  const usageById = sessionUsageMap(session, ids);
+  const agg = aggregateAllProjects(entries, usageById);
+  return {
+    totals: agg.totals,
+    projects: agg.projects,
+    sessionCount: ids.length,
+    caveat: 'company dashboards seen in the last 5 minutes, costs from ccusage notional on subscription',
+  };
+}
+
+// ---------- restart enforcement (always on) ----------
+// The soft-threshold restart block is always enforced and can no longer be
+// disabled per-session. The old enforceRestart toggle and its config writer
+// were removed. /api/state still reports enforceRestart for the UI, fixed true.
+
+// ---------- autoloop run manifest ----------
+// The supervisor writes <companyDir>/autoloop-run.json listing every child
+// session of one logical run. Absent file -> single-session behavior unchanged.
+function readRunManifest() {
+  try {
+    const raw = cachedReadFile(path.join(COMPANY_DIR, 'autoloop-run.json'), 256 * 1024);
+    if (!raw) return null;
+    const m = JSON.parse(raw);
+    if (!m || !Array.isArray(m.sessions)) return null;
+    return m;
+  } catch (e) {
+    return null;
+  }
 }
 
-// Atomically flip enforceRestart for a session and return the new value.
-function flipEnforceRestart(sid) {
-  if (!sid) return true;
-  const cfg = readToggleConfig();
-  if (!cfg.sessions) cfg.sessions = {};
-  const current = (cfg.sessions[sid] && cfg.sessions[sid].enforceRestart === false) ? false : true;
-  const next = !current;
-  cfg.sessions[sid] = Object.assign({}, cfg.sessions[sid] || {}, { enforceRestart: next });
-  writeToggleConfig(cfg);
-  return next;
+// Build a session-id -> usage map from ccusage session JSON, matching the same
+// period/agent substring rule buildState already uses for the live session.
+function sessionUsageMap(sessionData, sessionIds) {
+  const out = {};
+  if (!sessionData || !Array.isArray(sessionData.session)) return out;
+  for (const id of sessionIds || []) {
+    const row = sessionData.session.find(
+      (s) => String(s.period || '').includes(id) || String(s.agent || '').includes(id)
+    );
+    if (row) out[id] = summarizeBreakdowns(row.modelBreakdowns);
+  }
+  return out;
 }
 
 // ---------- /api/state ----------
@@ -1111,15 +1283,35 @@ function buildState() {
 
   refreshRegistryLastSeen();
 
+  // Cumulative spend across every child session of the current autoloop run.
+  // Absent manifest -> run stays null and the single-session view is unchanged.
+  let run = null;
+  const manifest = readRunManifest();
+  if (manifest && manifest.sessions.length) {
+    const usageById = sessionUsageMap(session, manifest.sessions);
+    const agg = aggregateRunSpend(manifest.sessions, usageById);
+    run = {
+      runId: manifest.runId || null,
+      current: manifest.current || resolvedSessionId,
+      sessionCount: agg.sessionCount,
+      totalSessions: manifest.sessions.length,
+      cost: agg.cost,
+      tokens: agg.tokens
+    };
+  }
+
   return {
     sessionId: SESSION_ID,
+    pid: process.pid,
     resolvedSessionId,
+    project: projectFromDir(orchDir || projectDir()),
     warning,
+    run,
     tokens: { available: !!(daily || session || blocks), today, session: sessionInfo, block },
     savings: computeSavings(today, orch.sessionModel),
-    context: { ...contextFill, enforceRestart: getEnforceRestart(SESSION_ID) },
+    context: { ...contextFill, enforceRestart: true },
     agents: activeAgents.map((a) => ({
-      agentType: a.agentType, model: a.model || null, description: a.description,
+      agentType: a.agentType, orgRole: a.orgRole || null, model: a.model || null, description: a.description,
       status: a.status, runtimeMs: a.runtimeMs || null, tokens: a.tokens || 0, toolCalls: a.toolCalls || 0
     })),
     org,
@@ -1176,6 +1368,10 @@ h1 { font-size: 22px; font-weight: 600; letter-spacing: -0.01em; }
 h2 { font-size: 13px; font-weight: 600; color: var(--dim); text-transform: uppercase; letter-spacing: 0.06em; margin-bottom: 0.75rem; }
 .mono { font-family: var(--font-mono); }
 .muted { color: var(--dim); }
+.identity { font-family: var(--font-mono); font-size: 13px; font-weight: 600; color: var(--text); margin-top: 0.3rem; }
+.identity .all-link { color: var(--accent, #2563eb); text-decoration: none; font-weight: 600; }
+.identity .all-link:hover { text-decoration: underline; }
+.identity .warn { color: var(--amber); }
 .topline { display: flex; align-items: baseline; justify-content: space-between; margin-bottom: 1.5rem; }
 .stats { display: flex; flex-wrap: wrap; gap: 2.5rem; margin-bottom: 1rem; }
 .stat { min-width: 9rem; }
@@ -1205,15 +1401,12 @@ tr:last-child td { border-bottom: none; }
 .feed { font-size: 13px; max-height: 22rem; overflow-y: auto; }
 .feed .row { border-bottom: 1px solid var(--line); }
 .feed .row:last-child { border-bottom: none; }
-.feed-header { display: flex; gap: 0.75rem; align-items: baseline; padding: 0.3rem 0; cursor: pointer; width: 100%; background: none; border: none; text-align: left; font-size: 13px; font-family: inherit; color: inherit; }
-.feed-header:hover { background: var(--hover); }
+.feed-line { display: flex; gap: 0.75rem; align-items: baseline; padding: 0.3rem 0; font-size: 13px; }
 .feed .ts { font-family: var(--font-mono); color: var(--dim); white-space: nowrap; font-size: 12px; flex-shrink: 0; }
 .feed .kind { font-weight: 600; width: 3.5rem; flex-shrink: 0; }
 .feed .kind.spawn { color: var(--cyan); }
 .feed .kind.finish { color: var(--accent); }
-.feed-bullet { flex: 1; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
-.feed-caret { font-size: 11px; color: var(--dim); flex-shrink: 0; padding-left: 0.5rem; }
-.feed-detail { padding: 0.3rem 0 0.5rem 1.25rem; font-size: 12.5px; white-space: normal; word-break: break-word; color: var(--dim); }
+.feed-bullet { flex: 1; white-space: normal; word-break: break-word; }
 .ctx-card { margin-top: 2.5rem; }
 .ctx-gauge-wrap { position: relative; height: 10px; border-radius: var(--radius-pill); overflow: visible; background: var(--hover); margin: 1.25rem 0 2rem; }
 .ctx-gauge-bar { position: absolute; left: 0; top: 0; height: 100%; border-radius: var(--radius-pill); transition: width 0.3s; }
@@ -1241,13 +1434,16 @@ footer { margin-top: 2rem; font-size: 12.5px; color: var(--dim); border-top: 1px
 .tree-card { position: relative; }
 .tree-header { display: flex; align-items: center; justify-content: space-between; margin-bottom: 0.75rem; }
 .tree-controls { display: flex; gap: 0.5rem; }
-.tree-btn { background: var(--surface); border: 1px solid var(--line); border-radius: 6px; cursor: pointer; padding: 0.2rem 0.5rem; font-size: 12px; color: var(--dim); }
+/* C24: pill/circle controls with consistent radius; flex centers every glyph. */
+.tree-btn { background: var(--surface); border: 1px solid var(--line); border-radius: var(--radius-pill); cursor: pointer; min-width: 1.9rem; height: 1.9rem; padding: 0 0.6rem; font-size: 12px; color: var(--dim); display: inline-flex; align-items: center; justify-content: center; }
 .tree-btn:hover { background: var(--hover); }
+.tree-btn svg { display: block; }
 .tree-container { overflow: hidden; border-radius: 12px; background: #fafaf9; border: 1px solid var(--line); position: relative; }
 .tree-svg-wrap { overflow: hidden; cursor: grab; user-select: none; }
 .tree-svg-wrap:active { cursor: grabbing; }
 #tree { display: block; width: 100%; }
 .tree-note { font-size: 12px; color: var(--dim); margin-top: 0.5rem; font-style: italic; }
+.tree-recon { font-size: 12px; color: var(--dim); margin-top: 0.25rem; }
 .node-detail { background: var(--surface); border: 1px solid var(--line); border-radius: 10px; padding: 1rem; margin-top: 0.75rem; font-size: 13px; }
 .node-detail h3 { font-size: 13px; font-weight: 600; margin-bottom: 0.5rem; }
 .nd-row { display: flex; gap: 0.5rem; padding: 0.15rem 0; }
@@ -1256,13 +1452,20 @@ footer { margin-top: 2rem; font-size: 12.5px; color: var(--dim); border-top: 1px
 @keyframes activePulse { 0%, 100% { opacity: 1; } 50% { opacity: 0.7; } }
 @media (max-width: 760px) { .stats { gap: 1.5rem; } }
 .toggle-on { background: rgba(31,136,61,0.1) !important; border-color: var(--accent) !important; color: var(--accent) !important; font-weight: 600; }
-.toggle-off { background: var(--hover) !important; color: var(--dim) !important; }
+/* C30: Apple-style pill toggle, locked ON (the 50% restart block cannot be disabled). */
+.restart-pill { display: inline-flex; align-items: center; gap: 0.5rem; font-size: 12px; color: var(--accent); font-weight: 600; cursor: default; white-space: nowrap; }
+.pill-switch { position: relative; width: 36px; height: 20px; border-radius: var(--radius-pill); background: var(--accent); flex-shrink: 0; cursor: default; }
+.pill-switch.on { background: var(--accent); }
+.pill-knob { position: absolute; top: 2px; left: 18px; width: 16px; height: 16px; border-radius: 50%; background: #fff; transition: left 0.15s ease; }
 </style>
 </head>
 <body>
 <div class="wrap">
   <div class="topline">
-    <h1>Company dashboard</h1>
+    <div>
+      <h1>Company dashboard</h1>
+      <div class="identity" id="identity"></div>
+    </div>
     <span class="muted mono" id="updated">connecting</span>
   </div>
 
@@ -1275,16 +1478,17 @@ footer { margin-top: 2rem; font-size: 12.5px; color: var(--dim); border-top: 1px
     <div class="caveat" id="caveat"></div>
   </section>
 
+  <!-- C32: policy / session model / owners band sits BEFORE the context-fill gauge. -->
+  <div class="band" id="policy-band"></div>
+
   <div class="card ctx-card">
     <div style="display:flex;align-items:center;justify-content:space-between;margin-bottom:0.5rem;">
       <h2 style="margin-bottom:0">Context fill</h2>
-      <button id="restart-toggle-btn" style="display:none;background:none;border:1px solid var(--line);border-radius:6px;cursor:pointer;padding:0.2rem 0.75rem;font-size:12px;color:var(--dim);white-space:nowrap;" title="Enable or disable the auto-restart block at the context threshold"></button>
+      <span id="restart-status" style="display:none;" title="The auto-restart block at the context threshold is always enforced and cannot be disabled"></span>
     </div>
     <div id="ctx-fill"></div>
   </div>
 
-  <div class="band" id="policy-band"></div>
-
   <div class="card">
     <h2>Active agents</h2>
     <div id="agents"></div>
@@ -1292,7 +1496,10 @@ footer { margin-top: 2rem; font-size: 12.5px; color: var(--dim); border-top: 1px
 
   <div class="card tree-card" id="tree-card">
     <div class="tree-header">
-      <h2 style="margin-bottom:0">Company delegation tree</h2>
+      <div>
+        <h2 style="margin-bottom:0">Company delegation tree</h2>
+        <div class="tree-recon" id="tree-recon"></div>
+      </div>
       <div class="tree-controls">
         <button class="tree-btn" id="zoom-in">+</button>
         <button class="tree-btn" id="zoom-out">-</button>
@@ -1340,6 +1547,12 @@ const el = (tag, cls, text) => {
   if (text !== undefined) n.textContent = text;
   return n;
 };
+// Client-side copy of collapseTitle (kept in sync with the server-side helper).
+const collapseTitle = (id, desc) => {
+  const d = desc || '';
+  const short = d.length > 56 ? d.slice(0, 56).replace(/\s+\S*$/, '') + '…' : d;
+  return id + '. ' + short;
+};
 const fmtTok = (n) => {
   if (n === null || n === undefined) return '?';
   if (n >= 1e9) return (n / 1e9).toFixed(2) + 'B';
@@ -1386,6 +1599,33 @@ function humanizeModel(modelId) {
   return name + ' (' + win + ')';
 }
 
+// C27: canonical agent label. Prefer the org-role (tree node label) so the Active-agents
+// table and the delegation tree name the SAME running agent identically.
+function agentLabel(a) {
+  if (!a) return 'agent';
+  return a.orgRole || a.agentType || 'agent';
+}
+
+function renderIdentity(s) {
+  const root = $('identity');
+  const sid = s.resolvedSessionId || s.sessionId || '';
+  const shortId = sid ? String(sid).slice(0, 8) : 'unbound';
+  const project = s.project || '-';
+  const bound = s.sessionId ? 'bound' : 'newest';
+  root.replaceChildren();
+  root.appendChild(el('span', null, 'Session ' + shortId + ' - ' + project + ' - '));
+  const state = el('span', s.warning ? 'warn' : null, s.warning ? 'unbound - newest session' : bound);
+  root.appendChild(state);
+  // C31: always-on back link to the all-sessions roll-up. This view is one session,
+  // /all is every project and every session.
+  root.appendChild(el('span', null, '  '));
+  const allLink = el('a', 'all-link', '← All projects (all sessions)');
+  allLink.href = '/all';
+  allLink.title = 'Back to the main dashboard with every project and session';
+  root.appendChild(allLink);
+  document.title = 'Session ' + shortId + ' - company dashboard';
+}
+
 function renderHeader(s) {
   const stats = $('stats');
   stats.replaceChildren();
@@ -1403,6 +1643,10 @@ function renderHeader(s) {
     add('today cost', t.today ? fmtUsd(t.today.cost) : '?', t.today ? fmtTok(t.today.total) + ' tokens' : '');
     const su = t.session && t.session.usage;
     add('session cost', su ? fmtUsd(su.cost) : '?', su ? fmtTok(su.total) + ' tokens' : 'session ' + (t.session && t.session.id || '?'));
+    if (s.run) {
+      add('run spend (' + s.run.sessionCount + ' sessions)', fmtUsd(s.run.cost),
+        fmtTok(s.run.tokens) + ' tokens across the run');
+    }
     if (s.savings && s.savings.tieringSaved !== null) {
       add('saved by model tiering', fmtUsd(s.savings.tieringSaved) + (s.savings.estimated ? ' est.' : ''), 'approx - vs all-' + shortModel(s.savings.topTierModel) + ' (current top tier)');
       add('saved by prompt caching', fmtUsd(s.savings.cacheSaved) + (s.savings.estimated ? ' est.' : ''), 'approx - cache reads vs full input price');
@@ -1462,8 +1706,8 @@ function renderAgents(s) {
   const tbody = el('tbody');
   for (const a of agents) {
     const tr = el('tr');
-    tr.appendChild(el('td', null, a.agentType));
-    tr.appendChild(el('td', 'mono', shortModel(a.model)));
+    tr.appendChild(el('td', null, agentLabel(a)));
+    tr.appendChild(el('td', 'mono', humanizeModel(a.model)));
     tr.appendChild(el('td', null, a.description));
     const td = el('td'); td.appendChild(el('span', 'pill run', a.status)); tr.appendChild(td);
     tr.appendChild(el('td', 'mono', fmtDur(a.runtimeMs)));
@@ -1481,15 +1725,24 @@ function renderContextFill(s) {
   root.replaceChildren();
   const ctx = s.context;
 
-  // Update the toggle button whenever we have a bound session
-  const toggleBtn = $('restart-toggle-btn');
-  if (toggleBtn && s.sessionId && ctx) {
-    const enforce = ctx.enforceRestart !== false;
-    toggleBtn.style.display = '';
-    toggleBtn.textContent = 'Auto-restart at ' + Math.round((ctx.threshold || 0.5) * 100) + '%: ' + (enforce ? 'ON' : 'OFF');
-    toggleBtn.className = enforce ? 'toggle-on' : 'toggle-off';
-  } else if (toggleBtn) {
-    toggleBtn.style.display = 'none';
+  // C30: Apple-style pill toggle rendered ON and LOCKED. It is inert: clicking it never
+  // disables the unconditional restart block. No config writer and no enforcement POST.
+  const statusEl = $('restart-status');
+  if (statusEl && s.sessionId && ctx) {
+    statusEl.style.display = '';
+    statusEl.replaceChildren();
+    const pill = el('span', 'restart-pill');
+    pill.title = 'Auto-restart is always enforced and cannot be disabled';
+    pill.appendChild(el('span', null, 'Auto-restart at ' + Math.round((ctx.threshold || 0.5) * 100) + '%'));
+    const sw = el('span', 'pill-switch on');
+    sw.setAttribute('role', 'switch');
+    sw.setAttribute('aria-checked', 'true');
+    sw.setAttribute('aria-disabled', 'true');
+    sw.appendChild(el('span', 'pill-knob'));
+    pill.appendChild(sw);
+    statusEl.appendChild(pill);
+  } else if (statusEl) {
+    statusEl.style.display = 'none';
   }
 
   if (!ctx || ctx.used === 0) {
@@ -1519,36 +1772,10 @@ function renderContextFill(s) {
   row.appendChild(el('span', 'ctx-pct ' + colorClass, pct + '%'));
   row.appendChild(el('span', 'muted', fmtTok(ctx.used) + ' / ' + fmtTok(ctx.window) + ' tokens'));
   if (ctx.modelId) row.appendChild(el('span', 'muted', humanizeModel(ctx.modelId)));
-  if (ctx.fill >= ctx.threshold && ctx.enforceRestart !== false) row.appendChild(el('span', 'pill warn', 'restart due'));
+  if (ctx.fill >= ctx.threshold) row.appendChild(el('span', 'pill warn', 'restart due'));
   root.appendChild(row);
 }
 
-// Set up the toggle button click handler once
-let _toggleSetup = false;
-function setupRestartToggle() {
-  if (_toggleSetup) return;
-  _toggleSetup = true;
-  const btn = $('restart-toggle-btn');
-  if (!btn) return;
-  btn.addEventListener('click', async () => {
-    btn.disabled = true;
-    try {
-      const res = await fetch('/api/restart-toggle', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({}),
-      });
-      const data = await res.json();
-      // Update button immediately without waiting for poll
-      const threshPct = btn.textContent.match(/(\d+)%/) ? btn.textContent.match(/(\d+)%/)[1] : '50';
-      const enforce = data.enforceRestart !== false;
-      btn.textContent = 'Auto-restart at ' + threshPct + '%: ' + (enforce ? 'ON' : 'OFF');
-      btn.className = enforce ? 'toggle-on' : 'toggle-off';
-    } catch (_) { /* ignore */ }
-    btn.disabled = false;
-  });
-}
-
 // MUST-FIX 1: visible unbound banner
 function renderUnboundBanner(s) {
   const banner = $('unbound-banner');
@@ -1569,14 +1796,13 @@ function treeStorageKey() {
   return 'companyTree:' + (_treeSessionId || 'unbound');
 }
 
+// C23: a page load (refresh) RESETS the tree to its natural fit instead of
+// restoring the persisted zoom/pan. We clear the stored view on load so the
+// saved key only outlives interactions within a single page lifetime, then the
+// natural vbW/vbH from layoutTree take over (svg.dataset.initVb path).
 function loadTreeView() {
   try {
-    const saved = JSON.parse(sessionStorage.getItem(treeStorageKey()) || '{}');
-    if (typeof saved.vbX === 'number') treeView.vbX = saved.vbX;
-    if (typeof saved.vbY === 'number') treeView.vbY = saved.vbY;
-    if (typeof saved.vbW === 'number') treeView.vbW = saved.vbW;
-    if (typeof saved.vbH === 'number') treeView.vbH = saved.vbH;
-    if (saved.selectedNode) treeView.selectedNode = saved.selectedNode;
+    sessionStorage.removeItem(treeStorageKey());
   } catch (_) {}
 }
 
@@ -1700,6 +1926,14 @@ function renderTree(s) {
   const org = s.org || { nodes: [], edges: [], note: '' };
   _orgNodes = org.nodes || [];
 
+  // Reconciliation line: live count == Active-agents table (s.agents.length), roles == org nodes
+  const reconEl = $('tree-recon');
+  if (reconEl) {
+    const live = (s.agents || []).length;
+    const roles = _orgNodes.filter(n => n.tier !== 0).length;
+    reconEl.textContent = live + ' agents live - ' + roles + ' roles';
+  }
+
   if (s.sessionId && !_treeSessionId) {
     _treeSessionId = s.sessionId;
     loadTreeView(); // load persisted view state now that we have a session id
@@ -1835,11 +2069,17 @@ function renderNodeDetail() {
     ['tier', node.tier === 0 ? 'orchestrator' : (node.tier === 1 ? 'lead' : 'worker')],
     ['status', node.status || '?'],
     ['dept', node.dept || '-'],
-    ['model', node.model || '-'],
-    ['tokens', fmtTok(node.tokens)],
-    ['tool calls', String(node.toolCalls || 0)],
-    ['runtime', node.runtimeMs ? fmtDur(node.runtimeMs) : '-'],
   ];
+  // Idle org role with no mapped agent: say so instead of fabricating model/token metrics
+  const noLiveAgent = node.tier !== 0 && node.status === 'idle' && !node.model && !node.tokens;
+  if (noLiveAgent) {
+    rows.push(['state', 'not currently running']);
+  } else {
+    rows.push(['model', node.model || '-']);
+    rows.push(['tokens', fmtTok(node.tokens)]);
+    rows.push(['tool calls', String(node.toolCalls || 0)]);
+    rows.push(['runtime', node.runtimeMs ? fmtDur(node.runtimeMs) : '-']);
+  }
   if (node.task) rows.push(['task', node.task]);
   if (node.surfaces) rows.push(['surfaces', node.surfaces]);
   if (node.currentAction) rows.push(['action', node.currentAction.slice(0, 120)]);
@@ -1874,22 +2114,7 @@ function setupTreeInteractions() {
     }
   }
 
-  // Mouse wheel zoom (MUST-FIX 5: set isInteracting to suppress poll re-apply)
-  wrap.addEventListener('wheel', (e) => {
-    e.preventDefault();
-    treeView.isInteracting = true;
-    const factor = e.deltaY > 0 ? 1.12 : 0.89;
-    const cx = treeView.vbX + treeView.vbW / 2;
-    const cy = treeView.vbY + treeView.vbH / 2;
-    treeView.vbW *= factor; treeView.vbH *= factor;
-    treeView.vbX = cx - treeView.vbW / 2; treeView.vbY = cy - treeView.vbH / 2;
-    // Enforce zoom floor: cannot zoom out beyond reset/natural size
-    clampToFloor();
-    svg.setAttribute('viewBox', treeView.vbX + ' ' + treeView.vbY + ' ' + treeView.vbW + ' ' + treeView.vbH);
-    saveTreeView();
-    clearTimeout(wrap._iTimer);
-    wrap._iTimer = setTimeout(() => { treeView.isInteracting = false; }, 300);
-  }, { passive: false });
+  // C26: zoom is ONLY via the +/- buttons. No wheel/pinch zoom on the tree. Pan stays.
 
   // Pan by drag
   let ds = null, dvs = null;
@@ -1959,74 +2184,25 @@ function setupTreeInteractions() {
   });
 }
 
-// Per-feed-item expand: sessionStorage set of expanded item keys, keyed per session
-function feedStorageKey() {
-  return 'feedExpanded:' + (_treeSessionId || 'unbound');
-}
-
-function loadFeedExpanded() {
-  try {
-    return new Set(JSON.parse(sessionStorage.getItem(feedStorageKey()) || '[]'));
-  } catch (_) { return new Set(); }
-}
-
-function saveFeedExpanded(set) {
-  try { sessionStorage.setItem(feedStorageKey(), JSON.stringify([...set])); } catch (_) {}
-}
-
-let _lastFeed = null;
-
-// Build a stable per-item key from ts + kind + agentType (no id on feed events)
-function feedItemKey(e, idx) {
-  return (e.ts || '') + ':' + (e.kind || '') + ':' + (e.agentType || '') + ':' + idx;
-}
-
 function renderFeed(s) {
   const root = $('feed');
   root.replaceChildren();
   const feed = s.feed || [];
-  _lastFeed = feed;
   if (!feed.length) {
     root.appendChild(el('div', 'empty', 'No spawn or finish events in the current transcript tail'));
     return;
   }
-  const expanded = loadFeedExpanded();
   for (let idx = 0; idx < feed.length; idx++) {
     const e = feed[idx];
-    const key = feedItemKey(e, idx);
-    const isOpen = expanded.has(key);
-
     const row = el('div', 'row');
-
-    // Collapsed header: timestamp + kind badge + truncated bullet + caret
-    const header = el('button', 'feed-header');
-    header.appendChild(el('span', 'ts', e.ts ? new Date(e.ts).toLocaleTimeString() : '?'));
-    header.appendChild(el('span', 'kind ' + e.kind, e.kind));
+    // Static line: timestamp + kind badge + full agentType: description (wraps, no click)
+    const line = el('div', 'feed-line');
+    line.appendChild(el('span', 'ts', e.ts ? new Date(e.ts).toLocaleTimeString() : '?'));
+    line.appendChild(el('span', 'kind ' + e.kind, e.kind));
     const bullet = el('span', 'feed-bullet');
     bullet.textContent = (e.agentType || '') + ': ' + (e.description || '');
-    header.appendChild(bullet);
-    const caret = el('span', 'feed-caret');
-    caret.textContent = isOpen ? 'v' : '>';
-    header.appendChild(caret);
-    row.appendChild(header);
-
-    // Expanded detail: full text, wrapping freely
-    if (isOpen) {
-      const detail = el('div', 'feed-detail');
-      detail.textContent = (e.agentType || '') + ': ' + (e.description || '');
-      row.appendChild(detail);
-    }
-
-    header.addEventListener('click', () => {
-      // Read fresh from storage so concurrent tabs don't clobber each other
-      const current = loadFeedExpanded();
-      if (current.has(key)) current.delete(key);
-      else current.add(key);
-      saveFeedExpanded(current);
-      // Re-render only the feed section using cached state
-      if (_lastFeed !== null) renderFeed({ feed: _lastFeed });
-    });
-
+    line.appendChild(bullet);
+    row.appendChild(line);
     root.appendChild(row);
   }
 }
@@ -2084,8 +2260,9 @@ function renderCriteria(s) {
     dot.style.flexShrink = '0';
     header.appendChild(dot);
     const titleSpan = el('span');
-    titleSpan.style.cssText = 'flex:1;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;';
-    titleSpan.textContent = itemId + '. ' + item.description;
+    // C28: collapsed criteria show the FULL description, wrapped (no ellipsis truncation).
+    titleSpan.style.cssText = 'flex:1;min-width:0;white-space:normal;word-break:break-word;';
+    titleSpan.textContent = item.description;
     header.appendChild(titleSpan);
     const caret = el('span', 'muted');
     caret.style.cssText = 'font-size:11px;flex-shrink:0;padding-left:0.5rem;';
@@ -2103,7 +2280,7 @@ function renderCriteria(s) {
       detail.appendChild(descP);
       if (item.evidence) {
         const evP = el('p', 'muted mono');
-        evP.style.cssText = 'font-size:12px;white-space:normal;word-break:break-word;';
+        evP.style.cssText = 'font-size:12px;white-space:pre-wrap;word-break:break-word;';
         evP.textContent = 'evidence: ' + (typeof item.evidence === 'string' ? item.evidence : JSON.stringify(item.evidence));
         detail.appendChild(evP);
       }
@@ -2129,28 +2306,26 @@ function renderCycles(s) {
   const root = $('cycles');
   root.replaceChildren();
   const c = s.cycles || {};
-  const table = el('table', 'center');
-  const thead = el('thead');
-  const hr = el('tr');
-  ['metric', 'value'].forEach((h) => hr.appendChild(el('th', null, h)));
-  thead.appendChild(hr);
-  table.appendChild(thead);
-  const tbody = el('tbody');
-  // Show counts and dates as headlines; drop bare byte sizes as primary values.
-  const rows = [
-    ['cycles run', String(c.cycleDirs ?? '?')],
-    ['briefings logged', String(c.briefingCount ?? '?')],
-    ['last compaction', c.lastCompaction ? new Date(c.lastCompaction).toLocaleString() : 'none seen'],
-    ['compactions observed', String(c.compactionsObserved ?? 0)],
-  ];
-  for (const [label, value] of rows) {
-    const tr = el('tr');
-    tr.appendChild(el('td', 'muted', label));
-    tr.appendChild(el('td', 'mono', value));
-    tbody.appendChild(tr);
-  }
-  table.appendChild(tbody);
-  root.appendChild(table);
+  const t = s.tokens || {};
+  const cacheRead = (t.today && t.today.cacheRead != null) ? t.today.cacheRead : null;
+  const hitRate = (t.block && t.block.cacheHitRate != null) ? t.block.cacheHitRate : null;
+  // C29: non-redundant metrics only. The header already shows the ~$ saved, so the
+  // cycles card never repeats a dollar-saved figure. Tokens, hit rate, cycles instead.
+  const stats = el('div', 'stats');
+  const tile = (label, value, sub) => {
+    const d = el('div', 'stat');
+    d.appendChild(el('div', 'label', label));
+    d.appendChild(el('b', null, value));
+    if (sub) d.appendChild(el('div', 'sub', sub));
+    stats.appendChild(d);
+  };
+  tile('cache reads reused', cacheRead != null ? fmtTok(cacheRead) + ' tok' : '?',
+    'context tokens served from cache, not re-sent');
+  tile('cache hit rate', hitRate != null ? (hitRate * 100).toFixed(1) + '%' : '?',
+    'served from cache this block');
+  tile('cycles compressed', String(c.cycleDirs ?? '?'),
+    (c.briefingCount ?? 0) + ' briefings logged');
+  root.appendChild(stats);
 }
 
 function renderBurn(s) {
@@ -2169,6 +2344,7 @@ async function tick() {
     const res = await fetch('/api/state');
     const s = await res.json();
     renderUnboundBanner(s);
+    renderIdentity(s);
     renderHeader(s);
     renderContextFill(s);
     renderBand(s);
@@ -2180,7 +2356,6 @@ async function tick() {
     renderCycles(s);
     renderBurn(s);
     setupTreeInteractions();
-    setupRestartToggle();
     $('updated').textContent = 'updated ' + new Date().toLocaleTimeString();
   } catch (e) {
     $('updated').textContent = 'disconnected';
@@ -2193,6 +2368,101 @@ setInterval(tick, 3000);
 </html>
 `;
 
+// Cross-project aggregate page. Reads /api/all (the global registry rolled up by
+// ccusage). Shows totals + a per-project breakdown, each row links back to that
+// session's own dashboard. No org tree, no criteria, no per-session structure.
+const ALL_PAGE = `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>All projects - company dashboard</title>
+<style>
+  :root { --bg:#0f1115; --card:#1a1d24; --line:#2a2f3a; --txt:#e6e8eb; --muted:#9aa3b2; --accent:#7aa2f7; }
+  * { box-sizing: border-box; }
+  body { margin:0; background:var(--bg); color:var(--txt); font:14px/1.5 system-ui,-apple-system,Segoe UI,Roboto,sans-serif; }
+  .wrap { max-width: 900px; margin: 0 auto; padding: 2rem 1.5rem; }
+  h1 { font-size: 1.4rem; margin: 0 0 0.25rem; }
+  a { color: var(--accent); text-decoration: none; }
+  a:hover { text-decoration: underline; }
+  .caveat { color: var(--muted); font-size: 12px; margin: 0.5rem 0 1.5rem; }
+  .stats { display: flex; gap: 1rem; flex-wrap: wrap; margin-bottom: 1.5rem; }
+  .stat { background: var(--card); border: 1px solid var(--line); border-radius: 10px; padding: 0.75rem 1rem; min-width: 150px; }
+  .stat .label { color: var(--muted); font-size: 12px; }
+  .stat b { font-size: 1.3rem; display: block; }
+  .proj { background: var(--card); border: 1px solid var(--line); border-radius: 10px; padding: 0.75rem 1rem; margin-bottom: 0.75rem; }
+  .proj-head { display: flex; justify-content: space-between; align-items: baseline; font-weight: 600; }
+  .proj-sub { color: var(--muted); font-size: 12px; }
+  .sess { display: flex; justify-content: space-between; font-size: 13px; padding: 0.25rem 0; border-top: 1px solid var(--line); margin-top: 0.5rem; }
+  .mono { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; }
+  .muted { color: var(--muted); }
+  #updated { color: var(--muted); font-size: 12px; }
+</style>
+</head>
+<body>
+<div class="wrap">
+  <h1>All projects</h1>
+  <div><a href="/">&larr; this session's dashboard</a> <span id="updated" class="mono">connecting</span></div>
+  <div class="caveat" id="caveat"></div>
+  <div class="stats" id="totals"></div>
+  <div id="projects"></div>
+</div>
+<script>
+  function $(id) { return document.getElementById(id); }
+  function el(tag, cls, txt) { var e = document.createElement(tag); if (cls) e.className = cls; if (txt != null) e.textContent = txt; return e; }
+  function safeHttpUrl(url) {
+    // Registry urls are world-writable, only allow http(s) into an href.
+    if (!url) return null;
+    try { var p = new URL(String(url)).protocol; return (p === 'http:' || p === 'https:') ? String(url) : null; }
+    catch (e) { return null; }
+  }
+  function fmtUsd(n) { return n == null ? '?' : '$' + Number(n).toFixed(2); }
+  function fmtTok(n) { if (n == null) return '?'; if (n >= 1e6) return (n/1e6).toFixed(1) + 'M'; if (n >= 1e3) return (n/1e3).toFixed(1) + 'k'; return String(n); }
+  function stat(parent, label, value) {
+    var d = el('div', 'stat'); d.appendChild(el('div', 'label', label)); d.appendChild(el('b', null, value)); parent.appendChild(d);
+  }
+  function render(s) {
+    $('caveat').textContent = s.caveat || '';
+    var t = $('totals'); t.replaceChildren();
+    var tot = s.totals || {};
+    stat(t, 'total cost', fmtUsd(tot.cost));
+    stat(t, 'total tokens', fmtTok(tot.tokens));
+    stat(t, 'cache read', fmtTok(tot.cacheRead));
+    stat(t, 'dashboards seen', String(s.sessionCount || 0));
+    var p = $('projects'); p.replaceChildren();
+    (s.projects || []).forEach(function (proj) {
+      var card = el('div', 'proj');
+      var head = el('div', 'proj-head');
+      head.appendChild(el('span', null, proj.project || '-'));
+      head.appendChild(el('span', 'proj-sub', fmtUsd(proj.cost) + ' - ' + fmtTok(proj.tokens) + ' tok'));
+      card.appendChild(head);
+      (proj.sessions || []).forEach(function (sess) {
+        var row = el('div', 'sess');
+        var left = el('span', 'mono');
+        var safe = safeHttpUrl(sess.url);
+        if (safe) { var a = el('a', null, sess.shortId); a.href = safe; left.appendChild(a); }
+        else { left.appendChild(el('span', null, sess.shortId)); }
+        row.appendChild(left);
+        var right = sess.missing ? '?' : (fmtUsd(sess.cost) + ' - ' + fmtTok(sess.tokens) + ' tok');
+        row.appendChild(el('span', sess.missing ? 'muted' : null, right));
+        card.appendChild(row);
+      });
+      p.appendChild(card);
+    });
+    $('updated').textContent = 'updated ' + new Date().toLocaleTimeString();
+  }
+  function tick() {
+    fetch('/api/all').then(function (r) { return r.json(); }).then(render).catch(function () {
+      $('updated').textContent = 'disconnected';
+    });
+  }
+  tick();
+  setInterval(tick, 3000);
+</script>
+</body>
+</html>
+`;
+
 // ---------- server ----------
 const server = http.createServer((req, res) => {
   const url = (req.url || '/').split('?')[0];
@@ -2214,45 +2484,30 @@ const server = http.createServer((req, res) => {
     res.end(body);
     return;
   }
+  if (req.method === 'GET' && url === '/all') {
+    res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' });
+    res.end(ALL_PAGE);
+    return;
+  }
+  if (req.method === 'GET' && url === '/api/all') {
+    let body;
+    try {
+      body = JSON.stringify(buildAllState());
+    } catch (e) {
+      res.writeHead(500, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: String(e && e.message || e) }));
+      return;
+    }
+    res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+    res.end(body);
+    return;
+  }
   if (req.method === 'GET' && url === '/api/registry') {
     const reg = readRegistry();
     res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
     res.end(JSON.stringify({ sessions: reg.sessions }));
     return;
   }
-  // POST /api/restart-toggle: flip enforceRestart for the bound SESSION_ID only.
-  // Body is ignored for session selection; only the bound session may be toggled.
-  // Returns: { "sessionId": "<id>", "enforceRestart": true|false }
-  if (req.method === 'POST' && url === '/api/restart-toggle') {
-    // Reject bodies larger than 4 KB to avoid memory accumulation from large payloads.
-    const MAX_BODY = 4096;
-    let body = '';
-    let bodyTooLarge = false;
-    req.on('data', (chunk) => {
-      if (bodyTooLarge) return;
-      body += chunk;
-      if (body.length > MAX_BODY) { bodyTooLarge = true; body = ''; }
-    });
-    req.on('end', () => {
-      if (bodyTooLarge) {
-        res.writeHead(413, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ error: 'request body too large' }));
-        return;
-      }
-      // Always use the server-bound SESSION_ID; ignore any sessionId in the body.
-      // Accepting a caller-supplied id would let any tab flip another session's toggle.
-      const sid = SESSION_ID;
-      if (!sid) {
-        res.writeHead(400, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ error: 'no session id bound to this dashboard' }));
-        return;
-      }
-      const newValue = flipEnforceRestart(sid);
-      res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
-      res.end(JSON.stringify({ sessionId: sid, enforceRestart: newValue }));
-    });
-    return;
-  }
   res.writeHead(404, { 'Content-Type': 'text/plain' });
   res.end('not found');
 });
@@ -2261,17 +2516,99 @@ const server = http.createServer((req, res) => {
 const PORT_PROBE_MAX = 20;
 let currentPort = PORT;
 
+// Pure decision for an EADDRINUSE on the derived port. The port is a
+// deterministic hash of the session id, so an occupant on it that reports the
+// SAME session id is our own stale instance and we should take over. A
+// different session id is a genuine hash clash and we probe a higher port.
+//
+// SECURITY (criterion 37 follow-up): the occupant pid comes from the occupant's
+// own /api/state HTTP response and is therefore spoofable. We NEVER kill that
+// pid. The only pid we will ever SIGTERM is regPid, the pid WE recorded for this
+// session in the local registry. Take-over is gated on the occupant proving it
+// is the very instance we recorded: occupantSessionId === ownSessionId AND
+// occupantPid === regPid. A lie about pid (occupantPid !== regPid), a missing
+// regPid, a different session, or no answer all fall back to probe-higher with
+// killPid === null, so a spoofer can never make us kill an arbitrary victim.
+// Returns { action: 'take-over' | 'probe-higher', killPid: <regPid | null> };
+// killPid is never the occupant HTTP pid.
+function decideEaddrinuse(occupantSessionId, occupantPid, ownSessionId, regPid) {
+  const sameSession = !!(ownSessionId && occupantSessionId && occupantSessionId === ownSessionId);
+  const pidMatches = !!(regPid && occupantPid && occupantPid === regPid);
+  if (sameSession && pidMatches) {
+    return { action: 'take-over', killPid: regPid };
+  }
+  return { action: 'probe-higher', killPid: null };
+}
+
+// Probe http://127.0.0.1:<port>/api/state and return the reported sessionId+pid.
+// Best-effort: any error (no answer, bad JSON, timeout) returns null so the
+// caller falls back to probe-higher rather than killing an unknown occupant.
+function probeOccupant(port, cb) {
+  let done = false;
+  const finish = (val) => { if (!done) { done = true; cb(val); } };
+  const req = http.get(
+    { host: HOST, port, path: '/api/state', timeout: 1500 },
+    (res) => {
+      let data = '';
+      res.on('data', (c) => { data += c; });
+      res.on('end', () => {
+        try {
+          const j = JSON.parse(data);
+          finish({ sessionId: (j && j.sessionId) || null, pid: (j && j.pid) || null });
+        } catch (_) { finish(null); }
+      });
+    }
+  );
+  req.on('error', () => finish(null));
+  req.on('timeout', () => { req.destroy(); finish(null); });
+}
+
+// SIGTERM the TRUSTED registry pid for this session, then retry binding the same
+// port as it frees. The pid is supplied by the gated decideEaddrinuse decision
+// (always regPid, never the spoofable occupant HTTP pid). Falls back to probing
+// higher if the pid never releases the port.
+function takeOverPort(killPid) {
+  const pid = killPid; // trusted regPid only; occupant HTTP pid is never used here
+  console.log('dashboard: port ' + currentPort + ' held by a stale instance of this session'
+    + (pid ? ' (pid ' + pid + ')' : '') + ', taking it over');
+  if (pid) { try { process.kill(pid, 'SIGTERM'); } catch (_) { /* already gone */ } }
+  let attempts = 0;
+  const maxAttempts = 30; // ~3s total at 100ms
+  const retry = () => {
+    attempts++;
+    // Clear any pending once-listener from a prior failed retry (BUG 2 path).
+    server.removeListener('listening', onListening);
+    server.once('listening', onListening);
+    server.once('error', onListenError);
+    server.listen(currentPort, HOST);
+  };
+  // onListenError below distinguishes a still-busy port from a real failure and
+  // schedules another retry until maxAttempts, then probes higher.
+  takeOverPort._retry = retry;
+  takeOverPort._attempts = () => attempts;
+  takeOverPort._max = maxAttempts;
+  retry();
+}
+
 function startListening() {
-  server.listen(currentPort, HOST, onListening);
+  // BUG 2 fix: a prior failed bind leaves its 'listening' once-listener pending
+  // (the event never fired). Clear it first so a close()+re-listen registers
+  // exactly one listener and onListening fires exactly once on the next bind.
+  server.removeListener('listening', onListening);
+  server.once('listening', onListening);
+  server.once('error', onListenError);
+  server.listen(currentPort, HOST);
 }
 
 function onListening() {
+  server.removeListener('error', onListenError);
   const chosenPort = currentPort;
   if (SESSION_ID && ownEntry) {
     // Record actual chosen port (may differ from the initial PORT after probe)
     ownEntry.port = chosenPort;
     ownEntry.url = 'http://' + HOST + ':' + chosenPort;
     writeRegistryEntry(SESSION_ID, ownEntry);
+    writeGlobalRegistryEntry(SESSION_ID, buildGlobalEntry());
   }
   // Warm the slow ccusage caches right away.
   refreshCcusage('daily');
@@ -2282,26 +2619,64 @@ function onListening() {
   console.log('dashboard listening on ' + url + ' (' + bound + ', company dir: ' + COMPANY_DIR + ')');
 }
 
-server.on('error', (err) => {
-  if (err.code === 'EADDRINUSE') {
-    const tried = currentPort;
-    if (currentPort < PORT + PORT_PROBE_MAX) {
-      currentPort++;
-      // Remove old listeners so re-listen is clean
-      server.close(() => { startListening(); });
+let inTakeOver = false;
+
+function probeHigher() {
+  if (currentPort < PORT + PORT_PROBE_MAX) {
+    currentPort++;
+    server.close(() => { startListening(); });
+  } else {
+    process.stderr.write(
+      'dashboard: port ' + PORT + ' is in use and probing ' + PORT + '+1..' +
+      PORT_PROBE_MAX + ' all failed. Free a port in that range and retry.\n'
+    );
+    process.exit(1);
+  }
+}
+
+// Listen-error handler: on EADDRINUSE, decide between taking over a same-session
+// stale instance and probing higher for a genuine different-session clash.
+function onListenError(err) {
+  if (err.code !== 'EADDRINUSE') {
+    process.stderr.write('dashboard: server error: ' + err.message + '\n');
+    process.exit(1);
+    return;
+  }
+  if (inTakeOver) {
+    // Mid take-over: the SIGTERM'd pid has not freed the port yet. Retry the
+    // same port a few times, then give up and probe higher.
+    if (takeOverPort._attempts() < takeOverPort._max) {
+      setTimeout(() => { takeOverPort._retry(); }, 100);
     } else {
-      process.stderr.write(
-        'dashboard: port ' + PORT + ' is in use and probing ' + PORT + '+1..' +
-        PORT_PROBE_MAX + ' all failed. Free a port in that range and retry.\n'
-      );
-      process.exit(1);
+      console.log('dashboard: stale instance did not release port ' + currentPort
+        + ' in time, probing a higher port');
+      inTakeOver = false;
+      probeHigher();
     }
     return;
   }
-  // Non-EADDRINUSE errors are unexpected - surface them clearly
-  process.stderr.write('dashboard: server error: ' + err.message + '\n');
-  process.exit(1);
-});
+  // First EADDRINUSE on this port: ask who holds it. The trusted pid is the one
+  // WE recorded for this session in the local registry; the occupant's
+  // self-reported pid is spoofable and is only used to confirm identity, never to
+  // pick a kill target.
+  const regPid = (() => {
+    try { const r = readRegistry(); const e = r.sessions[SESSION_ID]; return e && e.pid; }
+    catch (_) { return null; }
+  })();
+  probeOccupant(currentPort, (occupant) => {
+    const decision = SESSION_ID && occupant
+      ? decideEaddrinuse(occupant.sessionId, occupant.pid, SESSION_ID, regPid)
+      : { action: 'probe-higher', killPid: null };
+    if (decision.action === 'take-over') {
+      inTakeOver = true;
+      server.close(() => { takeOverPort(decision.killPid); });
+    } else {
+      // Different session, spoofed/mismatched pid, missing regPid, or no answer:
+      // never kill, keep the old probe-higher behavior.
+      probeHigher();
+    }
+  });
+}
 
 // Guard: only bind the port when run directly, not when require()'d for tests.
 if (require.main === module) startListening();
@@ -2326,6 +2701,14 @@ function humanizeModel(modelId) {
   return name + ' (' + win + ')';
 }
 
+// Truncate a criterion title to a short word-boundary prefix for the collapsed row.
+// Mirrors the client-side copy inside PAGE so the dashboard and tests agree exactly.
+function collapseTitle(id, desc) {
+  const d = desc || '';
+  const short = d.length > 56 ? d.slice(0, 56).replace(/\s+\S*$/, '') + '…' : d;
+  return id + '. ' + short;
+}
+
 // Server-side copy of layoutTree (mirrors the client-side copy in PAGE) for test export.
 // Keep in sync with the client-side definition inside the PAGE template.
 function layoutTree(org) {
@@ -2389,5 +2772,5 @@ function layoutTree(org) {
 
 // Test-only exports; the server path never calls require() on itself.
 if (typeof module !== 'undefined') {
-  module.exports = { usedTokens, humanizeModel, layoutTree };
+  module.exports = { usedTokens, humanizeModel, layoutTree, collapseTitle, aggregateRunSpend, buildOrgTree, aggregateAllProjects, safeHttpUrl, decideEaddrinuse, atomicWriteRegistryFile };
 }