instar 1.3.1649 → 1.3.1650

package/dashboard/console/accounts.js

@@ -7,7 +7,7 @@
 //   repair / retry / cancel   POST /subscription-relogin/repair-cell       operator session
 
 import { buildAccountsPage, frameworkName } from './accounts-model.js';
-import { el, setKids, pageHead, sheet, closeSheet, story, details, note, cantTell, askPin, forgetOperatorSession, firstPaint, arrivalScroll } from './ui.js';
+import { el, setKids, pageHead, sheet, closeSheet, story, details, note, cantTell, askPin, forgetOperatorSession, firstPaint, arrivalScroll, markNeed } from './ui.js';
 import { legacyHref } from './nav-model.js';
 import { verifiedDisplayName } from './display-identity.js';
 
@@ -60,6 +60,7 @@ export async function renderAccounts(main, ctx) {
       return row;
     })))));
 
+  markNeed(needs, 'accounts');
   setKids(main,
     pageHead({ eyebrow: 'Capacity · Accounts', headline: page.headline, sub: page.sub, tone: page.tone, facts: page.facts }),
     page.partial ? note(page.partial) : null,

package/dashboard/console/agents-model.js

@@ -315,7 +315,7 @@ export function waitingCards(pairing, now = Date.now()) {
   for (const n of pairing.restartNotices) cards.push({ kind: 'restart', id: n.id, title: 'An invite was cleared by a restart', body: `An invite from ${claimed(n.claimedAgent, n.claimedOwner)} was waiting for your approval when I restarted, and it was cleared (its secret lived only in memory). Paste it again, or forward it to my Telegram, before it expires at ${localTime(n.exp, now)}.`, actions: ['dismiss'] });
   for (const a of pairing.alarms) {
     const secondName = verifiedDisplayName(a.secondAccept && a.secondAccept.agent);
-    cards.push({ kind: 'alarm', iid: a.iid, title: 'Warning: your invite got out', body: `Two agents used the same invite, so I paused the first one: it cannot receive anything secret. The second ${secondName ? `calls itself ${secondName}` : 'has no verified name'}. Make a new invite and send it privately.`, actions: [] });
+    cards.push({ kind: 'alarm', iid: a.iid, title: 'Warning: your invite got out', body: `Two agents used the same invite, so I paused the first one: it cannot receive anything secret. The second ${secondName ? `calls itself ${secondName}` : 'has no verified name'}. Make a new invite and send it privately.`, actions: ['new-invite'] });
   }
   for (const p of pairing.pendingAccepts) cards.push({ kind: 'accept', iid: p.iid, name: verifiedDisplayName(p.claimedAgent) || 'An unnamed agent', title: `Pair with ${claimed(p.claimedAgent, p.claimedOwner)}?`, body: `Only approve if you know who sent you this invite. Check code (optional, to read to them): ${p.checkCode || '—'}. It expires at ${localTime(p.exp, now)}.`, actions: ['approve', 'decline'] });
   for (const i of pairing.finishPrompts) cards.push({ kind: 'finish', iid: i.iid, name: verifiedDisplayName(i.acceptor && i.acceptor.agent) || 'An unnamed agent', title: `${verifiedDisplayName(i.acceptor && i.acceptor.agent) || 'An unnamed agent'} accepted your invite.`, body: `${claimed(i.acceptor && i.acceptor.agent, i.acceptor && i.acceptor.owner).replace(/^the/, 'The')} accepted it. Finish only if that is who you sent it to.`, actions: ['finish', 'not-them'] });
@@ -341,7 +341,7 @@ export function buildAgentsPage({ health, pairingRes, invitesRes, peersRes, conv
     return {
       mode: 'off', certain: relayOff, relay, pairing, agents, waiting, conversations, facts: [], topicNames,
       headline: relayOff ? 'The agent network is off on this agent.' : 'The agent network looks off on this agent.',
-      sub: `${relayOff ? '' : `${relay.word}. `}Pairing is turned off too. To turn it on, ask me to “connect to the agent network”, or tap Turn on pairing below; that restarts my server, and this page reconnects by itself.`,
+      sub: `${relayOff ? '' : `${relay.word}. `}Pairing is turned off too. To turn it on, ask me to “connect to the agent network”, or tap Turn on pairing; that restarts my server, and this page reconnects by itself.`,
       tone: 'muted', notes: [],
     };
   }
@@ -378,7 +378,7 @@ export function buildAgentsPage({ health, pairingRes, invitesRes, peersRes, conv
   const subParts = [];
   if (waiting.length && !relay.connected && relay.state !== 'cant-tell' && !relayOff) subParts.push(`${relay.word}.`);
   if (pairing.state === 'elsewhere') subParts.push(pairing.holder ? `Pairing runs on ${pairing.holder.name}; open the console there to make or approve invites.` : 'Pairing runs on another of my machines.');
-  if (pairing.state === 'off' && agents.length) subParts.push(paired.length ? 'Existing agents are listed below.' : agents.some(a => a.historyOnly) ? 'Past conversations are saved below.' : 'No agents are paired here.');
+  if (pairing.state === 'off' && agents.length) subParts.push(paired.length ? 'Existing agents are still listed.' : agents.some(a => a.historyOnly) ? 'Past conversations are still saved.' : 'No agents are paired here.');
   if (pairing.state === 'cant-tell') subParts.push(pairing.reason);
   if (!agents.length && pairing.state === 'ok' && !waiting.length) subParts.push('Connect another agent to start.');
   if (relay.identity && relay.identity.tone === 'bad') subParts.push(relay.identity.word + '.');

package/dashboard/console/agents.js

@@ -14,7 +14,7 @@
 import {
   buildAgentsPage, threadModel, inviteResultWords, pinResultWords, bearerResultWords, enableWords, bindRequest, bindResultWords, localTime,
 } from './agents-model.js';
-import { el, setKids, pageHead, section, sheet, closeSheet, story, details, note, cantTell, askPin, firstPaint } from './ui.js';
+import { el, setKids, pageHead, section, sheet, closeSheet, story, details, note, cantTell, askPin, firstPaint, markNeed } from './ui.js';
 import { legacyHref } from './nav-model.js';
 import { verifiedDisplayName, uniqueNamedChoices } from './display-identity.js';
 import { topicNameMap } from './topic-names.js';
@@ -70,16 +70,18 @@ export async function renderAgents(main, ctx) {
   const connect = el('button', { class: 'btn-primary btn-inline connect-btn', type: 'button', text: '+ Connect another agent', onclick: () => openConnect(deps) });
   setKids(main, el('div', { class: 'agents-page' },
     pageHead({ eyebrow: EYEBROW, headline: page.headline, sub: page.sub, tone: page.tone, facts: page.facts }),
-    page.waiting.map((w) => waitingCard(w, deps)),
+    // Pairing being off is the thing to fix here, so its switch leads rather than following the lists.
+    page.pairing.state === 'off' ? turnOnCard(deps) : null,
+    page.waiting.map((w) => markNeed(waitingCard(w, deps), 'agents')),
     page.relay.connected || page.relay.state === 'cant-tell' ? null : relayLine(page.relay),
     page.relay.state === 'cant-tell' ? note(page.relay.word + '.') : null,
     page.notes.map((n) => note(n)),
     el('div', { class: 'page-sections' },
-      agentRows.length || page.pairing.state === 'ok' ? section({ id: 'agents', title: 'Agents', rows: agentRows, empty: 'No other agents yet. Connect one below.', onRow: (r) => openAgent(r.agent, deps) }) : null,
+      agentRows.length || page.pairing.state === 'ok' ? section({ id: 'agents', title: 'Agents', rows: agentRows, empty: 'No other agents yet. Use Connect another agent to add one.', onRow: (r) => openAgent(r.agent, deps) }) : null,
       pastRows.length ? section({ id: 'past-agents', title: 'Past conversations', collapsed: true, rows: pastRows, onRow: (r) => openAgent(r.agent, deps) }) : null,
       page.pairing.openInvites.length ? section({ id: 'open-invites', title: 'Invites not used yet', collapsed: true, rows: page.pairing.openInvites.map((i) => ({ key: `inv:${i.iid}`, main: 'Unused invitation', sub: `works once · expires at ${localTime(i.exp)}`, invite: i })), onRow: (r) => openInvite(r.invite, deps) }) : null,
     ),
-    page.pairing.state === 'off' ? turnOnCard(deps) : page.pairing.state === 'elsewhere' ? note(page.pairing.holder ? `Pairing runs on ${page.pairing.holder.name}; open the console there to connect another agent.` : 'Pairing runs on another of my machines; connect another agent from there.') : el('div', { class: 'page-primary' }, connect),
+    page.pairing.state === 'elsewhere' ? note(page.pairing.holder ? `Pairing runs on ${page.pairing.holder.name}; open the console there to connect another agent.` : 'Pairing runs on another of my machines; connect another agent from there.') : el('div', { class: 'page-primary' }, connect),
     footLink(),
   ));
 }
@@ -158,6 +160,7 @@ function waitingCard(w, deps) {
     b.addEventListener('click', () => pinned('Finish pairing', `/threadline/pairing/invites/${encodeURIComponent(w.iid)}/finish`, `Finish pairing with ${w.name}: I pin it as verified.`, 'Finishing. Checking we can talk…', b));
     acts.append(b);
   }
+  if (w.actions.includes('new-invite')) acts.append(el('button', { class: 'btn-primary btn-inline', type: 'button', text: 'Make a new invite', onclick: () => openConnect(deps) }));
   if (w.actions.includes('not-them')) {
     const b = el('button', { class: 'btn-quiet btn-danger-outline', type: 'button', text: 'Not them' });
     b.addEventListener('click', () => {

package/dashboard/console/console.css

@@ -772,6 +772,7 @@ button.run-mark:focus-visible { outline: 2px solid var(--accent); outline-offset
 /* ── Development (under-the-hood.md: Shipping + Feedback + Pace) ─────────── */
 .tiles-dev { margin-top: var(--s-3); }
 .dev-page .need-card { margin-bottom: var(--s-3); }
+.dev-page .need-line { display: block; margin-bottom: var(--s-3); }
 .ideas-page .need-card { margin: var(--s-3) 0; }
 .ideas-page .need-sub { margin: 0; }
 .ideas-page .need-sub:empty { display: none; }

package/dashboard/console/console.js

@@ -10,6 +10,7 @@ import {
 } from './home-model.js';
 import { GROUPS, legacyHref, icon, tabHref, LEGACY_DASHBOARD } from './nav-model.js';
 import { fillPartial } from './home-model.js';
+import { NEED_SOURCES, surfacedNeeds } from './needs-model.js';
 import { renderPromises, topicLink } from './promises.js';
 import { renderMachines } from './machines.js';
 import { renderAccounts } from './accounts.js';
@@ -30,6 +31,7 @@ import { renderSessions } from './sessions.js';
 import { renderMaturation, maturationTile } from './maturation-board.js';
 import { renderIdeas, ideasTile } from './ideas.js';
 import { paceCard } from './pace.js';
+import { takeTicket, signInAtBoot } from './ticket-model.js';
 import { sheetIsOpen, closeSheet, unlockCheck, machineIssue, MACHINES_PAGE, newArrival, refreshHeld } from './ui.js';
 
 const TOKEN_KEY = 'instar_token';      // shared with the legacy dashboard
@@ -91,11 +93,12 @@ function toggleTheme() {
 // told "can't tell". Cross-machine reads in particular can be slow for a moment.
 const MIN_TIMEOUT_MS = 20000;
 const RETRY_DELAY_MS = 0; // retry at once: a timeout already waited MIN_TIMEOUT_MS
-async function getOnce(path, timeoutMs) {
+async function getOnce(path, timeoutMs, soft403 = false) {
   const ctl = new AbortController();
   const t = setTimeout(() => ctl.abort(), timeoutMs);
   try {
     const r = await fetch(path, { headers: { Authorization: `Bearer ${token}` }, signal: ctl.signal, cache: 'no-store' });
+    if (r.status === 403 && soft403) return failure('the server answered 403');
     if (r.status === 401 || r.status === 403) { signOut(); return failure('not signed in'); }
     if (r.status === 503) return failure('switched off on this agent');
     if (!r.ok) return { ...failure(`the server answered ${r.status}`), retryable: r.status >= 500 };
@@ -468,7 +471,8 @@ function loadHome() {
   const { models, raw, results } = run;
   const paint = (id) => {
     // "What needs you" is the one answer: queue items plus promises waiting on the operator.
-    const model = id === 'needs' ? combineNeeds(raw.needs, raw.promised) : raw[id];
+    const model = id === 'needs' ? combineNeeds(raw.needs, raw.promised, surfacedNeeds(run.sources)) : raw[id];
+    if (!model) return; // nothing read yet for this card
     const shown = paintCard(CARDS.find((c) => c.id === id), model) || model;
     models[id] = shown;
     // The action queue must use the same last-known promise reading as its
@@ -527,6 +531,24 @@ function loadHome() {
     };
     attempt();
   };
+  // What needs the operator on other pages (needs-model.js): one in-flight read per source, no
+  // retry timer of its own (the next tick is the retry), and a 403 here never signs anyone out.
+  run.tick = (run.tick || 0) + 1;
+  for (const source of NEED_SOURCES) {
+    if (run.sourceBusy[source.id]) continue;
+    if (source.when && !source.when(run.sources)) continue;
+    if (source.everyTicks && run.sourceAt[source.id] && run.tick - run.sourceAt[source.id] < source.everyTicks) continue;
+    run.sourceAt[source.id] = run.tick;
+    run.sourceBusy[source.id] = true;
+    const keys = Object.keys(source.reads);
+    Promise.all(keys.map((k) => getOnce(source.reads[k], Math.max(TIMEOUT_MS, MIN_TIMEOUT_MS), true))).then((reads) => {
+      run.sourceBusy[source.id] = false;
+      if (!run.active || run.document !== document) return;
+      run.sources[source.id] = { ...(run.sources[source.id] || {}), results: Object.fromEntries(keys.map((k, i) => [k, reads[i]])) };
+      paint('needs');
+      paintHeadline(models);
+    });
+  }
   // Every source has one in-flight request and its own bounded retry timer.
   // A slow source cannot block another card or start overlapping refreshes.
   read('pool', '/pool', POOL_TIMEOUT_MS);
@@ -542,7 +564,7 @@ function loadHome() {
 }
 
 function renderHome(main) {
-  homeRun = { active: true, document, models: Object.fromEntries(CARDS.map((c) => [c.id, { state: 'loading' }])), raw: {}, results: {}, pending: {}, failures: {} };
+  homeRun = { active: true, document, models: Object.fromEntries(CARDS.map((c) => [c.id, { state: 'loading' }])), raw: {}, results: {}, pending: {}, failures: {}, sources: {}, sourceBusy: {}, sourceAt: {} };
   main.replaceChildren(
     el('section', { class: 'hero' },
       el('div', { class: 'eyebrow', id: 'heroTime', text: 'Checking in' }),
@@ -696,5 +718,14 @@ function previewBanner() {
   applyTheme(readTheme());
   await loadPreviewInfo();
   try { token = localStorage.getItem(TOKEN_KEY) || ''; } catch { token = ''; }
-  if (await validToken(token)) start(); else renderUnlock();
+  // An owner's paired phone opens signed in without the PIN (mobile-console-device-signin §3.5).
+  let ticket = '';
+  try { ticket = takeTicket(sessionStorage); } catch { ticket = ''; }
+  const signIn = await signInAtBoot({ storedToken: token, validToken, ticket, fetchFn: (p, o) => fetch(p, o) });
+  if (signIn.via === 'ticket') {
+    // Stored exactly as the PIN unlock stores it.
+    try { localStorage.setItem(TOKEN_KEY, signIn.token); } catch { /* storage blocked */ }
+  }
+  token = signIn.token;
+  if (signIn.via === 'pin') renderUnlock(); else start();
 })();

package/dashboard/console/costs-model.js

@@ -387,6 +387,18 @@ export function buildRouting(res) {
  * Build the whole page from the reads: { spend, caps, status, metrics, insights, tokens, claude, codex, orphans, chains, names }.
  * Returns { headline, sub, tone, facts, window, recorded, limits, checks, conversations, routing }.
  */
+/**
+ * Spending limits the operator turned on that are not enforcing: they believe money is capped
+ * and it is not. Only this counts: a route they froze is their own choice, and a pending
+ * restart is the agent's job. The only control is in the legacy Spend tab, so that is the action.
+ */
+export function spendingNeed(statusRes) {
+  if (!statusRes || !statusRes.ok) return null;
+  const st = (statusRes.data || {}).lifecycleState;
+  if (st !== 'probe-failed' && st !== 'construction-failed') return null;
+  return { title: 'Spending limits are on but not enforcing', why: 'Paid use is not capped right now, even though limits are turned on.' };
+}
+
 export function buildCostsPage(res, now = Date.now(), { window = DEFAULT_WINDOW } = {}) {
   const r = res || {};
   const w = windowParams(window, now);

package/dashboard/console/costs.js

@@ -3,8 +3,8 @@
 // switch stay in the legacy Spend tab until their native sheets ship. Every value
 // reaches the DOM through textContent; the model (costs-model.js) decides everything.
 
-import { buildCostsPage, WINDOWS, DEFAULT_WINDOW, GRAINS, windowParams, spendQuery, committedLine, basisWord, fmtTokens, fmtUsd, modelWord, doorWord } from './costs-model.js';
-import { el, setKids, pageHead, section, sheet, story, details, note, cantTell, firstPaint } from './ui.js';
+import { buildCostsPage, WINDOWS, DEFAULT_WINDOW, GRAINS, windowParams, spendQuery, committedLine, basisWord, fmtTokens, fmtUsd, modelWord, doorWord, spendingNeed } from './costs-model.js';
+import { el, setKids, pageHead, section, sheet, story, details, note, cantTell, firstPaint, markNeed } from './ui.js';
 import { legacyHref } from './nav-model.js';
 import { sessionLabel } from './home-model.js';
 
@@ -43,8 +43,11 @@ export async function renderCosts(main, ctx) {
   timeControl.classList.add('time-control');
   hero.insertBefore(timeControl, hero.querySelector('.facts'));
 
+  const spending = spendingNeed(status);
   setKids(main, el('div', { class: 'costs-page' },
     hero,
+    spending ? markNeed(el('div', { class: 'need-card' }, el('span', { class: 'need-title', text: spending.title }), el('span', { class: 'need-sub', text: spending.why }),
+      el('a', { class: 'btn-primary btn-inline', href: legacyHref('spend'), text: 'Open the spending controls' })), 'spending') : null,
     el('div', { class: 'page-controls' }, routingLink),
     el('div', { class: 'page-sections' },
       recordedSection(page, repaint),
@@ -75,7 +78,7 @@ function recordedSection(page, repaint) {
     const more = el('details', { class: 'raw more-detail' }, el('summary', { text: 'More detail' }),
       el('p', { class: 'card-line', text: 'How the ledger is grouped. By hour and by day follow the time window above; by month and all time cover every retained day.' }), grainChips,
       r.horizonNote ? el('p', { class: 'card-note', text: r.horizonNote }) : null,
-      el('p', { class: 'card-note', text: `Source: ${r.source || 'the feature-metrics ledger'}${r.lastReconcileAt ? `, reconciled ${new Date(r.lastReconcileAt).toLocaleString([], { month: 'short', day: 'numeric', hour: 'numeric', minute: '2-digit' })}` : ''}${r.rollupMaintained ? '' : ' · rollup not maintained'}. Reporting figures are recomputed at current prices; the committed figures below are what a limit enforces.` }));
+      el('p', { class: 'card-note', text: `Source: ${r.source || 'the feature-metrics ledger'}${r.lastReconcileAt ? `, reconciled ${new Date(r.lastReconcileAt).toLocaleString([], { month: 'short', day: 'numeric', hour: 'numeric', minute: '2-digit' })}` : ''}${r.rollupMaintained ? '' : ' · rollup not maintained'}. Reporting figures are recomputed at current prices; the committed figures are what a limit enforces.` }));
     wrap.append(more);
   }
   // Paid routes: committed limits and committed spend, visibly apart from the reporting rows.

package/dashboard/console/development-model.js

@@ -74,14 +74,20 @@ function shippingRow(group, pr, sub, end, tone, record, repo, stage) {
 }
 
 /** The watcher's own health line (slow vs stuck vs silently failed are separate states). */
+/** A stop only the agent's own records hold: it releases this itself, so nothing is asked of the operator yet. */
+export function agentOwnedStop(w) {
+  const stops = w && w.gate && Array.isArray(w.gate.rollbackStops) ? w.gate.rollbackStops : [];
+  return stops.length > 0 && stops.every((s) => s && s.class === 'agent');
+}
+
 export function watcherLine(w, now = Date.now()) {
   if (!w) return { text: 'Merge watcher: no reading.', tone: 'unknown' };
   if (w.invariantOk === false) return { text: 'Merge watcher: its safety invariant failed; it will not arm anything until that clears.', tone: 'bad' };
   if (w.breaker && w.breaker.open) return { text: 'Merge watcher paused itself after repeated failures.', tone: 'bad' };
   const gate = w.gate || {};
   const stops = Array.isArray(gate.rollbackStops) ? gate.rollbackStops : [];
-  if (stops.length && stops.every((s) => s && s.class === 'agent')) return { text: 'Auto-merging is stopped by the agent for its own reason. It releases this itself when its condition is met; you can also turn it back on below.', tone: 'attn', stopped: true };
-  if (Array.isArray(gate.rollback) && gate.rollback.length) return { text: 'Auto-merging is stopped (you or the agent rolled it back). Turn it back on below.', tone: 'attn', stopped: true };
+  if (stops.length && stops.every((s) => s && s.class === 'agent')) return { text: 'Auto-merging is stopped by the agent for its own reason. It releases this itself when its condition is met; you can also turn it back on here.', tone: 'attn', stopped: true };
+  if (Array.isArray(gate.rollback) && gate.rollback.length) return { text: 'Auto-merging is stopped (you or the agent rolled it back).', tone: 'attn', stopped: true };
   if (!w.lastTickAt) return { text: 'Merge watcher has not checked yet.', tone: 'unknown' };
   const age = now - w.lastTickAt;
   if (age > 2 * WATCHER_CADENCE_MS) return { text: `Merge watcher last checked ${ago(w.lastTickAt, now)}, usually every ${Math.round(WATCHER_CADENCE_MS / 60000)} min.`, tone: 'attn' };
@@ -464,7 +470,7 @@ export function buildFeedback(res = {}, now = Date.now()) {
     state = 'cant-tell';
     const k = failed.find((x) => todoFeeds.includes(x));
     headline = `I can’t tell whether feedback needs you: ${names[k]} didn’t answer (${reasonOf(res[k])}).`; tone = 'muted';
-    if (todos.length) sub = `${plural(todos.length, 'thing')} that ${todos.length === 1 ? 'does' : 'do'} need you ${todos.length === 1 ? 'is' : 'are'} listed below from the reads that answered.`;
+    if (todos.length) sub = `${plural(todos.length, 'thing')} that ${todos.length === 1 ? 'does' : 'do'} need you ${todos.length === 1 ? 'is' : 'are'} shown, from the reads that answered.`;
   } else if (todos.length) {
     headline = todos[0].sentence; tone = 'attn';
     const more = todos.length - 1;

package/dashboard/console/development.js

@@ -13,7 +13,7 @@ import {
   buildShipping, buildPace, buildFeedback, developmentHeadline, stoppedLead, foldFromHash, maintainerMode, authorityCard, holdWords, verifyWords, rollbackWords,
   readinessAuthorityRequest, triageAuthorityRequest, commitRequest, authorityResultWords, commitResultWords, newDecisionRef, PACE_METRICS, DEV_TOOLS_KEY,
 } from './development-model.js';
-import { el, setKids, pageHead, section, sheet, closeSheet, story, details, note, cantTell, askPin, firstPaint, arrivalScroll } from './ui.js';
+import { el, setKids, pageHead, section, sheet, closeSheet, story, details, note, cantTell, askPin, firstPaint, arrivalScroll, markNeed } from './ui.js';
 import { legacyHref } from './nav-model.js';
 
 const EYEBROW = 'Work · Development';
@@ -120,7 +120,10 @@ function paint() {
   // The one thing that needs the operator comes first; the rest wait as a counted line.
   const todos = feedback.todos;
   const first = todos[0] || null;
-  const lead = first ? todoCard(first, deps, true) : null;
+  const lead = first ? markNeed(todoCard(first, deps, true), 'feedback') : null;
+  const approvals = shipping.rows ? shipping.rows.filter((r) => r.group === 'needs').length : 0;
+  // Approvals live in the Shipping fold, which is often closed: the lead line opens it and goes there.
+  const approvalsLine = approvals ? markNeed(el('button', { class: 'btn-primary btn-inline need-line', type: 'button', text: `${approvals === 1 ? 'A pull request needs' : `${approvals} pull requests need`} your approval: show ${approvals === 1 ? 'it' : 'them'}`, onclick: () => { view.open = 'shipping'; paint(); arrivalScroll(main.querySelector('#sec-shipping'), { key: `tap:${Date.now()}` }); } }), 'shipping-approvals') : null;
   const stopped = stoppedCard(shipping, deps);
   const moreLine = todos.length > 1 ? el('button', { class: 'link-btn older-line', type: 'button', text: `${todos.length - 1} more ${todos.length === 2 ? 'thing needs' : 'things need'} you ›`, onclick: () => openMore(todos.slice(1), deps) }) : null;
 
@@ -128,7 +131,7 @@ function paint() {
   if (!view.open) view.open = feedback.tone === 'attn' || feedback.state === 'cant-tell' ? 'feedback' : 'shipping';
   setKids(main, el('div', { class: 'dev-page' },
     pageHead({ eyebrow: EYEBROW, headline: h.text, sub: h.sub, tone: h.tone }),
-    stopped, lead, moreLine,
+    stopped, lead, approvalsLine, moreLine,
     el('div', { class: 'page-sections' },
       fold({ id: 'shipping', title: 'Shipping', line: shipping.line, tone: shipping.tone, body: () => shippingBody(shipping, deps) }),
       fold({ id: 'feedback', title: 'Feedback', line: feedback.line, tone: feedback.tone, body: () => feedbackBody(feedback, deps) }),
@@ -176,7 +179,7 @@ function backOnButton(s, deps, primary = false) {
 function stoppedCard(s, deps) {
   const c = stoppedLead(s);
   if (!c) return null;
-  return el('div', { class: 'need-card stopped-lead' }, el('span', { class: 'need-title', text: c.title }), el('span', { class: 'need-sub', text: c.detail }), el('span', { class: 'need-sub', text: c.why }), backOnButton(s, deps, true));
+  return el('div', { class: 'need-card stopped-lead', 'data-operator-need': 'merging' }, el('span', { class: 'need-title', text: c.title }), el('span', { class: 'need-sub', text: c.detail }), el('span', { class: 'need-sub', text: c.why }), backOnButton(s, deps, true));
 }
 
 // ── to-dos (Feedback approvals and links) ────────────────────────────────────

package/dashboard/console/home-model.js

@@ -466,29 +466,45 @@ export function pullRequestRefs(row) {
   return [...out];
 }
 
-export function combineNeeds(needs, promised) {
-  if (!needs || !Number.isFinite(needs.count)) return needs; // loading or can't tell: say so as-is
-  if (!promised || promised.state === 'loading') return needs;
-  const pCount = Number.isFinite(promised.count) ? promised.count : 0;
+/**
+ * The one count. Surfaced rows (needs-model.js) merge in even while the queue or the promises
+ * are unread, so a slow read cannot hide a known need. A row naming the same thing as a queue
+ * item (its refs appear in that item) is dropped by identity: the queue item carries the action.
+ */
+export function combineNeeds(needs, promised, surfaced) {
+  // Nothing surfaced was asked for: the queue alone, exactly as before.
+  if (!surfaced && (!needs || !Number.isFinite(needs.count) || !promised || promised.state === 'loading')) return needs;
+  const known = surfaced && Array.isArray(surfaced.rows) ? surfaced : { rows: [], pending: [], failed: [] };
+  const pending = Array.isArray(known.pending) && known.pending.length > 0;
+  const failed = Array.isArray(known.failed) && known.failed.length > 0;
+  if (!needs || !Number.isFinite(needs.count)) {
+    if (!known.rows.length) return needs ? { ...needs, surfacedPending: pending } : needs; // loading or can't tell: say so as-is
+    needs = { ...(needs || {}), count: 0, all: [], rows: [], line: '', unreadQueue: true };
+  }
   const queue = needs.all || needs.rows || [];
+  const words = (r) => `${r.main || ''} ${r.sub || ''}`.toLowerCase();
+  const hasToken = (text, ref) => { const at = text.indexOf(ref); return at >= 0 && !/[\w.@-]/.test(text[at + ref.length] || ' ') && !/[\w.@-]/.test(text[at - 1] || ' '); };
+  const rows = known.rows.filter((r) => !(r.refs || []).some((ref) => queue.some((q) => hasToken(words(q), String(ref).toLowerCase()))));
   // A promise that waits on the same pull request as a queue item is the same
   // ask twice (the approval itself, and my promise to merge after it): show the
   // queue item, which carries the action, and drop the promise row.
   const queueRefs = new Set(queue.flatMap(pullRequestRefs));
-  const waitingAll = (promised.all || []).filter((r) => r.tone === 'attn').slice(0, pCount);
+  const promisesRead = promised && promised.state !== 'loading';
+  const pCount = promisesRead && Number.isFinite(promised.count) ? promised.count : 0;
+  const waitingAll = promisesRead ? (promised.all || []).filter((r) => r.tone === 'attn').slice(0, pCount) : [];
   const waiting = waitingAll.filter((r) => !pullRequestRefs(r).some((ref) => queueRefs.has(ref)))
     .map((r) => ({ ...r, sub: ['a promise', r.sub].filter(Boolean).join(' · ') }));
-  const promisesKnown = Number.isFinite(promised.count);
-  const count = needs.count + waiting.length;
-  // Urgent queue items lead (the headline names the first row), then promises, then the rest.
-  const all = [...queue.filter((r) => r.tone === 'bad'), ...waiting, ...queue.filter((r) => r.tone !== 'bad')];
+  const promisesKnown = !promisesRead || Number.isFinite(promised.count);
+  const count = needs.count + rows.length + waiting.length;
+  // Urgent queue items lead (the headline names the first row), then what is surfaced, then promises, then the rest.
+  const all = [...queue.filter((r) => r.tone === 'bad'), ...rows, ...waiting, ...queue.filter((r) => r.tone !== 'bad')];
   const notes = !promisesKnown ? "Couldn't check for promises waiting on you."
-    : promised.state === 'stale' ? 'Promise information is from the last successful check.' : '';
+    : promisesRead && promised.state === 'stale' ? 'Promise information is from the last successful check.' : '';
   const queueLine = needs.line === 'The queue is clear.' || needs.line === 'Waiting on you.' ? null : needs.line;
   const line = count ? '' : [notes, queueLine].filter(Boolean).join(' ') || 'Nothing is waiting on you.';
-  const partial = needs.state === 'partial' || !promisesKnown || promised.state === 'stale' || !!promised.coverage;
+  const partial = needs.state === 'partial' || !promisesKnown || needs.unreadQueue || failed || (promisesRead && (promised.state === 'stale' || !!promised.coverage));
   return {
-    ...needs, combined: true, count, all, rows: all.slice(0, MAX_ROWS), line,
+    ...needs, combined: true, count, all, rows: all.slice(0, MAX_ROWS), line, surfacedPending: pending, surfacedCount: rows.length,
     note: count ? null : needs.note,
     statusNote: count ? [needs.statusNote, notes, queueLine].filter(Boolean).join(' ') : needs.statusNote,
     coverage: partial ? 'partial view' : needs.coverage,
@@ -520,7 +536,7 @@ export function headline(allCards) {
   const otherAttn = attention.length;
   const loading = list.filter((c) => c.state === 'loading').length;
   // Never announce a count, or "all quiet", before both counting cards answered.
-  if (loading === list.length || (cards.needs && cards.needs.state === 'loading') || (cards.promised && cards.promised.state === 'loading')) return { text: 'Checking in…', tone: 'muted' };
+  if (loading === list.length || (cards.needs && cards.needs.state === 'loading' && !Number.isFinite(cards.needs.count)) || (cards.promised && cards.promised.state === 'loading' && !(cards.needs && cards.needs.surfacedCount > 0)) || (cards.needs && cards.needs.surfacedPending && !(cards.needs.count > 0))) return { text: 'Checking in…', tone: 'muted' };
   // A known action survives incomplete coverage. Coverage belongs under agent
   // status, not in the sentence describing the action.
   const count = cards.needs && cards.needs.combined ? known(cards.needs) : known(cards.needs) + known(cards.promised);
@@ -537,7 +553,7 @@ export function headline(allCards) {
     const context = withContext ? `${withContext[2].replace(/,\s*/g, ' · ')}.` : null;
     return { text: title || 'Open what needs your attention', tone: 'attn',
       sub: [context, first?.action ? 'Tap to review and respond.' : null,
-        count > 1 ? `${count - 1 === 1 ? 'One more thing needs' : `${count - 1} more things need`} you, listed below.` : null].filter(Boolean).join(' '),
+        count > 1 ? `${count - 1 === 1 ? 'One more thing needs' : `${count - 1} more things need`} you.` : null].filter(Boolean).join(' '),
       action: first?.action || null };
   }
   // Only what the operator can act on takes the headline. My own areas

package/dashboard/console/mandates.js

@@ -9,7 +9,7 @@ import {
   issueRequest, revokeRequest, grantRequest, approveRequest, denyRequest, resultWords,
   FLOOR_ACTIONS, GRANT_DURATIONS, AUTHORITIES_TEMPLATE, humanAction, defaultExpiryLocal,
 } from './mandates-model.js';
-import { el, setKids, pageHead, section, sheet, closeSheet, story, details, note, cantTell, askPin, firstPaint } from './ui.js';
+import { el, setKids, pageHead, section, sheet, closeSheet, story, details, note, cantTell, askPin, firstPaint, markNeed } from './ui.js';
 import { legacyHref } from './nav-model.js';
 import { verifiedDisplayName, uniqueNamedChoices } from './display-identity.js';
 
@@ -50,7 +50,7 @@ export async function renderMandates(main, ctx) {
 
   const parts = [pageHead({ eyebrow: 'People · Permission slips', headline: h.text, tone: h.tone, facts: mandatesFacts({ slips, approvals, audit }) })];
   // A broken chain is an incident: it leads the page, above everything else.
-  if (audit.ok && audit.chain.state === 'broken') parts.push(el('section', { class: 'incident', role: 'alert' }, el('span', { class: 'incident-title', text: 'Treat as an incident' }), el('p', { class: 'incident-text', text: `${audit.chain.words} Every decision below is suspect until the record is checked.` })));
+  if (audit.ok && audit.chain.state === 'broken') parts.push(el('section', { class: 'incident', role: 'alert' }, el('span', { class: 'incident-title', text: 'Treat as an incident' }), el('p', { class: 'incident-text', text: `${audit.chain.words} Every decision on this page is suspect until the record is checked.` })));
   const sections = [];
   if (!approvals.hidden) sections.push(approvalsBlock(approvals, deps));
   if (!slips.ok) sections.push(el('section', { class: 'list-section', id: 'sec-active' }, el('div', { class: 'list-head' }, el('h2', { class: 'eyebrow', text: 'Active slips' })), cantTell(slips.reason)));
@@ -70,7 +70,7 @@ function approvalsBlock(approvals, deps) {
   if (!approvals.ok) { wrap.append(el('p', { class: 'card-note', text: approvals.reason })); return wrap; }
   if (!approvals.rows.length) { wrap.append(el('p', { class: 'empty-line', text: 'Nothing is waiting for your approval.' })); return wrap; }
   for (const r of approvals.rows) wrap.append(approvalCard(r, deps));
-  return wrap;
+  return markNeed(wrap, 'approvals');
 }
 
 function approvalCard(r, deps) {

package/dashboard/console/needs-model.js

@@ -0,0 +1,105 @@
+// The one list of states that need the operator (docs/specs/operator-needs-first-screen.md).
+// Home's count and headline come from it, and every state's own page leads with it, so
+// neither can miss one. Pure: it reads nothing itself and touches no DOM. Rows are built with
+// each page's own model, so Home and the page cannot disagree.
+
+import { buildShipping, stoppedLead, operatorTodos, sourceState, agentOwnedStop } from './development-model.js';
+import { buildAccountsPage } from './accounts-model.js';
+import { pairingModel, waitingCards } from './agents-model.js';
+import { buildApprovals } from './mandates-model.js';
+import { buildPlansPage } from './plans-model.js';
+import { buildRequests } from './secrets-model.js';
+import { spendingNeed } from './costs-model.js';
+
+const row = (key, main, sub, href, refs = []) => ({ key: `need:${key}`, main, sub: sub || '', tone: 'attn', refs, action: { kind: 'href', href } });
+
+/** A 200 that does not have the expected shape: it told us nothing, so never read it as "nothing waiting". */
+const UNREADABLE = null;
+
+export const NEED_SOURCES = [
+  { id: 'merging', page: 'work/development', reads: { watcher: '/green-pr-automerge' },
+    rows: ({ watcher }, now) => {
+      if (agentOwnedStop(watcher.data)) return []; // the agent releases this itself; the page still shows it
+      const lead = stoppedLead(buildShipping({ watcher }, now, {}));
+      return lead ? [row('merging', lead.title, lead.detail, '#/work/development')] : [];
+    } },
+  { id: 'shipping-approvals', page: 'work/development', reads: { watcher: '/green-pr-automerge' },
+    rows: ({ watcher }, now) => buildShipping({ watcher }, now, {}).rows.filter((r) => r.group === 'needs')
+      .map((r) => row(`pr:${r.pr}`, `Pull request #${r.pr} needs your approval on GitHub`, '', '#/work/development?s=shipping', [`#${r.pr}`, `PR ${r.pr}`])) },
+  // Four reads, on a slower beat, and only where the merge watcher says this is a maintainer's agent.
+  { id: 'feedback', page: 'work/development', everyTicks: 4, when: (known) => sourceState(known.merging && known.merging.results && known.merging.results.watcher) === 'ok',
+    reads: { readiness: '/feedback-factory/readiness-authorities/proposal', triageProposal: '/feedback-factory/triage/authority/proposal', execute: '/feedback-factory/execute/status', queue: '/feedback-factory/triage/queue' },
+    rows: (r) => operatorTodos(r).map((t, i) => row(`feedback:${t.action || t.kind}:${i}`, t.sentence, t.detail, '#/work/development?s=feedback')) },
+  { id: 'accounts', page: 'capacity/accounts', reads: { pool: '/subscription-pool?scope=pool', relogin: '/subscription-relogin?scope=pool' },
+    rows: ({ pool, relogin }, now) => {
+      const episodes = relogin.ok && Array.isArray(relogin.data && relogin.data.episodes) ? relogin.data.episodes : [];
+      const page = buildAccountsPage(pool, now, { episodes });
+      if (!page.ok) return pool.data && pool.data.enabled === false ? [] : UNREADABLE;
+      return page.needs.map((n) => row(`account:${n.key}`, n.title, n.sub, '#/capacity/accounts?s=needs', [String(n.label || '').split(' · ').pop()].filter(Boolean)));
+    } },
+  { id: 'agents', page: 'people/agents', reads: { pairing: '/threadline/pairing', invites: '/threadline/pairing/invites' },
+    rows: ({ pairing, invites }, now) => waitingCards(pairingModel(pairing, invites, undefined, now), now)
+      .map((c, i) => row(`agent:${c.kind}:${c.iid || c.id || i}`, c.title, '', '#/people/agents')) },
+  { id: 'approvals', page: 'people/mandates', reads: { approvals: '/authorization-requests?status=pending' },
+    rows: ({ approvals }) => { const a = buildApprovals(approvals); return a.ok ? a.rows.map((r) => row(r.key, r.headline, r.reason, '#/people/mandates?s=waiting')) : UNREADABLE; } },
+  { id: 'plans', page: 'work/plans', reads: { initiatives: '/initiatives', blockers: '/blockers' },
+    rows: ({ initiatives, blockers }, now) => {
+      const page = buildPlansPage({ initiatives, blockers }, now);
+      if (!page.ok) return UNREADABLE;
+      return page.sections.needsYou.map((r) => row(`plan:${r.key}`, r.main, r.needs, '#/work/plans?s=needsYou'));
+    } },
+  { id: 'secrets', page: 'people/secrets', reads: { pending: '/secrets/pending' },
+    // Never the card's own key or link: both carry the one-time drop token.
+    rows: ({ pending }, now) => {
+      const reqs = buildRequests(pending, { now, names: {}, origin: '' });
+      if (!reqs.ok) return UNREADABLE;
+      return reqs.waiting.map((c, i) => row(`secret:${i}`, `Waiting for you to supply: ${c.label}`, c.leftWords, '#/people/secrets?s=waiting'));
+    } },
+  { id: 'spending', page: 'capacity/costs', reads: { status: '/routing-spend/enable-status' },
+    rows: ({ status }) => { const n = spendingNeed(status); return n ? [row('spending', n.title, n.why, '#/capacity/costs')] : []; } },
+];
+
+/**
+ * Where a console file says a state needs the operator and it is NOT one of the sources.
+ * Exact phrases, each with its reason, so a real need added to one of these pages still
+ * fails the floor. `file` + `phrase` must both match the line.
+ */
+export const NEED_EXEMPT = [
+  { file: 'home-model.js', phrase: '', why: 'Home itself: this is the card the sources feed.' },
+  { file: 'console.js', phrase: 'What needs you', why: 'Home itself: the card title.' },
+  { file: 'nav-model.js', phrase: 'waiting', why: 'A navigation description of the page, not a state.' },
+  { file: 'promises-model.js', phrase: '', why: 'Already on Home; the operator decided 2026-11-02 that only promises due within 24 hours count.' },
+  { file: 'promises.js', phrase: '', why: 'As promises-model.js.' },
+  { file: 'allowed-model.js', phrase: 'will wait for your approval', why: 'Describes what a safety profile means, not something waiting now.' },
+  { file: 'pace-model.js', phrase: 'waiting on you', why: 'A verdict on queue pace; the items themselves appear in their own sources.' },
+  { file: 'sessions-model.js', phrase: 'Waiting on you', why: 'A comment-like note that sessions do not report this; nothing waits.' },
+];
+
+const failedRead = (res) => sourceState(res) === 'failed';
+
+/**
+ * known: id → { results, rows?, rowsAt? }, Home's reads so far. Returns the rows that need the
+ * operator, plus which sources are unread (say "checking", never "quiet") or failed (say
+ * partial, never "quiet"). A failed read keeps its last good rows for graceMs. 503 means off.
+ */
+export function surfacedNeeds(known, now = Date.now(), graceMs = 120000) {
+  const out = { rows: [], pending: [], failed: [] };
+  for (const s of NEED_SOURCES) {
+    const k = known && known[s.id];
+    if (s.when && !s.when(known || {})) continue;
+    if (!k || !k.results) { if (!s.when) out.pending.push(s.id); continue; } // a conditional source is read on a later tick and never holds the headline
+    const reads = Object.values(k.results);
+    if (reads.every((r) => sourceState(r) === 'off')) continue; // switched off here; a page's builder handles one optional read being off
+    if (reads.some(failedRead)) {
+      out.failed.push(s.id);
+      if (k.rows && now - (k.rowsAt || 0) <= graceMs) out.rows.push(...k.rows);
+      continue;
+    }
+    const rows = s.rows(k.results, now);
+    if (rows === UNREADABLE) { out.failed.push(s.id); if (k.rows && now - (k.rowsAt || 0) <= graceMs) out.rows.push(...k.rows); continue; }
+    k.rows = rows;
+    k.rowsAt = now;
+    out.rows.push(...rows);
+  }
+  return out;
+}

package/dashboard/console/plans.js

@@ -7,7 +7,7 @@
 import {
   buildPlansPage, roundsTrack, projectActions, resultWords, refusalWords, driftSentence, linkChips, stepList, blockerStory, reasonWord, statusWord, PROJECT_DETAIL_CAP, OPEN_STATUSES,
 } from './plans-model.js';
-import { el, setKids, pageHead, section, sheet, closeSheet, sheetIsOpen, story, details, note, cantTell, firstPaint, arrivalScroll } from './ui.js';
+import { el, setKids, pageHead, section, sheet, closeSheet, sheetIsOpen, story, details, note, cantTell, firstPaint, arrivalScroll, markNeed } from './ui.js';
 import { legacyHref } from './nav-model.js';
 import { topicNameMap } from './topic-names.js';
 import { topicLink } from './promises.js';
@@ -49,6 +49,7 @@ function paint() {
 
   // Needs you: fresh items as rows; older ones waiting on you are a counted line, never dropped.
   const needs = section({ id: 'needsYou', title: 'Needs you', tone: 'attn', rows: s.needsYou, empty: 'Nothing is waiting on you.', onRow: open });
+  if (s.needsYou.length) markNeed(needs, 'plans');
   if (n.olderNeedsYou) needs.querySelector('.list-rows').append(el('a', { class: 'link-btn older-line', href: '#/work/plans?s=older', text: `+${n.olderNeedsYou} older, still waiting on you ›` }));
 
   // In the way, above In flight. Off and failed are one dashed line each, not a page.

package/dashboard/console/secrets.js

@@ -9,7 +9,7 @@ import {
   topicNameMap, conversationChoices, requestCard, requestBody, testRequestBody, resultWords, shareWords,
   leftWords, TTL_CHOICES,
 } from './secrets-model.js';
-import { el, setKids, pageHead, section, sheet, closeSheet, story, details, note, cantTell, firstPaint } from './ui.js';
+import { el, setKids, pageHead, section, sheet, closeSheet, story, details, note, cantTell, firstPaint, markNeed } from './ui.js';
 import { legacyHref } from './nav-model.js';
 
 const RECORD_KEYS = ['token', 'topicId', 'createdAt', 'expiresAt'];
@@ -90,7 +90,7 @@ function waitingBlock(requests, deps, multi) {
   const wrap = el('section', { class: 'list-section', id: 'sec-waiting' }, el('div', { class: 'list-head' }, el('h2', { class: 'eyebrow', text: 'Waiting' }), requests.ok ? el('span', { class: 'list-count', text: String(requests.waiting.length) }) : null));
   if (!requests.ok) { wrap.append(cantTell(requests.reason)); return wrap; }
   if (!requests.waiting.length) wrap.append(el('p', { class: 'empty-line', text: 'Nothing is waiting. When the agent needs a password or key, it asks here with a one-time link.' }));
-  else wrap.append(el('div', { class: 'secret-cards' }, requests.waiting.map((c) => waitingCard(c, deps))));
+  else { markNeed(wrap, 'secrets'); wrap.append(el('div', { class: 'secret-cards' }, requests.waiting.map((c) => waitingCard(c, deps)))); }
   wrap.append(note('Once someone submits, it moves to the agent; it doesn’t stay listed here.'));
   if (multi) wrap.append(note('These are this machine’s requests. Each machine keeps its own.'));
   return wrap;

package/dashboard/console/ticket-model.js

@@ -0,0 +1,36 @@
+// Console sign-in from an owner's paired phone (docs/specs/mobile-console-device-signin.md §3.5).
+// The Instar app puts a one-minute, single-use ticket in session storage; the console trades it
+// once for the same token a PIN unlock returns. Any failure falls back to the PIN box.
+
+export const TICKET_KEY = 'instar_console_ticket';
+export const REDEEM_PATH = '/dashboard/console-ticket';
+
+/** Reads the ticket and removes it at once, before any request, on every outcome. */
+export function takeTicket(storage) {
+  let t = '';
+  try { t = storage.getItem(TICKET_KEY) || ''; } catch { t = ''; }
+  try { storage.removeItem(TICKET_KEY); } catch { /* storage blocked */ }
+  return typeof t === 'string' && t.length > 0 && t.length <= 128 ? t : '';
+}
+
+/** POSTs the ticket; resolves to the token, or '' on any failure. */
+export async function redeemTicket(fetchFn, ticket) {
+  if (!ticket) return '';
+  try {
+    const r = await fetchFn(REDEEM_PATH, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ ticket }), cache: 'no-store' });
+    if (!r || !r.ok) return '';
+    const data = await r.json().catch(() => ({}));
+    return data && typeof data.token === 'string' && data.token.length > 0 ? data.token : '';
+  } catch { return ''; }
+}
+
+/**
+ * The boot decision: a valid stored token wins; else a ticket is redeemed; else the PIN box.
+ * Returns { token, via: 'stored' | 'ticket' | 'pin' }.
+ */
+export async function signInAtBoot({ storedToken, validToken, ticket, fetchFn }) {
+  if (storedToken && await validToken(storedToken)) return { token: storedToken, via: 'stored' };
+  const t = await redeemTicket(fetchFn, ticket);
+  if (t) return { token: t, via: 'ticket' };
+  return { token: '', via: 'pin' };
+}