pi-straw-boss 0.58.3 → 0.59.1

package/dist/server/main.mjs

@@ -1923,9 +1923,25 @@ function allyPort(link) {
     async taken(id, identity2) {
       await link()?.holder?.taken(id, identity2);
     },
+    delivered(id, run3) {
+      link()?.holder?.delivered(id, run3);
+    },
+    // A device is taken as gone only while the box can tell who is in the team: the policy file reads (a refused one answers `reply` for everybody, g346-F003) and the holder reads the roster. A team the unattended policy
+    // no longer names has no holder run and never will: nobody is in it, so its controllers are gone (g346-F005b).
+    known(team) {
+      const service = link();
+      if (!service) return false;
+      const { mode, config } = service.policyLook();
+      if (mode === "refused") return false;
+      if (mode === "unattended" && !config.teams.has(team)) return service.holder?.active === true;
+      return service.holder?.rosterKnown(team) ?? false;
+    },
     standing(device, team) {
       const service = link();
-      return service?.holder?.isMember(team, device) ? { level: service.levelOf(device) } : void 0;
+      if (!service) return void 0;
+      const { mode, config } = service.policyLook();
+      if (mode === "unattended" && !config.teams.has(team)) return void 0;
+      return service.holder?.isMember(team, device) ? { level: service.levelOf(device) } : void 0;
     },
     project: (team) => link()?.config().teams.get(team)?.project,
     thread: (device) => link()?.store.readThread(device).slice(-THREAD_ROWS).map((r) => ({ dir: r.dir, at: r.at, kind: r.kind, text: r.text })) ?? []
@@ -8017,7 +8033,12 @@ function createGuiHost(o) {
   let forwardNet;
   return {
     /** The hub and a net reading that binds its dialogs, for the forwarder an unattended device runs. */
-    dialogs: () => ({ hub: theHub(), read: async () => void await (forwardNet ??= netSource({ ...o.tower ? { services: (workspace) => o.tower.view(workspace) } : {}, run: cfg.run, world: cfg.world, sessions, hub: theHub() })).read() }),
+    dialogs: () => ({
+      hub: theHub(),
+      read: async () => void await (forwardNet ??= netSource({ ...o.tower ? { services: (workspace) => o.tower.view(workspace) } : {}, run: cfg.run, world: cfg.world, sessions, hub: theHub() })).read(),
+      /** The unit the hub files dialogs under `key` (known after a `read`): its pane for the dispatcher, its name and role for the label a controller is told. */
+      lookup: (key2) => forwardNet?.lookup(key2)
+    }),
     /** At the server's start: the GUI on the recorded ports unless it was stopped on purpose (which only the boss's own command undoes). */
     async start() {
       theHub().track();
@@ -8411,12 +8432,23 @@ function decodePlaintext(kind, bytes) {
   }
 }
 
+// src/link/scope.ts
+var EVERYONE = "all";
+function reaches(scope, c, admin) {
+  if (scope === "all") return true;
+  if (admin(c.team, c.device) && (scope.team === void 0 || scope.team === c.team)) return true;
+  return scope.device !== void 0 && scope.device === c.device && (scope.team === void 0 || scope.team === c.team);
+}
+
 // src/link/dialogs-out.ts
 var MAX_OPEN2 = 32;
 var MAX_SEEN = 1024;
 var UNANSWERED_MS = 30 * 6e4;
 var REFRESH_MS = 10 * 6e4;
 var UNKNOWN_RECHECK_MS = 15e3;
+var PASS_STUCK_MS = 6e4;
+var CLOSE_TRIES = 5;
+var MAX_CLOSES = 256;
 var DialogForwarder = class {
   d;
   open = /* @__PURE__ */ new Map();
@@ -8424,12 +8456,29 @@ var DialogForwarder = class {
   seen = /* @__PURE__ */ new Set();
   off;
   polling;
+  /** The closes not posted yet, per controller and dialog, drained by every pass until each is posted. */
+  closes = /* @__PURE__ */ new Map();
+  /** The passes let go as stuck that have not returned; at most one is outstanding, so a call that never returns costs one pending pass and not one a minute. */
+  released = /* @__PURE__ */ new Set();
+  /** The line that a second stuck pass is not let go was written for this stretch. */
+  hung = false;
   again = false;
+  /** The pass that counts: a pass let go as stuck has an older number and stops at its next turn. */
+  gen = 0;
+  /** When the pass in flight began, and the call it waits at (`dialog-pass-stuck` names it). */
+  passAt = 0;
+  step = "idle";
+  /** What the last `dialog-controllers` line said, so a line is written when it changes and not at every pass. */
+  counted;
+  /** The room for open questions was used up, and the line that says so was written. */
+  full = false;
   constructor(d) {
     this.d = d;
   }
   start() {
-    this.off ??= this.d.hub.onChange(() => void this.poll());
+    if (this.off) return;
+    this.off = this.d.hub.onChange(() => void this.poll());
+    this.d.log({ event: "dialog-forwarder", state: "started" });
   }
   stop() {
     this.off?.();
@@ -8439,25 +8488,69 @@ var DialogForwarder = class {
   tick() {
     return this.poll();
   }
-  /** Looks at the hub now; calls that overlap run once more after the one in flight. */
+  /** Looks at the hub now; calls that overlap run once more after the one in flight, and a pass in flight for `PASS_STUCK_MS` is let go (its next look is a new pass). */
   poll() {
-    if (this.polling) return this.again = true, this.polling;
+    if (this.polling) {
+      if (this.now() - this.passAt < PASS_STUCK_MS) return this.again = true, this.polling;
+      if (this.released.size) {
+        if (!this.hung) this.d.log({ event: "dialog-pass-hung", step: this.step, ms: this.now() - this.passAt });
+        this.hung = true;
+        return this.again = true, this.polling;
+      }
+      this.d.log({ event: "dialog-pass-stuck", step: this.step, ms: this.now() - this.passAt });
+      this.gen++;
+      this.released.add(this.polling);
+      this.polling = void 0;
+      for (const d of this.open.values()) d.sent.clear();
+    }
+    const gen = this.gen;
     const run3 = (async () => {
       do {
         this.again = false;
+        this.passAt = this.now();
         try {
-          await this.pass();
+          await this.pass(gen);
         } catch (error) {
-          this.d.log({ event: "dialog-forward-failed", error: String(error.message).slice(0, 200) });
+          this.d.log({ event: "dialog-forward-failed", step: this.step, error: String(error.message).slice(0, 200) });
         }
-      } while (this.again);
-    })().finally(() => this.polling = void 0);
+      } while (this.again && gen === this.gen);
+    })().finally(() => {
+      if (this.polling === run3) this.polling = void 0;
+      this.released.delete(run3);
+      if (!this.released.size) this.hung = false;
+    });
     return this.polling = run3;
   }
-  async pass() {
+  /** Whose unit asked: looked up until it is known, then kept. A lookup that fails leaves it unknown, which is the admins' alone. */
+  async whose(d) {
+    if (!this.d.dispatcher || d.who) return;
+    d.who = await this.d.dispatcher(d.key).catch(() => void 0);
+  }
+  /** What the question's controllers are: every controller when the box cannot tell whose units are whose, else the dispatcher and the admins. */
+  scopeOf(d) {
+    return this.d.dispatcher ? d.who ? { device: d.who.device, ...d.who.team !== void 0 ? { team: d.who.team } : {} } : {} : EVERYONE;
+  }
+  /** Records where the pass in flight waits (`dialog-pass-stuck` names it); a pass let go as stuck no longer writes it. */
+  at(gen, step) {
+    if (gen === this.gen) this.step = step;
+  }
+  /** One line when the controllers the forwarder sees change in number or in whether the list is complete, so a box with nobody to tell says so once (and the first pass says how it starts). */
+  count(controllers, known2) {
+    const line2 = `${controllers}/${known2}`;
+    if (line2 === this.counted) return;
+    this.counted = line2;
+    this.d.log({ event: "dialog-controllers", count: controllers, known: known2, open: this.open.size });
+  }
+  async pass(gen) {
     const to = this.d.controllers();
+    this.count(to.length, this.d.controllersKnown?.() ?? true);
+    if (this.closes.size && !await this.drain(gen)) return;
     if (!to.length && !this.open.size) return;
-    if (to.length) await this.d.read();
+    if (to.length) {
+      this.at(gen, "read");
+      await this.d.read();
+      if (gen !== this.gen) return;
+    }
     for (const o of to.length ? this.d.hub.answerable() : []) {
       const id = o.target.answer.dialog;
       if (this.open.has(id) || this.skipped.has(id)) continue;
@@ -8465,17 +8558,33 @@ var DialogForwarder = class {
       if (Buffer.byteLength(text5) > LIMITS2.dialog) {
         this.skipped.add(id);
         this.d.log({ event: "dialog-oversize", dialog: id, bytes: Buffer.byteLength(text5) });
-        await this.d.notice?.(`oversize/${id}`, { kind: "dialog-oversize", unit: o.key, text: `A question of ${o.owner} was not forwarded: it is ${Buffer.byteLength(text5)} bytes, over the ${LIMITS2.dialog} the link carries. It waits at the device.` });
+        const unit = { key: o.key };
+        this.at(gen, "dispatcher");
+        await this.whose(unit);
+        this.at(gen, "notice");
+        await this.d.notice?.(`oversize/${id}`, { kind: "dialog-oversize", unit: o.key, text: `A question of ${this.labelOf(o.key, o.owner)} was not forwarded: it is ${Buffer.byteLength(text5)} bytes, over the ${LIMITS2.dialog} the link carries. It waits at the device.` }, this.scopeOf(unit));
+        if (gen !== this.gen) return;
+        continue;
+      }
+      if (this.open.size >= MAX_OPEN2) {
+        if (!this.full) this.d.log({ event: "dialog-full", open: this.open.size });
+        this.full = true;
         continue;
       }
-      if (this.open.size >= MAX_OPEN2) continue;
-      this.open.set(id, { key: o.key, target: o.target, owner: o.owner, text: text5, sent: /* @__PURE__ */ new Map(), away: /* @__PURE__ */ new Set(), claimed: false, since: this.now(), told: false });
+      this.open.set(id, { key: o.key, target: o.target, owner: o.owner, label: this.labelOf(o.key, o.owner), text: text5, sent: /* @__PURE__ */ new Map(), away: /* @__PURE__ */ new Set(), claimed: false, since: this.now(), told: false });
+      this.d.log({ event: "dialog-seen", dialog: id, unit: o.key, owner: o.owner });
     }
     for (const [id, d] of [...this.open]) {
+      this.at(gen, "dispatcher");
+      await this.whose(d);
+      if (gen !== this.gen) return;
       const state = this.d.hub.outcome(id);
       if (!state.open) {
         this.open.delete(id);
-        for (const k of d.sent.keys()) await this.send(k, "dialog-close", { dialogId: id, by: state.by });
+        this.full = false;
+        this.d.log({ event: "dialog-ended", dialog: id, by: state.by, sent: d.sent.size });
+        for (const k of d.sent.keys()) this.hold(k, id, state.by);
+        if (!await this.drain(gen)) return;
         continue;
       }
       if (d.claimed && d.unknownAt !== void 0 && this.now() - d.unknownAt >= UNKNOWN_RECHECK_MS) {
@@ -8483,17 +8592,25 @@ var DialogForwarder = class {
         d.unknownAt = void 0;
         d.sent.clear();
       }
+      const mine = to.filter((c) => reaches(this.scopeOf(d), c, this.d.admin ?? (() => false)));
       for (const k of this.d.controllersKnown?.() === false ? [] : [...d.sent.keys()]) {
-        if (to.some((c) => `${c.team}
+        if (mine.some((c) => `${c.team}
 ${c.device}` === k)) continue;
         d.sent.delete(k);
-        await this.send(k, "dialog-close", { dialogId: id, by: "withdrawn" });
+        this.hold(k, id, "withdrawn");
+        if (!await this.drain(gen)) return;
       }
       if (!d.told && !d.claimed && to.length && this.now() - d.since >= UNANSWERED_MS) {
-        d.told = true;
-        await this.d.notice?.(`unanswered/${id}`, { kind: "dialog-unanswered", unit: d.key, text: `A question of ${d.owner} has waited ${Math.round((this.now() - d.since) / 6e4)} minutes for an answer.` });
+        this.at(gen, "notice");
+        const sent = await this.d.notice?.(`unanswered/${id}`, { kind: "dialog-unanswered", unit: d.key, text: `A question of ${d.label} has waited ${Math.round((this.now() - d.since) / 6e4)} minutes for an answer.` }, this.scopeOf(d));
+        if (gen !== this.gen) return;
+        d.told = sent !== false;
+      }
+      if (!mine.length && !d.unrouted) {
+        d.unrouted = true;
+        this.d.log({ event: "dialog-unrouted", dialog: id, unit: d.key, owner: d.owner });
       }
-      for (const c of to) {
+      for (const c of mine) {
         const k = `${c.team}
 ${c.device}`;
         const at = d.sent.get(k), up = this.d.online?.(c.team, c.device) ?? true;
@@ -8502,16 +8619,53 @@ ${c.device}`;
           if (at !== void 0) continue;
         } else if (at !== void 0 && !d.away.delete(k) && this.now() - at < REFRESH_MS) continue;
         d.sent.set(k, this.now());
-        if (!await this.send(k, "dialog-open", { dialogId: id, digest: d.target.answer.digest, owner: d.owner, dialog: d.text })) d.sent.delete(k);
+        this.at(gen, "post");
+        const posted = await this.send(k, "dialog-open", { dialogId: id, digest: d.target.answer.digest, owner: d.label, dialog: d.text });
+        if (gen !== this.gen) return;
+        if (!posted) d.sent.delete(k);
       }
     }
     for (const id of [...this.skipped]) if (!this.d.hub.outcome(id).open) this.skipped.delete(id);
   }
+  /** Keeps a close to post: the oldest is given up when the room is used up. */
+  hold(k, dialogId, by) {
+    this.closes.set(`${k}
+${dialogId}`, { k, dialogId, by, at: this.now(), tries: 0 });
+    for (const [key2, c] of this.closes) {
+      if (this.closes.size <= MAX_CLOSES) break;
+      this.closes.delete(key2);
+      this.d.log({ event: "dialog-close-dropped", dialog: c.dialogId, reason: "full" });
+    }
+  }
+  /** Posts the held closes, each removed once posted. One that failed `CLOSE_TRIES` times, or whose card has expired at the controller (`OPEN_STALE_MS`), is given up with a line. False when this pass was let go meanwhile. */
+  async drain(gen) {
+    for (const [key2, c] of [...this.closes]) {
+      if (this.now() - c.at > OPEN_STALE_MS) {
+        this.closes.delete(key2);
+        this.d.log({ event: "dialog-close-dropped", dialog: c.dialogId, reason: "stale" });
+        continue;
+      }
+      this.at(gen, "post");
+      const posted = await this.send(c.k, "dialog-close", { dialogId: c.dialogId, by: c.by });
+      if (posted) this.closes.delete(key2);
+      else if (++c.tries >= CLOSE_TRIES) {
+        this.closes.delete(key2);
+        this.d.log({ event: "dialog-close-dropped", dialog: c.dialogId, reason: "failed" });
+      }
+      if (gen !== this.gen) return false;
+    }
+    return true;
+  }
   now = () => this.d.now?.() ?? Date.now();
+  /** What the controllers are told asks: the unit's name when it is known, else the owner of the dialog. */
+  labelOf(key2, owner) {
+    return this.d.unit?.(key2) || owner;
+  }
   async send(k, kind, payload) {
     const [team, device] = k.split("\n");
     try {
       await this.d.post(team, device, kind, payload);
+      this.d.log({ event: "dialog-sent", kind, dialog: payload.dialogId, team, to: device });
       return true;
     } catch (error) {
       this.d.log({ event: "dialog-post-failed", kind, dialog: payload.dialogId, error: String(error.message).slice(0, 200) });
@@ -8532,6 +8686,8 @@ ${device}`);
     const drop = (reason) => this.d.log({ event: "drop", reason, kind: "dialog-answer", from: a.from, dialog: a.dialogId });
     const d = this.open.get(a.dialogId);
     if (!d) return drop("dialog-answer-unknown");
+    await this.whose(d);
+    if (!reaches(this.scopeOf(d), { team: a.team, device: a.from }, this.d.admin ?? (() => false))) return drop("dialog-answer-not-recipient");
     if (d.target.answer.digest !== a.digest) return drop("dialog-answer-digest");
     if (!ANSWER_ID2.test(a.answerId) || this.seen.has(a.answerId)) return drop("dialog-answer-id");
     this.seen.add(a.answerId);
@@ -8597,6 +8753,33 @@ ${dialogId}`;
 };
 var newAnswerId = () => randomBytes12(16).toString("hex");
 
+// src/server/dispatcher.ts
+function dispatcherOf(pane, listed2, allyPanes) {
+  const mine = listed2.find((p) => p.pane_id === pane);
+  if (!mine) return void 0;
+  const ally = allyPanes.find((a) => a.pane === pane);
+  if (ally) return { device: ally.device, ...ally.team ? { team: ally.team } : {} };
+  const device = listed2.find((p) => p.tab_id === mine.tab_id && p.tokens?.sb_opened_by?.startsWith("link:"))?.tokens?.sb_opened_by?.replace(/^(link:)+/, "");
+  return device && /^[a-z2-7]{26}$/.test(device) ? { device } : void 0;
+}
+function dispatcherLookup(d) {
+  let listed2;
+  return async (key2) => {
+    const pane = d.paneOf(key2);
+    if (!pane) return void 0;
+    if (!listed2 || d.now() - listed2.at > 2e3) listed2 = { at: d.now(), panes: d.list().catch(() => void 0) };
+    const panes3 = await listed2.panes;
+    return panes3 ? dispatcherOf(pane, panes3, d.allyPanes()) : void 0;
+  };
+}
+var KIND = { main: "main", member: "member", subagent: "subagent", ally: "ally run", run: "run" };
+function unitLabel(found) {
+  const name2 = allyLabel(found?.name);
+  if (!found || !/[\p{L}\p{N}]/u.test(name2)) return void 0;
+  const kind = KIND[found.role];
+  return kind ? `${kind} - ${name2}` : name2;
+}
+
 // src/server/opentower.ts
 import { realpathSync as realpathSync7 } from "node:fs";
 import { basename as basename8 } from "node:path";
@@ -10708,8 +10891,14 @@ var LinkHolder = class {
       ...message.awaitsReply !== void 0 ? { awaitsReply: message.awaitsReply } : {}
     };
     this.o.store.putInbox(item);
+    this.o.store.log({ event: "tower-in", kind: "tower", team: run3.team, from: header2.from, id: item.id, ...message.awaitsReply !== void 0 ? { ask: message.awaitsReply } : {} });
     this.thread(header2.from, { dir: "in", at: item.received, id: item.id, kind: "tower", ...message.awaitsReply !== void 0 ? { awaitsReply: message.awaitsReply } : {}, text: message.text });
   }
+  /** An ally run took the inbox message `id` into its session: one `link.log` line names the run, the sender, the team and the ask, never the text (docs/specs/2026-11-05-link-shared-box.md, Audit). */
+  delivered(id, run3) {
+    const item = this.o.store.readInbox(id);
+    if (item) this.o.store.log({ event: "tower-run", run: run3, team: item.team, from: item.from, id, ...item.awaitsReply !== void 0 ? { ask: item.awaitsReply } : {} });
+  }
   /** A row of a device's thread, under the lock; a store that cannot write it does not lose the message. */
   thread(device, row2) {
     try {
@@ -10742,6 +10931,7 @@ var LinkHolder = class {
       ...taken ? { reply: { ask: message.inReplyTo, main: taken.main, mainName: taken.mainName, tower: taken.tower } } : {}
     };
     this.o.store.putInbox(item);
+    this.o.store.log({ event: "tower-in", kind: "tower-reply", team: run3.team, from: header2.from, id: item.id, ask: message.inReplyTo });
     this.thread(header2.from, { dir: "in", at: item.received, id: item.id, kind: "tower-reply", inReplyTo: message.inReplyTo, text: message.text });
   }
   /** The election's record no longer names this session: nothing is acted on from here, and every stream ends. */
@@ -10895,7 +11085,7 @@ var LinkHolder = class {
     store.log({ event: "tower-open", project, from });
     const attempt = (async () => {
       try {
-        await openTower2(project, toWorkspace);
+        await openTower2(project, toWorkspace, from);
         store.log({ event: "tower-opened", project });
       } catch (error) {
         store.log({ event: "tower-open-failed", project, error: error.message });
@@ -11078,6 +11268,17 @@ ${target.id}`, { text: req.text, at: this.now() });
     }
     return items.sort((a, b) => a.received - b.received || (a.id < b.id ? -1 : 1));
   }
+  /** Whether this holder can tell who is in `team` right now: it runs, the team runs and has not died, and its roster reads. A device is taken as gone only while this is true (the revocation of a controller's mains). */
+  rosterKnown(team) {
+    const run3 = this.runs.get(team);
+    if (!this.running || !run3 || run3.dead) return false;
+    try {
+      this.loadTeam(team);
+      return true;
+    } catch {
+      return false;
+    }
+  }
   /** Whether `device` is a member of `team` on this computer's roster (a run whose sender left is ended). */
   isMember(team, device) {
     try {
@@ -11187,6 +11388,14 @@ ${target.id}`, { text: req.text, at: this.now() });
   dialogControllers() {
     return this.controllerRead().list;
   }
+  /** Whether `device` is an admin of `team`'s roster now (an admin is told every question and notice of the box). False for a team that is not running or a roster that cannot be read. */
+  isAdmin(team, device) {
+    try {
+      return this.loadTeam(team).state.members.get(device)?.role === "admin";
+    } catch {
+      return false;
+    }
+  }
   /** False while the controller list cannot be trusted to be complete (the holder is not running, or a team's roster could not be read): a caller does not withdraw anything then. */
   controllersKnown() {
     return this.controllerRead().known;
@@ -11259,6 +11468,7 @@ ${Buffer5.from(header2.id).toString("hex")}`).digest("hex").slice(0, 16);
     const sender = roster.members.get(header2.from);
     if (!(this.o.attended?.() ?? true) || !sender || sender.attended) return void this.o.store.log({ event: "drop", team: run3.team, reason: "dialog-open-unexpected", from: header2.from, kind: "dialog-open" });
     const fresh = this.dialogViews.put({ team: run3.team, device: header2.from, dialogId: p.dialogId, digest: p.digest, owner: p.owner, dialog: p.dialog, at: this.now() });
+    this.o.store.log({ event: "dialog-in", team: run3.team, from: header2.from, dialog: p.dialogId, fresh });
     if (fresh) this.o.notify(`Straw Link: ${sender.label} asks a question (${restrictLabel(p.owner)})`, "warning");
   }
   takeDialogClose(header2, p) {
@@ -12288,6 +12498,13 @@ function createLinkService({ kit, stateDir, version, started, pid = process.pid,
       return store;
     },
     attended,
+    /** How the policy file reads now: a refused one means the box cannot tell who may do what (g346-F003). */
+    policyMode: () => policy().mode,
+    /** The policy mode and the effective config from one read of the policy file, so the two cannot disagree. */
+    policyLook() {
+      const p = policy();
+      return { mode: p.mode, config: readEffectiveConfig(p, stateDir, { home, agentDir }) };
+    },
     /** The teams and projects of config.json, read fresh. */
     config,
     /** The level this computer gives a device (the policy file's, else `link.trust`, else `reply`): an ally run is claimed at it. */
@@ -13595,11 +13812,11 @@ ${c.device}`, units = mine.map((u) => ({ ...u, report: cutBytes(this.d.report(u.
       }
     }
   }
-  /** Tells every controller, once per `key`; nothing is remembered when there was nobody to tell, so the next trigger with the same key still goes out. */
-  async notify(key2, notice) {
-    if (this.told.has(key2)) return;
-    const to = this.d.controllers();
-    if (!to.length) return;
+  /** Tells the controllers `scope` covers (the dispatcher and the admins; `EVERYONE` for all), once per `key`; nothing is remembered when there was nobody to tell, so the next trigger with the same key still goes out. Resolves whether anybody was addressed. */
+  async notify(key2, notice, scope) {
+    if (this.told.has(key2)) return false;
+    const to = this.d.controllers().filter((c) => reaches(scope, c, this.d.admin ?? (() => false)));
+    if (!to.length) return false;
     this.told.add(key2);
     while (this.told.size > TOLD_MAX) this.told.delete(this.told.values().next().value);
     this.d.log({ event: "notice", key: key2, kind: notice.kind, unit: notice.unit });
@@ -13610,14 +13827,17 @@ ${c.device}`, units = mine.map((u) => ({ ...u, report: cutBytes(this.d.report(u.
         this.d.log({ event: "notice-post-failed", device: c.device, kind: notice.kind, error: String(error.message).slice(0, 200) });
       }
     }
+    return true;
   }
 };
 function runNotice(s2) {
+  const scope = s2.device !== void 0 ? { device: s2.device, ...s2.team !== void 0 ? { team: s2.team } : {} } : {};
   const who = s2.ally ? "An ally run" : "A run";
-  if (s2.kind === "refused") return { key: `refused/${s2.workspace}/${createHash12("sha256").update(s2.text).digest("hex").slice(0, 16)}`, notice: { kind: "run-refused", unit: allyLabel(s2.label), text: s2.text } };
+  if (s2.kind === "revoked") return { key: `revoked/${s2.main}/${s2.ended ? "ended" : s2.manual ? "manual" : "pending"}`, notice: { kind: s2.ended ? "main-revoked" : "main-revoke-pending", unit: allyLabel(s2.label), text: s2.text }, scope };
+  if (s2.kind === "refused") return { key: `refused/${s2.workspace}/${createHash12("sha256").update(s2.text).digest("hex").slice(0, 16)}`, notice: { kind: "run-refused", unit: allyLabel(s2.label), text: s2.text }, scope };
   const trust = s2.detail?.startsWith("No trust decision");
   const kind = trust ? "trust-unanswered" : s2.outcome === "quit" ? "run-quit" : s2.outcome === "timeout" ? "run-timeout" : "run-crashed";
-  return { key: `run/${s2.run}`, notice: { kind, unit: allyLabel(s2.label), text: `${who} ${s2.outcome === "quit" ? "was quit" : s2.outcome === "timeout" ? "timed out" : "crashed"}${s2.detail ? `: ${s2.detail}` : ""}` } };
+  return { key: `run/${s2.run}`, notice: { kind, unit: allyLabel(s2.label), text: `${who} ${s2.outcome === "quit" ? "was quit" : s2.outcome === "timeout" ? "timed out" : "crashed"}${s2.detail ? `: ${s2.detail}` : ""}` }, scope };
 }
 
 // src/server/towerrunstore.ts
@@ -15461,6 +15681,62 @@ function removeAnswer(slot, workspace, id, now) {
   if (was.some((a) => a.id === id)) write(slot, workspace, ANSWERS, was.filter((a) => a.id !== id));
 }
 
+// src/server/revoke.ts
+var GONE = /No live session is named|is not in this workspace|is not a main agent|was not opened by a tower/;
+function createRevoker(d) {
+  const told = /* @__PURE__ */ new Set();
+  let low = /* @__PURE__ */ new Set();
+  let goneSeen = /* @__PURE__ */ new Map();
+  let running;
+  const pass = async () => {
+    const now = /* @__PURE__ */ new Set(), gone = /* @__PURE__ */ new Map();
+    for (const row2 of d.opened()) {
+      if (row2.level !== void 0 && row2.level !== "dispatch") continue;
+      if (!d.known(row2.team)) continue;
+      const standing = d.standing(row2.device, row2.team);
+      if (standing?.level === "dispatch") continue;
+      now.add(row2.main);
+      if (!low.has(row2.main)) continue;
+      const why = standing ? "the device lost dispatch" : "the device left the team", who = `The main "${row2.name}" opened for ${row2.deviceLabel}`;
+      try {
+        await d.close(row2.workspace, row2.main);
+      } catch (cause) {
+        const reason = cause.message;
+        if (GONE.test(reason)) {
+          const seen = (goneSeen.get(row2.main) ?? 0) + 1;
+          gone.set(row2.main, seen);
+          if (seen < 2) continue;
+          if (await d.paneGone(row2.workspace, row2.pane)) {
+            d.log({ event: "revoke-gone", workspace: row2.workspace, main: row2.main });
+            d.forget(row2.workspace, row2.main);
+            gone.delete(row2.main);
+            continue;
+          }
+        }
+        const manual = /was not opened by a tower/.test(reason), key2 = `${row2.main}/${manual ? "manual" : "pending"}`;
+        d.log({ event: "revoke-waiting", workspace: row2.workspace, main: row2.main, why });
+        if (!told.has(key2)) {
+          const sent = await d.signal({ kind: "revoked", workspace: row2.workspace, label: row2.label, ally: true, device: row2.device, ...row2.team ? { team: row2.team } : {}, main: row2.main, ended: false, ...manual ? { manual: true } : {}, text: manual ? `${who} still runs and cannot be ended by the box (${reason}). Close it by hand.` : `${who} could not be ended yet (${reason}). The box asks again until it quits.` });
+          if (sent !== false) {
+            told.add(key2);
+            while (told.size > 256) told.delete(told.values().next().value);
+          }
+        }
+        continue;
+      }
+      d.log({ event: "revoke-ended", workspace: row2.workspace, main: row2.main, why });
+      d.forget(row2.workspace, row2.main);
+      d.signal({ kind: "revoked", workspace: row2.workspace, label: row2.label, ally: true, device: row2.device, ...row2.team ? { team: row2.team } : {}, main: row2.main, ended: true, text: `${who} was ended: ${why}.` });
+    }
+    low = now;
+    goneSeen = gone;
+  };
+  return {
+    /** One look at every opened main; looks that overlap share the one in flight. A failure is logged and the next sweep tries again. */
+    sweep: () => running ??= pass().catch((cause) => d.log({ event: "revoke-failed", error: cause.message.slice(0, 200) })).finally(() => running = void 0)
+  };
+}
+
 // src/server/runs.ts
 import { randomBytes as randomBytes17 } from "node:crypto";
 import { lstatSync as lstatSync7, realpathSync as realpathSync10 } from "node:fs";
@@ -15991,7 +16267,7 @@ function createRuns2(o) {
       release();
       svc.refusedAt = now();
       noticeOf(svc, { id: "settings", level: "error", kind: "settings", text: `A run could not start: ${cause.message}` });
-      o.signal?.({ kind: "refused", workspace: svc.ref.workspace, label: svc.ref.record().label, ally: true, text: `A run could not start: ${cause.message}` });
+      o.signal?.({ kind: "refused", workspace: svc.ref.workspace, label: svc.ref.record().label, ally: true, text: `A run could not start: ${cause.message}`, device, team: first2.team });
       log.line("run-refused", { workspace: svc.ref.workspace, why: "settings", kind: "ally" });
       return;
     }
@@ -16202,7 +16478,7 @@ function createRuns2(o) {
     a.rec.outcome = outcome;
     a.rec.endedAt = iso2(now());
     if (detail) a.rec.detail = phrase4(detail, 200);
-    if (outcome === "crashed" || outcome === "timeout" || outcome === "quit") o.signal?.({ kind: "ended", run: a.rec.id, workspace: ws, label: svc.ref.record().label, ally: a.rec.kind === "ally", outcome, ...detail ? { detail: phrase4(detail, 200) } : {} });
+    if (outcome === "crashed" || outcome === "timeout" || outcome === "quit") o.signal?.({ kind: "ended", run: a.rec.id, workspace: ws, label: svc.ref.record().label, ally: a.rec.kind === "ally", outcome, ...detail ? { detail: phrase4(detail, 200) } : {}, ...a.rec.kind === "ally" && a.rec.device ? { device: a.rec.device, ...a.rec.team ? { team: a.rec.team } : {} } : {} });
     try {
       writeRun(slot, a.rec);
       pruneRuns(slot, ws);
@@ -16324,7 +16600,7 @@ function createRuns2(o) {
           const orphan = a.rec.hand === true && !a.polled && a.pending === void 0 && a.closing === void 0;
           const outcome = a.pending ?? (a.closing !== void 0 ? "done" : orphan ? "quit" : "crashed");
           if (outcome === "crashed" && diedWithHerdr(a)) continue;
-          await finish(a, outcome, outcome === "crashed" ? "pi exited without tower_done" : orphan ? "the pi left before its first poll" : void 0, a.left === true);
+          await finish(a, outcome, outcome === "crashed" ? "pi exited without tower_done" : orphan ? "the pi left before its first poll" : a.why, a.left === true);
           continue;
         }
         if (a.recovering !== void 0) {
@@ -16353,9 +16629,18 @@ function createRuns2(o) {
         if (!a.token) continue;
         if (a.rec.kind === "ally" && !standingOf(a)) {
           log.line("ally-ended", { workspace: a.rec.workspace, run: a.rec.id, why: "the sender left the roster" });
+          a.why = "the sender left the team";
           terminate(a, "quit");
           continue;
         }
+        const low = a.rec.kind === "ally" && a.rec.level === "dispatch" && o.ally?.known?.(a.rec.team ?? "") !== false && standingOf(a)?.level !== "dispatch";
+        if (low && a.lowSeen) {
+          log.line("ally-ended", { workspace: a.rec.workspace, run: a.rec.id, why: "the sender lost dispatch" });
+          a.why = "the sender lost dispatch";
+          terminate(a, "quit");
+          continue;
+        }
+        a.lowSeen = low;
         if (now() - a.lastPoll > t.lost) {
           log.line("run-lost", { run: a.rec.id });
           terminate(a, "crashed");
@@ -16526,6 +16811,7 @@ function createRuns2(o) {
     a.offered.delete(event.id);
     a.rec.events.push(event.id);
     writeRun(slot, a.rec);
+    if (a.rec.kind === "ally") o.ally?.delivered?.(event.id, a.rec.id);
     if (event.kind === "boss") bossTurn(a);
     return { ok: true };
   }
@@ -16790,7 +17076,7 @@ function createRuns2(o) {
       const a = of(token);
       if (a && !a.ended && a.rec.kind === "ally") {
         const standing = standingOf(a);
-        if (!standing) terminate(a, "quit");
+        if (!standing) a.why ??= "the sender left the team", terminate(a, "quit");
         return { id: a.rec.id, workspace: a.rec.workspace, kind: "ally", ...standing ? { level: standing.level } : { gone: true }, ...a.rec.device ? { device: a.rec.device } : {}, ...a.rec.deviceLabel ? { deviceLabel: a.rec.deviceLabel } : {}, ...a.rec.deviceShort ? { deviceShort: a.rec.deviceShort } : {}, ...a.rec.team ? { team: a.rec.team } : {}, ...a.rec.teamName ? { teamName: a.rec.teamName } : {}, pane: a.rec.pane, asks: itemsOf(a, true).flatMap((i) => i.awaitsReply ? [i.awaitsReply] : []) };
       }
       return a && !a.ended ? { id: a.rec.id, workspace: a.rec.workspace, kind: headRun(a) ? "head" : a.rec.kind, ...a.rec.level ? { level: a.rec.level } : {}, ...a.rec.device ? { device: a.rec.device } : {}, ...a.rec.deviceLabel ? { deviceLabel: a.rec.deviceLabel } : {}, ...a.rec.team ? { team: a.rec.team } : {}, pane: a.rec.pane, asks: itemsOf(a, true).flatMap((i) => i.awaitsReply ? [i.awaitsReply] : []) } : void 0;
@@ -16911,6 +17197,8 @@ function createRuns2(o) {
         parked: readQueue(slot, workspace, true).map((e) => ({ id: e.id, kind: e.kind, ...e.from?.name ?? e.from?.id ? { from: e.from?.name ?? e.from?.id } : {}, first: phrase4(e.text.split("\n").find((l) => l.trim()) ?? "", 120) }))
       };
     },
+    /** The panes of the live ally runs, with the device each serves and its team: the units a controller dispatched (a question asked in one is that controller's). */
+    allyPanes: () => [...services.values()].flatMap((svc) => [...svc.allies.values()].filter((a) => !a.ended && a.rec.pane && a.rec.device).map((a) => ({ pane: a.rec.pane, device: a.rec.device, ...a.rec.team ? { team: a.rec.team } : {} }))),
     /** The waiting events of a workspace for the GUI's queue rows. */
     queue: (workspace) => {
       const s2 = find2(workspace);
@@ -17087,6 +17375,7 @@ var UNKNOWN = "(unknown)";
 var RUN_SEND_CAP_MS = 2e4;
 var RETRY_MS3 = [1e3, 2e3, 5e3, 1e4, 3e4];
 var REPUBLISH_MS = 300;
+var REVOKE_MS = 15e3;
 var REFRESH_MS2 = 4 * 6e4;
 var RECOVER_MS = 6e4;
 var RECOVER_POLL_MS = 2e3;
@@ -17216,10 +17505,14 @@ function createTowers(o) {
     standing: (device, team) => o.ally.standing(device, team),
     project: (team) => o.ally.project(team),
     thread: (device) => o.ally.thread(device),
+    known: (team) => o.ally.known?.(team) ?? true,
     waiting: (identity2) => {
       const ws = workspaceOf(identity2), answers2 = ws ? readAnswers(slot, ws, now()).map((a) => ({ id: `${LOCAL}${a.id}`, device: a.device, label: a.label, short: a.short, team: a.team, teamName: a.teamName, fromWorkspace: "", replyExpected: false, text: a.text, at: a.at, local: a.from, ...a.ask ? { awaitsReply: a.ask } : {} })) : [];
       return [...o.ally.waiting(identity2), ...answers2].sort((a, b) => a.at - b.at);
     },
+    delivered: (id, run4) => {
+      if (!id.startsWith(LOCAL)) o.ally.delivered?.(id, run4);
+    },
     taken: async (id, identity2) => {
       const ws = workspaceOf(identity2);
       if (!id.startsWith(LOCAL)) return o.ally.taken(id, identity2);
@@ -17691,6 +17984,7 @@ function createTowers(o) {
         error("purge", cause.message);
       }
     }, o.refreshMs ?? REFRESH_MS2));
+    timers2.push(setInterval(() => void revoker.sweep(), o.revokeMs ?? REVOKE_MS));
     const poll = o.recoverPollMs ?? RECOVER_POLL_MS;
     timers2.push(setInterval(() => {
       if (now() < recoverUntil + poll) look2();
@@ -17856,6 +18150,25 @@ function createTowers(o) {
     }
     return closed;
   };
+  const revoker = createRevoker({
+    opened: () => o.ally ? [...services.values()].filter((l) => !l.stopped && l.state === "live" && l.control && !isHeadL(l)).flatMap((l) => readRoutes(slot, l.record.workspace, now()).filter((r) => r.kind === "opened").map((r) => ({ workspace: l.record.workspace, label: l.record.label, main: r.to, name: r.name, device: r.device, deviceLabel: r.label, team: r.team, ...r.level ? { level: r.level } : {}, ...r.pane ? { pane: r.pane } : {} }))) : [],
+    known: (team) => o.ally?.known?.(team) ?? true,
+    standing: (device, team) => o.ally?.standing(device, team),
+    close: async (workspace, main) => void await need(workspace).control.closeMain(main),
+    paneGone: async (workspace, pane) => {
+      if (!pane) return false;
+      try {
+        const net = await need(workspace).reach.read();
+        return !net.ps.some((p) => p.pane_id === pane);
+      } catch {
+        return false;
+      }
+    },
+    // Herdr's listing is the second witness that a main is gone; no pane or a failed read confirms nothing
+    forget: (workspace, main) => void forgetClosed(workspace, { main }),
+    signal: (s2) => o.runs?.signal?.(s2),
+    log: ({ event, ...rest }) => log.line(String(event), rest)
+  });
   const answered = answeredAsks(now);
   const runToolFor = async (request) => {
     const who = runs2.runOf(request.token);
@@ -17865,7 +18178,7 @@ function createTowers(o) {
     const peer = who.kind === "ally" && who.device && who.team ? { device: who.device, label: who.deviceLabel ?? who.device.slice(0, 6), short: who.deviceShort ?? who.device.slice(0, 6), team: who.team, teamName: who.teamName ?? who.team.slice(0, 6) } : void 0;
     const route = (to, name3, kind, ask, live, panes3, pane) => {
       try {
-        addRoute(slot, ws, { ...peer, to, name: name3, kind, at: now(), ...ask ? { ask } : {}, ...pane ? { pane } : {} }, now(), live, panes3);
+        addRoute(slot, ws, { ...peer, to, name: name3, kind, at: now(), ...ask ? { ask } : {}, ...pane ? { pane } : {}, ...kind === "opened" && who.level ? { level: who.level } : {} }, now(), live, panes3);
       } catch (cause) {
         error("ally-route", cause.message);
       }
@@ -18627,9 +18940,9 @@ async function runServer(o) {
     ...o.towers,
     // A seam that watches the runs (tests) sees every signal too, and does not take the place of the notice to the controllers.
     runs: { ...o.towers?.runs, signal: (sig) => {
-      const r = runNotice(sig);
-      void reporter?.notify(r.key, r.notice);
+      const r = runNotice(sig), sent = reporter?.notify(r.key, r.notice, r.scope);
       o.towers?.runs?.signal?.(sig);
+      return sent;
     } }
   });
   stops.push(cfg.watch(() => {
@@ -18648,21 +18961,26 @@ async function runServer(o) {
     }
   }), o.herdrPollMs ?? HERDR_POLL_MS));
   const dialogsOut = () => forwarder ??= new DialogForwarder({
-    ...guiHost.dialogs(),
+    hub: guiHost.dialogs().hub,
+    read: guiHost.dialogs().read,
+    dispatcher: dispatcherLookup({ paneOf: (key2) => guiHost.dialogs().lookup(key2)?.pane, list: () => panes(cfg.run), allyPanes: () => towers?.runs.allyPanes() ?? [], now }),
+    admin: (team, device) => link?.holder?.isAdmin(team, device) ?? false,
     controllers: () => link?.holder?.dialogControllers() ?? [],
     online: (team, device) => link?.holder?.deviceOnline(team, device) ?? false,
     controllersKnown: () => link?.holder?.controllersKnown() ?? false,
+    unit: (key2) => unitLabel(guiHost.dialogs().lookup(key2)),
     post: async (team, device, kind, payload) => {
       if (!link?.holder) throw new Error("The link holder is not running");
       await link.holder.sendDialog(team, device, kind, payload);
     },
     log: ({ event, ...rest }) => log.line(String(event), Object.fromEntries(Object.entries(rest).map(([k, v]) => [k, typeof v === "number" || typeof v === "boolean" ? v : phrase6(v, 200)]))),
     now,
-    notice: (key2, notice) => unitsOut().notify(key2, notice)
+    notice: (key2, notice, scope) => unitsOut().notify(key2, notice, scope)
   });
   const unitWorkspaces = /* @__PURE__ */ new Map();
   const unitsOut = () => reporter ??= new UnitReporter({
     controllers: () => link?.holder?.dialogControllers() ?? [],
+    admin: (team, device) => link?.holder?.isAdmin(team, device) ?? false,
     // Per team: the units whose workspace has a pane inside that team's project, when its policy shares status. Labels and monitor commands leave this computer, so they pass the same scrub as a board's.
     units: async (team) => {
       const policy = link?.holder?.policyOf(team), rows = towers?.status() ?? [];
@@ -18714,11 +19032,11 @@ ${unit}`), note = ws ? readNotes(slot, ws).at(-1) : void 0, sent = ws ? link?.ho
         asks: { take: (q) => asks.take(q) },
         served: (identity2) => towers?.allyWaiting(identity2),
         confirmed: (to, dialogId, allow) => towers?.runs.confirmed(dialogId, allow) ?? false,
-        openTower: async (project, toWorkspace) => {
+        openTower: async (project, toWorkspace, from) => {
           try {
             await openTower({ run: cfg.run, towers: () => towers, now, home: o.link?.home ?? homedir12(), agentDir: env.PI_CODING_AGENT_DIR ?? join44(o.link?.home ?? homedir12(), ".pi", "agent") }, project, toWorkspace);
           } catch (error) {
-            void unitsOut().notify(`tower-open/${project}/${Math.floor(now() / 6e5)}`, { kind: "tower-open-failed", unit: allyLabel(project), text: `Could not open a tower for ${project}: ${error.message}` });
+            void unitsOut().notify(`tower-open/${from}/${project}/${Math.floor(now() / 6e5)}`, { kind: "tower-open-failed", unit: allyLabel(project), text: `Could not open a tower for ${project}: ${error.message}` }, { device: from });
             throw error;
           }
         }
@@ -18770,7 +19088,7 @@ ${unit}`), note = ws ? readNotes(slot, ws).at(-1) : void 0, sent = ws ? link?.ho
   if (slot.primary && !leaving && phase === "starting") {
     dialogsOut().start();
     timers2.push(setInterval(() => void Promise.all([dialogsOut().tick(), unitsOut().tick()]), o.unitsMs ?? 15e3));
-  }
+  } else log.line("dialog-forwarder", { state: "skipped", primary: slot.primary, leaving: Boolean(leaving), phase });
   if (phase === "starting") {
     phase = "ready";
     const stale = own.lastError !== void 0 && own.lastError === prior?.lastError;