quoxcli 0.3.1 → 0.4.0

package/lib/quoxon/approvalFacts.js

@@ -4,6 +4,8 @@
 // when). Pure, so the card, the /approvals row and /approvals N detail cannot drift apart.
 
 export const CMD_CARD_MAX = 400;
+/** Server text can arrive HTML-escaped ("2>/dev/null"); decode for display. Never renders HTML. */
+const dec = (t) => (typeof t === 'string' ? t.replace(/&(amp|lt|gt|quot|apos|#39|#x27);/gi, (_, e) => ({ amp: '&', lt: '<', gt: '>', quot: '"', apos: "'", '#39': "'", '#x27': "'" })[e.toLowerCase()]) : t);
 const str = (v) => (typeof v === 'string' ? v : v == null ? '' : (() => { try { return JSON.stringify(v); } catch { return String(v); } })());
 
 /** Text cut at `max` with a visible, honest tail. `n` is the /approvals number when known. */
@@ -16,11 +18,11 @@ export function clipVisible(text, max, n = null) {
 /** The exact command or tool input, verbatim: method.command, else the reach request, else args. */
 export function commandOf(it) {
   const p = it?.payload || {}; const c = p.approval_context || {}; const m = c.method || {};
-  if (typeof m.command === 'string' && m.command) return { text: m.command, kind: 'command' };
+  if (typeof m.command === 'string' && m.command) return { text: dec(m.command), kind: 'command' };
   const rq = (p.reach?.requests || []).find(r => r && r.kind === 'command' && typeof r.id === 'string' && r.id);
-  if (rq) return { text: rq.id, kind: 'command' };
+  if (rq) return { text: dec(rq.id), kind: 'command' };
   const a = m.args ?? c.args ?? p.args ?? null;
-  if (a != null && a !== '') return { text: str(a), kind: 'input' };
+  if (a != null && a !== '') return { text: dec(str(a)), kind: 'input' };
   return null;
 }
 
@@ -70,12 +72,12 @@ export function whoText(it) {
 /** WHY: the reason text (marked inferred when the caller did not state it). */
 export function whyText(it) {
   const c = it?.payload?.approval_context || {}; const r = c.reason;
-  if (r && typeof r === 'object') return r.text ? `${r.text}${r.source === 'inferred' ? ' (inferred, not stated by the caller)' : ''}` : null;
-  return r || it?.payload?.reason || null;
+  if (r && typeof r === 'object') return r.text ? `${dec(r.text)}${r.source === 'inferred' ? ' (inferred, not stated by the caller)' : ''}` : null;
+  return dec(r || it?.payload?.reason || null);
 }
 
 /** The user's own words that started this, when the server kept them. */
-export const excerptOf = (it) => it?.payload?.approval_context?.on_behalf_of?.request_excerpt || null;
+export const excerptOf = (it) => dec(it?.payload?.approval_context?.on_behalf_of?.request_excerpt) || null;
 
 /** One bag of the facts, for the card. */
 export function approvalFacts(it, { n = null } = {}) {

package/lib/quoxon/approvalSentence.js

@@ -0,0 +1,44 @@
+// TUI-APPROVE: "You approved WHO to do WHAT on WHERE", built only from fields the card already shows.
+// A field that is unknown is left out, never printed as "unknown".
+
+const PLAIN = { // tool -> [infinitive, gerund]
+  ssh_exec: ['run a shell command', 'running a shell command'],
+  host_exec: ['run a shell command', 'running a shell command'],
+  host_restart: ['restart a service', 'restarting a service']
+};
+
+/** "VULCAN-SEC via FORGE (CLI) acting for Adam" -> "VULCAN-SEC". */
+export function shortWho(raw) {
+  let w = String(raw || '').replace(/\s+acting for .*$/i, '').trim();
+  if (!w || /^unknown requester/i.test(w)) return '';
+  const sess = w.match(/\(via\s+session\s+([^,)]+)/i); // "FORGE (via session VULCAN-SEC, CLI)": the session is who asked
+  if (sess && sess[1].trim()) return sess[1].trim();
+  w = w.split('→').pop().split(/\s+via\s+/i)[0].replace(/\s*\(.*$/, '').trim();
+  return w;
+}
+
+const clean = (s) => String(s || '').replace(/\s+/g, ' ').replace(/[.\s]+$/, '').trim();
+
+function whatOf(a) {
+  const plain = PLAIN[a.tool];
+  if (plain) return plain;
+  const w = clean(a.what && a.what !== a.tool ? a.what : '');
+  if (w) return [w, w];
+  const t = clean(String(a.tool || '').replace(/_/g, ' '));
+  return t ? [`use ${t}`, `using ${t}`] : ['', ''];
+}
+
+/** The one- or two-line confirmation for an answered card. */
+export function approvalSentence(a, approved) {
+  const who = shortWho(a.who);
+  const [inf, ger] = whatOf(a);
+  const where = clean(a.where || a.target);
+  const said = (t) => where && new RegExp(`\\bon ${where.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*$`, 'i').test(t); // WHAT already ends "on <where>"
+  const at = where && !(said(inf) || said(ger) || new RegExp(`\\b${where.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`, 'i').test(inf)) ? ` on ${where}` : '';
+  if (approved) {
+    const tail = a.foreign ? ' It runs now; its result isn\'t tracked here.' : '';
+    const head = who ? `${who}${inf ? ` to ${inf}` : ''}` : (ger || 'the request');
+    return `\u2714 You approved ${head}${at}.${tail}`;
+  }
+  return `\u2716 You denied ${who ? `${who} ` : ''}${ger || 'the request'}${at}.`;
+}

package/lib/quoxon/approvalsView.js

@@ -110,12 +110,49 @@ export function filterPredicate(f, { userId = null, conversationId = null, now =
   return (it) => matchesAgent(it, f);
 }
 
+/** What the item says it will do, in its own words: the server's what.summary or the post text, whichever is not just the generic "tool target". Null when there is nothing more specific. */
+export function distinctWhat(it) {
+  const p = it?.payload || {}; const w = p.what && typeof p.what === 'object' ? p.what : {};
+  const generic = [w.action, w.target].filter(Boolean).join(' ').toLowerCase().replace(/\s+/g, ' ').trim();
+  const one = (t) => String(t ?? '').replace(/\s+/g, ' ').trim();
+  for (const c of [w.summary, p.action_params?.text, p.action_params?.body, p.action_params?.message]) {
+    const t = one(c); if (t && t.toLowerCase() !== generic) return t;
+  }
+  return null;
+}
+/** The content being approved, in full: summary, post text, images, body_md. */
+export function contentRows(it) {
+  const p = it?.payload || {}; const w = p.what && typeof p.what === 'object' ? p.what : {}; const ap = p.action_params || {};
+  const imgs = [].concat(ap.image_paths || ap.images || []).filter(Boolean).map(String);
+  const text = ap.text ?? ap.body ?? ap.message ?? null;
+  const body = typeof p.body_md === 'string' ? p.body_md : null;
+  return [
+    ['summary', w.summary ? String(w.summary) : null],
+    ['content', text != null && String(text).trim() ? String(text).trim() : null],
+    ['images', imgs.length ? imgs.join(', ') : null],
+    ['details', body && body.trim() && body.trim() !== String(text ?? '').trim() ? body.trim() : null]
+  ].filter(r => r[1]);
+}
+
+/** A plain approval (not a quox ask) shaped as a y/n card so the walkthrough can show it. The original id stays, so /approve N routes by the same list. */
+export function approvalAsWalkItem(it) {
+  if (isDecision(it)) return it;
+  const p = it?.payload || {}; const c = p.approval_context || {};
+  const dw = distinctWhat(it); const d = describeInboxItem(it);
+  const body = contentRows(it).filter(r => r[0] !== 'summary').map(r => `${r[0]}: ${r[1]}`).join('\n');
+  const why = [whyText(it) || c.why || p.reason || '', body].filter(Boolean).join('\n');
+  return { ...it, __approval: true, title: dw || d.title || it.title || it.id,
+    payload: { ...p, type: 'decision', session: requesterNames(it)[0] || approvalSourceLabel(it), why, high_risk: c.risk === 'high' || p.high_risk === true,
+      options: [{ key: 'y', label: 'Approve' }, { key: 'n', label: 'Deny' }] } };
+}
+
 /** One line: [N] age  who  what  (risk). Clipped to `cols`. */
 export function approvalRow(it, n, { cols = 100, now = Date.now() } = {}) {
   if (isDecision(it)) return decisionRow(it, n, { cols, now });
   const d = describeInboxItem(it);
   const who = requesterNames(it)[0] || approvalSourceLabel(it);
   let what = [d.tool, d.target && d.target !== d.tool ? d.target : null].filter(Boolean).join(' ') || d.title || it.id;
+  const dw = distinctWhat(it); if (dw && commandOf(it)?.kind !== 'command') what = dw; // two posts to the same account must not read the same
   const risk = ctxOf(it).risk ? ` (${ctxOf(it).risk})` : '';
   const priv = isPrivileged({ tool: d.tool, risk: ctxOf(it).risk, flag: it?.payload?.privileged === true || ctxOf(it).privileged === true, title: it.title }) ? ' [privileged]' : '';
   const cmd = commandOf(it);
@@ -150,6 +187,7 @@ export function approvalDetail(it, n, { now = Date.now() } = {}) {
     ['who', whoText(it)],
     ['why', why ? String(why) : null],
     ['request', excerptOf(it) ? `"${excerptOf(it)}"` : null],
+    ...contentRows(it).filter(r => !(r[0] === 'summary' && String(r[1]) === String(why ?? ''))),
     ['class', accessOf(it)],
     ['from', requesterNames(it).join(', ') || approvalSourceLabel(it)],
     ['asked', d.at ? `${ageText(d.at, now)} ago (${String(d.at)})` : null],
@@ -235,7 +273,7 @@ export function walkNoCatch(it) {
 }
 /** A title without the asker's own name in front of it ("SEER: Publish?" asked by SEER -> "Publish?"), whitespace and line breaks folded. */
 export function cleanTitle(it) {
-  const p = it.payload || {}; const t = String(it.title || it.id || '').replace(/\s+/g, ' ').trim();
+  const p = it.payload || {}; const t = decodeEntities(String(it.title || it.id || '')).replace(/\s+/g, ' ').trim();
   for (const name of [p.session, p.agent].filter(Boolean).map(String)) {
     if (t.toLowerCase().startsWith(name.toLowerCase() + ':')) { const rest = t.slice(name.length + 1).trim(); if (rest) return rest; }
   }
@@ -252,6 +290,27 @@ export function hang(label, text, cols) {
   if (cur || !out.length) out.push(cur);
   return out.map((l, k) => (k ? pad : lead) + l);
 }
+/** Like hang, but keeps the text's own line breaks: each line (a "- " list item too) starts a fresh line under the label, wrapped items indented past the dash. */
+export function hangBlock(label, text, cols) {
+  const segs = String(text ?? '').split('\n').map(l => l.replace(/\s+/g, ' ').trim()).filter(Boolean);
+  if (segs.length <= 1) return hang(label, segs[0] || '', cols);
+  const lead = '  ' + label.padEnd(8); const pad = ' '.repeat(lead.length);
+  const room = Math.max(20, (cols || 0) - lead.length - 1); const out = [];
+  for (const seg of segs) {
+    if (!cols) { out.push(seg); continue; }
+    const ind = /^[-*] /.test(seg) ? '  ' : '';
+    let cur = '';
+    for (const w of seg.split(' ')) {
+      if (cur && cur.length + 1 + w.length > room) { out.push(cur); cur = ind + w; } else cur = cur ? cur + ' ' + w : w;
+    }
+    if (cur) out.push(cur);
+  }
+  return out.map((l, k) => (k ? pad : lead) + l);
+}
+/** Slot and server text can arrive HTML-escaped ("-&gt;"); decode for display. Never renders HTML. */
+export function decodeEntities(t) {
+  return String(t ?? '').replace(/&(amp|lt|gt|quot|apos|#39|#x27);/gi, (_, e) => ({ amp: '&', lt: '<', gt: '>', quot: '"', apos: "'", '#39': "'", '#x27': "'" })[e.toLowerCase()]);
+}
 /** Owner 2026-10-17: a test or guard loosening needs a plain justification. True when the title, kind or tags say the ask would make a check easier to pass. */
 export const LOOSEN_RE = /loosen|weaken|relax|widen|(?:delete|remove|skip|disable|replace|rewrite|change|edit|update)\w*\s+(?:\w+\s+){0,3}?(?:tests?|guards?|checks?|assertions?|proof cases?)\b|test.?pin|goal ?post/i;
 export const isLoosening = (it) => { const p = it?.payload || {}; return p.loosening === true || LOOSEN_RE.test([it?.title, p.kind, p.category, ...(Array.isArray(p.tags) ? p.tags : [])].filter(Boolean).join(' ')); };
@@ -265,7 +324,7 @@ export function walkCard(it, i, total, { cols = 0 } = {}) {
   const yn = p.options.some(o => o.key === 'y') && p.options.some(o => o.key === 'n');
   const rec = bareLoose ? null : (p.options.find(o => o.key === p.recommend) || null);
   const dflt = bareLoose ? (p.options.find(o => o.key === 'n') || null) : (p.options.find(o => o.key === p.default) || null);
-  const why = String(p.why || '').replace(/\s+/g, ' ').trim();
+  const why = decodeEntities(String(p.why || '')).split('\n').map(l => l.replace(/\s+/g, ' ').trim()).filter(Boolean).join('\n');
   const what = yn
     ? `Yes lets ${who} go ahead with this; no stops it.${p.high_risk ? ' High risk: a yes needs your PIN.' : ''}`
     : `${who} needs you to choose how to settle this.${p.high_risk ? ' High risk: a yes needs your PIN.' : ''}`;
@@ -281,10 +340,10 @@ export function walkCard(it, i, total, { cols = 0 } = {}) {
     { key: keyClash('?') ? 'ask' : '?', label: 'Ask about it', ask: true },
   ];
   const lines = [
-    `Decision ${i} of ${total} · ${who} asks`,
+    `${p.__approval ? 'Approval' : 'Decision'} ${i} of ${total} · ${who} asks`,
     ...hang('', cleanTitle(it), cols).map(l => l.slice(8)),
     ...hang('WHAT', what, cols),
-    ...(why ? hang('WHY', why, cols) : []),
+    ...(why ? hangBlock('WHY', why, cols) : []),
     ...(loose || just ? hang('JUSTIFY', just || NO_JUSTIFICATION, cols) : []),
     ...(!why && !just && !loose ? hang('WHY', NO_REASON, cols) : []),
     ...hang('ADVICE', advice, cols),

package/lib/quoxon/commandShort.js

@@ -7,6 +7,7 @@
 export const SHORT_MAX = 54;
 export const SHORT = {
   walkthrough: 'a guided pass: what it does, why, my advice',
+  inbox: 'your Quox inbox: latest items, read, open',
   approvals: 'the questions waiting for you, one at a time',
   peek: 'look up an envelope, item, run or receipt by id',
   aside: 'a read-only side question, kept out of the chat',
@@ -20,13 +21,17 @@ export const SHORT = {
   skill: 'ask Quox to run a skill (approvals still apply)',
   rules: 'which rules win: QUOX.md, dev pack, server policy',
   clear: 'fresh conversation and a clear screen',
+  stop: 'stop the current turn, same as Esc',
+  devservers: 'your registered dev servers, and how to open one',
   resume: 'pick a recent conversation and carry on',
   compact: 'summarise the conversation, keeping decisions',
   challenge: 'a second opinion on the last answer (one extra turn)',
   spawn: 'ask HYPERION for a disposable VM (max 24h)',
   consent: 'AI data sharing: see where you stand, or agree',
+  contact: 'add a contact, or list them (as quox contacts)',
   help: 'this reference, or detail for one command',
-  note: 'jot a note for the dev observer (also // text)',
+  note: 'save a note to NotesQ (/notes lists them)',
+  devnote: 'jot a note for the dev observer (also // text)',
   share: 'attach your last ! command\'s output to your message',
   copy: 'copy the last answer to the clipboard',
   dragon: 'the Q comes alive; explain, ask, sleep',
@@ -95,10 +100,14 @@ export const SHORT = {
   afk: 'tell sessions you are away; approvals still queue',
   back: 'mark yourself present and show what you missed',
   observe: 'post a note to the session watching your window',
-  huh: 'the dragon explains what just happened',
-  sleep: 'mark yourself sleeping; the dragon curls up',
+  huh: 'explain the last output in plain words',
+  sleep: 'say you are asleep; sessions stop waiting on you',
   mode: 'ask first (default) or plan only',
   slots: 'held slots: who holds them and where',
+  todo: 'add an Action Tracker item; /todo alone lists',
+  done: 'mark Action Tracker items done: /done td1,td2',
+  todos: 'your Action Tracker by column: td1 do1 dn1',
+  plugins: 'installed plugins (extensions) and their state',
   mirror: 'what CommanderQ sees about this org right now',
   health: 'dashboard summary: services, agents, approvals',
   status: 'profile, org, server health, model, agent, slot',
@@ -108,5 +117,8 @@ export const SHORT = {
   server: 'your self-hosted install: version, health, disk',
   config: 'settings: theme, motion, verbose, model',
   model: 'choose the provider and model for your next turns',
+  qpe: 'how many proof engine rows show',
   row: 'your own live lines above the status bar',
+  deck: 'QuoxDeck MIDI pads (the quoxdeck extension)',
+  ext: 'installed extensions: list, turn on or off',
 };

package/lib/quoxon/commands.js

@@ -34,7 +34,7 @@ const ARGS = {
   fleet: [{ after: [], src: 'fleetHosts' }],
   replay: [{ after: [], src: 'conversations' }],
   org: [
-    { after: [], choices: [
+    { after: [], src: 'orgs', choices: [
       { value: 'switch', desc: 'move this session to another org' },
       { value: 'back', desc: 'return to the org you were in before' },
       { value: 'list', desc: 'your orgs' }] },
@@ -62,7 +62,11 @@ const ARGS = {
   say: [{ after: [], src: 'slots' }],
   broadcast: [{ after: [], choices: [{ value: '--slots', desc: 'only these slots, comma separated' }, { value: '--priority', desc: 'urgent shows red' }, { value: '--ack', desc: 'ask recipients to /ack' }] }],
   send: [{ after: [], src: 'slots' }, { after: ['*'], src: 'files', of: 'partial' }],
-  dragon: [{ after: [], choices: ['explain', 'ask', 'sleep', 'fly', 'hero', 'fire', 'classic'] }],
+  dragon: [
+    { after: [], choices: ['explain', 'ask', 'sleep', 'fly', 'hero', 'fire', 'classic', { value: 'companion', desc: 'the dragon beside an attached Lucid, Hyperion, Seer, Sentinel, Drago or Cipher' }] },
+    { after: ['companion'], choices: [{ value: 'on', desc: 'on attach and key moments, then leaves' }, { value: 'greeting', desc: 'only on attach, then leaves' }, { value: 'off', desc: 'never on its own (/dragon shows it)' }, { value: 'status', desc: 'what is set and whether the art loads' }] }
+  ],
+  inbox: [{ after: [], choices: [{ value: 'read', desc: 'read N | all: mark items read' }, { value: 'open', desc: 'open N: take an approval to /approvals' }, { value: 'latest', desc: 'the latest 10' }] }],
   tips: [{ after: [], choices: topicList().map(t => ({ value: t.topic, desc: `${t.count} tip${t.count === 1 ? "" : "s"}` })) }],
   whatsnew: [{ after: [], choices: [{ value: 'all', desc: 'every command and entry, regardless of seen' }, { value: 'on', desc: 'show the card at startup when something is new' }, { value: 'off', desc: 'stop the startup card' }] }],
   'tip-settings': [{ after: [], choices: [
@@ -93,6 +97,19 @@ const ARGS = {
   ]
 };
 
+// Dev-only entries (dev: true) are vendor tooling: they live in lib/vendor/devCommands.js, which package.json
+// "files" keeps out of the published quoxcli (same mechanism as the owner-only licence verbs, quox#1134).
+// Present in the dev tree, absent for every npm user.
+let DEV_ENTRIES = [];
+// TUI-QPE 2026-10-20 (owner: "/qpe is extension right?"): owner tooling that is not dev-observer gated also lives in
+// lib/vendor (VENDOR_ENTRIES), so the public build has no /qpe; customers have no proof engine.
+let VENDOR_ENTRIES = [];
+try {
+  const v = await import('../vendor/devCommands.js');
+  DEV_ENTRIES = v.DEV_ENTRIES || [];
+  VENDOR_ENTRIES = v.VENDOR_ENTRIES || [];
+} catch (e) { if (e?.code !== 'ERR_MODULE_NOT_FOUND') throw e; }
+
 export const REGISTRY = [
   // Talk (keys)
   { id: 'type', kind: 'key', group: 'Talk', usage: 'just type', desc: 'ask Quox anything; CommanderQ routes it to the right agent', status: 'active' },
@@ -110,6 +127,7 @@ export const REGISTRY = [
   { id: 'ctrlc', kind: 'key', group: 'Talk', usage: 'Ctrl+C', desc: 'clear the draft; during a turn interrupt; twice when idle quits', status: 'active' },
   // Approvals
   { id: 'approvals', kind: 'command', group: 'Approvals', usage: '/approvals [mine|agents|old|<agent>|N]', desc: 'the questions waiting for you, one at a time', server: true, cap: 'approvals', status: 'active' },
+  { id: 'inbox', kind: 'command', new: true, group: 'Approvals', usage: '/inbox [N | read N|all | open N]', desc: 'your Quox inbox: the latest 10 as a table, N shows one in full, read marks read, open takes an approval to /approvals', needs: ['inboxItems'], cap: 'approvals', status: 'active', args: ARGS.inbox },
   { id: 'walkthrough', kind: 'command', new: true, group: 'Approvals', usage: '/walkthrough', desc: 'walk through what is waiting for you one question at a time: what it does, why, my advice, then your choice (same as /approvals walkthrough)', server: true, cap: 'approvals', status: 'active' },
   { id: 'yestoall', kind: 'command', new: true, group: 'Approvals', usage: '/yestoall', desc: 'approve everything waiting for you (same as /approve all; privileged ones still ask)', server: true, cap: 'approvals', status: 'active' },
   { id: 'approve', kind: 'command', group: 'Approvals', usage: '/approve N | 1 y 2 n | agent <name>', desc: 'approve item N from the list, or everything one agent asked', server: true, cap: 'approvals', status: 'active',
@@ -128,11 +146,21 @@ export const REGISTRY = [
     detail: 'Lists your org skills (reusable procedures an agent follows; not Crystals, which are deterministic replays) with edition and one-line description. /skills <name> shows its card: purpose, version and review state, tests (results only when run-tests recorded them), the agents it is for, where it came from, recorded use, and how to run it.' },
   { id: 'skill', kind: 'command', group: 'Skills', usage: '/skill <name> [args]', desc: 'ask Quox to run a skill (governed: approvals still apply)', server: true, cap: 'skills', status: 'active',
     detail: 'Sends "Run the skill <name> with: <args>" as a normal turn, so CommanderQ runs it through the usual governed path. Nothing is executed from here, and approval cards work as always.' },
+  { id: 'plugins', kind: 'command', group: 'Skills', usage: '/plugins [name]', desc: 'plugins (extensions, add-ons) your org has installed: enabled state and version; /plugins <name> shows one', needs: ['pluginList'], status: 'active', aliases: ['plugin', 'extensions', 'extension', 'addons', 'apps'],
+    detail: 'Read-only. Lists the plugins installed for the active org (the same call as quox plugin list) with enabled or disabled and the version. /plugins <name> shows one plugin (as quox plugin get). Also answers to /extensions, /extension, /addons and /apps; "/extension list" works too.' },
+  { id: 'todo', kind: 'command', group: 'Awareness', usage: '/todo <text>', desc: 'add an Action Tracker item; /todo move do2 done moves one; /todo alone lists', needs: ['todoAdd', 'todoList', 'todoMove'], status: 'active',
+    detail: 'Moves: /todo move do5 done, /todo do5 done, /todo mark do2 done, /todo td3 doing (td = to do, do = doing, dn = done; the numbers are the ones /todos last showed, and if the list changed since, it says so and still moves the item you saw). Adds one item to your Action Tracker (status todo) as you, the same as quox actions add "<text>" or adding it in the dashboard, then confirms with the item id. No model call and no approval: you typing it is the authorization. /todo with no text lists your open items, the same as /todos. Mark one done with quox actions done <id>.' },
+  { id: 'done', kind: 'command', group: 'Awareness', usage: '/done <ids>', desc: 'mark Action Tracker items done: /done td1,td2', needs: ['todoList', 'todoMove'], status: 'active',
+    detail: 'Marks Action Tracker items done by the short ids /todos last showed: /done td1,td2 or /done td1 td2. Each one is confirmed by title. Same as /todo move td1,td2 done. No model call and no approval: you typing it is the authorization.' },
+  { id: 'todos', kind: 'command', group: 'Awareness', usage: '/todos', desc: 'your Action Tracker by column, numbered td1 do1 dn1 for /todo move', needs: ['todoList'], status: 'active',
+    detail: 'Read-only. Lists your whole Action Tracker (every page) by column: To do td1.., Doing do1.., Done dn1.. (the 10 newest; the rest via quox actions list --status done), newest first. Use the numbers with /todo move do2 done. /todo <text> adds one.' },
   { id: 'rules', kind: 'command', group: 'Skills', usage: '/rules [files|off|on|N]', desc: 'which rules win: advisory QUOX.md, the dev pack, enforced server policy', status: 'active',
     detail: '/rules shows the precedence: QUOX.md and the dev pack only guide; armed governance policies on the server are enforced and win. /rules files shows the QUOX.md text. QUOX.md in this directory and parents up to the git root, plus ~/.quox/QUOX.md, are sent with each turn as your rules. World-writable files and symlinks leaving your home or repo are ignored. /rules N shows page N.' },
   // Conversation
   { id: 'clear', kind: 'command', group: 'Conversation', usage: '/clear', desc: 'fresh conversation and a clear screen; rules and memory kept, /resume goes back', status: 'active', aliases: ['new', 'reset'],
     detail: 'Clears the screen and starts a new conversation. Your QUOX.md rules, attached agent, model choice and Quox memory stay as they are. The previous conversation is kept on the server: /resume lists it.' },
+  { id: 'stop', kind: 'command', group: 'Conversation', usage: '/stop', desc: 'stop the current turn, same as Esc', status: 'active', aliases: ['cancel'],
+    detail: 'Stops the turn that is running, exactly like Esc: the stream is cancelled, the working animation ends and the status line goes back to normal. /cancel does the same. With nothing running it says so.' },
   { id: 'resume', kind: 'command', group: 'Conversation', usage: '/resume [id|name]', desc: 'pick a recent conversation and carry on where it left off', status: 'active', needs: ['conversations', 'conversationTurns'],
     detail: 'Alone: a picker of your recent conversations (title, agent, age); Up/Down and Enter resume, Esc cancels. With an id (or the start of one) or a /rename name it resumes directly. The last turns are shown as history and your next message continues that conversation. Also at launch: quox --resume [id|name] or quox --conversation <id>.' },
   { id: 'compact', kind: 'command', group: 'Conversation', usage: '/compact [show]', desc: 'summarise the conversation on the server, keeping decisions', status: 'active', needs: ['compactConversation'],
@@ -149,15 +177,19 @@ export const REGISTRY = [
       'suggested too (providers, live model ids, orgs, agents, slots, options): Up and Down' +
       ' choose, Tab completes, Esc closes, and keep typing to narrow. Suggestions that ' +
       'cannot be fetched are simply left out.' },
-  { id: 'note', kind: 'command', group: 'Conversation', usage: '/note <text>', desc: 'jot an observation for the dev observer (also: // text); not sent to Quox', status: 'active', dev: true,
-    detail: 'Records your text in the dev transcript only: not sent to the model or the server, no turn, not in chat history. Needs dev transcripts on (touch ~/.config/quox/dev-transcripts). Up to 2000 characters.' },
+  { id: 'note', kind: 'command', group: 'Conversation', usage: '/note <text>', desc: 'save a NotesQ note (first line is the title); not sent to Quox. /notes lists them', status: 'active',
+    detail: 'Creates a NotesQ note through the same backend as quox notes new: the first line (or first 60 characters) becomes the title and your text is the body. It confirms with the title and id. If NotesQ is not licensed or enabled for your org it says so and how to enable it. /notes lists recent notes (quox notes ls).' },
+  { id: 'notes', kind: 'command', group: 'Conversation', usage: '/notes', desc: 'list your recent NotesQ notes (same as quox notes ls)', status: 'active',
+    detail: 'Runs quox notes list in this window. /note <text> saves a new one.' },
+  { id: 'contact', kind: 'command', group: 'Conversation', usage: '/contact new <name> [--phone N] [--email E] [--relationship R]', desc: 'add a contact (same as quox contacts add); /contact list pages them', status: 'active',
+    detail: 'Builds a quox contacts add command from what you type: --mobile, --tel and --number become --phone, a multi-word name is quoted for you, and a flag the command does not have is refused with the list it does take. It goes through the same approval rules as the CLI.' },
   { id: 'bang', kind: 'key', group: 'Talk', usage: '!<command>', desc: 'run a shell command here without leaving (!quox <args> runs this quox as you); output stays on your screen', status: 'active',
     detail: 'A line starting with ! runs on this machine in the current directory via your shell and prints inline: "$ <command>", the output, then "exit N". It is never sent to Quox, starts no turn and needs no approval, because it is your own command. !quox <args> (or !q <args>) runs THIS quox binary with your current profile, so !quox inbox list works as you; bare quox and tui need the terminal and are refused. Ctrl+C stops it (SIGTERM, then SIGKILL after 2 s) without quitting; one command at a time; stdin is closed, so a command that waits for input gets end-of-file; 120 s limit (QUOX_BANG_TIMEOUT_MS); output is capped at 2000 lines / 256 KB. !! is reserved. Only the command line and exit code go in the dev transcript, never the output.' },
   { id: 'share', kind: 'command', group: 'Talk', usage: '/share [N]', desc: 'attach the output of your last ! command (or the Nth-last) to your next message', status: 'active',
     detail: 'Command output is not shared with Quox by default, because it can contain secrets. /share attaches the latest ! result to your next message (up to 16 KB, and it says when it was cut); /share 2 picks the one before. A line "shared with Quox: output of `<command>`" appears when it is sent.' },
   { id: 'copy', kind: 'command', group: 'Conversation', usage: '/copy [N|code]', desc: 'copy the last answer (raw markdown) to the clipboard; N = Nth-last, code = last code block', status: 'active',
     detail: 'Uses the OSC 52 terminal escape (works over SSH in most terminals; wrapped for tmux). Needs a terminal that allows OSC 52. Mouse selection is untouched: select and copy with your terminal as usual.' },
-  { id: 'dragon', kind: 'command', group: 'Conversation', usage: '/dragon [explain|ask [question]|sleep|fly|hero|fire|classic]', desc: 'the Q comes alive; /dragon explain gives the simplest possible explanation of the last output, /dragon ask [question] answers one question just as simply, /dragon sleep is a katakana screensaver (any key wakes)', status: 'active', args: ARGS.dragon,
+  { id: 'dragon', kind: 'command', group: 'Conversation', usage: '/dragon [explain|ask [question]|sleep|fly|hero|fire|classic|companion on|greeting|off|status]', desc: 'the Q comes alive; /dragon explain gives the simplest possible explanation of the last output, /dragon ask [question] answers one question just as simply, /dragon sleep is a katakana screensaver (any key wakes)', status: 'active', args: ARGS.dragon,
     detail: 'Plain /dragon plays the dragon (googly eyes, a talking smile, tail sway and whip, then fire from its mouth); classic and hero are the same show, /dragon fire is the breath alone. explain and ask are ordinary turns on whichever AI you have selected (tools and approvals still apply); the answer stays in the conversation as "Dragon explains" or "Dragon answers". With no AI connected you get the usual connect card. /dragon ask with no question waits for your next line. /dragon sleep hides the screen under katakana with the dragon asleep; any key wakes it and is not typed, an approval wakes it, Ctrl+C quits. It only changes what is drawn, never the conversation. Quiet motion or NO_COLOR shows a still screen.' },
   { id: 'dragon-fly', kind: 'command', group: 'Conversation', usage: '/dragon-fly', desc: 'the dragon flies across the screen, wings beating (same as /dragon fly)', status: 'active',
     detail: 'One 9 second pass of the dragon in flight, wings beating; Esc stops it early. It only changes what is drawn, never the conversation. Quiet motion or NO_COLOR shows a single still frame instead.' },
@@ -234,6 +266,8 @@ export const REGISTRY = [
     detail: 'off (default) keeps the screen to your conversation, the tool result lines and ONE AOCL footer per turn (layers, tool count, time). on shows the compact AEE / VOLT / AOCL / WARD protocol lines as they happen. full adds the thinking stream. Saved to your profile. The full list of tools offered to the model for the last turn is in /aocl.' },
   { id: 'proof', kind: 'command', group: 'Verbose', usage: '/proof [envelope]', desc: 'the evidence chain for the last tool call: AEE, AOCL, tool, WARD', server: true, cap: 'receipts', status: 'active',
     detail: 'Each link is read back from the server and drawn confirmed only when the read says so. WARD is the server-verified inclusion receipt; it can be slow on a large chain and is bounded, so a link may stay open.' },
+  { id: 'evidence', kind: 'command', new: true, group: 'Verbose', usage: '/evidence', desc: 'signed evidence bundle for this conversation', server: true, cap: 'receipts', status: 'active', aliases: ['envelope', 'envelopes', 'aee', 'volt', 'ward'],
+    detail: 'The same export as `quox evidence bundle`: a zip with envelopes.json/csv, ward-receipts.json, volt.json, a manifest of file hashes and an Ed25519 signature, scoped to your org and this conversation. It prints the path, the envelope count, the receipt count and the command to check it offline (`quox evidence verify <file>`). /ward does the same and lists the WARD receipts; /envelope, /envelopes and /aee show the envelope ids (same as /proof); /volt points at the VOLT run inside the bundle.' },
   { id: 'prove', kind: 'command', new: true, group: 'Verbose', usage: '/prove', desc: 'independently check that the last turn\'s tool calls really did what they said: receipt chain plus a read-back of the effect', server: true, cap: 'receipts', status: 'active',
     detail: 'For each tool call of the last turn: the receipt chain is re-read from the server (as in /proof), and where the tool is a write we know how to read back (today: slot_create, memory_save) the effect is read from the system of record. ✔ proven = the chain agrees and the effect is there (or it was a read and the chain agrees). ⚠ unproven = it cannot be shown from here (no read mapping for that write, a read failed, no receipt). ✖ contradicts = the call failed, the server recorded a failure, or the effect is not there. Nothing is assumed: an unmapped write is never called proven. /proof is unchanged and shows one call\'s chain.' },
   { id: 'replay', kind: 'command', new: true, group: 'Verbose', usage: '/replay [run or conversation id] [page]', desc: 'rebuild an earlier run from the audit trail: decisions, tools with args, outputs and receipts, in order, paged', server: true, cap: 'receipts', status: 'active', args: ARGS.replay,
@@ -244,6 +278,8 @@ export const REGISTRY = [
   // Awareness
   { id: 'roster', kind: 'command', group: 'Awareness', usage: '/roster [all]', desc: 'show or hide the live roster under the status line; all includes background work', needs: ['roster'], status: 'active',
     detail: 'The roster lists what needs you: pending approvals, then work you started (objectives, loops, manual workflows). Scheduled and event-driven workflows are hidden; background failures show once per workflow in the bar below. /roster all shows everything. Refreshed every 15 s from the server. Down on an empty composer focuses it; Enter peeks, s asks to stop (y confirms), Esc returns. A source the server cannot answer shows nothing and is named here.' },
+  { id: 'loop', kind: 'command', group: 'Awareness', usage: '/loop [list|watch <id>|peek <id>|focus]', desc: 'follow a loop live in a card that updates in place', server: true, status: 'active',
+    detail: 'A loop you start from chat gets a live card: the turn strip (✔ ok, ⚠ waiting or denied, ✖ error, ◐ running), the receipts counter, host and scope, and the last lines of what it is writing. Milestones and errors land as normal chat lines beneath it, and a finished loop prints one line with the proof command. /loop list shows loops, /loop watch <id> follows one that is already running (and gives it the keys), /loop peek <id> prints one snapshot, /loop focus gives the keys back. Keys: Enter expands the output, s asks to halt (y confirms, never immediate), Esc collapses and leaves. Under 60 columns the card is one line. Needs a server with the loop event routes; one without them says so.' },
   { id: 'workflow', kind: 'command', group: 'Skills', usage: '/workflow <name|id|run>', desc: 'the step flow of a workflow\'s latest run (or one run): state, timings, human gates', server: true, cap: 'workflows', status: 'active',
     detail: 'Steps come from the workflow definition and each state and duration from that run\'s recorded envelopes. A reached human gate shows amber. Enter on a workflow row in the roster shows the same flow.' },
   { id: 'crystal', kind: 'command', group: 'Skills', usage: '/crystal <workflow>', desc: 'is this workflow eligible to become a Crystal? checked against the real gate', server: true, cap: 'crystals', status: 'active',
@@ -288,11 +324,11 @@ export const REGISTRY = [
   { id: 'afk', kind: 'command', new: true, group: 'Context', usage: '/afk [note]', desc: 'tell sessions you are away (they stop waiting on approvals, which still queue); /back then shows everything since, grouped', status: 'active',
     detail: 'Sets your presence on the server (per user and org): sessions saying into hitl, triage-q or this window\'s slot see "owner away since 15:54 UTC (note): approvals will queue"; `quox presence`, `quox slot list`, quox ask and agents see it too. Nothing is approved while you are away. /back or any typed message marks you present.' },
   { id: 'back', kind: 'command', new: true, group: 'Context', usage: '/back', desc: 'mark yourself present and show what happened since /afk (same as /away)', status: 'active' },
-  { id: 'observe', kind: 'command', new: true, group: 'Context', usage: '/observe <text>', desc: 'a note to the observer: posts your text to the session that watches your window', status: 'active', dev: true },
-  { id: 'huh', kind: 'command', new: true, group: 'Conversation', usage: '/huh [question]', desc: 'the dragon explains what just happened (same as /dragon explain)', status: 'active' },
-  { id: 'sleep', kind: 'command', new: true, group: 'Conversation', usage: '/sleep', desc: 'mark yourself sleeping (sessions stop waiting on approvals, which still queue) and the dragon curls up (/dragon sleep)', status: 'active' },
+  { id: 'huh', kind: 'command', new: true, group: 'Conversation', usage: '/huh [question]', desc: 'explain the last output in plain words, using one turn on your model (same as /dragon explain)', status: 'active' },
+  { id: 'sleep', kind: 'command', new: true, group: 'Conversation', usage: '/sleep', desc: 'tell other sessions you are away sleeping so they stop waiting on your approvals (they still queue), then the dragon curls up (same as /dragon sleep)', status: 'active' },
   { id: 'mode', kind: 'command', new: true, group: 'Context', usage: '/mode [ask|plan]', desc: 'this window\'s mode: ask first (default) or plan only', status: 'active', args: ARGS.mode,
     detail: 'Alone it shows the current mode and the options. /mode plan: Quox investigates with read tools and proposes the steps and the exact commands, and runs nothing that changes state; the server enforces it, and the answer ends with "Run this plan now? y/N/c" (y switches back to ask and sends the go-ahead). /mode ask goes back. For this window only: kept across /restart, never saved to your profile. Auto mode is not available yet: it needs standing grants (planned).' },
+  { id: 'devservers', kind: 'command', new: true, group: 'Connect', usage: '/devservers [name]', desc: 'your registered dev servers; /devservers <name> shows its go command', status: 'active' },
   { id: 'slots', kind: 'command', new: true, group: 'Conversation', usage: '/slots [all]', desc: 'held slots: who holds them and where; free ones are summarised, /slots all lists them (same as /slot list)', needs: ['slots'], cap: 'slots', status: 'active' },
   { id: 'mirror', kind: 'command', new: true, group: 'Context', usage: '/mirror [agents]', desc: 'the Mirror: what CommanderQ sees about this org right now', needs: ['mirror'], status: 'active',
     detail: 'Read-only, no model call. The org-scoped Mirror the server builds from each service and injects into CommanderQ on every turn: identity, health, implants, capabilities, plugins, memory, codebase, and every value it could not read with the reason. /mirror agents lists the agents. For the QuoxMind implants alone use /mind.' },
@@ -333,6 +369,10 @@ export const REGISTRY = [
       'prompt profile: compact is a short system prompt for small or local models (the ' +
       'default on Ollama, LM Studio and vLLM), full is the default elsewhere; --prompt-' +
       'profile does the same for one --print run.' },
+  { id: 'deck', ext: 'quoxdeck', kind: 'command', group: 'Context', usage: '/deck on|off|status', desc: 'QuoxDeck: an optional MIDI pad surface; pads open an approval or preselect an answer, you confirm here', status: 'active',
+    detail: 'Provided by the optional quoxdeck extension, not by core: npm i -g quoxdeck, then quox ext add quoxdeck (until then /deck says so). quoxon pushes approvals, health and loops to the deck at most once a second. A pad only opens an approval view or fills the composer with the answer; it never answers for you, and high risk still needs the step-up PIN. The setting is saved, so the deck comes back on at the next start.' },
+  { id: 'ext', kind: 'command', group: 'Context', usage: '/ext list|on|off <name>', desc: 'optional extensions (npm packages) that add surfaces to this window', status: 'active',
+    detail: 'Extensions load only when installed (npm i -g <pkg>) and listed (quox ext add <pkg>). /ext list shows each one and where it was found, on|off switches one for the next start and now. An extension can open an approval or preselect an answer; it cannot answer for you. Contract: cli/lib/quoxon/EXTENSIONS.md.' },
   { id: 'row', kind: 'command', group: 'Context', usage: '/row [new|add|list|edit <id>|rm <id>|test <id>|reload|on|off]', desc: 'your own live lines above the status bar: stats from a URL, your Quox, a plugin or a command', status: 'active', args: ARGS.row,
     detail:
       '/row new walks you through one row with y/N cards and shows what it will say before saving; /row edit <id> changes one. ' +
@@ -350,12 +390,24 @@ export const REGISTRY = [
     detail: 'Type @ at the start of a word: a list under the composer suggests agents, fleet hosts, tasks (your newest objectives) and receipts (the envelope ids of this session\'s tool calls), filtered as you type by id or name. Tab or Enter puts it in, Esc closes the list. The lists are fetched once per session on your first @ and then filtered locally, so typing never sends a request; receipts come from this session and need no request at all. /peek <id> shows what an id is.' }
 ];
 
+// Splice dev entries back next to their neighbours (after /notes and /back); absent in the public build.
+for (const e of DEV_ENTRIES) {
+  const after = e.id === 'devnote' ? 'notes' : 'back';
+  const i = REGISTRY.findIndex((x) => x.id === after);
+  REGISTRY.splice(i < 0 ? REGISTRY.length : i + 1, 0, e);
+}
+// Vendor (owner tooling) entries go just before /row; absent in the public build.
+for (const e of VENDOR_ENTRIES) {
+  const i = REGISTRY.findIndex((x) => x.id === 'row');
+  REGISTRY.splice(i < 0 ? REGISTRY.length : i, 0, e);
+}
+
 // The palette row's one-line wording (commandShort.js); /help keeps the long desc.
 for (const e of REGISTRY) if (e.kind === 'command' && !e.short && SHORT[e.id]) e.short = SHORT[e.id];
 
 const norm = (s) => String(s || '').trim().toLowerCase().replace(/^\//, '');
 
-/** Dev-only entries (/observe, /note) are invisible unless a dev observer is configured. */
+/** Dev-only entries (/observe, /devnote) are invisible unless a dev observer is configured. */
 export const entryVisible = (e) => !e.dev || devObserverOn();
 /** REGISTRY minus entries hidden on this install. */
 export const visibleRegistry = () => REGISTRY.filter(entryVisible);
@@ -397,6 +449,14 @@ const STATUS_LINE_HELP = [
   { kind: 'row', key: '── model ─', text: 'the divider under the composer names the provider and model (/model)' }
 ];
 
+/** QUOXON-DELIGHT: the short "Try these" block at the end of /help (the full verified set is the collector's tryThese.json). */
+export const TRY_THESE = [
+  { id: 'challenge', usage: '/challenge', hook: 'a different AI provider argues with the answer you just got' },
+  { id: 'spawn', usage: '/spawn 2c 4G 20G 1h for X', hook: 'a disposable VM in seconds, gone when the timer ends' },
+  { id: 'crystallize', usage: '/crystallize', hook: 'turn what you just did into a reusable skill' },
+  { id: 'roar', usage: '/roar <text>', hook: 'shout to every session you hold at once' }
+];
+
 /** registry: the entries to list (default: this install's visible registry; tests pass a fixture). */
 export function helpModel(topic, caps = {}, registry = visibleRegistry()) {
   if (topic) {
@@ -425,6 +485,11 @@ export function helpModel(topic, caps = {}, registry = visibleRegistry()) {
     out.push({ kind: 'gap' }, { kind: 'head', text: 'Coming', dim: true });
     for (const e of planned) out.push({ kind: 'dim', key: e.usage, text: e.desc });
   }
+  const tries = TRY_THESE.filter(t => registry.some(e => e.status === 'active' && (e.id === t.id || (e.aliases || []).includes(t.id))));
+  if (tries.length) {
+    out.push({ kind: 'gap' }, { kind: 'subhead', text: 'Try these' });
+    for (const t of tries) out.push({ kind: 'row', key: t.usage, text: t.hook });
+  }
   out.push({ kind: 'gap' }, { kind: 'dim', text: '/help <command> for detail, e.g. /help esc' });
   return out;
 }
@@ -467,7 +532,7 @@ export function nearestCommands(input, max = 3) {
 }
 
 // Commands whose last argument is free text: a pasted line that the terminal wrapped is still one command.
-const FREE_TEXT_CMDS = new Set(['ask', 'aside', 'afk', 'observe', 'roar', 'awaken', 'poke', 'wake', 'nudge', 'ping', 'slap', 'feedback', 'huh', 'r', 'reply', 'say', 'page', 'broadcast', 'gripe', 'gripe!', 'note', 'dragon', 'deny', 'wish', 'challenge']);
+const FREE_TEXT_CMDS = new Set(['ask', 'aside', 'afk', 'observe', 'roar', 'awaken', 'poke', 'wake', 'nudge', 'ping', 'slap', 'feedback', 'huh', 'r', 'reply', 'say', 'page', 'broadcast', 'gripe', 'gripe!', 'note', 'devnote', 'dragon', 'deny', 'wish', 'challenge']);
 /** "/say a long\n text" -> { text: '/say a long text', lines: 2 }; null when it is not a wrapped free-text command. */
 export function joinWrappedSlash(text) {
   const t = String(text || '');

package/lib/quoxon/countdownLine.js

@@ -1,6 +1,15 @@
 /** The restart countdown line, fitted to the width: full text when it fits, shorter forms below, never wrapped. */
-export function countdownLine(secs, cols) {
+export function countdownLine(secs, cols, { waiting = false } = {}) {
   const room = Math.max(20, (cols || 80) - 4); // paddingLeft 2 plus a margin
+  if (waiting) { // the countdown is over but the Quox server is down (a land is redeploying it): hold the restart until it answers
+    const w = [
+      '↻ New version ready, waiting for Quox server to come back before restarting · Esc to stay · Enter to restart now',
+      '↻ Waiting for Quox server to come back before restarting · Esc stay · Enter now',
+      '↻ Waiting for Quox server before restarting · Esc stay',
+      '↻ Waiting for Quox server · Esc stay',
+    ];
+    return w.find(f => f.length <= room) || w[w.length - 1];
+  }
   const forms = [
     `↻ New version ready. Restarting in ${secs}s · Esc to stay on this version · Enter to restart now`,
     `↻ New version · restarting in ${secs}s · Esc stay · Enter now`,

package/lib/quoxon/deck.js

@@ -0,0 +1,30 @@
+/**
+ * QuoxDeck compatibility shim. The deck is no longer part of core: it is an installable extension ("quoxdeck") run by the
+ * generic host in extensions.js (see EXTENSIONS.md). This file only keeps the old deck-shaped surface (on/off/status, the
+ * QUOXDECK_MODULE override, the "not installed" text) as a thin wrapper over that host. New code should use extensions.js.
+ */
+import { createExtensionHost, buildSnapshot, pickDraft, notInstalled, THROTTLE_MS } from './extensions.js';
+
+export const DECK_PACKAGE = 'quoxdeck';
+export const DECK_NOT_INSTALLED = notInstalled(DECK_PACKAGE);
+export const DECK_THROTTLE_MS = THROTTLE_MS;
+export const buildDeckState = buildSnapshot;
+export const deckPickDraft = pickDraft;
+
+export function createDeckHost({ env = process.env, ...rest } = {}) {
+  const legacy = env?.QUOXDECK_MODULE; // the old override still works, mapped to QUOX_EXT_QUOXDECK_MODULE
+  const h = createExtensionHost({ ...rest, env: legacy ? { ...env, QUOX_EXT_QUOXDECK_MODULE: legacy } : env });
+  return {
+    armed: h.armed,
+    emit: (msg) => h.emit(msg),
+    push: h.push,
+    async on() {
+      if (h.armed()) return { ok: true, text: 'QuoxDeck is already on.' };
+      const r = await h.load(DECK_PACKAGE);
+      if (r.ok) return { ok: true, text: 'QuoxDeck is on. Pads can open an approval or preselect an answer; you confirm in this window.' };
+      return { ok: false, text: r.notFound ? `QuoxDeck ${DECK_NOT_INSTALLED}` : `QuoxDeck ${r.text.replace(/^quoxdeck /, '')}`.replace('could not load: the package has no create().', 'could not load: the package has no createDeck.') };
+    },
+    off() { const was = h.armed(); h.unloadAll(); return was ? { ok: true, text: 'QuoxDeck is off.' } : { ok: true, text: 'QuoxDeck was not on.' }; },
+    status: () => (h.armed() ? 'QuoxDeck: on (armed).' : 'QuoxDeck: off. /deck on arms it.')
+  };
+}

package/lib/quoxon/demo.autoplay.js

@@ -4,7 +4,7 @@
  */
 export const AUTOPLAY_LABEL = 'DEMO: demo data, nothing real runs.';
 export const AUTOPLAY_REQUEST = 'Show me what you can do (demo)';
-export const AUTOPLAY_PROOF = '/proof';
+export const AUTOPLAY_PROOF = '/proof 1'; // bare /proof lists envelope ids (d73f04ab4); 1 is the newest chain, which the journey shows
 export const AUTOPLAY = Object.freeze({ seed: 20261013, startMs: 900, typeMinMs: 38, typeMaxMs: 78, afterTypeMs: 450, approvalHoldMs: 2500, afterKeyMs: 400, afterTurnMs: 900, finalHoldMs: 600 });
 
 /** Small seeded PRNG (mulberry32): deterministic across runs and platforms. */

package/lib/quoxon/demo.js

@@ -19,13 +19,15 @@ function decisionStore(file) {
   const wait = (ms) => new Promise(r => setTimeout(r, ms || 0));
   return {
     // staleMs: an answered item is still listed for this long (a server that lags behind its own answers)
-    async open() { const d = load(); await wait(d.approvalsDelayMs); return d.items.filter(x => x.status === 'open' || (d.staleMs && x.answeredAt && Date.now() - x.answeredAt < d.staleMs)); },
+    // failAfterAnswers: the server is down once anything was answered (the walkthrough's closing re-check)
+    async open() { const d = load(); await wait(d.approvalsDelayMs); if (d.failAfterAnswers && d.log.length) { const e = new Error('connect ECONNREFUSED'); e.status = 503; throw e; } return d.items.filter(x => x.status === 'open' || (d.staleMs && x.answeredAt && Date.now() - x.answeredAt < d.staleMs)); },
     async answer(id, key, note) {
       const d0 = load(); await wait(d0.answerDelayMs);
       const d = load(); const it = d.items.find(x => x.id === id);
       if (!it || it.status !== 'open') { const e = new Error('already handled'); e.status = 404; throw e; }
       it.status = 'answered'; it.answeredAt = Date.now(); it.answer = { key, note: note || null };
       d.log.push({ id, key, note: note || null, at: Date.now() });
+      if (d.arriveOnAnswer && !d.arrived) { d.items.push(...d.arriveOnAnswer); d.arrived = true; } // arriveOnAnswer: new items land while the owner is answering
       writeFileSync(file, JSON.stringify(d));
       return { ok: true };
     }

package/lib/quoxon/dividerAocl.js

@@ -153,13 +153,14 @@ export function chainCells(d, now, { still = false } = {}) {
  * Cells without `rgb` take the rule's own colour; `label: true` takes the label's own colour.
  * `still` (a slow redraw): no blink and no katakana, but every lit dot and the end colours stay.
  */
-export function dividerFrame({ cols, label, d, now, mono = false, reduced = false, still = false, seed = 0 }) {
+export function dividerFrame({ cols, label, extra = null, d, now, mono = false, reduced = false, still = false, seed = 0 }) {
   if (mono || reduced || !d || cols < MIN_COLS || !label || !dividerLive(d, now)) return null;
   const lab = ` ${label} `;
   const lw = stringWidth(lab);
   const chain = chainCells(d, now, { still });
   const cw = chain.cells.length;
-  const left = cols - lw - 1 - cw;
+  const ew = extra ? stringWidth(` ${extra.text} `) : 0;
+  const left = cols - lw - 1 - cw - ew;
   if (left < 4) return null;
   // the newest lit layer names itself to the left of the chain, in its colour, while it is new
   const tag = chain.newest && now - chain.newestAt < TAG_MS ? ` ${chain.newest} ${LAYER_NAMES[chain.newest] || ''} ` : '';
@@ -184,7 +185,7 @@ export function dividerFrame({ cols, label, d, now, mono = false, reduced = fals
       }
     } else labelCells = [{ t: lab, label: true }];
   }
-  return { cells: [...leftCells, ...chain.cells, ...labelCells, { t: '─' }] };
+  return { cells: [...leftCells, ...chain.cells, ...labelCells, ...(extra ? [{ t: ` ${extra.text} `, hex: extra.hex, bold: true }] : []), { t: '─' }] };
 }
 
 /** Plain text of a frame (tests and pty proofs). */