quoxcli 0.5.0 → 0.6.1

package/lib/quoxon/app.js

@@ -19,7 +19,7 @@ import { batchFor, batchModel, batchLabel, collapseArrivals } from './approvalBa
 import { walkCard, walkReply, walkNotYesNo, walkNoCatch, walkSummary, parseDecision, matchesAgent, filterPredicate, approvalRow, approvalDetail, isDecision, approvalAsWalkItem, parseAnswer, parsePairs, needsPin } from './approvalsView.js';
 import { createAutoOpen, noteArrivals, openDecision, takeQueue, strayAnswer, parseApprovalsArg, autoOn, APPROVALS_OPTIONS } from './autoOpen.js';
 import { dividerLive, GREEN_MS, RED_MS } from './dividerAocl.js';
-import { reduce, initialState, approvalKeyAllowed, groupApprovals, orderApprovals, otherSessionsCount, isPrivileged, approvalSourceLabel, approvalWhat, describeInboxItem, textGate } from './events.js';
+import { reduce, initialState, approvalKeyAllowed, groupApprovals, orderApprovals, otherSessionsCount, isPrivileged, approvalSourceLabel, approvalWhat, describeInboxItem, textGate, consentOf } from './events.js';
 import { turnTokens } from './indicator.js';
 import {
   Composer, RingComposer, Pending, ApprovalCard, BatchCard, LoopCardView, AskCard, StatusLine, RowsBar, NotifyBar, Working, HistoryItem, liveRows, Intro, Roster, WaitingNotice, historyGap, INTRO_FRAMES, introAnimates, describeActivity, clampCols, clip, COLORS, revealTimingFor
@@ -58,6 +58,7 @@ import { runWithSpinner, spinnerVerb } from './slashSpinner.js';
 import { parseMail, mailTable, mailDetail, noMailboxLines, mailNewestFirst, MAIL_USAGE } from './mailView.js';
 import { inboxBarText, arrivals, loadSeen, withSeen, arrivalLine, inboxTable, announceFresh, activeMutes, mutesLines, inboxDetail, parseInbox, INBOX_USAGE, newestFirst, unreadItems, readItems, isApprovalItem, isMuted } from './inboxView.js';
 import { devObserverOn, DEV_OBSERVER_REFUSAL } from './devObserver.js';
+import { isWebPty, SHELL_REFUSED } from './webPty.js';
 import { mindLines, mindErrorLines, mindHelpLines, MIND_HELP_ARGS } from './mind.js';
 import { packageVersion } from './welcome.js';
 import { feedbackPayload, feedbackPreview } from './feedback.js';
@@ -80,6 +81,7 @@ import { createConfirm } from './slash/confirm.js';
 import { isConsentError, consentHintLines, consentStatusLines } from './consent.js';
 import { CHOICES, modelLines, selectModel, selectOllamaModel, selectCompatModel, adoptAfterConnect, selectDiscoveredModel, selectSubscriptionModel, limitedOffer, modelLabel, fallbackNote, streamFields, normChoice } from './model.js';
 import { humanSessionLines } from '../core/sessionsOverview.js';
+import { resolutionFromItem } from '../core/inboxResolution.js';
 import { activeLines, activeRows, ACTIVE_KINDS } from '../core/activeSummary.js';
 import { capabilityLines, offerFor, findCapability } from './capabilities.js';
 import { anyProviderConnected, NO_AI_CARD, NO_AI_STATUS, asksAddHost, asksWatchHosts, addHostLines } from './noai.js';
@@ -94,7 +96,7 @@ import { createSound } from './sound/index.js';
 import { createPalette } from './slash/paletteController.js';
 import { capabilityMap } from './slash/palette.js';
 import { createArgSources } from './slash/argSources.js';
-import { runBroadcast, runAck, parsePokeArgs } from './slash/broadcastRun.js';
+import { runBroadcast, runAck, parsePokeArgs, slotNames } from './slash/broadcastRun.js';
 import { parseBroadcastText } from './slash/broadcast.js';
 import { isOwnBroadcast } from './ownBroadcast.js';
 import { orgLabel, isOrgId } from './orgLabel.js';
@@ -113,6 +115,7 @@ import { createLoopCards, rowsWithoutLoopCards } from './loopCards.js';
 import { initLoop, applySnapshot as applyLoopSnapshot, cardLines } from './loopCard.js';
 import { createCompanionController, companionCommand, DragonCompanionLive, takeGreeting, detachGreeting } from './dragonCompanion.js';
 import { dragonForAgent } from '../dragon/select.js';
+import { delegationDragonOn, markDelegationDragon } from './delegationDragon.js';
 import { createDragonJobs } from '../dragon/jobs.js';
 import { createModelCmd } from './slash/modelCmd.js';
 import { createChallengeCmd } from './slash/challenge.js';
@@ -133,7 +136,7 @@ import { compactResult, compactError, contextFacts, compactShowLines } from './s
 import { intentPanel } from './intent.js';
 import { awayDue, parseSince } from './away.js';
 import { parseSlashArgs as parseCallMeSlashArgs, statusLines as callMeStatusLines } from '../core/callMe.js';
-import { parseDndArgs, untilEpoch, sleepIntent, afkMeansSleep, newCollected, morningLines, waitingCount, DND_NOTE } from './dnd.js';
+import { parseDndArgs, untilEpoch, sleepIntent, afkMeansSleep, newCollected, morningLines, sinceLines, isIncident, waitingCount, DND_NOTE } from './dnd.js';
 import { sitrepData } from './objects/sitrep.js';
 import { mirrorErrorNote } from './objects/mirror.js';
 import { launchEgg } from './egg.js';
@@ -146,7 +149,7 @@ import { matchOrg, orgLines, orgRows, orgCandidates } from './orgSwitch.js';
 import { INSTALL_TOOLS, SUGGEST_LINE, planLine, offerQuestion, runInstall, missingTools } from './installCli.js';
 import { matchHat, hatLines, hatChoices, isPrivileged as hatIsPrivileged, mintConversationId } from './hatSwitch.js';
 import { slotOutbox, isConnectivityFailure, queuedLine, sentLine, fullLine } from './slotOutbox.js';
-import { isServerDown, waitForServer, SERVER_RESTARTING, explainTermination, RETRY_HINT, isResumeRetryable, RESUME_RETRY_DELAYS, RESUME_RECONNECTING } from './resend.js';
+import { isServerDown, waitForServer, SERVER_RESTARTING, explainTermination, RETRY_HINT, isResumeRetryable, RESUME_RETRY_DELAYS, RESUME_RECONNECTING, isTurnIdTaken, HELD_NOT_SHOWN } from './resend.js';
 import { gripeFiledLine, gripeFailedLine, gripeQueuedFiledLine } from '../core/quoxglyph.js';
 import { crossOrgTuiLines } from '../core/crossOrgApprovals.js';
 const gripeLead = '📣 GRIPE │';
@@ -167,7 +170,8 @@ const CARD_GONE_MS = 400;
 const STEER_OFF_NOTE = "This model can't take steering mid-turn; queued for next turn.";
 const newTurnId = () => `QXN_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
 
-function openEditor(text) {
+export function openEditor(text) {
+  if (isWebPty(process.env)) return null; // QUOXON web PTY: no $EDITOR on the server
   const dir = mkdtempSync(join(tmpdir(), 'quoxon-'));
   const file = join(dir, 'prompt.md');
   writeFileSync(file, text, 'utf8');
@@ -191,9 +195,10 @@ const GRIPE_LINE = /^\/gripe!?(\s|$)/i;
 const isOneLineCommand = (t) => t.startsWith('/') && (!t.includes('\n') || GRIPE_LINE.test(t));
 
 export const INBOX_BAR_MAX_MS = 300000; // the bar never waits longer than this between reads
+export const INBOX_BAR_READ = 10;      // the bar counts the latest 10 items, in the poll AND in /inbox (one basis: no '7 new' then '25 new')
 export const INBOX_BAR_COST_X = 20;     // wait 20x the last read's duration (a 3s read -> 60s; a fast read keeps the poll cadence)
 
-export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTimeoutMs = 120000, rosterMs = 15000, api: apiProp, profile: profileProp = 'default', org = null, version = '0.1.0', cwd = '', columns, demoLabel = null, verbose = 'on', mode = 'ask', editor = openEditor, introNote = null, animateIntro, earlyInput = null, startup = null, blocked: blockedProp = null, signedOut: signedOutProp = null, autoplay = null, rules = null, welcome = false, sessionName = null, invite = false, slotsAvailable = true, namesPath, transcript = null, modelChoice = null, resumeConversation = null, resume = null, restartSlot = null, restartAttach = null, restartDeclined = null, slotRetryDelays = [2000, 5000, 10000, 20000, 30000], resumeRetryDelays = RESUME_RETRY_DELAYS, onRestart = null, onDemo = null, healthRecheck = null, healthRecheckDelays = [5000, 10000, 20000, 40000, 60000], startupGraceMs = 60000, startupRetryMs = 3000, neverAnswered = false, onConnect = null, restartCheck = null, updater = null, startSha = null, buildWatch = startBuildWatch, autoRestartMs = null, restartCooloffMs = null, presenceRetryDelays = [2000, 5000, 10000, 20000, 30000, 60000], presencePollMs = 30000, autoIdleMs = null, autoTickMs = 1000, autoResumeMs = 3000, serverProbe = null, serverPollMs = SERVER_WAIT_EVERY_MS, serverWaitMs = SERVER_WAIT_MAX_MS, env = process.env, motion, motionStats = null, away = null, tipStartup = false, whatsNewStartup = false, interactive, resendDelays = null, demoAuto = null, agentLogin: agentLoginProp = false, startupSwitchOffer = false, humanProfiles = [], switchProfile = null, loginCandidates = [], slotRecordPath = undefined, outboxPath = undefined, spawnStatePath = undefined, noReplyMs = 90000, replyWatchMs = 30 * 60 * 1000, historyStore = null, runSpawn = spawnSync, runHandOverDelayMs = 60, mouseScreen = null, runNow = Date.now, whatsNewEntries = undefined }) {
+export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTimeoutMs = 120000, rosterMs = 15000, api: apiProp, profile: profileProp = 'default', org = null, version = '0.1.0', cwd = '', columns, demoLabel = null, verbose = 'on', mode = 'ask', editor = openEditor, introNote = null, animateIntro, earlyInput = null, startup = null, blocked: blockedProp = null, signedOut: signedOutProp = null, autoplay = null, rules = null, welcome = false, sessionName = null, invite = false, slotsAvailable = true, namesPath, transcript = null, modelChoice = null, resumeConversation = null, resume = null, restartSlot = null, restartAttach = null, restartDeclined = null, slotRetryDelays = [2000, 5000, 10000, 20000, 30000], resumeRetryDelays = RESUME_RETRY_DELAYS, onRestart = null, onDemo = null, healthRecheck = null, healthRecheckDelays = [5000, 10000, 20000, 40000, 60000], startupGraceMs = 60000, startupRetryMs = 3000, neverAnswered = false, onConnect = null, restartCheck = null, updater = null, startSha = null, buildWatch = startBuildWatch, autoRestartMs = null, restartCooloffMs = null, presenceRetryDelays = [2000, 5000, 10000, 20000, 30000, 60000], presencePollMs = 30000, autoIdleMs = null, autoTickMs = 1000, autoResumeMs = 3000, serverProbe = null, serverPollMs = SERVER_WAIT_EVERY_MS, serverWaitMs = SERVER_WAIT_MAX_MS, env = process.env, motion, motionStats = null, away = null, tipStartup = false, whatsNewStartup = false, interactive, resendDelays = null, demoAuto = null, agentLogin: agentLoginProp = false, startupSwitchOffer = false, humanProfiles = [], switchProfile = null, loginCandidates = [], slotRecordPath = undefined, outboxPath = undefined, spawnStatePath = undefined, noReplyMs = 90000, replyWatchMs = 30 * 60 * 1000, historyStore = null, runSpawn = spawnSync, runHandOverDelayMs = 60, mouseScreen = null, runNow = Date.now, whatsNewEntries = undefined, walkTtlMs = 1800000 }) {
   // Z2H: signed-out is ONE state (card at the top + /login), not scattered errors. While it holds, `blocked` is the
   // one-line answer, so chat, /connect and the digest/approvals pollers stay quiet instead of printing raw 401s.
   // PROFILE-SWITCH (owner 2026-10-16): the window's api is swappable in place (profileSwitch.js liveApi); `who` is the
@@ -686,9 +691,9 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     return () => clearInterval(id);
   }, []);
   // ---- QUOXON-MESH: slot chat (slotChat.js) ----------------------------------------------------------------
-  // Dragon companion (Lucid, Hyperion, Seer, Sentinel, Drago, Cipher, Vulcan, Quoxperticus): attach state + real stream events; art and reducer live in dragonlab.
+  // Dragon companion (Lucid, Hyperion, Seer, Sentinel, Drago, Cipher, Vulcan, Quoxperticus, Janus, Archivist, Architect, Roady, Weaver): attach state + real stream events; art and reducer live in dragonlab.
   const DC = React.useRef(null); DC.current ??= createCompanionController({ settings: () => api.settings?.() || {}, isTTY: Boolean(stdout?.isTTY), typing: () => B.current.text !== '', jobs: createDragonJobs({ reads: api.dragonReads || {}, context: () => ({ envelopeId: receiptMentions([...S.current.history, ...S.current.blocks])[0]?.value || null }) }) }); // each dragon's one job: a real read (dragon/jobs.js)
-  const dispatchEv = (a) => { DC.current.tap(a); dispatch(a); };
+  const dispatchEv = (a) => { DC.current.tap(a); dispatch(markDelegationDragon(a, a?.ev?.tool === 'delegate_to_agent' && delegationDragonOn(api.settings?.() || {}, env))); }; // dragons on: CommanderQ's hand-off gets a static dragon
   // QLOOP-LIVE: live loop cards in the chat stream (loopCards.js). A card is held live (commitLimit) until its loop finishes.
   const LC = React.useRef(null); LC.current ??= createLoopCards({ api, say: (t, tone) => say(t, tone), addItem: (it) => dispatch({ type: 'loopcard', card: it.card }), bump: () => { if (!R.current.closed) bump(n => n + 1); }, dragon: { summon: (d, cap) => DC.current.summon(d, cap) } });
   const SC = React.useRef(null); SC.current ??= { listener: null, slot: null, pendingFile: null, reattach: null, rooms: new Map(), active: null };
@@ -1190,7 +1195,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     R.current.inboxBusy = true; R.current.inboxAt = t;
     const epoch = R.current.inboxEpoch || 0;
     try {
-      const items = await api.inboxItems({ limit: 10 });
+      const items = await api.inboxItems({ limit: INBOX_BAR_READ });
       R.current.inboxCost = Date.now() - t;
       if (epoch !== (R.current.inboxEpoch || 0)) return; // an org switch landed while this read was in flight: it belongs to the old org
       if (!R.current.inboxSeen && items.length) { try { R.current.inboxSeen = loadSeen(api.settings?.(), R.current.orgId ?? api.orgId?.() ?? null); } catch { /* no saved watermark: baseline from this read */ } }
@@ -1225,6 +1230,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     if (BL.current) return;
     const N = R.current.notify || (R.current.notify = { fails: 0, authLost: false });
     try {
+      const readAt = Date.now();
       const items = await api.approvals();
       if (N.authLost) say('Signed in again: approvals are back.', 'ok');
       else if (N.slow) say('Quox server is back.', 'ok');
@@ -1240,6 +1246,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       retryOrgName();
       dispatch({ type: 'inbox.sync', ids: items.map(i => i.id) });
       R.current.openIds = { ids: new Set(items.map(i => i.id)), at: Date.now() }; // a walk skips a card answered elsewhere since it started
+      walkWatch(R.current.openIds.ids, readAt); // TUI-CARD-SYNC: the card on screen, answered in another window, closes here too (never awaited)
       // Provider paths that emit no approval.requested still surface here, as the same card.
       for (const raw of items) {
         const item = await enrichPlanItem(raw, { objectiveGet: api.objectiveGet, agents: api.agents, orgs: api.orgs, cache: (R.current.planCache ||= new Map()) });
@@ -1456,7 +1463,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
   // After approving from the terminal the tool runs asynchronously: poll its stored result.
   const pollResult = async (run) => {
     if (!run.approvalId || !api.approvalResult) return dispatch({ type: 'approval.result', callId: run.callId, outcome: 'timeout' });
-    const t0 = Date.now();
+    const t0 = Date.now(); let undecided = 0;
     while (Date.now() - t0 < resultTimeoutMs) {
       await new Promise(r => { const t = setTimeout(() => { R.current.pollTimers.delete(t); r(); }, resultPollMs); R.current.pollTimers.add(t); R.current.pollWake = r; });
       if (R.current.closed) return undefined;
@@ -1464,6 +1471,11 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       try {
         const r = await api.approvalResult(run.approvalId);
         if (r?.status === 'denied') return dispatch({ type: 'approval.result', callId: run.callId, outcome: 'denied' });
+        // Live 2026-11-08 (contacts_dial_batch): the inbox took the yes but the runner never got it, so the approval stayed
+        // pending with nobody as the decider. The runner moves a row off pending the moment it receives a decision, so two
+        // reads like that after our yes are proof nothing ran: say so, never "result not known yet".
+        if (r && r.status === 'pending' && !r.decided_by) { if (++undecided >= 2) return dispatch({ type: 'approval.result', callId: run.callId, outcome: 'unrecorded' }); }
+        else undecided = 0;
         if (r && (r.status === 'approved' || r.status === 'error') && r.executed_at) {
           const text = r.result == null ? null : clip(typeof r.result === 'string' ? r.result : JSON.stringify(r.result), cols - 20);
           // Command reached the host and exited >= 1 (not a connect/auth failure): say "ran, exit N", not "failed".
@@ -1543,30 +1555,114 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
   // server took it; a line typed while an answer is still on its way is never applied to the card just answered; Esc or any
   // command ends the walk with a summary; an id answered in this window never comes back, and a list held from earlier
   // (a bulk card, a range) is re-read from the server before its first card.
-  const WALK_TTL = 1800000;
+  const WALK_TTL = walkTtlMs; // 30 minutes; a prop only so a test can lapse a card
   const walkAnsweredIds = () => (R.current.walkAnswered ||= new Set());
-  const walkCloseCard = (W, why = 'next') => { if (W?.card) { W.card.at = Date.now(); W.card.walkWhy = why; W.card = null; } }; // why: next/done settle silently; stop = interrupted
+  // POPUP-DEDUPE (owner 2026-11-06, hit twice): what this window answered on the inline prompt, by inbox id and by approval id,
+  // so the auto-popup never re-opens it a second later while the server still lists it, and a walk card says so plainly.
+  const inlineAnswered = () => (R.current.inlineAnswered ||= { ids: new Map(), approvals: new Map() });
+  const itemApprovalId = (it) => it?.payload?.approval_id || it?.approval_id || it?.approvalId || it?.aee_correlation_id || null;
+  const answeredInline = (it) => { const m = inlineAnswered(); return m.ids.get(it?.id) || m.approvals.get(itemApprovalId(it)) || null; };
+  const walkCloseCard = (W, why = 'next', settle = null) => { if (W?.card) { W.card.at = Date.now(); W.card.walkWhy = why; if (settle) { W.card.settleText = settle.text; W.card.settleTone = settle.tone; } W.card = null; } }; // why: next/done settle silently; stop = interrupted, gone = closed by the server (settle = the line it leaves)
   const walkKeysText = (it) => { const ks = it.payload.options.map(o => o.key); return ks.length > 1 ? `${ks.slice(0, -1).join(', ')} or ${ks[ks.length - 1]}` : ks.join(''); };
   // EXPIRED-ASK (owner 2026-10-17 21:23): a question whose time ran out is gone: say so plainly and move on, never "the question stays".
   const askExpiry = (it) => { const t = Date.parse(it?.due_at ?? it?.payload?.expires_at); return Number.isFinite(t) ? t : null; };
   const expiredText = (it) => { const t = askExpiry(it); return t ? `That question expired at ${askClock(t)}, so there's nothing to answer.` : "That question is no longer open, so there's nothing to answer."; };
   const walkGoneElsewhere = (W, id) => { const o = R.current.openIds; return Boolean(o && o.at > W.startedAt && !o.ids.has(id)); };
-  const walkSummaryLines = (W, head) => {
+  // TUI-CARD-SYNC (owner 2026-11-08, two windows on one user: a card answered "a" in one window stayed open in the other and
+  // later said "expired, not answered"): what the SERVER says became of a walk item that is no longer in the open list.
+  // { kind: 'elsewhere', choice, at } | { kind: 'expired', at } | { kind: 'closed', at }. Read only for an item already gone.
+  const walkFateOfGone = async (it) => {
+    let item = null;
+    if (api.inboxItem) { try { item = await api.inboxItem(it.id); } catch { item = null; } }
+    const res = item && item.id ? resolutionFromItem(item) : null;
+    const at = res?.resolved_at ? Date.parse(res.resolved_at) : NaN;
+    if (!res) return { kind: 'closed', at };
+    if (res.outcome === 'expired') return { kind: 'expired', at };
+    const r = item.response || null;
+    if (!r || r.housekeeping || ['withdrawn', 'cancelled'].includes(res.outcome)) return { kind: 'closed', at };
+    const opt = typeof r.option === 'string' ? r.option : null;
+    const label = opt ? it.payload?.options?.find(o => o.key === opt)?.label : null;
+    const choice = opt ? (label && label !== opt ? `${opt}: ${decodeEntities(label)}` : opt) : res.outcome === 'approved' ? 'approved' : res.outcome === 'rejected' ? 'denied' : res.outcome;
+    return { kind: 'elsewhere', choice, at };
+  };
+  const walkTitleQ = (it) => `"${clip(decodeEntities(it?.title || it?.id || 'the question'), Math.max(20, cols - 50))}"`;
+  const walkGoneSettle = (it, fate) => ({ text: settledAskLine(walkTitleQ(it), fate, Number.isFinite(fate.at) ? fate.at : Date.now()), tone: settledAskTone(fate.kind) });
+  // The poll's open list no longer has the card on screen: close it with what the server says, then on to the next card.
+  const walkWatch = async (ids, readAt) => {
+    const W = R.current.pendingWalk; const card = W?.card; const id = W?.current; const it = id ? W.items[id] : null;
+    if (!card || !it || it.__orgId || W.done.has(id) || ids.has(id) || R.current.walkSend || R.current.walkWatching || readAt < (card.shownAt ?? card.at)) return;
+    R.current.walkWatching = true;
+    try {
+      const fate = await walkFateOfGone(it);
+      if (R.current.pendingWalk !== W || W.card !== card || W.current !== id || R.current.walkSend) return; // answered or stopped here meanwhile
+      W.done.add(id); (W.dropped ||= new Set()).add(id);
+      walkCloseCard(W, 'gone', walkGoneSettle(it, fate));
+      walkShow();
+    } finally { R.current.walkWatching = false; }
+  };
+  // A card left open past WALK_TTL: ask the server before saying anything (it may have been answered in another window).
+  const walkLapsed = async (card) => {
+    const W = R.current.pendingWalk; const it = W?.items?.[card.walk];
+    if (!it) { card.settleText = ''; return; }
+    if (it.__orgId) { card.settleText = `↷ ${walkTitleQ(it)}: this card timed out unanswered · /approvals`; card.settleTone = 'plain'; return; }
+    const now = await openIdsNow();
+    if (!now.ids) { card.settleText = `↷ ${walkTitleQ(it)}: this card timed out unanswered; couldn't check it with the server (${now.error}) · /approvals`; card.settleTone = 'plain'; return; }
+    if (now.ids.has(it.id)) { card.settleText = `↷ ${walkTitleQ(it)}: this card timed out unanswered; the question is still open · /walkthrough`; card.settleTone = 'plain'; return; }
+    const fate = await walkFateOfGone(it);
+    if (R.current.pendingWalk === W) { W.done.add(it.id); (W.dropped ||= new Set()).add(it.id); }
+    const st = walkGoneSettle(it, fate); card.settleText = st.text; card.settleTone = st.tone;
+  };
+  // fresh = the ids the server still has open (null: not re-checked), so an item answered elsewhere is never "still waiting"
+  const walkSummaryLines = (W, head, fresh = null) => {
     const sending = R.current.walkSend && W.current && !W.done.has(W.current) ? W.current : null;
-    const left = W.ids.filter(id => !W.done.has(id) && id !== sending).map(id => W.items[id].title || id);
-    const lines = walkSummary({ answered: W.answered, skipped: W.skipped.map(id => W.items[id].title || id), left });
+    const stillOpen = (id) => !fresh || fresh.has(id);
+    const left = W.ids.filter(id => !W.done.has(id) && id !== sending && stillOpen(id)).map(id => W.items[id].title || id);
+    const skipped = W.skipped.filter(stillOpen);
+    const lines = walkSummary({ answered: W.answered, skipped: skipped.map(id => W.items[id].title || id), left });
     if (head) lines[0] = lines[0].replace(/^Walkthrough done/, head);
     if (sending) lines.push(`  … still sending: ${W.items[sending].title || sending}`);
-    return { lines, open: left.length + W.skipped.length };
+    return { lines, open: left.length + skipped.length };
+  };
+  // WALK-REVALIDATE (owner 2026-11-08 03:56: a window open since the day before listed 8 "still waiting", most answered
+  // hours earlier in another window): the list a walk holds is re-checked with the server before it is shown; a failed
+  // or slow re-check shows the held list, labelled as possibly out of date.
+  const WALK_RECHECK_MS = 4000;
+  const openIdsNow = async () => {
+    let timer;
+    try {
+      const items = await Promise.race([api.approvals(), new Promise((_, rej) => { timer = setTimeout(() => rej(new Error('timed out')), WALK_RECHECK_MS); })]);
+      return { ids: new Set((Array.isArray(items) ? items : []).map(x => x?.id).filter(Boolean)), error: null };
+    } catch (e) { return { ids: null, error: clip(String(e?.message || e || 'unknown error').replace(/\s+/g, ' '), 80) }; }
+    finally { clearTimeout(timer); }
   };
   const walkEnd = (why) => { // Esc, a command, or a card left too long: the walk stops here and says where it stands
     const W = R.current.pendingWalk; if (!W) return false;
+    const card = W.card; const cur = W.current && !W.done.has(W.current) ? W.items[W.current] : null; // the card on screen: its line comes from the server
     R.current.pendingWalk = null; R.current.focusedDecision = null; K.current.walkEndAt = Date.now(); walkCloseCard(W, 'stop');
-    const { lines, open } = walkSummaryLines(W, `Walkthrough stopped (${why})`);
-    say(' ');
-    lines.forEach((l, k) => say(l, k === 0 ? 'ok' : undefined));
-    if (open) say('Nothing else was sent. /walkthrough picks up what is still waiting.', 'dim');
-    queueMicrotask(() => reconcileAsks());
+    const sending = R.current.walkSend && W.current && !W.done.has(W.current) ? W.current : null; // read now: the send settles on its own
+    const held = W.ids.some(id => !W.done.has(id) && id !== sending) || W.skipped.length;
+    // TUI-CARD-SYNC (owner 2026-11-08: /say during a card printed "The question closed before you answered." while it was
+    // still open): the stopped card says closed only when the server's open list no longer has it.
+    const settleCard = async ({ ids, error }) => {
+      if (!card) return;
+      if (!cur || sending || cur.__orgId) { card.settleText = cur && cur.__orgId && !sending ? `Not answered; it is still open in ${cur.__orgName || 'its org'}.` : ''; card.settleTone = 'plain'; return; }
+      if (!ids) { card.settleText = `Not answered; couldn't check whether the question is still open${error ? ` (${error})` : ''}.`; card.settleTone = 'plain'; return; }
+      if (ids.has(cur.id)) { card.settleText = 'Not answered; the question is still open.'; card.settleTone = 'plain'; return; }
+      const fate = await walkFateOfGone(cur);
+      if (fate.kind === 'elsewhere') { const st = walkGoneSettle(cur, fate); card.settleText = st.text; card.settleTone = st.tone; return; }
+      card.settleText = 'The question closed before you answered.'; card.settleTone = 'plain';
+    };
+    const show = ({ ids, error }) => {
+      settleCard({ ids, error }).catch(() => { if (card) card.settleText = ''; });
+      const { lines, open } = walkSummaryLines(W, `Walkthrough stopped (${why})`, ids);
+      say(' ');
+      lines.forEach((l, k) => say(l, k === 0 ? 'ok' : undefined));
+      if (error && held) say(`⚠ couldn't re-check with the server (${error}); this list may be out of date. /approvals to look again`, 'warn');
+      if (open) say('Nothing else was sent. /walkthrough picks up what is still waiting.', 'dim');
+      queueMicrotask(() => reconcileAsks());
+    };
+    if (!held) { show({ ids: null, error: null }); return true; }
+    R.current.walkEnding = openIdsNow().then(show, () => show({ ids: null, error: 'unknown error' })).finally(() => { R.current.walkEnding = null; });
     return true;
   };
   // TUI-WALK (owner 2026-10-19: he always runs /approvals again to confirm it is empty): the walk ends with a FRESH server
@@ -1577,6 +1673,10 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     catch (e) { say(`⚠ couldn't re-check approvals (${clip(String(e?.message || e || 'unknown error').replace(/\s+/g, ' '), 80)}); /approvals to look again`, 'warn'); return; }
     const gone = walkAnsweredIds();
     const open = (Array.isArray(items) ? items : []).filter(x => x && !gone.has(x.id));
+    // TUI-CARD-SYNC (owner 2026-11-08: "Nothing else is currently waiting" above a status line still saying "⏸ 1 approval
+    // waiting"): the counter is set from this same read, so the line and the bar never disagree.
+    R.current.openItems = open; syncApprovalRows(); R.current.openIds = { ids: new Set(open.map(i => i.id)), at: Date.now() };
+    dispatch({ type: 'notify', patch: { approvals: open.length, error: null, slow: false } });
     // the closing line repeats the other-org count + switch hint the walk opened with (the helper's own cache: no new token mints)
     const sayOthers = async () => { try { const v = api.otherOrgApprovals ? await api.otherOrgApprovals() : null; for (const l of crossOrgTuiLines(v)) say(l, 'warn'); } catch { /* the hint is optional */ } };
     if (!open.length) { say('✔ Nothing else is currently waiting for you.', 'ok'); await sayOthers(); return; }
@@ -1599,13 +1699,13 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       if (W.done.has(id)) continue;
       if (gone.has(id)) { W.done.add(id); continue; } // answered in this window already: never shown again
       { const ex = askExpiry(W.items[id]); if (ex && ex <= Date.now()) { W.done.add(id); (W.dropped ||= new Set()).add(id); refreshNotify(); say(`"${clip(W.items[id].title || id, 60)}": ${expiredText(W.items[id])}`, 'accent'); continue; } }
-      if (walkGoneElsewhere(W, id)) { W.done.add(id); say(`"${clip(W.items[id].title || id, 70)}" is no longer waiting (answered elsewhere or expired). Moving on.`, 'dim'); continue; }
+      if (walkGoneElsewhere(W, id)) { W.done.add(id); const was = answeredInline(W.items[id]); if (was) { say(`Already ${was === 'approve' ? 'approved' : 'denied'} (you answered it inline). Moving on.`, 'ok'); continue; } say(`"${clip(W.items[id].title || id, 70)}" is no longer waiting (answered elsewhere or expired). Moving on.`, 'dim'); continue; }
       nextId = id; break;
     }
     if (!nextId) { R.current.pendingWalk = null; R.current.focusedDecision = null; K.current.walkEndAt = Date.now(); say(' '); for (const l of walkSummaryLines(W).lines) say(l, l.startsWith('Walkthrough') ? 'ok' : undefined); walkRecheck(W); queueMicrotask(() => reconcileAsks()); return; }
     const live = W.ids.filter(id => !(W.dropped && W.dropped.has(id))); // expired or gone questions are not counted
     const it = W.items[nextId]; const c = walkCard(it, live.indexOf(nextId) + 1, live.length, { cols: cols - 2 });
-    W.current = nextId; W.at = Date.now(); W.card = { at: W.at, walk: nextId };
+    W.current = nextId; W.at = Date.now(); W.card = { at: W.at, walk: nextId, shownAt: W.at };
     say(' ');
     if (it.__orgName) say(`in ${it.__orgName} · answered there directly; this window stays in ${orgShown() || 'its own org'}`, 'warn'); // APPROVALS-AUTO: another org's card says whose it is
     c.lines.forEach((l, k) => say(l, k === 0 ? 'warn' : k === c.recoLine ? 'reco' : undefined));
@@ -1625,9 +1725,12 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     say(`That is not the name, so nothing was deleted. Type ${d.name} exactly, or Esc to cancel.`, 'warn');
   };
   const walkStart = async (list, { fresh = false, quiet = false } = {}) => {
+    if (R.current.walkEnding) await R.current.walkEnding; // the stopped walk's summary prints before the next walk's first card
     let decs = (list || []).filter(isDecision);
     if (!fresh && decs.length) { // a list held from before: only what the server still has waiting
-      try { const open = new Set((await api.approvals()).map(x => x.id)); decs = decs.filter(x => open.has(x.id)); } catch { /* slow server: the answered-in-this-window set below still applies */ }
+      const now = await openIdsNow();
+      if (now.ids) decs = decs.filter(x => now.ids.has(x.id));
+      else say(`⚠ couldn't re-check these with the server (${now.error}); they may be out of date.`, 'warn'); // the answered-in-this-window set below still applies
     }
     const gone = walkAnsweredIds();
     decs = decs.filter(x => !gone.has(x.id));
@@ -1647,10 +1750,10 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
   // APPROVALS-AUTO (owner 2026-11-06: "just make approvals pop up, i am tired of opening them"): a NEW approval or decision
   // opens by itself as the walkthrough card. It only OPENS; it never answers. A draft, typing in the last 2s, a streaming
   // turn or another card on screen holds it until the next idle point; an open walk simply gains the card.
-  const autoSkip = () => new Set([...S.current.approvals.map(x => x.inboxItemId), ...walkAnsweredIds(), ...(R.current.pendingWalk ? R.current.pendingWalk.ids : [])].filter(Boolean));
+  const autoSkip = (items = []) => new Set([...S.current.approvals.map(x => x.inboxItemId), ...walkAnsweredIds(), ...(R.current.pendingWalk ? R.current.pendingWalk.ids : []), ...items.filter(x => x && !x.__orgId && answeredInline(x)).map(x => x.id)].filter(Boolean));
   const autoBusy = () => Boolean(askOpen() || headCard(S.current) || SU.current.isOpen() || LI.current?.isOpen?.() || CN.current?.isOpen?.() || PK.current?.isOpen?.() || R.current.rs || R.current.noteAsk || R.current.delConfirm || R.current.denyReason || K.current.cardFocus || BL.current || AWAY.current.afk);
   const autoOpenItems = (items, how) => {
-    const skip = autoSkip(); const list = items.filter(x => !skip.has(x.id));
+    const skip = autoSkip(items); const list = items.filter(x => !skip.has(x.id)); // re-checked right before opening: answered here since it queued
     if (!list.length) return;
     if (how === 'open') { const n = list.length; say(' '); say(`⏸ ${n === 1 ? 'A new approval just arrived; it is open below' : `${n} new approvals just arrived; they are open below, one at a time`}. Esc stops · /approvals auto off stops them opening by themselves.`, 'warn'); }
     const had = R.current.pendingWalk;
@@ -1663,10 +1766,14 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     const d = openDecision(A.st, { draft: B.current.text, lastKeyAt: K.current.lastKeyAt || 0, now: Date.now(), streaming: Boolean(S.current.turn), walkOpen: Boolean(R.current.pendingWalk), askOpen: autoBusy() });
     if (!d) return;
     if (d === 'open' || d === 'join') { A.waitSaid = false; autoOpenItems(takeQueue(A.st), d); return; }
-    if (d === 'wait-draft' && !A.waitSaid) { A.waitSaid = true; say(`⏸ ${A.st.queue.length === 1 ? 'A new approval is' : `${A.st.queue.length} new approvals are`} waiting; it opens once your draft is empty.`, 'dim'); }
+    if (d === 'wait-draft' && !A.waitSaid) { // TUI-CARD-SYNC: another org's card says whose it is, so it never reads against "Nothing waiting for you"
+      A.waitSaid = true; const q = A.st.queue; const orgs = [...new Set(q.map(x => x.__orgId ? x.__orgName || x.__orgId : ''))];
+      const where = orgs.length === 1 && orgs[0] ? ` in ${orgs[0]}` : orgs.some(Boolean) ? ` (${q.filter(x => x.__orgId).length} in other orgs)` : '';
+      say(`⏸ ${q.length === 1 ? 'A new approval is' : `${q.length} new approvals are`} waiting${where}; it opens once your draft is empty.`, 'dim');
+    }
     A.timer = setTimeout(autoTry, 400); A.timer.unref?.();
   };
-  const autoArrive = (items, opts = {}) => { const A = AO.current; const r = noteArrivals(A.st, items, { skipIds: autoSkip(), ...opts }); if (A.st.queue.length) autoTry(); return r; };
+  const autoArrive = (items, opts = {}) => { const A = AO.current; const r = noteArrivals(A.st, items, { skipIds: autoSkip(opts.orgId ? [] : items), ...opts }); if (A.st.queue.length) autoTry(); return r; };
   // Other orgs: read an org's open items only when its count changed (the counts helper caches 60s), with the user's own token.
   const autoOthers = async (v) => {
     const A = AO.current; const first = !A.othersDone; A.othersDone = true;
@@ -1771,7 +1878,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       try { const pl = groupApprovals(await api.approvals(), { conversationId: S.current.ctx.conversationId, cardIds: [...S.current.approvals, ...S.current.waiting].map(x => x.inboxItemId).filter(Boolean) }).flatMap(g => g.items.map(x => x.item)); dispatch({ type: 'inbox', items: pl }); R.current.shownIds = pl.map(x => x.id); n = pl.findIndex(x => x.id === it.id) + 1; }
       catch (e) { say(`Could not re-read approvals (${clip(String(e?.message || e), 80)}); nothing was sent. Say the choice again.`, 'warn'); W.at = Date.now(); if (W.card) W.card.at = W.at; return true; }
     }
-    if (!n) { say(`"${it.title}" is no longer waiting (answered or expired). Moving on.`, 'warn'); W.done.add(it.id); walkShow(); return true; }
+    if (!n) { const was = answeredInline(it); say(was ? `Already ${was === 'approve' ? 'approved' : 'denied'} (you answered it inline). Moving on.` : `"${it.title}" is no longer waiting (answered or expired). Moving on.`, was ? 'ok' : 'warn'); W.done.add(it.id); walkShow(); return true; }
     if (askExpiry(it) && askExpiry(it) <= Date.now()) { W.done.add(it.id); (W.dropped ||= new Set()).add(it.id); refreshNotify(); say(expiredText(it), 'accent'); walkShow(); return true; }
     if (rep.note && noteNeedsConfirm(rep.note) && !R.current.noteBypass) {
       const o = it.payload.options.find(x => x.key === rep.key);
@@ -1798,14 +1905,29 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       if (!card.inboxItemId && card.approvalId && !batch) { // an event card that never learned its inbox id: find it, never answer null
         try { card = { ...card, inboxItemId: (await api.approvals()).find(i => (i.payload?.approval_id || i.approval_id || i.aee_correlation_id) === card.approvalId)?.id || null }; } catch { /* falls through to the 404 path */ }
       }
-      await respondWithStepUp(card, action, { proactive, reason, bulk });
+      const res = await respondWithStepUp(card, action, { proactive, reason, bulk });
+      // A 2xx is not a recorded yes on its own: the server reports the card's real status (an expired approval comes
+      // back as status expired, nothing ran). Only "resolved" lets this window say approved.
+      const st = action === 'approve' && res && typeof res === 'object' ? res.item?.status : null;
+      if (st && st !== 'resolved') {
+        const text = st === 'expired'
+          ? `Not approved: ${res.message || 'this approval had expired, so nothing ran. Ask the agent again to get a fresh one.'}`
+          : `Your approval was NOT recorded: the server still shows it ${st}. Nothing ran. Answer it again from /approvals.`;
+        dispatch({ type: 'approval.sent', callId: card.callId, action, tool: card.tool, target: card.target, approvalId: card.approvalId, inboxItemId: card.inboxItemId || null, batch, notRecorded: text });
+        return { notRecorded: true };
+      }
+      if (card.inboxItemId) { walkAnsweredIds().add(card.inboxItemId); inlineAnswered().ids.set(card.inboxItemId, action); } // POPUP-DEDUPE
+      if (card.approvalId) inlineAnswered().approvals.set(card.approvalId, action);
       // The demo's stream carries on to its own tool result, so no "running, result later" note, no poll, no stale count.
-      dispatch({ type: 'approval.sent', callId: card.callId, action, tool: card.tool, target: card.target, what: card.what, who: card.facts?.who || card.origin || card.askedBy || null, where: card.facts?.where || null, approvalId: card.approvalId, inboxItemId: card.inboxItemId || null, quiet: Boolean(demoLabel), foreign: Boolean(card.foreign), batch });
+      const consent = action === 'approve' && card.consent && api.grantContactability ? card.consent : null;
+      if (consent) R.current.consentAsk = { ...consent, at: Date.now() }; // the next line typed is the lawful basis (or n)
+      dispatch({ type: 'approval.sent', callId: card.callId, action, tool: card.tool, target: card.target, what: card.what, who: card.facts?.who || card.origin || card.askedBy || null, where: card.facts?.where || null, approvalId: card.approvalId, inboxItemId: card.inboxItemId || null, quiet: Boolean(demoLabel), foreign: Boolean(card.foreign), batch, consent });
       if (demoLabel) { B.current = initialBuffer(); dispatch({ type: 'notify', patch: { approvals: 0, error: null } }); } // (a stray early keystroke is not left in the composer)
-      if (action === 'approve' && card.tool !== 'hat.switch' && !demoLabel && !batch) pollResult({ callId: card.callId, approvalId: card.approvalId });
+      if (action === 'approve' && card.tool !== 'hat.switch' && !consent && !demoLabel && !batch) pollResult({ callId: card.callId, approvalId: card.approvalId });
       return { ok: true };
     } catch (e) {
       if (e?.status === 404 || (e?.status === 400 && /not open for response/i.test(`${e?.code || ''} ${e?.body?.error || ''} ${e?.message || ''}`))) { // already resolved elsewhere (another window, /approve all, the dashboard)
+        if (card.inboxItemId) walkAnsweredIds().add(card.inboxItemId); // POPUP-DEDUPE: handled elsewhere is never popped up again
         if (!batch) dispatch({ type: 'approval.gone', callId: card.callId, inboxItemId: card.inboxItemId || null });
         return { gone: true };
       }
@@ -1938,6 +2060,28 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     const open = (signal) => api.stream({ turnId, message: withShared(queued ? QUEUED_FRAME + text : text, shared), agent: via || SN.current.agent || 'quox', conversationId: S.current.ctx.conversationId, ...(handoffFrom ? { handoffFrom } : {}), heldSlot: where.current.slot ? { name: where.current.slot, session: slotSession(), display: myDisplay() } : null, context: turnContext(), overrideId: takeOverride(), ...(MD.current === 'plan' ? { mode: 'plan' } : {}), ...streamFields(MC.current) }, signal);
     // QUOXON-FW3: the server was unreachable before it said anything (a redeploy). Keep the message, wait for it
     // to come back, and send once. Only a send that produced NO event is ever retried, so nothing runs twice.
+    // Owner 2026-11-07: a "down" send can still have REACHED the server (it registered the turn_id, then the socket
+    // dropped before any event). The resend keeps the same id; if the server says it already holds that id, attach to
+    // that turn and show its answer. If it cannot be shown, the text goes back to the composer (a re-send there mints
+    // a new id), never a bare "turn_id already ran" with the message lost.
+    const resend = async function* (signal) {
+      const it = open(signal)[Symbol.asyncIterator]();
+      let first;
+      try { first = await it.next(); } catch (e) { if (!isTurnIdTaken(e)) throw e; first = null; }
+      if (first && !(first.done === false && isTurnIdTaken(first.value))) {
+        if (first.done) return;
+        yield first.value;
+        for (let n = await it.next(); !n.done; n = await it.next()) yield n.value;
+        return;
+      }
+      if (first) await it.return?.();
+      const conversationId = S.current.ctx.conversationId;
+      const held = Object.assign(new Error('turn held by the server but not attachable'), { code: 'turn_held_unattachable' });
+      if (!conversationId || !api.reattach) throw held;
+      let seen = false;
+      try { for await (const ev of api.reattach({ conversationId, turnId, after: 0 }, signal)) { seen = true; yield ev; } }
+      catch (e) { if (!seen && (e?.status === 404 || e?.status === 410)) throw held; throw e; }
+    };
     let r = await consumeTurn(turnId, open, { keepOnDown: true });
     if (!r?.down) return r;
     say(SERVER_RESTARTING, 'warn');
@@ -1951,7 +2095,12 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
         edit({ type: 'set', text: B.current.text ? `${text}\n${B.current.text}` : text });
         return say(res === 'cancelled' ? 'Cancelled. Your message is back in the composer; it was not sent.' : 'The Quox server did not come back in time. Your message is back in the composer; it was not sent.', 'warn');
       }
-      r = await consumeTurn(turnId, open, { keepOnDown: true });
+      r = await consumeTurn(turnId, resend, { keepOnDown: true });
+      if (r?.held) {
+        dispatch({ type: 'turn.deferred' });
+        edit({ type: 'set', text: B.current.text ? `${text}\n${B.current.text}` : text });
+        return say(HELD_NOT_SHOWN, 'warn');
+      }
     }
     if (r?.down) { dispatch({ type: 'turn.deferred' }); edit({ type: 'set', text: B.current.text ? `${text}\n${B.current.text}` : text }); say('The server keeps dropping the connection. Your message is back in the composer; it was not sent.', 'warn'); }
     return r;
@@ -2026,7 +2175,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     dispatchEv({ type: 'turn.begin', turnId });
     const ctrl = new AbortController();
     R.current.abort = ctrl;
-    let offered = false, sawEvent = false, down = false;
+    let offered = false, sawEvent = false, down = false, held = false;
     let answerText = '', suggested = false, gate = null; // the safety net reads the answer when no suggestion came
     try {
       for await (const ev of open(ctrl.signal)) {
@@ -2065,7 +2214,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
         dispatchEv({ type: 'event', ev: { type: 'turn.finished', status: ctrl.signal.aborted ? 'interrupted' : 'unconfirmed' } });
       }
     } catch (e) {
-      if (keepOnDown && !sawEvent && !ctrl.signal.aborted && isServerDown(e)) { down = true; }
+      if (keepOnDown && !sawEvent && !ctrl.signal.aborted && (isServerDown(e) || e?.code === 'turn_held_unattachable')) { down = true; held = e?.code === 'turn_held_unattachable'; }
       else if (!ctrl.signal.aborted) {
         // FW4: settle in-flight tools explicitly (never leave a row "running"), then explain the cut with a way forward.
         if (e?.status === 423 && typeof e?.body?.block_id === 'string') { // QUOXON-STEPUP: a policy block; a person may override it once
@@ -2118,7 +2267,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       const ra = R.current.reask; R.current.reask = null; // y/N/c: the chat about an ask is over: the same ask again, fresh window
       if (ra && !newOffer && askOpen()) { touchAsks(); if (ra.redo) ra.redo(); else say(ra.text, 'ask'); }
     }
-    return down ? { down: true } : undefined;
+    return down ? { down: true, ...(held ? { held: true } : {}) } : undefined;
   }
 
   React.useEffect(() => {
@@ -2166,6 +2315,38 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     bump(n => n + 1);
     return true;
   }
+  // MORNINGREPORT-ALWAYS (owner 2026-11-09): with nothing held (DND off) /morningreport still digests what happened since
+  // you were last here (the same since-marker as /away): approvals, slot messages to you, sessions that need you,
+  // incidents, then the /away card (agent actions). Reuses /sitrep, the held slot's messages and /away; never a new path.
+  async function sinceDigest() {
+    const p = parseSince('', { lastSeen: AWAY.current.last }); const sMs = Date.parse(p.since);
+    const part = (fn) => (fn ? Promise.resolve().then(fn).then((v) => ({ ok: true, v }), (e) => ({ ok: false, error: e?.status ? `HTTP ${e.status}` : e?.message || 'failed' })) : Promise.resolve(null));
+    const slot = where.current.slot || null;
+    const [sit, apl, sl, aw] = await Promise.all([
+      part(api.sitrep && (() => api.sitrep())),
+      part(!api.sitrep && api.approvals && (() => api.approvals())),
+      part(slot && api.slotMessages && (() => api.slotMessages(slot, 50))),
+      part(api.away && (() => api.away(p.since)))
+    ]);
+    const blind = [];
+    const sd = sit?.ok ? sitrepData(sit.v?.situation, sit.v?.approvals) : null;
+    if (sit && !sit.ok) blind.push(`sitrep (${sit.error})`);
+    let approvals = sd?.approvals || null;
+    if (!approvals && apl?.ok) approvals = (apl.v || []).map((a) => ({ title: a.title || a.summary || a.id }));
+    if (!approvals) approvals = [...S.current.approvals, ...S.current.waiting].map((a) => ({ title: a.title || a.tool || a.callId }));
+    const label = myLabel();
+    const slots = sl?.ok ? (sl.v || []).map((m) => ({ ...m, ts: Date.parse(m.created_at || m.ts) }))
+      .filter((m) => Number.isFinite(m.ts) && m.ts >= sMs && !(label && m.from === label) && !isOwnBroadcast(m, { label, display: myDisplay(), userId: api.userId?.() || null })) : [];
+    if (sl && !sl.ok) blind.push(`slot ${slot} (${sl.error})`);
+    const sessions = [...new Set([...(R.current.roster.allRows || []).filter((x) => x.state === 'waiting').map((x) => String(x.name || x.key || 'a session')), ...(sd?.needs || []).map((n) => String(n.title))])];
+    const incidents = aw?.ok ? (aw.v?.items || []).filter((it) => { const t = Date.parse(it.ts); return (!Number.isFinite(t) || t >= sMs) && (it.kind === 'alert' || /_failed$/.test(String(it.kind || '')) || isIncident(it)); }) : [];
+    for (const [t, tone] of sinceLines({ approvals, slots, sessions, incidents })) say(t, tone);
+    if (blind.length) say(`Could not read: ${blind.join(', ')}. Nothing is assumed there.`, 'warn');
+    if (aw?.ok) dispatch({ type: 'object', obj: { type: 'away', data: aw.v } });
+    else if (aw) say(`away: could not read the digest (${aw.error}). Nothing is assumed.`, 'warn');
+    else say('/away is not available in this mode.', 'warn');
+    return undefined;
+  }
   async function dndOn(until = null) {
     const at = Date.now(); const untilMs = until ? untilEpoch(until, at) : null;
     const note = dndNote(untilMs);
@@ -2504,6 +2685,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
 
   // ---- QUOXON-FW8: ! commands ---------------------------------------------------------------------
   function bangCommand(bang, { echoed = false } = {}) {
+    if (isWebPty(env)) return say(SHELL_REFUSED, 'warn'); // QUOXON web PTY: the browser terminal has no shell
     if (bang.kind === 'reserved') return say('!! is reserved. Use ! followed by a command, e.g. !ls or !quox inbox list.', 'warn');
     if (bang.kind === 'empty') return say('Usage: !<command> runs it here, !quox <args> runs this quox as you. Output stays on your screen; /share sends it to Quox.', 'warn');
     let plan = { cmd: bang.cmd };
@@ -2525,7 +2707,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       out = cleanOutput(out).replace(/\n+$/, '');
       if (out) dispatch({ type: 'bang.out', text: out });
     };
-    const run = runBang(plan, { cwd: process.cwd(), env, timeoutMs, onData: (t) => { pending += t; if (!timer) timer = setTimeout(() => { timer = null; flush(false); }, 80); } });
+    const run = runBang(plan, { cwd: process.cwd(), env, timeoutMs, columns: cols - 2, onData: (t) => { pending += t; if (!timer) timer = setTimeout(() => { timer = null; flush(false); }, 80); } });
     const slow = setTimeout(() => { if (R.current.bang?.run === run && !R.current.exiting) say('still running (Ctrl+C stops it)', 'accent'); }, 5000);
     R.current.bang = { run, cmd };
     run.done.then((r) => {
@@ -3434,6 +3616,9 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       case '/org': {
         if (!api.orgs) return say('Org switching is not available in this mode.', 'warn');
         const R0 = R.current, curId = R0.orgId ?? api.orgId?.() ?? null;
+        // Already authorised: the person typed this /org line themselves, or said y to an agent's suggested one (owner 2026-10-15,
+        // 2026-11-06: a typed command is the authorisation, never double-approve). Read once and cleared, so it never carries over.
+        const authorised = R0.preConfirmed === 'org' || R0.typedOrg === line.trim(); R0.preConfirmed = null; R0.typedOrg = null;
         const sub = (restArg.match(/^(\S+)\s*(.*)$/) || [])[1] || '';
         const query = (restArg.match(/^\S+\s+(.*)$/) || [])[1]?.trim() || '';
         let list;
@@ -3472,7 +3657,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
           if (!p) return say('No previous org in this session yet. /org lists yours.', 'warn');
           if (S.current.turn) return say('Wait for the current turn or press Esc first.', 'warn');
           R0.orgPending = { id: p.id, name: p.name, at: Date.now() };
-          if (R.current.preConfirmed === 'org') { R.current.preConfirmed = null; return command('/org yes'); }
+          if (authorised) return command('/org yes');
           return ask(`Switch back to ${p.name}?`, { action: `/org switch ${p.id} (${p.name})`, reason: 'This starts a new conversation in that org.' });
         }
         if (sub !== 'switch') return say('Usage: /org, /org switch <name or id>, or /org back', 'warn');
@@ -3483,8 +3668,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
         if (!m.org) return say(`No org of yours matches "${query}". /org lists them.`, 'warn');
         if (m.org.id === curId) return say(`Already in ${m.org.name}.`);
         R0.orgPending = { id: m.org.id, name: m.org.name, at: Date.now() };
-        // Already said yes to the suggested "/org switch X? y/N": one confirmation, not two (owner 2026-10-15).
-        if (R.current.preConfirmed === 'org') { R.current.preConfirmed = null; return command('/org yes'); }
+        if (authorised) return command('/org yes'); // typed, or a y to the suggestion: one confirmation at most, never two
         return ask(`Switch to ${m.org.name}?`, { action: `/org switch ${m.org.id} (${m.org.name})`, reason: 'This starts a new conversation in that org.' });
       }
       case '/todo': case '/todos': {
@@ -3681,7 +3865,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
         const held = (c) => Boolean(c && ((c.inbox?.length || 0) + (c.slots?.length || 0)));
         if (!win || (!AWAY.current.afk && !held(win.col))) { // nothing held in the last window: same since-last-seen digest as /away, honest note first
           say(win ? 'Nothing was held in your last do not disturb window. Here is what happened since you were last here.' : 'Nothing was held: do not disturb was off. Here is what happened since you were last here.', 'dim');
-          return command('/away');
+          return sinceDigest();
         }
         const col = win.col;
         const approvals = Math.max(S.current.notify?.approvals || 0, [...S.current.approvals, ...S.current.waiting].length);
@@ -3727,8 +3911,8 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
         return say(`✔ noted for the observer (quoxon${r.viaOrgName ? ` in ${r.viaOrgName}` : ''})`, 'ok');
       }
       case '/poke': case '/wake': case '/nudge': case '/ping': case '/slap': case '/awaken': { // owner tried all five on 2026-10-15
-        const m = parsePokeArgs(restArg); // FORCE-WAKE: --force is a no-op, never page text
-        if (!m) return say(`Usage: ${cmd} <slot or session> [text]  (an urgent page; they are asked to acknowledge, and an idle session is woken to read it, even with an unsent draft, which is set aside and put back)`, 'warn');
+        const m = parsePokeArgs(restArg, restArg.trim().includes(' ') ? await slotNames(api) : null); // FORCE-WAKE: --force is a no-op, never page text; TUI-WAKE-MULTI: a,b,c or a b c pages every one
+        if (!m) return say(`Usage: ${cmd} <slot>[,<slot>...] [text]  (several slots: a,b,c or a b c; an urgent page; they are asked to acknowledge, and an idle session is woken to read it, even with an unsent draft, which is set aside and put back)`, 'warn');
         return command(`/page ${m.slot} ${m.text ? m.text.trim() : `are you there? (${cmd.slice(1)} from ${myLabel() || 'the owner'})`}`);
       }
       case '/away': {
@@ -3764,13 +3948,14 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
         catch (e) { return dispatch({ type: 'error', text: `Could not read the inbox (${e.message}). That does not mean it is empty; try again or run: quox inbox list` }); }
         const top = newestFirst(items).slice(0, 10);
         R.current.inboxList = top; R.current.inboxSeen = arrivals(items, R.current.inboxSeen || null).ids;
-        dispatch({ type: 'notify', patch: { inboxBar: inboxBarText(items, cols, barOpts()) } });
+        const barText = () => inboxBarText(newestFirst(items).slice(0, INBOX_BAR_READ), cols, barOpts()); // TUI-CARD-SYNC: the poll's basis, never a 30-item count
+        dispatch({ type: 'notify', patch: { inboxBar: barText() } });
         if (q.kind === 'mutes') { for (const l of mutesLines(inboxMutes())) say(l.text, l.tone); return undefined; }
         if (q.kind === 'mute' || q.kind === 'unmute') {
           const key = q.source.toLowerCase(); const next = { ...inboxMutes() };
           if (q.kind === 'mute') next[key] = Date.now() + q.ms; else if (!next[key]) return say(`${q.source} is not muted. ${mark('/inbox mutes')} lists them.`, 'warn'); else delete next[key];
           if (api.saveSetting) api.saveSetting('inboxMutes', next); else (R.current.sessionSettings ||= {}).inboxMutes = next;
-          dispatch({ type: 'notify', patch: { inboxBar: inboxBarText(items, cols, barOpts()) } });
+          dispatch({ type: 'notify', patch: { inboxBar: barText() } });
           return say(q.kind === 'mute' ? `✔ muted ${q.source} for ${Math.round(q.ms / 360000) / 10}h: no arrival lines, out of the bar count, still listed in /inbox. Approvals are never muted. ${mark(`/inbox unmute ${q.source}`)} undoes it.` : `✔ unmuted ${q.source}`, 'ok');
         }
         const pick = (n) => { const it = top[n - 1]; if (!it) say(`No item ${n}: the list has ${top.length}. ${mark('/inbox')} shows it.`, 'warn'); return it; };
@@ -4157,7 +4342,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
           if (verb === 'approve' && privOf(it) && !(confirm && !all && !agent)) { heldPriv.push(k); continue; }
           try {
             const dsc = describeInboxItem(it); // APPROVAL-WHAT: record the real action and target, not a clipped title
-            const r = await answer({ callId: it.id, inboxItemId: it.id, approvalId: it.approval_id || it.approvalId || null, tool: dsc.tool || clip(it.title || it.id, cols - 40), target: dsc.target, raisedBy: approvalSourceLabel(it), risk: it.payload?.approval_context?.risk || null }, verb, { batch: true, reason, proactive: Boolean(R.current.authorising) && verb === 'approve', bulk: bulkish && isDecision(it) });
+            const r = await answer({ callId: it.id, inboxItemId: it.id, approvalId: it.approval_id || it.approvalId || null, tool: dsc.tool || clip(it.title || it.id, cols - 40), target: dsc.target, raisedBy: approvalSourceLabel(it), risk: it.payload?.approval_context?.risk || null, consent: bulkish || targets.length > 1 ? null : consentOf(it) }, verb, { batch: true, reason, proactive: Boolean(R.current.authorising) && verb === 'approve', bulk: bulkish && isDecision(it) });
             if (r?.gone) gone.push(k); else if (r?.ok) { done.push(k); R.current.lastAnswered = it.id; }
           } catch (e) {
             failed.push(`[${k}] ${e.message}`);
@@ -4283,13 +4468,20 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       }
       const st = bind.get(cd.id);
       if (askStateOpen(st)) continue;
+      if (st && typeof st === 'object' && st.walk && st.walkWhy !== 'next' && st.walkWhy !== 'done') { // a walkthrough card that did not close normally: its line comes from the server
+        if (!st.walkWhy) { st.walkWhy = 'lapsed'; st.at = now; walkLapsed(st); } // TUI-CARD-SYNC: left open past its window; never "expired" before the server says so
+        if (st.settleText == null && now - (st.at ?? now) < 15000) continue; // still checking
+        bind.delete(cd.id); takeAnswer();
+        if (st.settleText) dispatch({ type: 'ask.settle', id: cd.id, text: st.settleText, tone: st.settleTone || 'plain' });
+        else dispatch({ type: 'ask.settle', id: cd.id, text: '', tone: 'plain', silent: true });
+        continue;
+      }
       bind.delete(cd.id);
       const expired = st && typeof st === 'object' ? now - (st.at ?? 0) >= ASK_TTL : false;
       if (expired && st === SC.current.reattach && st.slot) R.current.declinedSlot = st.slot; // an unanswered reattach counts as a decline across the auto-restart of this window
       if (st && typeof st === 'object' && st.walkWhy) { // a walkthrough card: a normal end says nothing (the summary does), an interruption says so
         takeAnswer();
-        if (st.walkWhy === 'stop') dispatch({ type: 'ask.settle', id: cd.id, text: 'The question closed before you answered.', tone: 'plain' });
-        else dispatch({ type: 'ask.settle', id: cd.id, text: '', tone: 'plain', silent: true });
+        dispatch({ type: 'ask.settle', id: cd.id, text: '', tone: 'plain', silent: true });
         continue;
       }
       const outcome = expired ? { kind: 'expired' } : takeAnswer() || { kind: st === 'any' || st === 'kc' || st === 'uw' ? 'expired' : 'closed' };
@@ -4610,6 +4802,22 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
       if (/^y(es)?$/i.test(text.trim()) && Date.now() - a.at < 120000) { if (R.current.bang) say('A command is still running. Ctrl+C stops it.', 'warn'); else bangCommand(a.bang); bump(n => n + 1); return; }
       if (!text.startsWith('/')) { say('Not run.', 'dim'); return; }
     }
+    if (R.current.consentAsk && !text.startsWith('/')) { // "needs the lawful basis: type it now" after approving a contact-consent card
+      const a = R.current.consentAsk; R.current.consentAsk = null;
+      const basis = text.trim();
+      if (!basis || /^no?$/i.test(basis) || Date.now() - a.at > 600000) { say(`No consent recorded. Contact with ${a.recipient} via ${a.channel} stays denied by default.`, 'dim'); return; }
+      const pr = a.proposed || {};
+      const body = { recipient: a.recipient, channel: a.channel, basis };
+      for (const k of ['purpose', 'quiet_start', 'quiet_end', 'tz_offset_minutes', 'min_interval_minutes', 'max_per_day']) if (pr[k] !== undefined && pr[k] !== null && pr[k] !== '') body[k] = pr[k];
+      (async () => {
+        try {
+          const r = await api.grantContactability(body);
+          if (!r || r.granted !== true) { say(`Consent NOT recorded for ${a.recipient} via ${a.channel}: the server did not confirm it.`, 'warn'); return; }
+          say(`Consent recorded: ${a.recipient} via ${a.channel}, basis "${basis}". Evidence: consent artifact ${r.consent_artifact_id || '(no id returned)'}.`, 'ok');
+        } catch (e) { say(`Consent NOT recorded for ${a.recipient} via ${a.channel} (${e?.status ? `HTTP ${e.status}: ` : ''}${e?.body?.message || e?.message || 'failed'}).`, 'warn'); }
+      })();
+      return;
+    }
     if (R.current.hatPending && !text.startsWith('/')) { // "Put on the NSOC hat? y/N" from /hat: y switches (/hat yes still works)
       const a = R.current.hatPending;
       if (/^y(es)?$/i.test(text.trim()) && Date.now() - (a.at || 0) < 120000) { command('/hat yes'); return; }
@@ -4672,7 +4880,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
     }
     { const ls = R.current.listShownAt; R.current.listShownAt = null; // APPROVALS-UX: y/n right after a list (not a card) is not chat to the agent
       if (ls && Date.now() - ls < 600000 && /^(y(es)?|no?)$/i.test(text.trim())) { remember(text); R.current.histIdx = -1; say('Which one? /approve 1 or /approvals 1 to see it.', 'warn'); R.current.listShownAt = ls; return; } }
-    if (isOneLineCommand(text)) { PL.current.submitted(buf.text); remember(text); R.current.histIdx = -1; echoCmd(text); command(text); return; } // Up recalls commands too
+    if (isOneLineCommand(text)) { if (/^\/org\s+(switch\s+\S|back\s*$|-\s*$)/i.test(text.trim())) R.current.typedOrg = text.trim(); PL.current.submitted(buf.text); remember(text); R.current.histIdx = -1; echoCmd(text); command(text); return; } // Up recalls commands too
     if (!SC.current.active && BARE_COMMAND_WORDS.has(text.toLowerCase()) && findEntry('/' + text.toLowerCase())?.kind === 'command') { // owner 2026-10-26 18:22: "clear" went to the model as chat. Offer the command BEFORE anything is sent; n sends it as chat.
       const line = '/' + text.toLowerCase();
       remember(text); R.current.histIdx = -1;
@@ -5024,6 +5232,7 @@ export function App({ slotAgent, notifyMs = 4000, resultPollMs = 3000, resultTim
         return edit({ type: 'down', width: composerWidth() });
       }
       case 'ctrl-g': {
+        if (isWebPty(env)) { say(SHELL_REFUSED, 'warn'); return; } // QUOXON web PTY: no external editor
         const full = sanitizeForSend({ ...B.current }).text ?? B.current.text;
         mouseTerm(false); // the editor gets a plain terminal (QUOXON-MOUSE), and tracking comes back after
         if (isRawModeSupported) setRawMode(false);