spexcode 0.5.8 → 0.6.0

package/spec-cli/src/help.ts

@@ -25,9 +25,9 @@ const DOT_NOTE = `\`.\` as a node argument means the node THIS worktree works on
 node/<id> branch). One-shot payload reads (graph · spec search · session ls/show/review · eval ls ·
 scenario ls · issue ls/show/links) take --json.`
 
-const MENTION_NOTE = `Mentions: @session · [[node]] · @new / @new:<launcher> work in ANY prompt, issue, or remark body —
-text passed as a CLI arg included. [[node]] names the topic node; @session hands the text to that live agent;
-@new spawns a fresh worker on the thread's node (bare = configured default; :<launcher> = that named profile).`
+const MENTION_NOTE = `Mentions: @session · [[node]] work in ANY prompt, issue, or remark body — text passed as a CLI arg included.
+[[node]] names a topic; @session names a retained session for the receiving agent to inspect, contact with
+\`spex session send\`, or inherit with \`/distill\`. Mentions are references only: they never send or spawn.`
 
 type SessionVerbNote = 'selector' | 'project-bound'
 type SessionVerbHelp = readonly [usage: string | readonly string[], detail: string, notes?: readonly SessionVerbNote[]]
@@ -44,20 +44,22 @@ session to that node. --prompt-file <path>|- carries a long prompt without shell
     ls: ['spex session ls [SEL…] [--status a,b] [--all] [--json]',
       'One-shot table of living sessions. Shelved sessions ([[archive]]) are hidden; --all includes them, and naming one explicitly always shows it.', ['selector']],
     resources: ['spex session resources [--json]', 'Read-only host/process ownership, budgets, shared refs, and findings.'],
-    watch: ['spex session watch [SEL…] [--as NAME] [--idle] [--interval N=5]',
+    watch: ['spex session watch [SEL…] [--as NAME] [--idle] [--interval N=1]',
       'Streams lifecycle transitions and blocks until killed; `session wait` is the one-shot alternative.', ['selector']],
-    wait: ['spex session wait <SEL> [--timeout S=1200] [--interval S=2] [--idle]',
-      `EDGE-TRIGGERED wait on one session. Prints the current status immediately (stderr), then
-exits 0 only when it OBSERVES
-the session TRANSITION from a non-actionable status into an actionable one, printing the
-observed path on stdout (e.g. working→review — read the LAST token as the status reached).
-It NEVER returns just because the session is actionable ALREADY — for "what is it right NOW"
-use \`session ls\` / \`session review\` instead. --timeout is the guaranteed exit (code 1,
-observed path on stderr).`, ['selector']],
+    wait: ['spex session wait [SEL…] [--timeout S=1200] [--interval S=1] [--idle]',
+      `EDGE-TRIGGERED wait: follows the selected sessions' logs AND your own log, and exits 0 on
+the FIRST thing worth waking for — a followed session TRANSITIONING from a non-actionable
+status into an actionable one (stdout = the observed path, e.g. working→review; read the LAST
+token as the status reached), or a message arriving for you (stdout = message). The arrival
+status is printed immediately on stderr but never returns it: it NEVER returns just because a
+session is actionable ALREADY — for "what is it right NOW" use \`session ls\` / \`session review\`.
+It reads files only, so it needs no \`spex serve\` and costs the sessions it follows nothing.
+--timeout is the guaranteed exit (code 1, observed path on stderr); code 2 = a followed
+session's store is gone.`, ['selector']],
     review: ['spex session review <SEL> [--json]', 'Reports ahead · uncommitted · proposal · gates · merge-base diff.', ['selector']],
     merge: ['spex session merge <SEL>', 'Dispatches a gated merge to the session\'s own agent; it does not close the session.', ['selector', 'project-bound']],
     send: [['spex session send <SEL> "<msg>"', 'spex session send <SEL> --keys "<keys>"'],
-      `Plain send delivers a message and fails loud when dispatch is dead. --keys is the LAST RESORT:
+      `Plain send delivers a message once its timeline append succeeds; a dead adapter only delays its context. --keys is the LAST RESORT:
 raw nav-mode keystrokes to a TUI dialog ("Up Up Enter", C-/M-/S- combos). The raw key surface
 is UNSTABLE and can confirm dangerous dialogs — try a plain send first; use keys only when text
 provably cannot land.`, ['selector', 'project-bound']],
@@ -69,18 +71,17 @@ provably cannot land.`, ['selector', 'project-bound']],
     stop: ['spex session stop <SEL>', 'Soft stop: kill the exact agent and KEEP the worktree resumable.', ['selector', 'project-bound']],
     archive: ['spex session archive <SEL>', 'Cold-archive it: exact leaf/runtime stopped, worktree and conversation kept.', ['selector']],
     unarchive: ['spex session unarchive <SEL>', 'Deprecated compatibility spelling: same behavior as resume, relaunching the same conversation.', ['selector']],
-    close: ['spex session close <SEL>', 'Retire the session and its worktree.', ['selector', 'project-bound']],
+    close: ['spex session close <SEL>', `Retire ANOTHER session — one you dispatched — deleting its worktree, branch and record.
+<SEL> names that session; it is never \`.\` and never your own id. Closing yourself deletes the worktree
+you are running in, mid-turn. Your own ending is a declaration: \`done --propose close\`.`, ['selector', 'project-bound']],
     quarantine: ['spex session quarantine <ID> --adapter <harness> [--thread <native-id>] --tmux <id> --worktree <absent-path> --branch <absent-branch> [--restore]',
-      'Move only an unreadable record after the backend proves every named residue absent. Quarantine and --restore both require the original exact id because corrupt rows are outside selectors.', ['project-bound']],
-    maintain: [[
-      'spex session maintain --allow-stop <SEL> [--allow-resume <SEL>[:force]] … -- <command> [args…]',
-      'spex session maintain --status',
-    ], `Hold one project maintenance lease around a bounded operator command. Only the exact one-shot
-stop/resume plan is brokered; ordinary session writes stay closed. The bearer never prints or enters
-argv/environment. --status is the sanitized read-only lease view.`, ['selector', 'project-bound']],
-    done: ['spex session done --propose merge|nothing|close [--note T]', 'Declare your own work committed and stop.'],
-    park: ['spex session park --note <what-you-await>', 'Declare that a real background task will wake your own session.'],
-    ask: ['spex session ask --note <your-question>', 'Declare that your own session is stopped on the human and resumes on reply.'],
+      'Move only an unreadable record after the backend proves every named residue absent. --thread is an adapter-native conversation id, never the SpexCode session id; omit it for Claude. Quarantine and --restore both require the original exact id because corrupt rows are outside selectors.', ['project-bound']],
+    done: ['spex session done --propose merge|nothing|close [--note T]',
+      '`merge` declares review: committed work ready for human review, and it is the ONLY declaration that offers a clickable merge. `nothing` declares done: committed work, but no merge proposal. `close` declares close-pending: PROPOSE discarding this worktree — the human closes it. This declaration is how a session ends itself; never run `session close` on your own id.'],
+    park: ['spex session park --note <what-you-await>',
+      'Declare parked only when a real background task will wake your own session. It self-resumes; waiting for a human is asking, not parked.'],
+    ask: ['spex session ask --note <your-question>',
+      'Declare asking when the session needs a human reply or direction. It resumes only when the human replies; a background wake-up is parked instead.'],
     attach: ['spex session attach <SEL>', `Attaches the current terminal to the worker's tmux (detach: C-b d) and blocks until detached.
 LOCAL-only (fails loud on a remote backend); show --capture and send are non-interactive.`, ['selector']],
   }
@@ -88,12 +89,12 @@ LOCAL-only (fails loud on a remote backend); show --capture and send are non-int
 
 const SESSION_HELP_GROUPS = [
   { title: 'Manager verbs (dispatch, monitor, land)', verbs: ['new', 'ls', 'resources', 'watch', 'wait', 'review', 'merge'] },
-  { title: 'Control another session', verbs: ['send', 'interrupt', 'rename', 'show', 'resume', 'stop', 'archive', 'unarchive', 'close', 'quarantine', 'maintain'] },
+  { title: 'Control another session', verbs: ['send', 'interrupt', 'rename', 'show', 'resume', 'stop', 'archive', 'unarchive', 'close', 'quarantine'] },
   { title: 'Worker verbs (declare YOUR OWN state — a claim the graph and your supervisor act on)', verbs: ['done', 'park', 'ask'] },
   { title: 'Human escape hatch', verbs: ['attach'] },
 ] as const
 
-const SESSION_WRITE_NOTE = `Manager verbs that WRITE (send/interrupt/rename/resume/stop/close/maintain/merge) are PROJECT-BOUND: a backend serving
+const SESSION_WRITE_NOTE = `Manager verbs that WRITE (send/interrupt/rename/resume/stop/close/merge) are PROJECT-BOUND: a backend serving
 another project's repo refuses loudly — name the target with --api <url> to drive it on purpose.`
 
 function indent(text: string, spaces: number): string {

package/spec-cli/src/host-resources.ts

@@ -230,7 +230,9 @@ const sharedDescriptors = (recs: RawRecord[], retainRegistry = false): Map<strin
     // contribute nothing to the active set while still preserving exact ownership if the invariant is violated.
     if (!rec.governed) continue
     const harness = harnessById(rec.harness || defaultHarness.id)
+    const exactKey = harness.targetDescriptorKey?.({ session: rec.session_id, harnessSessionId: rec.harness_session_id }) ?? null
     for (const descriptor of harness.sharedRuntimes?.(runtimeRoot()) ?? []) {
+      if (exactKey && descriptor.key !== exactKey) continue
       const entry = out.get(descriptor.key) ?? { descriptor, recs: [] }
       entry.recs.push(rec)
       out.set(descriptor.key, entry)
@@ -386,8 +388,15 @@ const sessionStopBlocker = async (
   knownProbes?: Map<string, SharedRuntimeProbe>,
   opts: { coldReceipt?: unknown } = {},
 ): Promise<string | null> => {
-  const allowed = harnessId
-    ? new Set((harnessById(harnessId).sharedRuntimes?.(runtimeRoot()) ?? []).map((descriptor) => descriptor.key))
+  const targetRecord = recs.find((rec) => rec.session_id === id)
+  const targetHarness = harnessId ? harnessById(harnessId) : null
+  const exactKey = targetHarness?.targetDescriptorKey?.({ session: id, harnessSessionId: targetRecord?.harness_session_id }) ?? null
+  const targetDescriptors = targetHarness?.sharedRuntimes?.(runtimeRoot()) ?? []
+  if (targetHarness && targetDescriptors.length === 0) return null
+  if (targetRecord?.harness_session_id && targetHarness?.targetDescriptorKey && targetDescriptors.length && !exactKey)
+    return `${targetHarness.id} target has no exact shared-runtime generation binding`
+  const allowed = targetHarness
+    ? new Set(exactKey ? [exactKey] : targetDescriptors.map((descriptor) => descriptor.key))
     : null
   for (const [key, entry] of sharedDescriptors(recs, true)) {
     if (allowed && !allowed.has(key)) continue

package/spec-cli/src/index.ts

@@ -7,37 +7,38 @@ import { cors } from 'hono/cors'
 import { etag } from 'hono/etag'
 import { createNodeWebSocket } from '@hono/node-ws'
 import { loadSpecs, loadSpecsLite, specContent, specHistory, specDiffAt, loadConfig, loadReviewConfig } from './specs.js'
-import { issuesEnabled, remarkOnHost, resolveRemark, retractRemark } from './localIssues.js'
-import { closeIssue, createIssue, findIssue, issueStores, mergedIssues, promote, replyIssue } from './issues.js'
+import { issuesEnabled, resolveRemark, retractRemark } from './localIssues.js'
+import { closeIssue, createIssue, findIssue, issueStores, mergedIssues, promote } from './issues.js'
+import { remarkWithLoopIn, replyIssueWithLoopIn } from './loop-in.js'
 import { residentForgeState, refreshForgeNow } from '../../spec-forge/src/resident.js'
 import { resolveForgeHost } from '../../spec-forge/src/drivers.js'
-import { summarize } from './mentions.js'
+import { summarizeLoopIn } from './mentions.js'
 import { resolveLayout, mainBranch } from './layout.js'
 import { getBoardJson } from './graphCache.js'
 import { boardStream, closeBoardFileWatchers, ensureBoardFileWatchers, notifyBoardChanged } from './graphStream.js'
 import { gitA, gitTry, repoRoot } from './git.js'
-import { listSessions, sendText, interruptSession, rawKey, stopSession, closeSession, quarantineCorruptRecord, restoreQuarantinedRecord, archiveSession, resumeSession, mergeSession, reviewPayload, captureSessionResult, sessionPrompt, sessionGraph, registerWatch, deregisterWatch, renameSession, setSessionSort, sessionCreateRequest, superviseQueue, superviseTurnFailures, SessionRecordUnusable, TMUX_SOCK } from './sessions.js'
-import { superviseTimeline, readTimeline } from './session-timeline.js'
+import { cockpitReview } from './cockpit.js'
+import { listSessions, sendText, interruptSession, rawKey, stopSession, closeSession, quarantineCorruptRecord, restoreQuarantinedRecord, archiveSession, resumeSession, mergeSession, captureSessionResult, sessionPrompt, renameSession, setSessionSort, sessionCreateRequest, superviseQueue, superviseTurnFailures, superviseDelivery, SessionRecordUnusable, TMUX_SOCK } from './sessions.js'
+import { readTimeline } from './session-timeline.js'
 import { defaultHarness, HARNESSES, dashboardLauncherList, launcherDefault } from './harness.js'
 import { evalTimeline, readBlobByHash } from '../../spec-eval/src/evaltab.js'
 import { putBlob } from '../../spec-eval/src/cache.js'
 import { fileHumanReading } from '../../spec-eval/src/filing.js'
 import { fileHumanOk } from '../../spec-eval/src/humanok.js'
 import { buildExportModel, renderExportHtml, SessionEvalUnavailableError } from '../../spec-eval/src/sessioneval.js'
-import { saveUpload, MAX_UPLOAD_BYTES } from './uploads.js'
+import { appendUpload, cancelUpload, completeUpload, createUpload, evidenceMaxBytes, startUploadReaper, UploadError, uploadStatus } from './uploads.js'
 import { attachViewer, detachViewer, resizeBridge, hideViewer, forwardInput, superviseBridges, type Viewer } from './pty-bridge.js'
 import { installProcessGuards } from './resilience.js'
 import { resolveProjectIdentity } from './project-identity.js'
 import { evalDetailReview, evalsReview, issuesReview } from './reviews.js'
 import { collectResourceReport, ResourceConflict } from './host-resources.js'
-import { exactProcessIdentity, maintenanceErrorPayload, sessionMaintenance, SessionMaintenanceError, type Authorization } from './session-maintenance.js'
-import { readBackendInstanceRecords } from './runtime-ownership.js'
 
 // last-resort net: an unforeseen async throw (e.g. a worktree vanishing mid-read during a worker
 // self-merge) is logged and the server KEEPS SERVING instead of exiting and dropping the public port.
 installProcessGuards()
 
 const app = new Hono()
+startUploadReaper()
 app.use('/api/*', cors())
 app.onError((error, c) => {
   if (error instanceof SessionEvalUnavailableError) return c.json({ error: error.message }, 503)
@@ -46,7 +47,6 @@ app.onError((error, c) => {
   // stack would hide exactly the sentence the human needs.
   if (error instanceof SessionRecordUnusable) return c.json({ error: error.message, code: error.code }, 409)
   if (error instanceof ResourceConflict) return c.json({ error: error.message, code: error.code }, 409)
-  if (error instanceof SessionMaintenanceError) return c.json(maintenanceErrorPayload(error)!, 409)
   console.error(error)
   return c.text('Internal Server Error', 500)
 })
@@ -190,7 +190,7 @@ app.get('/api/evidence/:hash', (c) => {
 app.post('/api/evidence', async (c) => {
   const buf = Buffer.from(await c.req.arrayBuffer())
   if (buf.length === 0) return c.json({ error: 'empty evidence' }, 400)
-  if (buf.length > MAX_UPLOAD_BYTES) return c.json({ error: 'evidence too large' }, 413)
+  if (buf.length > evidenceMaxBytes()) return c.json({ error: 'evidence too large' }, 413)
   return c.json({ hash: putBlob(buf) }, 201)
 })
 // the SETTINGS read surface — one route for everything spexcode.json / spexcode.local.json resolves to:
@@ -249,9 +249,8 @@ app.get('/api/issues/:id', (c) => {
 })
 // the WRITE surface ([[local-issues]] / [[issues-view]]) — the human reply path, STORE-ROUTED through the one
 // reply verb ([[issues]] replyIssue): a local id git-commits to the trunk store, a forge id ('github#N')
-// posts a REAL comment through the driver; either way the text's @-mentions dispatch (a human summons an
-// agent from the issues page). `outcomes` is the one-line @-dispatch summary the dashboard echoes. The
-// server owns its freshness: a forge write forces the resident slice's read-back before answering, so the
+// posts a REAL comment through the driver. @session remains prose in either store; it never sends or spawns.
+// The server owns its freshness: a forge write forces the resident slice's read-back before answering, so the
 // reload that follows shows the comment. Honor the on/off switch: 403 when the feature is OFF; an unknown
 // local thread → 404; a failed forge write → 502 with the driver's own message (fail loud, never queued).
 app.post('/api/issues/:id/reply', async (c) => {
@@ -268,10 +267,10 @@ app.post('/api/issues/:id/reply', async (c) => {
     const node = id.includes('#')
       ? mergedIssues({ host: resolveForgeHost(), state: residentForgeState() }, loadSpecsLite().map((s) => s.id)).find((i) => i.id === id)?.nodes[0] ?? null
       : null
-    const r = await replyIssue(id, text, { author: 'human', node, evidence })
+    const r = await replyIssueWithLoopIn(id, text, { author: 'human', node, evidence })
     if (r.store !== 'local') await refreshForgeNow()
     notifyBoardChanged('full')   // atomic with persistence — see the /api/remarks block below
-    return c.json({ ok: true, replies: r.replies, url: r.url, outcomes: summarize(r.outcomes, r.loopIn) })
+    return c.json({ ok: true, replies: r.replies, url: r.url, outcomes: summarizeLoopIn(r.loopIn) })
   } catch (e) {
     const msg = String((e as Error).message || e)
     return c.json({ error: msg }, id.includes('#') ? 502 : 404)
@@ -306,7 +305,7 @@ app.post('/api/issues', async (c) => {
     const r = await createIssue(concern, { store, nodes, body: postBody, evidence, author: 'human' })
     if (r.store !== 'local') await refreshForgeNow()
     notifyBoardChanged('full')   // atomic with persistence — see the /api/remarks block below
-    return c.json({ ok: true, id: r.id, store: r.store, url: r.url, outcomes: summarize(r.outcomes) }, 201)
+    return c.json({ ok: true, id: r.id, store: r.store, url: r.url }, 201)
   } catch (e) {
     return c.json({ error: String((e as Error).message || e) }, store === 'local' ? 500 : 502)
   }
@@ -359,9 +358,9 @@ app.post('/api/remarks', async (c) => {
     : { issue: typeof body?.issue === 'string' ? body.issue : undefined }
   const codeSha = typeof body?.codeSha === 'string' ? body.codeSha : undefined
   try {
-    const r = await remarkOnHost(host, text, { codeSha, author: 'human', evidence })
+    const r = await remarkWithLoopIn(host, text, { codeSha, author: 'human', evidence })
     notifyBoardChanged('full')
-    return c.json({ ok: true, ref: r.ref, rid: r.rid, codeSha: r.codeSha, outcomes: summarize(r.outcomes, r.loopIn) }, 201)
+    return c.json({ ok: true, ref: r.ref, rid: r.rid, codeSha: r.codeSha, outcomes: summarizeLoopIn(r.loopIn) }, 201)
   } catch (e) {
     return c.json({ error: String((e as Error).message || e) }, 400)
   }
@@ -389,17 +388,52 @@ app.get('/api/slash-commands', (c) => {
   return c.json(h.slashCommands())
 })
 
-// write a pasted/dropped/picked file to this (worker) machine's /tmp and return its absolute path for the
-// client to splice into the prompt. Fail-loud: no/empty file → 400, over the size cap → 413, write error → 500.
+function uploadFailure(error: unknown): Response {
+  if (!(error instanceof UploadError)) throw error
+  const body: { error: string; offset?: number } = { error: error.message }
+  if (error.offset != null) body.offset = error.offset
+  return new Response(JSON.stringify(body), { status: error.status, headers: { 'content-type': 'application/json' } })
+}
+
+// One offset protocol for every attachment. Chunks stream through the existing /api proxy and stage only on
+// the worker machine; completion is the one boundary that makes a prompt-visible absolute path exist.
 app.post('/api/uploads', async (c) => {
-  const body = await c.req.parseBody().catch(() => ({} as Record<string, string | File>))
-  const file = body['file']
-  if (!(file instanceof File) || file.size === 0) return c.json({ error: 'no file' }, 400)
-  if (file.size > MAX_UPLOAD_BYTES) return c.json({ error: 'file too large' }, 413)
+  const body = await c.req.json().catch(() => null) as { name?: unknown; size?: unknown } | null
   try {
-    return c.json({ path: await saveUpload(file) }, 201)
-  } catch (e) {
-    return c.json({ error: String((e as Error)?.message || e) }, 500)
+    return c.json(createUpload(body?.name, body?.size), 201)
+  } catch (error) {
+    return uploadFailure(error)
+  }
+})
+app.get('/api/uploads/:id', (c) => {
+  try {
+    return c.json(uploadStatus(c.req.param('id')))
+  } catch (error) {
+    return uploadFailure(error)
+  }
+})
+app.patch('/api/uploads/:id', async (c) => {
+  try {
+    return c.json(await appendUpload(
+      c.req.param('id'), Number(c.req.header('upload-offset')), c.req.raw.body, c.req.header('content-length'),
+    ))
+  } catch (error) {
+    return uploadFailure(error)
+  }
+})
+app.post('/api/uploads/:id/complete', (c) => {
+  try {
+    return c.json({ path: completeUpload(c.req.param('id')) }, 201)
+  } catch (error) {
+    return uploadFailure(error)
+  }
+})
+app.delete('/api/uploads/:id', (c) => {
+  try {
+    cancelUpload(c.req.param('id'))
+    return c.body(null, 204)
+  } catch (error) {
+    return uploadFailure(error)
   }
 })
 
@@ -407,60 +441,6 @@ app.post('/api/uploads', async (c) => {
 // forward keystrokes, and close.
 app.get('/api/sessions', async (c) => c.json(await listSessions(c.req.query('all') === '1' || c.req.query('all') === 'true')))
 app.get('/api/resources', async (c) => c.json(await collectResourceReport()))
-const maintenance = sessionMaintenance()
-const maintenanceToken = (header: (name: string) => string | undefined) => header('x-spexcode-session-maintenance')?.trim() || ''
-const maintenanceLeaseOwner = () => {
-  const instanceId = process.env.SPEXCODE_INSTANCE_ID?.trim()
-  const record = instanceId ? readBackendInstanceRecords(repoRoot()).find((candidate) => candidate.instanceId === instanceId) : null
-  const exact = record ? exactProcessIdentity(record.pid) : null
-  if (!instanceId || !record || !exact || exact.startToken !== record.startToken)
-    throw new SessionMaintenanceError('maintenance_identity_unknown', 'cannot prove the exact live backend supervisor generation')
-  return { instanceId, pid: record.pid, startToken: record.startToken }
-}
-const operationAuthorization = async (
-  header: (name: string) => string | undefined,
-  operation: { op: 'stop'; sessionId: string } | { op: 'resume'; sessionId: string; force: boolean },
-): Promise<Authorization | undefined> => maintenance.authorizeHttpOperation({
-  authenticated: true,
-  projectMatches: true,
-  headers: { [maintenance.headerName]: maintenanceToken(header) },
-  operation,
-})
-app.get('/api/session-maintenance', (c) => c.json(maintenance.readState()))
-app.post('/api/session-maintenance/acquire', async (c) => {
-  const body = await c.req.json().catch(() => ({}))
-  const lease = await maintenance.acquireLease({
-    capabilities: Array.isArray(body?.capabilities) ? body.capabilities : body?.capabilities,
-    owner: maintenanceLeaseOwner(),
-    ttlMs: Number(body?.ttlMs),
-    waitMs: Number(body?.waitMs),
-  })
-  return c.json(lease, lease.state === 'active' ? 201 : 202)
-})
-app.post('/api/session-maintenance/heartbeat', async (c) => {
-  const body = await c.req.json().catch(() => ({}))
-  await maintenance.heartbeatLease({ token: maintenanceToken(c.req.header.bind(c.req)), epoch: Number(body?.epoch), ttlMs: Number(body?.ttlMs) })
-  return c.json({ ok: true, ...maintenance.readState() })
-})
-app.post('/api/session-maintenance/release', async (c) => {
-  const body = await c.req.json().catch(() => ({}))
-  await maintenance.releaseLease({ token: maintenanceToken(c.req.header.bind(c.req)), epoch: Number(body?.epoch) })
-  return c.json({ ok: true })
-})
-// edges derived live from `spex session watch` monitors (A→B = agent A is watching B), not a stored subscription;
-// watch/unwatch register + heartbeat. A literal `edges` segment so it never collides with the `:id` routes.
-app.get('/api/sessions/edges', async (c) => c.json(await sessionGraph()))
-app.post('/api/sessions/edges/watch', async (c) => {
-  const b = await c.req.json().catch(() => ({}))
-  const selectors = Array.isArray(b?.selectors) ? b.selectors.map(String) : []
-  const ok = registerWatch(String(b?.token || ''), String(b?.watcher || ''), selectors, Number(b?.ttlMs) || undefined)
-  return c.json({ ok }, ok ? 200 : 400)
-})
-app.post('/api/sessions/edges/unwatch', async (c) => {
-  const b = await c.req.json().catch(() => ({}))
-  const ok = deregisterWatch(String(b?.token || ''))
-  return c.json({ ok }, ok ? 200 : 404)
-})
 app.post('/api/sessions', async (c) => {
   const requestKey = c.req.header('idempotency-key') || randomUUID()
   const controller = new AbortController()
@@ -488,7 +468,7 @@ app.post('/api/sessions', async (c) => {
 // one server-side merge bundle (ahead/dirty/diff(merge-base)/gates/proposal) for the manager cockpit;
 // dashboard and `spex session review` are thin callers. 404 for an unknown id. See [[manager-cockpit]].
 app.get('/api/sessions/:id/review', async (c) => {
-  const r = await reviewPayload(c.req.param('id'))
+  const r = await cockpitReview(c.req.param('id'))
   return r ? c.json(r) : c.json({ error: 'no such session' }, 404)
 })
 // The self-contained HTML is the sole full-model transport exception. Interactive rows, including the CLI,
@@ -533,9 +513,7 @@ app.get('/api/sessions/:id', async (c) => {
 app.post('/api/sessions/:id/resume', async (c) => {
   const body = await c.req.json().catch(() => ({} as { force?: boolean }))
   const force = body?.force === true || c.req.query('force') === '1'
-  const sessionId = c.req.param('id')
-  const authorization = await operationAuthorization(c.req.header.bind(c.req), { op: 'resume', sessionId, force })
-  const r = await resumeSession(sessionId, { force, authorization })
+  const r = await resumeSession(c.req.param('id'), { force })
   return c.json(r, r.ok ? 200 : (r.refused ? 409 : 404))
 })
 // a dispatch to the session's own agent (it runs the merge), never a server merge — the server never touches
@@ -623,22 +601,21 @@ app.get('/api/sessions/:id/socket', upgradeWebSocket((c) => {
   }
 }))
 // ONE input route, `kind` the discriminator — the transport split is an implementation fact, not API surface.
-// kind:"text" (Command Box, `spex session send`, the server-side merge dispatch) injects a whole prompt
-// through the rendezvous control socket — socket-only + fail-loud: a prompt the agent doesn't confirm
-// accepting returns 502 with the reason (never a silent 200), so a dead dispatch is seen, not a false success.
+// kind:"text" (`spex session send`, the server-side merge dispatch) appends the prompt to the
+// target timeline, then best-effort pokes its adapter. A dead channel delays context injection but does not
+// change the successful append response; 502 means the record rejected the write.
 // kind:"keys" is the LAST-RESORT raw face (`spex session send --keys`): an ORDERED BATCH of
 // nav-mode key tokens over tmux send-keys, delivered in array order so tap order survives
 // ([[nav-mode-key-ordering]]); unstable by nature — callers try a plain text send first. An unknown kind is a
 // loud 400, never a guessed channel.
 app.post('/api/sessions/:id/input', async (c) => {
   const body = await c.req.json().catch(() => ({}))
-  if (body?.kind === 'text') {
+  if (body?.kind === 'text' || body?.kind === 'command') {
     // `from` (the sender's session id) rides only an agent-to-agent send → the backend records the comms
-    // edge ([[comms-edge]]); a raw human dispatch omits it and is not logged. `replyVia:"note"` marks a
+    // edge ([[session-timeline]]); a raw human dispatch omits it and is not logged. `replyVia:"note"` marks a
     // terminal-free sender ([[session-timeline]]): the server appends the note-reply insert to the delivery.
     const r = await sendText(c.req.param('id'), typeof body?.text === 'string' ? body.text : '', typeof body?.from === 'string' ? body.from : undefined, {
       ...(body?.replyVia === 'note' ? { replyVia: 'note' as const } : {}),
-      ...(typeof body?.deliveryId === 'string' && body.deliveryId ? { deliveryId: body.deliveryId } : {}),
     })
     return c.json(r, r.ok ? 200 : 502)
   }
@@ -647,14 +624,13 @@ app.post('/api/sessions/:id/input', async (c) => {
     const ok = await rawKey(c.req.param('id'), keys)
     return c.json({ ok }, ok ? 200 : 404)
   }
-  return c.json({ error: 'input needs kind: "text" | "keys"' }, 400)
+  return c.json({ error: 'input needs kind: "text" | "command" | "keys"' }, 400)
 })
 // soft stop: kill the agent's tmux + socket but KEEP the worktree (resumable). Distinct from close, which
 // removes the worktree. {ok:false} = no such session.
 app.post('/api/sessions/:id/stop', async (c) => {
   const sessionId = c.req.param('id')
-  const authorization = await operationAuthorization(c.req.header.bind(c.req), { op: 'stop', sessionId })
-  const ok = await stopSession(sessionId, { authorization })
+  const ok = await stopSession(sessionId)
   return c.json(ok ? { ok: true } : { ok: false, error: `no stop transition was committed for session ${sessionId}` }, ok ? 200 : 404)
 })
 app.post('/api/sessions/:id/interrupt', async (c) => {
@@ -724,7 +700,7 @@ injectWebSocket(server)
 superviseBridges()   // restore visible helpers after failure; their viewer subscriptions survive replacement
 superviseQueue()     // launch queued sessions as slots free (catches agent-authored proposals/crashes the server never sees directly)
 superviseTurnFailures() // reconcile adapter-owned native failure subscriptions across backend replacement
-superviseTimeline()  // record authored-lifecycle transitions to each session's durable timeline ([[session-timeline]])
+superviseDelivery()  // hand over messages an earlier pass could not ([[delivery-queue]]): the retry half of dispatch
 console.log(`spec-cli serving .spec (from git) on http://localhost:${port}`)
 
 let graphWatchersClosed = false