super-dsh 0.1.6 → 0.1.10-e

package/superd-hub/dist/agent-roster.d.ts

@@ -1,28 +1,30 @@
 /**
  * The hub's own agent roster row (AW-B, URL scheme).
  *
- * The selector is pure navigation: every runtime owns a mount path, so the UI
- * needs exactly one fact — which paths exist — and nothing else. The hub bakes
- * that fact into every page it can reach (ctx0's index and every mounted
- * world's index), so no world implements any selector code and no server-side
- * selection value exists anywhere.
+ * The selector is pure navigation: every runtime owns an addressing surface,
+ * so the UI needs exactly one fact — which surfaces exist — and nothing else.
+ * The hub bakes that fact into every page it can reach (ctx0's index and
+ * every mounted world's index), so no world implements any selector code and
+ * no server-side selection value exists anywhere.
  *
- *   /          → native DSH
- *   /omp/      → the OMP world's mount
- *   /codex/    → the Codex world's mount
+ *   /                       → native DSH
+ *   /omp/                   → the OMP world's mount (local worlds: mount roots)
+ *   /hub/?agent=<a6>        → federated rows (mesh P2 Task 3; demux family)
  */
 import type { IndexInjection } from '@deepseek-ai/dsh-host-webserver';
 /** One selectable runtime: its key, its label, the path that addresses it, its machine. */
 export interface AgentLink {
-    /** `native` for ctx0, otherwise the adapter's runtime key. */
+    /** Stable short id (a6) minted once per home (`superd/agent-ids.json`); for federated rows the peer-minted a6 adopted verbatim (never re-minted locally). */
+    id: string;
+    /** `native` for ctx0, the adapter's runtime key for local worlds, or the federated row's a6. */
     key: string;
-    /** Chip/menu label (`DSH`, `OMP`, `Codex`, …). */
+    /** Chip/menu label (`DSH`, `OMP`, `Codex · dev3`, …). */
     label: string;
-    /** Mount root, always trailing-slashed except the native `/`. */
+    /** Addressing surface, always trailing-slashed except the native `/`: a mount root for local worlds, `/hub/?agent=<a6>` for federated rows (informational chip only — switch traffic rides the `/hub` demux; there is no navigable page since T-C). */
     path: string;
-    /** Machine the runtime runs on — the Hub UI's grouping key. */
+    /** Machine the runtime runs on — the Hub UI's grouping key: `local`, or the owning machine's m4 for federated rows. */
     machine: string;
-    /** Whether the world's data plane is up (spawn resolved). Native is always ready. */
+    /** Whether the world's data plane is up (spawn resolved / probe reachable). Native is always ready. */
     ready: boolean;
     /** Whether the world's spawn REJECTED (mount stays for diagnosis). */
     failed: boolean;
@@ -30,11 +32,20 @@ export interface AgentLink {
 /** The global this module publishes the roster under. */
 export declare const AGENT_ROSTER_GLOBAL = "__DSH_AGENT_ROSTER__";
 /**
- * Every runtime that currently owns a mount, native first.
+ * Every runtime that currently owns an addressable surface — native first,
+ * then LOCAL worlds in roster order, then FEDERATED rows sorted by machine
+ * label (the paired machine's display label from its `machines.json` row; the
+ * m4 itself when no row survives) then agent label (key as the final tiebreak).
  *
- * A registered agent without a host mount has no addressable path yet (its
- * world is still spawning) and is therefore not selectable.
+ * A LOCAL agent without a host mount has no addressable path yet (its world
+ * is still spawning) and is therefore not selectable. A FEDERATED row
+ * (`machine` set, mesh P2 Task 3) needs NO mount: it is addressed by its a6
+ * through the `/hub` demux family, and the a6 IS the row's stable id —
+ * owner-minted at the peer and adopted verbatim, never re-minted locally.
+ * The id store lives under `home` — resolved per call (world-join precedent,
+ * zero module state); callers that already hold a home (rpc.ts) pass it through.
+ * @param home - the hub home backing the a6 id store and machine labels; defaults to `resolveDshHome()`.
  */
-export declare function agentLinks(): AgentLink[];
+export declare function agentLinks(home?: string): AgentLink[];
 /** The structured index row that publishes {@link agentLinks} to the page. */
-export declare function agentRosterRow(): IndexInjection;
+export declare function agentRosterRow(home?: string): IndexInjection;

package/superd-hub/dist/agent-roster.js

@@ -1,29 +1,68 @@
+import { resolveDshHome } from '@deepseek-ai/dsh-home-paths';
 import { listAgents } from './roster.js';
+import { ensureAgentId } from './agent-ids.js';
 import { takeHostMount } from './world-host.js';
-/** Machine of every roster row today — the local constant; the extension point a multi-machine registry replaces. */
+import { listRemotes } from './machines.js';
+/** Machine of every LOCAL roster row; federated rows carry their owning m4 (mesh P2 Task 3). */
 const LOCAL_MACHINE = 'local';
-/** The native runtime's synthetic entry (no adapter plugin backs it). */
-const NATIVE = { key: 'native', label: 'DSH', path: '/', machine: LOCAL_MACHINE, ready: true, failed: false };
+/** The native runtime's synthetic base row (no adapter plugin backs it); its
+ * id is minted per-home like every other LOCAL row's. */
+const NATIVE_BASE = { key: 'native', label: 'DSH', path: '/', machine: LOCAL_MACHINE, ready: true, failed: false };
 /** The global this module publishes the roster under. */
 export const AGENT_ROSTER_GLOBAL = '__DSH_AGENT_ROSTER__';
 /**
- * Every runtime that currently owns a mount, native first.
+ * Every runtime that currently owns an addressable surface — native first,
+ * then LOCAL worlds in roster order, then FEDERATED rows sorted by machine
+ * label (the paired machine's display label from its `machines.json` row; the
+ * m4 itself when no row survives) then agent label (key as the final tiebreak).
  *
- * A registered agent without a host mount has no addressable path yet (its
- * world is still spawning) and is therefore not selectable.
+ * A LOCAL agent without a host mount has no addressable path yet (its world
+ * is still spawning) and is therefore not selectable. A FEDERATED row
+ * (`machine` set, mesh P2 Task 3) needs NO mount: it is addressed by its a6
+ * through the `/hub` demux family, and the a6 IS the row's stable id —
+ * owner-minted at the peer and adopted verbatim, never re-minted locally.
+ * The id store lives under `home` — resolved per call (world-join precedent,
+ * zero module state); callers that already hold a home (rpc.ts) pass it through.
+ * @param home - the hub home backing the a6 id store and machine labels; defaults to `resolveDshHome()`.
  */
-export function agentLinks() {
-    const links = [NATIVE];
+export function agentLinks(home = resolveDshHome()) {
+    const links = [{ id: ensureAgentId(home, 'native'), ...NATIVE_BASE }];
+    const locals = [];
+    const federated = [];
+    const machineLabels = new Map(listRemotes(home).map((row) => [row.id, row.label !== '' ? row.label : row.name]));
     for (const agent of listAgents()) {
-        const mount = takeHostMount(agent.key);
-        if (mount === undefined)
-            continue;
-        const path = mount.labelPath.endsWith('/') ? mount.labelPath : `${mount.labelPath}/`;
-        links.push({ key: agent.key, label: agent.label, path, machine: LOCAL_MACHINE, ready: agent.ready === true, failed: agent.failed === true });
+        if ((agent.machine ?? LOCAL_MACHINE) === LOCAL_MACHINE) {
+            const mount = takeHostMount(agent.key);
+            if (mount === undefined)
+                continue;
+            const path = mount.labelPath.endsWith('/') ? mount.labelPath : `${mount.labelPath}/`;
+            locals.push({ id: ensureAgentId(home, agent.key), key: agent.key, label: agent.label, path, machine: LOCAL_MACHINE, ready: agent.ready === true, failed: agent.failed === true });
+        }
+        else {
+            federated.push({
+                id: agent.key,
+                key: agent.key,
+                label: agent.label,
+                path: `/hub/?agent=${encodeURIComponent(agent.key)}`,
+                machine: agent.machine,
+                ready: agent.ready === true,
+                failed: agent.failed === true,
+            });
+        }
     }
+    federated.sort((a, b) => {
+        const machineA = machineLabels.get(a.machine) ?? a.machine;
+        const machineB = machineLabels.get(b.machine) ?? b.machine;
+        if (machineA !== machineB)
+            return machineA < machineB ? -1 : 1;
+        if (a.label !== b.label)
+            return a.label < b.label ? -1 : 1;
+        return a.key < b.key ? -1 : a.key > b.key ? 1 : 0;
+    });
+    links.push(...locals, ...federated);
     return links;
 }
 /** The structured index row that publishes {@link agentLinks} to the page. */
-export function agentRosterRow() {
-    return { kind: 'global', name: AGENT_ROSTER_GLOBAL, value: { agents: agentLinks() } };
+export function agentRosterRow(home = resolveDshHome()) {
+    return { kind: 'global', name: AGENT_ROSTER_GLOBAL, value: { agents: agentLinks(home) } };
 }

package/superd-hub/dist/agent-status.d.ts

@@ -0,0 +1,119 @@
+import { type MachineRow } from './machines.js';
+import { type ProbeResult } from './mesh-link.js';
+import { type A2aAddress, type A2aGateway } from './a2a-service.js';
+import type { A2aIngest } from './a2a-ingest.js';
+/** One collected session row — exactly what session/list exposes (see the header's upstream anchor). */
+export interface AgentStatusRow {
+    /** Full DSH session id (the wire identity; R6 truncates for display). */
+    sessionId: string;
+    /** `SessionSummary.updatedAt` (epoch ms). */
+    mtime: number;
+    /** `running` mapped directly: true → 'busy', false → 'idle', unobservable → 'unknown'. */
+    status: 'busy' | 'idle' | 'unknown';
+    /** `SessionSummary.agentAvailable` — whether the session owns a live Agent. */
+    agentAvailable: boolean;
+}
+/** One workspace join entry — exactly the title-join fields the R6 ruling needs (WorkspaceView, workspace-controller types.ts:17-29). */
+export interface AgentWorkspaceEntry {
+    workspaceId: string;
+    /** User-visible title (non-null upstream — the session fallback display title). */
+    title: string;
+    sessionIds: string[];
+}
+/** One agent's collected window (bounded, payload order kept). */
+export interface AgentStatusAgent {
+    a6: string;
+    rows: AgentStatusRow[];
+    /**
+     * Workspace membership for the title join (R6 title-source ruling): the
+     * `workspace/follow` baseline's WorkspaceViews, trimmed to the join fields.
+     * Absent when the workspace leg failed (the error note says so).
+     */
+    workspaces?: AgentWorkspaceEntry[];
+    /** Per-agent collection failure (face miss / session-list rejection / workspace-follow death). */
+    error?: string;
+}
+/** One machine's snapshot. */
+export interface AgentStatusMachine {
+    /** Epoch ms of the LAST SUCCESSFUL collection (kept on failure — the data's age, not the attempt's). */
+    collectedAt: number;
+    agents: AgentStatusAgent[];
+    /** Machine-level collection failure note (set on failure, cleared on success). */
+    error?: string;
+}
+/** The whole cache file. */
+export interface AgentStatusFile {
+    machines: Record<string, AgentStatusMachine>;
+}
+/** Rows kept per agent (payload order; the D18 ≤5 window is R6's query-time concern). */
+export declare const AGENT_STATUS_ROWS_MAX = 32;
+/** Read the cache; a missing or unreadable/corrupt file degrades to empty (never throws). */
+export declare function loadAgentStatus(home: string): AgentStatusFile;
+/** Record a SUCCESSFUL machine collection — replaces the rows wholesale (empty included), clears the error. */
+export declare function recordMachineCollection(home: string, machine: string, agents: AgentStatusAgent[], now?: () => number): void;
+/**
+ * Record a machine-level collection FAILURE — the previous snapshot stays
+ * (rows AND its collectedAt: the data's age is what it is) and the error
+ * note says what happened.
+ */
+export declare function recordMachineFailure(home: string, machine: string, error: string): void;
+/**
+ * `workspace/follow` — the workspace face's reconnect-safe STATE verb
+ * (workspace-controller index.ts:199 `@Remote({ mode: 'stream' }) follow(signal)`:
+ * signal-only, no request parameter — the wire payload is a bare `{args:{}}`).
+ * Every generation starts with EXACTLY ONE
+ * `{type:'baseline', value:{items: WorkspaceView[], ...}}` frame; increments
+ * after it are mutations we do not consume. All other verbs on the controller
+ * are mutations (create / rename / delete / insert-before / archive / pin) — excluded.
+ */
+export declare const WORKSPACE_FOLLOW = "workspace/follow";
+/** Workspaces kept per agent (join-sized; a host has few). */
+export declare const AGENT_WORKSPACES_MAX = 32;
+/** How a remote agent's presentation-lane face is resolved (injectable for tests). */
+export type RemoteFaceOf = (a6: string) => A2aGateway | undefined;
+/** The production resolver: the federation memo first, the shared target registry second (the /hub demux order). */
+export declare function federatedFaceOf(a6: string): A2aGateway | undefined;
+/**
+ * Collect one REACHABLE machine's session lists over the presentation lane.
+ * Never throws: a machine-level failure records the error and keeps the
+ * previous snapshot; a per-agent failure (no face, rejected list) marks that
+ * agent with an error and empty rows — an honest miss, never a guess.
+ */
+export declare function collectRemoteMachine(home: string, remote: MachineRow, probe: ProbeResult, opts?: {
+    faceOf?: RemoteFaceOf;
+}): Promise<void>;
+/**
+ * Collect the LOCAL machine's agents (worlds + native — every a6 in the id
+ * store) through their in-process faces, resolved by the a2a-host local leg.
+ */
+export declare function collectLocalMachine(home: string, gatewayFor: (addr: A2aAddress) => A2aGateway): Promise<void>;
+/**
+ * Claim (and clear, peer-side) the envelopes buffered for THIS machine and
+ * deliver each through the SAME ingest handler the HTTP endpoint uses — in
+ * order, no dedupe layer (claim&clear is the peer's guarantee). A per-
+ * envelope failure degrades; the claim itself throwing propagates to the
+ * sweep's leg-level swallow.
+ */
+export declare function pullOutboxFor(home: string, remote: MachineRow, ingest: A2aIngest, opts?: {
+    fetchImpl?: typeof fetch;
+}): Promise<number>;
+/** The assembled legs a sweep runs (the shape mesh-link's SweepCollectors takes). */
+export interface StatusSweepLegs {
+    onLocalCollect(): Promise<void>;
+    onRemoteProbed(info: {
+        remote: MachineRow;
+        probe: ProbeResult;
+    }): Promise<void>;
+}
+/**
+ * Compose the dual-responsibility legs over one assembly (a2a-row's single
+ * resolver + shared ingest). Every leg degrades internally — a failure never
+ * breaks probe accounting or the sweep loop.
+ */
+export declare function statusSweepLegs(deps: {
+    home: string;
+    gatewayFor: (addr: A2aAddress) => A2aGateway;
+    ingest: A2aIngest;
+    remoteFaceOf?: RemoteFaceOf;
+    fetchImpl?: typeof fetch;
+}): StatusSweepLegs;

package/superd-hub/dist/agent-status.js

@@ -0,0 +1,386 @@
+/**
+ * Agent status cache + the sweep's dual responsibility legs (postoffice R5;
+ * D18, plan 2026-09-28-machine-mesh-postoffice-rework task board).
+ *
+ * THE CACHE (`<home>/superd/agent-status.json`, 0600 atomic writes —
+ * machines.ts discipline): per machine `{collectedAt, agents: [{a6, rows}]}`,
+ * flat and additive. Rows carry EXACTLY what the session-list payload
+ * exposes — upstream `SessionSummary`
+ * (packages/api/session-controller/src/types.ts:177) is
+ * `{agentAvailable, sessionId, updatedAt, running, blank, parentSessionId?,
+ * origin?, cwd?, projections?}`: status maps `running` directly (true →
+ * 'busy', false → 'idle'), anything else → 'unknown' (Orchestra unknown
+ * discipline — never guess). NOTE: session/list carries NO title — the D18
+ * title overlay is a QUERY-time concern (R6), not a collection fact.
+ *
+ * THE LEGS (both ride the EXISTING reprobe sweep — mesh-link's single timer,
+ * no second probing path):
+ *   - OUTBOX PULL: after each SUCCESSFUL reprobe, claim the peer's buffered
+ *     envelopes (`GET /api/superd/a2a/outbox?machine=<selfId>`, cookie 随行)
+ *     and feed each into the SAME ingest handler the HTTP endpoint uses —
+ *     claim&clear semantics, in order, no dedupe layer. A pull failure
+ *     degrades (log, keep sweeping).
+ *   - SESSION-LIST COLLECTION: per reachable machine, every roster agent's
+ *     session list through the PRESENTATION lane (the federation memo's wire
+ *     faces — D16 presentation exemption, the same lane the /hub family
+ *     browses); local agents (worlds + native) collect the same shape through
+ *     their in-process faces. Failure retention: a machine's rows are only
+ *     replaced by a SUCCESSFUL collection (empty included); a failure keeps
+ *     the previous snapshot and records an error note.
+ */
+import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { ensureSelf } from './machines.js';
+import { cookieOf } from './mesh-link.js';
+import { agentIdMap } from './agent-ids.js';
+import { fetchA2aOutbox } from './a2a-wire.js';
+import { WIRE } from './wire-endpoints.js';
+import { sessionRpc } from './a2a-service.js';
+import { federatedGatewayOf } from './mesh-federate.js';
+import { getTarget } from './targets.js';
+/** Rows kept per agent (payload order; the D18 ≤5 window is R6's query-time concern). */
+export const AGENT_STATUS_ROWS_MAX = 32;
+function statusPath(home) {
+    return join(home, 'superd', 'agent-status.json');
+}
+function isRecord(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+function coerceFile(v) {
+    const out = { machines: {} };
+    const machines = isRecord(v) ? v['machines'] : undefined;
+    if (!isRecord(machines))
+        return out;
+    for (const [m4, raw] of Object.entries(machines)) {
+        if (m4 === '' || !isRecord(raw) || !Array.isArray(raw['agents']))
+            continue;
+        const agents = [];
+        for (const a of raw['agents']) {
+            if (!isRecord(a) || typeof a['a6'] !== 'string' || a['a6'] === '' || !Array.isArray(a['rows']))
+                continue;
+            let workspaces;
+            if (Array.isArray(a['workspaces'])) {
+                workspaces = [];
+                for (const w of a['workspaces']) {
+                    if (!isRecord(w) || typeof w['workspaceId'] !== 'string' || w['workspaceId'] === '' || typeof w['title'] !== 'string')
+                        continue;
+                    workspaces.push({
+                        workspaceId: w['workspaceId'],
+                        title: w['title'],
+                        sessionIds: Array.isArray(w['sessionIds']) ? w['sessionIds'].filter((sid) => typeof sid === 'string') : [],
+                    });
+                }
+            }
+            const rows = [];
+            for (const r of a['rows']) {
+                if (!isRecord(r) || typeof r['sessionId'] !== 'string' || r['sessionId'] === '')
+                    continue;
+                const status = r['status'] === 'busy' || r['status'] === 'idle' || r['status'] === 'unknown' ? r['status'] : 'unknown';
+                rows.push({
+                    sessionId: r['sessionId'],
+                    mtime: typeof r['mtime'] === 'number' ? r['mtime'] : 0,
+                    status,
+                    agentAvailable: r['agentAvailable'] === true,
+                });
+            }
+            agents.push({
+                a6: a['a6'],
+                rows,
+                ...(workspaces === undefined ? {} : { workspaces }),
+                ...(typeof a['error'] === 'string' && a['error'] !== '' ? { error: a['error'] } : {}),
+            });
+        }
+        const machine = {
+            collectedAt: typeof raw['collectedAt'] === 'number' ? raw['collectedAt'] : 0,
+            agents,
+        };
+        if (typeof raw['error'] === 'string' && raw['error'] !== '')
+            machine.error = raw['error'];
+        out.machines[m4] = machine;
+    }
+    return out;
+}
+/** Read the cache; a missing or unreadable/corrupt file degrades to empty (never throws). */
+export function loadAgentStatus(home) {
+    let raw;
+    try {
+        raw = readFileSync(statusPath(home), 'utf8');
+    }
+    catch {
+        return { machines: {} };
+    }
+    try {
+        return coerceFile(JSON.parse(raw));
+    }
+    catch {
+        return { machines: {} };
+    }
+}
+/** Persist the cache: recursive mkdir, tmp write, chmod 0600, atomic rename. */
+function saveAgentStatus(home, file) {
+    const dir = join(home, 'superd');
+    mkdirSync(dir, { recursive: true });
+    const target = statusPath(home);
+    const tmp = `${target}.tmp`;
+    writeFileSync(tmp, JSON.stringify(file, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
+    chmodSync(tmp, 0o600);
+    renameSync(tmp, target);
+}
+/** Record a SUCCESSFUL machine collection — replaces the rows wholesale (empty included), clears the error. */
+export function recordMachineCollection(home, machine, agents, now = Date.now) {
+    if (machine === '')
+        return;
+    const file = loadAgentStatus(home);
+    file.machines[machine] = { collectedAt: now(), agents };
+    saveAgentStatus(home, file);
+}
+/**
+ * Record a machine-level collection FAILURE — the previous snapshot stays
+ * (rows AND its collectedAt: the data's age is what it is) and the error
+ * note says what happened.
+ */
+export function recordMachineFailure(home, machine, error) {
+    if (machine === '')
+        return;
+    const file = loadAgentStatus(home);
+    const prior = file.machines[machine];
+    if (prior === undefined) {
+        file.machines[machine] = { collectedAt: 0, agents: [], error };
+    }
+    else {
+        file.machines[machine] = { ...prior, error };
+    }
+    saveAgentStatus(home, file);
+}
+// ---------------------------------------------------------------- collection
+/**
+ * `workspace/follow` — the workspace face's reconnect-safe STATE verb
+ * (workspace-controller index.ts:199 `@Remote({ mode: 'stream' }) follow(signal)`:
+ * signal-only, no request parameter — the wire payload is a bare `{args:{}}`).
+ * Every generation starts with EXACTLY ONE
+ * `{type:'baseline', value:{items: WorkspaceView[], ...}}` frame; increments
+ * after it are mutations we do not consume. All other verbs on the controller
+ * are mutations (create / rename / delete / insert-before / archive / pin) — excluded.
+ */
+export const WORKSPACE_FOLLOW = 'workspace/follow';
+/** Workspaces kept per agent (join-sized; a host has few). */
+export const AGENT_WORKSPACES_MAX = 32;
+/** One agent's workspace baseline over one face: first frame, abort, join fields only. */
+async function workspaceBaselineOf(face, timeoutMs = 10_000) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const iterable = await face.openWireStream(WORKSPACE_FOLLOW, { args: {} }, controller.signal);
+        const iterator = (await iterable)[Symbol.asyncIterator]();
+        for (;;) {
+            const next = await iterator.next();
+            if (next.done)
+                return [];
+            const frame = next.value;
+            if (!isRecord(frame) || frame['type'] !== 'baseline')
+                continue;
+            const value = isRecord(frame['value']) ? frame['value'] : {};
+            const items = Array.isArray(value['items']) ? value['items'] : [];
+            const out = [];
+            for (const item of items) {
+                if (!isRecord(item) || typeof item['workspaceId'] !== 'string' || item['workspaceId'] === '' || typeof item['title'] !== 'string')
+                    continue;
+                out.push({
+                    workspaceId: item['workspaceId'],
+                    title: item['title'],
+                    sessionIds: Array.isArray(item['sessionIds']) ? item['sessionIds'].filter((sid) => typeof sid === 'string') : [],
+                });
+                if (out.length >= AGENT_WORKSPACES_MAX)
+                    break;
+            }
+            controller.abort(); // baseline consumed — drop the stream now
+            return out;
+        }
+    }
+    finally {
+        controller.abort();
+        clearTimeout(timer);
+    }
+}
+function errMsg(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/** One session-list item → the honest cache row (unknown when the payload doesn't say). */
+function rowOf(item) {
+    if (!isRecord(item) || typeof item['sessionId'] !== 'string' || item['sessionId'] === '')
+        return undefined;
+    const running = item['running'];
+    return {
+        sessionId: item['sessionId'],
+        mtime: typeof item['updatedAt'] === 'number' ? item['updatedAt'] : 0,
+        status: running === true ? 'busy' : running === false ? 'idle' : 'unknown',
+        agentAvailable: item['agentAvailable'] === true,
+    };
+}
+/**
+ * Collect one agent fully: the session list AND the workspace baseline (the
+ * R6 title source). A workspace-leg failure keeps the fresh rows and notes
+ * the error — the title join then falls back honestly ('[unhosted]').
+ */
+async function collectAgent(face, a6) {
+    const rows = await collectAgentRows(face);
+    try {
+        return { a6, rows, workspaces: await workspaceBaselineOf(face) };
+    }
+    catch (error) {
+        return { a6, rows, error: `workspace follow failed — ${errMsg(error)}` };
+    }
+}
+/** One agent's session list over one face (sessionRpc unwraps {ok,value} and applies wireArgsOf's `_request` key). */
+async function collectAgentRows(face) {
+    const value = await sessionRpc(face, WIRE.sessionList, {});
+    const items = isRecord(value) && Array.isArray(value['items']) ? value['items'] : [];
+    const rows = [];
+    for (const item of items) {
+        const row = rowOf(item);
+        if (row !== undefined)
+            rows.push(row);
+        if (rows.length >= AGENT_STATUS_ROWS_MAX)
+            break;
+    }
+    return rows;
+}
+/** The production resolver: the federation memo first, the shared target registry second (the /hub demux order). */
+export function federatedFaceOf(a6) {
+    return federatedGatewayOf(a6) ?? getTarget(a6)?.gateway;
+}
+/**
+ * Record a collection's outcome under the ONE rule this cache already states
+ * for machines: only a SUCCESSFUL collection replaces rows.
+ *
+ * `sessionListFailures` counts the agents whose SESSION LIST leg died (no face,
+ * or the list call rejected) — the leg the rows come from.
+ * `AgentStatusAgent.error` alone cannot carry that verdict: a failed WORKSPACE
+ * (title) leg sets it too while the rows are perfectly fresh. So a collection
+ * in which the session list died for EVERY agent is recorded as a machine-level
+ * FAILURE (O1b, 0.1.8-e): writing it as fresh `rows: []` would let "could not
+ * collect" masquerade as "this agent has no sessions", and would wipe a prior
+ * snapshot that was real. An empty-but-collected machine IS a success.
+ */
+function recordCollection(home, machine, agents, sessionListFailures) {
+    if (agents.length > 0 && sessionListFailures === agents.length) {
+        const why = agents.find((a) => a.error !== undefined)?.error ?? 'unknown error';
+        recordMachineFailure(home, machine, `collection failed for every agent (${agents.length}) — ${why}`);
+        return;
+    }
+    recordMachineCollection(home, machine, agents);
+}
+/**
+ * Collect one REACHABLE machine's session lists over the presentation lane.
+ * Never throws: a machine-level failure records the error and keeps the
+ * previous snapshot; a per-agent failure (no face, rejected list) marks that
+ * agent with an error and empty rows — an honest miss, never a guess.
+ */
+export async function collectRemoteMachine(home, remote, probe, opts = {}) {
+    const faceOf = opts.faceOf ?? federatedFaceOf;
+    if (!probe.ok || !Array.isArray(probe.agents)) {
+        // (unreachable probes never reach the collector — the sweep only calls it
+        // after a SUCCESSFUL reprobe — but the guard stays honest for direct callers)
+        recordMachineFailure(home, remote.id, 'probe did not carry a roster');
+        return;
+    }
+    const agents = [];
+    let sessionListFailures = 0;
+    for (const agent of probe.agents) {
+        if (typeof agent?.id !== 'string' || agent.id === '')
+            continue;
+        try {
+            const face = faceOf(agent.id);
+            if (face === undefined) {
+                agents.push({ a6: agent.id, rows: [], error: 'no gateway face for the session list' });
+                sessionListFailures += 1;
+                continue;
+            }
+            agents.push(await collectAgent(face, agent.id));
+        }
+        catch (error) {
+            agents.push({ a6: agent.id, rows: [], error: errMsg(error) });
+            sessionListFailures += 1;
+        }
+    }
+    // only the SESSION LIST leg counts here: a dead workspace (title) leg keeps
+    // the fresh rows and must not demote the whole collection to a failure
+    recordCollection(home, remote.id, agents, sessionListFailures);
+}
+/**
+ * Collect the LOCAL machine's agents (worlds + native — every a6 in the id
+ * store) through their in-process faces, resolved by the a2a-host local leg.
+ */
+export async function collectLocalMachine(home, gatewayFor) {
+    const self = ensureSelf(home, 'local');
+    const agents = [];
+    let sessionListFailures = 0;
+    for (const [, a6] of Object.entries(agentIdMap(home))) {
+        try {
+            const face = gatewayFor({ machine: self.id, id: a6 });
+            agents.push(await collectAgent(face, a6));
+        }
+        catch (error) {
+            agents.push({ a6, rows: [], error: errMsg(error) });
+            sessionListFailures += 1;
+        }
+    }
+    recordCollection(home, self.id, agents, sessionListFailures);
+}
+// ---------------------------------------------------------------- outbox pull
+/**
+ * Claim (and clear, peer-side) the envelopes buffered for THIS machine and
+ * deliver each through the SAME ingest handler the HTTP endpoint uses — in
+ * order, no dedupe layer (claim&clear is the peer's guarantee). A per-
+ * envelope failure degrades; the claim itself throwing propagates to the
+ * sweep's leg-level swallow.
+ */
+export async function pullOutboxFor(home, remote, ingest, opts = {}) {
+    const self = ensureSelf(home, 'local');
+    const envelopes = await fetchA2aOutbox(remote.origin, self.id, {
+        cookie: cookieOf(remote.id, home),
+        fetchImpl: opts.fetchImpl,
+    });
+    let delivered = 0;
+    for (const envelope of envelopes) {
+        try {
+            await ingest.ingest(envelope);
+            delivered += 1;
+        }
+        catch {
+            // per-envelope degradation — the claim already consumed it peer-side
+        }
+    }
+    return delivered;
+}
+/**
+ * Compose the dual-responsibility legs over one assembly (a2a-row's single
+ * resolver + shared ingest). Every leg degrades internally — a failure never
+ * breaks probe accounting or the sweep loop.
+ */
+export function statusSweepLegs(deps) {
+    return {
+        async onLocalCollect() {
+            try {
+                await collectLocalMachine(deps.home, deps.gatewayFor);
+            }
+            catch {
+                // the local leg degrades — the sweep keeps probing remotes
+            }
+        },
+        async onRemoteProbed({ remote, probe }) {
+            try {
+                await pullOutboxFor(deps.home, remote, deps.ingest, { fetchImpl: deps.fetchImpl });
+            }
+            catch {
+                // pull failure degrades — never breaks probe accounting
+            }
+            try {
+                await collectRemoteMachine(deps.home, remote, probe, { faceOf: deps.remoteFaceOf });
+            }
+            catch (error) {
+                recordMachineFailure(deps.home, remote.id, errMsg(error));
+            }
+        },
+    };
+}