total-recall-brain 3.44.0 → 3.46.0

package/scaffold/.agent/skills/total-recall/plugins/git/ui/chunks/remove-worktree.md

@@ -0,0 +1,23 @@
+---
+type: ui-chunk:chunk
+title: Remove a linked worktree
+description: Review a registered linked worktree, confirm its target, and read the removal result.
+timestamp: "2026-11-08T09:20:00Z"
+plugin: git
+id: remove-worktree
+intents: [remove linked git worktree, clean up isolated checkout, review worktree removal, dirty worktree refused]
+surfaces: [page]
+operations: [worktree-remove]
+data: ["worktree-remove:/ok", "worktree-remove:/removed"]
+---
+
+<style>
+  .sentinel-remove { padding:var(--spacing-md); border-inline-start:3px solid var(--color-danger); background:var(--color-surface); }
+  .sentinel-remove h2 { margin-top:0; }
+  .sentinel-remove small { color:var(--color-muted); }
+</style>
+<section class="sentinel-remove">
+  <h2>Confirm the linked checkout</h2>
+  <p>Select the worktree by path. The Home checks Git’s removal receipt before refreshing the register.</p>
+  <small>Git refuses ordinary removal when the worktree contains local changes.</small>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/git/ui/chunks/repository-ledger.md

@@ -0,0 +1,25 @@
+---
+type: ui-chunk:chunk
+title: Git repository ledger
+description: Read the active checkout, local upstream comparison, dirty files, conflicts, and stashes.
+timestamp: "2026-11-08T09:20:00Z"
+plugin: git
+id: repository-ledger
+intents: [audit git repository, check working tree, git branch and upstream, count unpushed commits, show conflicts and stashes]
+surfaces: [page, right]
+panel: repository
+operations: [audit]
+data: ["audit:/headState", "audit:/upstreamStatus", "audit:/isClean", "audit:/unpushedCommits", "audit:/conflictedFiles", "audit:/totalDirty", "audit:/stashCount", "audit:/timestamp"]
+---
+
+<style>
+  .sentinel-ledger { padding:var(--spacing-md); border-inline-start:3px solid var(--color-accent); color:var(--color-text); background:var(--color-surface); }
+  .sentinel-ledger h2 { margin:.3rem 0; font:600 clamp(1.55rem,5vw,2.2rem) var(--typography-heading-font-family,Georgia,serif); }
+  .sentinel-ledger p { margin:0; }
+  .sentinel-ledger small { text-transform:uppercase; letter-spacing:.11em; color:var(--color-accent); }
+</style>
+<header class="sentinel-ledger">
+  <small>Git</small>
+  <h2>Read the current checkout</h2>
+  <p>Review repository state and its registered worktrees. Ahead and behind come from the local tracking ref.</p>
+</header>

package/scaffold/.agent/skills/total-recall/plugins/git/ui/chunks/unmerged-work.md

@@ -0,0 +1,22 @@
+---
+type: ui-chunk:chunk
+title: Work not in the default branch
+description: Find branches with commits the default branch lacks, worktrees with uncommitted changes and detached worktrees holding commits on no branch.
+timestamp: "2026-11-12T21:30:00Z"
+plugin: git
+id: unmerged-work
+intents: [find unmerged branches, find unfinished worktrees, check for work that never landed, see what is not merged into main]
+surfaces: [page, right]
+operations: [unmerged]
+data: ["unmerged:/outstanding", "unmerged:/summary", "unmerged:/repositories/0/branches", "unmerged:/repositories/0/worktrees", "unmerged:/repositories/0/kept"]
+---
+
+<style>
+  .sentinel-unmerged { padding:var(--spacing-md); border:1px solid var(--color-border); background:var(--color-surface); }
+  .sentinel-unmerged h2 { margin-top:0; }
+  .sentinel-unmerged b { color:var(--color-accent); }
+</style>
+<section class="sentinel-unmerged">
+  <h2>Land what is still outside the default branch</h2>
+  <p>Each branch shows its commits the default branch lacks and whether they are pushed. Each worktree shows its <b>uncommitted</b> files and any commits on no branch, which removing the worktree would lose. Merge or report every item before ending the work.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/git/ui/chunks/upstream-divergence.md

@@ -0,0 +1,17 @@
+---
+type: ui-chunk:chunk
+plugin: git
+id: upstream-divergence
+title: Check branch divergence before integration
+description: Review upstream state and local ahead or behind counts before choosing a branch integration action.
+timestamp: "2026-11-08T23:12:00Z"
+intents: [check commits ahead and behind, inspect missing upstream, prepare branch integration]
+surfaces: [page]
+panel: repository
+operations: [audit]
+data: ["audit:/headState", "audit:/upstreamStatus", "audit:/unpushedCommits", "audit:/behindCommits"]
+---
+<section>
+  <h2>Read branch divergence</h2>
+  <p>Check whether this checkout has an upstream. On a tracked branch, compare commits ahead and behind, then check the working tree before selecting an integration action.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/git/ui/chunks/worktree-conflict-triage.md

@@ -0,0 +1,17 @@
+---
+type: ui-chunk:chunk
+plugin: git
+id: worktree-conflict-triage
+title: Triage conflicts in a linked checkout
+description: Find unresolved conflicts and distinguish them from staged, unstaged and untracked work before opening a diff.
+timestamp: "2026-11-08T23:12:00Z"
+intents: [triage merge conflicts, compare staged and unstaged work during a conflict, inspect dirty worktree before cleanup]
+surfaces: [page]
+panel: repository
+operations: [audit, diff]
+data: ["audit:/conflictedFiles", "audit:/stagedFiles", "audit:/unstagedFiles", "audit:/untrackedFiles", "diff:/diffStat"]
+---
+<section>
+  <h2>Separate conflicts from other local changes</h2>
+  <p>Read the conflict count first. Then open diff statistics for the relevant working or staged changes. Preserve the linked checkout until its local work is resolved.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/git/ui/chunks/worktree-terminal.md

@@ -0,0 +1,22 @@
+---
+type: ui-chunk:chunk
+title: Worktree compatibility commands
+description: Use the owner compatibility command in the terminal to list, create, or remove linked worktrees.
+timestamp: "2026-11-08T09:20:00Z"
+plugin: git
+id: worktree-terminal
+intents: [git sentinel worktree command, worktree compatibility syntax, terminal git worktree list, worktree create remove alias]
+surfaces: [page]
+operations: [worktree]
+data: ["worktree:/ok", "worktree:/worktrees/0/head", "worktree:/removed"]
+---
+
+<style>
+  .sentinel-terminal { padding:var(--spacing-md); border:1px dashed var(--color-border); background:var(--color-surface); }
+  .sentinel-terminal h2 { margin-top:0; }
+  .sentinel-terminal code { color:var(--color-accent); overflow-wrap:anywhere; }
+</style>
+<section class="sentinel-terminal">
+  <h2>Use the compatibility command</h2>
+  <p><code>total-recall git worktree-list</code> reads the register. Select <code>create</code> or <code>remove</code> with the required path for an explicit change.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/git/ui/home.js

@@ -0,0 +1,273 @@
+const UPSTREAM = {
+  tracking: 'Tracking local upstream',
+  none: 'No upstream configured',
+  gone: 'Upstream missing',
+  detached: 'Detached HEAD',
+  unborn: 'No commits yet',
+  unknown: 'Upstream unknown',
+  error: 'Upstream check failed'
+};
+const AUDIT_COUNTS = {
+  unpushed: 'unpushedCommits', behind: 'behindCommits', conflicts: 'conflictedFiles',
+  staged: 'stagedFiles', unstaged: 'unstagedFiles', untracked: 'untrackedFiles',
+  dirty: 'totalDirty', stashes: 'stashCount'
+};
+
+function commandError(error) {
+  try {
+    const result = JSON.parse(error.message);
+    if (typeof result.error === 'string') return result.error;
+  } catch {}
+  return error?.message || 'The owner command failed.';
+}
+
+class GitHome extends HTMLElement {
+  connectedCallback() {
+    if (this.shadowRoot) return;
+    const root = this.attachShadow({ mode: 'open' });
+    root.innerHTML = `
+      <style>
+        :host {
+          display:block; padding:var(--spacing-md,16px); color:var(--color-text,CanvasText);
+          background:var(--color-background,Canvas); border:1px solid var(--color-border,currentColor);
+          border-radius:var(--radius-md,6px); font:14px/1.55 var(--typography-body-font-family,system-ui,sans-serif);
+        }
+        * { box-sizing:border-box; min-width:0; }
+        h2,h3,p,dl { margin:0; }
+        h2 { font:600 clamp(1.55rem,5vw,2.1rem)/1.15 var(--typography-heading-font-family,Georgia,serif); }
+        h3 { font-size:1.05rem; }
+        .kicker { color:var(--color-accent,currentColor); letter-spacing:.1em; text-transform:uppercase; }
+        section { margin-top:var(--spacing-md,16px); padding-top:12px; border-top:1px solid var(--color-border,currentColor); }
+        .bar,.actions { display:flex; align-items:center; flex-wrap:wrap; gap:8px 16px; }
+        .bar { justify-content:space-between; }
+        .metrics { display:grid; grid-template-columns:repeat(auto-fit,minmax(min(100%,7rem),1fr)); gap:8px; margin:10px 0; }
+        .metrics div { padding:8px; background:var(--color-surface,Canvas); border-radius:var(--radius-md,6px); }
+        dd { margin:0; font:600 1.05rem var(--typography-mono-font-family,ui-monospace,monospace); font-variant-numeric:tabular-nums; }
+        dt,.note { color:var(--color-muted,currentColor); }
+        #conflicts[data-alert],#unpushed[data-alert],.error { color:var(--color-danger,currentColor); }
+        #last-commit,#audit-time { overflow-wrap:anywhere; }
+        #worktrees { padding:0; list-style:none; margin:8px 0; }
+        #worktrees li {
+          border-bottom:1px solid var(--color-border,currentColor); padding:8px 0;
+          display:flex; flex-wrap:wrap; align-items:center; gap:8px; justify-content:space-between;
+        }
+        #worktrees code { display:block; overflow-wrap:anywhere; }
+        button,input,select {
+          min-height:44px; border:1px solid var(--color-border,currentColor); border-radius:var(--radius-md,6px);
+          padding:6px 10px; font:inherit; color:inherit; background:var(--color-background,Canvas);
+        }
+        button { cursor:pointer; }
+        button:disabled { opacity:.65; cursor:default; }
+        button:focus-visible,input:focus-visible,select:focus-visible {
+          outline:2px solid var(--color-accent,currentColor); outline-offset:3px;
+        }
+        label { display:grid; gap:4px; }
+        .fields { display:grid; grid-template-columns:repeat(auto-fit,minmax(min(100%,10rem),1fr)); gap:8px; margin:8px 0; }
+        fieldset { margin:12px 0 0; padding:12px; background:var(--color-surface,Canvas); border:1px solid var(--color-border,currentColor); }
+        #confirm-text { overflow-wrap:anywhere; margin-bottom:8px; }
+        pre { overflow:auto; max-height:16rem; white-space:pre-wrap; overflow-wrap:anywhere; }
+      </style>
+      <header class="bar">
+        <div><p class="kicker">Git</p><h2>Repository ledger</h2></div>
+        <button type="button" id="refresh">Refresh repository</button>
+      </header>
+      <section aria-labelledby="audit-heading">
+        <h3 id="audit-heading">Working tree audit</h3>
+        <p id="audit-state" role="status">Reading the repository…</p>
+        <dl class="metrics">
+          <div><dt>Unpushed</dt><dd id="unpushed">—</dd></div>
+          <div><dt>Behind</dt><dd id="behind">—</dd></div>
+          <div><dt>Conflicted</dt><dd id="conflicts">—</dd></div>
+          <div><dt>Staged</dt><dd id="staged">—</dd></div>
+          <div><dt>Unstaged</dt><dd id="unstaged">—</dd></div>
+          <div><dt>Untracked</dt><dd id="untracked">—</dd></div>
+          <div><dt>Dirty files</dt><dd id="dirty">—</dd></div>
+          <div><dt>Stashes</dt><dd id="stashes">—</dd></div>
+        </dl>
+        <p id="upstream" class="note"></p>
+        <p id="last-commit"></p>
+        <p id="audit-time" class="note"></p>
+      </section>
+      <section aria-labelledby="worktree-heading">
+        <h3 id="worktree-heading">Registered worktrees</h3>
+        <p id="worktree-state" role="status">Reading worktree registrations…</p>
+        <ul id="worktrees"></ul>
+        <div id="create" hidden>
+          <div class="fields">
+            <label>New worktree path<input id="path" required></label>
+            <label>Base ref<input id="base" placeholder="HEAD"></label>
+          </div>
+          <button type="button" id="plan-create">Review detached worktree</button>
+        </div>
+        <fieldset id="confirmation" hidden>
+          <legend id="confirm-title"></legend>
+          <p id="confirm-text"></p>
+          <div class="actions">
+            <button type="button" id="confirm"></button>
+            <button type="button" id="cancel">Cancel</button>
+          </div>
+        </fieldset>
+        <p id="action-status" role="status"></p>
+      </section>
+      <section id="changes" hidden aria-label="Diff statistics">
+        <button type="button" id="show-diff" aria-expanded="false" aria-controls="diff">Inspect changed files</button>
+        <div id="diff" hidden>
+          <div class="fields">
+            <label>Comparison<select id="diff-mode"><option value="working">Working tree</option><option value="staged">Staged changes</option></select></label>
+            <label>Base ref<input id="diff-base" placeholder="Default comparison"></label>
+          </div>
+          <button type="button" id="read-diff">Read diff stats</button>
+          <p id="diff-status" role="status"></p>
+          <pre id="diff-stat"></pre>
+        </div>
+      </section>`;
+
+    const field = id => root.getElementById(id);
+    const set = (id, text) => { field(id).textContent = text; };
+    const canRun = command => this.host?.operations?.includes(command);
+    const run = async (command, args = []) => {
+      if (!this.host?.run) throw new Error('The repository command runner is unavailable.');
+      return this.host.run(command, args);
+    };
+    let busy = false;
+    let pending;
+
+    field('create').hidden = !canRun('worktree-create');
+    field('changes').hidden = !canRun('diff');
+
+    const setBusy = value => {
+      busy = value;
+      for (const control of root.querySelectorAll('#refresh, #plan-create, #worktrees button')) control.disabled = value;
+    };
+
+    const ask = (command, args, target, base = '') => {
+      if (busy || !canRun(command)) return;
+      const creating = command === 'worktree-create';
+      pending = { command, args, trigger: root.activeElement };
+      set('confirm-title', creating ? 'Create a detached worktree?' : 'Remove this linked worktree?');
+      set('confirm-text', creating ? `${target} from ${base}` : `${target}. Git will refuse removal if it contains local changes.`);
+      set('confirm', creating ? 'Confirm creation' : 'Confirm removal');
+      field('confirmation').hidden = false;
+      field('confirm').focus();
+    };
+
+    const paintAudit = report => {
+      for (const [id, key] of Object.entries(AUDIT_COUNTS)) {
+        const value = report?.[key];
+        set(id, Number.isSafeInteger(value) ? String(value) : '—');
+        field(id).toggleAttribute('data-alert', value > 0);
+      }
+      if (!report) {
+        set('audit-state', 'Repository audit unavailable.');
+        for (const id of ['upstream', 'last-commit', 'audit-time']) set(id, '');
+        return;
+      }
+      const branch = report.branch || UPSTREAM[report.headState] || 'Branch unknown';
+      const state = report.isClean === true ? 'Clean working tree' : report.isClean === false ? 'Changes in working tree' : 'Working tree state unknown';
+      const incomplete = Array.isArray(report.errors) && report.errors.length ? ' Some audit checks failed.' : '';
+      set('audit-state', `${branch} · ${state}.${incomplete}`);
+      const upstream = UPSTREAM[report.upstreamStatus] || 'Upstream unknown';
+      set('upstream', report.upstream ? `${upstream} ${report.upstream}.` : upstream);
+      set('last-commit', report.lastCommit || 'Latest commit unavailable.');
+      set('audit-time', report.timestamp ? `Observed ${report.timestamp}` : '');
+    };
+
+    const paintWorktrees = result => {
+      field('worktrees').replaceChildren();
+      if (!result) { set('worktree-state', 'Worktree inventory unavailable.'); return; }
+      set('worktree-state', `${result.worktrees.length} registered.`);
+      result.worktrees.forEach((tree, index) => {
+        const row = document.createElement('li');
+        const label = document.createElement('div');
+        const name = document.createElement('strong');
+        const path = document.createElement('code');
+        const current = tree.path === result.current;
+        const branch = tree.branch?.replace(/^refs\/heads\//, '') || (tree.detached ? 'Detached' : 'Branch unknown');
+        const markers = [index === 0 && 'Main', current && 'Current', tree.locked && 'Locked', tree.prunable && 'Prunable'].filter(Boolean);
+        name.textContent = [branch, ...markers, tree.head?.slice(0, 12)].filter(Boolean).join(' · ');
+        path.textContent = tree.path;
+        label.append(name, path);
+        row.append(label);
+        if (canRun('worktree-remove') && index > 0 && !current && !tree.locked && !tree.prunable) {
+          const remove = document.createElement('button');
+          remove.type = 'button';
+          remove.textContent = 'Review removal';
+          remove.setAttribute('aria-label', `Review removal of ${tree.path}`);
+          remove.addEventListener('click', () => ask('worktree-remove', ['--', tree.path], tree.path));
+          row.append(remove);
+        }
+        field('worktrees').append(row);
+      });
+    };
+
+    const refresh = async () => {
+      if (busy) return;
+      pending = undefined;
+      field('confirmation').hidden = true;
+      setBusy(true);
+      set('audit-state', 'Reading the repository…');
+      set('worktree-state', 'Reading worktree registrations…');
+      try {
+        await Promise.all([
+          run('audit').then(result => paintAudit(typeof result?.headState === 'string' ? result : null), () => paintAudit(null)),
+          run('worktree-list').then(result => paintWorktrees(result?.ok === true && Array.isArray(result.worktrees) ? result : null), () => paintWorktrees(null))
+        ]);
+      } finally { setBusy(false); }
+    };
+
+    field('refresh').addEventListener('click', () => void refresh());
+    field('plan-create').addEventListener('click', () => {
+      const target = field('path').value;
+      if (!target.trim()) return;
+      const base = field('base').value.trim() || 'HEAD';
+      ask('worktree-create', ['--base', base, '--', target], target, base);
+    });
+    field('cancel').addEventListener('click', () => {
+      const trigger = pending?.trigger;
+      pending = undefined;
+      field('confirmation').hidden = true;
+      trigger?.focus();
+    });
+    field('confirm').addEventListener('click', async () => {
+      if (busy || !pending || !canRun(pending.command)) return;
+      const { command, args } = pending;
+      pending = undefined;
+      field('confirmation').hidden = true;
+      setBusy(true);
+      set('action-status', 'Running the confirmed worktree action…');
+      try {
+        const result = await run(command, args);
+        if (result?.ok !== true) throw new Error('Git did not confirm the requested worktree change.');
+        set('action-status', result.removed ? 'Linked worktree removed.' : 'Detached worktree created.');
+        if (command === 'worktree-create') {
+          field('path').value = '';
+          field('base').value = '';
+        }
+      } catch (error) { set('action-status', commandError(error)); }
+      finally { setBusy(false); await refresh(); field('refresh').focus(); }
+    });
+    field('show-diff').addEventListener('click', event => {
+      field('diff').hidden = !field('diff').hidden;
+      event.currentTarget.setAttribute('aria-expanded', String(!field('diff').hidden));
+    });
+    field('read-diff').addEventListener('click', async () => {
+      if (!canRun('diff') || field('read-diff').disabled) return;
+      const base = field('diff-base').value.trim();
+      const args = [...(field('diff-mode').value === 'staged' ? ['--cached'] : []), ...(base ? ['--base', base] : [])];
+      field('read-diff').disabled = true;
+      set('diff-status', 'Reading diff stats…');
+      set('diff-stat', '');
+      try {
+        const result = await run('diff', args);
+        if (typeof result?.diffStat !== 'string') throw new Error('Diff statistics unavailable.');
+        const outcome = result.diffStat ? 'Comparison complete.' : 'The selected comparison has no changes.';
+        set('diff-status', result.timestamp ? `${outcome} Observed ${result.timestamp}.` : outcome);
+        set('diff-stat', result.diffStat);
+      } catch (error) { set('diff-status', commandError(error)); }
+      finally { field('read-diff').disabled = false; }
+    });
+    void refresh();
+  }
+}
+
+if (!customElements.get('tr-git-home')) customElements.define('tr-git-home', GitHome);

package/scaffold/.agent/skills/total-recall/plugins/mesh/DESIGN.md

@@ -0,0 +1,35 @@
+---
+name: Mesh Network Atlas
+description: A pine and slate field atlas for reading a private fleet.
+colors:
+  background: "#14221e"
+  surface: "#1f322b"
+  text: "#edf8f0"
+  border: "#617e70"
+  muted: "#bfdbcc"
+  accent: "#bbefd2"
+  ok: "#a3e8b9"
+  warn: "#ffdf99"
+  danger: "#ffbcb2"
+typography:
+  body:
+    fontFamily: "system-ui, sans-serif"
+  heading:
+    fontFamily: "Georgia, serif"
+  mono:
+    fontFamily: "ui-monospace, monospace"
+spacing:
+  md: 16px
+rounded:
+  md: 8px
+---
+
+# Mesh Network Atlas
+
+Use the tone of a field atlas. The ink surface holds a persistent control strip and a quiet roster of machines. Use a serif title, plain sans-serif labels, and monospace for a verified address, command, or timing. Use warm warning colors only when an observation needs attention.
+
+In Machines, let the roster and reachability ladder share a row at wide widths and stack in that order in a drawer. The ladder keeps control membership, path, login, and execution distinct. State words accompany any color or border changes. Separate recorded facts and their timestamps from current observations. A sleeping or offline device is different from a peer whose path failed a probe.
+
+Flows, Placement, Boundary, and Join use the same map vocabulary. Give each source its own timestamp and unavailable state. The control strip distinguishes credential presence in Auth from a verified control API. Request fleet execution explicitly. The enrollment workflow hands key issuance to an interactive terminal.
+
+Keep targets at least 44 pixels tall. Preserve keyboard focus on refresh, use a visible outline, and announce read failures through the status region. Layout changes need no animation. The [platform map](docs/MESH_PLATFORM.md) records what the current owner commands can observe.

package/scaffold/.agent/skills/total-recall/plugins/mesh/README.md

@@ -24,25 +24,24 @@ Peers install it with `npx total-recall plugin install peer:<this-node>/mesh`.
 ## Features
 
 - **Identifier**: `mesh`
-- **Version**: 0.1.0
 - **SSSS Category**: `mesh-nodes`
 - **CLI Command**: `npx total-recall mesh`
-- **UI**: `ui/card.js` is the declared card component and uses `ui/DESIGN.md` tokens.
+- **UI**: native Mesh Home, [owner design](DESIGN.md), and SSSS blocks under `ui/chunks/`.
 - **API key**: paste it in the plugin UI (`save-token` event) or pipe it to `npx total-recall mesh token set --stdin`; stored as `HEADSCALE_API_KEY` in the secrets store
 
 ## Install and vendor
 
-Install the full integration with `total-recall plugin install <git URL of this repository>`. The declared standalone artifact is the control and SSH helper capability under `capability/`. The manifest lists its exports and [the capability entry](capability/index.mjs) exposes them. A consumer integration guide and independent proof remain open. The Total Recall card, host routes and auth/grant integration belong to the installed plugin.
+Install the full integration with `total-recall plugin install <git URL of this repository>`. The declared standalone artifact is the control and SSH helper capability under `capability/`. The manifest lists its exports and [the capability entry](capability/index.mjs) exposes them. A consumer integration guide and independent proof remain open. Mesh Home, host routes, and Auth and grant integration belong to the installed plugin.
 
 The [Mesh project tracker](docs/projects/in-progress/MESH_CARD/MESH_CARD_PROJECT_TRACKER.md) separates runtime transport and authorization work from card checks.
 
 ## Mesh screens and integration declarations
 
-The card defines Machines, Flows, Placement, Boundary and Join. Machines separates control membership, path checks, recorded login and actual execution. Hardware cells retain their measurement dates; failed or untested runtime probes remain unknown. Placement filters confirmed capabilities and includes the integration matrix declared in `plugin.json.mesh`.
+Mesh Home defines Machines, Flows, Placement, Boundary, and Join. Machines separates control membership, path checks, recorded login, and actual execution. Hardware cells retain their measurement dates. Failed or untested runtime probes remain unknown. Select **Verify fleet execution** to run `doctor`. Placement filters confirmed capabilities and includes the integration matrix declared in `plugin.json.mesh`.
 
 `total-recall mesh view <machines|flows|placement|boundary|join> --json` reads fixed owner commands. Each source carries its command, attempt time and either data or an explicit error. `mesh.provides` references declared operations/runtime modules; `mesh.integrations` identifies each owner and the meaning of its evidence; `mesh.endpoints` identifies served peer routes. These are declarations, not primitive grants or proof every provider action works. Read-only views never perform enrollment, policy changes, grant edits, deployments or secret transfers.
 
-The dashboard supplies frozen `host.operations`. Read-only cards show CLI handoffs for login administration and re-enrollment. A writable host may expose those declared actions; re-enrollment then requires target-specific confirmation. Enrollment keys never enter the card.
+The dashboard supplies frozen `host.operations`. A read-only Home shows CLI handoffs for login administration and re-enrollment. A writable host can expose those declared actions with target-specific confirmation for re-enrollment. Enrollment key issuance stays in the interactive terminal. `mesh token-status --json` reports credential presence from Auth.
 
 Auth's `host-secrets-store` runtime supplies the single host-store selector for control credentials and mesh-sync authentication. Project `AGENT_DIR`/`TR_BRAIN` cannot divert these reads. Native SSSS audit contention is serialized by the generic host; errors still fail closed. The corresponding source runtime must be installed; missing modules never select a fallback implementation.
 

package/scaffold/.agent/skills/total-recall/plugins/mesh/cli.mjs

@@ -46,15 +46,21 @@ export async function run(argv = []) {
     if (!result.success) process.exitCode = 1;
     return;
   }
+  if (sub === 'token-status' || (sub === 'token' && (!args[1] || args[1] === 'status'))) {
+    if (sub === 'token-status' && args.slice(1).some(arg => arg !== '--json')) {
+      throw new Error('token-status accepts only --json');
+    }
+    const meta = await findHeadscaleKeyMeta(brainDir);
+    const present = Boolean(meta?.set);
+    console.log(JSON.stringify(sub === 'token-status' ? { present } : { present, secretKey: 'HEADSCALE_API_KEY' }));
+    return;
+  }
   if (sub === 'token') {
     if (args[1] === 'set' && args.includes('--stdin')) {
       const chunks = []; for await (const chunk of process.stdin) chunks.push(chunk);
       const config = JSON.parse(process.env.TR_PLUGIN_CONFIG || '{}');
       const at = args.indexOf('--url'); if (at >= 0) config.controlUrl = args[at + 1];
       console.log(JSON.stringify(await saveCredential({ key: 'HEADSCALE_API_KEY', value: Buffer.concat(chunks).toString('utf8').trim(), configuration: config, brainDir: process.env.TR_SECRETS_BRAIN || brainDir })));
-    } else if (!args[1] || args[1] === 'status') {
-      const meta = await findHeadscaleKeyMeta(brainDir);
-      console.log(JSON.stringify({ present: !!meta?.set, secretKey: 'HEADSCALE_API_KEY' }));
     } else throw new Error('token <status|set --stdin [--url URL]>');
     return;
   }

package/scaffold/.agent/skills/total-recall/plugins/mesh/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "tr-plugin-mesh",
-  "version": "0.2.9",
+  "version": "0.3.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "tr-plugin-mesh",
-      "version": "0.2.9",
+      "version": "0.3.0",
       "license": "MIT",
       "dependencies": {
         "@gregiteen/ssss-cli": "0.14.5",
@@ -15,7 +15,7 @@
       "devDependencies": {
         "jsdom": "^29.1.1",
         "supertest": "^7.3.1",
-        "total-recall-brain": "3.43.3",
+        "total-recall-brain": "3.45.0",
         "vitest": "^4.1.12"
       }
     },
@@ -7177,9 +7177,9 @@
       }
     },
     "node_modules/total-recall-brain": {
-      "version": "3.43.3",
-      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.43.3.tgz",
-      "integrity": "sha512-yjfPN/BQxEEa+iodyFXQov/6fRt1pZg/7RcmgsbpALwBt6Ki3JJjT3tzArBC7NxHQmXgGYyKnCYId6xe/W2rPg==",
+      "version": "3.45.0",
+      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.45.0.tgz",
+      "integrity": "sha512-HDYfROazZbsLHQsFPnlBcSpe1HL1QEi7JG8x/eNRUI06RxVQsZWl8LwBo2lTWjWRDrKmCy7BUmSXQDuWF3lrEw==",
       "dev": true,
       "license": "MIT",
       "workspaces": [
@@ -7187,7 +7187,7 @@
       ],
       "dependencies": {
         "@simplewebauthn/server": "^13.3.2",
-        "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.4",
+        "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.5",
         "bcrypt": "^6.0.0",
         "better-sqlite3": "^12.11.1",
         "cookie-parser": "^1.4.7",

package/scaffold/.agent/skills/total-recall/plugins/mesh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tr-plugin-mesh",
-  "version": "0.2.9",
+  "version": "0.3.0",
   "type": "module",
   "description": "Headscale and Tailscale SSH control-server mesh administration and node discovery",
   "scripts": {
@@ -15,6 +15,7 @@
   "files": [
     "cli.mjs",
     "plugin.json",
+    "DESIGN.md",
     "README.md",
     "LICENSE",
     "ui/",