total-recall-brain 3.44.0 → 3.46.0

package/scaffold/.agent/skills/total-recall/plugins/mesh/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "mesh",
   "name": "Headscale",
-  "version": "0.2.9",
+  "version": "0.3.0",
   "description": "Control-server mesh administration, Tailscale SSH, and peer node discovery.",
   "license": "MIT",
   "requires": [
@@ -22,34 +22,6 @@
       "url": "https://headscale.net"
     }
   },
-  "card_face": {
-    "skin": "mesh-telemetry",
-    "theme": "vibrant",
-    "headline": "Mesh Control Deck",
-    "primary_color": "#2563eb",
-    "secondary_color": "#1e3a8a",
-    "accent_color": "#3b82f6",
-    "quick_actions": [
-      {
-        "subcommand": "status",
-        "label": "STATUS"
-      },
-      {
-        "subcommand": "nodes",
-        "label": "NODES"
-      },
-      {
-        "subcommand": "doctor",
-        "label": "DOCTOR"
-      },
-      {
-        "subcommand": "leader",
-        "label": "LEADER"
-      }
-    ],
-    "touch_layout": "comfortable",
-    "interactive": true
-  },
   "ssss_schemas": {
     "categories": [
       {
@@ -222,7 +194,8 @@
         "name": "preauthkey",
         "description": "Issue a secret enrollment key to an interactive terminal",
         "effect": "write",
-        "output": "text"
+        "output": "text",
+        "sensitive_output": true
       },
       {
         "name": "policy",
@@ -234,6 +207,12 @@
         "description": "Mesh probe operation",
         "effect": "read"
       },
+      {
+        "name": "token-status",
+        "description": "Check whether Auth has a saved mesh credential",
+        "effect": "read",
+        "output": "json"
+      },
       {
         "name": "token",
         "description": "Mesh token operation",
@@ -262,14 +241,40 @@
     ]
   },
   "ui": {
-    "design_tokens": "ui/DESIGN.md",
+    "design_tokens": "DESIGN.md",
+    "home": "network",
     "elements": [
+      {
+        "id": "network",
+        "kind": "panel",
+        "tag": "mesh-home",
+        "module": "ui/home.js",
+        "description": "Mesh network atlas",
+        "tokens": [
+          "color-background",
+          "color-surface",
+          "color-text",
+          "color-border",
+          "spacing-md",
+          "radius-md"
+        ],
+        "optional_tokens": [
+          "color-muted",
+          "color-accent",
+          "color-ok",
+          "color-warn",
+          "color-danger",
+          "typography-body-font-family",
+          "typography-heading-font-family",
+          "typography-mono-font-family"
+        ]
+      },
       {
         "id": "panel",
         "kind": "panel",
         "tag": "mesh-panel",
         "module": "ui/panel.js",
-        "description": "Mesh panel",
+        "description": "Mesh credential setup through Auth",
         "events": [
           "save-token"
         ],
@@ -287,13 +292,6 @@
             "description": "Printed by `total-recall mesh token status --json`: { present, secretKey }"
           }
         }
-      },
-      {
-        "id": "card",
-        "kind": "card",
-        "tag": "tr-mesh-card",
-        "module": "ui/card.js",
-        "description": "Meshlink Card Face"
       }
     ]
   },

package/scaffold/.agent/skills/total-recall/plugins/mesh/src/cli/mesh.mjs

@@ -50,6 +50,8 @@ function printHelp() {
     view <screen>          Read Machines, Flows, Placement, Boundary or Join sources (--json)
     doctor                 Probe reachability & compute capabilities across all nodes
     nodes                  List mesh nodes and how to reach each one
+    token-status           Read whether Auth has a saved mesh credential (--json)
+    token status           Show credential presence and its Auth binding
     ssh <node> [cmd…]      Open a session using the node's recorded access
     exec <node> <cmd…>     Execute a command on a node non-interactively (--json)
     leader [--json]        Show the elected leader and its server port
@@ -226,7 +228,7 @@ export default async function meshCli(argv = []) {
           error: null
         };
         nodeInfo.tested_runtimes = ['ollama', 'docker', 'node', 'git'];
-        nodeInfo.tested_harnesses = ['agy', 'claude', 'codex', 'gemini'];
+        nodeInfo.tested_harnesses = ['agy', 'claude', 'codex'];
 
         if (node.self) {
           try {
@@ -239,7 +241,7 @@ export default async function meshCli(argv = []) {
           nodeInfo.reachable = true;
         } else if (resolved.complete) {
           try {
-            const probeCmd = 'echo "agy=$(which agy 2>/dev/null) claude=$(which claude 2>/dev/null) codex=$(which codex 2>/dev/null) gemini=$(which gemini 2>/dev/null) ollama=$(which ollama 2>/dev/null) docker=$(which docker 2>/dev/null) node=$(which node 2>/dev/null) git=$(which git 2>/dev/null)"';
+            const probeCmd = 'echo "agy=$(which agy 2>/dev/null) claude=$(which claude 2>/dev/null) codex=$(which codex 2>/dev/null) ollama=$(which ollama 2>/dev/null) docker=$(which docker 2>/dev/null) node=$(which node 2>/dev/null) git=$(which git 2>/dev/null)"';
             const { execMeshCommand } = await import('../core/mesh.mjs');
             // Cloud peers routinely need several seconds; a 4 s budget reported
             // reachable machines as down.
@@ -250,7 +252,7 @@ export default async function meshCli(argv = []) {
               for (const part of parts) {
                 const [k, v] = part.split('=');
                 if (v && v.trim()) {
-                  if (['agy', 'claude', 'codex', 'gemini'].includes(k)) {
+                  if (nodeInfo.tested_harnesses.includes(k)) {
                     nodeInfo.harnesses.push(k);
                   } else {
                     nodeInfo.runtimes.push(k);

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/active-device-dispatch.md

@@ -0,0 +1,22 @@
+---
+type: ui-chunk:chunk
+title: Mesh dispatch receipt
+description: Send a command to an explicit or freshly active device and inspect whether dispatch succeeded.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: active-device-dispatch
+intents: [send command to active device, dispatch mesh task, inspect dispatch result, run on selected machine]
+surfaces: [page]
+operations: [dispatch]
+data: ["dispatch:/dispatched", "dispatch:/is_local", "dispatch:/timestamp"]
+---
+
+<style>
+  .mesh-dispatch { padding:var(--spacing-md); border-inline-start:3px solid var(--color-accent); background:var(--color-surface); }
+  .mesh-dispatch h2 { margin-top:0; }
+  .mesh-dispatch strong { color:var(--color-accent); }
+</style>
+<section class="mesh-dispatch">
+  <h2>Read where dispatch ran</h2>
+  <p>Supply an explicit target or let Mesh resolve a device from fresh presence. The receipt records whether the command dispatched and whether it ran <strong>locally or on a peer</strong>.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/control-probe.md

@@ -0,0 +1,25 @@
+---
+type: ui-chunk:chunk
+title: Mesh control verification
+description: Check the control API and local mesh network as independent observations.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: control-probe
+intents: [verify mesh control API, probe control server, troubleshoot Headscale API, check control plane health]
+surfaces: [page, right]
+operations: [probe]
+data: ["probe:/control/verified", "probe:/control/state", "probe:/network_available"]
+---
+
+<style>
+  .mesh-probe { padding:var(--spacing-md); background:var(--color-surface); border-inline-start:3px solid var(--color-accent); }
+  .mesh-probe h2 { margin-top:0; }
+  .mesh-probe li + li { margin-top:.4em; }
+</style>
+<section class="mesh-probe">
+  <h2>Test the control API</h2>
+  <ul>
+    <li>Read whether the authenticated control API was verified.</li>
+    <li>Check local mesh network availability separately.</li>
+  </ul>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/control-server.md

@@ -0,0 +1,22 @@
+---
+type: ui-chunk:chunk
+title: Recorded mesh control server
+description: Check whether the local owner has a recorded provisioning target for the control server.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: control-server
+intents: [inspect mesh server provisioning, manage Headscale control server, check recorded server target, mesh server update]
+surfaces: [page]
+operations: [server]
+data: ["server:/provisioned"]
+---
+
+<style>
+  .mesh-server { padding:var(--spacing-md); background:var(--color-surface); border:1px solid var(--color-border); }
+  .mesh-server h2 { margin-top:0; }
+  .mesh-server code { color:var(--color-accent); }
+</style>
+<section class="mesh-server">
+  <h2>Inspect the provisioning record</h2>
+  <p>Run <code>server status</code> for the recorded control-server target. Use the control probe to verify the service that is answering now.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/credential-readiness.md

@@ -0,0 +1,23 @@
+---
+type: ui-chunk:chunk
+title: Mesh credential readiness
+description: Check whether Auth has the shared mesh credential, and use Auth to manage its value.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: credential-readiness
+intents: [is mesh key configured, check mesh token status, save shared mesh credential, refresh Headscale auth]
+surfaces: [page, right]
+operations: [token-status, token]
+data: ["token-status:/present", "token:/present"]
+---
+
+<style>
+  .mesh-auth { padding:var(--spacing-md); background:var(--color-surface); border-radius:var(--radius-md); }
+  .mesh-auth h2 { margin:.25em 0; }
+  .mesh-auth small { color:var(--color-accent); font-weight:600; }
+</style>
+<section class="mesh-auth">
+  <small>Total Recall Auth</small>
+  <h2>Read credential presence</h2>
+  <p>Mesh Home reports whether the shared credential is saved. Check control verification separately. Use the credential setup panel to manage the value through Auth.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/elected-leader.md

@@ -0,0 +1,22 @@
+---
+type: ui-chunk:chunk
+title: Elected mesh leader
+description: Inspect the election strategy, leader server port, and this machine's leader role.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: elected-leader
+intents: [who is mesh leader, mesh leader election, leader port, is this machine leader]
+surfaces: [page, right]
+operations: [leader]
+data: ["leader:/leader/strategy", "leader:/leader/port", "leader:/is_current_node_leader"]
+---
+
+<style>
+  .mesh-leader { padding:var(--spacing-md); background:var(--color-surface); border-radius:var(--radius-md); }
+  .mesh-leader h2 { margin-top:0; }
+  .mesh-leader p { color:var(--color-muted); margin-bottom:0; }
+</style>
+<section class="mesh-leader">
+  <h2>Read the election</h2>
+  <p>See how the leader was selected, which server port was reported, and whether this machine leads the fleet.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/enrollment-key.md

@@ -0,0 +1,22 @@
+---
+type: ui-chunk:chunk
+title: Mesh enrollment key handoff
+description: Issue an enrollment credential in an interactive terminal for the intended new machine.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: enrollment-key
+intents: [create mesh enrollment key, add a device to private mesh, issue preauth key, terminal enrollment credential]
+surfaces: [page]
+operations: [preauthkey]
+---
+
+<style>
+  .mesh-key { padding:var(--spacing-md); border:1px dashed var(--color-border); background:var(--color-surface); }
+  .mesh-key h2 { margin-top:0; }
+  .mesh-key code { color:var(--color-accent); overflow-wrap:anywhere; }
+</style>
+<section class="mesh-key">
+  <h2>Issue the key in a terminal</h2>
+  <p>Run <code>total-recall mesh preauthkey</code> in the interactive terminal and pass the credential directly to the intended machine.</p>
+  <p>Choose reusable or ephemeral enrollment only when it matches that machine’s role.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/file-receipt.md

@@ -0,0 +1,25 @@
+---
+type: ui-chunk:chunk
+title: Verified mesh file transfer
+description: Send one bounded file and verify the destination byte count and SHA-256.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: file-receipt
+intents: [copy file to mesh peer, verify mesh file transfer, check destination checksum, send file through mesh]
+surfaces: [page]
+operations: [file]
+data: ["file:/ok", "file:/bytes", "file:/sha256"]
+---
+
+<style>
+  .mesh-receipt { padding:var(--spacing-md); background:var(--color-surface); border:1px solid var(--color-border); }
+  .mesh-receipt h2 { margin-top:0; }
+  .mesh-receipt li::marker { color:var(--color-ok); }
+</style>
+<section class="mesh-receipt">
+  <h2>Read a transfer receipt</h2>
+  <ol>
+    <li>Choose a peer, source file, and destination explicitly.</li>
+    <li>Read the destination byte count and SHA-256 after the transfer.</li>
+  </ol>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/fleet-execution.md

@@ -0,0 +1,23 @@
+---
+type: ui-chunk:chunk
+title: Fleet execution and capabilities
+description: Verify which configured nodes can run a probe and which runtimes or harnesses they expose.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: fleet-execution
+intents: [verify mesh execution, find node with Docker, check available harnesses, diagnose fleet compute capability]
+surfaces: [page]
+operations: [doctor]
+data: ["doctor:/0/reachable", "doctor:/0/runtimes", "doctor:/0/harnesses"]
+---
+
+<style>
+  .mesh-execution { padding:var(--spacing-md); border-inline-start:3px solid var(--color-ok); background:var(--color-surface); }
+  .mesh-execution h2 { margin-top:0; }
+  .mesh-execution em { color:var(--color-muted); }
+</style>
+<section class="mesh-execution">
+  <h2>Verify where work can run</h2>
+  <p>Request the execution probe before using the Placement matrix. An answering node can report the runtimes and harnesses it found.</p>
+  <p><em>A failed probe leaves that node’s capabilities unknown.</em></p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/fleet-presence.md

@@ -0,0 +1,23 @@
+---
+type: ui-chunk:chunk
+title: Fresh mesh presence
+description: Observe recent activity evidence from reachable peers and check when the fleet observation was made.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: fleet-presence
+intents: [check fleet presence, find active mesh device, see idle evidence, last peer activity]
+surfaces: [page, right, bottom]
+operations: [presence]
+data: ["presence:/success", "presence:/timestamp", "presence:/peers/0/state"]
+---
+
+<style>
+  .mesh-presence { padding:var(--spacing-md); background:var(--color-surface); border-block-end:1px solid var(--color-border); }
+  .mesh-presence h2 { margin-top:0; }
+  .mesh-presence em { color:var(--color-muted); }
+</style>
+<section class="mesh-presence">
+  <h2>Read current device activity</h2>
+  <p>Check whether the peer answered with a fresh activity observation. Use the observation time to distinguish fresh presence from an earlier record.</p>
+  <p><em>Unavailable presence remains unknown.</em></p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/interactive-ssh.md

@@ -0,0 +1,22 @@
+---
+type: ui-chunk:chunk
+title: Interactive mesh SSH
+description: Open a terminal session to a peer using its recorded login and authenticated mesh access.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: interactive-ssh
+intents: [SSH to mesh node, open peer terminal, interactive remote shell, log into fleet machine]
+surfaces: [page, bottom]
+operations: [ssh]
+---
+
+<style>
+  .mesh-shell { padding:var(--spacing-md); background:var(--color-surface); }
+  .mesh-shell h2 { margin-top:0; }
+  .mesh-shell code { display:block; overflow-wrap:anywhere; padding:.55em; background:var(--color-background); color:var(--color-accent); }
+</style>
+<section class="mesh-shell">
+  <h2>Continue in a terminal</h2>
+  <p>Use the peer’s recorded access to open an interactive session.</p>
+  <code>total-recall mesh ssh &lt;peer&gt;</code>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/local-enrollment.md

@@ -0,0 +1,23 @@
+---
+type: ui-chunk:chunk
+title: This machine's mesh enrollment
+description: Inspect local enrollment and backend state and determine whether unattended enrollment is enabled.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: local-enrollment
+intents: [check mesh enrollment, join private mesh, re-enroll local machine, inspect mesh backend]
+surfaces: [page, right]
+operations: [enroll]
+data: ["enroll:/state", "enroll:/backend_state", "enroll:/auto_enroll_enabled"]
+---
+
+<style>
+  .mesh-join { padding:var(--spacing-md); background:var(--color-surface); border-inline-start:3px solid var(--color-warn); }
+  .mesh-join h2 { margin-top:0; }
+  .mesh-join small { color:var(--color-muted); }
+</style>
+<section class="mesh-join">
+  <h2>Check how this machine joined</h2>
+  <p>Read <code>enroll --status</code> for the local enrollment state, backend state, and unattended enrollment setting.</p>
+  <small>Re-enrollment can interrupt this machine’s connection. Confirm the target before changing it.</small>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/mesh-policy.md

@@ -0,0 +1,23 @@
+---
+type: ui-chunk:chunk
+title: Mesh access policy
+description: Inspect whether the control server has a policy and when its current policy was recorded.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: mesh-policy
+intents: [inspect mesh policy, audit network ACL, review SSH grants, change mesh trust policy]
+surfaces: [page]
+operations: [policy]
+data: ["policy:/configured", "policy:/updatedAt"]
+---
+
+<style>
+  .mesh-policy { padding:var(--spacing-md); border-block:1px solid var(--color-border); background:var(--color-surface); }
+  .mesh-policy h2 { margin-top:0; }
+  .mesh-policy code { color:var(--color-warn); }
+</style>
+<section class="mesh-policy">
+  <h2>Review the trust boundary</h2>
+  <p>Read the control server policy with <code>policy get</code>. Review who can reach each destination before replacing a policy.</p>
+  <p>The Boundary view presents policy and secret grants as separate observations.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/network-atlas.md

@@ -0,0 +1,25 @@
+---
+type: ui-chunk:chunk
+title: Mesh network atlas
+description: Read current network, control API, and enrollment observations for the private fleet.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: network-atlas
+intents: [mesh overview, fleet connectivity, check mesh network, control server verified, inspect enrolled machines]
+surfaces: [page, right]
+panel: network
+operations: [status]
+data: ["status:/state", "status:/control/verified", "status:/enrollment/state", "status:/observed_at"]
+---
+
+<style>
+  .mesh-atlas { color:var(--color-text); background:var(--color-surface); padding:var(--spacing-md); border-inline-start:3px solid var(--color-accent); }
+  .mesh-atlas h2 { margin:.3em 0; font:600 clamp(1.6rem,5vw,2.3rem) var(--typography-heading-font-family,Georgia,serif); }
+  .mesh-atlas p { margin:0; }
+  .mesh-atlas small { letter-spacing:.12em; text-transform:uppercase; color:var(--color-accent); }
+</style>
+<header class="mesh-atlas">
+  <small>Mesh field atlas</small>
+  <h2>Read the fleet</h2>
+  <p>Open a machine to inspect membership, path, recorded login, and execution separately.</p>
+</header>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/node-roster.md

@@ -0,0 +1,26 @@
+---
+type: ui-chunk:chunk
+title: Mesh node roster
+description: Inspect current fleet observations and distinguish members from recorded-only nodes.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: node-roster
+intents: [list mesh nodes, show enrolled peers, which machines are online, recorded mesh node]
+surfaces: [page, right]
+operations: [nodes]
+data: ["nodes:/nodes/0/network_state", "nodes:/nodes/0/access_state", "nodes:/nodes/0/vault_only"]
+---
+
+<style>
+  .mesh-roster { padding:var(--spacing-md); border-block:1px solid var(--color-border); background:var(--color-surface); }
+  .mesh-roster h2 { margin:0 0 .5rem; }
+  .mesh-roster dt { color:var(--color-accent); font-weight:600; }
+  .mesh-roster dd { margin:0 0 .6rem; }
+</style>
+<section class="mesh-roster">
+  <h2>Compare node records</h2>
+  <dl>
+    <dt>Membership</dt><dd>Read current network state for enrolled machines.</dd>
+    <dt>Recorded only</dt><dd>Keep an earlier record separate from current membership and liveness.</dd>
+  </dl>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/node-selection-proof.md

@@ -0,0 +1,17 @@
+---
+type: ui-chunk:chunk
+plugin: mesh
+id: node-selection-proof
+title: Choose a mesh node with verified capabilities
+description: Use current reachability and installed harness observations to narrow the list of candidate execution nodes.
+timestamp: "2026-11-08T23:12:00Z"
+intents: [choose a mesh node for work, check which peer has a harness, verify a node can run the required runtime]
+surfaces: [page]
+panel: network
+operations: [nodes, doctor]
+data: ["doctor:/0/reachable", "doctor:/0/runtimes", "doctor:/0/harnesses"]
+---
+<section>
+  <h2>Check a node against the work it needs to run</h2>
+  <p>Start with the enrolled roster, then inspect the fleet execution probe. Filter to reachable nodes with the required runtime and harness. Recheck the selected peer before dispatch.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/owner-observations.md

@@ -0,0 +1,23 @@
+---
+type: ui-chunk:chunk
+title: Mesh owner observations
+description: Read the selected fleet view and inspect its source evidence and observation time.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: owner-observations
+intents: [read mesh view, mesh flows evidence, placement source observations, inspect boundary sources]
+surfaces: [page, right]
+operations: [view]
+data: ["view:/screen", "view:/observed_at", "view:/sources/status/ok"]
+---
+
+<style>
+  .mesh-sources { padding:var(--spacing-md); background:var(--color-surface); }
+  .mesh-sources h2 { margin-top:0; }
+  .mesh-sources small { color:var(--color-muted); }
+</style>
+<section class="mesh-sources">
+  <h2>Trace a fleet observation</h2>
+  <p>Select Machines, Flows, Placement, Boundary, or Join. Each view reports when its owner commands ran and whether each source answered.</p>
+  <small>A source can fail while the other observations remain available.</small>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/peer-path.md

@@ -0,0 +1,23 @@
+---
+type: ui-chunk:chunk
+title: Mesh peer path and latency
+description: Probe a named peer and report whether its network path answered, with timing when available.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: peer-path
+intents: [ping mesh peer, check node path, measure mesh latency, test reachability]
+surfaces: [page, right]
+operations: [ping]
+data: ["ping:/reachable", "ping:/latency_ms"]
+---
+
+<style>
+  .mesh-path { padding:var(--spacing-md); border:1px dashed var(--color-border); background:var(--color-surface); }
+  .mesh-path h2 { margin-top:0; }
+  .mesh-path strong { color:var(--color-accent); }
+</style>
+<section class="mesh-path">
+  <h2>Check the path to a peer</h2>
+  <p>Ping a named machine. A response proves the path from this machine at the time of the test.</p>
+  <p><strong>Round-trip time</strong> appears when the probe can measure it.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/pinned-leader.md

@@ -0,0 +1,24 @@
+---
+type: ui-chunk:chunk
+title: Pin the mesh leader
+description: Record an explicit mesh address and optional server port as the leader pin.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: pinned-leader
+intents: [pin mesh leader, choose leadership address, set leader server port]
+surfaces: [page]
+operations: [leader-pin]
+data: ["leader-pin:/ok", "leader-pin:/leaderPort"]
+---
+
+<style>
+  .mesh-pin { padding:var(--spacing-md); border-inline-start:3px solid var(--color-warn); background:var(--color-surface); }
+  .mesh-pin h2 { margin-top:0; }
+</style>
+<section class="mesh-pin">
+  <h2>Change the leader pin</h2>
+  <ol>
+    <li>Select the intended mesh address and optional server port.</li>
+    <li>Check the write result, then read the elected leader separately.</li>
+  </ol>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/reachability-evidence-ladder.md

@@ -0,0 +1,17 @@
+---
+type: ui-chunk:chunk
+plugin: mesh
+id: reachability-evidence-ladder
+title: Trace where a mesh operation failed
+description: Compare control verification, peer latency and recorded login evidence to distinguish control, network and access failures.
+timestamp: "2026-11-08T23:12:00Z"
+intents: [diagnose why mesh execution failed, separate mesh control and login failure, compare peer reachability with SSH access]
+surfaces: [page, right]
+panel: network
+operations: [probe, ping, access, doctor]
+data: ["probe:/control/verified", "ping:/reachable", "ping:/latency_ms", "access:/complete", "doctor:/0/reachable"]
+---
+<section>
+  <h2>Follow the mesh evidence ladder</h2>
+  <ol><li>Verify the controller independently.</li><li>Probe the named peer from this machine.</li><li>Review the recorded login and the execution probe before dispatching work.</li></ol>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/recorded-login.md

@@ -0,0 +1,23 @@
+---
+type: ui-chunk:chunk
+title: Recorded mesh login
+description: Inspect whether the selected node has a complete login record and when it was verified.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: recorded-login
+intents: [inspect mesh login, record node access, verify recorded SSH account, discover working login]
+surfaces: [page]
+operations: [access]
+data: ["access:/complete", "access:/verified_at"]
+---
+
+<style>
+  .mesh-login { padding:var(--spacing-md); background:var(--color-surface); border-radius:var(--radius-md); }
+  .mesh-login h2 { margin-top:0; }
+  .mesh-login b { color:var(--color-accent); }
+</style>
+<section class="mesh-login">
+  <h2>Review how the fleet reaches a node</h2>
+  <p>Inspect the resolved access record for the selected machine. A complete record gives the fleet a login target.</p>
+  <p>Compare the <b>recorded verification time</b> with a new execution probe.</p>
+</section>