0.64.0

The controller’s page for an unattended box (todo #121 task 7; spec §8)

A box’s workspace that this computer operates is a base on the map like a local one.

• Placement. In Standard, Geek and Raven it sits after the local bases and before the teammates’ cards. It carries the machine’s badge (its label and short id) and the team’s name under the title. While an operate session is live, the box’s own ally card is folded under the base (“This machine’s status card”) instead of standing beside it; with no live session (greyed, ended, none) the card stays on the map.
• What works. Everything the base shows (units, tabs, queued messages, todos, monitors, the comms view, the composer, the terminal tile, the pad, Dismiss) is the usual page fed by the merged net. The ⋯ entries follow what the box lets through (box.can): Quit on a unit, Quit on a squad, Dismiss, and Quit tower only when the session has the box scope. A remote base has no + Main, + Member, Stash or Quit base (the box’s tower and other teams’ units are not ours to close or open into), anywhere: the map, the zoomed base, the comms header and the phone’s list. A squad whose Quit is hidden has no empty ⋯ either.
• States. A greyed base (unreachable) is dimmed with a dashed edge, says “unreachable · last seen 4m ago” with a clock that keeps counting, offers no action and takes no typing in its comms (the composer says the machine cannot be reached, not that the stream is down; a form, options, suggestions or checklist in the comms log are off with the same reason, post nothing, and come back on with the box, while one already answered stays answered). An ended base is one line with its reason: 「操作權限已撤銷」 (the grant was withdrawn, or the device left the team) or 「這台機器不讓這部裝置操作」 (the box refused this device, shown once), or a plain “Operating this machine has ended”. Geek keeps its flat look: dashed, not dimmed.
• Earlier runs. A fold “Earlier runs (n)” under a live base lists the box’s finished runs from api/transcripts (50 to a page, Show more for the next), newest first; a row opens the run’s read-only comms view, the way a tower’s earlier run does. The list is asked once when the base shows live, and again when its units change (at most every 10 s); a refused list draws no fold.
• Untrusted text. Everything a box says (labels, team, names, run names) becomes text; no markup, no URL and no handler comes from it. A route is built only from the controller’s own x<16 hex> keys, and a row whose key is of any other form is dropped. A box’s wait card shows its URL as text only, with no Open link.
• Focus and the reason. The control that loses the focus when its box goes away (a block in the log, the terminal card’s line or the pad’s key) gets it back when the box returns, unless you went elsewhere meanwhile. A wait card that is off because the box is away says so (“This machine cannot be reached right now…”) instead of “The connection is down”.
• Zen and the phone. Nothing box-specific: a box’s question is a card like a local one (“main · Work”), and the phone shows the same base with 44 px rows and folds.
• Strings are in English and Traditional Chinese (box_*).
• Demo. npm run gui:dev with ?operate=live,unreachable,revoked,refused (or all, more for 53 finished runs) shows the states with no box.
• Bundle. The base’s own parts are a lazy chunk (4.65 KB, 2.29 KB gzipped) loaded with the first remote base. The entry grows by 1,954 bytes raw / 657 gzipped, of which about 2 KB is stylesheet.

Trains as their own workers: the session guard and the sidebar (todo #125, tasks 4 and 6)

Still not in use: no prompt opens a train yet (prompts/train.md is a placeholder until task 8; spec §22, §23).

• The train’s session guard (src/trainguard.ts). In a train, sb checks every todo and MonitorCreate call against the step’s frozen spec: a step passes only on the gate wrapper’s own end line, carrying the frozen hash and a nonce the wrapper makes for that run, with the monitor’s record showing exit 0. Acceptance, UAT and e2e steps are refused. While a session’s train role is not settled, both tools are refused when anything local says it is a train. Mains, towers and the integrator’s other todos are untouched.
• Herdr’s sidebar (src/order.ts, src/trainsign.ts). An integrator’s tab sorts right after its tower, the trains after it by code and project, so a train ending moves no other row; the integrator and each train carry their own mark, and a train shows its current step (sb_step). Who is the integrator comes from a live writer of the project’s yard.json and Herdr’s pane list, never from a pane token; it is display only.

Link operate is documented (todo #121 task 9; spec)

• Docs. How it works has a section “Straw Link operate” (what the controller sees and can do, the box side, /boss link operate, failure and backoff); the unattended-device guide documents the policy’s operate field (§2), what a controller sees (§7) and how operate ends (§8); the Straw Link spec lists the operate kind and the relay’s live class and limits; the spec’s §11.8 compares the moldplan-center role with §13.
• Where each part shipped. The box’s side (the bridge, the grant and scope checks, the ledger and transcripts, the policy watch), the wiring in the sb server (one sink per holder by role, the host per GUI, the hello caps, a box that grants nobody offered to nobody) and the controller’s host and sanitizer are in 0.62.0. This release adds the controller’s page for a box (above); it changes nothing on the wire or in the box.
• Operate off stays off. /boss link operate off ends every session and keeps operate off until /boss link operate on, across a GUI and a server that start again (link/operate-off.json, mode 600); this has been so since 0.62.0 and is now written down.

Fixes from the review of the whole of operate (todo #121; spec §11.8)

• A box that serves two of your teams. When one box’s base is shown by two sessions (one per team), Quit squad goes to the session that owns the squad instead of answering “No such squad” for the other team’s, Earlier runs lists the runs of both sessions (a run both list once), and the base’s cards follow the units of both. A unit whose own session is unreachable, or reaches less than the other, is off or limited by itself while the rest of the base works.
• A box’s waits keep their cards. A box tower’s wait card, your press on it and a resolved or declined wait now cross the controller (as text, with its lengths and the address checked); a resolved wait is no longer shown as open in the dock and in Zen, and a card is no longer drawn as a wait written before cards.
• The head tower is out of reach of every operate session. A box grant could name the head tower’s key on a read, a watch, a close or a dismiss (only sessions/* refused it). The box now treats the head as nobody’s scope and refuses it on every route, and the controller never puts such a key in its tables.
• Earlier runs hold no head-tower row. A box that ran 0.62.x or 0.63.x filed the head tower’s own finished runs as the box’s; the ledger now leaves such rows out when it opens, lists and looks up none, and makes none, so they reach neither Earlier runs nor the transcript route. A box upgraded to 0.64.0 loses those old rows from its list at once; they are dropped from operate-ledger.jsonl at the next start (the session files themselves stay where pi keeps them).
• link.log keeps the audit on an unattended box. It rotates at 8 MiB with four old copies (link.log.1 to .4) instead of 1 MiB with one, so an hour of typing does not push a week of operate audit out. The policy file is read once and again only when it changes; a read that fails keeps the last answer. An attended computer is unchanged.
• Smaller. A box’s dialog disables the choices only this computer may give and the ones that open a pane, also on the Mac’s own page; a write in flight when the session ends is no longer typed.