Complete seam catalog

Complete seam catalog

Shared API 14 first shipped with elowen-plugin-shared 0.11.0 and core 0.30.4. Package 0.12.0 retains API 14 and adds the exported retry and retryPresentation subpaths plus canonical local-execution classifiers. These additions require the matching core package; an API 14 match alone does not prove that an older package contains the new exports.

UI kit 0.24.0 publishes UI API 67 and depends on shared package 0.12.0. UI API 65 publishes three runtime members a live rail row needs and the two helpers that go with them: components.RailMenu (the rail's popover, a panel of rail rows opened by the caller's own trigger), components.MarkStrip (marks that each name themselves on hover) and components.HoverCard (a card that opens after the pointer rests, for content too long to sit in a row), plus utils.formatSpeed and utils.apiErrorMessage. A bundle that uses them declares requiresApiVersion: 65; an older host refuses it before mounting. The bundled Subagent rail is the consumer. API 66 adds one prop to the same row: components.RailRow's note, the row's second line under the name, so a row that carries a status note keeps the name whole and gives the note a line of its own. A bundle that uses it declares requiresApiVersion: 66. API 67 adds utils.workflowElapsedSeconds(workflow, now), the run elapsed the workflow inspectors show, derived from the workflow's runTiming. See the published telemetry primitives. UI API 64 exposes components.ConnectionStatus with canonical connection/retry lane props and the updated desktop ticket/stream contracts. Consumers pass an AbortSignal to ticket callbacks, retain authoritative expiresAt, and use the existing GET-only retryConnection action. See connection status and browser UI compatibility. Every loaded plugin declares the exact requiresSharedApi: 14. The exact gate rejects API 13 before entry import, including plugins without API routes. Authenticated API routes use complete declared patterns on both namespaced and root surfaces, with decoded req.params and no prefix-remainder dispatch. Database-backed host calls are awaited: identity, account, policy, path, provider, settings, skill catalog and scoped secret operations. Factories and the committed ctx.config snapshot stay synchronous. Bundled Files and Subagent and registry Parts and LSP consume these calls. Row 28 defines the async PostgreSQL database; row 74 defines locked identity batches. See Persistence, Plugin context and Release.

UI API 57 narrowed the existing browser-runtime seam in row 47 with exact ChoiceFieldProps, ProjectFilterPillsProps, SelectionSummaryProps and SummaryChipProps. The same API adds the existing DataTableSelectCell to the runtime component map, with exact header/row props and current-page selection owned by its DataTable context. MCP is the concrete plugin consumer; absent context renders no cell, and selection changes are local set updates with no inference or new requests. Consumers declare API 57. The unused summary/chip line variant is removed. Single choices always compose the anchored Select surface; the old picker and project variant presentation flags are removed. Editor uses the project catalog adapter without a variant, while host settings use ChoiceField. Consumers retain their selected value and write path; empty project choice catalogs omit the filter. Catalog preparation is linear and reuses existing queries. The host and all consumers of removed properties must ship together; the maximum-version mount predicate does not provide compatibility with removed props. See Browser bundle and runtime.

This catalog counts contract entries, not individual overloads. Rows 4–7 are the four placements of the one registerText(placement, value, options) registration, introduced with shared API 9 and core 0.29.97. Loader-owned platform prompt files use the same system-prompt list with their existing platform gate and ordering. Related methods are one entry only when they share the same owner, timing, consumer, and absent behavior. The authoritative list is the PluginContext interface in src/plugins/api.ts; manifest declarations are the PluginManifest interface in src/plugins/manifest.ts. A producer means a real implementation in the audited bundled or registry plugin trees, not a test fixture.

Useful consumer anchors include the GET /brain/status route in src/api/routes/brain.ts for status, LiveSessionSpawner.spawn in src/brain/service/spawner.ts for input transforms, GET /system/readiness in src/api/routes/system.ts for readiness, GET /projects/summary in src/api/routes/projects.ts for Project indicators, PluginRegistry.contextFor in src/plugins/registry.ts (which builds PluginContext from src/plugins/pluginContext.ts) for registration behavior, and web/lib/pluginChatUi.tsx plus web/lib/pluginDashboardMetrics.tsx for browser slots. The tool-trace contract is the CodeModeTraceSink interface in src/plugins/api.ts and the transcript consumers are in src/brain/toolTrace/.

The shared elowen-plugin-shared/turnRunner failure seam is log(detail, metadata): metadata preserves the original failure and supplies reporting: 'local-only' only when elowen-plugin-shared/errors.isInstanceCondition proves a local cause that is not a host condition: HostConditionError (database acquisition, measured scheduling stalls) stays reportable, so the collector reports it once the same problem repeats. Platform adapters forward metadata beside their existing problem code. Both terminal failure and best-effort afterReply failure use it. Diagnostic text and reply behavior remain unchanged; no registration, extra transport or text classifier is added. The additional callback argument retains the shared API contract and requires the first paired core release through requiresCore. See Typed logging and reports.

Shared helper contracts use the same published package: Singleflight coalesces in-flight work, normalizeConfigScalars normalizes supplied scalar overrides, and alertPushPrefs supplies neutral browser/core bounds. Current core consumers and release-bound registry adoption are distinguished in those owning guides.

The public host accessors include host.elowenCli() and await host.relayClient(), whose client is available after durable inference-origin attribution resolves. Plugin notifications use ctx.alerts.raise(), whose host transport applies each recipient's push preferences. Prompt overlays are declared through registerPrompts() and rendered by core.

Generation-bound clients passed to host.terminalProcessApi() and host.subagentOwnerApi() carry { id, generation, surface: 'web' | 'cli' }. Bundled Terminal and Subagent validate and forward the explicit surface so core can restore a detached binding after restart without assuming CLI. Unbound controls omit the client object. The CLI's owner request binding supplies all three fields; generation fencing and account authority are unchanged.

SurfaceFactRegistration in src/plugins/api.ts owns the correlated surface/resolver tuples. The runtime resolver derives its stored fact shape from that public contract, so the API does not depend on the resolver module.

The one ctx.registerSurfaceFact(surface, resolve) registration, introduced with shared API 9 and core 0.29.97, selects the five contracts in rows 17–21 and appends to one PluginRegistry.surfaceFacts list. resolveSurfaceFacts(surface, viewer, input) applies the web administrator and account grant gates to account, session and Project facts, but never to instance readiness. Each surface keeps its existing timing and failure rule: visibility awaits synchronous or asynchronous local-state probes and hides account/Project panels on throw or rejection, badges omit zero or failure, status drops failed providers, indicators have a two-second deadline, and readiness failure yields a failed row. Visibility and badge registrations are unique per plugin; duplicates are refused and warned. Response shapes and provider ordering stay unchanged; the removed registration methods have no aliases. The authenticated browser listing sends declared component names as slots: string[] before any bundle JavaScript runs; manifest declarations and operation-dock policy stay unchanged.

For every changing value, use the placement and cost rule from the opening: registerText('turn-context', fn, { placement: "after-user" }) for per-turn context, never a system-prompt fragment. The system prompt is the cached prefix.

The summary route obtains authorized rows from ProjectService.authorizedRows, sharing the canonical account visibility and order without filesystem projection. Its one five-second registry lookup also supplies the Sandbox control for managed branches; registry failure is logged once and never triggers another unbounded registry wait. Output follows the shared ProjectSummary contract and accepts only ProjectIndicatorTone own keys. GitHub and OneDrive remain real indicator producers; with no contributions, the indicators array is empty.

Browser contract history

The current value is exported as PLUGIN_UI_API_VERSION by the UI kit and mirrored with a literal type in the host runtime. A bundle's manifest and registration requirements must not exceed that host ceiling. This section owns the history; source comments and package READMEs link here. Historical additions can later be withdrawn as described below.

• UI API 17 publishes Calendar, backed by the host's date engine.
• UI API 18 publishes the host's Todo-card preview rule.
• UI API 19 publishes SectionDeck and DeckNavigation for responsive settings overlays.
• UI API 21 requires the viewer locale for buildUsageSummary.
• UI API 22 publishes Textarea and retires unused component variants and SettingsRow.icon.
• UI API 23 publishes utils.impersonateUser and the canonical localized utils.formatUsd.
• UI API 24 publishes CardGrid and CardGridItem for the host's card-register layout.
• UI API 25 publishes SelectionActionBar and CardSelectCheckbox for bulk selection.
• UI API 27 publishes RailSection, RailList, RailRow, RailDot and ShimmerText.
• UI API 28 publishes TaskList and TaskRow for Todo cards and rails.
• UI API 29 adds toast promise and dismissKey, hooks.useAutosaveToast and autosave editing; toast(message, tone) retains its signature.
• UI API 30 adds DeckNavigation.badge, PageToolbar.filterActions and hooks.useInvalidatePluginUi; the toolbar panel is then called Options.
• UI API 31 adds shared workflow labels and counts.
• UI API 32 publishes cardTasks and cardTasksAddressable for Todo-card projection.
• UI API 33 retires the unused LiveTail preview and generic mcpServers config field; MCP management belongs to the MCP plugin.
• UI API 34 publishes the canonical child and detached-process rail visibility selectors.
• UI API 36 publishes DesktopPreview and useDesktopPreviewState for Browser and Sandbox.
• UI API 38 adds one viewport-gated still scheduler; suspended streams retain their session snapshot.
• UI API 39 moves narration and pending questions into DesktopPreview, removing its notices slot and context.
• UI API 48 adds the optional Project-row nameIndicator projection described in catalog row 40.
• UI API 49 withdraws useResetUsage and aggregate speed/provenance from complete provider statistics.
• UI API 51 centralizes plugin editor localization and publishes Input.unit and LimitSliderRow, as described in the configuration section and catalog row 66.
• UI API 53 renames the canonical filter/action toolbar panel Actions.

UI API 40 publishes components.RowPicker, the host's single-choice dropdown (an anchored combobox with a search box above eight rows, RowPickerProps and RowPickerItem in the UI kit). A pick calls onChange and closes it with no Save step; notice and onOpenChange cover a lazily loaded catalog, and onClosed runs after a pick, with focus on the trigger. ManageSelectionModal no longer has a single mode: a bundle that opened it for one choice uses RowPicker, and ChoiceField, BrainModelField and ModelCatalogField are anchored dropdowns too (they no longer take subtitle); BackendPicker and ExecutorPicker, withdrawn in API 45, were anchored dropdowns as well. A bundle that needs it sets requiresApiVersion: 40.

UI API 41 adds two optional props; a bundle that passes them sets requiresApiVersion: 41, so an older host refuses it before mounting instead of silently drawing the large strip. ResourceMeters takes size: 'compact', the same snapshot on one caption line (a 16px ring, the label and the percentage per resource, exact figures in the tooltip and accessible text); the default stays the three 52px rings. DesktopPreview takes caption, what sits under the collapsed tile beside the claim control in place of identity; the expanded controls row keeps identity. Absent caption, the collapsed tile shows identity as before. Sandbox's chat desktop tile passes its Project's compact meters as the caption, from the same useProjectUsageMetrics cache the Projects register reads.

UI API 42 adds the chatDock registration with manifest web.chatDock (catalog row 58). A bundle that registers it sets requiresApiVersion: 42; an older host never mounts the slot. Sandbox and registry Browser are its consumers.

UI API 43 removes the chatArtifacts registration, together with the core ctx.chatArtifacts seam that fed it and the inline_artifact stream event. An artifact rendered only while the tool turn it was anchored to was loaded, so a reload or a daemon restart could hide something still running; live state in the chat is a chatDock view, drawn from the plugin's own state. A bundle that still registers chatArtifacts loads, and the key is ignored. Core migration 46 drops the brain_inline_artifacts table.

UI API 54 also publishes components.AdaptiveBrandMark, the same brand renderer used by core's ModelIcon. Its AdaptiveBrandMarkProps are declared once in the UI kit and consumed by the host and bundles. Minimal use: <AdaptiveBrandMark src="/api/plugins/sandbox/icon" size={12} monochrome />. Monochrome masks inherit local text color, so black SVG icons remain visible on light and OLED surfaces; the default mode retains a colored image. An omitted or empty alt makes the mark decorative, and an absent icon is handled by the caller omitting the component. Rendering loads only the supplied asset, with no polling, subscriptions or extra API calls. Changelog pills are the plugin consumer. A bundle using it declares requiresApiVersion: 54; older hosts refuse it before mounting.

Core's DockItem projection uses the same shell through each operation's title and renderProgress presentation; the shell's controls and inspection are independent of operation kind. Source adapters keep ownership, transport and durable acknowledgement. Marketplace install/repair and memory-maintenance adapters are administrator-only at the shell's desktop breakpoint, with no extra browser store or connection. Plugin environment calls below are unchanged.

UI API 54 publishes hooks.useOperationDock(): call const dock = hooks.useOperationDock(); dock.open(operation.id) after an authenticated UI environment action. open(id) means track and show in the minimized dock; it does not open a progress dialog or move focus. The person opens progress by clicking the dock icon or an overflow-list entry. Start and completion are announced in a polite live region, and a failed operation keeps a destructive-tone alert icon until explicitly acknowledged, including an alert on +N when the item is in overflow. The hook signature and UI API version remain unchanged; showProgress is a shell-only action, not a plugin contract. dock.operations supplies the same own, UI-initiated operation rows for Project busy state. The host mounts one progress view and dock in the shell; bundles do not mount progress dialogs. Sandbox snapshot creation, environment lifecycle, resource/network autosave and snapshot deletion are the consumers. The source is Sandbox's authenticated list plus pushed durable rows and server acknowledgement, not browser storage. No Sandbox means no environment items or reads. There is one list read per page load/reconnect, one single-operation seed read on opening progress and no per-frame requests. Environment history is bounded to twenty returned items and unseen settled results from the last 24 hours. Update requests use the existing coordinator queue, journal and report through the same host dock. The host also groups own hand-started conversations at desktop widths using the existing personal-session query and conversation invalidation; this is core-owned and does not change the plugin hook. All item kinds share the typed DockItem model and the reserved shell footer described in WEB.md. components.OperationProgressDialog is removed. A bundle needing this hook declares requiresApiVersion: 54; an older host refuses it before mounting, and a bundle supporting older hosts must feature-detect the hook.

UI API 61 publishes components.ResourceHistoryModal with ResourceHistoryModalProps. A caller provides the initial metric, description, close callback and an authorized useHistory hook; Sandbox additionally supplies its Project picker in the scope slot. The host draws the range picker, five inline metric checkbox pills and shared chart, keeps one metric checked, and localizes common empty/error states. A supplied domain failure can use plugin copy. Closing the surface unmounts its reader; opening it adds only the caller's own history query. The component never authorizes or fetches for a plugin. Host settings, computers and Sandbox are real consumers; no contribution means no modal. Sandbox requires UI API 61 so older hosts refuse it before mounting.

UI API 52 lets components.TimeSeriesChart take height: 'fill', which draws the plot to the height its flex column parent leaves over, with a 240px floor. A bundle that passes it sets requiresApiVersion: 52, and an older host refuses the bundle before mounting. Absent or numeric height is unchanged. Sandbox's load-history dialog is the consumer: one combined chart fills the modal body beneath its controls. See WEB.md for the layout contract.

UI API 50 also publishes hooks.useMobileViewport(): boolean | undefined, the host's existing phone-breakpoint hook. It is undefined during SSR and the first render, then updates after measurement and on breakpoint changes. Wait for a boolean before mounting a viewport-specific surface; do not implement a local media query. Sandbox history uses it for Settings' size="page" and explicit center/fullscreen Modal presentation, and enables its history query only after measurement. Each consumer has one subscription with unmount cleanup and no polling or network cost. Older hosts refuse bundles requiring API 50. See WEB.md for the runtime contract.

UI API 50 publishes typed resource actions, instant ranges and numeric time axes through the existing runtime and kit. A bundle requiring them sets requiresApiVersion: 50; older hosts refuse it before mounting. PluginProjectRowMetric.action takes { label: string; onSelect: () => void }, with Project-qualified localized copy. components.DateRangeFilter has discriminated DateRangeFilterProps: absent/day precision preserves calendar dates; instant precision takes InstantRange, optional InstantRangePreset[], and canonical ISO min/max constraints. utils.instantRangeBounds({ from, to }, constraints?) validates complete fixed custom instants to InstantRangeBounds, with explicit errors. Live presets are sent as window=1h|6h|24h|7d|30d, mutually exclusive with explicit from/to; Sandbox resolves them against its own current time and includes the current partial bucket. components.TimeSeriesChart accepts optional TimeSeriesTimeAxis through timeAxis: { dataKey, domain, tickFormat, tooltipFormat }. Time mode uses unique ascending epoch-millisecond keys, linear disconnected lines and Recharts keyboard accessibility; category behavior and the lazy boundary remain. Sandbox's useUsageHistoryActions opens the same ResourceHistoryModal from Project, Account-desktop and chat-desktop meters; its history hook is the consumer and owns data authorization, query bounds, retained states and dialog selection. Core introduces no plugin-specific route or polling. Minimal composition, DST policy, absent behavior, limits, cost and accessibility are documented in WEB.md.

UI API 47 adds the optional figure on PluginProjectRowMetric, a short text (four characters at most) drawn in the hole of the Project-card ring instead of the percentage; description then names the unit beneath it and percent keeps setting the arc. Without it the hole shows the percentage. Sandbox's disk speed ring is the consumer.

UI API 46 adds the userStatus registration for web.user panels (catalog row 39). It is a record of components keyed by panel id, with the same props as the panel (plugin, panelId, user, surface: 'user'). The User drawer draws it as the first line of the panel's tab, right-aligned beside the panel label, inside an error boundary that renders nothing on a crash, so a crashing or still-loading status leaves the line with the label alone. The line is omitted when the bundle is not loaded, incompatible or registers none. It is mounted with the tab, so it must fetch only what it shows. A bundle that registers it sets requiresApiVersion: 46. Sandbox is the example: EnvironmentStatus shows a green or red dot for the bubblewrap probe from the probe-only route environment/status, so the status line never runs the HOME size walk.

UI API 45 withdraws every runtime member that no bundled, registry or installed bundle named (the full list is in docs/WEB.md, "Bounded shared UI"), among them ExecutorPicker, BackendPicker, RailMeter, RailSectionHead, hooks.useAutosaveToast, hooks.useConfig and utils.formatCost. The version is a compatibility ceiling and cannot express a removal, so the withdrawal was taken only after every consuming repository was searched; a bundle that still names one of them reads undefined.

UI API 44 publishes utils.localDateTime(timestamp, locale?, seconds?), the host's rendering of an ISO 8601 timestamp as an absolute date and time in the viewer's zone, so a bundle never prints a raw UTC database string. Pair it with the already published utils.parseTs and utils.compactElapsed for a relative hint. A bundle that calls it sets requiresApiVersion: 44; on an older host the name is absent. Sandbox's snapshot list in the Project Environment tab is its consumer.

UI API 39 also publishes components.ResourceMeters({ metrics: PluginProjectRowMetrics }). This is the existing Project-card strip, not a plugin renderer. Sandbox's web-src/useProjectUsageMetrics.ts supplies the same batch cache key, polling and generation-sensitive recall to its Projects row contribution and Account Desktops. Both call it with the full authorized Project list; a refused read drops remembered figures while an ordinary failed read retains them marked stale. The row contribution keeps lifecycle status, actions and overlays, and the Account card places the strip below its name and state without adding a per-desktop usage request.

The same ResourceMeters seam accepts up to five metrics. Sandbox contributes CPU, memory, disk, IO and network from one authorized batch. A producer can supply figure with state: 'absolute' for an unlimited rate; it is visible without claiming a percentage. Default rings retain their 52px size and single-line captions on one native horizontal track; narrow containers scroll instead of wrapping. The shared horizontal-overflow observer drives the existing edge fade and focus reveal, and gestures on the whole track stay out of card reorder sensors. With no contribution nothing renders; there is no extra host request. Network history uses the existing chart's right axis for Mb/s and full-point formatting for contemporaneous percentages.

EnvironmentLimits.netMbitPerSec travels through the existing Project resources and Sandbox lifecycle control, as an integer rate in decimal Mb/s with zero unlimited. It never enters the envelope hash. Sandbox's root gateway operation set-network-limit uses the environment-control lock and the existing framed transport/capability catalog, derives and proves its veth peer, and owns a marked IFB only while needed. Before start, the helper projects the current ceiling into the root-owned per-machine 20-network.conf outside creation identity. Its mandatory ExecStartPost imports that same installed helper and calls apply-network-limit, which accepts only the machine and reads the current unit ceiling under the same environment-control lock before proving its new veth. Starts are queued with --no-block so the hook can acquire that lock; the client waits for both registration and an active unit, refusing a failed hook. Start retries and resumes verify both live and network limits before success. Live updates and reconcile use the same shaping code; Stop also runs against an already-stopped envelope, and stop/destroy/unlimited remove the owned IFB. The existing privileged-file byte comparison includes the helper source and its hook renderer, so refresh detects these changes without a new installed file. The plugin performs no shaping without the runtime provider, and a refused root operation remains a failure. This adds no host route or independently stored quota.

API 55 publishes utils.interpolate(template, values), the host's existing i18n helper. Use runtime().utils.interpolate(strings.readersCount, { read: read.size, total: people.length }) in the Changelog reader count. It replaces every named placeholder with the literal string or number, preserves unknown placeholders and dollar sequences, and does not recursively expand inserted values. It runs synchronously during rendering with work proportional to template length and performs no requests. Bundles using it declare requiresApiVersion: 55 in their manifest and registration; older hosts refuse that contribution instead of invoking a local fallback.

API 55 types the existing hooks.useEnvironmentOperation(operationId, projectId?) with EnvironmentOperationFollowState: operation, logTail, loading and loadError. Sandbox ProjectEnvironmentSettings follows one durable operation with a seed read followed by pushed sandbox frames. A null id parks the hook without a read or subscription; its parked state has loading true. Loading ends on the seed result or first matching frame. A seed transport error is loadError, separate from operation.status === 'failed'. projectId optionally scopes the seed request. Cleanup aborts the seed and unsubscribes; there is no polling.

UI API 58 makes a plugin panel in a window or the Project drawer (web.project, web.user, web.settings) draw the same anatomy as Settings, on the existing browser-runtime seam, row 47. It publishes components.SettingsValue, SettingsState, SettingsList, SettingsItem and SliderWithReading next to the already published SettingsGroup and SettingsRow, with the props SettingsValueProps, SettingsStateProps, SettingsListProps and SettingsItemProps in the UI kit, shared by the host and bundles. SettingsGroup is one card with a title, an optional description, group actions and an optional collapsible fold remembered under storageKey; SettingsRow is one fact or setting with a label, a description, a right-aligned control and optional status and actions; SettingsValue is a read-only value for the row's control (an empty value draws a muted dash); SettingsList and SettingsItem draw a list of records as outlined small items with media, title, description, an end figure and actions; SettingsState is the empty, loading or error box inside a group. StatusDot (API 57) stays: a 6px dot with tone: 'success' | 'warning' | 'muted', decorative, so the word beside it carries the meaning. Colour means state only; show a fact as a row, never as a coloured pill. A panel returns SettingsGroups (or a fragment of them) and never wraps them in a page: the host puts them into the section's SettingsPage (in the Project drawer, directly into the drawer body), so spacing, typography and hairlines are the host's. Minimal use inside a registration.project[panelId] component: <C.SettingsGroup title="Git"><C.SettingsRow label="Branch" control={<C.SettingsValue>main</C.SettingsValue>} /></C.SettingsGroup>. The same API withdraws components.PropertyGroup, PropertyRow and DetailBlock from the runtime and their types from the kit; they remain host-only primitives of narrow drawers. A bundle using the new components declares requiresApiVersion: 58; an older host refuses it before mounting, and a bundle that still calls a withdrawn component must be updated together with the host. Rendering does no work beyond the markup: no requests, subscriptions or timers. The host's Project and User drawers are the consumers, and bundled Sandbox draws its web.project and web.user panels from them: the usage rings (the register card's ResourceMeters, each ring opening that metric's history, under a Resources title with the sample age as muted meta beside it; a host project has no environment, so it renders nothing, see placement: 'overviewTop' in row 39), the environment state, limits (one SliderWithReading row per ceiling), networking and snapshots groups, and the Development environment groups.

UI API 59 publishes hooks.useProjectCommits(id, { limit, anchor, enabled }) on the existing browser-runtime seam, row 47: the Project's commit log in ANCHORED pages, through the host's own query cache and its existing authenticated Project route. The result is react-query's infinite query — data.pages of { commits, hasMore, anchor }, hasNextPage, isFetchingNextPage, fetchNextPage() and refetch() — so a panel unfolds a history in place instead of sending the reader to the editor. anchor is the commit the WHOLE walk starts from and the caller names it (the head of a hooks.useProjectGit snapshot): the daemon reads every page — including a first page re-read after a failure — from that same commit, which is what stops a reload from shifting the window onto a newer history and showing one commit twice. null anchors at the current HEAD for a caller with no snapshot. A page is bounded (limit, at most 200) and carries one row more than it returns, which is where hasMore is read from; skip advances into the anchored history. The anchor reaches git log as an object id or not at all: anything else answers 400, so a revision expression or an option can never come from a client. A managed Project's pages cross the same environment gate as its snapshot read, refuse to start a stopped environment and answer 409 or 503 exactly as that read does. The read adds no route, storage, polling or timer; one call is one page. The registry Editor plugin's Project panel is the consumer. A bundle using it declares requiresApiVersion: 59 in its manifest and registration, and an older host refuses the contribution rather than invoking a local fallback. See Browser runtime.

UI API 56 publishes utils.uploadProjectFile(file, { projectId, directory }, { signal, onProgress }) on the existing browser-runtime seam, row 47. Editor calls the host's web/lib/projectUploads.ts, the same implementation chat calls with { sessionId }. The core session route validates explicit positive Project ids and relative directories, refuses mixed targets, checks current account access at open, part and commit, and never follows a destination outside the Project. It uses the host and guest write seams in rows 59 and 60, with create-only collision suffixes, no file type or total size cap, durable byte progress, retry/resume and cancellation. A restart loses open sessions; idle staging expires. With no caller it spends nothing. See Browser runtime.

API 55 accepts PluginApiRequestInit in runtime().api(path, init). Pass { method: 'PATCH', json: payload } for a JSON write; json and raw body are mutually exclusive. The host uses its existing JSON builder and authenticated request path, defaults JSON writes to POST, and preserves cancellation, request deadlines, restart recovery and server errors. Calls without json retain RequestInit behavior, including FormData uploads. A JSON payload is serialized once, on the browser request boundary; serialization failures reject the call. Licensing customer edits consume this option through their existing runtime request wrapper. Bundles using json require browser API 55 in both manifest and registration, with no local serializer fallback.

Modal no longer accepts intent. Automatic presentation depends only on overlay depth and viewport: the first roomy overlay is a drawer, nested roomy overlays are centered, and phone overlays are fullscreen. presentation remains the explicit geometry override. WorkspaceDetailRail uses Modal with drawerWidth='default'; it also accepts the optional icon, iconNode, actions, tabs and footer props, and its description may be a node. DetailBlock draws a plain sentence-case heading: its icon prop is still accepted but no longer drawn, and it gains an optional aside node on the right of the heading row. Both changes are additive, so the UI API version is unchanged (see the drawer anatomy in docs/modules/web/components.md). PageOverlay uses standsInForPage so editors opened from Settings resolve as first-level drawers. Resolved shape owns the z-band. Focus isolation, dismissal and onClosed are unchanged; no contribution is required for the default rules. The withdrawn plugin runtime hook useQueries is no longer published; useQuery, useMutation and useQueryClient remain on the host's shared query client.

Core sources use the same DockOperation presentation contract directly in OperationDockProvider. Memory dreaming is the core example: own durable run rows, the existing memory SSE invalidation, a bounded authenticated list and settled-run acknowledgement, with the shared operation progress dialog. PluginOperationProgressDialog accepts the common presentation fields, so this core source does not need a plugin registration or another dock. This changes no plugin manifest or registration contract; absent core rows produce no items and incur only the shared list read on mount/reconnect.

Cronjob manual-run source

The registry Cronjob plugin uses the same durable-row plus private-plugin-event shape as Sandbox. It owns the queue and history and contributes its browser adapter through web.operationDock: { desktopOnly: true } and registration.operationDock. Core contributes authenticated plugin routes, publishEvent, SSE, the existing UI loader and the generic operation dock source above. hooks.useOperationDock().open(runId, 'cronjob') reads the accepted run before SSE and tracks it minimized. The adapter validates raw operations and maps queued/running/done to pending/running/succeeded; failed and interrupted both use failed display rules, with an explicit translated Interrupted label. With no Cronjob plugin there is no read or item.

POST /plugins/cronjob/jobs/:id/run accepts {requestId, expectedRevision} and returns {ok:true, requestId, runId, operation}. The actual account comes from verified auth. As in Sandbox, full/impersonation credentials mark initiator:'ui', verified agent calls mark 'agent', and other credentials mark 'system'. The initiating account is separate from the job owner. Existing owner/instance rules still authorize Run now and run-history reads; even an administrator cannot read another account's dock operations.

GET /plugins/cronjob/api/operations returns {operations}: the newest 100 own UI rows still waiting/running or with an unacknowledged outcome. GET …/operations/:id reads one own operation, including an acknowledged one. POST …/operations/:id/acknowledge settles acknowledgement idempotently on a terminal row, returns {ok:true, acknowledgedAt} with the original durable server timestamp, and refuses unfinished rows with 409. Missing and foreign ids both return 404. The list and detail are projections of p_cronjob_runs, never a second operation table; detailed rows and request dedupe last seven days, matching the existing history retention.

Operation fields are id as the run id, requestId, jobId, jobName, accountUserId, initiator, status, queuedAt, nullable startedAt/finishedAt/acknowledgedAt, nullable preview/errorMessage/skipReason, and historyUrl. Status is queued | running | done | failed | interrupted. The history URL is /p/cronjob?run=<id> and opens the exact retained receipt, including loading and unavailable states. A skipped guard or revoked execution grant maps to failed with its reason; restart interruption remains an error in history, with explicit interruptedAt and dock status interrupted.

After each durable queue/start/settlement/acknowledgement, Cronjob publishes {type:'plugin', plugin:'cronjob', kind:'manual-run', projectId:null, userId:accountUserId, data:{operation}}. The existing SSE recipient boundary delivers it only to the initiator, including for admins, and the shared activity store skips it. Seed again from the authorized list on reload and reconnect, preserving frames received during that read as Sandbox does. Keep the last known state on a failed read; no polling per item, elapsed-time success inference or cancel action. Rendering and opening Cronjob items are desktop-only.

The plugin's useRunCronJob in web-src/jobs.ts validates the accepted id, opens it through the host dock on desktop, provides shared queued/error feedback and refreshes the existing caches once. All Run now buttons call it. Scheduler claims consume the existing JSON request before starting that same journal row. Boot preserves requests still queued on jobs and marks stranded manual rows interrupted immediately, including runs younger than a scheduler tick. All job deletion paths pass through JobStore.save; its post-save callback settles removed waiting runs without cancelling claimed turns. Account removal and boot reconciliation clear a removed initiator's private link while preserving instance run history. No historical initiator is guessed for pre-migration rows.

Environment operation provenance and acknowledgement

Sandbox's dock reads GET /plugins/sandbox/api/environments/operations without a Project parameter and receives {operations: EnvironmentOperation[]}. POST …/operations/ack accepts exactly {operationId: string} and returns the acknowledged operation. Both use the verified account and fresh Project-management access, with an own successful deletion exception after the Project disappears. The list includes only own UI operations: pending/running rows and unacknowledged outcomes settled within 24 hours, bounded to 20 after access filtering. Host operations and automatic recovery are excluded. Foreign, missing or inaccessible acknowledgement targets answer 404; running targets answer 409; repeated acknowledgement keeps the original timestamp. The operation carries updatedAt, nullable acknowledgedAt, and initiator: 'ui'|'agent'|'system'; acknowledgement republishes the same environment-operation event with outer userId taken from the durable row's owner. The SSE gate delivers that frame only to that authenticated account, including tabs connected after the deleted Project and memberships disappeared; other accounts and administrators receive no private frame. Unacknowledged lifecycle progress keeps its existing Project tenancy. The existing per-environment history retains at most 20 disposable settled rows, so a row already pruned from it cannot reappear in the dock. Retrying a failed request clears its acknowledgement and stamps the retrying caller; live progress exposes the timestamp just committed to the durable row. No second store or polling loop is created.

The authenticated HTTP dispatcher preserves PluginApiAuth.credentialScope as well as the verified agent marker. Only full and impersonation identify interactive login sessions; agent is a turn-bound ElowenApi call, and api/advisor are non-session credentials. An absent origin on a non-HTTP transport is not proof of a UI action. Sandbox derives provenance from these host fields and rejects initiator in the HTTP body. Core's Project create/delete routes and conversation execution-selection route forward their verified provenance through the existing requestEnvironment input; direct Project-tool calls default to agent, internal reconciliation to system. Migration 16 adds provenance and acknowledgement to the existing Sandbox row, preserving old rows as system rather than guessing which were UI requests. When Sandbox is unavailable its API is unavailable; the dock must never invent operations.

All published Sites gateway operations preserve intentional privileged-client shutdown, including daemon pause, as PublishedSitesGatewayStatus.code: 'closed' alongside available: false and the unchanged detail. A consumer checks result.code === 'closed' rather than parsing error text. The classification acts when an injected worker call rejects because its client has closed or paused, including pending handshake and request settlement during detach. Successful replies, helper refusals, deployment validation errors, missing injected transport and unexpected connection loss omit the code; omission carries no shutdown classification. The existing status conversion performs no extra I/O or retries and does not change cleanup. The registry Sites gateway and worker monitor consume this classification when handling daemon shutdown.

Shared desktops

Sandbox opens the fixed guest connector through host.machineRuntimeGateway().startExecution(request, options) only. The strict request uses op: 'desktop-connect', lifetime: 'connection', the owned Project generation/disk/spec identity, and /usr/local/bin/node /usr/local/lib/elowen/desktop/connector.mjs at /. The privileged worker revalidates root-owned machine ownership before admission. It removes only the command runtime ceiling, not attach/handshake budgets, capacity limits, execution leases, owner-loss cancellation or settlement proof. Ordinary execution retains its existing deadline. Without the gateway or a packaged desktop, admission fails; there is no host socket fallback or automatic installation.

The chat shows a Project desktop through web.chatDock: Sandbox's view reads the same stored desktop/overview as Account → Desktops, one shared query that never runs a guest command, and draws the tile whenever the conversation runs in a managed Project whose desktop is ready, whatever the transcript has loaded, so a reload or a daemon restart never hides it. It contributes only a ready tile, never absent/loading/error bars, so the chat dock lets text flow beside it exactly like Browser. A conversation outside a managed Project reads no desktop at all. Migration 12 removes Sandbox's legacy sandbox-desktop cards. The desktop provider publishes bounded action captions only after agent GUI admission, never from passive still capture; labels exclude typed text, keys and launch arguments and stop at 128 characters. One subscriber set per session is removed on unsubscribe without closing the display.

Sandbox supplies exactly one desktop per container on the current project-base@19 image, gated by desktopCapability(reference) and its contract in ROOTFS_RECIPES['project-base'].desktop.imageContracts (1920x1080). The guest agent is baked into the image. Only the current pin and guest are supported. Retired materialized disks keep their original provenance for start, restart and boot recovery without archive lookup; they have no admitted desktop. Recreate or restore involving a retired environment or snapshot fails before mutation, including recovered durable intents. No older-result fallback or version-specific parser exists. A Project on an older image gets a desktop only as a new Project; no compatibility or installation path exists. elowen-desktop --json ensure starts the guest desktop on first agent use. status only observes. Stream/ticket preparation observes an already stored ready desktop and refuses a stopped one. The desktop runs until a member stops it or the container stops, including when the daemon restarts. Migration 13 removes desktop intent, idle timestamps and VNC-generation columns, invalidates old X11 observations and fails queued obsolete lifecycle actions. There is no app tracking. Human stop uses the shared confirmation and existing Project operation queue.

The current image carries desktop payload 13. Keyboard destinations are explicit in the shared daemon/guest command contract: type requires target; key requires exactly one of target or window. Examples: {action:"type",text:"2400",target:"e12"} and {action:"key",key:"ctrl+s",window:"Editor"}. Guest argv is type -- 2400 e12, key -- ctrl+a e12, or key --window=Editor -- ctrl+s. The host validates every batch step before dispatch. No previous click or implicit seat focus supplies a destination.

The existing guest Accessibility seam owns numeric, setValue and focused. numeric returns finite CurrentValue/MinimumValue/MaximumValue and the displayed Text, or null for absent Text. Spin-button fill refuses invalid or out-of-range input and requires Text before writing org.a11y.atspi.Value.CurrentValue through D-Bus Properties.Set with a double variant. Within two seconds both Value and the number parsed from nonempty displayed Text must equal the request. The standard Number parser accepts equivalent numeric formatting but does not guess decimal separators or strip units. Clamping, rounding, unparsable Text or inconsistent precision fails, including when Value already matched before the command. Read and snapshots still prefer committed Value for spin buttons; numeric verification reads Text separately through the same bounded text reader. Missing Text or missing or unwritable Value fails without a keyboard fallback; an uncertain write is never repeated. Equal, verified values deliver no input. Plain text fill still verifies exact text and does not implicitly submit.

Commands.keyboard is the one preparation path for text fill, targeted type/key, window shortcuts and focus confirmation after an editable left click. It preserves modal/coverage admission, activates a non-popup destination window and refreshes the AT-SPI identity. An already focused element keeps its caret and selection. Otherwise a real pointer click at its visible centre requests focus, which must be observed within 1.5 seconds. After an explicit editable click it only confirms focus, never clicks or activates again. No GrabFocus call is needed, so providers that reject it remain usable. Popup targets keep their surface identity but verify the same-process non-popup owner through compositor transient links. An override surface without a link requires one focused non-popup window of the same process plus the exact element's focused state. That owner id is fixed for the command; missing, ambiguous, changed or unfocused owners fail. Window shortcuts confirm window focus without choosing an element.

The Input seam checks window focus and saved element address/name/role/state before each contiguous plain-text run, at Tab/Return and paste boundaries, and once at the end. A plain run costs two guards regardless of its length, in addition to command preparation; each guard reads windows twice and performs three direct AT-SPI reads for an element, with no tree traversal. Key chords retain checks between their presses; clipboard transfer is checked on completion. Cancellation is checked for every character and held keys are always released. A final explicit Tab, Return or shortcut may intentionally move focus; later input must still pass the original destination guard, so another destination requires another targeted command. A failed check stops rather than refocusing or retrying input. Delivery remains false before input, true after proven input even if a later check fails, and null for uncertain delivery. A delivered focus click remains true if later input fails. GNOME keyboard delivery and AT-SPI focus reads are separate bus operations, not an atomic compositor transaction; a focus change inside a text run is detected only at its next boundary. Live focus-steal and widget persistence checks remain part of image qualification.

Only the daemon adopts fresh observation identity, at boot reconcile and when an agent ensures the desktop or a stream/ticket observes a stored ready desktop; no surface probes the guest to draw a tile. Account Desktops and the chat dock read the same bounded keyset overview pages of stored state (one useDesktopOverview query); Account does not claim control, but members can stop a desktop from its row or expanded preview after confirmation. Chat retains the shared tile, narration, action captions and human takeover button. Collapsed stills remain passive and never prepare a desktop.

The one model tool is Desktop. It advertises one flat top-level object whose required action picks the variant (so providers that keep only the root properties still show every field, and reason is accepted like on any other tool); the zod discriminated union inside execute is the only validator and answers a bad call with invalid_arguments and one message for the chosen action. It always operates the desktop of the managed Project the conversation runs in (currentAccess().projectRef), which is the one desktop that conversation's chat shows. Outside a managed Project it refuses with managed_project_required and tells the model to switch the conversation first; there is no argument that names another Project. Its actions are look, read, screenshot, click, clickxy, fill, type, key, scroll, hover, drag, wait, activate, batch and handover. target takes a ref or a semantic selector (name="Submit", role="text box" name=City, text~=Hotovo); a ref stays valid while its element exists, also across actions in other windows. activate raises the window whose title matches window (exact, else a unique substring). batch runs 1 to 20 steps (no screenshot, handover or batch), one guest call each, validated before the first and stopped at the first failure. Look maps to guest snapshot and read to guest read (one element's exact text or committed numeric value and states); the other actions keep their argv shapes and strict GUI result validation. Input actions already collect a post-action accessibility snapshot. The tool description leads with consuming snapshot, snapshot_state and verification, rather than requesting another look. In code mode, Desktop declares details.modelObservation through row 62: the latest canonical content per Project arrives at yield/completion even if the script prints only status. Explicit text(c.text) and image(c) forwarding is deduplicated; the normal text budget, explicit truncation markers and image processing still apply. Already queued calls inside the script cannot be cancelled by this delivery. A batch returns step summaries and the last executed step's observation when available, not every intermediate snapshot. Use a screenshot for visual work or unnamed controls and derive its region from current geometry. Failed verification may follow delivered input: inspect action_delivered and verify current state before repeating an uncertain action. Daemon preflight and the bundled guest share lib/desktopSelectors.mjs; mixed bare text plus predicates is rejected before input. One lib/desktopResult.mjs discriminant covers host and guest results: success, error_type, action_delivered, with null meaning unknown. Ambiguous exact expectations include scope and bounded role/name candidates. A partial startup look succeeds with snapshot_state: incomplete and does not prove completeness. Every input action takes optional expect (a semantic selector, never a ref; bare text means text~=) and expectTimeout (0 to 60 s, default 10); the guest then verifies the result in a fresh snapshot and reports verification without retrying the input. screenshot takes marks to draw element refs on the image. Whole-screen and window screenshots arrive at the largest quarter scale a provider passes to the model unchanged, regions at a quarter-step scale from 0.25 to 4; every result reports its region and scale. type presses Tab for \t and Enter for \n; when they move focus, subsequent input requires a new explicit destination. wait polls for text and is not a sleep. Start apps from Bash with desktop-open <app> [args]; it exits non-zero with a message when the program did not start, and otherwise waits up to 10 s for a new window, then up to 3 s more for its accessibility tree, and prints its title, says its controls are not readable yet, or says no window appeared. A selector that fill uses is narrowed to editable matches, because GTK names an entry after its label. handover is the desktop's use of core's takeover operation kind: Sandbox contributes {tool:'Desktop',kind:'takeover'} with input {action:'look'}, so DesktopRuntime.execute calls controller.requestTakeover (the tile shows the request and offers the claim), waits until the person returns control or the tool call is cancelled, then runs a fresh look under normal agent admission. Before that wait the tool runs one ordinary look under its own request id, which admits, authorizes and prepares the desktop, so the chat tile is there while the person is asked; a refused desktop never waits. Only a person claims control; like Browser's request-takeover, the wait has no timer besides cancellation of the tool call, which stopping the turn triggers. No guest condition, hint or wording names a program: input, paste and table reading are decided by generic AT-SPI roles and interfaces only.

Sandbox's human-only stop route is POST desktop/stop?projectId=…, declared in its manifest with access: 'user', like Browser's close route. The plugin dispatcher sets optional PluginApiAuth.agent: true for verified ElowenApi credentials; the stop handler refuses it, then rechecks membership and scoped Projects, even for admins. Absent agent means an ordinary authenticated caller, not anonymous authority. useDesktopStop is the single mutation/confirmation path for Account and chat: shared danger IconButton on the Account row and DesktopPreview.power in the raised view, translated error toasts, then invalidation of the shared overview and resource snapshot. The shared enlarged view renders navigation, claim/return, More actions with Quality then Speed, then power, using the same controls and ConfirmDialog as Browser. No additional menu renderer is needed.

Declare provides.desktop: true, all five desktop/ API paths and desktop/vnc in provides.wsRoutes, then call ctx.registerDesktopProvider(provider) once. Browser is the account-scoped producer and Sandbox supplies managed Project displays. The optional prepare(sessionId,userId,signal,projectId?,kind?) hook runs before initial agent resolution and authenticated stream/ticket resolution. It is idempotent and bounded, and must authorize the session before any side effect. Agent preparation receives the active Project id and command kind and must reject a different Project before guest execution. Sandbox uses the kind to let a ready handover interrupt active input, while serializing a cold handover's ensure with starts and member stops; the human wait never holds that queue. Passive stream/ticket preparation runs beside the agent queue, so an agent waiting for a human lease cannot block viewer tickets or reconnect tickets. It rechecks authority and refuses an observation if the admitted display identity changed during its probe, including a member stop. Concurrent viewer probes of the same identity remain admitted. Core rechecks active-turn liveness after it settles. No hook means no preparation; heartbeat, takeover/release, WebSocket reconnect and passive stills never call it. Sandbox invokes its fixed guest ensure with a 70-second execution budget; Browser has no hook. The provider supplies a synchronous authorized description, private native RFB authentication and an abortable openRfb returning DesktopByteChannel: Node readable/writable streams, a closed promise and an awaited close(). It must honor write/drain and read pause/resume. Core never resolves producer socket paths or starts a desktop from a read.

displayId identifies the actual display and its epoch, not a tab or viewer. Managed descriptions carry Project id, environment generation and desktop epoch; every current Project member may watch and claim. All sessions naming a display share one daemon-owned controller. controller(displayId).runAgent and runUser share one serial settlement queue. runView is only for authorized passive producer reads, not input or application launch, and it runs beside that queue instead of in it: an agent operation may wait up to a minute for the UI, and a read changes nothing, so a still capture never waits for it. It works during a human lease without claiming control or changing its revision; it checks cancellation and display fencing before it starts, never holds a claim in handover-pending, and a fence awaits reads in flight as well as the queue. Sandbox runs one still capture per display at a time and shares it with every viewer asking meanwhile. Sandbox uses it for full-screen still capture at the smallest quarter scale that fills its 480x300 box, reusing its admitted GUI screenshot validation and cancellation with the cached reconcile observation, never fresh observation probes. A visible collapsed Sandbox card costs one guest capture plus one host resize per 1500 ms server refresh; hidden or off-viewport cards stop scheduling captures. Without a passive consumer no extra operation runs. A claim during an active operation returns handover-pending; input remains blocked until that operation actually settles. Tokens are private and bound to the authenticated account, view and control revision. A claim belongs to the holder's account and view id and to its current lease, not to one socket: when a socket of that account and view closes, carrying no lease or exactly that lease, held input is released at once and the view has a 15-second budget to rebind with its lease proof, after which that same lease, and only that one, returns to the agent. Because view ids are chosen by clients, a socket of another account or one carrying a stale lease never starts or ends anything. A new claim or an explicit release of that view cancels the budget; admission, permission and protocol failures release control at once. closeDisplay(displayId, reason) fences a producer-known display even before a viewer resolves a session. closeSession closes only that session's views and releases only its claimant, leaving other sessions on the same live controller. closeDisplay advances the monotonic connection generation, rejects old tickets and awaits every admitted operation before reopening the same controller. Producer cancellation must start before awaiting this fence. No owner means unavailable, never a compatibility implementation.

Optional agent.operations entries bind each declared mutation tool to its operation kind and a Zod input schema. The host validates the tuple before any admission, then passes the complete command and authenticated user id to agent.execute. Tools call the returned desktop.execute({ sessionId, requestId, tool, kind, input }); runners forward desktop.command to the daemon using the active turn, never payload identity. The host checks exact turn/account grants and rechecks Project/plugin authority at admission. The host passes its authenticated userId explicitly to openRfb and agent.execute; WebSocket and runner callbacks have no ambient plugin identity. Execute must settle only after input has stopped, even when aborted. hostCancel requests cancellation; the runner waits for settlement and never replays an uncertain request. Each runtime keeps a bounded 10,000-request no-replay ledger. Settled entries are reclaimed only after their host-owned caller turn retires; unresolved and active-turn unknown outcomes are never removed. Native turn scope and runner pending-turn liveness are authoritative, never payload flags. Input JSON is bounded to 64 KiB. Result JSON is bounded to 4 MiB plus 64 KiB, allowing a producer's bounded base64 image and report through the same daemon and active-turn RPC schema. Sandbox uses this for Desktop screenshots: its producer validates a PNG of at most 3 MiB, geometry and scale, and its model tool extracts image bytes into image content instead of text/details. The larger result bound does not widen input, permission, queue, cancellation or no-replay rules.

Native VncAuth is required for managed desktops. connectionAuth returns security type 2 and the producer's password of one to eight Latin-1 bytes only through the private authenticated, no-store ticket response. It is absent from URLs, SSE, descriptions and artifacts. Account Browser uses security type 1 on its private host Unix socket. Clipboard policy is explicit; disabled clipboard is removed in both directions. Core frames every client message and rechecks queued input, resize and clipboard mutations at write time. Held keys/buttons are released on revocation. Tracking is capped at 256 distinct keys per connection; overflow releases known inputs and closes the connection before forwarding the excess key. Pixel formats must be validated 8-, 16- or 32-bit true-colour formats with non-overlapping channels and matching depth; Tight framing uses the negotiated channel widths. Transport uses a 4 MiB high-water bound, 15-second admission and 5-second live permission checks. Core retains Cursor -239 and VMware alpha cursor 0x574d5664 in SetEncodings only when the connection's validated ticket carries a control lease, not merely because a client says it is interactive. Claim and release open a new connection. Producers therefore send controller frames without an embedded pointer and a cursor shape in the negotiated pixel format for Cursor -239 or fixed RGBA for the alpha encoding, while watch-only clients get the remote pointer in their framebuffer. Sandbox composites its signal-driven GNOME cursor for viewers and screenshots; Browser's x11vnc handles the same negotiation natively. A producer without cursor encoding still sends its normal framebuffer; core never invents a cursor shape.

Portable X11 startup remains in elowen-plugin-shared/x11Desktop for host Browser only. Call writeXauthority before starting processes, then x11DesktopArguments with displayNumber, width, height, xauthPath, socketPath and deferMs. It validates/returns argv without starting processes; no call performs no work. X uses its private MIT cookie, VNC a Unix socket with -nopw and disabled TCP/IPv6 listeners. There is no sharedMemory or password option. Browser owns directory/socket permissions, readiness, supervision and cleanup. Sandbox keeps image-owned Wayland and native VncAuth.

DesktopProvider has no controlChanged callback. The daemon logs transitions; producers use desktop.controller(displayId).subscribe(listener) and release the subscription. Browser shares a controller across tabs; no listener leaves control intact and no subscription grants input. See provider control.

The chat host publishes measured tile union width and composer height. Stack height stays local; float exclusion uses --chat-dock-float-top and --chat-dock-float-height. Producers supply placement chat, not geometry.

Shared attachment markers

attachmentNote(name, type) from elowen-plugin-shared/voice returns the attachment or untranscribed-audio marker for caller-normalized inputs without downloads, storage, localization or inference. Minimal use is attachmentNote(clip.name, clip.type). Callers retain MIME normalization/defaults; no attachment means no call. Discord and Telegram use it after absent core transcription, Teams for non-image notes, and WhatsApp retains its different voice note. Ship these consumers with the containing core export; manifests remain the source for release requirements.

Internal web owners

These internal boundaries add no PluginContext method, manifest slot or UI API version.

The shell uses one command geometry, a measured navigation drawer below 1024px and advisor availability from 1440px; skins change paint only. See shell preferences, request boundaries and caption limits.