From 8e9fb5d983419b14946d64354015ff7e9b1b2ad3 Mon Sep 17 00:00:00 2001
From: AlexZ005 <alexz005.info@gmail.com>
Date: Sun, 20 Sep 2026 03:48:15 +0300
Subject: [PATCH 1/3] [feat] cloudApi: the join dial carries the plugin's data,
 and authProvider.decide answers it

Roadmap 29, rooms access control (seam 1). A gated cloud room needs the host to see a
knock's name or a room-code proof BEFORE the conn opens - an unapproved conn is closed at
once, so the dial's PeerJS metadata is the only channel that arrives first.

- `cloudApi.connectToPeer(peerId, cloudMeta)` -> `requestConnect(peerId, cloudMeta)`: the
  join dial's metadata gains `cloud: <plain JSON <= 1 KB>` (bounded in `boundCloudMeta`;
  oversized or unserialisable data is dropped, not truncated), remembered per peer on the
  PeerConnection (`dialCloud`) so a restore re-dial knocks with the same hand, forgotten by
  the next plain dial. Absent = the dial is byte-identical (`{jr: 1}`).
- `authProvider.decide(peerId, cloudMeta)` REPLACES `authorize` when present: 'admit' (the
  auto-approve path), 'deny' (refused with NO card; a joiner that advertised `jr` hears
  `denied` through the 25-F refusal dial, an older one is closed silently), `{label}` (the
  normal card carrying the label, capped at 120 chars, refreshed by a re-dial). Undefined
  defers to `authorize`; a provider with only `authorize` is byte-unchanged; a throwing
  `decide` falls back to the manual card and admits nobody.
- `Toasts.svelte` and the Connect drawer's Toasts tab render `approval.label`.
- `cloudApi.dialMeta = true` is the probe an older engine lacks (the cloud plugin fails
  closed to the plain approval card without it). No CLOUD_HOOKS_VERSION bump: additive.
- `pendingApprovals` is typed `Writable<any[]>` (it inferred never[]), which removes five
  pre-existing svelte-check errors; the patch's own JSDoc gaps (dialOptions/dial params,
  the `dialCloud` field) are filled so the check adds nothing.

Suite `dial-metadata` (43): the joiner's dial (identical without metadata, carried on the
dial and its restore, bounded), every verdict branch against a stubbed peer, and two real
peers over signaling (label, deny, admit). The patch itself was written and proven by the
`29-rooms-access` lane; this lands it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 src/components/menu/ConnectInfoDrawer.svelte |   2 +-
 src/components/menu/Toasts.svelte            |   7 +
 src/lib/cloudHooks.js                        |   4 +
 src/lib/cloudPlugin.js                       |   9 +-
 src/lib/peerApproval.js                      |  26 +-
 src/lib/peerHandler.svelte.js                |  45 +++-
 src/stores/appStore.js                       |   3 +
 tests/e2e/dial-metadata.test.cjs             | 244 +++++++++++++++++++
 8 files changed, 324 insertions(+), 16 deletions(-)
 create mode 100644 tests/e2e/dial-metadata.test.cjs

diff --git a/src/components/menu/ConnectInfoDrawer.svelte b/src/components/menu/ConnectInfoDrawer.svelte
index 6524a2b9..7884aba4 100644
--- a/src/components/menu/ConnectInfoDrawer.svelte
+++ b/src/components/menu/ConnectInfoDrawer.svelte
@@ -209,7 +209,7 @@
 				<ul class="cxd-toast-list">
 					{#each $pendingApprovals as a (a.peerId)}
 						<li class="cxd-toast cxd-live" data-kind="request">
-							<div class="cxd-toast-text">Connection request from <span class="cxd-mono">{String(a.peerId).toUpperCase()}</span></div>
+							<div class="cxd-toast-text">Connection request from <span class="cxd-mono">{String(a.peerId).toUpperCase()}</span>{#if a.label}<span class="cxd-knock"> — {a.label}</span>{/if}</div>
 							<div class="cxd-live-actions">
 								{#if $rolesInfo}
 									<button class="cxd-approve" onclick={() => approveRequest(a, null)} title="Approve as viewer">View only</button>
diff --git a/src/components/menu/Toasts.svelte b/src/components/menu/Toasts.svelte
index b673e0a1..d1d1217a 100644
--- a/src/components/menu/Toasts.svelte
+++ b/src/components/menu/Toasts.svelte
@@ -534,6 +534,8 @@ style="z-index: var(--z-toast); pointer-events: none;"
             <div class="tp-toast-text">
                 Connection request <span class="cxreq-id">{String(approval.peerId).slice(0, 6).toUpperCase()}</span>
             </div>
+            <!-- 29: a cloud plugin's label for the knock ("Ada wants to join Amber Mesa") -->
+            {#if approval.label}<div class="cxreq-label">{approval.label}</div>{/if}
             <!-- 27-E: how long they have been waiting. An EXPIRED card stays approvable —
                  a missed request is worse than a stale card, and approving still just
                  dials back; if they gave up, that dial answers with peer-unavailable,
@@ -731,6 +733,11 @@ style="z-index: var(--z-toast-low); pointer-events: none;"
     font-size: 11px;
     opacity: 0.65;
 }
+.cxreq-label {
+    margin-top: 2px;
+    font-size: 12px;
+    overflow-wrap: anywhere;
+}
 .cxreq-age.expired {
     opacity: 0.9;
     color: #fbbf24;
diff --git a/src/lib/cloudHooks.js b/src/lib/cloudHooks.js
index 7b4b1332..ce178f03 100644
--- a/src/lib/cloudHooks.js
+++ b/src/lib/cloudHooks.js
@@ -96,6 +96,10 @@ export function hasCapabilityProvider() {
  *     is a synchronous lookup against it). Returns false/undefined = defer to the
  *     normal whitelist+approval flow.
  *   onPeerConnect(peerId): void — observe accepted connections (identity binding).
+ *   decide(peerId, cloudMeta): 'admit' | 'deny' | {label} — 29 (rooms access). When
+ *     present it replaces `authorize`: `cloudMeta` is the joiner's dial data
+ *     (cloudApi.connectToPeer's 2nd arg, null when absent); 'deny' refuses with no
+ *     approval card; an object is the normal card, carrying `label`.
  * @type {any}
  */
 let authProvider = null;
diff --git a/src/lib/cloudPlugin.js b/src/lib/cloudPlugin.js
index 7ce6d6f7..f8404764 100644
--- a/src/lib/cloudPlugin.js
+++ b/src/lib/cloudPlugin.js
@@ -131,8 +131,13 @@ function makeCloudApi() {
 		/** the id of the peer whose session we joined, or null when WE are the host —
 		 *  lets the plugin make the session host the roles authority (admin) — v2.1 */
 		sessionHost: () => get(sessionHost),
-		/** dial a peer through the normal request flow (join a room) — v2 */
-		connectToPeer: (/** @type {string} */ peerId) => requestConnect(peerId),
+		/** dial a peer through the normal request flow (join a room) — v2. 29: an optional
+		 *  `cloudMeta` (plain JSON, ≤ 1 KB) rides the join dial to the host's auth hook
+		 *  (`decide(peerId, cloudMeta)`) — a knock's name, a room-code proof. */
+		connectToPeer: (/** @type {string} */ peerId, /** @type {any} */ cloudMeta) => requestConnect(peerId, cloudMeta),
+		/** 29: this engine carries `cloudMeta` on dials and consults `authProvider.decide`
+		 *  (admit / deny / knock-with-label). Absent on older engines — probe it. */
+		dialMeta: true,
 
 		// --- plugin message channel (replicate the plugin's own state) ---
 		/** broadcast a cloud message to all peers (roles, room announces) */
diff --git a/src/lib/peerApproval.js b/src/lib/peerApproval.js
index 0a050c9e..e2dae149 100644
--- a/src/lib/peerApproval.js
+++ b/src/lib/peerApproval.js
@@ -199,9 +199,10 @@ export function modalClosed() {
  * immediately, and it costs nothing to ask before opening a connection that cannot open.
  * Still `async` so the cloud plugin's `connectToPeer` keeps returning a promise; the body
  * has no awaits, so every dial happens in the same tick.
- * @param {string} rawId @returns {Promise<void>}
+ * @param {string} rawId @param {any} [cloudMeta] 29: a cloud plugin's dial data (see dialOptions)
+ * @returns {Promise<void>}
  */
-export async function requestConnect(rawId) {
+export async function requestConnect(rawId, cloudMeta) {
 	const peerId = String(rawId || '').toLowerCase();
 	/** @type {any} */
 	const peer = get(peers);
@@ -210,18 +211,23 @@ export async function requestConnect(rawId) {
 		showToast('Not connected to a signaling server yet — try again in a moment.');
 		return;
 	}
-	dial(peerId);
+	dial(peerId, cloudMeta);
 }
 
 /**
  * The dial itself: whitelist + broadcast the roster + open the DataConnection + queue the
  * pending entry. Split out of `requestConnect` so the guard above reads as one decision
  * and this stays exactly what it always did. @param {string} peerId
+ * @param {any} [cloudMeta] 29: the plugin's dial data, remembered per peer for re-dials
  */
-function dial(peerId) {
+function dial(peerId, cloudMeta) {
 	/** @type {any} */
 	const peer = get(peers);
 	if (!peer) return;
+	// 29: remember the plugin's dial data for this peer's join dials (and their restores)
+	const cloud = boundCloudMeta(cloudMeta);
+	if (cloud !== undefined) (peer.dialCloud ??= new Map()).set(peerId, cloud);
+	else peer.dialCloud?.delete(peerId);
 	clearJoinRefusal(); // 25-F: a new request replaces the last answer on the pill
 	const users = /** @type {any[]} */ (get(userdata));
 	if (!users.some((/** @type {any} */ u) => u[0] === peerId)) {
@@ -244,6 +250,18 @@ function dial(peerId) {
 	}
 }
 
+/** 29: a plugin's dial data, bounded — plain JSON under 1 KB, else nothing.
+ * @param {any} cloud @returns {any} */
+function boundCloudMeta(cloud) {
+	if (cloud === undefined || cloud === null) return undefined;
+	try {
+		const s = JSON.stringify(cloud);
+		return s && s.length <= 1024 ? JSON.parse(s) : undefined;
+	} catch {
+		return undefined;
+	}
+}
+
 /** @type {Map<string, any>} one expiry timer per outbound request */
 const approvalTimers = new Map();
 
diff --git a/src/lib/peerHandler.svelte.js b/src/lib/peerHandler.svelte.js
index 25f26037..9b655c10 100644
--- a/src/lib/peerHandler.svelte.js
+++ b/src/lib/peerHandler.svelte.js
@@ -144,12 +144,20 @@ const STREAM_TYPES = new Set(['camera', 'vrhands']);
  * is what lets a host send a refusal without an older joiner mistaking the refusal dial
  * for an approval (see `JOIN_RESULTS` in connectionState). `result` is set only by the
  * host's approve dial-back.
- * @param {string} [result] @returns {{metadata: Record<string, any>}}
+ * 29: `cloud` is a plugin's dial data (peerApproval.boundCloudMeta), never on a result dial.
+ * @param {string} [result] @param {any} [cloud] @returns {{metadata: Record<string, any>}}
  */
-function dialOptions(result) {
-	return { metadata: result ? { jr: 1, joinresult: result } : { jr: 1 } };
+function dialOptions(result, cloud) {
+	/** @type {Record<string, any>} */
+	const metadata = result ? { jr: 1, joinresult: result } : { jr: 1 };
+	// 29 (rooms access): a cloud plugin's own dial data — a knock's name, a room-code
+	// proof — rides the join dial so the host's auth hook reads it BEFORE any data flows
+	// (an unapproved conn is closed at once). Absent = the dial is byte-identical.
+	if (cloud !== undefined && !result) metadata.cloud = cloud;
+	return { metadata };
 }
 
+
 /** How long a refusal dial may hang before it is closed regardless. The answer is in its
  * metadata, which the joiner has at its `connection` event — the conn never needs to
  * open, and a joiner that closes it at once is the normal case. */
@@ -208,6 +216,9 @@ export class PeerConnection {
 		/** 25-F: peers whose NEXT dial is an approval dial-back, so its handshake opens with
 		 * `joinresult: approved` @type {Set<string>} */
 		this.approvedDialBacks = new Set();
+		/** @type {Map<string, any>} 29 (rooms access): a cloud plugin's dial data per peer we
+		 * are joining — read by every join dial and its restore re-dials (dialOptions) */
+		this.dialCloud = new Map();
 		/** 25-F: peers a refusal dial is out to — their `peer-unavailable` is not news @type {Set<string>} */
 		this.refusalDials = new Set();
 
@@ -517,10 +528,26 @@ export class PeerConnection {
 			// M1b (open-core): a cloud auth provider may pre-approve a known /
 			// authenticated peer, skipping the manual Approve. Default — no provider
 			// — keeps the whitelist + approval flow byte-identical.
+			/** 29: the approval card's plugin label ("Ada wants to join Amber Mesa") */
+			let knockLabel = '';
 			if (!found) {
 				const auth = getAuthProvider();
 				try {
-					const authorized = !!auth && typeof auth.authorize === 'function' && auth.authorize(conn.peer);
+					// 29 (rooms access): a provider with `decide(peerId, cloudMeta)` answers
+					// 'admit' | 'deny' | {label} (knock). 'deny' refuses with no card — told to a
+					// joiner that can hear it. Without `decide`, `authorize` as before.
+					const cloudMeta = conn?.metadata?.cloud ?? null;
+					const verdict = auth && typeof auth.decide === 'function' ? auth.decide(conn.peer, cloudMeta) : undefined;
+					if (verdict === 'deny') {
+						if (conn?.metadata?.jr) this.sendJoinResult(conn.peer, 'denied');
+						conn.close();
+						return;
+					}
+					if (verdict && typeof verdict === 'object' && verdict.label) knockLabel = String(verdict.label).slice(0, 120);
+					const authorized =
+						verdict !== undefined
+							? verdict === 'admit'
+							: !!auth && typeof auth.authorize === 'function' && auth.authorize(conn.peer);
 					if (authorized && roomIsFull(this) && conn?.metadata?.jr) {
 						// 25-F: a plugin would let them in, but the mesh cannot take one more —
 						// say so rather than auto-approving past the hard cap
@@ -553,11 +580,11 @@ export class PeerConnection {
 				// refreshes the answer on the card that is already there.
 				const hearsNo = !!conn?.metadata?.jr;
 				const known = approvals.find(toast => toast.peerId === conn.peer);
-				if (known && known.hearsNo !== hearsNo) {
-					pendingApprovals.set(/** @type {any} */ (approvals.map((/** @type {any} */ a) => (a.peerId === conn.peer ? { ...a, hearsNo } : a))));
+				if (known && (known.hearsNo !== hearsNo || (knockLabel && known.label !== knockLabel))) {
+					pendingApprovals.set(/** @type {any} */ (approvals.map((/** @type {any} */ a) => (a.peerId === conn.peer ? { ...a, hearsNo, ...(knockLabel ? { label: knockLabel } : {}) } : a))));
 				}
 				if (!known) {
-					approvals.push({ peerId: conn.peer, hearsNo });
+					approvals.push(knockLabel ? { peerId: conn.peer, hearsNo, label: knockLabel } : { peerId: conn.peer, hearsNo });
 					// 27-E: stamp the SAME clock the joiner's countdown uses, so the card's
 					// age and their pill agree; and BOUND the queue — a host who walked away
 					// used to collect a card per dial with nothing dropping them (audit H3).
@@ -1391,7 +1418,7 @@ export class PeerConnection {
 			console.log("Connecting to " + peerId);
             // 25-F: an approval dial-back says so in its metadata; every dial says it can
             // hear a join result
-            const conn = this.peer.connect(peerId, dialOptions(this.approvedDialBacks.has(peerId) ? 'approved' : undefined));
+            const conn = this.peer.connect(peerId, dialOptions(this.approvedDialBacks.has(peerId) ? 'approved' : undefined, this.dialCloud?.get(peerId)));
             // peer.connect returns undefined when the signaling link is down
             // (disconnected peer) — bail instead of throwing on conn.on below (CN)
             if (!conn) {
@@ -1474,7 +1501,7 @@ export class PeerConnection {
 			try { stale.close(); } catch {}
 			delete this.connections[peerId];
 		}
-		const conn = this.peer.connect(peerId, dialOptions());
+		const conn = this.peer.connect(peerId, dialOptions(undefined, this.dialCloud?.get(peerId)));
 		if (!conn) {
 			log('error', 'net', 'restore failed: signaling link is down', { peer: peerId });
 			return;
diff --git a/src/stores/appStore.js b/src/stores/appStore.js
index c24c802d..f94a0442 100644
--- a/src/stores/appStore.js
+++ b/src/stores/appStore.js
@@ -254,6 +254,9 @@ export const objectContextMenu = writable(null);
 export const renamingObject = writable(null);
 
 export const fixLight = writable(false);
+/** connection requests awaiting the host's answer: `{peerId, hearsNo?, label?, status?, at?}` per
+ * row (29: `label` is a cloud plugin's knock line, see peerHandler's decide branch).
+ * @type {import('svelte/store').Writable<any[]>} */
 export const pendingApprovals = writable([]);
 export const waitingForApproval = writable([]);
 /** @type {import('svelte/store').Writable<any[]>} strings or {text, actions} */
diff --git a/tests/e2e/dial-metadata.test.cjs b/tests/e2e/dial-metadata.test.cjs
new file mode 100644
index 00000000..7b9d1253
--- /dev/null
+++ b/tests/e2e/dial-metadata.test.cjs
@@ -0,0 +1,244 @@
+// 29 (roadmap 29, rooms access control) — THE JOIN DIAL CARRIES THE PLUGIN'S DATA, AND
+// THE HOST'S AUTH HOOK DECIDES ON IT.
+//
+// A cloud room can be gated (a code, a knock with a name). The plugin cannot say any of
+// that over the data channel, because an unapproved conn is closed before it opens — the
+// only thing that reaches the host FIRST is the dial's PeerJS metadata. So
+// `cloudApi.connectToPeer(peerId, cloudMeta)` → `requestConnect(peerId, cloudMeta)` puts
+// `cloud: <plain JSON ≤ 1 KB>` on the join dial (and on that peer's restore re-dials),
+// and `authProvider.decide(peerId, cloudMeta)` — when the provider has one — replaces
+// `authorize`: 'admit' / 'deny' (refused with NO card, told to a joiner that can hear
+// it) / {label} (the normal card, carrying the label). `cloudApi.dialMeta === true` is
+// the probe an older engine lacks.
+//
+// What this suite pins:
+//   1   the JOINER: no metadata → the dial is byte-identical to before the seam
+//   2   metadata rides the dial AND its restore re-dial; a later plain dial forgets it;
+//       oversized / unserialisable data is dropped rather than sent
+//   3   the HOST, against a stubbed peer: deny (closed, no card, refusal dial only when
+//       the joiner can hear it) · label (the card carries it, capped, refreshed on a
+//       re-dial) · admit (whitelisted + dialled back, no card) · no verdict → the old
+//       `authorize` path · a provider with ONLY authorize is byte-identical · a
+//       throwing decide falls back to the manual card
+//   4   two real peers over signaling: the label, then deny, then admit
+//
+// Run: APP_URL=https://theprototype.app:5219/ PEER_CONFIG=... npm run e2e -- dial-metadata
+const h = require('./helpers.cjs');
+
+/** run a snippet with `s = window.__stores` and `pc` (the PeerConnection) in scope */
+const inPage = (peer, body, arg) =>
+	peer.page.evaluate(
+		([src, a]) => {
+			let pc = null;
+			window.__stores.peers.subscribe((v) => (pc = v))();
+			return Object.getPrototypeOf(async function () {}).constructor('s', 'pc', 'arg', src)(window.__stores, pc, a);
+		},
+		[body, arg ?? null]
+	);
+const read = (peer, store) => inPage(peer, `let v; s.${store}.subscribe((x) => (v = x))(); return v;`);
+const dials = (peer) => inPage(peer, 'return window.__dials.map((d) => ({ id: d.id, opts: d.opts }))');
+const lastDial = async (peer, id) => (await dials(peer)).filter((d) => d.id === id).pop() ?? null;
+
+/** an incoming conn as peerjs hands it to the `connection` event */
+const EMIT = `
+	const fake = { peer: arg.peer, metadata: arg.metadata, open: false, closed: false, handlers: {},
+		on(ev, fn) { this.handlers[ev] = fn; }, close() { this.closed = true; }, send() {} };
+	pc.peer.emit('connection', fake);
+	return { closed: fake.closed, wired: Object.keys(fake.handlers) };`;
+
+/** dial against a stubbed peer.connect that records every call */
+const DIAL_STUB = `
+	window.__dials = [];
+	Object.defineProperty(pc.peer, 'open', { value: true, configurable: true });
+	pc.peer.connect = (id, opts) => {
+		const conn = { peer: id, open: false, sent: [], handlers: {}, on(ev, fn) { (this.handlers[ev] ??= []).push(fn); }, close() { this.closed = true; }, send(m) { this.sent.push(m); } };
+		window.__dials.push({ id, opts: JSON.parse(JSON.stringify(opts ?? null)), conn });
+		return conn;
+	};`;
+
+/** the host's auth provider: `decide` records what it was asked and answers
+ *  `window.__verdict` (a thrower when it is the string 'throw') */
+const DECIDER = `
+	window.__decided = [];
+	window.__verdict = arg;
+	s.cloudHooks.setAuthProvider({
+		decide(peerId, meta) {
+			window.__decided.push({ peerId, meta: meta === undefined ? 'undefined' : meta });
+			if (window.__verdict === 'throw') throw new Error('decide blew up');
+			return window.__verdict;
+		}
+	});`;
+
+const text = (loc) => loc.textContent({ timeout: 3000 }).catch(() => '');
+const click = (loc, timeout = 5000) => loc.click({ timeout }).then(() => true, () => false);
+
+async function dialVia(peer, id) {
+	await peer.page.locator('input[placeholder="Enter peer ID to connect"]').fill(id);
+	await peer.page.getByRole('button', { name: 'Connect', exact: true }).click();
+	await peer.page.waitForTimeout(300);
+}
+
+h.run(async () => {
+	const browser = await h.launch();
+
+	// ==================================================================== the joiner
+	const J = await h.setupPage(browser, 'joiner');
+	await J.page.waitForFunction(() => !!window.__stores?.peerApproval?.requestConnect, { timeout: 30000 });
+	await inPage(J, DIAL_STUB);
+
+	console.log('\n=== 1. no metadata: the dial is byte-identical ===');
+	h.check((await inPage(J, 'return s.cloudPlugin.makeCloudApi().dialMeta')) === true, 'cloudApi.dialMeta === true is the probe for this engine');
+	await dialVia(J, 'aaaa1');
+	const plain = await lastDial(J, 'aaaa1');
+	h.check(JSON.stringify(plain?.opts) === '{"metadata":{"jr":1}}', `a pill dial carries exactly {jr:1} and nothing else (${JSON.stringify(plain?.opts)})`);
+
+	console.log('\n=== 2. metadata rides the dial ===');
+	const META = { v: 1, room: 'amber-mesa', name: 'Ada', proof: 'abc123' };
+	await inPage(J, 's.peerApproval.requestConnect("bbbb1", arg)', META);
+	await J.page.waitForTimeout(200);
+	const withMeta = await lastDial(J, 'bbbb1');
+	h.check(JSON.stringify(withMeta?.opts?.metadata?.cloud) === JSON.stringify(META), `connectToPeer's 2nd arg rides the join dial as metadata.cloud (${JSON.stringify(withMeta?.opts)})`);
+	h.check(withMeta?.opts?.metadata?.jr === 1, 'and the dial still says it can hear a join result');
+	// the restore re-dial carries it too — a joiner that loses the negotiation mid-way
+	// must not knock a second time with an EMPTY hand
+	await inPage(J, 'pc.restoreConnection("bbbb1")');
+	const restored = await lastDial(J, 'bbbb1');
+	h.check((await dials(J)).filter((d) => d.id === 'bbbb1').length === 2, 'premise: the restore re-dialled');
+	h.check(JSON.stringify(restored?.opts?.metadata?.cloud) === JSON.stringify(META), 'the restore re-dial carries the same metadata');
+	// a plain dial to the same peer forgets it
+	await inPage(J, 's.waitingForApproval.set([]); s.userdata.set([]);');
+	await dialVia(J, 'bbbb1');
+	const forgot = await lastDial(J, 'bbbb1');
+	h.check(forgot && !('cloud' in (forgot.opts?.metadata ?? {})), `a later plain dial to the same peer carries no cloud data (${JSON.stringify(forgot?.opts)})`);
+	// bounded: over 1 KB is dropped, not truncated; unserialisable is dropped
+	await inPage(J, 's.peerApproval.requestConnect("cccc1", { pad: "x".repeat(1100) })');
+	const big = await lastDial(J, 'cccc1');
+	h.check(big && !('cloud' in big.opts.metadata), 'metadata over 1 KB is dropped (the dial goes out without it)');
+	await inPage(J, 'const cyc = { a: 1 }; cyc.self = cyc; s.peerApproval.requestConnect("cccc2", cyc)');
+	const cyc = await lastDial(J, 'cccc2');
+	h.check(cyc && !('cloud' in cyc.opts.metadata), 'unserialisable metadata is dropped');
+	await inPage(J, 's.peerApproval.requestConnect("cccc3", { n: 1 }); s.waitingForApproval.set([]); s.userdata.set([]); delete pc.connections["cccc3"]; s.peerApproval.requestConnect("cccc3", null)');
+	const nulled = await lastDial(J, 'cccc3');
+	h.check(nulled && !('cloud' in nulled.opts.metadata), 'null metadata forgets a remembered one');
+	await J.ctx.close();
+
+	// ==================================================================== the host
+	const H = await h.setupPage(browser, 'host');
+	await H.page.waitForFunction(() => !!window.__stores?.cloudHooks?.setAuthProvider, { timeout: 30000 });
+	await inPage(H, DIAL_STUB);
+	const cards = () => read(H, 'pendingApprovals');
+	const decided = () => inPage(H, 'return window.__decided');
+
+	console.log('\n=== 3a. decide → deny ===');
+	await inPage(H, DECIDER, 'deny');
+	const denied = await inPage(H, EMIT, { peer: 'dddd1', metadata: { jr: 1, cloud: { v: 1, name: 'Mallory', proof: 'wrong' } } });
+	h.check(denied.closed && denied.wired.length === 0, `a denied dial is closed at once and never wired (${JSON.stringify(denied)})`);
+	const d1 = await decided();
+	h.check(d1.length === 1 && d1[0].peerId === 'dddd1' && d1[0].meta?.name === 'Mallory' && d1[0].meta?.proof === 'wrong', `decide saw the peer id and the dial's cloud data (${JSON.stringify(d1)})`);
+	h.check(!(await cards()).some((c) => c.peerId === 'dddd1'), 'NO approval card for a denied dial');
+	h.check(!(await read(H, 'userdata')).some((u) => u[0] === 'dddd1'), '…and it is not whitelisted');
+	const refusal = await lastDial(H, 'dddd1');
+	h.check(refusal?.opts?.metadata?.joinresult === 'denied', `a joiner that can hear it is told "denied" (${JSON.stringify(refusal?.opts)})`);
+	// an older joiner (no jr) cannot hear a refusal — it would read the dial as approval
+	await inPage(H, EMIT, { peer: 'dddd2', metadata: { cloud: { name: 'Old' } } });
+	h.check((await dials(H)).filter((d) => d.id === 'dddd2').length === 0, 'an older joiner is denied silently — no refusal dial it would misread as an approval');
+	h.check(!(await cards()).some((c) => c.peerId === 'dddd2'), '…and still gets no card');
+	// a dial with no cloud data at all reaches decide as null
+	await inPage(H, EMIT, { peer: 'dddd3', metadata: { jr: 1 } });
+	const d3 = (await decided()).find((d) => d.peerId === 'dddd3');
+	h.check(d3 && d3.meta === null, `a dial without cloud data reaches decide as null, not undefined (${JSON.stringify(d3)})`);
+
+	console.log('\n=== 3b. decide → {label} ===');
+	const LABEL = 'Ada wants to join Amber Mesa';
+	await inPage(H, DECIDER, { label: LABEL });
+	// (the unapproved conn itself is closed at once, as every pending request's is — the
+	// CARD is the state, and it is what carries the label)
+	await inPage(H, EMIT, { peer: 'eeee1', metadata: { jr: 1, cloud: { v: 1, name: 'Ada' } } });
+	const c1 = (await cards()).find((c) => c.peerId === 'eeee1');
+	h.check(c1 && c1.label === LABEL && c1.hearsNo === true, `the approval card carries the label (${JSON.stringify(c1)})`);
+	const card = H.page.locator('.tp-toast--req', { hasText: 'EEEE1' });
+	await card.waitFor({ timeout: 5000 }).catch(() => {});
+	h.check((await text(card.locator('.cxreq-label'))).trim() === LABEL, 'the toast card renders the label under the request line');
+	// a re-dial with a label refreshes a card that had none
+	await inPage(H, DECIDER, {});
+	await inPage(H, EMIT, { peer: 'eeee2', metadata: { jr: 1 } });
+	h.check((await cards()).some((c) => c.peerId === 'eeee2' && !c.label), 'an object verdict without a label is the plain card');
+	await inPage(H, DECIDER, { label: 'Bo wants to join' });
+	await inPage(H, EMIT, { peer: 'eeee2', metadata: { jr: 1, cloud: { name: 'Bo' } } });
+	h.check((await cards()).some((c) => c.peerId === 'eeee2' && c.label === 'Bo wants to join'), 'a re-dial with a label refreshes the existing card');
+	h.check((await cards()).filter((c) => c.peerId === 'eeee2').length === 1, '…without adding a second card');
+	// the label is bounded
+	await inPage(H, DECIDER, { label: 'L'.repeat(300) });
+	await inPage(H, EMIT, { peer: 'eeee3', metadata: { jr: 1 } });
+	const c3 = (await cards()).find((c) => c.peerId === 'eeee3');
+	h.check(c3 && c3.label.length === 120, `the label is capped at 120 characters (${c3?.label?.length})`);
+	// the drawer's Toasts tab shows it too
+	await click(H.page.locator('[data-testid="connect-info-button"]'));
+	await H.page.waitForTimeout(350);
+	await click(H.page.locator('.cxd-tab', { hasText: 'Toasts' }));
+	await H.page.waitForTimeout(250);
+	const drawerKnock = H.page.locator('.cxd-knock', { hasText: LABEL });
+	h.check((await drawerKnock.count()) >= 1, 'the Connect drawer renders the label beside the request');
+	await H.page.mouse.click(10, 500);
+	await H.page.waitForTimeout(300);
+	for (const id of ['eeee1', 'eeee2', 'eeee3']) await click(H.page.locator('.tp-toast--req', { hasText: id.toUpperCase() }).locator('.cxreq-reject'));
+	await H.page.waitForTimeout(300);
+	h.check(!(await cards()).some((c) => /^eeee/.test(c.peerId)), 'premise: the knock cards are cleared');
+
+	console.log('\n=== 3c. decide → admit ===');
+	await inPage(H, DECIDER, 'admit');
+	await inPage(H, EMIT, { peer: 'ffff1', metadata: { jr: 1, cloud: { v: 1, proof: 'right' } } });
+	await H.page.waitForTimeout(200);
+	h.check((await read(H, 'userdata')).some((u) => u[0] === 'ffff1'), 'an admitted peer is whitelisted');
+	h.check(!(await cards()).some((c) => c.peerId === 'ffff1'), '…with no card');
+	const back = await lastDial(H, 'ffff1');
+	h.check(back?.opts?.metadata?.joinresult === 'approved', `…and dialled back as an approval (${JSON.stringify(back?.opts)})`);
+
+	console.log('\n=== 3d. no verdict → the old authorize path ===');
+	await inPage(H, 'window.__decided = []; s.cloudHooks.setAuthProvider({ decide() { window.__decided.push(1); return undefined; }, authorize(id) { return id === "gggg1"; } })');
+	await inPage(H, EMIT, { peer: 'gggg1', metadata: { jr: 1 } });
+	await inPage(H, EMIT, { peer: 'gggg2', metadata: { jr: 1 } });
+	h.check((await read(H, 'userdata')).some((u) => u[0] === 'gggg1'), 'decide returning undefined defers to authorize (gggg1 admitted)');
+	h.check((await cards()).some((c) => c.peerId === 'gggg2' && !c.label), '…which sends the rest to the plain card');
+	// a provider with ONLY authorize: byte-identical to before the seam
+	await inPage(H, 's.cloudHooks.setAuthProvider({ authorize(id) { return id === "hhhh1"; } })');
+	await inPage(H, EMIT, { peer: 'hhhh1', metadata: { jr: 1, cloud: { name: 'ignored' } } });
+	await inPage(H, EMIT, { peer: 'hhhh2', metadata: { jr: 1 } });
+	h.check((await read(H, 'userdata')).some((u) => u[0] === 'hhhh1') && (await cards()).some((c) => c.peerId === 'hhhh2'), 'a provider with only authorize behaves exactly as before');
+	// a throwing decide fails SAFE: the manual card, never a silent admit
+	await inPage(H, DECIDER, 'throw');
+	await inPage(H, EMIT, { peer: 'iiii1', metadata: { jr: 1 } });
+	h.check((await cards()).some((c) => c.peerId === 'iiii1') && !(await read(H, 'userdata')).some((u) => u[0] === 'iiii1'), 'a decide that throws falls back to the manual card and admits nobody');
+	await inPage(H, 's.cloudHooks.setAuthProvider(null)');
+	await H.ctx.close();
+
+	// ==================================================================== two real peers
+	console.log('\n=== 4. two real peers ===');
+	const A = await h.setupPage(browser, 'A');
+	const B = await h.setupPage(browser, 'B');
+	await A.page.waitForFunction(() => !!window.__stores?.cloudHooks?.setAuthProvider, { timeout: 30000 });
+	await inPage(A, DECIDER, { label: LABEL });
+	await inPage(B, 's.peerApproval.requestConnect(arg.id, arg.meta)', { id: A.id, meta: { v: 1, room: 'amber-mesa', name: 'Ada' } });
+	const acard = A.page.locator('.tp-toast--req', { hasText: String(B.id).slice(0, 6).toUpperCase() });
+	await acard.waitFor({ timeout: 30000 }).catch(() => {});
+	h.check((await acard.count()) === 1, "premise: A gets B's request card over signaling");
+	h.check((await text(acard.locator('.cxreq-label'))).trim() === LABEL, 'the real card carries the plugin label');
+	const real = await inPage(A, 'return window.__decided');
+	h.check(real.some((d) => d.peerId === B.id && d.meta?.name === 'Ada' && d.meta?.room === 'amber-mesa'), `A's decide received B's dial data over the wire (${JSON.stringify(real)})`);
+	h.check(await click(acard.locator('.cxreq-reject'), 10000), 'premise: A rejects the knock');
+	await h.eventually(() => read(B, 'connectionState.joinRefusal'), (r) => r?.result === 'denied' && r?.peerId === A.id, 'B hears the rejected knock as declined', 20000);
+
+	await inPage(A, 'window.__decided = []; window.__verdict = "deny"');
+	await inPage(B, 's.peerApproval.requestConnect(arg.id, arg.meta)', { id: A.id, meta: { v: 1, room: 'amber-mesa', proof: 'wrong' } });
+	await h.eventually(() => read(B, 'connectionState.joinRefusal'), (r) => r?.result === 'denied' && r?.peerId === A.id, 'B hears a decide-deny as declined', 20000);
+	h.check((await inPage(A, 'return window.__decided')).some((d) => d.meta?.proof === 'wrong'), 'premise: A decided on the wrong proof');
+	h.check(!(await read(A, 'pendingApprovals')).some((c) => c.peerId === B.id), 'A saw no card for the denied dial');
+
+	await inPage(A, 'window.__decided = []; window.__verdict = "admit"');
+	await inPage(B, 's.peerApproval.requestConnect(arg.id, arg.meta)', { id: A.id, meta: { v: 1, room: 'amber-mesa', proof: 'right' } });
+	await h.eventually(() => read(B, 'connectionState.sessionHost'), (v) => v === A.id, 'B is admitted with nobody pressing Approve', 30000);
+	h.check(!(await read(A, 'pendingApprovals')).some((c) => c.peerId === B.id), 'A saw no card for the admitted dial');
+	h.check((await read(A, 'userdata')).some((u) => u[0] === B.id), 'B is on A\'s roster');
+
+	await h.finish(browser);
+});

From 311e184af865b1352d510c21817ec465471b3b99 Mon Sep 17 00:00:00 2001
From: AlexZ005 <alexz005.info@gmail.com>
Date: Sun, 20 Sep 2026 03:48:15 +0300
Subject: [PATCH 2/3] [feat] cloudApi v3.1: api.aiPresets + setMeshJobStatus
 (the hosted-AI seam)

Roadmap 29, G-3 hosted AI (seam 2). A signed-in cloud user should get the assistant with
no key, URL or model to type. The plugin cannot write core's aiProviders / meshProviders
itself - they are Svelte stores loaded from localStorage at module init, so a key written
after boot changes nothing until a reload - so core owns ONE plugin-managed preset per
domain and the plugin describes it.

- `api.aiPresets.userHas(tag)` -> `{ai, mesh}`: does the user have a provider of their
  OWN (the tagged entry excluded).
- `api.aiPresets.seed(tag, {ai, mesh, activate, enable})`: create / update / remove the
  managed entry in both lists (`null` removes). `tag` is `managedBy` on the config, so a
  user-created provider - which carries no tag - is untouchable by construction; a config
  cannot smuggle an `id` or a tag. ACTIVATION takes two guards, both required: the
  caller's `activate.<domain>` AND the slot being empty or already ours. The trap the lane
  brief named: `addAiProvider`/`addMeshProvider` activate a first provider on their own,
  so a seed without permission restores the previous pointer, or guard 1 leaks through
  the add (the suite's counterfactual). `enable` flips the master toggle only when our
  entry became the active one.
- `providers.js` / `meshProviders.js`: optional `managedBy` on the config typedef (absent
  = the user's own, no migration) and the add whitelists keep it.
- `api.setMeshJobStatus(fn)` + `cloudHooks.meshJobStatus`: one line under each RUNNING
  mesh-job card ("You are #3 in queue"); `fn()` -> string | null, re-read on every set
  (a function is never equal to itself in svelte's store check, so a set is the poke) and
  on every job-list change; a throwing fn renders nothing and breaks nothing.
- `makeCloudApi` is exported so the debug hook can hand a suite the real api.
- No CLOUD_HOOKS_VERSION bump: every member is additive and typeof-probed (the plugin
  stays compatibleHooks = 3; hostedAi.js already calls exactly this shape).

Suite `ai-presets` (45): the probe, create/update/remove, both activation guards with
their counterfactuals, enable-only-when-active, managedBy across the store and a reload,
and the status line's render/re-read/remove/throw.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 src/components/menu/MeshJobsCard.svelte |  18 +++
 src/lib/ai/meshProviders.js             |   7 +-
 src/lib/ai/providers.js                 |   6 +
 src/lib/cloudHooks.js                   |  11 ++
 src/lib/cloudPlugin.js                  | 120 ++++++++++++++-
 tests/e2e/ai-presets.test.cjs           | 193 ++++++++++++++++++++++++
 6 files changed, 353 insertions(+), 2 deletions(-)
 create mode 100644 tests/e2e/ai-presets.test.cjs

diff --git a/src/components/menu/MeshJobsCard.svelte b/src/components/menu/MeshJobsCard.svelte
index 806906d0..d87e34e1 100644
--- a/src/components/menu/MeshJobsCard.svelte
+++ b/src/components/menu/MeshJobsCard.svelte
@@ -3,6 +3,20 @@
 	// a small stack near the top-right — one card per active/finished job with a
 	// progress bar, cancel (while running) and dismiss (when finished).
 	import { meshJobs, cancelMeshJob, dismissMeshJob } from '$lib/ai/meshJobs';
+	// v3.1 (roadmap 29 G-3): a cloud plugin's own line under the status row — the
+	// hosted queue position. Null without a plugin; see cloudHooks.meshJobStatus.
+	import { meshJobStatus } from '$lib/cloudHooks';
+
+	/** the plugin's line, re-read when the fn is (re)set OR the job list changes — the
+	 *  second argument is unused on purpose: it is the dependency (the `screensFor`
+	 *  idiom, a `get()`-style read inside a helper registers nothing). */
+	function pluginLine(fn: (() => string | null) | null, _jobs: unknown): string {
+		try {
+			return (fn && fn()) || '';
+		} catch {
+			return '';
+		}
+	}
 
 	const RUNNING = new Set(['submitting', 'running', 'importing']);
 	function label(status: string) {
@@ -38,6 +52,10 @@
 						<span class="min-w-0 flex-1 truncate text-[11px] text-red-300/80" title={job.error}>{job.error}</span>
 					{/if}
 				</div>
+				{#if RUNNING.has(job.status)}
+					{@const line = pluginLine($meshJobStatus, $meshJobs)}
+					{#if line}<div class="mesh-job-plugin-line text-[11px] text-gray-400">{line}</div>{/if}
+				{/if}
 				{#if RUNNING.has(job.status)}
 					<div class="mt-1 h-1 w-full overflow-hidden rounded-sm bg-gray-700">
 						{#if job.progress != null}
diff --git a/src/lib/ai/meshProviders.js b/src/lib/ai/meshProviders.js
index 30cdb179..18d96212 100644
--- a/src/lib/ai/meshProviders.js
+++ b/src/lib/ai/meshProviders.js
@@ -20,6 +20,9 @@ import { safeStorage } from '../safeStorage';
  * @property {string} [assetProxy]    meshy: CORS proxy for the GLB download — Meshy's
  *   assets CDN sends no Access-Control-Allow-Origin, so browsers can't fetch the
  *   result directly. Blank = the build-time VITE_ASSET_PROXY default (meshy.js).
+ * @property {string} [managedBy] cloudApi v3.1 (roadmap 29 G-3): the tag of the cloud
+ *   plugin that OWNS this entry (`api.aiPresets.seed`). Absent = the user's own (see
+ *   ai/providers.js — same rule, same reason).
  */
 
 /**
@@ -121,7 +124,9 @@ export function addMeshProvider(config) {
 		...(config.workflowJson !== undefined ? { workflowJson: config.workflowJson } : {}),
 		...(config.outputNodeId !== undefined ? { outputNodeId: String(config.outputNodeId).trim() } : {}),
 		...(config.mode !== undefined ? { mode: config.mode } : {}),
-		...(config.assetProxy !== undefined ? { assetProxy: String(config.assetProxy).trim() } : {})
+		...(config.assetProxy !== undefined ? { assetProxy: String(config.assetProxy).trim() } : {}),
+		// v3.1: a plugin-managed preset keeps its tag
+		...(typeof config.managedBy === 'string' && config.managedBy ? { managedBy: config.managedBy } : {})
 	};
 	const list = [...get(meshProviders), entry];
 	meshProviders.set(list);
diff --git a/src/lib/ai/providers.js b/src/lib/ai/providers.js
index 754dbfc7..9a4bd6c9 100644
--- a/src/lib/ai/providers.js
+++ b/src/lib/ai/providers.js
@@ -27,6 +27,10 @@ import { safeStorage } from '../safeStorage';
  * @property {string[]} [models]   model ids the endpoint reported on the last
  *   successful Test connection (GET /models) — Settings' model-picker suggestions.
  *   Persisted so the picker still works after a reload without re-fetching.
+ * @property {string} [managedBy] cloudApi v3.1 (roadmap 29 G-3): the tag of the cloud
+ *   plugin that OWNS this entry (`api.aiPresets.seed`). ABSENT = the user's own — every
+ *   entry saved before the seam existed reads as theirs with no migration, and a preset
+ *   is untouchable-by-construction for anything but its own tag.
  */
 
 /**
@@ -164,6 +168,8 @@ export function addAiProvider(config) {
 	if (Array.isArray(config.models) && config.models.length) {
 		entry.models = config.models.map(String).slice(0, 500);
 	}
+	// v3.1: a plugin-managed preset keeps its tag (the whitelist above used to drop it)
+	if (typeof config.managedBy === 'string' && config.managedBy) entry.managedBy = config.managedBy;
 	const list = [...get(aiProviders), entry];
 	aiProviders.set(list);
 	persistProviders(list);
diff --git a/src/lib/cloudHooks.js b/src/lib/cloudHooks.js
index ce178f03..90123ac1 100644
--- a/src/lib/cloudHooks.js
+++ b/src/lib/cloudHooks.js
@@ -195,6 +195,17 @@ export const CLOUD_HOOKS_VERSION = 3;
  * @type {import('svelte/store').Writable<{name: string, version: string} | null>} */
 export const cloudPluginInfo = writable(null);
 
+/**
+ * v3.1 (roadmap 29 G-3, hosted AI): ONE extra status line under each mesh-job card,
+ * e.g. "You are #3 in queue for the hosted AI". The plugin installs a FUNCTION
+ * (`api.setMeshJobStatus(fn)`); `fn()` → string | null, null renders nothing. It is a
+ * function rather than a string so the plugin owns the wording and the moment: core
+ * re-reads it whenever the store is SET (a function is never `===` its last value in
+ * svelte's equality check, so setting the same fn again is a poke) and whenever the
+ * job list changes. Null = no plugin, the card is byte-identical.
+ * @type {import('svelte/store').Writable<(() => string | null) | null>} */
+export const meshJobStatus = writable(null);
+
 /**
  * 21-G5 (F7): CROSS-SCENE PRESENCE, the rolesInfo-bridge shape one domain over. The
  * rooms plugin publishes who is in the project's OTHER rooms/scenes and core renders
diff --git a/src/lib/cloudPlugin.js b/src/lib/cloudPlugin.js
index f8404764..f552dc10 100644
--- a/src/lib/cloudPlugin.js
+++ b/src/lib/cloudPlugin.js
@@ -25,6 +25,11 @@ import {
 import { currentLevel } from './levels';
 import { myPlayMode, peerPlayModes } from './gamePresence';
 import { safeStorage } from './safeStorage';
+// v3.1 (roadmap 29 G-3): the hosted-AI preset seam. Both provider modules are LEAVES
+// (svelte/store + safeStorage), so a static edge from here closes nothing.
+import { aiProviders, aiActiveProvider, aiEnabled, addAiProvider, updateAiProvider, removeAiProvider, setAiActiveProvider, setAiEnabled } from './ai/providers';
+import { meshProviders, meshActiveProvider, meshGenEnabled, addMeshProvider, updateMeshProvider, removeMeshProvider, setMeshActiveProvider, setMeshGenEnabled } from './ai/meshProviders';
+import { meshJobStatus } from './cloudHooks';
 
 // 28-A (roadmap #28, publish · play · remix): the seams below reach cycle-sensitive
 // modules — sessions is history-family, cameraBookmarks imports objectActions, playMode is
@@ -90,12 +95,115 @@ export async function startCloudPlugin() {
 	}
 }
 
+/**
+ * v3.1 (roadmap 29 G-3, hosted AI) — ONE plugin-managed provider preset, in BOTH
+ * provider lists. Core keeps ownership of the stores: the plugin describes one entry
+ * per domain and never sees the others' keys. `tag` marks the plugin's own entry
+ * (`managedBy` on the config), so a user-created provider — which carries no tag — is
+ * untouchable by construction rather than by care.
+ *
+ * ACTIVATION takes TWO guards, both required: `activate.<domain>` (the caller's
+ * permission — the plugin passes !userHas) AND the slot being empty or already ours.
+ * Either alone leaves a hole: the first misses "they have a provider but it is not the
+ * selected one", the second misses "they just deleted the selected one". And one
+ * trap the lane brief spelled out: `addAiProvider`/`addMeshProvider` make the FIRST
+ * provider active whenever the slot is empty, so a seed that is NOT allowed to
+ * activate has to put the previous pointer back, or guard 1 leaks through the add.
+ *
+ * `enable: true` also flips the master aiEnabled / meshGenEnabled, and ONLY when our
+ * entry is the active one (the plugin gates that to once per device on its side).
+ * Switching a feature on for somebody is a bigger liberty than offering them a row.
+ *
+ * `null` for `ai` or `mesh` REMOVES that entry (the store's own remove re-points the
+ * active slot at the first remaining provider, exactly as a user delete does).
+ */
+const aiPresets = {
+	/** does the user have a provider of their OWN (the tagged entry excluded)?
+	 *  @param {string} tag @returns {{ai: boolean, mesh: boolean}} */
+	userHas: (tag) => ({
+		ai: get(aiProviders).some((p) => p.managedBy !== tag),
+		mesh: get(meshProviders).some((p) => p.managedBy !== tag)
+	}),
+	/**
+	 * Create / update / remove the managed entry in aiProviders + meshProviders.
+	 * @param {string} tag
+	 * @param {{ai?: any, mesh?: any, activate?: {ai?: boolean, mesh?: boolean}, enable?: boolean}} opts
+	 * @returns {{ai: {id: string, active: boolean}, mesh: {id: string, active: boolean}, enabled: {ai: boolean, mesh: boolean}}}
+	 */
+	seed(tag, { ai, mesh, activate, enable } = {}) {
+		if (typeof tag !== 'string' || !tag) throw new Error('aiPresets.seed: a non-empty tag is required');
+		const mayActivate = { ai: activate?.ai !== false, mesh: activate?.mesh !== false };
+		const out = { ai: { id: '', active: false }, mesh: { id: '', active: false }, enabled: { ai: false, mesh: false } };
+
+		out.ai.id = seedOne(tag, ai, mayActivate.ai, {
+			list: aiProviders,
+			active: aiActiveProvider,
+			add: (/** @type {any} */ cfg) => addAiProvider({ ...cfg, preset: 'custom' }),
+			update: updateAiProvider,
+			remove: removeAiProvider,
+			setActive: setAiActiveProvider
+		});
+		out.ai.active = !!out.ai.id && get(aiActiveProvider) === out.ai.id;
+		if (enable && out.ai.active && !get(aiEnabled)) {
+			setAiEnabled(true);
+			out.enabled.ai = true;
+		}
+
+		out.mesh.id = seedOne(tag, mesh, mayActivate.mesh, {
+			list: meshProviders,
+			active: meshActiveProvider,
+			add: (/** @type {any} */ cfg) => addMeshProvider({ kind: 'comfyui', ...cfg }),
+			update: updateMeshProvider,
+			remove: removeMeshProvider,
+			setActive: setMeshActiveProvider
+		});
+		out.mesh.active = !!out.mesh.id && get(meshActiveProvider) === out.mesh.id;
+		if (enable && out.mesh.active && !get(meshGenEnabled)) {
+			setMeshGenEnabled(true);
+			out.enabled.mesh = true;
+		}
+		return out;
+	}
+};
+
+/**
+ * One domain of `aiPresets.seed`. Returns the managed entry's id, or '' when there is
+ * none (removed, or nothing offered). @param {string} tag @param {any} cfg
+ * @param {boolean} mayActivate @param {any} s the domain's store + writers
+ * @returns {string}
+ */
+function seedOne(tag, cfg, mayActivate, s) {
+	const existing = get(s.list).find((/** @type {any} */ p) => p.managedBy === tag) || null;
+	if (!cfg || typeof cfg !== 'object') {
+		if (existing) s.remove(existing.id);
+		return '';
+	}
+	// the plugin describes FIELDS; the identity (id) and the ownership (managedBy) are
+	// core's to assign, so a config carrying either cannot re-point an entry
+	const fields = { ...cfg };
+	delete fields.id;
+	delete fields.managedBy;
+	let id = existing?.id || '';
+	if (existing) {
+		s.update(id, { ...fields, managedBy: tag });
+	} else {
+		const before = get(s.active);
+		id = s.add({ ...fields, managedBy: tag });
+		// the store activates a first provider on its own — undo that when the caller
+		// may not activate (guard 1 would otherwise leak through the add)
+		if (!mayActivate && get(s.active) !== before) s.setActive(before);
+	}
+	const active = get(s.active);
+	if (mayActivate && (!active || active === id)) s.setActive(id);
+	return id;
+}
+
 /**
  * The API surface handed to a cloud plugin's `register(api)`. Deliberately small
  * and stable: peer hooks, UI mount points, and a couple of context accessors.
  * @returns {any}
  */
-function makeCloudApi() {
+export function makeCloudApi() {
 	return {
 		/** contract version — bump when the surface changes incompatibly.
 		 *  v2 (roadmap #14 PM): + mountProfile, mountConnectDrawer.
@@ -337,6 +445,16 @@ function makeCloudApi() {
 		 *  (logout). Core never learns what is behind the provider. */
 		setCommunityProvider: (/** @type {any} */ provider) => setCommunityProvider(provider),
 
+		// --- v3.1 (roadmap 29 G-3): hosted AI ---
+		/** ONE plugin-managed provider preset in Settings ▸ AI — `userHas(tag)` +
+		 *  `seed(tag, {ai, mesh, activate, enable})`; see `aiPresets` above. Additive and
+		 *  typeof-probed: no CLOUD_HOOKS_VERSION bump, an older engine simply has none. */
+		aiPresets,
+		/** an extra status line under each mesh-job card ("You are #3 in queue"). Pass
+		 *  `fn() → string | null` (null renders nothing) or null to remove it; call it
+		 *  again whenever the line may have changed — every set is a poke. */
+		setMeshJobStatus: (/** @type {any} */ fn) => meshJobStatus.set(typeof fn === 'function' ? fn : null),
+
 		// --- utilities ---
 		toast: showToast
 	};
diff --git a/tests/e2e/ai-presets.test.cjs b/tests/e2e/ai-presets.test.cjs
new file mode 100644
index 00000000..e033fe79
--- /dev/null
+++ b/tests/e2e/ai-presets.test.cjs
@@ -0,0 +1,193 @@
+// 29 (roadmap 29, G-3 hosted AI) — cloudApi v3.1: `api.aiPresets` + `api.setMeshJobStatus`.
+//
+// A signed-in cloud user should get the assistant with no key, URL or model to type.
+// The plugin cannot write core's aiProviders / meshProviders itself (Svelte stores
+// loaded from localStorage at module init — a key written after boot changes nothing
+// until a reload), so core owns ONE plugin-managed preset per domain behind
+// `aiPresets.userHas(tag)` / `aiPresets.seed(tag, {ai, mesh, activate, enable})`. The
+// tag is `managedBy` on the config; a provider the user made carries none, so it is
+// untouchable by construction. `setMeshJobStatus(fn)` is the plugin's one line under
+// each mesh-job card. Both additive and typeof-probed: NO CLOUD_HOOKS_VERSION bump.
+//
+// What this suite pins:
+//   1   the probe: the members exist, the version did not move
+//   2   seed creates / updates / removes the managed entry; a config cannot smuggle an
+//       id or a tag; the user's own entries are never touched
+//   3   GUARD 1 (permission): activate:false never takes the slot — including through
+//       the store's own "first provider becomes active" (the counterfactual leak)
+//   4   GUARD 2 (the slot): a taken slot is not taken even when the caller may; a
+//       freed slot is
+//   5   enable flips the master toggle only when our entry became the active one
+//   6   managedBy survives the store's whitelist and a reload
+//   7   the mesh-job status line: renders under a RUNNING job, re-reads on every set,
+//       null removes it, a throwing fn renders nothing and breaks nothing
+//
+// Run: APP_URL=https://theprototype.app:5219/ npm run e2e -- ai-presets
+const h = require('./helpers.cjs');
+
+const inPage = (peer, body, arg) =>
+	peer.page.evaluate(
+		([src, a]) => Object.getPrototypeOf(async function () {}).constructor('s', 'api', 'arg', src)(window.__stores, window.__api, a),
+		[body, arg ?? null]
+	);
+const read = (peer, store) => inPage(peer, `let v; s.${store}.subscribe((x) => (v = x))(); return v;`);
+const TAG = 'theprototype-cloud:hosted';
+const AI = { label: 'ThePrototype hosted — experimental', baseUrl: 'https://ai.example.test/v1/', apiKey: 'tok-1', model: 'qwen3-mock' };
+const MESH = { label: 'ThePrototype hosted — experimental', baseUrl: 'https://ai.example.test/trellis/', apiKey: 'tok-1', workflowJson: '{"1":{}}', outputNodeId: '' };
+const RESET = `
+	s.aiProviders.aiProviders.set([]); s.aiProviders.setAiActiveProvider(null); s.aiProviders.setAiEnabled(false);
+	s.meshProviders.meshProviders.set([]); s.meshProviders.setMeshActiveProvider(null); s.meshProviders.setMeshGenEnabled(false);`;
+/** everything a check wants to know about both domains */
+const STATE = `
+	const r = (st) => { let v; st.subscribe((x) => (v = x))(); return v; };
+	const ai = r(s.aiProviders.aiProviders), mesh = r(s.meshProviders.meshProviders);
+	return {
+		ai: ai.map((p) => ({ id: p.id, label: p.label, baseUrl: p.baseUrl, apiKey: p.apiKey, model: p.model, preset: p.preset, managedBy: p.managedBy ?? null })),
+		aiActive: r(s.aiProviders.aiActiveProvider), aiEnabled: r(s.aiProviders.aiEnabled),
+		mesh: mesh.map((p) => ({ id: p.id, label: p.label, baseUrl: p.baseUrl, apiKey: p.apiKey, kind: p.kind, workflowJson: p.workflowJson, managedBy: p.managedBy ?? null })),
+		meshActive: r(s.meshProviders.meshActiveProvider), meshEnabled: r(s.meshProviders.meshGenEnabled)
+	};`;
+const mine = (st, dom) => st[dom].find((p) => p.managedBy === TAG) ?? null;
+
+h.run(async () => {
+	const browser = await h.launch();
+	const A = await h.setupPage(browser, 'A');
+	await A.page.waitForFunction(() => !!window.__stores?.cloudPlugin?.makeCloudApi, { timeout: 30000 });
+	await inPage(A, 'window.__api = s.cloudPlugin.makeCloudApi();' + RESET);
+
+	console.log('\n=== 1. the probe ===');
+	const probe = await inPage(A, 'return { version: api.version, seed: typeof api.aiPresets?.seed, userHas: typeof api.aiPresets?.userHas, status: typeof api.setMeshJobStatus, dialMeta: api.dialMeta }');
+	h.check(probe.seed === 'function' && probe.userHas === 'function', `api.aiPresets.{seed, userHas} exist (${JSON.stringify(probe)})`);
+	h.check(probe.status === 'function', 'api.setMeshJobStatus exists');
+	h.check(probe.version === 3, `CLOUD_HOOKS_VERSION stays 3 — additive members, the plugin keeps compatibleHooks = 3 (${probe.version})`);
+	h.check(probe.dialMeta === true, 'the seam-1 probe (dialMeta) rides the same api');
+	h.check(JSON.stringify(await inPage(A, 'return api.aiPresets.userHas(arg)', TAG)) === '{"ai":false,"mesh":false}', 'userHas: nothing configured → {ai:false, mesh:false}');
+
+	console.log('\n=== 2. seed: create, update, remove ===');
+	const r1 = await inPage(A, 'return api.aiPresets.seed(arg.tag, { ai: arg.ai, mesh: arg.mesh, activate: { ai: true, mesh: true }, enable: true })', { tag: TAG, ai: AI, mesh: MESH });
+	let st = await inPage(A, STATE);
+	h.check(!!r1.ai.id && r1.ai.active && r1.enabled.ai, `seed returns the ai id, active, enabled (${JSON.stringify(r1.ai)} ${JSON.stringify(r1.enabled)})`);
+	h.check(!!r1.mesh.id && r1.mesh.active && r1.enabled.mesh, `…and the mesh half (${JSON.stringify(r1.mesh)})`);
+	const m1 = mine(st, 'ai');
+	h.check(m1 && m1.id === r1.ai.id && m1.preset === 'custom' && m1.baseUrl === 'https://ai.example.test/v1' && m1.model === 'qwen3-mock' && m1.apiKey === 'tok-1', `the ai entry is a custom provider with the fields given, baseUrl normalised (${JSON.stringify(m1)})`);
+	const mm1 = mine(st, 'mesh');
+	h.check(mm1 && mm1.id === r1.mesh.id && mm1.kind === 'comfyui' && mm1.baseUrl === 'https://ai.example.test/trellis' && mm1.workflowJson === '{"1":{}}', `the mesh entry is a comfyui provider with the workflow (${JSON.stringify(mm1)})`);
+	h.check(st.aiActive === r1.ai.id && st.meshActive === r1.mesh.id, 'both slots were empty → both taken');
+	h.check(st.aiEnabled === true && st.meshEnabled === true, 'enable:true switched both masters on');
+	h.check(JSON.stringify(await inPage(A, 'return api.aiPresets.userHas(arg)', TAG)) === '{"ai":false,"mesh":false}', 'userHas excludes our own tagged entry');
+	// update: same id, fields move, nothing duplicated, nothing re-enabled
+	const r2 = await inPage(A, 'return api.aiPresets.seed(arg.tag, { ai: { ...arg.ai, apiKey: "tok-2", model: "qwen3-next" }, mesh: arg.mesh, activate: { ai: true, mesh: true }, enable: true })', { tag: TAG, ai: AI, mesh: MESH });
+	st = await inPage(A, STATE);
+	h.check(r2.ai.id === r1.ai.id && st.ai.length === 1 && mine(st, 'ai').apiKey === 'tok-2' && mine(st, 'ai').model === 'qwen3-next', 'a second seed UPDATES the same entry in place (the token rotates, no duplicate row)');
+	h.check(r2.enabled.ai === false && r2.enabled.mesh === false, 'enabled reports false when the master was already on (the plugin\'s once-per-device stamp reads it)');
+	// a config cannot smuggle identity or ownership
+	await inPage(A, 'api.aiPresets.seed(arg.tag, { ai: { ...arg.ai, id: "evil", managedBy: "somebody-else" }, mesh: arg.mesh })', { tag: TAG, ai: AI, mesh: MESH });
+	st = await inPage(A, STATE);
+	h.check(st.ai.length === 1 && st.ai[0].id === r1.ai.id && st.ai[0].managedBy === TAG, `id and managedBy in the config are ignored — core assigns both (${JSON.stringify(st.ai)})`);
+	// remove
+	const r3 = await inPage(A, 'return api.aiPresets.seed(arg, { ai: null, mesh: null })', TAG);
+	st = await inPage(A, STATE);
+	h.check(r3.ai.id === '' && r3.mesh.id === '' && st.ai.length === 0 && st.mesh.length === 0, 'null removes the managed entries');
+	h.check(st.aiActive === null && st.meshActive === null, 'the freed slots read empty');
+	h.check(st.aiEnabled === true, 'removal does NOT flip the master back off (that is the user\'s switch)');
+
+	console.log('\n=== 3. guard 1: activate:false never takes the slot ===');
+	await inPage(A, RESET);
+	const r4 = await inPage(A, 'return api.aiPresets.seed(arg.tag, { ai: arg.ai, mesh: arg.mesh, activate: { ai: false, mesh: false }, enable: true })', { tag: TAG, ai: AI, mesh: MESH });
+	st = await inPage(A, STATE);
+	h.check(st.ai.length === 1 && st.mesh.length === 1, 'the entries are created');
+	// THE COUNTERFACTUAL LEAK: addAiProvider/addMeshProvider activate a first provider on
+	// their own, so without the seed restoring the pointer this would read our id
+	h.check(st.aiActive === null && st.meshActive === null, `…but the EMPTY slot is not taken: the store's own first-provider activation is undone (${st.aiActive}, ${st.meshActive})`);
+	h.check(r4.ai.active === false && r4.mesh.active === false && r4.enabled.ai === false && st.aiEnabled === false, 'seed reports inactive and the master stays off');
+	const r5 = await inPage(A, 'return api.aiPresets.seed(arg.tag, { ai: arg.ai, mesh: arg.mesh, activate: { ai: true, mesh: true } })', { tag: TAG, ai: AI, mesh: MESH });
+	st = await inPage(A, STATE);
+	h.check(r5.ai.active && st.aiActive === r5.ai.id && r5.mesh.active && st.meshActive === r5.mesh.id, 'the same seed WITH permission takes the empty slot');
+
+	console.log('\n=== 4. guard 2: a taken slot is never taken ===');
+	await inPage(A, RESET);
+	const own = await inPage(A, `
+		const id = s.aiProviders.addAiProvider({ preset: 'custom', label: 'My own vLLM', baseUrl: 'http://192.168.1.50:8000/v1', apiKey: 'mine', model: 'my-model' });
+		s.aiProviders.setAiActiveProvider(id);
+		const mid = s.meshProviders.addMeshProvider({ kind: 'comfyui', label: 'My box', baseUrl: 'http://192.168.1.50:8188', apiKey: '', workflowJson: '{}' });
+		s.meshProviders.setMeshActiveProvider(mid);
+		return { id, mid, userHas: api.aiPresets.userHas(arg) };`, TAG);
+	h.check(own.userHas.ai === true && own.userHas.mesh === true, 'userHas sees a provider of the user\'s own');
+	// the plugin's real call: activate = !userHas
+	const r6 = await inPage(A, 'return api.aiPresets.seed(arg.tag, { ai: arg.ai, mesh: arg.mesh, activate: { ai: false, mesh: false }, enable: true })', { tag: TAG, ai: AI, mesh: MESH });
+	st = await inPage(A, STATE);
+	h.check(st.aiActive === own.id && st.meshActive === own.mid, 'the user\'s provider stays ACTIVE');
+	h.check(st.ai.length === 2 && st.ai.find((p) => p.id === own.id).apiKey === 'mine' && st.ai.find((p) => p.id === own.id).managedBy === null, 'the user\'s entry is untouched and untagged; ours sits beside it');
+	h.check(r6.ai.active === false && st.aiEnabled === false, 'no activation, no enable');
+	// a buggy caller that passes permission anyway: the slot is still not taken
+	const r7 = await inPage(A, 'return api.aiPresets.seed(arg.tag, { ai: arg.ai, mesh: arg.mesh, activate: { ai: true, mesh: true }, enable: true })', { tag: TAG, ai: AI, mesh: MESH });
+	st = await inPage(A, STATE);
+	h.check(st.aiActive === own.id && st.meshActive === own.mid && r7.ai.active === false, 'guard 2 alone holds: permission does not take a slot somebody else holds');
+	h.check(st.aiEnabled === false, '…and the master stays off, because we never became active');
+	// "they just deleted the selected one": the store re-points to the first remaining
+	await inPage(A, 's.aiProviders.removeAiProvider(arg.id); s.meshProviders.removeMeshProvider(arg.mid)', own);
+	st = await inPage(A, STATE);
+	h.check(st.aiActive === mine(st, 'ai').id, 'premise: deleting the user\'s provider re-points the slot at ours (the store\'s own rule)');
+	const r8 = await inPage(A, 'return api.aiPresets.seed(arg.tag, { ai: arg.ai, mesh: arg.mesh, activate: { ai: true, mesh: true }, enable: true })', { tag: TAG, ai: AI, mesh: MESH });
+	st = await inPage(A, STATE);
+	h.check(r8.ai.active === true && r8.mesh.active === true && st.aiActive === r8.ai.id, 'a slot that is already ours counts as free');
+	h.check(r8.enabled.ai === true && st.aiEnabled === true, 'and NOW enable flips the master, because we became the active one');
+
+	console.log('\n=== 5. enable only when active ===');
+	await inPage(A, RESET);
+	await inPage(A, 'const id = s.aiProviders.addAiProvider({ preset: "custom", label: "Own", baseUrl: "http://x/v1", apiKey: "k", model: "m" }); s.aiProviders.setAiActiveProvider(id);');
+	const r9 = await inPage(A, 'return api.aiPresets.seed(arg.tag, { ai: arg.ai, activate: { ai: true }, enable: true })', { tag: TAG, ai: AI });
+	st = await inPage(A, STATE);
+	h.check(r9.enabled.ai === false && st.aiEnabled === false, 'enable:true with a taken slot flips nothing');
+	h.check(r9.mesh.id === '' && st.mesh.length === 0, 'an absent mesh config seeds no mesh entry');
+
+	console.log('\n=== 6. managedBy survives the store and a reload ===');
+	await inPage(A, RESET);
+	const direct = await inPage(A, `
+		const id = s.aiProviders.addAiProvider({ preset: 'custom', label: 'Tagged', baseUrl: 'http://x/v1', apiKey: 'k', model: 'm', managedBy: arg });
+		const mid = s.meshProviders.addMeshProvider({ kind: 'comfyui', label: 'Tagged', baseUrl: 'http://x', apiKey: '', workflowJson: '{}', managedBy: arg });
+		const r = (st) => { let v; st.subscribe((x) => (v = x))(); return v; };
+		return { ai: r(s.aiProviders.aiProviders).find((p) => p.id === id)?.managedBy, mesh: r(s.meshProviders.meshProviders).find((p) => p.id === mid)?.managedBy };`, TAG);
+	h.check(direct.ai === TAG && direct.mesh === TAG, 'addAiProvider / addMeshProvider keep managedBy (the field whitelist used to drop it)');
+	await h.freshReload(A);
+	await A.page.waitForFunction(() => !!window.__stores?.cloudPlugin?.makeCloudApi, { timeout: 30000 });
+	await inPage(A, 'window.__api = s.cloudPlugin.makeCloudApi();');
+	st = await inPage(A, STATE);
+	h.check(mine(st, 'ai') && mine(st, 'mesh'), 'the tag is persisted with the entry and survives a reload');
+	h.check(JSON.stringify(await inPage(A, 'return api.aiPresets.userHas(arg)', TAG)) === '{"ai":false,"mesh":false}', '…so userHas still reads them as ours after the reload');
+	await inPage(A, RESET);
+
+	console.log('\n=== 7. the mesh-job status line ===');
+	const line = () => A.page.locator('.mesh-job-plugin-line');
+	const job = (status) => inPage(A, 's.meshJobs.meshJobs.set([{ id: "j1", prompt: "a chair", status: arg, progress: null, error: "" }])', status);
+	await job('running');
+	await A.page.waitForTimeout(200);
+	h.check((await A.page.locator('.mesh-job').count()) === 1, 'premise: a running job renders its card');
+	h.check((await line().count()) === 0, 'no plugin → no extra line (the card is byte-identical)');
+	await inPage(A, 'api.setMeshJobStatus(() => "You are #3 in queue for the hosted AI")');
+	await A.page.waitForTimeout(200);
+	h.check((await line().count()) === 1 && (await line().textContent()).trim() === 'You are #3 in queue for the hosted AI', 'setMeshJobStatus(fn) renders fn() under the running job');
+	await inPage(A, 'api.setMeshJobStatus(() => "Running on our hardware…")');
+	await A.page.waitForTimeout(200);
+	h.check((await line().textContent()).trim() === 'Running on our hardware…', 'setting the fn again re-reads it (every set is a poke)');
+	// the line follows the job list too: a job that finishes loses it
+	await job('done');
+	await A.page.waitForTimeout(200);
+	h.check((await A.page.locator('.mesh-job').count()) === 1 && (await line().count()) === 0, 'a finished job shows no queue line');
+	await job('running');
+	await inPage(A, 'api.setMeshJobStatus(() => null)');
+	await A.page.waitForTimeout(200);
+	h.check((await line().count()) === 0, 'a fn returning null renders nothing');
+	await inPage(A, 'api.setMeshJobStatus(() => { throw new Error("plugin bug"); })');
+	await A.page.waitForTimeout(200);
+	h.check((await line().count()) === 0, 'a throwing fn renders nothing…');
+	h.check(h.pageErrors(A).length === 0, '…and breaks nothing');
+	await inPage(A, 'api.setMeshJobStatus("not a function")');
+	h.check((await read(A, 'cloudHooks.meshJobStatus')) === null, 'a non-function clears the store');
+	await inPage(A, 'api.setMeshJobStatus(() => "x"); api.setMeshJobStatus(null)');
+	await A.page.waitForTimeout(200);
+	h.check((await line().count()) === 0 && (await read(A, 'cloudHooks.meshJobStatus')) === null, 'null removes the line');
+	await inPage(A, 's.meshJobs.meshJobs.set([])');
+
+	await h.finish(browser);
+});

From 9fea3f8e4eae674ccae2f3d3801354e50d3d2909 Mon Sep 17 00:00:00 2001
From: AlexZ005 <alexz005.info@gmail.com>
Date: Sun, 20 Sep 2026 04:15:38 +0300
Subject: [PATCH 3/3] [docs] 1.15.1 "Knock, and a key you never typed":
 changelog, CLAUDE.md entries, baseline 336/47

- CHANGELOG: the 1.15.1 section (gated rooms end to end, the hosted-AI preset + queue line,
  cloudApi v3.1 for plugin authors).
- CLAUDE.md: the cloudApi v3.1 architecture entry (both seams and their guards), the jsDelivr
  semver-tag gotcha (core #230), the round-2 status entry, and the stale `plans-core/` plan
  paths rewritten to `cloud/plans/core/` (51 mentions incl. the two prose lines the brief named).
- e2e skill: the dial-metadata + ai-presets suites.
- check-baseline.json ratcheted 341 -> 336 (typing `pendingApprovals` removed five errors).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .claude/skills/e2e-verify/SKILL.md |   8 +-
 CHANGELOG.md                       |  26 +++++
 CLAUDE.md                          | 154 +++++++++++++++++++----------
 check-baseline.json                |   4 +-
 4 files changed, 138 insertions(+), 54 deletions(-)

diff --git a/.claude/skills/e2e-verify/SKILL.md b/.claude/skills/e2e-verify/SKILL.md
index 0831da1e..ba77100a 100644
--- a/.claude/skills/e2e-verify/SKILL.md
+++ b/.claude/skills/e2e-verify/SKILL.md
@@ -29,7 +29,13 @@ The GAME line: `game-state`, `hud-actions`, `logic-nodes`, `collectibles-v2`,
 `scene-folders` and the `game-loop-v2/v3/v4` acceptance suites, plus (R3a)
 `sdk-game-seams` (78 since 29: onChange/freeRegion/setNodesData) — the module-facing seams api.game/peerVars/flow/playerPosition, the
 `{replicate:false}` local pulse, the round-aware `ctx.trigger`, and the counterfactual
-that the migrated collectible pieces are GONE from core. `module-toolbox` covers the
+that the migrated collectible pieces are GONE from core. The cloudApi v3.1 seams (1.15.1) are
+`dial-metadata` (43: the join dial's `cloud` metadata + `authProvider.decide` against a
+stubbed peer, then two real peers over signaling — needs PEER_CONFIG for its last section;
+NOTE a knock's conn IS closed at once like every pending request's, the CARD is the state) and
+`ai-presets` (45: `api.aiPresets` create/update/remove, both activation guards with their
+counterfactuals, `setMeshJobStatus` rendering under a fake RUNNING job pushed into
+`s.meshJobs.meshJobs`). `module-toolbox` covers the
 toolbox seams incl. the `sidebar: false` opt-out and openToolbox/closeToolbox/
 toggleToolbox. **`trigger-log-sync`** (56, three peers) covers DEVX #18 - the handshake
 reply for the trigger log, and the epoch that keeps arriving history readable while making
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 26574c8a..19a4a5f5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,32 @@
      per release, newest first. HTML comments like this one are stripped before
      rendering, so maintainer notes stay out of the user-facing window. -->
 
+## 1.15.1 — Knock, and a key you never typed 🔑
+
+### 🚪 Gated cloud rooms work end to end
+
+- 🚪 **A room with a code, or a knock with your name.** Joining a cloud room now carries what
+  the room asks for: the right code lets you straight in, a wrong one is declined at once, and
+  a knock shows the host *"Ada wants to join Amber Mesa"* on the approval card. (The plugin
+  shipped this with 1.15.0 and fell back to the plain card until the engine could carry it.)
+
+### ⚡ Hosted AI, zero configuration
+
+- ⚡ **Signed in? The assistant can be set up for you.** The cloud plugin can now add a hosted
+  provider to Settings ▸ AI — no key, URL or model to type. A provider you configured yourself
+  always stays the selected one; the hosted row sits beside it to switch to. (Experimental —
+  it appears only while our hardware is reachable.)
+- ⏳ **"You are #3 in queue for the hosted AI."** The mesh-job card shows your place in the
+  hosted queue while a text-to-3D job waits.
+
+### 🧩 For plugin authors
+
+- 🧩 **cloudApi v3.1**, all additive (no hooks-version bump): `connectToPeer(peerId, cloudMeta)`
+  rides plain JSON on the join dial, `authProvider.decide(peerId, cloudMeta)` answers
+  admit / deny / `{label}`, `cloudApi.dialMeta` is the probe; `api.aiPresets.{userHas, seed}`
+  own one plugin-managed provider preset per domain, `api.setMeshJobStatus(fn)` is the line
+  under the mesh-job card.
+
 ## 1.15.0 — Where everyone is 👥
 
 ### 👥 One session, and you can see who is in which scene (roadmap #22, the last three rounds)
diff --git a/CLAUDE.md b/CLAUDE.md
index c4bb3135..19748088 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -45,7 +45,31 @@ loadable play content. Everything a user does must be visible to connected peers
   `{myId,myRole,amAdmin,order,roleOf(id),setRole(id,role)}` so CORE renders per-peer
   role controls + gates viewer actions) + `setRolesInfo`; `sessionHost()` accessor;
   `captureThumbnail(maxW)` (renders a fresh frame + reads the canvas synchronously →
-  downscaled JPEG blob, null in VR — for cloud room thumbnails).
+  downscaled JPEG blob, null in VR — for cloud room thumbnails). **cloudApi v3.1 (1.15.1,
+  roadmap 29 core seams — both ADDITIVE, typeof-probed, no CLOUD_HOOKS_VERSION bump):**
+  (1) ROOMS ACCESS — `connectToPeer(peerId, cloudMeta)` puts `cloud: <plain JSON ≤ 1 KB>`
+  on the join dial's PeerJS metadata (`peerApproval.boundCloudMeta`; remembered per peer on
+  `PeerConnection.dialCloud` so a restore re-dial knocks with the same hand; absent = the dial
+  is byte-identical `{jr:1}`), because an unapproved conn is closed before it opens and the
+  metadata is the only thing the host reads FIRST. `authProvider.decide(peerId, cloudMeta)`
+  REPLACES `authorize` when present: `'admit'` (the auto-approve path) · `'deny'` (refused with
+  NO card; a `jr` joiner hears `denied` through the 25-F refusal dial, an older one is closed
+  silently) · `{label}` (the normal card carrying the label, 120-char cap, refreshed by a
+  re-dial; Toasts + the drawer's Toasts tab render `approval.label`). Undefined defers to
+  `authorize`; a throwing `decide` falls back to the manual card. `cloudApi.dialMeta = true`
+  is the probe; the cloud rooms plugin fails CLOSED to the plain card without it.
+  (2) HOSTED AI — `api.aiPresets.userHas(tag)` / `seed(tag, {ai, mesh, activate, enable})`:
+  core owns ONE plugin-managed provider preset per domain (`managedBy` on the
+  `providers.js`/`meshProviders.js` config; ABSENT = the user's own, no migration, and the
+  add whitelists keep it). Activation takes TWO guards (the caller's `activate.<domain>` AND
+  the slot empty-or-ours) and the trap the lane named: `addAiProvider`/`addMeshProvider`
+  auto-activate a FIRST provider, so a seed without permission restores the previous pointer
+  or guard 1 leaks through the add. `enable` flips the master only when our entry became
+  active. `setMeshJobStatus(fn)` + `cloudHooks.meshJobStatus` = one line under each RUNNING
+  mesh-job card, re-read on every SET (a function is never `===` its last value in svelte's
+  store check, so a set is a poke — the plugin re-sets on every change) and on every job-list
+  change. `makeCloudApi` is exported for the debug hook. Suites `dial-metadata` (43, two real
+  peers at the end) + `ai-presets` (45).
 - `src/lib/triggerSync.js` (DEVX #18, the gameSync/hudSync shape — data in the leaf
   store, wire out here, NO history kind because the log is RUNTIME state): the flow
   TRIGGER LOG finally has a handshake reply. `flowTriggers` is what every stateful node
@@ -149,7 +173,7 @@ loadable play content. Everything a user does must be visible to connected peers
   the fiftieth download read 98% before moving a byte. `byBytes` says WHICH kind of
   percentage you are reading. `indicatorState` is the four-state sync convention
   (offline/idle/active/failed) and OFFLINE must not look like an error.
-  Plan + as-built: cloud `plans-core/roadmap-22-shared-library-sessions.md` sections 5-8.
+  Plan + as-built: cloud `plans/core/roadmap-22-shared-library-sessions.md` sections 5-8.
 - `src/lib/mountedVolumes.js` (R22 round 13, a LEAF: svelte/store + idb + toast; `sessions`
   by dynamic import; `explorer.js` must NEVER import it) — MOUNTED PROJECT VOLUMES: saved
   projects browsed as roots of their own ABOVE Library. Store
@@ -250,10 +274,10 @@ loadable play content. Everything a user does must be visible to connected peers
   target. The grip is 7px ON the boundary, double-click FORGETS the width (rather than
   storing the default, so a later default change still reaches it), and the header menu
   grows "Reset widths and order" only when there is something to reset.
-  Plan: cloud `plans-core/roadmap-22-shared-library-sessions.md` section 10.
+  Plan: cloud `plans/core/roadmap-22-shared-library-sessions.md` section 10.
 - **R22 ROUND 36 — DELETED KEEPS ITS STRUCTURE** (`sharedLibrary.js` bin section +
   `explorerView.js` + `Explorer.svelte`'s bin; plan + as-built: cloud
-  `plans-core/pending/22-deleted-folders.md`). THE FINDING: `explorer.deleteFolder` DESTROYED
+  `plans/core/pending/22-deleted-folders.md`). THE FINDING: `explorer.deleteFolder` DESTROYED
   locally and wrote NO tombstone and NO log row, so a peer on `shareNewFiles: always` stripped
   the departed rows to `wasShared`, claimed them as `mine`, republished — and the deleter
   adopted its own folder back and auto-downloaded its own files ("deleting a folder recreates
@@ -342,7 +366,7 @@ loadable play content. Everything a user does must be visible to connected peers
   hidden old versions of a deleted-for-everyone scene stay on the shelf indefinitely.
 - **R22 ROUND 36 (ROOMS) — THE UNNAMED WORLD IS A ROOM WITH AN IDENTITY** (`peerScenes.js`
   `roomOf`/`roomCtx`/`elsewhereThan(map, mine, peerId, host)`; map + as-built: cloud
-  `plans-core/pending/22-scene-rooms-map.md`). THE FINDING: the room gate was only-on-evidence
+  `plans/core/pending/22-scene-rooms-map.md`). THE FINDING: the room gate was only-on-evidence
   — two rows were elsewhere only when BOTH named a scene and the names differed, so an EMPTY
   scene gated nothing. Right for a joiner adopting the host's content over the handshake
   without learning its name; wrong the moment a session holds a named room AND an unnamed one,
@@ -1274,7 +1298,7 @@ loadable play content. Everything a user does must be visible to connected peers
   names so a flow node has something to address. **The MANUAL is a `doc` line per def
   in a DOCS map** (helper-made nodes have no literal to hang one on), feeding the info
   pane, the palette tooltip AND the docs-site tables from one string; `shader-node-docs`
-  fails if a node ships without one. Plan + as-built: cloud `plans-core/pending/shader-graph-editor.md`; the
+  fails if a node ships without one. Plan + as-built: cloud `plans/core/pending/shader-graph-editor.md`; the
   scene-wide half (post stack, layer 2) is `scene-look-post-processing.md`.
   **THE HUD** (21-A, `hudDocs` + `hudSync` + `components/hud/` + the dock tab) — core
   had not one UI/2D/screen node, so a game's menu and score could not be authored:
@@ -1328,7 +1352,7 @@ loadable play content. Everything a user does must be visible to connected peers
   to ~10Hz AND written only ON CHANGE — the layer is real DOM. `HudEditor.svelte` is the
   6th `FLOW_FAMILY` member on UvEditor's shell (see the flex-feedback gotcha for the
   artboard sizing), and `Controls.svelte`'s `flowDockSnapshot` needs its `hud` lines or
-  the tab never comes back after play mode. Plan: cloud `plans-core/pending/21-a-hud-and-sdk.md`.
+  the tab never comes back after play mode. Plan: cloud `plans/core/pending/21-a-hud-and-sdk.md`.
   **21-D — THE HUD BECOMES INTERACTIVE, AND THE GAME SHELL** (`hudKinds` + `hudImages` +
   `hudActions` + `gameState` + `gameSync` + `HudElementPicker`/`HudPalette`/
   `HudActionsSection`/`GameCameraNode`). 21-A shipped a PRESENTATION layer; a user could
@@ -1396,7 +1420,7 @@ loadable play content. Everything a user does must be visible to connected peers
   borrows that camera's aspect. The HUD is hidden in the VIEWPORT while authoring
   (`viewportOverrides` gains a `hud` key — its first real `renderLayer` caller — with
   `hudPreviewInViewport` as the eye toggle). Plan + as-built: cloud
-  `plans-core/pending/21-d-hud-interaction-game-shell.md`.
+  `plans/core/pending/21-d-hud-interaction-game-shell.md`.
   **21-E — GAME HARDENING** (roadmap 21-E, all eight phases): the layer between "the
   pieces exist" and "press Play and a game works". E1/E2 made the HUD editor WYSIWYG
   (content at 1:1 inside a transform-scaled stage — it used to scale boxes and not
@@ -1457,7 +1481,7 @@ loadable play content. Everything a user does must be visible to connected peers
   playanim/sound/particles/impulse/reset-counter/toggle-visibility (chain actions),
   the objectMenu "Make collectible" recipe (onclick→latch→not→visibility + setvariable
   add, ONE flownodes entry per object), and the docs-site `build-a-game.md`
-  walkthrough. Plan + as-built: cloud `plans-core/roadmap-21e-game-hardening.md`.
+  walkthrough. Plan + as-built: cloud `plans/core/roadmap-21e-game-hardening.md`.
   **21-F — LEVELS, COLLECTIBLES v2, HUD EDITOR POLISH** (roadmap 21-F): `levels.js` —
   a SCENE ASSET is an ordinary content-hashed .tpscene in the Explorer. **21-G1 renamed
   the folder to `Scenes` and DEMOTED it**: `SCENES_FOLDER`/`ensureScenesFolder` premake it
@@ -1530,7 +1554,7 @@ loadable play content. Everything a user does must be visible to connected peers
   drew the id hash, so two screens disagreed about one person) + `showFacing`
   heading wedges (`facingAngle` = one atan2(z, x): canvas +y IS world +z). F7
   (cross-scene presence on the rooms layer) deliberately slipped to 21-G. Plan +
-  as-built: cloud `plans-core/roadmap-21f-levels-and-polish.md`.
+  as-built: cloud `plans/core/roadmap-21f-levels-and-polish.md`.
   **21-G1 — SCENES NOT LEVELS; RECIPE RE-HOMING** (see the levels entry above for the
   discovery change). Three more pieces. (1) **The object menu's `Game ▸` submenu is
   GONE** — its only entries were the two collectible recipes, and they moved to the NODE
@@ -1608,7 +1632,7 @@ loadable play content. Everything a user does must be visible to connected peers
   peerRoster. Plugin half (cloud repo): rooms records carry {scene, members, invites}
   (PB fields in pocketbase-setup.md), a 30s presence POLL, invites riding MY room
   record (self-expiring ~2min; Join = connectToPeer — the ordinary join sync lands
-  them in the scene). Plan: cloud `plans-core/roadmap-21g-projects-presence.md`.
+  them in the scene). Plan: cloud `plans/core/roadmap-21g-projects-presence.md`.
   `editOverlays` (PR #133, imports NOTHING): park/strip for the edit WIREFRAME,
   which is a LineSegments CHILD of the edited mesh and therefore inside the
   serialized tree — a save taken mid-session wrote it into the file as a
@@ -2010,7 +2034,7 @@ loadable play content. Everything a user does must be visible to connected peers
 - Docs (2026-07-24 split): SDK authoring docs live on the PUBLIC docs site
   (theprototype-docs: module-sdk.md + module-package.md); `MODULES.md` committed here.
   ALL planning docs live in the PRIVATE cloud repo (`theprototype-app/cloud` →
-  `docs/plans-core/`, local `../theprototype.app-cloud`). This repo's `/docs` is
+  `plans/core/`, local `/home/deck/.code/theprototype-app/cloud`). This repo's `/docs` is
   gitignored scratch space (pointer READMEs inside).
 
 - `src/lib/knock.js` + `knockMath.js` (24-A) — A HAND KNOCKS A BODY. `knockMath` is the pure
@@ -2210,6 +2234,15 @@ loadable play content. Everything a user does must be visible to connected peers
 
 ## Hard-won gotchas (do not rediscover)
 
+- **jsDelivr PARSES `@v2` AS A SEMVER VERSION, AND A VERSION IS NEVER RE-RESOLVED.** The scenes
+  feed is `scenes@v2` and the serving ritual retags `v2`; jsDelivr's data API lists the repo as
+  `versions: ["1","2"], tags: {}`, the response says `x-jsd-version-type: version`, and a
+  version's files are cached permanently — `purge.jsdelivr.net` reports `finished` and changes
+  nothing (measured: 16 h and four purges after the Jam Room retag the index still listed three
+  games while `@a5ebe8f` and `@main` listed six). `@main` resolves as a BRANCH (≤ 12 h cache,
+  purgeable). So a moving ref on jsDelivr must be a branch or a tag name that is not a
+  version (`format-2`); `packs@v1` has the same trap waiting. Core ticket #230; the deploy-time
+  unblock is `VITE_SCENES_BASE=…scenes@main` (what `contentBase()` exists for).
 - **flowbite-svelte's `Button` FREEZES its class string at mount.** `Button.svelte:34` reads
   the theme through a DESTRUCTURING `$derived` declaration, which evaluates its object ONCE
   — so a button BORN disabled wears `cursor-not-allowed opacity-50` forever, even after its
@@ -4391,14 +4424,14 @@ override for e2e — never share 5173 (the user's main-checkout server).
 
 - One commit per phase/feature; message style: `[feat]/[fix] lowercase summary` + body
   bullets + `Co-Authored-By: Claude ... <noreply@anthropic.com>`.
-- Plan documents live in the PRIVATE cloud repo: `../theprototype.app-cloud/docs/plans-core/`
+- Plan documents live in the PRIVATE cloud repo: `cloud/plans/core/` (local `/home/deck/.code/theprototype-app/cloud/plans/core/`)
   (versioned there — moved 2026-07-24; **never commit plans into THIS repo**).
   `/plans/` in this repo is GITIGNORED local drafting space; a finished roadmap's
-  plan files move to cloud `plans-core/done/` (roadmap 24's did, 2026-09-12).
-  Postponed phases → `plans-core/pending/`; future ideas → `plans-core/backlog.md`;
-  open design questions → `plans-core/quiz.md`. Keep `00-overview.md` tables in sync
+  plan files move to cloud `plans/core/done/` (roadmap 24's did, 2026-09-12).
+  Postponed phases → `plans/core/pending/`; future ideas → `plans/core/backlog.md`;
+  open design questions → `plans/core/quiz.md`. Keep `00-overview.md` tables in sync
   with every scope change. Historical `docs/plan/...` references below = the old
-  in-repo path; those files are now under `plans-core/`.
+  in-repo path; those files are now under `plans/core/`.
 - Roadmap ritual: user drops notes → ask 3-4 targeted AskUserQuestion forks (offer a
   recommended option — they usually take it) → write plan files → present the batch
   table (sizes S/M/L/XL, riskiest last) → they pick what executes.
@@ -4713,10 +4746,29 @@ override for e2e — never share 5173 (the user's main-checkout server).
   learning its name. New suites: import-duplicates(65), scene-open-guard(30),
   scene-rooms(37); four guards proven by BREAKING them. Standing pre-existing reds,
   A/B'd against base: `explorer-drop` last check, `explorer-files`, `peers-popover`.
-  NEXT: roadmap 22 (cloud `plans-core/roadmap-22-shared-library-sessions.md`) — forks
+  NEXT: roadmap 22 (cloud `plans/core/roadmap-22-shared-library-sessions.md`) — forks
   locked (replicate the INDEX per-item opt-in; ONE mesh with scenes as tags;
   scene-is-primary renaming), and the vocabulary settled: **session = the mesh, room =
   who is in a scene, PocketBase rooms stay DISCOVERY** — that naming blocks R4.
+- Status (2026-09-20): **1.15.1 "Knock, and a key you never typed" — ROADMAP 29 ROUND 2, the two
+  core seams, taken IN-HOUSE by the integrator.** The `29-core-seams` lane had sat ~11 h at a budget
+  checkpoint with nothing committed and a resume prompt nobody sent, so `feat/1.15.1` (off
+  release/next = main 02ce930) carries them: `8e9fb5d` seam 1 (the rooms-access lane's proven
+  patch landed + the JSDoc it lacked; `pendingApprovals` typed, which REMOVED five baseline
+  errors) · `311e184` seam 2 (`api.aiPresets` + `setMeshJobStatus`, written here against the
+  cloud's `hostedAi.js` and the answered QUESTIONS-29-ai-gateway forks 1/1b) · the docs commit.
+  Gates: svelte-check **336/47** (341 → 336, zero NEW messages, baseline ratcheted), vitest 178,
+  build green server-down; battery under the lock: dial-metadata 44 · ai-presets 46 ·
+  net-handshake 9 · approval-timeout 17 · join-result 41 · sdk-game-seams 78 green;
+  invite-link-live 21/1 (the documented public-cloud red) and open-core-m1 16/1 (the drawer-mount
+  check, A/B'd IDENTICAL on pristine 1.14.0 at :5214 — pre-existing). Cloud smoke against this
+  core: **139/0**, the rooms-access section now admitting on a real room code through `decide`
+  and G3 seeding through `api.aiPresets` (not the debugStores adapter). Cloud side: one consumer
+  line for `setMeshJobStatus` (re-set on every `hostedAi.onChange`). FOUND on the way: the Games
+  tab's stale feed is jsDelivr parsing `scenes@v2` as a VERSION (gotcha above, core #230).
+  OWED on device: a gated room with two real logins (right code → in, wrong → declined, knock →
+  the labelled card), the hosted preset appearing in Settings ▸ AI on a real sign-in once
+  `VITE_AI_GATEWAY_URL` is set, and the queue line under a real mesh job.
 - Status (2026-09-19): **1.15.0 "Where everyone is" — ROADMAP 29's finished lanes INTEGRATED.**
   Core `feat/1.15` = six lane PRs merged clean (#223 sessions R4/R5/R6 · #224 sdk-polish S1/S2 ·
   #227 s3-followup S3a/b/d · #226 football suite · #225 c6-template · #222 embed); vitest 178;
@@ -4757,7 +4809,7 @@ override for e2e — never share 5173 (the user's main-checkout server).
   `explorer-views` 114 · `explorer-delete-confirm` 54 · `explorer-multiselect` 63 ·
   `explorer-storage` 116 · `explorer-mounts-edit` 49 · `private-scene` 55 · `peers-popover`
   21 · `explorer-drop` 9 · `shared-library` 270/18 against a pristine-base 271/17 on the same box (the 17 are the chunked-transfer sections — the 700 KB fixture never reassembles here, `size -1` — and everything downstream of a peer holding bytes; the one extra is the SENDER ledger reading `active` instead of `done` in that same dead transfer). Three lane runs died at `h.connect` first; an instrumented copy and four probes connected every time, so that was the signaling box, not the code. svelte-check **362/47 unchanged**; build green. Architecture entry
-  above; plan + as-built: cloud `plans-core/pending/22-deleted-folders.md`. OWED: the
+  above; plan + as-built: cloud `plans/core/pending/22-deleted-folders.md`. OWED: the
   on-device pass in non-dark themes (folder-card dimming, the ghost tint, the `history`
   glyph, the Location column's 160px).
 - Status (2026-09-02): **R22 ROUND 13 SHIPPED — PRs #186 and #188 MERGED to release/next
@@ -4786,7 +4838,7 @@ override for e2e — never share 5173 (the user's main-checkout server).
   saved project in `loadSessions`, inline zip/hash; unblock first, then progress through
   transferLedger), the app-wide flowbite frozen-disabled-paint survey, idb.js settling on
   the transaction's onabort, and the dock-inset suite's logo-menu leak. Plan + full
-  as-built: cloud `plans-core/roadmap-22-round13-mounts-storage.md`.
+  as-built: cloud `plans/core/roadmap-22-round13-mounts-storage.md`.
 - Status (2026-08-25): **ROADMAP 22 — THE SHARED EXPLORER LIBRARY. R1/R2/R3/R7 + R8 and
   four review rounds EXECUTED on `feat/22-shared-library` (lane `theprototype-lane-snap`
   @5202), 10 commits off release/next @f46d335, NOT PUSHED.** svelte-check **385/62** at
@@ -4801,7 +4853,7 @@ override for e2e — never share 5173 (the user's main-checkout server).
   local `vite dev` shows "Server local dev / localhost:9001/peerjs" despite `.env`, a stray
   `Shared` folder on Share-all, "delete permanently" not removing the file, and the
   one-file/unsaved-scene prompt. Plan + as-built: cloud
-  `plans-core/roadmap-22-shared-library-sessions.md` sections 5-8.
+  `plans/core/roadmap-22-shared-library-sessions.md` sections 5-8.
 - Status (2026-08-22, later): **B7 SPAWNER MERGED; DEVX #18, THE PALETTE RULE AND THE
   COLLECTIBLE TOOLBOX v2 ARE OPEN PRs.** `release/next` @19a8a3c carries R3a (#170) and
   B7 (#172, the spawner — see the architecture entry). OPEN: core **#176** DEVX #18 (the
@@ -4857,7 +4909,7 @@ override for e2e — never share 5173 (the user's main-checkout server).
   table — pre-existing (the 21-F recipe stood on the same stamps), asserted in the
   module suite so a core `gettriggers`/`triggers` pair would flip it loudly. OWED
   on-device: the manager in non-dark themes and as a <=640px sheet, touch radius feel in
-  VR, a 3+ player per-player scramble. Plan: cloud `plans-core/roadmap-21g-projects-
+  VR, a 3+ player per-player scramble. Plan: cloud `plans/core/roadmap-21g-projects-
   presence.md` ROUND 3 REVISED.
 - Status (2026-08-21, latest): **ROADMAP 21-G — PROJECTS, CROSS-SCENE PRESENCE,
 - Status (2026-08-22, latest): **21-G ROUND 2 — DCC-STANDARD PROJECTS (G7-G10 + docs)
@@ -4883,7 +4935,7 @@ override for e2e — never share 5173 (the user's main-checkout server).
   explorer-inline-input(38) project-open-import(36) scene-versions(68) + project-file
   updated to OPEN semantics; docs-site projects.md committed there (72d14c7);
   build-a-game touch-ups ride the parallel round-3 session's uncommitted rewrite.
-  As-built + owed-on-device: cloud `plans-core/roadmap-21g-projects-presence.md`.
+  As-built + owed-on-device: cloud `plans/core/roadmap-21g-projects-presence.md`.
 - Status (2026-08-21): **ROADMAP 21-G — PROJECTS, CROSS-SCENE PRESENCE,
   PER-PLAYER PROGRESS: G1-G6 EXECUTED same-day off the 21-F merge (release/next
   @fdfbe39); MERGED 2026-08-22: PRs #164 -> #165 -> #166 to release/next @f126b85 (both lane merges landed CLEAN - G1 was already both branches' base - and the App.svelte hook counts held 164/164). ROUND 2 (G7-G10, DCC-standard projects: hidden version history + panel, the TP|Scene|GLTF menu with open-replaces vs import-furnishes, project/scene identity, inline naming) and ROUND 3 (the collectible NODE + manager toolbox) are PLANNED with locked forks 10-20 in the same plan doc, executing in parallel windows.** The user's four fork
@@ -4910,7 +4962,7 @@ override for e2e — never share 5173 (the user's main-checkout server).
   for the per-player case. OWED on-device: the project round-trip feel, cross-scene
   presence + invites on real cloud rooms (after the PB fields land), a 3+ player
   leaderboard, the Scenes/Download/recipe UI in non-dark themes. Plan + as-built:
-  cloud `plans-core/roadmap-21g-projects-presence.md`.
+  cloud `plans/core/roadmap-21g-projects-presence.md`.
 - Status (2026-08-21, later): **ROADMAP 21-F — LEVELS, COLLECTIBLES v2, HUD EDITOR
   POLISH: F1-F6 EXECUTED across three lanes; F7 (cross-scene presence on the rooms
   layer) deliberately slipped to 21-G per the plan.** Baseline re-measured 385/62 on a
@@ -4941,7 +4993,7 @@ override for e2e — never share 5173 (the user's main-checkout server).
   debug element and the new toolbar/dialog in non-dark themes, the marquee's feel on
   a real pointer, and the confirmation that "equalize takes the FIRST pick's size" is
   the right reference. Plan + as-built: cloud
-  `plans-core/roadmap-21f-levels-and-polish.md`.
+  `plans/core/roadmap-21f-levels-and-polish.md`.
 - Status (2026-08-21): **ROADMAP 21-E — GAME HARDENING, ALL EIGHT PHASES EXECUTED AND
   MERGED — PRs #158/#159/#160 to `release/next` @2d8af51.** Baseline **385/62** measured
   on the merged head; the release.yml gate ratcheted with it. Each lane PR took a
@@ -5032,12 +5084,12 @@ override for e2e — never share 5173 (the user's main-checkout server).
   action picker, the new input controls in NON-DARK themes, the game loop in VR (the
   HUD layer is DOM, desktop-only by design), and one judgement to confirm — an input
   value is LOCAL by default with `shared` as a per-element opt-in. Plan + as-built:
-  cloud `plans-core/pending/21-d-hud-interaction-game-shell.md`.
+  cloud `plans/core/pending/21-d-hud-interaction-game-shell.md`.
 - Status (2026-08-18, later): **ROADMAP #21-A — lanes L1 and L2 MERGED, PRs #149 (L1) and
   #150 (L2) to `release/next`.** The two lanes conflicted in exactly the ONE file
   `git merge-tree` predicted — App.svelte's debugStores lines — resolved as a UNION with the
   array/destructure/store-object counts asserted equal afterwards (141/141), which is the
-  whole point of that gotcha. Plan: cloud `plans-core/pending/21-a-hud-and-sdk.md` (parent
+  whole point of that gotcha. Plan: cloud `plans/core/pending/21-a-hud-and-sdk.md` (parent
   `roadmap-21-games-hud-physics.md`). flowRuntime, flowSockets, nodeCatalog and
   AnimationNode all auto-merged despite both lanes touching them. **L1 `feat/21-module-node-io`** (worktree `../theprototype-lane-flow` @5200,
   3 commits): `c48d1bc` the `'text'` param kind as its own commit so L2 could
@@ -5069,7 +5121,7 @@ override for e2e — never share 5173 (the user's main-checkout server).
   passes `playMode: true`.
 - Status (2026-08-18): **ROADMAP #20 MERGED + v1.6.0 — PRs #146 and #147 to
   `release/next` @944eb8d.** Editor ergonomics, units, workspace restore, the graph
-  tree. Plan + as-built: cloud `plans-core/roadmap-20-editor-ergonomics-units.md`.
+  tree. Plan + as-built: cloud `plans/core/roadmap-20-editor-ergonomics-units.md`.
   Baseline **388/62** (391 -> 388: annotating Scene's `marqueeStart` fixed three
   pre-existing implicit-anys; the release.yml gate was ratcheted to match).
   **P1** duplicate carries animation clips, object flows AND shader graphs (the last
@@ -5095,7 +5147,7 @@ override for e2e — never share 5173 (the user's main-checkout server).
   (lane `../theprototype-lane-uv` @ port 5193, 2 commits, NOT PR'd yet; **branched off
   `feat/17e-animation-curves`**, because U1 re-points the TIMELINE at the extracted
   engine — retarget once 17-E lands). Plan + as-built: cloud
-  `plans-core/pending/uv-editor-transform-tools.md`. **U1** `$lib/modalGrab.js` =
+  `plans/core/pending/uv-editor-transform-tools.md`. **U1** `$lib/modalGrab.js` =
   `createGesture` (see the architecture entry); shipped by moving the timeline onto it
   FIRST, with animation-curves/animation-window as the safety net, so the extraction is
   provably behaviour-preserving. **U2/U3** the UV editor gained the timeline's whole
@@ -5160,7 +5212,7 @@ override for e2e — never share 5173 (the user's main-checkout server).
   when a once-clip reaches its end, LOCALLY on every peer — each runtime reaches that
   elapsed time itself, the same reasoning as the once-clip end, so no message. Wire it
   into a Counter, a sound, or the next door's Play Animation.
-  **FOLLOW-UP DROP (2026-08-14, plan `plans-core/pending/17-e-animation-followups.md`,
+  **FOLLOW-UP DROP (2026-08-14, plan `plans/core/pending/17-e-animation-followups.md`,
   F1-F6 ALL EXECUTED + two user requests, 8 commits):** F1 the reported
   **Ctrl+V fires push-to-talk** (voiceChat matched the KEY and no modifiers; PTT is
   a BARE hold, and the keyup path is deliberately NOT modifier-guarded or pressing
@@ -5196,7 +5248,7 @@ override for e2e — never share 5173 (the user's main-checkout server).
   Baseline held **391/62**; build green. OWED: the user’s on-device/feel pass, then
   the PR of the whole 17-E branch to release/next.
   NEXT (planned): the same transform tools
-  in the UV editor → cloud `plans-core/pending/uv-editor-transform-tools.md`.
+  in the UV editor → cloud `plans/core/pending/uv-editor-transform-tools.md`.
 - Status (2026-08-17): **THE MESH-EDIT ROUND IS MERGED TO release/next — PRs #132
   (19-A), #133 (two fix rounds) and #134 (the pivot work) @9972a24.** #133:
   the Cancel button drew Undo2 beside #mesh-undo's Undo2 (now the X of a
@@ -5216,7 +5268,7 @@ override for e2e — never share 5173 (the user's main-checkout server).
   surfaced in the toolbox. Baseline **391/62** at every commit. New suites:
   mesh-pivot-gizmo (124+). OWED: the user's on-device feel pass (incl. the
   non-dark themes, which headless cannot judge). PENDING follow-ups written up
-  in cloud `plans-core/pending/mesh-proportional-pivot-followups.md`: F1
+  in cloud `plans/core/pending/mesh-proportional-pivot-followups.md`: F1
   proportional falloff for ROTATE/SCALE (needs the user's fork answer), F2
   vertex slide under a custom pivot (probably WONTFIX, make it visible), F3 a
   proportional TRANSLATE never replicates its falloff neighbours — the only
@@ -5224,7 +5276,7 @@ override for e2e — never share 5173 (the user's main-checkout server).
   separate) and P7c (vertex-bevel segments + the mitered corner) stay PARKED.
 - Status (2026-08-19): **21-C1..C4 TERRAIN + SPLINES — branch `feat/21-terrain-road`
   (lane `../theprototype-lane-spline` @ port 5203), 8 commits, MERGED to release/next.**
-  Plan: cloud `plans-core/pending/21-c-games-content.md` (C1-C4). **C2** is the PORT of
+  Plan: cloud `plans/core/pending/21-c-games-content.md` (C1-C4). **C2** is the PORT of
   phase 57 (`feat/spline-tool` @6be9f8a cherry-picked, three conflicts, all in the
   places the plan predicted) with the post-1.2.0 adaptations: SplineToolbar on the
   shared ToolboxWindow, DragRow numbers, and the plan's registerEditProxy /
@@ -5274,7 +5326,7 @@ override for e2e — never share 5173 (the user's main-checkout server).
 - Status (2026-08-18): **SCENE LOOK / POST-PROCESSING — branch `feat/scene-post-stack`
   (lane `../theprototype-lane-post` @ port 5198), 8 commits, release/next merged in
   CLEAN, baseline 391/62 at every commit, NOT PR'd.** Plan: cloud
-  `plans-core/pending/scene-look-post-processing.md` (L1-L5 marked EXECUTED there).
+  `plans/core/pending/scene-look-post-processing.md` (L1-L5 marked EXECUTED there).
   **L1** the stack core (see the `scenePost`/`postEffects` architecture entries) ·
   **L2** `scenepost`/`getscenepost` + sessions/.tpscene/autosave + the `'look'` history
   kind · **L3** Configure Scene ▸ Post-processing (`PostStack.svelte`, params from the
@@ -5290,13 +5342,13 @@ override for e2e — never share 5173 (the user's main-checkout server).
   `api.registerPostEffect` SDK seam + docs-site pages). **L6** (the Post DOMAIN in the
   shader editor) and **L7** (the scene default material) are BLOCKED on the shader lane
   landing and move to the follow-up plan, together with the user's per-CAMERA looks and
-  Watch-adopts-look: cloud `plans-core/pending/post-camera-looks-and-shader-integration.md`.
+  Watch-adopts-look: cloud `plans/core/pending/post-camera-looks-and-shader-integration.md`.
   The two lanes conflict in exactly TWO files (`App.svelte` debugStores,
   `peerHandler` dispatch) — measured with `git merge-tree`; everything else auto-merges.
 - Status (2026-08-19): **21-B PHYSICS PLAY — B1-B6 + A8 EXECUTED**, lane
   `../theprototype-lane-post` @ port 5202, branch `feat/21-physics-play` off
   release/next @803d040, 13 commits, NOT PR'd. Plan: cloud
-  `plans-core/pending/21-b-physics-play.md`. Baseline **388/62** at every commit
+  `plans/core/pending/21-b-physics-play.md`. Baseline **388/62** at every commit
   (roadmap 20 dropped it from 391 — re-measure on a pristine worktree, do not
   trust the number in an older plan). B1 scenePhysics v2 · B2 the throw-velocity
   leaf + the Euler/clamp fixes · B4 ground + out-of-bounds + the parameter
@@ -5373,7 +5425,7 @@ override for e2e — never share 5173 (the user's main-checkout server).
   commits @be8cb0d off release/next @78e71d7 (merged in; the one conflict was
   App.svelte's debugStores, as `git merge-tree` predicted). NOT PR'd. Baseline
   **391/62** at every commit. Plan + as-built: cloud
-  `plans-core/pending/shader-graph-editor.md`. SH0 spike (all four gates measured) ->
+  `plans/core/pending/shader-graph-editor.md`. SH0 spike (all four gates measured) ->
   the ShaderFrog array-varying vite patch -> **SH0.5, which flipped the backend
   choice on CORRECTNESS**: adding a light to a scene leaves ShaderFrog-driven objects
   byte-identically unchanged (it bakes three's light set into the source) while the
@@ -5405,7 +5457,7 @@ override for e2e — never share 5173 (the user's main-checkout server).
   coincident-ghost fix, and the properties-panel poke REMOVED as unworkable.
   New suites: `animation-relative-motion`, `pick-tiny-objects`, `animation-loop-pause`,
   `animation-look-channels`, `edit-overlay-gaps`, `mesh-budget`, `selection-extras`.
-  Release plan + CHANGELOG draft: cloud `plans-core/pending/1.5.0-release-prep.md`.
+  Release plan + CHANGELOG draft: cloud `plans/core/pending/1.5.0-release-prep.md`.
   PENDING plans from this round: `animation-relative-and-136-followups.md` (done),
   `duplicate-parity-and-material-sharing.md` (duplicate must carry clips + object
   flows; shared materials WAIT for the shader lane, because every material change
@@ -5471,7 +5523,7 @@ override for e2e — never share 5173 (the user's main-checkout server).
   P5a `7179a6f` (Opus) · P5b `d224cc2` · docs `497ef8e`/`cfff1c8` · P7a `5da6fe8`
   (Opus) · P7b `7edcbed`. Baseline **391/62 at EVERY commit**; build green; 28 files,
   +7195/-487. As-built table + the parked specs: cloud
-  `plans-core/pending/19-a-mesh-tool-interaction.md` §9 (§4 keeps P6's spec, §8 P7c's).
+  `plans/core/pending/19-a-mesh-tool-interaction.md` §9 (§4 keeps P6's spec, §8 P7c's).
   P7a = bridge **invert faces** (negate the wall dir AFTER the shell-test guess) +
   face-bevel **negative profile** (the concave quarter circle is the same arc with the
   sin/cos roles SWAPPED; every schedule column telescopes to 1, so total reach is
@@ -5506,7 +5558,7 @@ override for e2e — never share 5173 (the user's main-checkout server).
   off its source.
 - Status (2026-08-15, superseded by the entry above): **ROADMAP #19-A IN FLIGHT — the mesh tool APPLY-AND-ADJUST model.**
   Branch `feat/mesh-tool-interaction` off release/next @608e852; plans in the cloud repo
-  (`plans-core/roadmap-19-tool-interaction-snapping.md` + `pending/19-a/-b`); 19-B
+  (`plans/core/roadmap-19-tool-interaction-snapping.md` + `pending/19-a/-b`); 19-B
   (advanced snapping) runs in a PARALLEL user session on a worktree lane — Scene.svelte
   belongs to 19-B in that split. Committed so far: **P0** `bf6f2df` (DragRow
   onscrubstart/onscrubend; meshToolParams into debugStores; componentsOfTris exported;
@@ -5662,7 +5714,7 @@ override for e2e — never share 5173 (the user's main-checkout server).
   reasoning (the flipY direction had two confident opposite answers; the "empty scene
   on late join" turned out to be an earlier probe SUPPRESSING delivery, so a planned
   send-channel rewrite was dropped as aimed at a non-bug). As-built + what remains:
-  cloud `plans-core/pending/uv-editor.md`.
+  cloud `plans/core/pending/uv-editor.md`.
 - Status (2026-08-10): **MESH HARDENING — branch `feat/mesh-hardening`** (off
   release/next @372af29, lane ../theprototype-lane-c @5182, 4 commits + docs),
   from user reports on the merged M0-M6 tools. (1) `setFaceSubmode` + the
@@ -5681,13 +5733,13 @@ override for e2e — never share 5173 (the user's main-checkout server).
   New suites mesh-selection-undo(23)/mesh-edit-display(9)/mesh-loop-hardening(22);
   27-suite mesh+undo battery green; baseline 391/62 (unchanged from base).
   **NEXT WORKSTREAM (user-approved, ahead of M4 gizmo/M5/M9): stored face
-  topology as a HALF-EDGE structure** — cloud plans-core/pending/
+  topology as a HALF-EDGE structure** — cloud plans/core/pending/
   mesh-topology-halfedge.md, with the measurement that justifies it (a 4-degree
   rotate twists a quad's triangles ~9 degrees apart, indistinguishable from a
   real crease in a soup, so a rotated band leaves the derived topology).
 - Status (2026-08-10): **17-A MODULE PLATFORM SHIPPED — core PR #101** (branch
   feat/module-platform, lane ../theprototype-lane-flow @5186, 13 commits; plan +
-  as-built: cloud plans-core/pending/17-a-module-platform.md). **A1** SDK gaps
+  as-built: cloud plans/core/pending/17-a-module-platform.md). **A1** SDK gaps
   from the modules repo's DEVX-REQUESTS.md (api.haptic per-hand, isVR, vrHand,
   fireObjectClick, possess camera:'first' + possessModes probe; DEVX #8 fix —
   onInput subscribed via import().then() and DROPPED KEYS for seconds after
@@ -5712,7 +5764,7 @@ override for e2e — never share 5173 (the user's main-checkout server).
   are not testable headlessly); dungeon/dungeon-play stop at a THIRD peer on
   this box (setupPage waitForFunction, pre-existing environment limit).
 - Status (2026-08-10): **mesh-editing roadmap M0-M4 + M6 EXECUTED** (plan: cloud
-  `plans-core/pending/mesh-editing-roadmap.md`, which also carries the M5 bevel design
+  `plans/core/pending/mesh-editing-roadmap.md`, which also carries the M5 bevel design
   notes). Lane `../theprototype-lane-c` @ **port 5182**. Three stacked PRs off
   `release/next`: **#92** 15-G convert-to-mesh + quad granularity + the three mesh-edit
   defects it surfaced (multi-material meshes rendering NOTHING after an edit; wall
@@ -5781,7 +5833,7 @@ override for e2e — never share 5173 (the user's main-checkout server).
   `noteDoubleClickToOpen` (single click / drawer arrows only FLY; dblclick opens) +
   `visitedNote`, and the Esc order (first stops following, second closes the card).
   Suite `notes-v2` = 90 checks incl. a PROVEN frame-lag guard; baseline 419/62 held
-  throughout. Plan + as-built notes: cloud `plans-core/pending/15-h-notes-v2.md`.
+  throughout. Plan + as-built notes: cloud `plans/core/pending/15-h-notes-v2.md`.
   Backlog spinoff: a camera follow/look-at NODE for roadmap-16 camera OBJECTS.
 - Status (2026-08-02): **Roadmap #15 in flight — A+J → PR #81, B+C → PR #82,
   second drop K/L/M/N/O + toast-system rework → PR #84 (stacked on #82), docs
@@ -5792,7 +5844,7 @@ override for e2e — never share 5173 (the user's main-checkout server).
   GitHub stars (Welcome + cloud profile — cloud repo carries its own copy),
   PWA manifest/icons/no-cache SW, outline-follows-the-selection-SET (K).
   Baseline 419/62. Plan + parked designs: cloud repo
-  plans-core/roadmap-15-editmesh-notes-polish.md (mesh lane D→E→F, G, H notes
+  plans/core/roadmap-15-editmesh-notes-polish.md (mesh lane D→E→F, G, H notes
   v2 still pending there). Lane: ../theprototype-lane-ui @ port 5186 (5176 is
   shadowed by a stale [::1] server — the port-shadow trap; ALWAYS curl a source
   file and grep your new symbol before trusting a lane server).
@@ -5825,7 +5877,7 @@ override for e2e — never share 5173 (the user's main-checkout server).
 - Status (2026-08-04): **Roadmap #16 (menus, grid & scene cameras) EXECUTED →
   core PR #86** (branch fix/roadmap16-menus-cameras, six commits, STACKED on #85 →
   #84 → #82; retarget to release/next as they land; plan + as-built notes in the
-  cloud repo plans-core/roadmap-16-menus-grid-cameras.md). P6 deselect broadcasts
+  cloud repo plans/core/roadmap-16-menus-grid-cameras.md). P6 deselect broadcasts
   `unlock` (peers kept objects locked forever) + "Selected ▸" gates on the SET · P1
   menu filter hidden-until-typing + ↑/↓ navigation + Enter-opens-submenu · P2 the
   node editor's private search box retired onto the shared filter · P3 Configure
@@ -5836,7 +5888,7 @@ override for e2e — never share 5173 (the user's main-checkout server).
   deselect-unlock/grid-snapping/camera-bookmarks/camera-objects; 419/62 held.
   REMAINING from #15: mesh lane D→E→F, G (convert to mesh), H (notes v2).
 - Status (2026-08-01): **VR sleeve palette (K1+K2) MERGED to release/next (PR #75)**
-  — plan: cloud repo plans-core/done/k-vr-sleeve-palette.md (as-built notes there).
+  — plan: cloud repo plans/core/done/k-vr-sleeve-palette.md (as-built notes there).
   One commit: `$lib/vrSleeve.js` + the `vrsleeve` core-module shell + the generic
   module-VR hook registries in vrControls (nav suppressor / panel-group provider /
   trigger start-end-swallow / grip-drop interceptor / frame hook — Scene.svelte
@@ -5847,7 +5899,7 @@ override for e2e — never share 5173 (the user's main-checkout server).
   clear/cap). Lane: ../theprototype-lane-aiphys @5178. REMAINING: on-device feel
   (strip offsets on the forearm — constants at the top of vrSleeve.js) = user check.
   **AI assistant v3 flow+physics tools: PR #76 OPEN against release/next** (same
-  lane; plan: plans-core/done/ai-flow-physics-tools.md). The assistant creates
+  lane; plan: plans/core/done/ai-flow-physics-tools.md). The assistant creates
   BEHAVIOR now: `create_flow_nodes`/`update_flow_nodes` always available (curated
   node-type enum + alias map, editor-identical node/edge construction incl. the
   handle-qualified edge-id format, ONE 'flownodes' history entry per call; the
@@ -5868,7 +5920,7 @@ override for e2e — never share 5173 (the user's main-checkout server).
   resolved by absorbing physicsShapeChanged into setPhysicsFor); post-merge 438/62
   held + ai/collider/joints suites green. REMAINING: live vLLM smoke = user check.
 - Status (2026-08-01): **Colliders v2 + Edit Mesh Pro MERGED to release/next (PR
-  #74)** — plan: cloud repo plans-core/pending/colliders-v2-editmesh-pro.md (marked
+  #74)** — plan: cloud repo plans/core/pending/colliders-v2-editmesh-pro.md (marked
   EXECUTED). Five commits: **CL-A** colliders core (colliderSpec.js one source of
   truth, LIVE mid-sim collider rebuild, sensors + enter/exit dispatch, material
   presets, freeze axes, scene-gravity `scenephysics` singleton, collider viz,
@@ -5903,7 +5955,7 @@ override for e2e — never share 5173 (the user's main-checkout server).
   bump): drag-drop-simulation cluster (explorer-drop/explorer/packs-drop) +
   user-modules, open-core-m1 (1 check), dock-sidebar-inset, layout, node-search,
   panels, script-nodes + a few two-peer timing suites. NEXT: deps migrations
-  post-1.0 (cloud plans-core/pending/deps-migrations-post-1.0.md, Part A first).
+  post-1.0 (cloud plans/core/pending/deps-migrations-post-1.0.md, Part A first).
 - Status (2026-07-26): **Mobile/responsive UI polish — branch
   `fix/ui-polish-connect-settings` (off main, NOT PR'd yet).** A large ad-hoc pass, not a
   numbered roadmap batch. Landmarks: **Connect docking** — the centred pill MEASURES
diff --git a/check-baseline.json b/check-baseline.json
index f39d4b38..87376af8 100644
--- a/check-baseline.json
+++ b/check-baseline.json
@@ -1,6 +1,6 @@
 {
 	"comment": "27-I: the svelte-check floor, read ONLY by scripts/check-ratchet.cjs. It used to be hardcoded in release.yml's shell block, where it went stale (362 while the tree measured 359). Ratchet it DOWN whenever a change legitimately removes errors - that is the project convention, and --update does it in one command.",
-	"errors": 341,
+	"errors": 336,
 	"warnings": 47,
-	"measured": "2026-09-17"
+	"measured": "2026-09-20"
 }