fix(cec): the tech's Site door opens the tunnel it shows

[mrjeeves]

What changed

Field report from #186: the help tech finally saw the KVM's 🌐 Site button, but clicking it refused with "Sites are owner/fleet only — X isn't yours." Remote control kept working the whole time.

Root cause: #186 widened only kvmTwin — the visibility gate — while mapSite, the gate the tunnel actually goes through, kept the old owner/fleet rule. A door drawn on, lock unchanged. The KVM itself was never the blocker: its senderMayControl admits the session's technician (cecApprovedTech) for every plane, site routes included — which is exactly why control worked. The GUI was the only thing refusing.

One authority now answers both questions:

• cecStanding(node) — live CEC standing: a dialed customer, or a hand up in the watched queue right now. Deliberately the same lifetime as the appliance's approved‑tech set (admitted while asking or on dial, dropped on hangup), which is what really authorizes each tunneled request.
• kvmDoors(node) = kvmAllowed || cecStanding — the session doors (web Site + the Power/Reset that ride the same tunnel). mapSite, kvmTwin, and the graph card's globe (capabilitiesFor.sites' kvm arm) all read this one gate, so the button can never render only for the tunnel to refuse.
• kvmAllowed stays the curation rule (attach/detach, the drawer's fleet tools): owner / co‑fleet / shared only. A tech never inherits those.
• kvmTwin's raisedHand option is gone — cecStanding covers queue rows, so the special case (and its two call sites) collapse.

An ordinary customer's exposed sites stay owner/fleet‑only: the CEC consent model covers screen + control, and a person's sites would just be denied. The KVM arm is safe precisely because the appliance is the real authority — widening the GUI gate can't grant access the KVM would refuse; it just stops the GUI refusing first.

Pre‑answer clicks work too: while the hand is up, the KVM's cecAdmit admits whoever reaches out — the site offer itself triggers admission ("the hand‑raise IS the ask").

Verification

• svelte-check: 152 files, 0 errors, 0 warnings
• vite build: clean
• No raisedHand references remain

🤖 Generated with Claude Code

https://claude.ai/code/session_01YYdqmManehKSKxwzcfeeU4

---

Generated by Claude Code