The Office Gateway Was a Bottleneck With a Name
The first mobile build had one gateway, on the office Mac. Every session the phone could see lived there; a session on the MacBook did not exist as far as the pocket was concerned. When Dad withdrew the session takeover on 2026-09-17, the same ruling moved the gateway: one per Mac, each on that Mac's own tailnet address, each with its own list of approved devices. No Mac relays for another. The phone reaches each host directly, the same way the family's other services already reach each other over the tailnet.
Approval Is Per Host
A gateway exists only where it has someone to serve. The daemon's installer — and therefore every ordinary build and every family deploy — sets up a Mac's gateway only when that Mac carries a private, operator-approved device list, and reports that it skipped everywhere else. The same iPhone has to be listed on each Mac it may reach. Approving a phone on the office Mac grants nothing on the MacBook. The device is still the credential, and the permission is still the operator's, now one host at a time.
The Phone Holds a List of Macs
On the phone, the single address became a list. Each registered Mac is a chip named by its fleet alias — office, macbook — with a status dot; the address is information under the name, never the name (Dad, the same day). The Macs sheet lists every registered Mac with its address, its host name, and the mode its owner speaks:
Every registered Mac connects automatically while the app is active, and choosing a chip only chooses which Mac's sessions are listed below it. Known fleet Macs are one tap away, with an add-all; a custom address exists only for the day an address changes, and it is named by its address until that Mac's hello names it. An explicit Disconnect, or the gateway refusing or revoking the device, stops automatic reconnection for that Mac until Connect is pressed. Editing a row never redirects a link that is already open, and an invalid address is refused without touching the old one. In the picture, three Macs show Disconnected · Could not connect to the server. — they are registered on the phone, but no device list was approved on them, so no gateway answers. That is the per-host rule, visible.
The Gateway Says Who It Is and What It Has
Each gateway's hello carries the Mac's fleet label and the coding CLIs actually installed on that Mac, read from the same table the Mac app uses. The phone keeps no roster of its own; it offers a shell, SSH through that Mac, and whatever that Mac says it has. Connection lifetime is bounded on the gateway: keepalive finds a phone that left without closing, a connection that sends nothing for 45 seconds after its greeting is closed, a connection still in its TCP, WebSocket or identity step counts against a separate, bounded budget with an eight-second deadline, and takes one of the eight device slots only once its device's identity is proven — so an unapproved or anonymous connection never holds a slot, and each connection remembers recent request identities so a replayed request is refused. The Mac app watching another Mac's sessions is not built; that part of the ruling remains a later milestone.