Operator Console

At a glance

• Who sees it: only accounts the server has marked as operators. If you are not one, the command does not appear, and every part of the console would refuse you even if it did.
• How to open it: the Command Palette — press Ctrl+K and type Operator.
• What it can do: list accounts, list generation runs, open one run to see why it failed, and disable or re-enable an account.
• What it cannot do: read anyone's Kards. Not their titles, not their content, not their notes. The console sees accounts and run metadata only, and there is no path through it to a customer's work.

Accounts

The first tab lists accounts on the service, newest first. Search by email or display name, and narrow to active or disabled accounts with the filter.

• ACTIVE / DISABLED is the account's state. A disabled account cannot sign in or make any request; the row for one is dimmed.
• Tenant is the workspace an account's Kards live in. An individual customer is a tenant of one and never sees the word.
• NO TENANT is a warning, and worth acting on. It means the account was created but never got a workspace, so it has no library at all. It happens only to accounts created during a specific past fault, and the fix is for the account holder to use Reset Kard Library, which provisions the workspace and restores the starter Kards.
• HISTORY opens that account's audit trail — every disable and re-enable, who did it, when, and the reason they gave.

Disabling and re-enabling an account

Disabling stops an account from making any request. It is the moderation tool for abuse, and it is always reversible — a switch you cannot switch back is an outage, not moderation.

• A reason is required. The form will not submit without one and the server refuses a blank one. The account holder is owed an explanation, and a trail of empty reasons answers nobody's question later.
• The reason is permanent. It is written to an audit record that can be read and added to, but never edited or deleted. Correcting a mistaken action means re-enabling the account with a reason that says so — which is what an audit trail is for.
• You cannot disable your own account. It would lock you out of the only tool that could undo it.
• Nothing is deleted. A disabled account keeps every Kard, setting and ticket it had. Re-enabling restores access to all of it.

Generation runs

The second tab lists AI generation runs across every tenant, so a support question like "my Kard stopped half way this morning" has somewhere to be answered. Filter by status; Failed only is the default, because that is what usually brings someone here.

• FAILED — nothing usable came back.
• PARTIAL — the run started and stopped part-way. The customer got some of a Kard, and the tokens spent were real.
• COMPLETE — the run finished.
• Reason is what actually went wrong, in the AI provider's own words where it gave any, or the HTTP status where the provider answered without starting a stream at all.
• Charged is what the customer was billed for that run.

One row is one Kard. A Kard is built from several AI calls — an outline, one per stage, and a repair attempt for any stage that came back malformed — and the listing rolls all of them up, so a Kard is a single line with a single price however many calls it took.

Repairs says how many of those calls were retries, and Repair cost says what the retries came to. A stage that comes back malformed is asked again, and that second ask is charged like any other call — so a Kard listed as 26 calls of which 8 were repairs is a very different piece of work from a clean 18, and the difference is money. Runs generated before this was recorded show 0 for both: the figure was never captured for them, and it is left empty rather than guessed.

Selecting a run opens it call by call. Each names its phase — the outline, a content stage, a repair of one, or the web search that precedes a References stage — alongside its own status, tokens, price and reason. That is how a run that succeeded twice and then failed tells you exactly where it stopped, and what the recovery cost.

"Cross-tenant run listing is not available here"

This is a configuration message, not a failure, and it is worth understanding because it looks alarming and is not.

Listing runs across every tenant is the one thing the console does that the ordinary database connection deliberately cannot do — the isolation that keeps every customer's data separate is exactly what stops it. It needs a second, read-only database credential, and a deployment that has not been given one answers this instead. Accounts, disable and re-enable, and the audit trail all keep working. If you see it and expect otherwise, the deployment has not been updated; nothing is broken and no data is at risk.

Good to know

• The lists show one page. When there are more results than fit, a banner says so. It never silently pretends a full page is everything — narrow the search rather than assuming you have seen every account.
• The window behaves like every other. Minimize it to the dock, resize it from the corner, or close it; reopening rebuilds it fresh.
• The console is a view, not a permission. Everything it shows is checked again by the server on every request. Reaching the window without the right account gets you a console that can load nothing.

Troubleshooting

• "Not available for this account": the server does not recognize this account as an operator. That is the same answer it gives to everyone else, and it is not a fault.
• "Refused: the account is already in that state": somebody has already disabled (or re-enabled) it. Open HISTORY on that row to see who and when.
• A run will not open, "exists in more than one tenant": two tenants happen to share a run identifier, so there is no single run to show. The console refuses rather than guess, because showing the wrong tenant's run with no way to tell would be worse.
• The command is missing from the palette: you are signed out, or signed in as a non-operator. Check the account strip at the top of the app.

Related topics

• The Event Console (System Log)
• The Command Palette
• Settings