---
title: "Watch a mesh"
description: "Choose a terminal display, line stream, or read-only browser dashboard for a running mesh."
kind: "Guide (informative)"
audience: "operators"
---

import { Card, Cards } from 'fumadocs-ui/components/card';

Inspect agents, channels, and messages in a [running mesh](run-a-mesh.mdx).
The terminal console and stream use the [MeshView](mesh-view.mdx) observer model.
Choose one for your current task:

<Cards>
<Card title="Use the console" href="console.mdx">
Inspect a space interactively, follow a chat stream, or use authorized operator controls.
</Card>
<Card title="Use the web dashboard" href="web-dashboard.mdx">
Start a read-only browser display on the credential the space mints for it.
</Card>
</Cards>

## Terminal console [#terminal-console]

Run `cotal console` for an interactive terminal display.
A pipe or `--plain` selects the timestamped line stream for scripts and CI logs.
The console ships with the CLI and can perform separately authorized operator actions.
See [Use the console](console.mdx#terminal-console) for keys, controls, attachment, and reply behavior.

## Web dashboard [#web-dashboard]

Start the `@cotal-ai/web` service with `cotal service start web`.
The dashboard ships with `cotal-ai` and is seeded automatically, but it is separate from stack startup.
It requires a registered static-auth root and explicit read-only intent, and it reads the `web.creds` that `cotal up` mints for the space unless you pass `--creds`.
See [Use the web dashboard](web-dashboard.mdx#web-dashboard) for setup and private browser access.

## Check visibility limits [#what-each-surface-can-see]

The credential and display determine what you can see:

| Display | Visibility |
| --- | --- |
| Console TUI | Selects only chat when credentials or a user bearer are present, even with admin grants. Without either, uses a whole-space tap on an open mesh. |
| Console line stream | Uses the same chat or whole-space tap selection as the TUI. |
| Dashboard service | Uses the protected file you supply and its grants. It does not mint a replacement admin credential. |

A chat-only credential hides DM views. A restricted read does not prove that a peer or DM is absent.
Neither display starts the mesh's dependencies automatically.

When an endpoint rebuilds an ordered KV watch, it skips the predecessor's delete request if it
recorded that watch as its own and the connection's known publish claims exclude the delete.
The predecessor remains for the broker's inactive-threshold cleanup. Skipping the request does not
prove the consumer is gone. Granted deletes, unknown claims, and unrecorded consumers still go to
the broker for authorization.

See [Identity](identity-and-auth.mdx) for observer and admin scopes and the [wire specification](../SPEC.md) for visibility guarantees.