create-walle 0.10.0 → 0.10.2

package/template/coding-task-manager/public/m/app.js

@@ -160,6 +160,13 @@
       itemElements: [],
     },
     projects: [],
+    // WP-5 (S-16/AC-5c): the machine registry, mirrored field for field from the desktop client —
+    // same GET /api/machines rows, same reachable/unknown/unhealthy card states, same chip facts.
+    // Empty until the hub answers; with zero machines nothing machine-shaped renders at all.
+    machines: [],
+    // The project picked on this Mac before a box was chosen in the new-session sheet: the key the
+    // same-repo prefill matches, and what "This Mac" restores.
+    newSessionLocalCwd: '',
     pendingStepUp: null,
     workflowRoute: { pending: null },
     homeSearchQuery: '',
@@ -386,7 +393,7 @@
       || !mobilePrivateStateRuntime.matchesAuth(operation.principalAuth, lease)) {
       if (mobilePrivatePreparationOperation !== operation) return null;
       identityCache.clear(); mobilePrivateLease = null; mobilePrivateReady = false; mobilePrivateCache = null; // D-7: an unattached lease keeps no identity bytes
-      state.sessions = []; state.sessionsLoaded = true; state.remoteOutbox = [];
+      state.sessions = []; state.sessionsLoaded = true; state.remoteOutbox = []; syncPoolOutboxPendingMarker();
       state.privateScopeError = mobilePrivateStateRuntime.snapshot()?.code || 'private_scope_unavailable';
       setConnection('offline', 'Private data paused');
       render();
@@ -420,7 +427,7 @@
     const staleSocket = state.ws; state.ws = null; state.wsReady = false; clearWsReconnectTimer(); clearWsLivenessTimers(); try { staleSocket?.close(); } catch { /* expected: invalidation can race socket close */ }
     clearTimeout(state.remoteOutboxTimer); state.remoteOutboxTimer = null;
     clearTimeout(state.remoteOutboxStorage.persistTimer); state.remoteOutboxStorage.persistTimer = null;
-    state.remoteOutbox = []; state.remoteOutboxDraining = false; state.sessions = []; state.sessionsLoaded = true; state.sessionsFromCache = false;
+    state.remoteOutbox = []; syncPoolOutboxPendingMarker(); state.remoteOutboxDraining = false; state.sessions = []; state.sessionsLoaded = true; state.sessionsFromCache = false;
     state.activeSession = null; state.detail.sessionId = null; state.detail.messages = []; state.remoteSubmissions.clear();
     state.remote = null; state.remoteStatusPromise = null; state.remoteStatusLoading = false; remoteStatusLease = null;
     state.remoteOutboxStorage.persistInFlight = null; remoteOutboxMirrorDeferred = false;
@@ -2458,6 +2465,7 @@
           <span class="session-title-line">
             <span class="session-title">${esc(card.title || card.id || 'Session')}</span>
             ${opts.worker === true ? cardModelChip(card) : ''}
+            ${phoneMachineChip(card)}
             ${pill}
           </span>
           <span class="session-meta"><span class="session-meta-text">${esc(meta)}</span>${sessionDiffMark(card)}</span>
@@ -4099,6 +4107,10 @@
       .then((mod) => {
         if (container) container.dataset.moreLoaded = '1';
         mod.renderMore(moreContext());
+        // WP-5 (D-11/S-16): the Machines card is part of More on the phone, exactly as it is part of
+        // Settings on the desktop. more.js owns #more-content and rewrites it wholesale, so the card
+        // is (re)appended after each of its renders.
+        renderPhoneMachinesCard();
       })
       .catch((err) => {
         if (container) {
@@ -5616,7 +5628,25 @@
     }
   }
 
+  // WP-4 (docs/dgx-spark-coding-readiness-2026-10-24.html) — phone = desktop parity: the desktop
+  // shows a MACHINE-scoped failure frame verbatim in a toast (public/index.html:4471-4481), while
+  // this dispatcher used to drop every 'error' frame, so a hub refusal (machine_agent_signed_out,
+  // machine_unreachable, …) was invisible on the phone. Only machine failures are shown, through
+  // the app's existing toast helper (:13662); every other error frame keeps today's behaviour.
+  function showMobileMachineError(msg) {
+    const code = String((msg && msg.code) || '');
+    if (!/^machine_/.test(code) && !(msg && msg.machine)) return false;
+    toast(String((msg && (msg.message || msg.error)) || code || 'Machine error'));
+    return true;
+  }
+
   function dispatchMobileWsMessage(msg) {
+    if (msg.type === 'error') {
+      // A machine create refused at the hub names the box and the page that fixes it; show it and
+      // stop. 'hello'/'pong'/… are unaffected, and no other frame type is touched.
+      showMobileMachineError(msg);
+      return;
+    }
     if (msg.type === 'hello') {
       handleServerHello(msg);
       return;
@@ -5667,9 +5697,16 @@
     }
     if (msg.type === 'sessions' || msg.type === 'data-changed') {
       if (msg.type === 'data-changed' && ['models', 'model-registry', 'providers'].includes(msg.resource)) phoneModelPicker?.invalidateCatalog?.(); // D-6: as desktop onDataChanged
+      // R-3: a queue-draft echo reloads the open idle builder's draft (reloadIfIdle guards
+      // mid-operation panes); scheduleRefresh below is unchanged.
+      if (msg.type === 'data-changed' && msg.resource === 'queue-draft' && msg.id) {
+        privateQueueActions.reloadIfIdle(msg.id).catch(window.ClientErrors.tail('mobile:queue-draft-load'));
+      }
       scheduleRefresh(350);
       return;
     }
+    // R-3: delivery transitions (server.js broadcastQueueState) were dropped on the phone.
+    if (msg.type === 'queue-state' && msg.sessionId) privateQueueActions.reloadIfIdle(msg.sessionId).catch(window.ClientErrors.tail('mobile:queue-draft-load'));
     if (msg.type === 'session-activity') { applySessionActivity(msg); return; }
     if (msg.type === 'tunnel-economy') { phonePresence.handleTunnelEconomy(msg); return; } // D-8: the lane governor's economy notice drives the passive #detail-tunnel-economy chip
     if (msg.type === 'session.status') {
@@ -5814,7 +5851,28 @@
     }, 0);
   }
 
+  // Plain window.localStorage, or null when the context blocks it (private mode throws on the getter
+  // itself). The outward mirror of the queue is the only thing in this file that uses plain storage.
+  function phonePlainStorage() {
+    try {
+      return window.localStorage || null;
+    } catch (error) {
+      return null; // expected: a blocked/opaque context throws on the localStorage getter itself
+    }
+  }
+
+  // P-7 boot seam: public/m/pool-failover.js probes the other members before this app has a private
+  // lease, and cannot read the outbox (which is leased). So every persist and every clear mirrors ONLY
+  // the queue's presence into `ctm.pool.outboxPending` — '1' or absent, never an entry, an id or a
+  // count — and attemptPhonePoolFailover() reads it back through the shared module.
+  function syncPoolOutboxPendingMarker() {
+    const failover = window.CtmPoolFailover;
+    if (!failover?.writeOutboxPendingMarker) return false;
+    return failover.writeOutboxPendingMarker(phonePlainStorage(), state.remoteOutbox.length > 0);
+  }
+
   function persistRemoteOutbox(options = {}) {
+    syncPoolOutboxPendingMarker();
     const captured = capturedPrivateStorage(options.lease || mobilePrivateLease);
     if (!captured || !remoteOutboxPersistence) return false;
     if (pendingDurableOutboxWrites.size && options.includePending !== true) {
@@ -6087,6 +6145,7 @@
     } catch (err) {
       const index = state.remoteOutbox.findIndex((item) => item === entry && item.id === entry.id);
       if (index >= 0) state.remoteOutbox.splice(index, 1);
+      syncPoolOutboxPendingMarker();
       throw err;
     } finally { finishPendingDurableOutboxWrite(entry.id, lease); }
     if (typeof opts.isStatusCurrent !== 'function' || opts.isStatusCurrent()) setComposerStatus(remoteOutboxQueuedStatus(entry), '');
@@ -13284,19 +13343,357 @@
     if (state.activeTab === 'search') renderSearch();
   }
 
-  function openNewSessionSheet() {
+  // ── WP-5 machine surfaces (docs/remote-machine-hub-sessions-2026-10-22.html §6.6, D-11, S-16) ──
+  // The desktop presenter's field-for-field twin (public/js/core/session-commands.js): the same
+  // /api/machines rows, the same card-state table, the same chip text and the same payload field.
+  // Phone = desktop parity: no phone-only machine feature and no desktop-only machine feature.
+  const PHONE_MACHINE_CARD_STATES = Object.freeze(['reachable', 'unknown', 'unhealthy']);
+
+  function phoneMachineFacts(row) {
+    const meta = (row && (row.meta || row)) || {};
+    return {
+      machine: String(meta.machine || '').trim(),
+      name: String(meta.machineName || meta.machine_name || '').trim(),
+      health: String(meta.machineHealth || meta.machine_health || '').trim(),
+    };
+  }
+
+  // '' for a local session, so local rows are byte-identical to their pre-hub render (AC-5b).
+  function phoneMachineChip(row) {
+    const facts = phoneMachineFacts(row);
+    if (!facts.machine) return '';
+    const name = facts.name || facts.machine;
+    const unreachable = facts.health === 'unreachable';
+    const title = unreachable ? `Runs on ${name} — unreachable (showing its last known state)` : `Runs on ${name}`;
+    return `<span class="machine-chip${unreachable ? ' unreachable' : ''}" title="${esc(title)}" aria-label="${esc(title)}"`
+      + ` data-machine-name="${esc(name)}" data-machine-health="${esc(facts.health)}">${esc((unreachable ? '⚠ ' : '◈ ') + name)}</span>`;
+  }
+
+  // WP-4 (docs/dgx-spark-coding-readiness-2026-10-24.html): the same rule as the desktop presenter —
+  // a reachable box whose Claude/Codex CLI is signed out names the agents it needs signed in
+  // (`agents` = the hub's last-read {claude, codex, checkedAt} verdict). The option stays ENABLED:
+  // shell sessions still work there and the hub refuses a signed-out agent create itself.
+  const PHONE_MACHINE_AGENT_LABELS = { claude: 'Claude', codex: 'Codex' };
+
+  function phoneMachineSignedOutAgents(machine) {
+    const agents = machine && machine.agents;
+    if (!agents || typeof agents !== 'object') return [];
+    return ['claude', 'codex']
+      .filter((key) => agents[key] === 'signed_out')
+      .map((key) => PHONE_MACHINE_AGENT_LABELS[key]);
+  }
+
+  // WP-4: the machine's NAME, read from the registry row (state.machines, the same array
+  // phoneMachineOptionsHtml is called with — desktop machineSelectionName() does exactly this),
+  // never from the option's rendered text, which carries the "◈ " glyph and may carry a
+  // "— sign in: …" suffix. An id the list does not know falls back to the raw id.
+  function phoneMachineDisplayName(machineId) {
+    const id = String(machineId || '').trim();
+    if (!id) return '';
+    const row = (Array.isArray(state.machines) ? state.machines : [])
+      .find((machine) => machine && String(machine.instanceId || '') === id);
+    return String((row && (row.displayName || row.url)) || id);
+  }
+
+  // AC-5a: reachable is selectable; unknown/unhealthy render DISABLED with their reason;
+  // unreachable is ABSENT. The phone expresses the same three states as <option> attributes.
+  function phoneMachineCardView(machine) {
+    const health = String((machine && machine.health) || '').trim();
+    if (PHONE_MACHINE_CARD_STATES.indexOf(health) === -1) return null;
+    const id = String((machine && machine.instanceId) || '');
+    if (!id) return null;
+    const name = machine.displayName || machine.url || id;
+    const reason = health === 'reachable'
+      ? 'reachable'
+      : health === 'unknown'
+        ? 'health unknown — the box is not answering probes'
+        : 'unhealthy — the box is up but its hub is degraded';
+    const view = { id, name, health, reason, disabled: health !== 'reachable' };
+    // WP-4: only a reachable box names an agent — a disabled option keeps its single reason.
+    if (health === 'reachable') {
+      const signInNeeded = phoneMachineSignedOutAgents(machine);
+      if (signInNeeded.length) view.signInNeeded = signInNeeded;
+    }
+    return view;
+  }
+
+  // The hub's registry: the phone reads the same GET /api/machines the desktop does. A hub-less
+  // (older) server 404s and the phone simply has no machines (no grid, no chip, no card).
+  async function loadMachines() {
+    try {
+      const payload = await api('/api/machines');
+      state.machines = Array.isArray(payload?.machines) ? payload.machines.filter((m) => m && m.instanceId) : [];
+    } catch {
+      state.machines = [];
+    }
+    return state.machines;
+  }
+
+  // The desktop rule (session-commands.js machinesWritableHere): registration is loopback-only
+  // server-side, so off loopback the phone shows the list read-only instead of a form that 403s.
+  // The phone's own loopback signal is the auth principal's isLoopback.
+  function machinesWritableHere() {
+    return state.auth?.isLoopback === true;
+  }
+
+  // WP-6 (brief item 2): the phone Machines page is public/m/machines.js — the twin of the desktop
+  // machines-page.js (This Mac + every registry member, the same groups/badges/sparklines/actions,
+  // the same Add dialog, Show a code, Leave pool, Join pool, New session here, "Sign in to <member>
+  // too"). The old phone card here (register form, remove button, health line) is DELETED, not kept
+  // beside it: the register form's legacy URL path lives in the Add dialog on both surfaces, exactly
+  // as WP-5 has it on the desktop.
+  let phoneMachinesSurface = null;
+
+  function phoneMachines() {
+    if (phoneMachinesSurface) return phoneMachinesSurface;
+    phoneMachinesSurface = window.CtmPhoneMachines?.create?.({
+      $,
+      document,
+      esc,
+      api,
+      toast,
+      loadMachines: (options) => loadMachines(options),
+      openNewSessionSheet: (instanceId) => openNewSessionMachine(instanceId),
+      confirm: (message) => window.confirm(message),
+      now: () => Date.now(),
+    }) || null;
+    return phoneMachinesSurface;
+  }
+
+  // Renders (or re-renders) the Machines section inside #more-content. more.js owns that container and
+  // rewrites it wholesale, so this runs again after each of its renders and the section node is reused.
+  function renderPhoneMachinesCard() {
+    return phoneMachines()?.render($('more-content')) || null;
+  }
+
+  // ── WP-6 item 3: the picker — <select> at N <= 4, the search sheet above it ─────────────────────
+  // The one clock read for the picker (D-12 staleness). Named, so a test drives it instead of the
+  // page's real clock.
+  function phoneMachinesNow() {
+    return Date.now();
+  }
+  // N = This Mac + the visible registry rows (D-1). At or below MACHINE_PICKER_CARD_LIMIT the phone
+  // keeps the one-tap <select>: its option text carries the D-12 load line when the hub has a fresh
+  // sample, because a phone option row is short enough for it ("◈ Spark — CPU 12% · 3 running");
+  // when the sample is stale or absent the option keeps the pre-WP-6 "◈ Name" text, so a hub that
+  // sends no samples renders exactly what it rendered before. Above the limit the picker is the
+  // search sheet (D-2 search, D-3 groups, offline disabled with "last seen …").
+  function phoneMachineOptionsHtml(machines, now) {
+    const views = (Array.isArray(machines) ? machines : []).filter((m) => m && m.instanceId).map(phoneMachineCardView).filter(Boolean);
+    const items = ['<option value="">This Mac</option>']
+      .concat(views.map((view) => {
+        // '' when nothing is signed out, so the option text is byte-identical to its pre-WP-4 self.
+        const signIn = !view.disabled && Array.isArray(view.signInNeeded) && view.signInNeeded.length
+          ? ` — sign in: ${view.signInNeeded.join(', ')}`
+          : '';
+        const machine = (Array.isArray(machines) ? machines : []).find((m) => String(m?.instanceId || '') === view.id);
+        // machineLoadLine is the shared copy (public/js/machine-pool-shared.js), loaded by
+        // public/m/index.html before this file — the same global the desktop picker calls.
+        const load = !view.disabled && machine ? machineLoadLine(machine, now) : '';
+        // A stale/absent sample yields 'stats stale' or '' — neither earns a place in a one-line option.
+        const loadText = load && load !== 'stats stale' ? ` — ${load}` : '';
+        return `<option value="${esc(view.id)}"${view.disabled ? ' disabled' : ''}>${esc(view.disabled ? `◈ ${view.name} — ${view.reason}` : `◈ ${view.name}${loadText}${signIn}`)}</option>`;
+      }));
+    return { views, html: items.join('') };
+  }
+
+  function phoneMachinePickerMode(machines) {
+    return window.CtmPhoneMachines?.pickerMode?.(machines) || 'select';
+  }
+
+  async function openNewSessionSheet() {
     if (!state.auth?.scopes?.includes('create') && !state.auth?.scopes?.includes('admin')) {
       toast('This phone token needs create scope. Upgrade it on the Mac.');
       return;
     }
     const select = $('new-session-project');
-    const options = state.projects.length
-      ? state.projects.map((project) => `<option value="${esc(project.path || project.cwd || project.name)}">${esc(project.name || compactPath(project.path || project.cwd))}</option>`)
-      : ['<option value="">Home</option>'];
-    select.innerHTML = options.join('');
+    select.innerHTML = phoneProjectOptionsHtml(state.projects);
+    state.newSessionLocalCwd = '';
+    phoneMachineSetHint('');
+    // WP-5 (S-16/AC-5c): the machine choice is fetched per open, exactly like the desktop modal.
+    // With zero renderable machines the field stays hidden and the sheet is unchanged (AC-5a).
+    // WP-6 (D-1/D-2/D-3): above MACHINE_PICKER_CARD_LIMIT machines the field becomes the search sheet
+    // — the <select> stays as the value store (hidden), and the row above it opens the sheet.
+    const machineField = $('new-session-machine-field');
+    const machineSelect = $('new-session-machine');
+    const machineRow = $('new-session-machine-row');
+    if (machineSelect) machineSelect.innerHTML = '<option value="">This Mac</option>';
+    if (machineField) machineField.hidden = true;
+    const machines = await loadMachines();
+    if (machineSelect) {
+      const { views, html } = phoneMachineOptionsHtml(machines, phoneMachinesNow());
+      machineSelect.innerHTML = html;
+      if (machineField) machineField.hidden = views.length === 0;
+      phoneMachineSetPickerMode(views.length ? phoneMachinePickerMode(machines) : 'select');
+    }
+    if (machineRow) machineRow.hidden = true;
     $('new-session-sheet').hidden = false;
   }
 
+  // The picker's mode decides which of the two controls is visible; the <select> is always the value
+  // holder, so createSession's `$('new-session-machine').value` read never changes.
+  function phoneMachineSetPickerMode(mode) {
+    const search = mode === 'search';
+    const machineSelect = $('new-session-machine');
+    const machineRow = $('new-session-machine-row');
+    if (machineSelect) machineSelect.hidden = search;
+    if (machineRow) {
+      machineRow.hidden = !search;
+      machineRow.textContent = phoneMachineSelectedLabel();
+    }
+    return search;
+  }
+
+  function phoneMachineSelectedLabel() {
+    const id = String($('new-session-machine')?.value || '').trim();
+    return id ? `◈ ${phoneMachineDisplayName(id)}` : '◈ This Mac';
+  }
+
+  // WP-6 item 4 / D-1: "New session here" from the Machines page opens the EXISTING new-session sheet
+  // and selects that machine. One create path, exactly as the desktop page's machinesPageNewSessionHere.
+  async function openNewSessionMachine(instanceId) {
+    await openNewSessionSheet();
+    const machineSelect = $('new-session-machine');
+    const id = String(instanceId || '').trim();
+    if (!machineSelect || machineSelect.hidden || !id) return false;
+    machineSelect.value = id;
+    phoneMachineSetPickerMode(phoneMachinePickerMode(state.machines));
+    await onPhoneMachineChange();
+    return true;
+  }
+
+  // ── WP-6 item 3: the machine search sheet (N > MACHINE_PICKER_CARD_LIMIT) ───────────────────────
+  let phoneMachineSheetOpen = false;
+
+  function renderPhoneMachineSearchSheet(query) {
+    const list = $('machine-search-list');
+    if (!list) return false;
+    const now = phoneMachinesNow();
+    const selected = String($('new-session-machine')?.value || '').trim();
+    list.innerHTML = window.CtmPhoneMachines?.sheetListHtml?.(state.machines, query, selected, now) || '';
+    const count = $('machine-search-count');
+    if (count) {
+      const groups = window.CtmPhoneMachines?.sheetGroups?.(state.machines, query, now) || [];
+      const total = groups.reduce((sum, group) => sum + group.rows.length, 0);
+      count.textContent = total
+        ? `${total} machine${total === 1 ? '' : 's'}`
+        : 'No machine matches that search.';
+    }
+    return true;
+  }
+
+  function openPhoneMachineSearchSheet() {
+    const backdrop = $('machine-search-sheet');
+    if (!backdrop) return false;
+    const input = $('machine-search-input');
+    if (input) input.value = '';
+    renderPhoneMachineSearchSheet('');
+    backdrop.hidden = false;
+    phoneMachineSheetOpen = true;
+    if (input && typeof input.focus === 'function') input.focus();
+    return true;
+  }
+
+  function closePhoneMachineSearchSheet() {
+    const backdrop = $('machine-search-sheet');
+    if (backdrop) backdrop.hidden = true;
+    phoneMachineSheetOpen = false;
+    return true;
+  }
+
+  function bindPhoneMachineSearchSheet() {
+    const input = $('machine-search-input');
+    if (input) input.addEventListener('input', () => renderPhoneMachineSearchSheet(input.value));
+    $('machine-search-close')?.addEventListener('click', () => closePhoneMachineSearchSheet());
+    $('machine-search-sheet')?.addEventListener('click', (event) => {
+      if (event.target === $('machine-search-sheet')) closePhoneMachineSearchSheet();
+    });
+    $('machine-search-list')?.addEventListener('click', async (event) => {
+      const row = event.target?.closest?.('[data-machine-pick]');
+      if (!row || row.disabled) return;
+      event.preventDefault();
+      const machineSelect = $('new-session-machine');
+      if (!machineSelect) return;
+      machineSelect.value = row.getAttribute('data-machine-pick') || '';
+      phoneMachineSetPickerMode('search');
+      closePhoneMachineSearchSheet();
+      await onPhoneMachineChange();
+    });
+    $('new-session-machine-row')?.addEventListener('click', (event) => {
+      event.preventDefault();
+      openPhoneMachineSearchSheet();
+    });
+  }
+
+  function phoneProjectOptionsHtml(projects) {
+    const rows = Array.isArray(projects) ? projects : [];
+    return rows.length
+      ? rows.map((project) => `<option value="${esc(project.path || project.cwd || project.name)}">${esc(project.name || compactPath(project.path || project.cwd))}</option>`).join('')
+      : '<option value="">Home</option>';
+  }
+
+  function phoneMachineSetHint(text, warn) {
+    const hint = $('new-session-machine-hint');
+    if (!hint) return;
+    hint.textContent = text || '';
+    hint.hidden = !text;
+    hint.classList.toggle('warn', !!warn);
+  }
+
+  // The box checkout of the project picked on this Mac: the box row whose gitRemoteKey equals the
+  // local project's key ('' = that project has no remote, so nothing can match).
+  function phoneSameRepoProject(localProjects, localCwd, boxRows) {
+    const local = (Array.isArray(localProjects) ? localProjects : []).find((project) => project && (project.path || project.cwd) === localCwd);
+    const localKey = String(local?.gitRemoteKey || '');
+    if (!localKey) return '';
+    const match = (Array.isArray(boxRows) ? boxRows : []).find((row) => row && (row.path || row.cwd) && String(row.gitRemoteKey || '') === localKey);
+    return match ? String(match.path || match.cwd) : '';
+  }
+
+  // WP-5 (S-13, desktop _selectMachineCard + nsMachineAfterProjectsLoaded): the project list
+  // belongs to the selected machine. A box lists the BOX's projects (GET /api/projects?machine=)
+  // and prefills the checkout whose gitRemoteKey equals the key of the project picked on this Mac
+  // (plain equality: the server normalizes); "This Mac" restores the local list and project. An
+  // answer for a machine that is no longer selected is dropped, so a box path never lands under
+  // "This Mac" (or under another box).
+  async function onPhoneMachineChange() {
+    const machineSelect = $('new-session-machine');
+    const select = $('new-session-project');
+    if (!machineSelect || !select) return;
+    const machine = String(machineSelect.value || '').trim();
+    if (!machine) {
+      select.innerHTML = phoneProjectOptionsHtml(state.projects);
+      if (state.newSessionLocalCwd) select.value = state.newSessionLocalCwd;
+      state.newSessionLocalCwd = '';
+      phoneMachineSetHint('');
+      return;
+    }
+    if (!state.newSessionLocalCwd) state.newSessionLocalCwd = String(select.value || '');
+    // The registry row's own name ('' only for an unknown id, which falls back to the id itself):
+    // never the option's rendered text, which carries "◈ " and possibly "— sign in: …".
+    const name = phoneMachineDisplayName(machine);
+    select.innerHTML = '';
+    phoneMachineSetHint(`Loading projects on ${name}…`);
+    let rows = [];
+    try {
+      const data = await api(`/api/projects?machine=${encodeURIComponent(machine)}`);
+      rows = Array.isArray(data) ? data : (Array.isArray(data?.projects) ? data.projects : []);
+    } catch (err) {
+      if (String($('new-session-machine')?.value || '').trim() !== machine) return;
+      phoneMachineSetHint(`Could not list projects on ${name}: ${err?.message || err}`, true);
+      return;
+    }
+    if (String($('new-session-machine')?.value || '').trim() !== machine) return;
+    select.innerHTML = phoneProjectOptionsHtml(rows);
+    const match = phoneSameRepoProject(state.projects, state.newSessionLocalCwd, rows);
+    if (match) {
+      select.value = match;
+      phoneMachineSetHint(`Same repository found on ${name}.`);
+    } else {
+      phoneMachineSetHint(`No checkout on ${name} carries this project's git remote — pick a folder on that box.`, true);
+    }
+  }
+
   async function createSession(event) {
     event.preventDefault();
     const lease = mobilePrivateLease;
@@ -13317,11 +13714,15 @@
             ? 'walle'
             : 'claude';
     const args = prompt && !isWalle ? [prompt] : [];
-    const request = Object.freeze({ cwd, agent, agentLabel, prompt, isWalle, cmd, args: Object.freeze(args.slice()) });
+    // WP-5 (S-12/S-16): the machine chosen in the sheet travels with the create frame as `machine`;
+    // '' is this Mac and the field is omitted, so a local create frame is unchanged.
+    const machine = ($('new-session-machine')?.value || '').trim();
+    const request = Object.freeze({ cwd, agent, agentLabel, prompt, isWalle, cmd, args: Object.freeze(args.slice()), machine });
     const action = async () => {
       if (!privateLeaseCurrent(lease) || state.pendingStepUp?.action !== action) throw privateScopeChangedError();
       const id = randomId();
       const payload = { type: 'create', id, cwd: request.cwd, cmd: request.cmd, args: request.args.slice() };
+      if (request.machine) payload.machine = request.machine;
       if (request.isWalle) {
         Object.assign(payload, {
           label: 'Wall-E Coding', agentType: 'walle', agentMode: 'coding', agentKind: 'walle-coding',
@@ -13368,6 +13769,7 @@
     { ...hiddenSheet('stepup-sheet'), close: () => $('stepup-cancel')?.click() },
     { ...hiddenSheet('workflow-route-sheet'), close: () => closeWorkflowRouteSheet('cancel') },
     { ...hiddenSheet('model-picker-sheet'), close: () => closeModelPicker() },
+    { ...hiddenSheet('machine-search-sheet'), close: () => closePhoneMachineSearchSheet() },
     { ...hiddenSheet('review-sheet'), close: () => closeReviewSheet() },
     { ...hiddenSheet('review-comment-sheet'), close: () => { $('review-comment-sheet').hidden = true; } },
     { ...hiddenSheet('queue-builder-sheet'), close: () => closeQueueBuilder() },
@@ -13768,6 +14170,8 @@
     $('new-session-btn').addEventListener('click', openNewSessionSheet);
     $('new-session-cancel').addEventListener('click', () => { $('new-session-sheet').hidden = true; });
     $('new-session-form').addEventListener('submit', createSession);
+    $('new-session-machine')?.addEventListener('change', () => { onPhoneMachineChange().catch(() => { /* expected: onPhoneMachineChange reports its own failures in the hint */ }); });
+    bindPhoneMachineSearchSheet();
     $('status-content')?.addEventListener('click', (event) => {
       if (event.target.closest('[data-private-scope-retry]')) { refreshPhoneHealth({ force: true }).catch(() => {}); retryPrivateStatePreparation().catch(() => {}); return; } // D-7: an explicit re-check ignores the TTL
       handleStatusSummaryClick(event);
@@ -13858,6 +14262,66 @@
     if (hash.startsWith('#walle/')) setTab('walle');
   }
 
+  // ── WP-6 item 5 / P-7: the boot-failure seam ───────────────────────────────────────────────────
+  // THE seam: init() below. The first API call of a boot is `prepareMobilePrivateState`'s private
+  // scope read (public/js/private-state-scope.js runPreparation: GET /api/auth/me, GET
+  // /api/instance/manifest, GET /api/auth/me again). When that read does not reach this origin, the
+  // runtime records it in the snapshot as `httpStatus`: 0 for a rejected fetch / aborted body (the
+  // transport outage P-7 is about) and the HTTP status when a response did arrive — so a 5xx from the
+  // relay/tunnel is the same "the box behind this origin is not answering" case, while a 4xx means
+  // this origin IS answering and the phone must not navigate away from it.
+  function phoneBootOriginUnreachable() {
+    const snapshot = mobilePrivateStateRuntime?.snapshot?.() || null;
+    const status = Number(snapshot?.httpStatus);
+    if (status === 0) return true;
+    return Number.isFinite(status) && status >= 500;
+  }
+
+  // The phone's own identity for the failover payloads: the dial-cache row for THIS origin (written by
+  // the last successful /api/machines load), falling back to the origin itself. The cache holds the
+  // five roster fields and no credential, so this is never a secret.
+  function phoneSelfOriginRow() {
+    const origin = String(window.location?.origin || '').replace(/\/+$/, '');
+    const rows = window.CtmPoolFailover?.readPoolOrigins?.() || [];
+    const mine = (Array.isArray(rows) ? rows : []).find((row) => String(row?.origin || '').replace(/\/+$/, '') === origin);
+    return { instanceId: String(mine?.instanceId || ''), displayName: String(mine?.displayName || ''), origin };
+  }
+
+  // Fire-and-forget: boot continues rendering the local shell whatever this decides. It navigates
+  // only when another pool member answers (public/m/pool-failover.js), and asks first when this phone
+  // still holds unsent outbox items — the outbox is per origin and would otherwise be stranded.
+  function attemptPhonePoolFailover() {
+    const failover = window.CtmPoolFailover;
+    if (!failover?.failoverOnBootFailure) return null;
+    // Offline means no member can answer: probing would burn four seconds per member to prove nothing.
+    if (typeof navigator !== 'undefined' && navigator.onLine === false) return null;
+    if (!phoneBootOriginUnreachable()) return null;
+    return failover.failoverOnBootFailure({
+      // The leased outbox is not readable yet, so this is the content-free presence marker app.js keeps
+      // in plain localStorage; the in-memory length is ORed in so the prompt can never under-report.
+      hasUnsentOutbox: !!failover.readOutboxPendingMarker?.(phonePlainStorage()) || state.remoteOutbox.length > 0,
+      selfInstanceId: phoneSelfOriginRow().instanceId,
+      renderList: (html) => { mountPhonePoolOriginsList(html); },
+    }).catch(() => null); // HANDLE: a failover that cannot even probe leaves the user on the boot screen
+  }
+
+  // The "no member answered" roster, mounted into the phone's own status surface (the P-7 list).
+  function mountPhonePoolOriginsList(html) {
+    const host = $('pool-failover-list') || $('pool-from-banner');
+    if (!host) return null;
+    host.innerHTML = String(html || '');
+    return host;
+  }
+
+  // AC-6e: arriving here with ?poolFrom=<id> means another member handed this phone over. Both names
+  // come from the stored roster; every string is escaped inside the module.
+  function showPhonePoolFromBanner() {
+    const failover = window.CtmPoolFailover;
+    if (!failover?.showPoolFromBanner) return null;
+    const self = phoneSelfOriginRow();
+    return failover.showPoolFromBanner({ self, selfInstanceId: self.instanceId });
+  }
+
   async function init() {
     const operation = {};
     mobilePrivatePreparationOperation = operation;
@@ -13885,7 +14349,14 @@
       state.sessionsLoaded = true;
       if (!preparationRetry.isPending()) setConnection('offline', state.auth?.authenticated ? 'Private data paused' : 'Sign in');
       render();
-    }
+      // P-7 (WP-6 item 5): the boot API call did not reach this origin. A scheduled retry means the
+      // origin is answering (the runtime asked us to come back), so only an unreachable origin tries
+      // the other pool members. Nothing here blocks the local shell: the switch is a navigation.
+      if (!preparationRetry.isPending()) attemptPhonePoolFailover();
+    }
+    // AC-6e: if we arrived on a ?poolFrom=<id> hand-over, say who handed us over — over the shell, on
+    // every tab, whether or not the private lease came up.
+    showPhonePoolFromBanner();
     if ('serviceWorker' in navigator && !window.__CTM_MOBILE_TEST_DISABLE_SW) {
       registerMobileServiceWorker().catch(() => {});
     }
@@ -13993,6 +14464,28 @@
         itemsContext: state.skillPicker.itemsContext ? { ...state.skillPicker.itemsContext } : null,
       }),
       selectMobileSkillItemForTest: (index, control) => selectMobileSkillItem(index, control),
+      // WP-5 (S-11/S-16 AC-5a/AC-5c): the machine surfaces, so the phone spec can assert the same
+      // contract the desktop spec does — zero machines renders nothing, the create payload carries
+      // `machine`, and a remote row carries the chip.
+      loadMachines,
+      openNewSessionSheet,
+      createSession,
+      machineOptionsHtml: (machines, now) => phoneMachineOptionsHtml(machines, now),
+      machinePickerMode: (machines) => phoneMachinePickerMode(machines),
+      machineSearchSheetHtml: (machines, query, selectedId, now) => window.CtmPhoneMachines?.sheetListHtml?.(machines, query, selectedId, now) || '',
+      // WP-6: the Machines page itself now lives in public/m/machines.js (its presenters are exported
+      // there); this renders the page's list for a given registry, so the phone spec can still assert
+      // the card contract from the app realm without reaching into the module.
+      machinesCardHtml: (machines) => {
+        const surface = phoneMachines();
+        if (!surface) return '';
+        if (Array.isArray(machines)) surface.state.machines = machines.map((machine) => ({ ...machine }));
+        return surface.listHtml();
+      },
+      machineState: () => state.machines.map((machine) => ({ ...machine })),
+      sessionRowHtml: (card) => sessionRow(card),
+      sameRepoProject: (localProjects, localCwd, boxRows) => phoneSameRepoProject(localProjects, localCwd, boxRows),
+      machineChipHtml: (card) => phoneMachineChip(card),
     };
   }