create-walle 0.10.1 → 0.10.2

package/template/coding-task-manager/public/index.html

@@ -227,6 +227,7 @@
           <button class="nav-pill" data-nav="insights" onclick="navTo('insights');closeNavMore()" role="menuitem">Insights</button>
           <button class="nav-pill" data-nav="permissions" onclick="navTo('permissions');closeNavMore()" role="menuitem">Permissions</button>
           <button class="nav-pill" data-nav="worktrees" onclick="navTo('worktrees');closeNavMore()" role="menuitem">Worktrees</button>
+          <button class="nav-pill" data-nav="machines" onclick="navTo('machines');closeNavMore()" role="menuitem">Machines</button>
         </div>
       </div>
       <button class="nav-pill" data-nav="setup" onclick="navTo('setup')" title="Setup & Settings" style="margin-left:auto;font-size:16px;padding:4px 8px;">⚙</button>
@@ -593,6 +594,8 @@
           <div id="worktrees-filters" style="padding:10px 20px 0;border-bottom:1px solid var(--border);display:none;flex-wrap:wrap;gap:6px;background:var(--bg);"></div>
           <div id="worktrees-body" style="flex:1;overflow-y:auto;padding:16px 20px;"></div>
         </div>
+        <!-- Machines (WP-5 / D-14): rendered by js/app/machines-page.js; replaces the Settings tab. -->
+        <div id="machines-panel" style="display:none;flex-direction:column;height:100%;overflow:hidden;"></div>
         <div id="setup-panel">
           <div class="setup-header">
             <div style="display:flex;justify-content:space-between;align-items:baseline;">
@@ -1765,6 +1768,7 @@ url = "http://localhost:<span id="setup-mcp-port-display-toml">3457</span>/mcp"<
                   </div>
                 </div>
               </div>
+
               <!-- TAB: Backups -->
               <div class="setup-section" id="setup-section-backups" style="display:none;">
                 <div class="card" id="setup-backups">
@@ -2637,6 +2641,14 @@ url = "http://localhost:<span id="setup-mcp-port-display-toml">3457</span>/mcp"<
         <!-- Populated dynamically by showNewSessionModal() -->
       </div>
       <input type="hidden" id="ns-agent" value="claude:" />
+      <!-- WP-5 (S-11/AC-5a): machine cards, the agent grid's twin. Hidden with the hidden
+           input emptied when the hub has no machines, so the modal renders exactly as before. -->
+      <label id="ns-machine-label" style="display:none">Choose Machine</label>
+      <div id="ns-machine-grid" class="ns-agent-grid ns-machine-grid" style="display:none">
+        <!-- Populated dynamically by loadNewSessionMachines() -->
+      </div>
+      <input type="hidden" id="ns-machine" value="" />
+      <div id="ns-machine-hint" class="ns-machine-hint" style="display:none"></div>
       <label id="ns-cwd-label">Project Folder</label>
       <div class="ns-path-picker" id="ns-path-picker">
         <div class="ns-path-input-row">
@@ -2887,6 +2899,7 @@ url = "http://localhost:<span id="setup-mcp-port-display-toml">3457</span>/mcp"<
 <script src="js/terminal-queue-plan.js?v=__CTM_ASSET_EPOCH__"></script>
 <script src="js/prompt-submission-client.js?v=__CTM_ASSET_EPOCH__"></script>
 <script src="js/queue-panel-submission-reconcile.js?v=__CTM_ASSET_EPOCH__"></script>
+<script src="js/prompt-submission-tray.js?v=__CTM_ASSET_EPOCH__"></script>
 <script src="js/screenshot-router.js?v=__CTM_ASSET_EPOCH__"></script>
 <script src="js/upload-banner-state.js?v=__CTM_ASSET_EPOCH__"></script>
 <script src="js/standup-stale-followup.js?v=__CTM_ASSET_EPOCH__"></script>
@@ -2904,6 +2917,11 @@ url = "http://localhost:<span id="setup-mcp-port-display-toml">3457</span>/mcp"<
 <script src="js/app/models-provider-tls.js?v=__CTM_ASSET_EPOCH__"></script>
 <script src="js/app/backups-panel.js?v=__CTM_ASSET_EPOCH__"></script>
 <script src="js/app/worktrees-panel.js?v=__CTM_ASSET_EPOCH__"></script>
+<!-- WP-6: the ONE DOM-free machine-pool presenter copy (order, search text, groups, load line,
+     sparkline, pairing container). Loaded before the picker (js/core/session-commands.js) and the
+     Machines page (js/app/machines-page.js), both of which call into it and no longer define it. -->
+<script src="js/machine-pool-shared.js?v=__CTM_ASSET_EPOCH__"></script>
+<script src="js/app/machines-page.js?v=__CTM_ASSET_EPOCH__"></script>
 <script src="js/app/approvals-ui.js?v=__CTM_ASSET_EPOCH__"></script>
 <script src="js/app/restart-banner.js?v=__CTM_ASSET_EPOCH__"></script>
 <script src="js/background-work.js?v=__CTM_ASSET_EPOCH__"></script>
@@ -3600,6 +3618,7 @@ const state = window._ctmState = {
   ws: null,
   token: getCookie('ctm_token'),
   sessions: new Map(),   // id -> { term, fitAddon, container }
+  pendingCloseIds: new Map(), // id -> addedAtMs; cleared only by evidence (unlisted, intentional exit, kill error), no timer
   sessionScrollbackRows: {},
   activeTab: null,       // session id or 'rules'
   // Lifecycle WP-6 (delegated-worker-lifecycle-identity-observability-2026-09-27.html §5 D-3):
@@ -4441,7 +4460,25 @@ function _dispatchWebSocketMessage(msg) {
     case 'resume-prompt-result': onResumePromptResult(msg); break;
     case 'resume-blocked': onSessionResumeBlocked(msg); break;
     case 'resume-retry-noop': onResumeRetryNoop(msg); break;
-    case 'error': console.error('Server error:', msg.message); break;
+    case 'error': {
+      // WP-5 (§6.3/AC-5a): a machine-scoped failure (machine_unreachable, or the box's own code)
+      // is SHOWN — the user picks another machine or fixes the box. Never retried here, and every
+      // other error frame keeps its existing console-only path.
+      var _machineErr = /^machine_/.test(String(msg.code || '')) || !!msg.machine;
+      if (_machineErr && typeof toast === 'function') {
+        // One toast per machine id: a storm of the same box's failures never stacks.
+        toast(msg.message || msg.error || String(msg.code || 'Machine error'),
+          { type: 'error', title: 'Machine error', key: 'machine-error:' + String(msg.machine || msg.code || '') });
+      }
+      // D-7: the server refused THIS kill (e.g. owner_recovery_pending). Say so and drop the
+      // pending entry, so the next list brings the tab back truthfully instead of hiding it.
+      if (msg.id && state.pendingCloseIds.has(msg.id)) {
+        state.pendingCloseIds.delete(msg.id);
+        toast(msg.message || 'Could not close the session.', { type: 'error', key: 'kill-failed:' + msg.id });
+      }
+      console.error('Server error:', msg.message);
+      break;
+    }
     case 'analysis-progress': onAnalysisProgress(msg); break;
     case 'analysis-done': onAnalysisDone(msg); break;
     case 'queue-state': onQueueState(msg); break;
@@ -5600,90 +5637,63 @@ function _promptTrayClearanceBottomPx(viewportHeight, inputStackTop) {
 // ".walle-input-stack" today (no MutationObserver wired to it), so a TTL is
 // the fallback staleness bound; forceRecompute lets a known-authoritative
 // caller (resize) always get a fresh read.
-const _promptTrayAnchorCache = { atMs: 0, inputStackTop: 0 };
+const _promptTrayAnchorCache = { atMs: 0, inputStackTop: 0, queuePanelOpen: null };
 const _promptTrayAnchorCacheTtlMs = 2000;
 
 function _positionPromptSubmissionTray(tray, opts) {
   const now = Date.now();
+  const queuePanelOpen = window._ctmState?.queuePanelOpen === true;
   const stale = !_promptTrayAnchorCache.atMs || (now - _promptTrayAnchorCache.atMs) > _promptTrayAnchorCacheTtlMs;
-  if ((opts && opts.forceRecompute) || stale) {
+  if ((opts && opts.forceRecompute) || stale || _promptTrayAnchorCache.queuePanelOpen !== queuePanelOpen) {
     let inputStackTop = 0;
-    for (const stack of document.querySelectorAll('.walle-input-stack')) {
+    for (const stack of document.querySelectorAll('.walle-input-stack, #qp-bottom')) {
       if (!stack.offsetParent) continue;
       const rect = stack.getBoundingClientRect();
       if (rect.height > 0 && (!inputStackTop || rect.top < inputStackTop)) inputStackTop = rect.top;
     }
-    _promptTrayAnchorCache.inputStackTop = inputStackTop;
-    _promptTrayAnchorCache.atMs = now;
+    Object.assign(_promptTrayAnchorCache, { inputStackTop, atMs: now, queuePanelOpen });
   }
   tray.style.bottom = _promptTrayClearanceBottomPx(window.innerHeight, _promptTrayAnchorCache.inputStackTop) + 'px';
 }
 
+// WP-1 (C2, design §6 + docs/queue-delivery-recovery-evidence-2026-10-23.html §6 "WP-1 boundary
+// update"): the tray renderer itself now lives in public/js/prompt-submission-tray.js — index.html
+// sits at its file-size ceiling, so only the renderer moved. The three dependencies that can only
+// exist here (the tray element, its composer clearance, and the owner-fenced recovery route) are
+// passed in explicitly; the module owns no globals and no queue state of its own.
 function _renderPromptSubmissionStatus(record) {
-  const tray = _ensurePromptSubmissionTray();
-  _positionPromptSubmissionTray(tray);
-  let row = document.getElementById('prompt-submission-' + record.clientMessageId);
-  if (!row) {
-    row = document.createElement('div');
-    row.id = 'prompt-submission-' + record.clientMessageId;
-    row.style.cssText = 'display:flex;align-items:center;gap:8px;padding:9px 10px;border:1px solid var(--border);border-radius:6px;background:var(--bg-secondary);box-shadow:0 6px 20px rgba(0,0,0,.28);font-size:12px;color:var(--text-primary)';
-    tray.appendChild(row);
-  }
-  // Quiet happy path (user feedback 2026-08-20: stacked "Sending prompt..." rows sat over the
-  // composer for a whole 21-min turn saying nothing). The tray's real job is the FAILURE lane —
-  // Retry/Restore when a prompt would otherwise be silently lost — so pending/queued rows stay
-  // hidden unless a prompt is still unacknowledged after 5s, a 'sent' that was never shown
-  // dismisses without the "Prompt sent" flash, and a user-hidden quiet row stays hidden until
-  // its status escalates to a failure (loss protection always wins over the quieting).
-  const quietStatus = record.status === 'pending' || record.status === 'queued';
-  if (!quietStatus && row.dataset.hiddenByUser === '1') delete row.dataset.hiddenByUser;
-  if (quietStatus) {
-    if (!row.dataset.quietRevealAt) {
-      row.dataset.quietRevealAt = String(Date.now() + 5000);
-      row.style.display = 'none';
-      setTimeout(() => {
-        const live = document.getElementById('prompt-submission-' + record.clientMessageId);
-        if (live && live.dataset.quietRevealAt && live.dataset.hiddenByUser !== '1') live.style.display = 'flex';
-      }, 5000);
-    } else if (row.dataset.hiddenByUser === '1' || Date.now() < Number(row.dataset.quietRevealAt)) {
-      row.style.display = 'none';
-    } else {
-      row.style.display = 'flex';
-    }
-  } else if (record.status === 'sent' && row.style.display === 'none') {
-    row.remove();
-    setTimeout(() => window.CTMPromptSubmission.dismiss(record.clientMessageId), 0);
-    return;
-  } else {
-    delete row.dataset.quietRevealAt;
-    row.style.display = 'flex';
-  }
-  row.textContent = '';
-  const label = document.createElement('span');
-  label.style.flex = '1';
-  label.textContent = record.status === 'pending' ? 'Sending prompt...' : record.status === 'sent' ? 'Prompt sent' : (record.message || 'Prompt needs attention');
-  row.appendChild(label);
-  if (record.status === 'needs_attention' || record.status === 'blocked' || record.status === 'failed') {
-    const retry = document.createElement('button');
-    retry.className = 'btn small'; retry.textContent = 'Retry';
-    retry.onclick = () => window.CTMPromptSubmission.retry(record.clientMessageId);
-    row.appendChild(retry);
-  }
-  if (record.status !== 'pending' && record.status !== 'queued') {
-    const dismiss = document.createElement('button');
-    dismiss.className = 'btn small'; dismiss.textContent = 'Dismiss';
-    dismiss.onclick = () => window.CTMPromptSubmission.dismiss(record.clientMessageId);
-    row.appendChild(dismiss);
-    if (record.status === 'sent') setTimeout(() => window.CTMPromptSubmission.dismiss(record.clientMessageId), 2200);
-  } else {
-    // Quiet rows get a HIDE-ONLY dismiss — never CTMPromptOutbox.dismiss here, that would drop
-    // the durable retry record while the prompt is still in flight. The row (and its tracking)
-    // stays; only the pixels go, and a failure escalation clears hiddenByUser above.
-    const hide = document.createElement('button');
-    hide.className = 'btn small'; hide.textContent = 'Dismiss';
-    hide.onclick = () => { row.dataset.hiddenByUser = '1'; row.style.display = 'none'; };
-    row.appendChild(hide);
-  }
+  if (!window.PromptSubmissionTray) return null;
+  return window.PromptSubmissionTray.renderStatus(record, {
+    document,
+    ensureTray: _ensurePromptSubmissionTray,
+    positionTray: _positionPromptSubmissionTray,
+    getManager: () => window.CTMPromptSubmission,
+    onRecovery: _recoverPromptSubmission,
+    setTimer: (callback, delayMs) => setTimeout(callback, delayMs),
+    now: () => Date.now(),
+  });
+}
+
+// C2/C3 (R6, AC-1d/AC-1e, AC-1f): the tray's recovery gesture is routed by the queue module, which
+// owns the exact-item matching and the one-gesture-at-a-time rule; the page supplies its own state
+// and the owner-fenced resendQpItem, and never mints an identity here.
+function _recoverPromptSubmission(action, record, options = {}) {
+  return window.QueuePanelSubmissionReconcile.routeTrayRecovery(action, record, options, {
+    getSessionId: () => qpCurrentSession, getItems: () => qpItems, resendItem: resendQpItem,
+    getManager: () => window.CTMPromptSubmission,
+  });
+}
+
+// WP-1 (C4, R7/AC-1e): the review surface for a queue item whose last outcome is uncertain. The
+// record and its lifetime guard live in the reconcile module and the row itself in the tray module;
+// the page supplies its own state plus the owner-fenced resend route behind the confirmation, and
+// never mints an identity here.
+function _reviewQpItems(items, canNotify) {
+  return window.QueuePanelSubmissionReconcile.openItemReview(items, {
+    getItems: () => qpItems, getSessionId: () => qpCurrentSession, getManager: () => window.CTMPromptSubmission,
+    notify: message => canNotify && toast('Delivery unconfirmed — review this item before sending again. ' + message, { type: 'warning', key: 'qp-review:' + qpCurrentSession }),
+    renderReview: (record, isCurrent) => window.PromptSubmissionTray.renderItemReview(record, { document, ensureTray: _ensurePromptSubmissionTray, positionTray: _positionPromptSubmissionTray, getManager: () => window.CTMPromptSubmission, isCurrent, onRecovery: _recoverPromptSubmission }),
+  });
 }
 
 // S-16/S-17/D-12/D-16: the tray is no longer a status ghost for every outbox row of every
@@ -12072,34 +12082,22 @@ function createTerminal(id, opts) {
     return intent;
   }
 
-  async function _terminalDeleteServerDraft(id, attachment, options = {}) {
-    if (attachment && !attachment.attachmentId && options.cancelRequest && attachment.clientId) {
-      // Upload cancelled before the 201 arrived: cancel the server-side create by its request id.
-      const cancel = await _terminalFetchWithRetry('/api/sessions/' + encodeURIComponent(id) + '/image-drafts?request_id=' +
-        encodeURIComponent(attachment.clientId) + '&purge=1&token=' + encodeURIComponent(state.token || ''), { method: 'DELETE' }, { attempts: 3 });
-      if (!cancel.ok && cancel.status !== 404) throw new Error('HTTP ' + cancel.status);
-      return true;
-    }
-    if (!attachment || !attachment.attachmentId) return true;
-    const headers = attachment.etag ? { 'If-Match': attachment.etag } : {};
-    const response = await _terminalFetchWithRetry('/api/sessions/' + encodeURIComponent(id) + '/image-drafts/' +
-      encodeURIComponent(attachment.attachmentId) + '?token=' + encodeURIComponent(state.token || '') +
-      (options.purge === true ? '&purge=1' : ''), {
-      method: 'DELETE', headers,
-    }, { attempts: 3 });
-    if (!response.ok && response.status !== 404) throw new Error('HTTP ' + response.status);
-    return true;
-  }
-
   async function _terminalRemoveDraftAttachment(id, attachment, metricEvent, options = {}) {
     const Draft = window.TerminalAttachmentDraft;
     const draft = _terminalAttachmentDraftState(id);
     if (!Draft || !draft || !attachment || !draft.attachments.includes(attachment)) return false;
+    const owned = _terminalDraftUploadOwnership(id);
+    const current = () => Boolean(owned.lifetime && owned.lifetime === _terminalRootDraftLifetime
+      && !owned.reason && owned.context && owned.context.draft === draft
+      && owned.lifetime.attachmentCurrent(owned.context, id, draft, attachment));
+    if (!current()) return false;
     clearTimeout(attachment._unconfirmedReconcileTimer);
     attachment._unconfirmedReconcileTimer = null;
     try {
-      await _terminalDeleteServerDraft(id, attachment, options);
+      if (!await _terminalDeleteServerDraft(id, attachment, options,
+        { context: owned.context, isCurrent: current }) || !current()) return false;
     } catch (error) {
+      if (!current()) return false;
       console.warn('[terminal-image] draft cleanup failed:', error && error.message ? error.message : error);
       _terminalAttachmentMetric(id, 'provider_delete_cleanup_failed', { attachmentCount: draft.attachments.length });
       _terminalRenderAttachmentDraft(id);
@@ -12119,10 +12117,13 @@ function createTerminal(id, opts) {
     if (action === 'disabled' || !action) return false;
     if (action === 'cancel') return _terminalCancelAttachmentUpload(id, attachment);
     const metric = action === 'detach' ? 'attached_detached_by_user' : 'chip_dismissed_by_user';
+    const owned = _terminalDraftUploadOwnership(id);
     const removed = _terminalRemoveDraftAttachment(id, attachment, metric);
     if (action === 'detach') {
       void Promise.resolve(removed).then(didRemove => {
         if (!didRemove || typeof toast !== 'function') return;
+        if (!owned.context || owned.lifetime !== _terminalRootDraftLifetime || owned.context.draft !== draft
+          || owned.lifetime.current(owned.context) !== true) return;
         toast((attachment.label || 'Image token') + ' text remains in the composer - delete it there too.', {
           type: 'info', duration: 4200,
         });
@@ -12141,8 +12142,9 @@ function createTerminal(id, opts) {
     return target ? String(target.dataset.attachmentId || '') : '';
   }
 
-  function _terminalFocusAfterAttachmentDismiss(id, adjacentClientId, dismissed) {
+  function _terminalFocusAfterAttachmentDismiss(id, adjacentClientId, dismissed, context) {
     if (!dismissed || !adjacentClientId) return;
+    if (!context || context.id !== id || _terminalRootDraftLifetime?.capture(id, context.session, context.draft) !== context) return;
     const region = document.getElementById('tray-chip-region');
     if (!region || region.dataset.sessionId !== id) return;
     const target = Array.from(region.querySelectorAll('.terminal-attachment-chip'))
@@ -12377,8 +12379,7 @@ function createTerminal(id, opts) {
   function _terminalCancelAttachmentUpload(id, attachment) {
     if (!attachment || (attachment.status !== 'uploading' && attachment.status !== 'materializing')) return false;
     try { attachment._uploadAbortController?.abort(); } catch {}
-    void _terminalRemoveDraftAttachment(id, attachment, 'upload_cancelled', { purge: true, cancelRequest: true });
-    return true;
+    return _terminalRemoveDraftAttachment(id, attachment, 'upload_cancelled', { purge: true, cancelRequest: true });
   }
 
   // image-attach-latency-redesign F2: with the server reconciler on, retrying a failed draft
@@ -12560,6 +12561,8 @@ function createTerminal(id, opts) {
       return;
     }
     region.replaceChildren();
+    const focusOwned = _terminalDraftUploadOwnership(id);
+    const focusContext = !focusOwned.reason && focusOwned.context?.draft === draft ? focusOwned.context : null;
     for (const attachment of draft.attachments) {
       const chip = document.createElement('div');
       chip.className = 'terminal-attachment-chip tray-attachment-chip';
@@ -12634,7 +12637,7 @@ function createTerminal(id, opts) {
           const adjacentClientId = _terminalAdjacentAttachmentClientId(id, attachment);
           const dismissed = _terminalDismissAttachment(id, attachment);
           void Promise.resolve(dismissed).then(result => {
-            _terminalFocusAfterAttachmentDismiss(id, adjacentClientId, result);
+            _terminalFocusAfterAttachmentDismiss(id, adjacentClientId, result, focusContext);
           });
         }
       };
@@ -13323,16 +13326,22 @@ function createTerminal(id, opts) {
     const failed = draft.attachments.filter(attachment => attachment && attachment.status === 'failed');
     if (!failed.length) return [];
 
+    const owned = _terminalDraftUploadOwnership(id);
+    const current = () => Boolean(owned.lifetime && owned.lifetime === _terminalRootDraftLifetime
+      && !owned.reason && owned.context?.draft === draft && owned.lifetime.current(owned.context));
     const removed = [];
     for (const attachment of failed) {
+      if (!current()) break;
       if (!Draft.removeAttachment(draft, attachment.clientId)) continue;
       removed.push(attachment);
       _terminalReleaseAttachmentUploadSource(attachment);
       await _terminalDeleteServerDraft(id, attachment).catch(error => {
+        if (!current()) return;
         console.warn('[terminal-image] failed draft cleanup after send failed:', error && error.message ? error.message : error);
         _terminalAttachmentMetric(id, 'failed_draft_cleanup_failed', { attachmentCount: removed.length });
       });
     }
+    if (!current()) return removed;
     _terminalRenderAttachmentDraft(id);
     _terminalAttachmentMetric(id, 'failed_drafts_discarded_on_send', { attachmentCount: removed.length });
     if (options.userAuthorized === true) {
@@ -13865,12 +13874,13 @@ function createTerminal(id, opts) {
     const providerOrderBase = draft.attachments.reduce((max, item) => (
       Math.max(max, Number(item._providerOrdinal || item.providerOrder || 0))
     ), 0);
+    const stagedOwnerHostId = _terminalAttachmentOwnerHostId(state.sessions.get(id));   // R-1: the id the server stamps
     const staged = files.map((file, index) => {
       const providerOrder = providerOrderBase + index + 1;
       const attachment = Draft.addUploading(draft, {
         clientId: _terminalAttachmentClientId(),
         filename: file.name || ('clipboard-image-' + (index + 1) + '.png'),
-        ownerHostId: _terminalAttachmentCurrentHostId(),
+        ownerHostId: stagedOwnerHostId,
       });
       attachment._promptOffset = promptOffset;
       attachment._promptOrder = index;
@@ -13930,7 +13940,7 @@ function createTerminal(id, opts) {
           // is adopted here instead of being rendered as an intermediate 'ready' first. Only a
           // row with no reservation (or no retained publication) takes the legacy transition.
           const outcome = _terminalFinishAttachmentUpload(id, attachment, uploaded);   // WP-3 §6: adopt or legacy ready
-          if (outcome.outcome === 'rejected') return;
+          if (outcome.outcome === 'rejected') return void _terminalRejectedUploadOutcome(id, attachment, outcome, { metric: _terminalAttachmentMetric, postDiagnostic: _terminalPostAttachmentDiagnostic });   // R-4: fails visibly, never silently
           // image-attach-latency-redesign WP-1: with the server reconciler on, do not race a
           // second PTY paste against it here -- the reconciler already got a nudge from this
           // draft's server-side 'create' op and owns delivering it. readyCount here only
@@ -14387,12 +14397,13 @@ function createTerminal(id, opts) {
         // the CONTINUOUS reader on THIS tick -- no mouse report is built/sent (AC-8d).
         // WP-2 (D-4): px = |deltaY| in px per deltaMode -- the live terminal lands that far below the pane top.
         if (decision.action === 'reader-enter') {
-          const px = _wheelDeltaPx(e, term); wheelRecorder.noteEvent({ deltaPx: px, deltaMode: e.deltaMode, steps: 0 });
+          if (writer._wheelSender && writer._wheelSender.cancel) writer._wheelSender.cancel(); const px = _wheelDeltaPx(e, term); wheelRecorder.noteEvent({ deltaPx: px, deltaMode: e.deltaMode, steps: 0 });
           _enterContinuousForSession(id, px);
           e.preventDefault();
           e.stopPropagation();
           return;
         }
+        if (decision.action === 'swallow') { e.preventDefault(); e.stopPropagation(); return; } // D-4: a Codex app view's wheel-down is CTM's, never the PTY's
         if (decision.shouldForward) {
           let cw = 0, ch = 0;
           try { const d = term._core._renderService.dimensions.css.cell; cw = d.width; ch = d.height; } catch {}
@@ -14428,7 +14439,7 @@ function createTerminal(id, opts) {
           e.stopPropagation();
           return;
         }
-      } catch (error) {
+      } catch (error) { e.preventDefault(); e.stopPropagation();
         send({
           type: 'client-diag', id, event: 'terminal-wheel-forward-error',
           details: { message: String(error && error.message || error).slice(0, 160) },
@@ -14441,7 +14452,7 @@ function createTerminal(id, opts) {
         if (wheelDecisionForDiag) {
           if (wheelDecisionForDiag.action === 'reader') wheelRecorder.noteEvent({ deltaPx: _wheelDeltaPx(e, term), deltaMode: e.deltaMode, steps: 0, route: 'reader' }); // D-15: reader-open events
           wheelRecorder.record(wheelDecisionForDiag.route, {
-            bufferType: buf.type, baseY: buf.baseY,
+            bufferType: buf.type, baseY: buf.baseY, deltaY: e.deltaY, action: wheelDecisionForDiag.action,
             appMouse: wheelDecisionForDiag.mouseActive, isAlt: wheelDecisionForDiag.isAlt,
             mouseSource: wheelDecisionForDiag.mouseState && wheelDecisionForDiag.mouseState.source, frameTracking: wheelDecisionForDiag.frameTracking,
           });
@@ -17024,14 +17035,15 @@ function _showWarmSessionShell(id) {
   for (const panelId of [
     'rules-panel', 'review-panel', 'codereview-panel', 'insights-panel',
     'permissions-panel', 'prompts-panel', 'walle-panel', 'models-panel',
-    'backups-panel', 'worktrees-panel', 'setup-panel',
+    'backups-panel', 'worktrees-panel', 'machines-panel', 'setup-panel',
   ]) {
     const panel = document.getElementById(panelId);
     panel?.classList?.remove('active');
-    if (panel && ['models-panel', 'backups-panel', 'worktrees-panel', 'setup-panel'].includes(panelId)) {
+    if (panel && ['models-panel', 'backups-panel', 'worktrees-panel', 'machines-panel', 'setup-panel'].includes(panelId)) {
       panel.style.display = 'none';
     }
   }
+  if (typeof machinesPanelHidden === 'function') machinesPanelHidden();
   const sidebar = document.getElementById('sidebar');
   const sidebarResize = document.getElementById('sidebar-resize');
   if (!state.sidebarManuallyHidden) {
@@ -17143,7 +17155,7 @@ function _prepareSurfaceResume(id) {
   const previousId = state.activeTab;
   const switchingTabs = previousId !== id;
   const session = state.sessions.get(id);
-  const isPanel = ['rules', 'insights', 'permissions', 'prompts', 'codereview', 'walle', 'models', 'worktrees', 'setup'].includes(id);
+  const isPanel = ['rules', 'insights', 'permissions', 'prompts', 'codereview', 'walle', 'models', 'worktrees', 'machines', 'setup'].includes(id);
   const wakeDirtyEvent = session?._wakeStreamDirty;
   if (wakeDirtyEvent) {
     session._wakeStreamDirty = false;
@@ -17355,6 +17367,7 @@ function _commitSurfaceVisibility(id, isPanel, wasSubscribedBeforeActivation) {
   if (bkp) { bkp.classList.remove('active'); bkp.style.display = 'none'; }
   var wtp = document.getElementById('worktrees-panel');
   if (wtp) { wtp.classList.remove('active'); wtp.style.display = 'none'; }
+  var mcp = document.getElementById('machines-panel'); if (mcp) { mcp.classList.remove('active'); mcp.style.display = 'none'; } if (typeof machinesPanelHidden === 'function') machinesPanelHidden();
   var stp = document.getElementById('setup-panel');
   if (stp) { stp.classList.remove('active'); stp.style.display = 'none'; }
   state.activeTab = id;
@@ -17467,6 +17480,10 @@ if (id === 'rules') {
   wtp.style.display = 'flex';
   wtp.classList.add('active');
   loadWorktreesPanel();
+} else if (id === 'machines') {
+  var mcp = document.getElementById('machines-panel');
+  mcp.style.display = 'flex'; mcp.classList.add('active');
+  loadMachinesPanel();
 } else if (id === 'setup') {
   var sp = document.getElementById('setup-panel');
   sp.style.display = 'flex';
@@ -17725,7 +17742,7 @@ function activateTab(id) {
 
 function syncNavPills(activeId) {
   const navPills = document.querySelectorAll('#topbar-nav .nav-pill');
-  const specialPanels = ['rules', 'insights', 'permissions', 'prompts', 'codereview', 'walle', 'models', 'backups', 'worktrees', 'setup'];
+  const specialPanels = ['rules', 'insights', 'permissions', 'prompts', 'codereview', 'walle', 'models', 'backups', 'worktrees', 'machines', 'setup'];
   const navId = specialPanels.includes(activeId) ? activeId : 'sessions';
   navPills.forEach(pill => {
     pill.classList.toggle('active', pill.dataset.nav === navId);
@@ -18421,10 +18438,10 @@ function showStandupDashboard(opts) {
     const el = document.getElementById(id);
     if (el) el.classList.remove('active');
   });
-  ['models-panel', 'backups-panel', 'worktrees-panel', 'setup-panel'].forEach(id => {
+  ['models-panel', 'backups-panel', 'worktrees-panel', 'machines-panel', 'setup-panel'].forEach(id => {
     const el = document.getElementById(id);
     if (el) { el.classList.remove('active'); el.style.display = 'none'; }
-  });
+  }); if (typeof machinesPanelHidden === 'function') machinesPanelHidden();
 
   state.activeTab = SESSIONS_OVERVIEW_TAB_ID;
   _projectSessionListSelection(SESSIONS_OVERVIEW_TAB_ID);
@@ -18828,6 +18845,9 @@ function renderStandupCard(card, opts) {
   opts = opts || {};
   const tokens = opts.tokens || [];
   const providerBadge = renderStandupProviderBadge(card);
+  // WP-5 (§6.6/S-14): the standup card carries the same chip. '' for a local session (and for a
+  // catalog that predates the hub — the presenter tolerates the missing fields).
+  const machineChip = machineChipHtml(card);
   const subtitle = [card.agent, card.model, card.branch].filter(Boolean).join(' / ');
   const goal = standupCleanGoalText(card.goal || card.intent || '');
   const progress = card.progressSummary || card.progress || '';
@@ -18847,6 +18867,7 @@ function renderStandupCard(card, opts) {
           <div class="standup-card-title">${titleHtml}</div>
           <div class="standup-card-meta" title="${standupEsc(subtitle || card.cwd || '')}">
             ${providerBadge}
+            ${machineChip}
             <div class="standup-card-subtitle">${standupEsc(subtitle || card.cwd || '')}</div>
           </div>
         </div>
@@ -19043,6 +19064,8 @@ function navTo(target, opts) {
     showSetupPanel();
   } else if (target === 'worktrees') {
     showWorktreesPanel();
+  } else if (target === 'machines') {
+    showMachinesPanel(opts || {});
   }
 }
 
@@ -22778,19 +22801,19 @@ function onSnapshot(msg) {
   const dimsMismatch = gridMismatchDecision.mismatch;
   if (dimsMismatch) {
     const manualReflowSnapshot = restoreSource === 'reflow';
-    if (gridMismatchDecision.action === 'apply-authoritative') {
-      // Serialized xterm snapshots are grid-relative. Final-exit and manual
-      // reflow snapshots are user-authoritative recovery frames, so replay them
-      // at the captured PTY grid instead of throwing them away after a local
-      // fit drift. Activation/cache snapshots can still be discarded and
-      // re-requested at local dimensions.
-      try {
-        if (ptyCols > 0 && ptyRows > 0 && (s.term.cols !== ptyCols || s.term.rows !== ptyRows)) {
-          _runTerminalMutation(s, 'authoritative-snapshot-resize', () => s.term.resize(ptyCols, ptyRows));
-          if (finalExitSnapshot) s._lastFinalExitSnapshotResizeAt = Date.now();
-          if (manualReflowSnapshot) s._lastManualReflowSnapshotResizeAt = Date.now();
-        }
-      } catch {}
+    // Serialized xterm snapshots are grid-relative. Final-exit and manual reflow snapshots are
+    // user-authoritative recovery frames, so replay them at the captured PTY grid instead of
+    // throwing them away after a local fit drift. Activation/cache snapshots can still be
+    // discarded and re-requested at local dimensions.
+    // WP-1 (D-1): adopting that grid is all-or-nothing. A grid the cols-pin chokepoint refused
+    // is NOT replayed at the landed hybrid -- it takes the mismatch branch below (resync the
+    // server to our dims, request a fresh frame), which is the recovery this path already had.
+    const adoptAuthoritative = ptyCols > 0 && ptyRows > 0
+      && gridMismatchDecision.action === 'apply-authoritative'
+      && _adoptTerminalGrid(s, ptyCols, ptyRows, 'authoritative-snapshot-resize');
+    if (adoptAuthoritative) {
+      if (finalExitSnapshot) s._lastFinalExitSnapshotResizeAt = Date.now();
+      if (manualReflowSnapshot) s._lastManualReflowSnapshotResizeAt = Date.now();
     } else {
       // Non-interim, non-authoritative snapshot at a foreign grid: the client
       // resized after requesting. Do NOT replay foreign-width data. Resync the
@@ -23280,6 +23303,13 @@ function _showLoadingOverlay(s, opts) {
 }
 const DISMISS_AUTHORITIES = new Set(['activation-ready', 'degraded', 'user', 'reconcile']); // R5 §6.4: replaces {authoritative:true}; only 'reconcile' is vetoable (I-9: veto is a no-op, NEVER _showLoadingOverlay)
 function _loadingOverlayDismissAuthority(opts) { return (opts && DISMISS_AUTHORITIES.has(opts.authority)) ? opts.authority : (opts && opts.authoritative === true ? 'activation-ready' : 'reconcile'); }
+// WP-4a (§5 OQ-4, §6): record which exit ran and the store lifecycle it saw, on the session, so the
+// next stranded cover can be attributed (H-A store missing/active while mounted, H-B resume-blocked
+// held, H-C no dismissal ran) without a per-call beacon. Instrumentation only: no exit changes.
+function _recordOverlayDismiss(s, authority, exit) {
+  if (!s) return;
+  s._lastOverlayDismiss = { authority, exit, lifecycle: _presentationStore.getSessionState(_resumeClientSessionId(s))?.lifecycle ?? null, at: Date.now() };
+}
 function _dismissLoadingOverlay(s, opts) {
   opts = opts || {}; const authority = _loadingOverlayDismissAuthority(opts);
   // WI-1: keep the corner chip in sync on every dismiss checkpoint (this function is called from
@@ -23294,16 +23324,19 @@ function _dismissLoadingOverlay(s, opts) {
   // "session-restore-started" means the PTY exists, not that the visible page is ready.
   if (s && authority === 'reconcile') {
     const rs = _resumeStateForSession(s);
-    if (rs && rs.dismissBlocked) return { vetoed: true }; // I-9: never _showLoadingOverlay here.
+    if (rs && rs.dismissBlocked) { _recordOverlayDismiss(s, authority, 'vetoed-dismiss-blocked'); return { vetoed: true }; } // I-9: never _showLoadingOverlay here.
   }
   // A resume-blocked card is a terminal recovery state, not a loading cover. Readiness and
   // lifecycle handlers share this DOM shell, but they do not own the card and must not erase its
   // diagnosis/actions. Retry and the server's explicit blocked=false projection clear it.
-  if (_presentationStore.getSessionState(_resumeClientSessionId(s))?.lifecycle === 'resume-blocked'
-      && opts.clearResumeBlocked !== true) return;
+  const lifecycle = _presentationStore.getSessionState(_resumeClientSessionId(s))?.lifecycle ?? null;
+  if (lifecycle === 'resume-blocked' && opts.clearResumeBlocked !== true) { _recordOverlayDismiss(s, authority, 'resume-blocked-held'); return; }
   if (s._loadingOverlayTimer) { clearTimeout(s._loadingOverlayTimer); s._loadingOverlayTimer = null; }
   s._resumeLoadStartedAt = 0;
-  if (!s.container) return;
+  if (!s.container) { _recordOverlayDismiss(s, authority, 'no-container'); return; }
+  // The store keeps ONE lifecycle per session, and _clearSessionLifecycle only writes the family it
+  // owns; naming that mismatch here is what separates a silent no-op clear from a real one.
+  _recordOverlayDismiss(s, authority, LIFECYCLE_COVER_FAMILY[lifecycle] === 'restore' ? 'cleared' : 'not-restore-family');
   _clearSessionLifecycle(s, 'restore');
   s._loadingOverlayShownAt = 0;
 }
@@ -23311,6 +23344,9 @@ function _dismissLoadingOverlay(s, opts) {
 
 
 function onExit(msg) {
+  // D-7: an intentional exit is the server confirming the close. It must clear the pending entry
+  // BEFORE the early return below — killSession already removed the tab, so there is no `s`.
+  if (msg.intentional === true) state.pendingCloseIds.delete(msg.id);
   const s = state.sessions.get(msg.id);
   if (!s) return;
   // S-19 (terminal-sync-adopted-restart-race-2026-09-07.html §9 S-19): an exited session
@@ -24007,72 +24043,6 @@ function onSessionRestoreFailed(msg) {
   );
 }
 
-// WI-5: cause-specific, non-alarming copy for the enumerated deterministic resume_blocked reason
-// codes the server can send (see server.js markSessionResumeBlocked / _notifyResumePreflightFailure).
-// Branch ONLY on `msg.code` here — never on message text — so this stays correct even if the
-// human-readable message wording changes server-side. An unrecognized code (contract drift, or a
-// code we haven't special-cased yet) falls back to the same honest red failure banner
-// onSessionRestoreFailed already renders, rather than inventing false calm.
-const RESUME_BLOCKED_COPY = {
-  missing_claude_transcript: {
-    tone: 'info',
-    title: "This session's transcript is gone from this machine.",
-    body: 'The file was removed before CTM stored any of its prompts (Claude Code deletes transcripts older than '
-      + 'its retention period, 30 days by default). There is nothing to resume; start a fresh session in the same folder.',
-  },
-  missing_codex_rollout: {
-    tone: 'info',
-    title: "This session's transcript is gone from this machine.",
-    body: 'The file was removed before CTM stored any of its prompts. There is nothing to resume; '
-      + 'start a fresh session in the same folder.',
-  },
-  agent_cli_not_found: {
-    tone: 'warn',
-    title: 'The agent CLI isn’t available on this host.',
-    body: 'CTM could not find the CLI needed to resume this session on this machine. '
-      + 'Install it (or fix PATH), then reload — or start fresh here.',
-  },
-  resume_exit_loop: {
-    tone: 'warn',
-    title: 'This session could not finish resuming.',
-    body: '',
-  },
-  resume_no_frame: {
-    tone: 'warn',
-    title: 'The session never painted a usable screen.',
-    body: '',
-  },
-  resume_no_output: {
-    tone: 'warn',
-    title: 'The agent did not respond while resuming.',
-    body: 'It may be waiting on authentication, blocked by configuration, or unavailable on this host.',
-  },
-  // Mixed-version compatibility: current servers normalize this internal
-  // lifecycle reason to resume_no_output before it reaches the browser.
-  no_provider_output: {
-    tone: 'warn',
-    title: 'The agent did not respond while resuming.',
-    body: 'It may be waiting on authentication, blocked by configuration, or unavailable on this host.',
-  },
-  // Compatibility for a server from before the resume lifecycle became provider-neutral.
-  codex_no_output: {
-    tone: 'warn',
-    title: 'Codex did not respond while resuming.',
-    body: 'It may be waiting on authentication, blocked by configuration, or unavailable on this host.',
-  },
-  restore_retries_exhausted: {
-    tone: 'warn',
-    title: 'CTM could not prepare this session after several tries.',
-    body: 'The launch planner kept timing out. Retry now, or start fresh here.',
-  },
-};
-
-
-
-
-
-
-
 // Render (or reuse) the same DOM overlay shell used for the codex resume-loading spinner, but as
 // a STATIC informational/warning card — no spinner, no progress bar, no red "failed" styling
 // (WI-5: the cross-host case is expected, not an error). Returns false for an unrecognized code
@@ -24426,6 +24396,9 @@ async function onSessionsList(msg, options = {}) {
 
   // Add tabs for sessions we don't have terminals for (reconnect scenario)
   for (const sess of msg.sessions) {
+    // D-7: a close we already sent wins over any list that still carries the id — otherwise this
+    // loop re-creates the stub and re-pushes tabOrder, and the tab the user just closed returns.
+    if (state.pendingCloseIds.has(sess.id)) continue;
     const incomingLiveStatus = sess && sess.liveStatus;
     const hasIncomingLiveStatus = incomingLiveStatus !== undefined && incomingLiveStatus !== null && incomingLiveStatus !== '';
     const existingBeforeShape = state.sessions.get(sess.id);
@@ -24601,6 +24574,9 @@ async function onSessionsList(msg, options = {}) {
             lastSeenAt: sess.resumeBlockedLastSeenAt || '',
             trashPath: sess.resumeBlockedTrashPath || '',
             originalPath: sess.resumeBlockedOriginalPath || '',
+            // WP-3 (D-13): why the copy is in CTM's trash and when — the card's "why" sentence.
+            trashReason: sess.resumeBlockedTrashReason || '',
+            trashedAt: sess.resumeBlockedTrashedAt || '',
             // WP-6: the resume ladder's answer for the missing-transcript card.
             resumeRung: sess.resumeBlockedRung || '',
             coverage: sess.resumeBlockedCoverage || null,
@@ -24650,15 +24626,23 @@ async function onSessionsList(msg, options = {}) {
               deterministic: false,
             });
           }
-        } else if (existing._resumeBlocked && existing._resumeCheckPending !== true) {
+        } else if (existing._resumeCheckPending !== true) {
           // A pending Check again is not a clear: its answer (resume-blocked / resume-retry-noop / restore-started) arrives on its own.
-          existing._resumeBlocked = false;
-          existing._resumeBlockedRung = '';
-          existing._resumeBlockedCode = '';
-          existing._resumeBlockedMessage = '';
-          existing._resumeBlockedDetail = '';
-          existing._resumeBlockedAttempts = 0;
-          // Leave only a resume-blocked lifecycle: a loading cover (a Retry in flight) is not this tick's to clear.
+          if (existing._resumeBlocked) {
+            existing._resumeBlocked = false;
+            existing._resumeBlockedRung = '';
+            existing._resumeBlockedCode = '';
+            existing._resumeBlockedMessage = '';
+            existing._resumeBlockedDetail = '';
+            existing._resumeBlockedAttempts = 0;
+          }
+          // WP-4c (session-exit-close-truth-2026-10-24.html §5 OQ-4 = H-B, §8 WP-4c): the server's
+          // resumeBlocked:false is the authority for a SERVER-owned block, and it must clear a
+          // resume-blocked store lifecycle even when THIS client object never saw the flag -- a
+          // `created` replacement rebuilds the object (`onCreated` -> createTerminal) while
+          // _presentationStore (keyed by session id) keeps the card, so a flag-only test strands the
+          // card's shell (and the loading cover that shell hosts) forever. Leave any other lifecycle:
+          // a loading cover (a Retry in flight) is not this tick's to clear.
           if (existing.container && _presentationStore.getSessionState(_resumeClientSessionId(existing))?.lifecycle === 'resume-blocked') _clearSessionLifecycle(existing, 'restore');
         }
       }
@@ -24719,6 +24703,11 @@ async function onSessionsList(msg, options = {}) {
       _maybeRearmTerminalBootstrapFromInventory(existing, sess, { restoring });
     }
   }
+  // D-7: a FULL list that omits the id is the server's own evidence that the close landed — only
+  // then is the pending entry dropped (no timer). A restoring list is partial by design, so it is no evidence.
+  if (!restoring) for (const pendingId of Array.from(state.pendingCloseIds.keys())) {
+    if (!serverIds.has(pendingId)) state.pendingCloseIds.delete(pendingId);
+  }
 
   if (!options.skipStreamStatusRefresh && !restoring && typeof refreshStreamStatuses === 'function') {
     await refreshStreamStatuses({ force: true, render: false, timeoutMs: 3000,
@@ -24751,6 +24740,10 @@ async function onSessionsList(msg, options = {}) {
   }
 
   if (!ownsRoot()) return false;
+  // WP-5 (S-15): repaint machine chips that are already mounted from THIS frame's facts (the
+  // render paths build chips from the row text, but a tab chip reparented into the toolbar is not
+  // rebuilt by a skipped/deferred render). A no-op for every local session.
+  if (typeof refreshSessionMachineChips === 'function') refreshSessionMachineChips(msg.sessions);
   if (!options.deferRender) _renderSessionsListProjection();
 
   // Auto-activate explicit hash targets as soon as they appear. Saved-session
@@ -25318,9 +25311,12 @@ function populateModelSwitcher(sessionId, opts) {
   // The chip label is the lead model + tags + token badge only; effort and the delegate model ride the
   // tooltip / aria-label that syncChip paints. This writes only .model-chip-lead.
   var leadHost = _chipLeadHost(chip);
-  leadHost.textContent = '';
+  var labelHost = leadHost.querySelector ? leadHost.querySelector('.model-chip-label') : null;
+  if (!labelHost) { labelHost = document.createElement('span'); labelHost.className = 'model-chip-label'; }
+  labelHost.textContent = chipView.text;
+  while (leadHost.firstChild) leadHost.removeChild(leadHost.firstChild);
+  leadHost.appendChild(labelHost);
   chip.classList.toggle('model-stale', chipView.stale);
-  leadHost.appendChild(document.createTextNode(chipView.text));
   chipView.tags.forEach(function(tag) {
     var tagEl = document.createElement('span');
     tagEl.className = 'model-chip-tag';
@@ -27098,7 +27094,7 @@ function renderSessionList(force) {
     }).map(p =>
       `<span class="prompt-badge" onclick="event.stopPropagation();openPromptInEditor(${p.prompt_id})" title="${escHtml(p.title || 'Prompt')}">${escHtml((p.title || 'Prompt').slice(0, 20))}</span>`
     ).join('');
-    const branchBadge = activeSessionBranchBadge(s);
+    const branchBadge = activeSessionBranchBadge(s) + machineChipHtml(s); // + WP-5 machine chip ('' local)
     const forkBadge = activeSessionForkBadge(s);
     const worktreeBadge = worktreeAttentionBadge(s);
     const ownerChip = sessionOwnerChipHtml(s);
@@ -28253,9 +28249,12 @@ function _renderTabsLegacy(force) {
       ? SessionWorkspaceTracking.tabBranchNode(SessionWorkspaceTracking.trackingForSession(s), tabBranch, '\u25ED', branchBadgeHtml)
       : null;
     const lifecycleChip = _sessionLifecycleChipNode(s);
+    // WP-5 (\u00a76.6/S-14): the same presenter as the stream-chrome tab (session-commands.js), so both
+    // tab render modes show an identical chip. null for a local session.
+    const tabMachineChip = machineSessionChipNode(s, id);
     const tabClose = document.createElement('span'); tabClose.className = 'close-tab'; tabClose.textContent = '\u00d7';
     tabClose.onclick = function(e) { e.stopPropagation(); killSession(id); };
-    tab.appendChild(tabIcon); tab.appendChild(tabLabel); if (tabBranchEl) tab.appendChild(tabBranchEl); if (lifecycleChip) tab.appendChild(lifecycleChip); tab.appendChild(tabClose);
+    tab.appendChild(tabIcon); tab.appendChild(tabLabel); if (tabBranchEl) tab.appendChild(tabBranchEl); if (tabMachineChip) tab.appendChild(tabMachineChip); if (lifecycleChip) tab.appendChild(lifecycleChip); tab.appendChild(tabClose);
     tab.onpointerdown = function(e) {
       if (e.target?.closest?.('.close-tab')) return;
       if (e.button === undefined || e.button === 0) {
@@ -28362,6 +28361,9 @@ function _streamChromeTabUnitForId(id) {
       branchInfo.displayNamespace || '',
       workspaceTracking ? JSON.stringify(workspaceTracking) : '',
       lifecycleHtml,
+      // WP-5 (S-15): the machine chip's label/title depend on the machine's health, so a
+      // reachable -> unreachable flip must rebuild the tab instead of leaving a stale chip.
+      JSON.stringify(sessionMachineFacts(session)),
     ]),
     visualHash: JSON.stringify([
       state.activeTab === id,
@@ -28869,9 +28871,12 @@ function _nsPathRefreshHostStatus() {
     attempt: bounded ? _nsPathPickerState.hostPathAttempts : 0,
     count: candidates.length,
   });
+  // WP-5 (§6.5): the probe is answered BY the selected machine via the X-CTM-Machine header (a
+  // local selection sends none), and the seq guard above is what keeps a box answer from ever
+  // landing in a local path field.
   fetch('/api/path-status', {
     method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
+    headers: machineScopedHeaders({ 'Content-Type': 'application/json' }),
     body: JSON.stringify({ paths: candidates }),
   })
     .then(function(r) {
@@ -28958,7 +28963,10 @@ function _nsPathRefreshHostStatus() {
 function _nsPathLoadProjects() {
   if (_nsPathPickerState.projectsLoaded || _nsPathPickerState.projectsLoading) return;
   _nsPathPickerState.projectsLoading = true;
-  fetch('/api/projects?token=' + encodeURIComponent(state.token || ''))
+  // WP-5 (§6.5): the selected machine answers this list ('' ⇒ this Mac, URL unchanged). These rows
+  // are the only place the same-repo prefill looks — plain gitRemoteKey equality inside
+  // nsMachineAfterProjectsLoaded(), against the keys of the machine we are pointed at.
+  fetch('/api/projects?token=' + encodeURIComponent(state.token || '') + machineQueryParam())
     .then(function(r) { return r.ok ? r.json() : []; })
     .then(function(projects) {
       _nsPathPickerState.projects = Array.isArray(projects)
@@ -28967,6 +28975,7 @@ function _nsPathLoadProjects() {
       _nsPathPickerState.projectsLoaded = true;
       _nsPathPickerState.projectsLoading = false;
       _nsPathRefreshHostStatus();
+      if (typeof nsMachineAfterProjectsLoaded === 'function') nsMachineAfterProjectsLoaded(_nsPathPickerState);
       if (_nsPathPickerState.open) _nsPathRenderSuggestions();
       _nsPathUpdateValidation();
       if (typeof _storagePathRepaintOpen === 'function') _storagePathRepaintOpen();
@@ -29179,7 +29188,9 @@ function _nsFetchFsSuggestions(value) {
   clearTimeout(_nsPathPickerState.fsTimer);
   _nsPathPickerState.fsTimer = setTimeout(function() {
     var seq = ++_nsPathPickerState.fsSeq;
-    fetch('/api/path-suggest?q=' + encodeURIComponent(q), { cache: 'no-store' })
+    // WP-5 (§6.5): suggestions come FROM the selected machine; the fsSeq guard above already drops
+    // a stale answer, including one that arrives after a machine switch.
+    fetch('/api/path-suggest?q=' + encodeURIComponent(q) + machineQueryParam(), { cache: 'no-store' })
       .then(function(r) { return r.ok ? r.json() : null; })
       .then(function(d) {
         if (!d || seq !== _nsPathPickerState.fsSeq) return; // a newer keystroke won
@@ -29923,6 +29934,9 @@ async function _maybeRecommendWorktreeForNewSession(force) {
 
 function showNewSessionModal() {
   document.getElementById('new-session-modal').classList.remove('hidden');
+  // WP-5: the machine list is fetched per open; with zero machines the grid stays unrendered
+  // and this modal is pixel-identical to its pre-hub self (AC-5a).
+  if (typeof loadNewSessionMachines === 'function') loadNewSessionMachines();
   _nsPathReset(getLastSessionCwd());
   document.getElementById('ns-label').value = '';
   _nsWorktreeTouched = false;
@@ -30108,6 +30122,8 @@ function killSession(id, opts) {
   const s = state.sessions.get(id);
   const label = s?.meta?.label || id.slice(0, 8);
   if (!opts.skipConfirm && !confirm(`Close session "${label}"?`)) return;
+  // D-7: our close wins over any list that was already in flight when it was sent.
+  state.pendingCloseIds.set(id, Date.now());
   send({ type: 'kill', id });
   // Clean up locally
   if (s) {
@@ -30172,6 +30188,8 @@ function _killTabSilent(id) {
   if (window.CTMNativeSubagentReview?.hasTab(id)) { closeSpecialTab(id); return; }
   const s = state.sessions.get(id);
   if (!s) return;
+  // D-7: see killSession — the pending entry bridges until the list proves the close landed.
+  state.pendingCloseIds.set(id, Date.now());
   send({ type: 'kill', id });
   _clearTerminalRecoveryProtocolResources(s);
   if (s._outputIdleTimer) clearTimeout(s._outputIdleTimer);
@@ -31060,6 +31078,8 @@ document.addEventListener('keydown', (e) => {
   }
   // Cmd+Shift+V / Ctrl+Shift+V: cycle the available surfaces in product order.
   if ((e.metaKey || e.ctrlKey) && e.shiftKey && (e.key === 'V' || e.key === 'v')) {
+    // One keystroke, one action: the terminal already consumed this chord as a path paste.
+    if (e.defaultPrevented) return;
     const id = state.activeTab;
     if (id && state.sessions && state.sessions.has(id) && typeof setSessionView === 'function') {
       e.preventDefault();
@@ -32060,12 +32080,13 @@ async function loadRecentSessions(options = {}) {
       if (!state.tabOrder.includes('review')) state.tabOrder.push('review');
       // If not post-restart (e.g. normal page load with saved review), restore active tab now
       if (!state._postRestart) {
-        const _hashNav = location.hash.slice(1).split('&')[0];
+        // AC-5e: resolve the alias before classifying, so boot never flashes the old #setup tab.
+        const _hashNav = (typeof _machinesHashAliasTarget === 'function' ? _machinesHashAliasTarget(location.hash) : '') || location.hash.slice(1).split('&')[0];
         // Map hash aliases (e.g. #review → codereview) to the internal nav target so a
         // panel-hash load isn't mistaken for "no panel" and overridden by the saved
         // session below — the bug that made #review steal focus to the last session.
         const _hashTarget = NAV_TARGET_ALIASES[_hashNav] || _hashNav;
-        const _isHashPanel = ['command', 'rules', 'insights', 'permissions', 'prompts', 'review', 'codereview', 'walle', 'models', 'backups', 'worktrees', 'setup'].includes(_hashNav);
+        const _isHashPanel = ['command', 'rules', 'insights', 'permissions', 'prompts', 'review', 'codereview', 'walle', 'models', 'backups', 'worktrees', 'machines', 'setup'].includes(_hashNav);
         if (_isHashPanel) {
           const _alreadyOnHashPanel = state.activeTab === _hashTarget || (_hashNav === 'command' && state.activeTab === 'overview');
           if (!_alreadyOnHashPanel) navTo(_hashTarget, { skipHash: true });
@@ -32645,6 +32666,9 @@ function sessionItemHtml(s, opts = {}) {
   const deviceTag = (!thisDevice && s.hostname) ? `<span style="color:var(--accent);font-size:9px;margin-left:4px">${escHtml(s.hostname)}</span>` : '';
   const msgCount = s.userMsgCount > 0 ? `<span>${s.userMsgCount} msgs</span>` : '';
   const providerBadge = recentSessionAgentBadgeHtml(s);
+  // WP-5 (§6.6/S-14): '' for a local session, so local rows keep their exact markup. NOTE: this
+  // row template is duplicated in renderServerSearchResults() below — both must stay in step.
+  const machineChip = machineChipHtml(s);
   const activeInfo = recentSessionActiveInfo(s, opts.activeIndex || null);
   const activeBadge = recentSessionActiveBadgeHtml(activeInfo);
   const activeCls = activeInfo ? ' active-session' : '';
@@ -32659,6 +32683,7 @@ function sessionItemHtml(s, opts = {}) {
       <span class="project">${escHtml(project)}</span>
       ${activeBadge}
       ${providerBadge}
+      ${machineChip}
       ${branch}
       ${msgCount}
       <span>${ago}</span>
@@ -32842,7 +32867,7 @@ function continueInShell(sessionId, cwd) {
   send({
     type: 'create',
     cwd: cwd || undefined,
-    label: `Shell: ${cwd}`,
+    label: `Shell: ${cwd}`, titleIntent: 'default', // D-13: CTM-composed name, never tier 1
   });
 }
 
@@ -33350,7 +33375,7 @@ function openFolder(folderPath) {
     cmd: 'open',
     args: [folderPath],
     cwd: folderPath,
-    label: `Folder: ${folderPath.replace(/^\/Users\/[^/]+\//, '~/')}`,
+    label: `Folder: ${folderPath.replace(/^\/Users\/[^/]+\//, '~/')}`, titleIntent: 'default', // D-13: CTM-composed name
   });
 }
 
@@ -34932,6 +34957,8 @@ function renderServerSearchResults(results, total, query, degraded) {
     const branch = s.gitBranch ? branchMetaHtml(s.gitBranch) : '';
     const msgCount = s.userMsgCount > 0 ? `<span>${s.userMsgCount} msgs</span>` : '';
     const providerBadge = recentSessionAgentBadgeHtml(s);
+    // WP-5 (§6.6/S-14): the SECOND copy of the recent-item row template (see sessionItemHtml).
+    const machineChip = machineChipHtml(s);
     const activeInfo = recentSessionActiveInfo(s, _activeIndex);
     const activeBadge = recentSessionActiveBadgeHtml(activeInfo);
     const activeCls = activeInfo ? ' active-session' : '';
@@ -34960,7 +34987,7 @@ function renderServerSearchResults(results, total, query, degraded) {
       + '<div class="recent-msg"><span class="pin-icon" style="' + (isPinned ? 'cursor:grab;' : '') + '">&#9733;</span><span class="recent-msg-text">' + highlighted + '</span></div>'
       + matchCtx
       + msgSnippet
-      + '<div class="recent-meta"><span class="project">' + escHtml(project) + '</span>' + activeBadge + providerBadge + branch + msgCount + '<span>' + ago + '</span></div>'
+      + '<div class="recent-meta"><span class="project">' + escHtml(project) + '</span>' + activeBadge + providerBadge + machineChip + branch + msgCount + '<span>' + ago + '</span></div>'
       + '</div>';
   }).join('');
 
@@ -35441,11 +35468,11 @@ function onDataChanged(msg) {
     refreshQpPromptsIfLoaded();
   }
   if (r === 'queue-draft') {
-    const sid = getQpSessionId();
-    const changedSessionId = String(msg.id || '');
-    if (sid && (!changedSessionId || changedSessionId === sid)) {
-      qpScheduleDraftRevalidate(sid, 'data-changed');
-    }
+    // clock-free r4 R-5: invalidate the session the echo names, not the panel's
+    // session dropdown — an echo that lands while the select is empty (getQpSessionId() ===
+    // null) used to be dropped, so the stale draft was never re-checked.
+    const target = String(msg.id || '') || getQpSessionId() || qpCurrentSession;
+    if (target) qpScheduleDraftRevalidate(target, 'data-changed');
   }
   if (r === 'auto-approvals' || r === 'approval-rules' || r === 'approval-decisions') {
     if (state.activeTab === 'permissions') loadAutoApprovals();
@@ -36006,10 +36033,14 @@ window.addEventListener('message', (e) => {
 // 'review' is the canonical code-review route; 'codereview' is kept as a legacy alias.
 // Both classify as nav panels (so initial-load session-restore suppression treats them
 // like any other panel), but they dispatch to the same internal target ('codereview').
-const NAV_TARGETS = ['sessions', 'command', 'prompts', 'rules', 'insights', 'permissions', 'review', 'codereview', 'walle', 'models', 'backups', 'worktrees', 'setup'];
+const NAV_TARGETS = ['sessions', 'command', 'prompts', 'rules', 'insights', 'permissions', 'review', 'codereview', 'walle', 'models', 'backups', 'worktrees', 'machines', 'setup'];
 // Hash nav targets that are aliases for a different internal navTo() id.
 const NAV_TARGET_ALIASES = { review: 'codereview' };
 
+// AC-5e: the old Settings → Machines deep link resolves to the first-class `machines` page (WP-5/D-14).
+const _MACHINES_HASH_ALIAS = 'setup&tab=machines';
+function _machinesHashAliasTarget(hash) { return String(hash || '').replace(/^#/, '') === _MACHINES_HASH_ALIAS ? 'machines' : ''; }
+
 function _parseHashRoute() {
   const hash = location.hash.slice(1);
   const parts = hash ? hash.split('&') : [];
@@ -36065,8 +36096,12 @@ function handleHashRoute() {
   const hash = route.hash;
   const routeLease = _rootPrivateRuntime?.capture?.();
   if (!_isRootPrivateLeaseCurrent(routeLease)) {
-    const publicNav = route.isNav && route.firstPart && ['setup', 'models', 'backups'].includes(route.firstPart);
-    if (publicNav) navTo(NAV_TARGET_ALIASES[route.firstPart] || route.firstPart, { skipHash: true });
+    // Machines is the pool-admin page that replaced a Settings tab, so its deep link (AC-5e alias
+    // included) resolves here alongside setup/models/backups.
+    // typeof-guarded: this router is extracted and run on its own by the hash-route harnesses.
+    const _publicAlias = route.isNav && typeof _machinesHashAliasTarget === 'function' ? _machinesHashAliasTarget(route.hash) : '';
+    const publicNav = route.isNav && route.firstPart && ['setup', 'models', 'backups', 'machines'].includes(route.firstPart);
+    if (publicNav) navTo(_publicAlias || NAV_TARGET_ALIASES[route.firstPart] || route.firstPart, { skipHash: true });
     return;
   }
   const deferPromptRoute = (delay, action) => {
@@ -36128,6 +36163,9 @@ function handleHashRoute() {
     return;
   }
 
+  // #setup&tab=machines (AC-5e) — the Settings tab is gone, so the alias rewrites onto #machines.
+  if (isNav && typeof _machinesHashAliasTarget === 'function' && _machinesHashAliasTarget(hash) === 'machines') { navTo('machines'); return; }
+
   // #setup&tab=access — open setup and let SETUP.init pick the inner tab.
   if (isNav && firstPart === 'setup') {
     navTo('setup', { skipHash: true });
@@ -36959,6 +36997,11 @@ function qpReconcileSubmissionMessage(message, options = {}) {
     status: message.status,
     retryable: message.retryable === true,
     message: message.message,
+    // WP-1 (C3, R3/R7): the broadcast frame carries the same typed recovery verdict as the
+    // direct reply — pass it through so lastAttempt is never quietly downgraded to a guess.
+    recoveryAction: message.recoveryAction,
+    reason: message.reason,
+    code: message.code,
     observedAt: message.observedAt || message.updated_at || message.updatedAt || Date.now(),
   });
   if (options.owner && !qpDraftLifetime.current(options.owner)) return false;
@@ -37506,6 +37549,9 @@ async function loadQpDraftForSession(sessionId) {
   }
   const loadState = qpDraftStateFor(sessionId, owner);
   loadState.phase = 'loading';
+  // clock-free r4 R-5b: this load may only clear the invalidations it covered — an
+  // echo that lands in the awaits below cannot have been seen by this fetch.
+  const invalidationAtStart = loadState.invalidationSeq || 0;
   try {
     const data = (await qpFetchDraftWithRetry(sessionId, owner)) || {};
     if (!isQpDraftLoadCurrent(sessionId, seq, owner)) return;
@@ -37523,7 +37569,9 @@ async function loadQpDraftForSession(sessionId) {
     loadState.failCount = 0;
     loadState.lastError = '';
     loadState.nextRetryAt = 0;
-    loadState.stale = false;
+    // clock-free r4 R-5b: keep stale set when an echo invalidated this session after
+    // the fetch above started; only the invalidations this load covered are cleared.
+    loadState.stale = (loadState.invalidationSeq || 0) !== invalidationAtStart;
     qpDraftFailureEpisodeActive = false;
     clearDegradedIndicator('queue-draft');
     clearToastByKey('queue-draft-load');
@@ -37546,10 +37594,11 @@ async function loadQpDraftForSession(sessionId) {
     await _handleQpDraftLoadFailure(sessionId, seq, error, owner);
   } finally {
     // Safety net (WP-2a): guarantee the panel never strands on "Loading draft..."
-    // even if something above throws unexpectedly. Only clear/repaint when this
-    // load still owns the panel — a stale/superseded load must never clobber a
-    // newer load's state.
-    if (await qpDraftLifetime.verify(owner) && isQpDraftLoadCurrent(sessionId, seq, owner) && qpDraftLoading) {
+    // even if something above throws unexpectedly. The clear never awaits: the
+    // currency check below is synchronous, so a private-scope verify that is slow
+    // or fails can no longer hold the flag. A stale/superseded load must never
+    // clobber a newer load's state, which isQpDraftLoadCurrent already encodes.
+    if (isQpDraftLoadCurrent(sessionId, seq, owner) && qpDraftLoading) {
       qpDraftLoading = false;
       renderQpItems();
       updateQpModeBtn();
@@ -37573,6 +37622,9 @@ async function qpScheduleDraftRevalidate(sessionId, reason = 'invalidation', ori
     const loadState = qpDraftStateFor(sessionId, timerOwner);
     if (!qpDraftLifetime.current(timerOwner)) return false;
     loadState.stale = true;
+    // clock-free r4 R-5b: the counter lets an in-flight load tell which invalidations
+    // it predates, so completing it cannot clear an echo it never saw.
+    loadState.invalidationSeq = (loadState.invalidationSeq || 0) + 1;
     if (sessionId !== qpCurrentSession || !qpQueuePanelVisible()) return false;
     if (qpEditingIdx >= 0 || qpDraftSavePending(sessionId) || qpDraftLoading) {
       qpDraftLifetime.defer(timerOwner, qpDeferredDraftReloads);
@@ -37623,7 +37675,6 @@ async function syncQpDraftWithServerQueue(sessionId, seq = qpDraftLoadSeq, owner
   try {
     const res = await qpDraftLifetime.request(owner, fetch, `/api/queues/${encodeURIComponent(sessionId)}`, {
       headers: { 'Authorization': 'Bearer ' + owner?.token },
-      signal: AbortSignal.timeout(4000),
     });
     if (!res || !isQpDraftLoadCurrent(sessionId, seq, owner)) return false;
     if (res.status === 204) {
@@ -39047,6 +39098,9 @@ async function sendQueueFromPanel(actionOwner, viewOwner) {
     if (ownsContext) { qpDraftLifetime.finish(actionOwner); qpDraftLifetime.finish(viewOwner); }
     return;
   }
+  // WP-1 (C4, AC-1e): review-blocking happens BEFORE any dispatch, single item or auto batch, so
+  // an uncertain outcome can never be sent by switching mode.
+  if (_reviewQpItems(pendingItems, canPublish())) { finishOwnedAction(); return; }
   if (pendingItems.length === 1) {
     try {
       if (await qpMaybeRouteWorkflow(sessionId, pendingItems[0])) {
@@ -39154,6 +39208,13 @@ async function sendQueueFromPanel(actionOwner, viewOwner) {
     try {
       const session = actionOwner.session;
       if (!session) throw new Error('Session not connected');
+      // R7 (AC-1e): Send Next invokes the recovery policy published with this item's last failure
+      // instead of blindly repeating an identity the server already refused. A `review` verdict was
+      // already handled by the review gate above -- it is never dispatched from here.
+      const itemPolicy = window.QueuePanelSubmissionReconcile.itemRecoveryPolicy(item);
+      // The certified no-effect recovery is the one place an item may drop the dead identity it
+      // was admitted with -- and only because the user just asked for a fresh attempt.
+      if (itemPolicy === 'resend') { delete item._submissionClientMessageId; delete item.lastAttempt; item._forceResend = true; }
       const displayText = qpBuildDisplayText(item);
       const images = (item && item.images) || [];
       const wantsImagePaste = images.length > 0 && window.TerminalImageTransport.providerAcceptsImagePathPaste(
@@ -39189,9 +39250,15 @@ async function sendQueueFromPanel(actionOwner, viewOwner) {
           clientMessageId: submissionId,
           status: result?.status || 'failed',
           retryable: result?.retryable === true,
+          recoveryAction: result?.recoveryAction,
+          reason: result?.reason,
+          code: result?.code,
           message: result?.message || '',
           observedAt: Date.now(),
         }, { itemId, owner: actionOwner });
+        // The explicit fresh attempt has been dispatched: this transient click intent must not
+        // outlive it, or the next Send Next would mint yet another identity from the same gesture.
+        delete item._forceResend;
         if (!result || result.status !== 'sent') {
           manualSendSent = false;
           const liveItem = canPublish() ? qpItems.find(candidate => candidate?.id === itemId
@@ -39203,12 +39270,16 @@ async function sendQueueFromPanel(actionOwner, viewOwner) {
                 outcome: result?.status || 'unresolved',
                 message: result?.message || '',
                 retryable: result?.retryable === true,
+                // Same typed verdict the direct reply carried, so the next Send Next follows
+                // the server's policy for this failure rather than guessing one.
+                recoveryAction: result?.recoveryAction,
+                ...(result?.reason || result?.code ? { reason: result?.reason || result?.code } : {}),
               };
             }
           }
           const msg = result?.message || 'CTM could not verify that the prompt was accepted';
           if (canPublish()) toast(
-            result?.retryable ? 'Not sent yet — ' + msg + ' It stays queued.' : 'Not sent — ' + msg,
+            result?.retryable ? 'Not sent yet — ' + msg + ' It stays queued.' : 'Prompt needs attention — ' + msg,
             { type: result?.retryable ? 'warning' : 'error', key: 'qp-send-failed:' + sessionId },
           );
           saveQpDraft(actionOwner);