create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/public/js/app/machines-page.js

@@ -35,8 +35,19 @@ var _machinesPageState = {
   loading: false,
   loaded: false,
   error: '',
+  // WP-4 (docs/remote-session-hub-bridge-2026-10-30.html R-11/R-13, §6.2): the hub-bridge access
+  // surface. `access.trust` is the R-11 trust policy (GET /api/hub-bridge/trust), `access.grants`
+  // every live grant and `access.pending` every open ask (GET /api/hub-bridge/grants), and
+  // `accessAudit` the last 20 audit rows per machine (GET /api/hub-bridge/audit). `accessPendingIndex`
+  // is pending-id -> row, so a grant-button click knows the caller session, tier and choice.
+  access: null,
+  accessAudit: Object.create(null),
+  accessPendingIndex: Object.create(null),
 };
 
+// pendingId -> the open ask (R-5). Rendered as a banner on the session toolbar the ask names (AC-2g).
+var _machinesPageBanners = Object.create(null);
+
 // AC-5f's seam: the panel's timer and clock are injectable so a test can prove the timer stops
 // without sleeping. `now` is never called from a hidden path — every caller passes it in or reads it
 // here, so the tested paths are clock-free.
@@ -118,7 +129,8 @@ function machinesPageToast(text) {
   var panel = document.getElementById('machines-panel');
   var node = panel ? panel.querySelector('.machines-page-toast') : null;
   if (node) { node.textContent = message; node.classList.toggle('show', !!message); }
-  if (typeof toast === 'function') toast(message);
+  // An empty message CLEARS the inline note; it must never pop an empty global toast.
+  if (message && typeof toast === 'function') toast(message);
   return message;
 }
 
@@ -156,8 +168,8 @@ function machinesFormatPct(value) {
   return machineFormatPct(value);
 }
 
-function machinesAgentText(agents) {
-  return machineAgentText(agents);
+function machinesAgentText(agents, presence) {
+  return machineAgentText(agents, presence);
 }
 
 function machinesTaskLine(tasks) {
@@ -168,6 +180,19 @@ function machinesGpuText(gpu) {
   return machineGpuText(gpu);
 }
 
+function machinesPowerText(sample, history, now) {
+  return machinePowerText(sample, history, now);
+}
+
+// WP-3 (§8, docs/fleet-auto-update-pooled-machines-2026-10-26.html): the box's update status line.
+// The rule lives in the shared presenter (machineFleetLine); here is only its markup, so the phone
+// card renders the same bytes. '' (no markup at all) when there is nothing honest to say.
+function machinesPageFleetHtml(machine) {
+  var fleet = machineFleetLine(machine);
+  if (!fleet) return '';
+  return '<div class="mpc-fleet" data-fleet-tone="' + mEsc(fleet.tone) + '" title="' + mEsc(fleet.title) + '">' + mEsc(fleet.text) + '</div>';
+}
+
 function machinesCredentialBadge(machine, isSelf) {
   var credential = String((machine && machine.peerCredential) || (isSelf ? 'self' : 'missing'));
   if (isSelf) return { html: '<span class="mpc-cred" data-cred="self" title="This Mac runs the sessions itself">This Mac</span>', action: '' };
@@ -616,17 +641,20 @@ function machineCardHtml(machine, history) {
   var cpuNow = sample && sample.cpuPct != null ? Number(sample.cpuPct) : machinesLastValue(cpuSeries);
   var memNow = machinesLastValue(memSeries);
   var credential = machinesCredentialBadge(m, false);
-  var agents = machinesAgentText(m.agents);
+  var agents = machinesAgentText(m.agents, m.agentPresence);
   var facts = ''
     + machinesStatBlock('Load', sample && sample.load1 != null ? mEsc(Number(sample.load1).toFixed(2)) : '')
     + machinesStatBlock('Cores', sample && sample.cores != null ? mEsc(String(sample.cores)) : '')
     + machinesStatBlock('Disk free', sample ? mEsc(machinesFormatBytes(sample.diskFreeBytes)) : '')
     + machinesStatBlock('GPU', mEsc(machinesGpuText(sample && sample.gpu)))
+    + machinesStatBlock('Power', mEsc(machinesPowerText(sample, machinesHistoryRows(history), machinesPageNow())))
     + machinesStatBlock('Tasks', mEsc(machinesTaskLine(sample && sample.tasks)))
     + machinesStatBlock('Agents', mEsc(agents));
   var staleNote = stale && (sample || statsAt)
     ? '<span class="mpc-stale" title="The hub re-reads a box at most once a minute; this sample is older than three">stats stale</span>'
     : '';
+  // WP-3 rev 3 (docs/off-lan-hub-to-box-access-2026-10-31.html §13.6 D-17): an unreachable box whose every dial URL is local-only says WHY — `awayReason` is the registry's verdict, and anything else renders no note at all.
+  var awayNote = m.awayReason === 'no_away_path' ? '<div class="machines-page-note machine-card-away-note">' + mEsc('Not reachable away from home — no away path is set up on this hub (bin/away-path.sh).') + '</div>' : (m.awayReason === 'away_path_down' ? '<div class="machines-page-note machine-card-away-note">' + mEsc("Not reachable — the away path is set up, but this box's tunnel or forward is down. Run: bin/away-path.sh doctor") + '</div>' : '');
   return '<article class="machine-page-card" data-machine-id="' + mEsc(id) + '" data-health="' + mEsc(health) + '">'
     + '<div class="mpc-head">'
     + '<span class="mpc-dot" data-health="' + mEsc(health) + '" title="' + mEsc(health) + '"></span>'
@@ -636,13 +664,16 @@ function machineCardHtml(machine, history) {
     + credential.html
     + '</div>'
     + '<div class="mpc-meta">' + mEsc([machineHealthLabel(m), machineLastSeenText(m), [m.os, m.arch].filter(Boolean).join('/')].filter(Boolean).join(' · '))
-    + ' ' + staleNote + '</div>'
+    + ' ' + staleNote + '</div>' + awayNote
+    + machinesPageFleetHtml(m)
     + '<div class="mpc-sparks">'
     + '<div class="mpc-spark"><span class="mpc-spark-label">CPU</span>' + sparklineSvg(cpuSeries) + '<span class="mpc-spark-val">' + mEsc(machinesFormatPct(cpuNow)) + '</span></div>'
     + '<div class="mpc-spark"><span class="mpc-spark-label">MEM</span>' + sparklineSvg(memSeries) + '<span class="mpc-spark-val">' + mEsc(machinesFormatPct(memNow)) + '</span></div>'
     + '</div>'
     + '<dl class="mpc-facts">' + facts + '</dl>'
     + machinesPageSignInHtml(m)
+    + machinesPageSkillsRowHtml(m)
+    + machinesPageModelsRowHtml(m)
     + '<div class="mpc-actions">'
     + '<button type="button" class="mpc-btn mpc-fav" aria-pressed="' + (m.favorite ? 'true' : 'false') + '"'
     + ' title="Favorite — shown first in the picker" onclick="machinesPageToggle(' + mEsc(JSON.stringify(id)) + ',\'favorite\')">'
@@ -654,6 +685,7 @@ function machineCardHtml(machine, history) {
     + '<button type="button" class="mpc-btn mpc-danger" onclick="machinesPageConfirmRemove(' + mEsc(JSON.stringify(id)) + ')">Remove</button>'
     + '</div>'
     + machinesPageSignInRowHtml(m)
+    + machinesPageAccessBlockHtml(m)
     + '</article>';
 }
 
@@ -674,6 +706,7 @@ function machinesSelfCardHtml() {
     + machinesStatBlock('Cores', latest && latest.cores != null ? mEsc(String(latest.cores)) : '')
     + machinesStatBlock('Disk free', latest ? mEsc(machinesFormatBytes(latest.diskFreeBytes)) : '')
     + machinesStatBlock('GPU', mEsc(machinesGpuText(latest && latest.gpu)))
+    + machinesStatBlock('Power', mEsc(machinesPowerText(latest, machinesHistoryRows(history), machinesPageNow())))
     + machinesStatBlock('Tasks', mEsc(machinesTaskLine(latest && latest.tasks)))
     + machinesStatBlock('Memory', latest ? mEsc(machinesFormatBytes(latest.memUsedBytes) + ' / ' + machinesFormatBytes(latest.memTotalBytes)) : '');
   var poolNote = _machinesPageState.machines.length
@@ -712,6 +745,7 @@ function machinesPageHeaderHtml() {
     + 'Names, favorites and visibility live on the machine they describe.</p>'
     + '</div>'
     + '<div class="machines-page-actions">'
+    + machinesPageTrustAllHtml()
     + '<button type="button" class="mpc-btn mpc-primary" onclick="openAddMachineDialog()">+ Add machine</button>'
     + '<button type="button" class="mpc-btn" onclick="openShowCodeDialog()">Show a code for this machine</button>'
     + (inPool ? '<button type="button" class="mpc-btn mpc-danger" onclick="machinesPageLeavePool()">Leave pool</button>' : '')
@@ -777,11 +811,17 @@ function loadMachinesPanel() {
     machinesPageJson(machinesPageUrl('/api/machines')),
     machinesPageJson(machinesPageUrl('/api/machine-self')),
     machinesPageJson(machinesPageUrl('/api/host/stats', machinesPageHistoryQuery('', now))),
+    // R-11/R-13: the trust policy and the live grants/pending rows that fill every card's Access block.
+    machinesPageJson(machinesPageUrl('/api/hub-bridge/trust')),
+    machinesPageJson(machinesPageUrl('/api/hub-bridge/grants')),
   ]).then(function (results) {
     var list = results[0];
     var self = results[1];
     var stats = results[2];
     _machinesPageState.loading = false;
+    // A hub without the WP-2 routes (an older server) 404s: the access surface is simply empty, and
+    // the Machines page renders exactly as it did before this work.
+    machinesPageApplyAccess(results[3], results[4]);
     if (!list.ok) {
       _machinesPageState.error = machinesPageServerError(list.data, list.status);
       renderMachinesPage();
@@ -799,7 +839,7 @@ function loadMachinesPanel() {
     _machinesPageState.origins = machinesPageReadPoolOrigins();
     _machinesPageState.loaded = true;
     renderMachinesPage();
-    return machinesPageLoadHistories(now).then(function () {
+    return Promise.all([machinesPageLoadHistories(now), machinesPageLoadAccessAudits()]).then(function () {
       renderMachinesPage();
       return true;
     });
@@ -883,10 +923,48 @@ function machinesPanelHidden() {
   return machinesPageStopPolling();
 }
 
-// navTo('machines') entry point (mirrors showWorktreesPanel).
+// navTo('machines') entry point (mirrors showWorktreesPanel). `opts.revealMachine` /
+// `opts.revealMachineName` come from a `.machine-chip` click (AC-4a): after the cards exist, the
+// named card is scrolled into view and flashed, exactly once per click.
 function showMachinesPanel(opts) {
   if (typeof activateTab === 'function') activateTab('machines');
-  return loadMachinesPanel();
+  var options = opts || {};
+  var pending = loadMachinesPanel();
+  if (!options.revealMachine && !options.revealMachineName) return pending;
+  return pending.then(function (ok) {
+    machinesPageRevealCard(String(options.revealMachine || ''), String(options.revealMachineName || ''));
+    return ok;
+  });
+}
+
+/** AC-4a: scroll the named machine's card into view and flash it (the chip click-through target). */
+function machinesPageRevealCard(machineId, machineName) {
+  if (typeof document === 'undefined' || !document || typeof document.querySelector !== 'function') return false;
+  var id = String(machineId || '');
+  var name = String(machineName || '');
+  var escaped = (typeof window !== 'undefined' && window.CSS && typeof CSS.escape === 'function')
+    ? CSS.escape(id)
+    : id.replace(/["\\]/g, '\\$&');
+  var card = id ? document.querySelector('.machine-page-card[data-machine-id="' + escaped + '"]') : null;
+  if (!card && name && typeof document.querySelectorAll === 'function') {
+    var cards = document.querySelectorAll('.machine-page-card') || [];
+    for (var i = 0; i < cards.length; i += 1) {
+      var node = cards[i];
+      var nameNode = typeof node.querySelector === 'function' ? node.querySelector('.mpc-name') : null;
+      if (nameNode && String(nameNode.value || '') === name) { card = node; break; }
+    }
+  }
+  if (!card) return false;
+  if (typeof card.scrollIntoView === 'function') {
+    try { card.scrollIntoView({ block: 'center' }); } catch { card.scrollIntoView(); }
+  }
+  if (card.classList && typeof card.classList.add === 'function') {
+    card.classList.add('machine-card-highlight');
+    if (typeof setTimeout === 'function') {
+      setTimeout(function () { card.classList.remove('machine-card-highlight'); }, 2000);
+    }
+  }
+  return true;
 }
 
 // ── AC-5d: keep the picker grid and the sidebar chip in step without a reload ───────────────────
@@ -1250,3 +1328,1245 @@ function openShowCodeDialog() {
 function machinesPageJoinPool(instanceId, url) {
   return openAddMachineDialog({ url: url || '' });
 }
+
+// ── WP-9: the Skills line + the Review dialog (§9 S-9, AC-9a..AC-9d) ────────────────────────────
+// One line per machine row ("Skills: 12 sent · 2 held back · 1 new on spark — Review"), and the
+// dialog it opens: what the hub held back, what the machine has of its own, and which plugins this
+// hub is told not to send it. PHONE = DESKTOP PARITY — public/m/machines.js renders the same states
+// with the same wording from the same row shape, and neither surface gets an action the other lacks.
+//
+// AC-9c: a machine whose row carries `skills: null` (a box this hub never pushed to and never read)
+// renders EXACTLY the card it rendered before this work — every builder below returns '' for null, so
+// the row's bytes cannot move. tests/machines-page.test.js pins that byte-for-byte.
+
+var MACHINES_PAGE_SKILL_REASONS = {
+  platform: 'macOS-only',
+  hub_home_path: 'points at a path that exists only on this laptop',
+  too_large: 'too large to send',
+  unreadable: 'could not be read',
+};
+
+var MACHINES_PAGE_SKILL_STATES = {
+  new_on_box: 'new on this machine',
+  same: 'same as the hub',
+  shadows_hub: 'this machine’s copy wins',
+  changed_on_box: 'changed on this machine',
+  conflict: 'both sides changed',
+};
+
+// The states that mean "this machine has its own copy" — `same` is the hub's, already on the list.
+var MACHINES_PAGE_BOX_LOCAL_STATES = ['new_on_box', 'changed_on_box', 'conflict', 'shadows_hub'];
+
+/** The row's `skills` block, or null. Everything below reads through this one accessor. */
+function machinesPageSkills(machine) {
+  var skills = machine && machine.skills;
+  return skills && typeof skills === 'object' ? skills : null;
+}
+
+function machinesPageSkillReasonLabel(reason) {
+  var key = String(reason || '');
+  return MACHINES_PAGE_SKILL_REASONS[key] || key || 'held back';
+}
+
+function machinesPageSkillStateLabel(state) {
+  var key = String(state || '');
+  return MACHINES_PAGE_SKILL_STATES[key] || key || 'differs';
+}
+
+function machinesPageSkillsHeldBack(machine) {
+  var skills = machinesPageSkills(machine);
+  return skills && Array.isArray(skills.heldBack) ? skills.heldBack : [];
+}
+
+function machinesPageSkillsOnBox(machine) {
+  var skills = machinesPageSkills(machine);
+  return skills && Array.isArray(skills.onBox) ? skills.onBox : [];
+}
+
+function machinesPageSkillsPlugins(machine) {
+  var skills = machinesPageSkills(machine);
+  return skills && Array.isArray(skills.plugins) ? skills.plugins : [];
+}
+
+function machinesPageSkillsExcluded(machine) {
+  var skills = machinesPageSkills(machine);
+  return skills && Array.isArray(skills.excludePlugins) ? skills.excludePlugins : [];
+}
+
+/** How many of this machine's own skills the hub does not have (or has a different copy of). */
+function machinesPageSkillsBoxLocalCount(machine) {
+  return machinesPageSkillsOnBox(machine).filter(function (item) {
+    return item && MACHINES_PAGE_BOX_LOCAL_STATES.indexOf(String(item.state)) !== -1;
+  }).length;
+}
+
+function machinesPageSkillsMachineName(machine) {
+  var m = machine || {};
+  return String(m.displayName || m.hostname || m.instanceId || 'this machine');
+}
+
+/**
+ * The row's one Skills line, or '' when the row has no skills block (AC-9c).
+ * "sent" is always shown; every other segment appears only when it is non-zero.
+ */
+function machinesPageSkillsLineText(machine) {
+  if (!machinesPageSkills(machine)) return '';
+  var parts = [(Number((machine.skills || {}).sentCount) || 0) + ' sent'];
+  var heldBack = machinesPageSkillsHeldBack(machine).length;
+  if (heldBack) parts.push(heldBack + ' held back');
+  var local = machinesPageSkillsBoxLocalCount(machine);
+  if (local) parts.push(local + ' new on ' + machinesPageSkillsMachineName(machine));
+  var text = 'Skills: ' + parts.join(' · ');
+  var error = (machine.skills || {}).pushError;
+  if (error && (error.message || error.code)) {
+    text += ' · last push failed: ' + String(error.message || error.code);
+  }
+  return text;
+}
+
+/** §9 S-9: Review is offered when there is something to review — held-back items, this machine's own
+ *  skills, or a plugin this hub ships that is not excluded yet. */
+function machinesPageSkillsNeedsReview(machine) {
+  if (!machinesPageSkills(machine)) return false;
+  if (machinesPageSkillsHeldBack(machine).length) return true;
+  if (machinesPageSkillsBoxLocalCount(machine)) return true;
+  var excluded = machinesPageSkillsExcluded(machine);
+  return machinesPageSkillsPlugins(machine).some(function (plugin) { return excluded.indexOf(plugin) === -1; });
+}
+
+function machinesPageSkillsRowHtml(machine) {
+  if (!machinesPageSkills(machine)) return ''; // AC-9c: no block, no bytes
+  var id = String((machine && machine.instanceId) || '');
+  var review = machinesPageSkillsNeedsReview(machine)
+    ? '<button type="button" class="mpc-btn mpc-skills-review" onclick="machinesPageOpenReview('
+      + mEsc(JSON.stringify(id)) + ')">Review</button>'
+    : '';
+  return '<div class="mpc-skills"><span class="mpc-skills-line">' + mEsc(machinesPageSkillsLineText(machine))
+    + '</span>' + review + '</div>';
+}
+
+// ── WP-3: the Models line + the Review dialog's Models section (§6.2, §8 WP-3) ───────────────────
+// The row's `models` block is the BOX's own answer about its own routes (lib/machine-registry.js
+// `_modelsBlockFrom`, read on the existing 60 s probe tick): how many of its enabled routes it can
+// actually use, which ones it cannot get to, and what its two /delegate picks name. `null` = never
+// read, or a box that predates WP-1 — then this card renders EXACTLY the bytes it rendered before
+// this work (AC-3a), so every builder below returns '' for null, exactly like the Skills builders.
+// Nothing here promises an action: "Remove from <box>" arrives in WP-4, "Use on <box>" in WP-5.
+// PHONE = DESKTOP PARITY: public/m/machines.js renders the same states with the same wording.
+
+/** The row's `models` block (§6.2), or null. Everything below reads through this one accessor. */
+function machinesPageModels(machine) {
+  var models = machine && machine.models;
+  return models && typeof models === 'object' ? models : null;
+}
+
+function machinesPageModelsUnreachable(machine) {
+  var models = machinesPageModels(machine);
+  return models && Array.isArray(models.unreachable) ? models.unreachable : [];
+}
+
+function machinesPageModelsDelegate(machine) {
+  var models = machinesPageModels(machine);
+  return models && Array.isArray(models.delegate) ? models.delegate : [];
+}
+
+/** The unreachable rows are worded ONCE here — the line, the /delegate warning and the dialog all
+ *  read the same sentence. A local runtime has nothing listening, which is a different fact. */
+function machinesPageModelsUnreachableLabel(machine, item) {
+  if (String((item && item.type) || '').toLowerCase() === 'ollama') return 'nothing is running there';
+  return "can't be reached from " + machinesPageSkillsMachineName(machine);
+}
+
+/** Whether one /delegate default's route is reachable on the box, said plainly (§8 WP-3). */
+function machinesPageModelsReachLabel(machine, reach) {
+  return (String(reach || '') === 'reachable' ? 'can be reached from ' : "can't be reached from ")
+    + machinesPageSkillsMachineName(machine);
+}
+
+/** §8 WP-3: one warning per /delegate default whose route the box itself cannot get to. */
+function machinesPageModelsDelegateWarnings(machine) {
+  return machinesPageModelsDelegate(machine).filter(function (entry) {
+    var reach = String((entry && entry.reach) || '');
+    return reach === 'unreachable' || reach === 'no_server';
+  }).map(function (entry) {
+    return '/delegate on ' + machinesPageSkillsMachineName(machine) + ' uses ' + String((entry && entry.model) || '')
+      + ' through a route ' + machinesPageSkillsMachineName(machine) + " can't reach.";
+  });
+}
+
+/**
+ * The row's one Models line, or '' when the row has no models block (AC-3a).
+ * "usable" is always shown; the unreachable segment appears only when there is one.
+ */
+function machinesPageModelsLineText(machine) {
+  var models = machinesPageModels(machine);
+  if (!models) return '';
+  var parts = [(Number(models.usable) || 0) + ' usable'];
+  var unreachable = machinesPageModelsUnreachable(machine).length;
+  if (unreachable) {
+    parts.push(unreachable + " can't be reached from " + machinesPageSkillsMachineName(machine));
+  }
+  return 'Models: ' + parts.join(' · ');
+}
+
+/** §8 WP-3: Review is offered when the block has something to show — a route the box cannot get to,
+ *  or a /delegate default that names one. */
+function machinesPageModelsNeedsReview(machine) {
+  if (!machinesPageModels(machine)) return false;
+  if (machinesPageModelsUnreachable(machine).length) return true;
+  return machinesPageModelsDelegateWarnings(machine).length > 0;
+}
+
+function machinesPageModelsRowHtml(machine) {
+  if (!machinesPageModels(machine)) return ''; // AC-3a: no block, no bytes
+  var id = String((machine && machine.instanceId) || '');
+  var review = machinesPageModelsNeedsReview(machine)
+    ? '<span class="mpc-models-sep">—</span>'
+      + '<button type="button" class="mpc-btn mpc-models-review" onclick="machinesPageOpenReview('
+      + mEsc(JSON.stringify(id)) + ')">Review</button>'
+    : '';
+  var warnings = machinesPageModelsDelegateWarnings(machine).map(function (text) {
+    return '<span class="mpc-models-warn">' + mEsc(text) + '</span>';
+  }).join('');
+  return '<div class="mpc-models"><span class="mpc-models-line">' + mEsc(machinesPageModelsLineText(machine))
+    + '</span>' + review + warnings + '</div>';
+}
+
+/** WP-9 title, extended by WP-3: the dialog names whichever of the two blocks the row actually has. */
+function machinesPageReviewTitle(machine) {
+  var name = machinesPageSkillsMachineName(machine);
+  var hasSkills = !!machinesPageSkills(machine);
+  var hasModels = !!machinesPageModels(machine);
+  if (hasSkills && hasModels) return 'Skills and models on ' + name;
+  if (hasModels) return 'Models on ' + name;
+  return 'Skills on ' + name;
+}
+
+/** WP-3: a row is reviewable while EITHER block has something to show. A section whose block is
+ *  absent renders nothing, so a models-only row opens a Models-only dialog. */
+function machinesPageReviewOpenable(machine) {
+  return !!machinesPageSkills(machine) || machinesPageModelsNeedsReview(machine);
+}
+
+// ── the Review dialog's sections (pure presenters; the wiring mounts them) ───────────────────────
+
+function machinesPageReviewHeldBackHtml(machine) {
+  if (!machinesPageSkills(machine)) return ''; // no block, no section (§8 WP-3)
+  var items = machinesPageSkillsHeldBack(machine);
+  var body = items.length
+    ? items.map(function (item) {
+      var where = item && item.file
+        ? '<span class="mpc-review-where">' + mEsc(String(item.file) + (item.line ? ':' + item.line : '')) + '</span>'
+        : '';
+      return '<li class="mpc-review-item" data-skill="' + mEsc(String((item && item.name) || '')) + '"'
+        + ' data-key="' + mEsc(machinesPageReviewItemKey(item && item.agent, item && item.name)) + '">'
+        + '<span class="mpc-review-name">' + mEsc(String((item && item.name) || '')) + '</span>'
+        + '<span class="mpc-review-meta">' + mEsc([String((item && item.agent) || ''), machinesPageSkillReasonLabel(item && item.reason)].filter(Boolean).join(' · ')) + '</span>'
+        + where + '</li>';
+    }).join('')
+    : '<li class="mpc-review-empty">Nothing was held back.</li>';
+  return '<section class="mpc-review-section" data-section="held-back"><h4>Held back</h4><ul>'
+    + body + '</ul></section>';
+}
+
+/** The buttons one on-`machine` item offers, by state (§9 S-9). `new_on_box` has no laptop copy to
+ *  fall back to, so "Use the laptop's copy" is absent there — the one state where the pair differs. */
+function machinesPageReviewItemActionsHtml(instanceId, item) {
+  var state = String((item && item.state) || '');
+  var args = mEsc(JSON.stringify(String(instanceId))) + ',' + mEsc(JSON.stringify(String((item && item.agent) || '')))
+    + ',' + mEsc(JSON.stringify(String((item && item.name) || ''))) + ',' + mEsc(JSON.stringify(String((item && item.boxHash) || '')));
+  var out = '';
+  if (state !== 'shadows_hub') {
+    out += '<button type="button" class="mpc-btn mpc-primary" onclick="machinesPageReviewAction(' + args + ',\'import\',this)">Import</button>';
+  }
+  if (state !== 'new_on_box') {
+    out += '<button type="button" class="mpc-btn" onclick="machinesPageReviewAction(' + args + ',\'retire\',this)">Use the laptop’s copy</button>';
+  }
+  out += '<button type="button" class="mpc-btn" onclick="machinesPageReviewSkip(' + args + ',this)">Skip</button>';
+  return out;
+}
+
+function machinesPageReviewOnBoxHtml(machine) {
+  if (!machinesPageSkills(machine)) return ''; // no block, no section (§8 WP-3)
+  var id = String((machine && machine.instanceId) || '');
+  var items = machinesPageSkillsOnBox(machine).filter(function (item) { return item && String(item.state) !== 'same'; });
+  var body = items.length
+    ? items.map(function (item) {
+      var key = String((item && item.name) || '');
+      return '<li class="mpc-review-item" data-skill="' + mEsc(key) + '"'
+        + ' data-key="' + mEsc(machinesPageReviewItemKey(item && item.agent, key)) + '">'
+        + '<span class="mpc-review-name">' + mEsc(key) + '</span>'
+        + '<span class="mpc-review-meta">' + mEsc([String((item && item.agent) || ''), machinesPageSkillStateLabel(item && item.state)].filter(Boolean).join(' · ')) + '</span>'
+        + '<span class="mpc-review-actions">'
+        + machinesPageReviewItemActionsHtml(id, item)
+        + '<button type="button" class="mpc-btn" onclick="machinesPageShowDiff(' + mEsc(JSON.stringify(id)) + ','
+        + mEsc(JSON.stringify(String((item && item.agent) || ''))) + ',' + mEsc(JSON.stringify(key)) + ',this)">Show diff</button>'
+        + '</span>'
+        + '<div class="mpc-review-diff" hidden></div>'
+        + '</li>';
+    }).join('')
+    : '<li class="mpc-review-empty">This machine has no skills of its own.</li>';
+  return '<section class="mpc-review-section" data-section="on-box"><h4>On '
+    + mEsc(machinesPageSkillsMachineName(machine)) + '</h4><ul>' + body + '</ul></section>';
+}
+
+function machinesPageReviewPluginsHtml(machine) {
+  if (!machinesPageSkills(machine)) return ''; // no block, no section (§8 WP-3)
+  var plugins = machinesPageSkillsPlugins(machine);
+  var excluded = machinesPageSkillsExcluded(machine);
+  var body = plugins.length
+    ? plugins.map(function (plugin) {
+      var id = String(plugin);
+      return '<label class="mpc-review-plugin"><input type="checkbox" value="' + mEsc(id) + '"'
+        + (excluded.indexOf(id) !== -1 ? ' checked' : '') + '> ' + mEsc(id) + '</label>';
+    }).join('')
+    : '<p class="mpc-review-empty">The hub sends no plugins to this machine.</p>';
+  return '<section class="mpc-review-section" data-section="plugins"><h4>Plugins</h4>'
+    + '<p class="mpc-review-note">Checked plugins are not sent to this machine.</p>'
+    + '<div class="mpc-review-plugins">' + body + '</div>'
+    + '<div class="mpc-review-actions"><button type="button" class="mpc-btn mpc-primary"'
+    + ' onclick="machinesPageReviewSavePlugins(' + mEsc(JSON.stringify(String((machine && machine.instanceId) || '')))
+    + ',this)">Save</button></div></section>';
+}
+
+/**
+ * §8 WP-3 + WP-4: the Review dialog's Models section — one row per route the box cannot get to (id,
+ * type, origin, and what that means for THIS machine), then the box's own /delegate defaults with the
+ * verdict of the route each one names. WP-4 puts ONE control on the unreachable rows (a checkbox: the
+ * route ids are the box's own, and only the box can delete them) and the matching "Remove from
+ * <machine>" button under the list — never on the /delegate rows, which name no route of their own.
+ */
+function machinesPageReviewModelsHtml(machine) {
+  if (!machinesPageModels(machine)) return ''; // no block, no section
+  var name = machinesPageSkillsMachineName(machine);
+  var unreachable = machinesPageModelsUnreachable(machine);
+  var rows = unreachable.map(function (item) {
+    var id = String((item && item.id) || '');
+    return '<li class="mpc-review-item" data-route="' + mEsc(id) + '">'
+      + '<label class="mpc-review-pick"><input type="checkbox" data-role="models-pick" value="' + mEsc(id) + '"'
+      + ' aria-label="' + mEsc('Remove ' + id + ' from ' + name) + '"'
+      + ' onchange="machinesPageReviewModelsPicked()">'
+      + '<span class="mpc-review-name">' + mEsc(id) + '</span></label>'
+      + '<span class="mpc-review-meta">'
+      + mEsc([String((item && item.type) || ''), String((item && item.origin) || '')].filter(Boolean).join(' · '))
+      + '</span>'
+      + '<span class="mpc-review-where">' + mEsc(machinesPageModelsUnreachableLabel(machine, item)) + '</span>'
+      + '</li>';
+  });
+  if (!rows.length) rows.push('<li class="mpc-review-empty">Every route on this machine can be reached.</li>');
+  machinesPageModelsDelegate(machine).forEach(function (entry) {
+    var route = String((entry && entry.routeId) || '');
+    var meta = [String((entry && entry.model) || ''), route ? 'route ' + route : ''].filter(Boolean).join(' · ');
+    rows.push('<li class="mpc-review-item" data-agent="' + mEsc(String((entry && entry.agent) || '')) + '">'
+      + '<span class="mpc-review-name">' + mEsc(String((entry && entry.agent) || '')) + '</span>'
+      + '<span class="mpc-review-meta">' + mEsc(meta) + '</span>'
+      + '<span class="mpc-review-where">' + mEsc(machinesPageModelsReachLabel(machine, entry && entry.reach)) + '</span>'
+      + '</li>');
+  });
+  // WP-4: nothing unreachable → nothing to remove → no control at all (the row line is the whole
+  // block). With rows, the button is disabled until a row is ticked.
+  var remove = unreachable.length
+    ? '<div class="mpc-review-models-remove"><button type="button" class="mpc-btn mpc-danger" data-role="models-remove"'
+      + ' onclick="machinesPageReviewRemoveModels('
+      + mEsc(JSON.stringify(String((machine && machine.instanceId) || ''))) + ',this)" disabled>'
+      + 'Remove from ' + mEsc(name) + '</button></div>'
+    : '';
+  return '<section class="mpc-review-section" data-section="models"><h4>Models on '
+    + mEsc(name) + '</h4><ul>' + rows.join('') + '</ul>' + remove
+    + machinesPageReviewFromHubHtml(machine) + '</section>';
+}
+
+/** WP-4: the route ids ticked in the OPEN dialog — the only truth a Remove POST may be built from. */
+function machinesPageReviewModelsChecked() {
+  var overlay = _machinesPageDialog && _machinesPageDialog.overlay;
+  var picked = [];
+  if (overlay && typeof overlay.querySelectorAll === 'function') {
+    Array.prototype.slice.call(overlay.querySelectorAll('[data-role="models-pick"]') || []).forEach(function (box) {
+      if (box && box.checked) picked.push(String(box.value == null ? '' : box.value));
+    });
+  }
+  return picked;
+}
+
+/** WP-4: one tick or untick → the button is live exactly while something is ticked. Returns the count. */
+function machinesPageReviewModelsPicked() {
+  var overlay = _machinesPageDialog && _machinesPageDialog.overlay;
+  var count = machinesPageReviewModelsChecked().length;
+  var button = overlay && typeof overlay.querySelector === 'function'
+    ? overlay.querySelector('[data-role="models-remove"]') : null;
+  if (button) button.disabled = count === 0;
+  return count;
+}
+
+/**
+ * §8 WP-5: the "From this hub" subsection — the routes THIS hub holds that the machine does not, one
+ * row each, each row carrying its OWN "Use on <name>" button. There is no checkbox and no bulk
+ * control here (AC-5c: nothing in this dialog can copy more than one route). The list is read ONCE
+ * per open (machinesPageReviewFetchFromHub) and read again after a copy or a remove, so a route that
+ * just travelled leaves the list — and a route that just arrived joins it.
+ */
+function machinesPageReviewFromHubState(machine) {
+  var id = String((machine && machine.instanceId) || '');
+  var store = _machinesPageReview ? _machinesPageReview.fromHub : null;
+  // Nothing stored for THIS machine (or the dialog has moved on) reads as "still looking": the open
+  // path fetches straight away, so the loading line is what the first paint legitimately shows.
+  if (!store || String(store.instanceId || '') !== id) return { status: 'loading' };
+  if (store.error) return { status: 'error', error: String(store.error) };
+  return { status: 'ready', routes: Array.isArray(store.routes) ? store.routes : [] };
+}
+
+function machinesPageReviewFromHubItemsHtml(machine) {
+  if (!machinesPageModels(machine)) return ''; // no block, no subsection
+  var name = machinesPageSkillsMachineName(machine);
+  var id = String((machine && machine.instanceId) || '');
+  var view = machinesPageReviewFromHubState(machine);
+  if (view.status === 'loading') {
+    return '<li class="mpc-review-empty">' + mEsc('Looking for routes this hub has that ' + name + ' lacks…') + '</li>';
+  }
+  if (view.status === 'error') return '<li class="mpc-review-note">' + mEsc(view.error) + '</li>';
+  if (!view.routes.length) {
+    return '<li class="mpc-review-empty">' + mEsc('This hub has no other routes ' + name + ' could use.') + '</li>';
+  }
+  return view.routes.map(function (route) {
+    var routeId = String((route && route.id) || '');
+    var label = String((route && route.name) || '') || routeId;
+    var origin = String((route && route.origin) || '');
+    var meta = [String((route && route.type) || ''), origin].filter(Boolean).join(' · ');
+    // The button names its route and the origin the row was PAINTED with: the copy carries that
+    // origin as `expectOrigin`, so a route that moved on the hub is refused instead of copied.
+    return '<li class="mpc-review-item" data-hub-route="' + mEsc(routeId) + '">'
+      + '<span class="mpc-review-name">' + mEsc(label) + '</span>'
+      + '<span class="mpc-review-meta">' + mEsc(meta) + '</span>'
+      + '<span class="mpc-review-actions"><button type="button" class="mpc-btn mpc-primary" data-role="models-copy"'
+      + ' data-route-id="' + mEsc(routeId) + '" data-origin="' + mEsc(origin) + '"'
+      + ' onclick="machinesPageReviewCopyModel(' + mEsc(JSON.stringify(id)) + ',this)">'
+      + 'Use on ' + mEsc(name) + '</button></span></li>';
+  }).join('');
+}
+
+function machinesPageReviewFromHubHtml(machine) {
+  if (!machinesPageModels(machine)) return '';
+  return '<div class="mpc-review-from-hub" data-section="from-hub"><h5>From this hub</h5>'
+    + '<ul class="mpc-review-list" data-role="from-hub">' + machinesPageReviewFromHubItemsHtml(machine) + '</ul></div>';
+}
+
+/** The subsection's live node in the OPEN dialog — null when the dialog is gone or is not a models one. */
+function machinesPageReviewFromHubNode() {
+  var overlay = _machinesPageDialog && _machinesPageDialog.overlay;
+  if (!overlay || typeof overlay.querySelector !== 'function') return null;
+  return overlay.querySelector('[data-role="from-hub"]');
+}
+
+/** Repaint ONLY the list: the rest of the dialog (and the note the action just wrote) stays put. */
+function machinesPageReviewFromHubPaint() {
+  var machine = machinesPageMachineById(_machinesPageReview && _machinesPageReview.instanceId);
+  var node = machinesPageReviewFromHubNode();
+  if (!node || !machinesPageModels(machine)) return false;
+  node.innerHTML = machinesPageReviewFromHubItemsHtml(machine);
+  return true;
+}
+
+/**
+ * WP-5: ONE read of `models/copyable` per open, stored in the open-dialog state under this machine's
+ * id. A refusal is the server's own code and is SHOWN, never retried — there is no timer here.
+ */
+function machinesPageReviewFetchFromHub(instanceId) {
+  var id = String(instanceId == null ? '' : instanceId);
+  if (!id) return Promise.resolve(false);
+  _machinesPageReview.fromHub = { instanceId: id, loading: true };
+  machinesPageReviewFromHubPaint();
+  return machinesPageJson(machinesPageUrl('/api/machines/' + encodeURIComponent(id) + '/models/copyable'))
+    .then(function (result) {
+      if (String(_machinesPageReview.instanceId) !== id) return false; // the dialog moved on meanwhile
+      _machinesPageReview.fromHub = result.ok
+        ? { instanceId: id, routes: (result.data && Array.isArray(result.data.routes)) ? result.data.routes : [] }
+        : { instanceId: id, error: machinesPageServerError(result.data, result.status) };
+      machinesPageReviewFromHubPaint();
+      return !!result.ok;
+    })
+    .catch(function (error) {
+      // REPORT: the subsection says why it is empty; the dialog stays open and nothing is retried.
+      if (String(_machinesPageReview.instanceId) !== id) return false;
+      _machinesPageReview.fromHub = {
+        instanceId: id,
+        error: 'Could not reach the hub: ' + ((error && error.message) || 'fetch failed'),
+      };
+      machinesPageReviewFromHubPaint();
+      return false;
+    });
+}
+
+/** The name a row was painted with — the success note says what travelled, in the user's own words. */
+function machinesPageReviewFromHubRouteName(routeId) {
+  var store = _machinesPageReview ? _machinesPageReview.fromHub : null;
+  var routes = (store && Array.isArray(store.routes)) ? store.routes : [];
+  var match = routes.filter(function (route) {
+    return String((route && route.id) || '') === String(routeId == null ? '' : routeId);
+  })[0];
+  return String((match && match.name) || '') || String(routeId == null ? '' : routeId);
+}
+
+function machinesPageReviewDialogHtml(machine) {
+  return '<div class="machine-modal mpc-review-modal" role="dialog" aria-modal="true" aria-labelledby="mpc-review-title">'
+    + '<h3 id="mpc-review-title">' + mEsc(machinesPageReviewTitle(machine)) + '</h3>'
+    + '<p class="machine-modal-sub">'
+    + mEsc(machinesPageSkillsLineText(machine) || machinesPageModelsLineText(machine)) + '</p>'
+    + '<div class="mpc-review-note" data-role="review-note" role="status" aria-live="polite"></div>'
+    + machinesPageReviewHeldBackHtml(machine)
+    + machinesPageReviewOnBoxHtml(machine)
+    + machinesPageReviewPluginsHtml(machine)
+    + machinesPageReviewModelsHtml(machine)
+    + '<div class="machine-modal-actions"><button type="button" class="mpc-btn" onclick="closeMachinesPageDialog()">Close</button></div>'
+    + '</div>';
+}
+
+// ── diff rendering (the LCS line diff is public/js/prompt-diff.js — never a second copy) ────────
+var MACHINES_PAGE_DIFF_LINE_CAP = 400;
+
+function machinesPageDiffOps(hubText, boxText) {
+  var diff = typeof PromptDiff !== 'undefined' && PromptDiff && typeof PromptDiff.diffLines === 'function'
+    ? PromptDiff
+    : (typeof window !== 'undefined' ? window.PromptDiff : null);
+  if (!diff || typeof diff.diffLines !== 'function') return null;
+  return diff.diffLines(hubText == null ? '' : String(hubText), boxText == null ? '' : String(boxText));
+}
+
+function machinesPageDiffFileHtml(boxFile, hubFile) {
+  var filePath = String((boxFile && boxFile.path) || (hubFile && hubFile.path) || '');
+  var size = Number((boxFile && boxFile.size) || (hubFile && hubFile.size) || 0);
+  var head = '<p class="mpc-diff-file">' + mEsc(filePath) + '</p>';
+  if ((boxFile && boxFile.binary) || (hubFile && hubFile.binary)) {
+    return head + '<p class="mpc-diff-binary">' + mEsc('binary file, ' + machinesFormatBytes(size)) + '</p>';
+  }
+  var ops = machinesPageDiffOps(hubFile ? hubFile.text : '', boxFile ? boxFile.text : '');
+  if (!ops) return head + '<p class="mpc-diff-binary">' + mEsc('binary file, ' + machinesFormatBytes(size)) + '</p>';
+  var shown = ops.slice(0, MACHINES_PAGE_DIFF_LINE_CAP);
+  var lines = shown.map(function (op) {
+    var cls = op.type === 'add' ? 'mpc-diff-add' : (op.type === 'del' ? 'mpc-diff-del' : 'mpc-diff-eq');
+    var sign = op.type === 'add' ? '+' : (op.type === 'del' ? '-' : ' ');
+    return '<span class="' + cls + '">' + mEsc(sign + ' ' + op.text) + '</span>';
+  }).join('');
+  var more = ops.length > shown.length
+    ? '<p class="mpc-review-note">' + mEsc('… ' + (ops.length - shown.length) + ' more lines') + '</p>'
+    : '';
+  return head + '<div class="mpc-diff">' + lines + '</div>' + more;
+}
+
+/** A preview payload → the per-file diff markup. Pure, so the dialog is testable without a socket. */
+function machinesPageDiffHtml(preview) {
+  var boxFiles = (preview && preview.box && Array.isArray(preview.box.files)) ? preview.box.files : [];
+  var hubFiles = (preview && preview.hub && Array.isArray(preview.hub.files)) ? preview.hub.files : [];
+  var hubByName = {};
+  hubFiles.forEach(function (file) { if (file && file.path) hubByName[String(file.path)] = file; });
+  var seen = {};
+  var out = boxFiles.map(function (file) {
+    var key = String((file && file.path) || '');
+    seen[key] = true;
+    return machinesPageDiffFileHtml(file, hubByName[key] || null);
+  });
+  hubFiles.forEach(function (file) {
+    var key = String((file && file.path) || '');
+    if (seen[key]) return;
+    out.push('<p class="mpc-diff-file">' + mEsc(key) + '</p><p class="mpc-diff-binary">'
+      + mEsc('only on this hub — importing replaces it (a backup is kept)') + '</p>');
+  });
+  return out.join('') || '<p class="mpc-review-empty">No files on either side.</p>';
+}
+
+// ── the Review dialog's wiring (AC-9a: an action re-reads /api/machines and repaints IN PLACE) ───
+// Every write here is one of the three WP-8 routes; the dialog never holds a copy of the list, so a
+// successful action cannot leave the row showing yesterday's numbers. Nothing calls location.reload().
+var _machinesPageReview = { instanceId: '', skipped: {}, fromHub: null };
+
+function machinesPageMachineById(instanceId) {
+  var id = String(instanceId == null ? '' : instanceId);
+  return _machinesPageState.machines.find(function (machine) {
+    return String((machine && machine.instanceId) || '') === id;
+  }) || null;
+}
+
+function machinesPageReviewNote(text, kind) {
+  var overlay = _machinesPageDialog && _machinesPageDialog.overlay;
+  var node = overlay && typeof overlay.querySelector === 'function'
+    ? overlay.querySelector('[data-role="review-note"]') : null;
+  if (!node) return;
+  node.textContent = String(text || '');
+  node.classList.toggle('bad', kind !== 'ok');
+}
+
+/** Buttons are disabled while their own request is in flight (a double-tap must not double-post). */
+function _machinesPageReviewBusy(button, busy) {
+  if (!button || typeof button !== 'object') return;
+  button.disabled = !!busy;
+  if (typeof button.setAttribute === 'function') button.setAttribute('aria-busy', busy ? 'true' : 'false');
+}
+
+function machinesPageReviewItemKey(agent, name) {
+  return String(agent || '') + ':' + String(name || '');
+}
+
+/** Client-only Skip: the item leaves this dialog and stays gone across a repaint — no server call. */
+function machinesPageReviewSkip(instanceId, agent, name) {
+  var key = machinesPageReviewItemKey(agent, name);
+  _machinesPageReview.skipped[key] = true;
+  var overlay = _machinesPageDialog && _machinesPageDialog.overlay;
+  if (overlay && typeof overlay.querySelector === 'function') {
+    var item = overlay.querySelector('.mpc-review-item[data-key="' + key.replace(/"/g, '\\"') + '"]');
+    if (item) item.hidden = true;
+  }
+  return key;
+}
+
+function _machinesPageReviewApplySkips() {
+  var overlay = _machinesPageDialog && _machinesPageDialog.overlay;
+  if (!overlay || typeof overlay.querySelectorAll !== 'function') return;
+  var items = overlay.querySelectorAll('.mpc-review-item[data-key]');
+  Array.prototype.slice.call(items || []).forEach(function (item) {
+    var key = typeof item.getAttribute === 'function' ? item.getAttribute('data-key') : null;
+    if (key && _machinesPageReview.skipped[key]) item.hidden = true;
+  });
+}
+
+function machinesPageReviewPaint() {
+  var overlay = _machinesPageDialog && _machinesPageDialog.overlay;
+  if (!overlay) return null;
+  var machine = machinesPageMachineById(_machinesPageReview.instanceId);
+  if (!machinesPageReviewOpenable(machine)) { closeMachinesPageDialog(); return null; }
+  overlay.innerHTML = machinesPageReviewDialogHtml(machine);
+  _machinesPageReviewApplySkips(overlay);
+  return machine;
+}
+
+function machinesPageOpenReview(instanceId) {
+  var id = String(instanceId == null ? '' : instanceId);
+  var machine = machinesPageMachineById(id);
+  if (!machinesPageReviewOpenable(machine)) return null;
+  closeMachinesPageDialog();
+  _machinesPageReview = { instanceId: id, skipped: {}, fromHub: null };
+  var overlay = _machinesPageMountDialog(machinesPageReviewDialogHtml(machine));
+  _machinesPageDialog = { overlay: overlay, review: true };
+  // WP-5: one read of the hub's copyable routes per open — the dialog is already painted, so the
+  // subsection shows "Looking for…" until this lands.
+  machinesPageReviewFetchFromHub(id);
+  return _machinesPageDialog;
+}
+
+/** AC-9a: re-read the list, repaint the row, and repaint the OPEN dialog — never a page reload. */
+function machinesPageReviewRefresh() {
+  return machinesPageJson(machinesPageUrl('/api/machines')).then(function (list) {
+    if (list && list.ok) {
+      _machinesPageState.machines = (list.data && Array.isArray(list.data.machines)) ? list.data.machines : [];
+      _machinesPageState.hubNetworkSuspect = !!(list.data && list.data.hubNetworkSuspect);
+      renderMachinesPage();
+    }
+    machinesPageReviewPaint();
+    return true;
+  }).catch(function () {
+    // REPORT: the dialog says why it could not refresh; it stays open with what it has.
+    machinesPageReviewNote('Could not re-read the machine list — close and reopen Review.');
+    return false;
+  });
+}
+
+/**
+ * AC-8c/AC-9a: Import (POST .../skills/import) or "Use the laptop's copy" (POST .../skills/retire).
+ * `expectBoxHash` is the hash the user is looking at, so the server can refuse a box that moved on.
+ */
+function machinesPageReviewAction(instanceId, agent, name, boxHash, action, button) {
+  var id = String(instanceId || '');
+  var verb = String(action) === 'retire' ? 'retire' : 'import';
+  var body = { agent: String(agent || ''), name: String(name || '') };
+  if (boxHash) body.expectBoxHash = String(boxHash);
+  _machinesPageReviewBusy(button, true);
+  return machinesPageJson(
+    machinesPageUrl('/api/machines/' + encodeURIComponent(id) + '/skills/' + verb),
+    { method: 'POST', body: body },
+  ).then(function (result) {
+    _machinesPageReviewBusy(button, false);
+    if (!result.ok) return _machinesPageReviewActionFailed(result);
+    machinesPageToast(verb === 'import'
+      ? 'Imported ' + String(name || '') + ' from this machine.'
+      : 'This machine now uses the laptop’s copy of ' + String(name || '') + '.');
+    delete _machinesPageReview.skipped[machinesPageReviewItemKey(agent, name)];
+    return machinesPageReviewRefresh();
+  }).catch(function (error) {
+    // REPORT: a transport failure is shown in the dialog, which stays open for a retry.
+    _machinesPageReviewBusy(button, false);
+    machinesPageReviewNote('Could not reach the hub: ' + ((error && error.message) || 'fetch failed'));
+    return false;
+  });
+}
+
+function _machinesPageReviewActionFailed(result) {
+  var data = result && result.data;
+  var code = String((data && (data.error || data.code)) || '');
+  if (Number(result && result.status) === 409 || code.indexOf('agent_skill_changed') !== -1) {
+    machinesPageReviewNote('This skill changed on the box since you opened Review — reopen to see the new version.');
+    return machinesPageReviewRefresh();
+  }
+  machinesPageReviewNote(machinesPageServerError(data, result && result.status));
+  return false;
+}
+
+/**
+ * §8 WP-4: "Remove from <machine>" — the box deletes these routes and the keys it holds for them.
+ * The hub keeps its own copies, which is exactly what the confirm says before anything is sent; a
+ * cancelled confirm is not a request. Only the TICKED ids travel, and the list is re-read after.
+ */
+function machinesPageReviewRemoveModels(instanceId, button) {
+  var id = String(instanceId == null ? '' : instanceId);
+  var name = machinesPageSkillsMachineName(machinesPageMachineById(id));
+  var routeIds = machinesPageReviewModelsChecked();
+  if (!routeIds.length) return Promise.resolve(false); // nothing ticked → nothing to send
+  if (typeof confirm === 'function'
+    && !confirm('Deletes these routes and their keys from ' + name + '. This hub keeps its own copies.')) {
+    return Promise.resolve(false);
+  }
+  _machinesPageReviewBusy(button, true);
+  return machinesPageJson(
+    machinesPageUrl('/api/machines/' + encodeURIComponent(id) + '/models/remove'),
+    { method: 'POST', body: { routeIds: routeIds } },
+  ).then(function (result) {
+    _machinesPageReviewBusy(button, false);
+    if (!result.ok) { machinesPageReviewNote(machinesPageServerError(result.data, result.status)); return false; }
+    var data = result.data || {};
+    var removed = Array.isArray(data.removed) ? data.removed.length : routeIds.length;
+    var missing = Array.isArray(data.missing) ? data.missing.length : 0;
+    // The note goes AFTER the reload: the reload repaints the dialog and would wipe a note set first.
+    // WP-5: the removals also change what this hub can offer, hence the reload of both lists.
+    return machinesPageReviewReload().then(function (reloaded) {
+      machinesPageReviewNote('Removed ' + removed + ' from ' + name + (missing ? ' · ' + missing + ' already gone' : ''), 'ok');
+      return reloaded;
+    });
+  }).catch(function (error) {
+    // REPORT: a transport failure is shown in the dialog, which stays open for a retry.
+    _machinesPageReviewBusy(button, false);
+    machinesPageReviewNote('Could not reach the hub: ' + ((error && error.message) || 'fetch failed'));
+    return false;
+  });
+}
+
+/** WP-5: after a copy or a remove, re-read BOTH the list and the routes this hub could still offer. */
+function machinesPageReviewReload() {
+  var id = String((_machinesPageReview && _machinesPageReview.instanceId) || '');
+  return machinesPageReviewRefresh().then(function () {
+    return machinesPageReviewFetchFromHub(id);
+  });
+}
+
+/**
+ * §8 WP-5 / AC-5c: "Use on <name>" — copies THIS one route and its key to the machine, and nothing
+ * else; there is no control anywhere in this dialog that copies two routes at once. The confirm says
+ * exactly that before anything is sent, and `expectOrigin` is the origin the row was painted with, so
+ * a route that moved on the hub is refused instead of copied.
+ */
+function machinesPageReviewCopyModel(instanceId, button) {
+  var id = String(instanceId == null ? '' : instanceId);
+  var name = machinesPageSkillsMachineName(machinesPageMachineById(id));
+  var attr = function (key) {
+    return button && typeof button.getAttribute === 'function' ? String(button.getAttribute(key) || '') : '';
+  };
+  var routeId = attr('data-route-id');
+  var origin = attr('data-origin');
+  if (!routeId) return Promise.resolve(false); // no route on the row → nothing to copy
+  var label = machinesPageReviewFromHubRouteName(routeId);
+  if (typeof confirm === 'function'
+    && !confirm('Copies this route and its key to ' + name + '. Only this route is copied.')) {
+    return Promise.resolve(false);
+  }
+  _machinesPageReviewBusy(button, true);
+  return machinesPageJson(
+    machinesPageUrl('/api/machines/' + encodeURIComponent(id) + '/models/copy'),
+    { method: 'POST', body: { routeId: routeId, expectOrigin: origin } },
+  ).then(function (result) {
+    _machinesPageReviewBusy(button, false);
+    if (!result.ok) { machinesPageReviewNote(machinesPageServerError(result.data, result.status)); return false; }
+    // After the reload, which repaints the dialog (a note set first would be wiped).
+    return machinesPageReviewReload().then(function (reloaded) {
+      machinesPageReviewNote('Copied ' + label + ' to ' + name, 'ok');
+      return reloaded;
+    });
+  }).catch(function (error) {
+    // REPORT: a transport failure is shown in the dialog, which stays open for a retry.
+    _machinesPageReviewBusy(button, false);
+    machinesPageReviewNote('Could not reach the hub: ' + ((error && error.message) || 'fetch failed'));
+    return false;
+  });
+}
+
+/** §9 S-9: checked = excluded. PUT replaces the list wholesale (the route's own contract). */
+function machinesPageReviewSavePlugins(instanceId, button) {
+  var id = String(instanceId || '');
+  var overlay = _machinesPageDialog && _machinesPageDialog.overlay;
+  var excluded = [];
+  if (overlay && typeof overlay.querySelectorAll === 'function') {
+    Array.prototype.slice.call(overlay.querySelectorAll('.mpc-review-plugins input') || []).forEach(function (box) {
+      if (box && box.checked) excluded.push(String(box.value == null ? '' : box.value));
+    });
+  }
+  _machinesPageReviewBusy(button, true);
+  return machinesPageJson(
+    machinesPageUrl('/api/machines/' + encodeURIComponent(id) + '/skills/exclude-plugins'),
+    { method: 'PUT', body: { plugins: excluded } },
+  ).then(function (result) {
+    _machinesPageReviewBusy(button, false);
+    if (!result.ok) { machinesPageReviewNote(machinesPageServerError(result.data, result.status)); return false; }
+    machinesPageToast(excluded.length ? 'Plugins saved — ' + excluded.length + ' not sent to this machine.' : 'Plugins saved — every plugin is sent to this machine.');
+    return machinesPageReviewRefresh();
+  }).catch(function (error) {
+    _machinesPageReviewBusy(button, false);
+    machinesPageReviewNote('Could not reach the hub: ' + ((error && error.message) || 'fetch failed'));
+    return false;
+  });
+}
+
+function _machinesPageReviewDiffNode(agent, name) {
+  var overlay = _machinesPageDialog && _machinesPageDialog.overlay;
+  if (!overlay || typeof overlay.querySelector !== 'function') return null;
+  var key = machinesPageReviewItemKey(agent, name).replace(/"/g, '\\"');
+  var item = overlay.querySelector('.mpc-review-item[data-key="' + key + '"]');
+  return item && typeof item.querySelector === 'function' ? item.querySelector('.mpc-review-diff') : null;
+}
+
+/** AC-9b: the diff is the hub's copy vs the box's, rendered by public/js/prompt-diff.js (desktop) —
+ *  the same module the phone lazy-loads, never a second algorithm. */
+function machinesPageShowDiff(instanceId, agent, name, button) {
+  var id = String(instanceId || '');
+  var node = _machinesPageReviewDiffNode(agent, name);
+  if (node && !node.hidden) { node.hidden = true; return Promise.resolve(true); }
+  _machinesPageReviewBusy(button, true);
+  return machinesPageJson(machinesPageUrl(
+    '/api/machines/' + encodeURIComponent(id) + '/skills/preview?agent=' + encodeURIComponent(String(agent || ''))
+    + '&name=' + encodeURIComponent(String(name || '')),
+  )).then(function (result) {
+    _machinesPageReviewBusy(button, false);
+    node = _machinesPageReviewDiffNode(agent, name);
+    if (!node) return false;
+    node.hidden = false;
+    node.innerHTML = result.ok
+      ? machinesPageDiffHtml(result.data)
+      : '<p class="mpc-review-note">' + mEsc(machinesPageServerError(result.data, result.status)) + '</p>';
+    return !!result.ok;
+  }).catch(function (error) {
+    _machinesPageReviewBusy(button, false);
+    node = _machinesPageReviewDiffNode(agent, name);
+    if (node) {
+      node.hidden = false;
+      node.innerHTML = '<p class="mpc-review-note">' + mEsc('Could not reach the hub: ' + ((error && error.message) || 'fetch failed')) + '</p>';
+    }
+    return false;
+  });
+}
+
+// ── WP-4: hub-bridge access (R-11 trust, R-4 grants, R-5 pending, R-9 audit, R-13 the UI) ─────────
+// Everything here is the Machines page's half of docs/remote-session-hub-bridge-2026-10-30.html: the
+// per-card "Can use this Mac: Ask · Always · Never" select (R-11), the card's Access block (active
+// grants with [Revoke], open asks with the 4-way grant card + [Deny], and the last 20 audit lines), the page-level
+// "Trust all my machines" switch, and the pane-overlay banner an open ask paints (AC-2g). Every
+// route is user-principal only (§6.2, no peerControl), so a 403 here is the server refusing a
+// non-admin session — shown as-is, never retried.
+//
+// No innerHTML of a server string: every value goes through mEsc.
+
+// The Access block's HTML, the effective-policy rule and the request bodies are ONE copy, in
+// public/js/machine-pool-shared.js (loaded before this file): the phone Machines card calls the same
+// builders with its own escaper and its own `mp-*` class names. What is left here is this page's
+// state, its reads and its delegated wiring.
+var MACHINES_PAGE_ACCESS_OPTS = { esc: mEsc };
+
+/** R-11: this page's effective policy for a machine (its own row, else the file default). */
+function machinesPageTrustValueFor(instanceId) {
+  return machineEffectiveTrust(_machinesPageState.access, instanceId);
+}
+
+/** Fold the two GET bodies into state. A failed/missing read leaves the surface empty, never stale. */
+function machinesPageApplyAccess(trustResult, grantsResult) {
+  var trust = (trustResult && trustResult.ok && trustResult.data) ? trustResult.data : null;
+  var payload = (grantsResult && grantsResult.ok && grantsResult.data) ? grantsResult.data : null;
+  _machinesPageState.access = trust
+    ? {
+      v: 1,
+      default: MACHINES_PAGE_TRUST_VALUES.indexOf(String(trust.default || '')) !== -1 ? String(trust.default) : MACHINES_PAGE_TRUST_DEFAULT,
+      machines: (trust.machines && typeof trust.machines === 'object') ? trust.machines : {},
+    }
+    : null;
+  var grants = (payload && Array.isArray(payload.grants)) ? payload.grants : [];
+  var pending = (payload && Array.isArray(payload.pending)) ? payload.pending : [];
+  _machinesPageState.accessPendingIndex = Object.create(null);
+  for (var i = 0; i < pending.length; i += 1) {
+    var row = pending[i];
+    if (row && row.id) _machinesPageState.accessPendingIndex[String(row.id)] = row;
+  }
+  _machinesPageState.accessGrants = grants;
+  _machinesPageState.accessPending = pending;
+  return true;
+}
+
+function machinesPageGrantsFor(instanceId) {
+  return machineAccessRowsFor(_machinesPageState.accessGrants, instanceId);
+}
+
+function machinesPagePendingFor(instanceId) {
+  return machineAccessRowsFor(_machinesPageState.accessPending, instanceId);
+}
+
+/** R-13: the last 20 audit lines for every member, in one round of reads (never This Mac's own). */
+function machinesPageLoadAccessAudits() {
+  var rows = _machinesPageState.machines.filter(function (machine) { return machine && machine.instanceId; });
+  return Promise.all(rows.map(function (machine) {
+    var id = String(machine.instanceId);
+    return machinesPageJson(machinesPageUrl('/api/hub-bridge/audit', 'machineId=' + encodeURIComponent(id) + '&limit=' + MACHINES_PAGE_AUDIT_LIMIT))
+      .then(function (result) {
+        _machinesPageState.accessAudit[id] = (result.ok && result.data && Array.isArray(result.data.entries)) ? result.data.entries : [];
+        return null;
+      })
+      .catch(function () {
+        // HANDLE: one machine's history is decoration; its card still renders from the other reads.
+        _machinesPageState.accessAudit[id] = [];
+        return null;
+      });
+  }));
+}
+
+/** Re-read trust + grants + audit and repaint (after any action, and on both WS frames). */
+function machinesPageRefreshAccess() {
+  var panel = (typeof document !== 'undefined' && document) ? document.getElementById('machines-panel') : null;
+  if (!panel || typeof fetch !== 'function') return Promise.resolve(false);
+  return Promise.all([
+    machinesPageJson(machinesPageUrl('/api/hub-bridge/trust')),
+    machinesPageJson(machinesPageUrl('/api/hub-bridge/grants')),
+  ]).then(function (results) {
+    machinesPageApplyAccess(results[0], results[1]);
+    return machinesPageLoadAccessAudits();
+  }).then(function () {
+    renderMachinesPage();
+    return true;
+  }).catch(function () {
+    // REPORT: a transport fault is not a silent success; the page keeps its last honest paint.
+    machinesPageToast('hub_bridge_unavailable');
+    return false;
+  });
+}
+
+// ── the trust select + the page switch (R-11, R-13) ───────────────────────────────────────────────
+function machinesPageTrustAllHtml() {
+  return machineTrustAllHtml(_machinesPageState.access, MACHINES_PAGE_ACCESS_OPTS);
+}
+
+function machinesPageTrustSelectHtml(instanceId) {
+  return machineTrustSelectHtml(instanceId, _machinesPageState.access, MACHINES_PAGE_ACCESS_OPTS);
+}
+
+/** R-11: PUT one machine's row. The server validates the value; a refusal is shown, never swallowed. */
+function machinesPageTrustChange(instanceId, value, select) {
+  var id = String(instanceId || '');
+  var body = hubBridgeTrustBody(id, value);
+  return machinesPageJson(machinesPageUrl('/api/hub-bridge/trust'), { method: 'PUT', body: body })
+    .then(function (result) {
+      if (!result.ok) {
+        machinesPageToast(machinesPageServerError(result.data, result.status));
+        if (select) {
+          // Put the control back where the server still says it is (the last honest policy).
+          select.value = machinesPageTrustValueFor(id);
+        }
+        return false;
+      }
+      machinesPageToast('');
+      return machinesPageRefreshAccess();
+    })
+    .catch(function (error) {
+      // REPORT: an unreachable hub must not look like a saved policy.
+      machinesPageToast((error && error.message) || 'trust_write_failed');
+      return false;
+    });
+}
+
+/** R-13: the page switch writes the trust file DEFAULT ('always' on, 'ask' off). */
+function machinesPageTrustAll(on) {
+  return machinesPageJson(machinesPageUrl('/api/hub-bridge/trust'), { method: 'PUT', body: hubBridgeTrustAllBody(on) })
+    .then(function (result) {
+      if (!result.ok) {
+        machinesPageToast(machinesPageServerError(result.data, result.status));
+        return false;
+      }
+      machinesPageToast('');
+      return machinesPageRefreshAccess();
+    })
+    .catch(function (error) {
+      machinesPageToast((error && error.message) || 'trust_write_failed');
+      return false;
+    });
+}
+
+// ── the Access block (R-13) ───────────────────────────────────────────────────────────────────────
+function machinesPageAccessBlockHtml(machine) {
+  var m = machine || {};
+  var id = String(m.instanceId || '');
+  if (!id) return '';
+  return machineAccessBlockHtml(id, {
+    trust: _machinesPageState.access,
+    grants: machinesPageGrantsFor(id),
+    pending: machinesPagePendingFor(id),
+    audit: Array.isArray(_machinesPageState.accessAudit[id]) ? _machinesPageState.accessAudit[id] : [],
+    now: machinesPageNow(),
+  }, MACHINES_PAGE_ACCESS_OPTS);
+}
+
+// ── the three writes (R-4/R-5) ────────────────────────────────────────────────────────────────────
+/** The pending row's own machine/session/tier is what is granted — never the card's id. */
+function machinesPagePendingRow(pendingId) {
+  var key = String(pendingId || '');
+  if (!key) return null;
+  return _machinesPageState.accessPendingIndex[key] || _machinesPageBanners[key] || null;
+}
+
+/** Answer the ask: POST the grant its own tier names, in the scope and for the duration it names (D-1). */
+function machinesPageAccessAllow(instanceId, pendingId, grant) {
+  var row = machinesPagePendingRow(pendingId);
+  if (!row) {
+    machinesPageToast('pending_not_found');
+    return Promise.resolve(false);
+  }
+  var call = hubBridgeAnswerCall(row, instanceId, grant);
+  return machinesPageJson(machinesPageUrl(call[0]), call[1]).then(function (result) {
+    if (!result.ok) {
+      machinesPageToast(machinesPageServerError(result.data, result.status));
+      return false;
+    }
+    machinesPageToast('');
+    delete _machinesPageBanners[String(pendingId)];
+    machinesPagePaintHubBridgeBanners();
+    return machinesPageRefreshAccess();
+  }).catch(function (error) {
+    machinesPageToast((error && error.message) || 'grant_failed');
+    return false;
+  });
+}
+
+function machinesPageAccessDeny(pendingId) {
+  var key = String(pendingId || '');
+  if (!key) return Promise.resolve(false);
+  return machinesPageJson(machinesPageUrl(hubBridgeDenyPath(key)), { method: 'POST', body: {} })
+    .then(function (result) {
+      if (!result.ok) {
+        machinesPageToast(machinesPageServerError(result.data, result.status));
+        return false;
+      }
+      machinesPageToast('');
+      delete _machinesPageBanners[key];
+      machinesPagePaintHubBridgeBanners();
+      return machinesPageRefreshAccess();
+    })
+    .catch(function (error) {
+      machinesPageToast((error && error.message) || 'deny_failed');
+      return false;
+    });
+}
+
+/** DELETE with the (machine, session, tier) triple — the server drops that tier and everything below it. */
+function machinesPageAccessRevoke(instanceId, callerSessionId, tier) {
+  return machinesPageJson(machinesPageUrl('/api/hub-bridge/grants'), {
+    method: 'DELETE',
+    body: hubBridgeRevokeBody(instanceId, callerSessionId, tier),
+  }).then(function (result) {
+    if (!result.ok) {
+      machinesPageToast(machinesPageServerError(result.data, result.status));
+      return false;
+    }
+    machinesPageToast('');
+    return machinesPageRefreshAccess();
+  }).catch(function (error) {
+    machinesPageToast((error && error.message) || 'revoke_failed');
+    return false;
+  });
+}
+
+// ── AC-2g: the pane overlay an open ask paints (docs/hub-bridge-approval-banner-cutoff-2026-10-31.html)
+// Absolute in the session's .term-container — never a toolbar / tab-strip row (that crushed the tabs).
+/** The banner's markup is the shared one (js/machine-pool-shared.js), so the phone says the same thing. */
+function hubBridgePendingBannerHtml(row) {
+  return hubBridgeBannerHtml(row, MACHINES_PAGE_ACCESS_OPTS);
+}
+
+function machinesPageBannerAllow(pendingId, grant) {
+  return machinesPageAccessAllow('', pendingId, grant);
+}
+
+function machinesPageBannerDeny(pendingId) {
+  return machinesPageAccessDeny(pendingId);
+}
+
+/** Is this session one the page shows? (the banner belongs to a mirror row the user can see) */
+function machinesPageSessionShown(sessionId) {
+  var sid = String(sessionId || '');
+  if (!sid) return false;
+  if (typeof state === 'undefined' || !state || !state.sessions) return false;
+  var sessions = state.sessions;
+  if (sessions && typeof sessions.has === 'function') return sessions.has(sid);
+  if (Array.isArray(sessions)) return sessions.some(function (row) { return String((row && row.id) || '') === sid; });
+  return false;
+}
+
+/** The pane the asking session's banner overlays: its own .term-container, wherever its toolbar is. */
+function machinesPageBannerHostFor(sessionId) {
+  var sid = String(sessionId || '');
+  if (!sid) return null;
+  if (typeof document === 'undefined' || !document || typeof document.querySelector !== 'function') return null;
+  var escaped = (typeof window !== 'undefined' && window.CSS && typeof CSS.escape === 'function')
+    ? CSS.escape(sid)
+    : sid.replace(/["\\]/g, '\\$&');
+  return document.querySelector('.term-container[data-session-id="' + escaped + '"]');
+}
+
+/**
+ * Repaint every banner: one per shown session with an open ask, removed for every session whose ask
+ * was answered or cleared. Idempotent — safe to call from the seed, a frame, or after an action.
+ */
+function machinesPagePaintHubBridgeBanners() {
+  if (typeof document === 'undefined' || !document) return 0;
+  var bySession = Object.create(null);
+  Object.keys(_machinesPageBanners).forEach(function (id) {
+    var row = _machinesPageBanners[id];
+    var sid = row && row.callerSessionId ? String(row.callerSessionId) : '';
+    if (!sid || !machinesPageSessionShown(sid)) return;
+    if (!bySession[sid]) bySession[sid] = row;
+  });
+  var painted = 0;
+  Object.keys(bySession).forEach(function (sid) {
+    var host = machinesPageBannerHostFor(sid);
+    if (!host) return;
+    var node = (typeof host.querySelector === 'function') ? host.querySelector(':scope > .hub-bridge-banner') : null;
+    if (!node) {
+      if (typeof document.createElement !== 'function') return;
+      node = document.createElement('div');
+      node.className = 'hub-bridge-banner';
+      node.dataset.sessionId = sid;
+      node.setAttribute('role', 'alert');
+      if (typeof host.appendChild === 'function') host.appendChild(node);
+    }
+    node.innerHTML = hubBridgePendingBannerHtml(bySession[sid]);
+    painted += 1;
+  });
+  // Drop the banners whose ask is gone (or whose session the page no longer shows).
+  if (typeof document.querySelectorAll === 'function') {
+    var nodes = document.querySelectorAll('.hub-bridge-banner');
+    for (var i = 0; i < (nodes ? nodes.length : 0); i += 1) {
+      var banner = nodes[i];
+      var bannerId = String((banner.dataset && banner.dataset.sessionId) || '');
+      if (bySession[bannerId]) continue;
+      if (banner.parentNode && typeof banner.parentNode.removeChild === 'function') banner.parentNode.removeChild(banner);
+    }
+  }
+  return painted;
+}
+
+/** AC-2g: a `hub-bridge-pending` frame paints the banner on the session it names. */
+function onHubBridgePending(frame) {
+  var row = frame && frame.pending;
+  if (!row || !row.id) return false;
+  _machinesPageBanners[String(row.id)] = row;
+  machinesPagePaintHubBridgeBanners();
+  if (machinesPagePanelOpen()) machinesPageRefreshAccess();
+  return true;
+}
+
+/** AC-2g: a `hub-bridge-pending-cleared` frame hides every banner it names. */
+function onHubBridgePendingCleared(frame) {
+  var ids = (frame && Array.isArray(frame.ids)) ? frame.ids : [];
+  if (!ids.length) return false;
+  for (var i = 0; i < ids.length; i += 1) delete _machinesPageBanners[String(ids[i] || '')];
+  machinesPagePaintHubBridgeBanners();
+  if (machinesPagePanelOpen()) machinesPageRefreshAccess();
+  return true;
+}
+
+function machinesPagePanelOpen() {
+  if (typeof document === 'undefined' || !document || typeof document.getElementById !== 'function') return false;
+  var panel = document.getElementById('machines-panel');
+  return !!(panel && panel.style && panel.style.display !== 'none');
+}
+
+// ── the delegated wiring (one pair of listeners for every render) ─────────────────────────────────
+// The shared builders mark every control with `data-hub-bridge-*` instead of an inline handler, so a
+// card repaint, the toolbar banner and the audit repaint all keep working without rebinding. Capture
+// phase, so a control inside a card never also opens the card.
+function machinesPageAccessBind(doc) {
+  var target = doc || ((typeof document !== 'undefined') ? document : null);
+  if (!target || typeof target.addEventListener !== 'function') return false;
+  if (target.__ctmMachinesAccessBound) return false;
+  target.__ctmMachinesAccessBound = true;
+  target.addEventListener('change', function (event) {
+    var node = (event.target && typeof event.target.closest === 'function')
+      ? event.target.closest(HUB_BRIDGE_TRUST_HOOK) : null;
+    if (!node || typeof node.getAttribute !== 'function') return;
+    if (node.hasAttribute && node.hasAttribute('data-hub-bridge-trust-all')) {
+      machinesPageTrustAll(!!event.target.checked);
+      return;
+    }
+    machinesPageTrustChange(node.getAttribute('data-hub-bridge-trust'), event.target.value, event.target);
+  }, true);
+  target.addEventListener('click', function (event) {
+    var node = (event.target && typeof event.target.closest === 'function')
+      ? event.target.closest(HUB_BRIDGE_ACTION_HOOK) : null;
+    if (!node || typeof node.getAttribute !== 'function') return;
+    if (typeof event.stopPropagation === 'function') event.stopPropagation();
+    var action = node.getAttribute('data-hub-bridge');
+    if (action === 'allow') machinesPageBannerAllow(node.getAttribute('data-pending-id'), node.getAttribute('data-grant'));
+    else if (action === 'deny') machinesPageBannerDeny(node.getAttribute('data-pending-id'));
+    else if (action === 'revoke') {
+      machinesPageAccessRevoke(node.getAttribute('data-machine-id'), node.getAttribute('data-session-id'), node.getAttribute('data-tier'));
+    }
+  }, true);
+  return true;
+}
+
+/** One entry for both hub-bridge frames (public/js/ws/live-dispatch.js calls this). */
+function machinesPageHubBridgeOnFrame(msg) {
+  var type = String((msg && msg.type) || '');
+  if (type === 'hub-bridge-pending') return onHubBridgePending(msg);
+  if (type === 'hub-bridge-pending-cleared') return onHubBridgePendingCleared(msg);
+  return false;
+}
+
+// The live WS dispatcher (js/ws/live-dispatch.js) hands both frames here; it is loaded after this
+// file, so the assignment is the contract between them and not a load-order accident.
+if (typeof globalThis !== 'undefined' && globalThis) {
+  globalThis.CtmHubBridgeAccess = { onFrame: machinesPageHubBridgeOnFrame };
+}
+
+/** AC-2g: on page load, seed the banners from the hub's own list of open asks. */
+function machinesPageSeedHubBridgeBanners() {
+  // A slice without a transport (a unit realm) simply seeds nothing; the page always has fetch.
+  if (typeof fetch !== 'function') return Promise.resolve(false);
+  return machinesPageJson(machinesPageUrl('/api/hub-bridge/grants')).then(function (result) {
+    if (!result.ok) return false;
+    var pending = (result.data && Array.isArray(result.data.pending)) ? result.data.pending : [];
+    _machinesPageBanners = Object.create(null);
+    for (var i = 0; i < pending.length; i += 1) {
+      var row = pending[i];
+      if (row && row.id) _machinesPageBanners[String(row.id)] = row;
+    }
+    machinesPagePaintHubBridgeBanners();
+    return true;
+  }).catch(function () {
+    // HANDLE: a hub that cannot be read seeds nothing; the next frame or page load tries again.
+    return false;
+  });
+}
+
+// The page-load seed: run it now when the document is already parsed, else on DOMContentLoaded.
+if (typeof document !== 'undefined' && document && typeof document.addEventListener === 'function') {
+  var _machinesPageSeedBanners = function () {
+    try {
+      machinesPageAccessBind();
+      machinesPageSeedHubBridgeBanners();
+    } catch {
+      // expected: a slice realm with no transport seeds nothing; the page always has fetch.
+    }
+  };
+  if (String(document.readyState || '') === 'loading') {
+    document.addEventListener('DOMContentLoaded', _machinesPageSeedBanners);
+  } else {
+    _machinesPageSeedBanners();
+  }
+}