create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/machine-registry.js

@@ -26,6 +26,24 @@
 // The consecutive-miss counters are deliberately MODULE state, not columns: they are probe
 // bookkeeping, they die with the process, and they must never look like fact to a reader.
 const { dispatchOwnerMutation } = require('./owner-mutation-disposition');
+const { createErrorSink } = require('./error-sink');
+// WP-3 rev 3 (§13.6 D-17): the hub-side `proxy.sh` the installer writes. Node builtins only.
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+// WP-7 (docs/remote-agent-skills-bundles-2026-10-25.html §5 D-11, §6.5): the pure classification of
+// a box's own skills against the hub's copy and the base the box reported. Required at the top
+// level on purpose — it is a leaf (build/store/codex-install only), so it introduces no cycle, and a
+// probe-time require would hide the edge from the dependency lint.
+const bundleInventory = require('./agent-bundle/inventory');
+// WP-1 (docs/remote-box-model-access-2026-10-26.html §6.2, §5.3 D-2/D-9): the box's OWN model
+// availability, read on the same probe tick as everything else. Only the TTL constant is needed from
+// the module (the block is derived here, on the hub, from the box's §6.1 body) — the module is a
+// leaf (http/https only), so the edge introduces no cycle.
+const { ORIGIN_TTL_MS } = require('./model-availability');
+
+/** REPORT sink for a probe-sweep fault that must not fail the sweep (WP-7's hub-side build). */
+const errorSink = createErrorSink({ name: 'machine-registry' });
 
 const DEFAULT_TIMEOUT_MS = 3000;
 // D-4/P3 grace: a machine with no successful probe for this long reads `unreachable`.
@@ -57,6 +75,14 @@ const _missStreak = new Map();
 // with a freshness stamp, it dies with the process, and a stale copy must never look like fact to a
 // reader (a restart reads `unknown`, which never refuses a forward).
 const _agentAuth = new Map();
+// instance_id -> { presence: { dsh: boolean }, checkedAt } (WP-13b, D-15). The box's OWN
+// available-agents answer as this hub last read it from ITS /api/models/available-agents, reduced to
+// the compact presence the new-session card and the machine row need: whether the box has the
+// DeepSeek Harness. Nothing else from the body is kept — not paths, not versions, not the other
+// agents. Same module-state contract as _agentAuth: a stale copy must never look like fact to a
+// reader (a restart reads "never read", which refuses nothing), and a failed/404/unparseable read
+// KEEPS the previous value (P3, "Unknown != Dead").
+const _agentPresence = new Map();
 // instance_id -> { sample, checkedAt } (D-12, D-16). The box's own host sample as the hub last read
 // it from ITS /api/host/stats?latest=1, plus the hub-clock stamp that gates the next re-read. Same
 // module-state contract as _agentAuth: a stale number must never look fresh, and a box that stops
@@ -67,9 +93,47 @@ const _hostStats = new Map();
 // its os/arch/hostname live — the roster deliberately carries none of them (P-1) — so the sweep
 // caches what the probe already fetched instead of asking again.
 const _manifestHost = new Map();
+// instance_id -> the `build` block of the last manifest this hub read from the box (WP-0,
+// docs/fleet-auto-update-pooled-machines-2026-10-26.html S-1/S-2). Same lifetime and the same write
+// sites as `_manifestHost`: the manifest the probe already fetched is the version truth the fleet
+// reconciler and the Machines card read ("which build is that box running?"), so nothing re-asks.
+const _manifestBuild = new Map();
+// instance_id -> the agent-skill push result (WP-3, docs/remote-agent-skills-bundles-2026-10-25.html
+// §6.5). Module state for the same reason as _agentAuth: it describes the LAST push this process
+// made, it is not durable truth about the box, and a restart must read "never pushed" rather than a
+// stale tree. `pushError` is cleared by the next success and kept otherwise; `sentTreeHash`/
+// `sentAt`/`sentCount`/`heldBack` always describe the last SUCCESSFUL push (D-6: a failure never
+// erases what the box is actually running).
+const _agentBundlePush = new Map();
+// instance_id -> { onBox, checkedAt } (WP-7 §6.5/D-11). The box's OWN skill inventory as this hub
+// last read it from ITS /api/agent-skills/inventory, classified against the hub's copy and the base
+// the BOX reported. Module state for the same reason as _agentAuth: it is the last read this process
+// made, and a box that stops answering keeps its entry with a FROZEN onBox — never blanked to "no
+// skills", which would read as "the box lost everything". `checkedAt` is the hub clock stamp that
+// gates the next read (SAME 60 s constant, SAME tick — this module still owns ONE timer site).
+const _agentSkills = new Map();
+// WP-1 §6.2: instance_id -> { block, checkedAt }. The box's OWN model availability (§6.1) as this
+// hub last read it from ITS /api/models/availability, plus the hub-clock stamp that gates the next
+// read. D-9: the read rides the EXISTING 60 s probe tick and is refreshed at most once per
+// ORIGIN_TTL_MS (10 min) per machine — no second timer, no poll. Module state for the same reason as
+// _agentAuth. `block === null` is a REAL answer ("this box predates WP-1"), not "never read" —
+// `checkedAt` is what tells the two apart, and a failed read keeps the previous block untouched.
+const _machineModels = new Map();
+// WP-1 §6.2: how long a box's availability answer is trusted. Same value as the box's own per-origin
+// cache, on purpose: the hub must not re-ask more often than the box would re-probe.
+const MODELS_REFRESH_MS = ORIGIN_TTL_MS;
+// platform -> { items, at }: the hub's own item list (`{agent, kind, name, itemHash}`) as WP-1's
+// builder produced it for that platform. Memoized for AGENT_AUTH_REFRESH_MS so N boxes of one
+// platform cost ONE build per minute. Only `items` is kept — `blobsByHash` is hub-local absolute
+// paths and would pin the whole hub tree in memory for a classification that never reads it.
+const _hubItemCache = new Map();
 // The last sweep's self-suspicion verdict, surfaced by GET /api/machines. Not persisted per
 // machine (design §7 "not persisted per machine") — it is a hub-wide observation about one sweep.
 let _lastSweep = { hubNetworkSuspect: false, at: 0 };
+// WP-3 rev 3 (§13.6 D-17): does THIS hub have an away path? The installer writes its hub half to
+// `~/.config/ctm-away-path/proxy.sh` (bin/away-path.sh cmd_install_hub). Read once per sweep, off
+// the request path (see machineAwayReason); `null` = this process has not swept yet.
+let _awayPathProxyExists = null;
 // Bumped by every registry write this process makes (register, remove, seed, a probe that changed
 // a row). Readers that keep a snapshot (lib/remote-machine-catalog.js) compare it instead of
 // trusting a TTL alone: a snapshot taken a moment before a registration must not hide the new
@@ -127,10 +191,36 @@ function _manifestHostBlock(body) {
   };
 }
 
+/**
+ * WP-0 (S-1): the manifest's `build` block — the box's own version truth (`lib/instance-manifest.js`
+ * publishes `{ version, sha, builtAt, release }`). Each field is bounded; a manifest without the
+ * block (an older box) reads as three empty strings, never undefined, so a reader can tell "no
+ * build published" from "never probed" (`null`).
+ */
+function _manifestBuildBlock(body) {
+  const manifest = (body && (body.manifest || body.instance)) || body || {};
+  const build = manifest.build || {};
+  return {
+    sha: _string(build.sha, 64),
+    version: _string(build.version, 64),
+    release: _string(build.release, 64),
+  };
+}
+
 function _manifestDisplayName(body) {
   return _manifestHostBlock(body).displayName;
 }
 
+/**
+ * D-9/WP-3: the cached manifest host block for an instance (the box's `os` is what the bundle
+ * build targets), or null when this hub has never read that box's manifest. A COPY: the cache is
+ * module state and a reader must not be able to mutate it.
+ */
+function manifestHostFor(instanceId) {
+  const host = _manifestHost.get(_string(instanceId, 160)) || null;
+  return host ? { ...host } : null;
+}
+
 function _hostLabel(url) {
   try { return _string(new URL(url).host, 160); } catch { return _string(url, 160); }
 }
@@ -172,6 +262,60 @@ function _dialUrls(machine = {}) {
   return pinned ? [pinned] : [];
 }
 
+// WP-3 rev 3 (§13.6 D-17): is this host one only the home LAN (or this machine) can name? A URL
+// that does not parse is NOT local-only — "would this work from another network?" would be unknown.
+function _isLocalOnlyHost(hostname) {
+  const host = String(hostname || '').toLowerCase();
+  if (!host) return false;
+  if (host === 'localhost' || host.endsWith('.localhost')) return true;
+  if (host.endsWith('.local')) return true;
+  // `new URL('http://[::1]:3456').hostname` keeps the brackets; strip them before parsing.
+  const ip = host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host;
+  if (ip.includes(':')) {
+    if (ip === '::1') return true;
+    const first = parseInt(ip.split(':')[0] || '', 16);
+    if (!Number.isInteger(first)) return false;
+    // fc00::/7 (unique-local) and fe80::/10 (link-local).
+    return (first >= 0xfc00 && first <= 0xfdff) || (first >= 0xfe80 && first <= 0xfebf);
+  }
+  const octets = ip.split('.');
+  if (octets.length !== 4) return false;
+  const nums = octets.map((part) => (/^\d{1,3}$/.test(part) ? Number(part) : NaN));
+  if (nums.some((n) => !Number.isInteger(n) || n > 255)) return false;
+  if (nums[0] === 127 || nums[0] === 10) return true; // 127/8 loopback, 10/8 private
+  if (nums[0] === 172 && nums[1] >= 16 && nums[1] <= 31) return true; // 172.16/12
+  return nums[0] === 192 && nums[1] === 168; // 192.168/16
+}
+
+/**
+ * WP-3 rev 3 (docs/off-lan-hub-to-box-access-2026-10-31.html §13.6 D-17): WHY an `unreachable` box
+ * whose every dial URL is local-only cannot be dialled from here, or null when the hub cannot know.
+ * The one readable fact is whether this hub has an away path at all — the hub-side
+ * `~/.config/ctm-away-path/proxy.sh` (bin/away-path.sh cmd_install_hub): no proxy ⇒ nothing could
+ * ever route to the box from off-LAN; proxy present ⇒ this box's tunnel or forward is the down half.
+ *
+ * That fact is read ONCE PER SWEEP (`probeMachinesOnce`), never on the request path: /api/machines
+ * renders on the main thread. `null` (module state) = this process has not swept yet — an honest
+ * "not known", and `unreachable` is only ever written BY a sweep.
+ */
+function machineAwayReason(machine = {}, deps = {}) {
+  const row = machine || {};
+  if (row.health !== 'unreachable') return null;
+  const urls = _dialUrls(row);
+  if (!urls.length) return null;
+  const localOnly = urls.every((raw) => {
+    try {
+      return _isLocalOnlyHost(new URL(raw).hostname);
+    } catch {
+      return false; // expected: an unparsable URL is not local-only (see _isLocalOnlyHost)
+    }
+  });
+  if (!localOnly) return null;
+  const proxyExists = typeof deps.awayPathProxyExists === 'boolean' ? deps.awayPathProxyExists : _awayPathProxyExists;
+  if (proxyExists === null) return null; // this hub has not swept yet, so it does not know
+  return proxyExists ? 'away_path_down' : 'no_away_path';
+}
+
 // One JSON GET against a box, with the AbortController + unref'd timer shape server.js's golive
 // probe uses, so a hung box can never hold the tick open past timeoutMs. Shared by the manifest and
 // the agent-sign-in probes: this is the ONE timer site in the file (a second copy would be a new
@@ -215,7 +359,7 @@ async function _probeManifest(url, options = {}) {
   // Reachable but degraded: the box answered and told us nothing we can pin or trust.
   if (!instanceId) return { ok: false, code: 'machine_manifest_invalid', error: 'manifest_instance_id_missing', body: fetched.body };
   const host = _manifestHostBlock(fetched.body);
-  return { ok: true, instanceId, displayName: host.displayName, host };
+  return { ok: true, instanceId, displayName: host.displayName, host, build: _manifestBuildBlock(fetched.body) };
 }
 
 /**
@@ -351,6 +495,18 @@ function _cacheManifestHost(instanceId, host) {
   }
 }
 
+/**
+ * WP-0 (S-2): cache the manifest's `build` block beside `_manifestHost` — written by the same single
+ * caller (the sweep), cleared by the same test seam. A build change is deliberately NOT registry
+ * news: it is a version stamp the fleet reconciler reads, not machine identity, and bumping the
+ * revision on every restart of every box would wake every snapshot reader for nothing.
+ */
+function _cacheManifestBuild(instanceId, build) {
+  const id = _string(instanceId, 160);
+  if (!id || !build) return;
+  _manifestBuild.set(id, build);
+}
+
 /** A box's logged-in flag -> the hub's three-state verdict (unknown for anything unexpected). */
 function _agentLoginState(signedIn) {
   if (signedIn === true) return 'signed_in';
@@ -378,6 +534,240 @@ async function _probeAgentAuth(url, options = {}) {
   return { claude: _agentLoginState(signedInFor('claude')), codex: _agentLoginState(signedInFor('codex')) };
 }
 
+/**
+ * WP-13b (D-15): the box's OWN available-agents answer, reduced to the one compact presence the hub
+ * surfaces — `{ dsh: boolean }`.
+ *
+ * The route (`GET /api/models/available-agents`) answers `agentCliCache.getAvailableAgents()`'s
+ * body: `{ ok, agents: { <agent>: { available, … } }, <agent>: boolean }`. This read keeps ONLY
+ * whether `dsh` is present; paths and every other agent are dropped at the door, so nothing the box
+ * printed about its filesystem is ever cached hub-side.
+ *
+ * Three outcomes, matching the sign-in/skills reads:
+ *   'block' — a 200 that carries an explicit dsh verdict: store the compact presence.
+ *   'keep'  — a failed read, a 404 (a box older than this route), a non-object/unparseable body, or
+ *             a body that names no dsh at all: KEEP the previous value (P3, "Unknown != Dead"). Only
+ *             an explicit answer is news; a silent box is never read as "the box lost dsh".
+ */
+async function _probeAgentAvailability(url, options = {}) {
+  const fetched = await _getJsonBox(url, '/api/models/available-agents', options);
+  if (!fetched.ok) return { state: 'keep' };
+  const presence = _dshPresenceFromBody(fetched.body);
+  if (!presence) return { state: 'keep' };
+  return { state: 'block', presence };
+}
+
+/**
+ * The `dsh` verdict in a `/api/models/available-agents` body, or null when the body carries none.
+ * Accepted shapes (the hub must not care which one its box serves): the route's own
+ * `{ dsh: <boolean>, agents: { dsh: { available } } }`, and the bare `{ agents: {…} }` / `{ dsh }`.
+ */
+function _dshPresenceFromBody(body) {
+  if (!body || typeof body !== 'object' || Array.isArray(body)) return null;
+  const agents = body.agents && typeof body.agents === 'object' && !Array.isArray(body.agents) ? body.agents : null;
+  const detail = agents ? agents.dsh : undefined;
+  if (detail !== undefined) {
+    if (typeof detail === 'boolean') return { dsh: detail };
+    if (detail && typeof detail === 'object' && typeof detail.available === 'boolean') return { dsh: detail.available };
+    return null; // present but not a verdict — "no answer", never "not installed"
+  }
+  if (typeof body.dsh === 'boolean') return { dsh: body.dsh };
+  return null;
+}
+
+/**
+ * Store one box's agent presence. `noteRegistryChanged()` fires only when the SURFACED presence
+ * actually moved, exactly like the sign-in read above: a first read is not news (registration already
+ * bumped the revision), and an identical re-read under a newer `checkedAt` is not either.
+ */
+function _setAgentPresence(instanceId, presence, now) {
+  const id = _string(instanceId, 160);
+  if (!id || !presence) return null;
+  const previous = _agentPresence.get(id) || null;
+  const next = { presence: { dsh: presence.dsh === true }, checkedAt: now };
+  _agentPresence.set(id, next);
+  if (previous && previous.presence.dsh !== next.presence.dsh) noteRegistryChanged();
+  return next;
+}
+
+/**
+ * WP-7 (§6.5/AC-7a): read a box's OWN skill inventory from ITS `GET /api/agent-skills/inventory`.
+ *
+ * Never throws and never reports anything but the parsed body or null. A box running an older CTM
+ * answers 404, a silent box never answers, and an unparseable body is not an inventory — all three
+ * read "no inventory this time", which the caller answers with KEEP THE LAST VALUE. It is
+ * deliberately not "an empty inventory": that would claim the box lost every skill it had.
+ */
+async function _probeAgentSkills(url, options = {}) {
+  const fetched = await _getJsonBox(url, '/api/agent-skills/inventory', options);
+  if (!fetched.ok) return null;
+  const body = fetched.body;
+  return body && typeof body === 'object' && !Array.isArray(body) ? body : null;
+}
+
+/**
+ * WP-1 (§6.2/§6.1): read a box's OWN model availability from ITS `GET /api/models/availability`.
+ *
+ * Three outcomes, and the difference between them is the whole contract:
+ *   'block' — the box answered with a §6.1 body: store the derived §6.2 block.
+ *   'null'  — the box answered 404: it predates WP-1, so `models` is null and the row renders
+ *             exactly as it did before (AC-1e). Stamped, so a pre-WP-1 box is asked once per TTL.
+ *   'keep'  — anything else (silent box, non-JSON answer, transport throw): KEEP the previous block
+ *             and move only the stamp (the remote-skills WP-7 rule). Never blank a block we hold.
+ */
+async function _probeModelsAvailability(url, options = {}) {
+  const fetched = await _getJsonBox(url, '/api/models/availability', options);
+  if (fetched.ok) {
+    const body = fetched.body;
+    // A 200 that is not a §6.1 body (no `routes` array) is not an answer to this question: KEEP.
+    if (!body || typeof body !== 'object' || Array.isArray(body) || !Array.isArray(body.routes)) {
+      return { state: 'keep' };
+    }
+    return { state: 'block', block: _modelsBlockFrom(body) };
+  }
+  if (fetched.status === 404) return { state: 'null', block: null };
+  return { state: 'keep' };
+}
+
+/**
+ * §6.2: the block the machine row surfaces, derived from the box's §6.1 body. `usable` is the
+ * launch-able count the card states (enabled, and either keyed or a local runtime, and reachable);
+ * `unreachable` lists the enabled rows the box cannot get to; `delegate` mirrors the box's own
+ * /delegate picks with the verdict of the route each one names.
+ */
+function _modelsBlockFrom(body) {
+  const routes = (Array.isArray(body.routes) ? body.routes : []).filter((row) => row && typeof row === 'object');
+  const enabled = routes.filter((row) => row.enabled !== false);
+  const isOllama = (row) => _string(row.type, 60).toLowerCase() === 'ollama';
+  const usable = enabled.filter((row) => row.reach === 'reachable' && (row.keyed === true || isOllama(row))).length;
+  const unreachable = enabled
+    .filter((row) => row.reach === 'unreachable' || row.reach === 'no_server')
+    .map((row) => ({
+      id: _string(row.id, 200),
+      type: _string(row.type, 60),
+      origin: row.origin ? _string(row.origin, 300) : null,
+    }));
+  // WP-5 (§6.4/R-6): the box's own route list, so the hub can offer "Use on <box>" for the routes
+  // the box does NOT have and refuse one whose origin that same list calls unreachable. THREE fields
+  // only — id, origin and the reach verdict — never a name, a type, a credential flag or a key: the
+  // hub needs "does this box already have this id" and "can this box reach this origin", nothing
+  // else. A row with no id is not a route the hub can match, so it is skipped rather than surfaced
+  // as an empty id.
+  const routeRows = routes
+    .map((row) => ({
+      id: _string(row.id, 200),
+      origin: row.origin ? _string(row.origin, 300) : null,
+      reach: _string(row.reach, 20) || 'unknown',
+    }))
+    .filter((row) => row.id);
+  const delegate = (Array.isArray(body.delegateDefaults) ? body.delegateDefaults : [])
+    .filter((pref) => pref && typeof pref === 'object')
+    .map((pref) => ({
+      agent: _string(pref.agent, 20),
+      routeId: _string(pref.routeId, 200),
+      model: _string(pref.model, 200),
+      reach: _string(pref.reach, 20) || 'unknown',
+    }));
+  const nativeOf = (agent) => ({
+    signedIn: !!(body.native && body.native[agent] && body.native[agent].signedIn === true),
+  });
+  return {
+    checkedAt: _string(body.checkedAt, 60),
+    usable,
+    unreachable,
+    routes: routeRows,
+    delegate,
+    native: { claude: nativeOf('claude'), codex: nativeOf('codex') },
+  };
+}
+
+/**
+ * Store one box's availability block. `noteRegistryChanged()` fires only when the SURFACED block
+ * moved — a first read or a real change is news, an identical re-read under a newer `checkedAt` is
+ * not, or every 60 s tick would invalidate every reader's snapshot for nothing.
+ */
+function _setMachineModels(instanceId, block, now) {
+  const id = _string(instanceId, 160);
+  if (!id) return null;
+  const previous = _machineModels.get(id) || null;
+  const next = { block, checkedAt: now };
+  _machineModels.set(id, next);
+  if (!previous || JSON.stringify(previous.block) !== JSON.stringify(next.block)) noteRegistryChanged();
+  return next;
+}
+
+/** WP-1 §6.2: the box's availability block as this hub last read it, or null (never read / pre-WP-1). */
+function modelsFor(instanceId) {
+  const entry = _machineModels.get(_string(instanceId, 160));
+  return entry ? entry.block : null;
+}
+
+/**
+ * WP-7 (§6.5): the hub's own item list for one box platform, memoized for AGENT_AUTH_REFRESH_MS.
+ *
+ * `deps.buildAgentBundle` is injectable so a unit test never reads the real home; production falls
+ * back to WP-1's builder. A build failure is REPORTed and answered with null — "the hub cannot read
+ * its own skills" and "the hub has no skills" are DIFFERENT claims, and only the second one may
+ * rewrite a box's classification to `new_on_box`.
+ *
+ * @returns {Promise<{items: object[]}|null>}
+ */
+async function _hubItemsForPlatform(platform, { deps = {}, now = Date.now() } = {}) {
+  const key = _string(platform, 40) || 'unknown';
+  const cached = _hubItemCache.get(key) || null;
+  if (cached && now - cached.at < AGENT_AUTH_REFRESH_MS) return { items: cached.items };
+  const build = typeof deps.buildAgentBundle === 'function'
+    ? deps.buildAgentBundle
+    : require('./agent-bundle/build').buildAgentBundle;
+  try {
+    const bundle = await build({ targetPlatform: key });
+    const items = (bundle && Array.isArray(bundle.items) ? bundle.items : []).map((item) => ({
+      agent: item.agent, kind: item.kind, name: item.name, itemHash: item.itemHash,
+    }));
+    _hubItemCache.set(key, { items, at: now });
+    return { items };
+  } catch (error) {
+    // REPORT: a hub-side build fault leaves every box's `onBox` exactly as it was (see the caller).
+    errorSink.report('agent-skill-inventory-build', error);
+    return null;
+  }
+}
+
+/**
+ * WP-7 (§6.5/AC-7a): classify one box's inventory read. `boxSkills` come from the box, `baseItems`
+ * from the base the BOX reported (that is the design adjustment: the hub's push record is
+ * in-process, so classification survives a hub restart only if the box carries the base back).
+ *
+ * @returns {Promise<object[]|null>} the classification rows, or null when the hub could not read its
+ *          own skills — the caller then keeps the previous `onBox` rather than publishing a wrong one.
+ */
+async function _classifyInventory(inventory, { deps = {}, now = Date.now() } = {}) {
+  const boxSkills = Array.isArray(inventory.skills) ? inventory.skills : [];
+  // §6.5: only a box holding at least one UNMANAGED skill is worth the hub's own build — a box whose
+  // skills are all CTM's (AC-7d) has nothing to classify, so the hub never walks its own tree for it.
+  const unmanaged = boxSkills.some((skill) => skill && (skill.managed === null || skill.managed === undefined));
+  if (!unmanaged) return [];
+  const hub = await _hubItemsForPlatform(inventory.platform, { deps, now });
+  if (!hub) return null;
+  const baseItems = inventory.base && Array.isArray(inventory.base.items) ? inventory.base.items : [];
+  return bundleInventory.classifyBoxSkills({ hubItems: hub.items, baseItems, boxSkills });
+}
+
+/**
+ * Store one box's classification. `noteRegistryChanged()` fires when the SURFACED block actually
+ * moved — a first read (the row goes from "no inventory" to a review list) is news, an identical
+ * re-read with only a newer `checkedAt` is not, or every 15 s tick would invalidate every snapshot.
+ */
+function _setAgentSkills(instanceId, onBox, now) {
+  const id = _string(instanceId, 160);
+  if (!id) return null;
+  const previous = _agentSkills.get(id) || null;
+  const next = { onBox, checkedAt: now };
+  _agentSkills.set(id, next);
+  if (!previous || JSON.stringify(previous.onBox) !== JSON.stringify(next.onBox)) noteRegistryChanged();
+  return next;
+}
+
 function _rows(deps = {}) {
   const db = deps.db;
   if (!db || typeof db.listMachineRows !== 'function') return [];
@@ -394,7 +784,7 @@ function _isPinned(row = {}) {
   return Number(row.lastSeenAt || row.last_seen_at || 0) > 0;
 }
 
-function _machineView(row = {}) {
+function _machineView(row = {}, deps = {}) {
   const lastSeenAt = Number(row.lastSeenAt ?? row.last_seen_at ?? 0) || 0;
   const enabled = Number(row.enabled ?? 1) !== 0;
   const health = _string(row.health, 40) || 'unknown';
@@ -403,11 +793,14 @@ function _machineView(row = {}) {
   // manifest, which the sweep caches per instance. The registry row's own label is the fallback for
   // a box this hub has not read a manifest from yet.
   const manifest = _manifestHost.get(instanceId) || null;
+  // WP-0 (S-1/S-2): the build stamp the box published in the manifest this hub last read, or null
+  // when it has never answered (never a fabricated {sha:''} row pretending to be a version).
+  const build = _manifestBuild.get(instanceId) || null;
   // D-12/D-16: the box's own host sample (load, memory, disk, GPU, tasks) and its newest session
   // create. `checkedAt` is the HUB clock stamp of the read, so a reader can label a stale number
   // instead of showing it as current.
   const stats = _hostStats.get(instanceId) || null;
-  return {
+  const view = {
     instanceId,
     displayName: _string((manifest && manifest.displayName) || row.displayName || row.display_name, 200),
     url: _string(row.url, 1000),
@@ -425,18 +818,33 @@ function _machineView(row = {}) {
     os: _string(manifest && manifest.os, 40),
     arch: _string(manifest && manifest.arch, 40),
     hostname: _string(manifest && manifest.hostname, 160),
+    // WP-0 (S-1): the box's own version truth (the manifest's build block), null until it answers.
+    build,
     // null = this hub has never read a sample for this box (never a zeroed-out sample).
     stats: stats ? { sample: stats.sample, checkedAt: stats.checkedAt } : null,
+    // WP-3 (§6.5) + WP-7 (§6.5/D-11) + WP-8 (§6.5): the skills push state for this box — the last
+    // successful tree and the last failure if there is one — together with the classification of the
+    // box's OWN skills (`onBox`, `checkedAt`) and this machine's per-machine plugin exclusions.
+    // null = this process neither pushed to, read this box, nor excluded anything for it.
+    skills: _skillsView(instanceId, deps),
+    // WP-1 (§6.2): the box's own model availability, read on the existing tick. null = this hub has
+    // never read it, or the box predates WP-1 — the row then renders exactly as it did before.
+    models: modelsFor(instanceId),
     lastUsedAt: Number((stats && stats.sample && stats.sample.lastUsedAt) || 0) || 0,
     // D-5: "unknown" until the box has ever answered; a disabled row is never a picker
     // candidate, and only reachable/unhealthy ever render as cards.
     pickerState: !enabled ? 'unknown' : health,
     visible: enabled && (health === 'reachable' || health === 'unhealthy'),
   };
+  // WP-3 rev 3 (§13.6 D-17): computed LAST, on the view itself, so the reason is derived from the
+  // exact `health` / `url` / `urls` the card renders (never a second, possibly-different reading).
+  // null for every row the hub cannot speak for; the Machines card then renders no note at all.
+  view.awayReason = machineAwayReason(view, deps);
+  return view;
 }
 
 function listMachines(deps = {}) {
-  const machines = _rows(deps).map((row) => _machineView(row));
+  const machines = _rows(deps).map((row) => _machineView(row, deps));
   return { machines, hubNetworkSuspect: !!_lastSweep.hubNetworkSuspect };
 }
 
@@ -531,6 +939,13 @@ async function probeMachinesOnce(options = {}, deps = {}) {
     return { ok: true, probed: 0, reachable: 0, unknown: 0, unreachable: 0, unhealthy: 0, hubNetworkSuspect: false, results: [] };
   }
 
+  // WP-3 rev 3 (§13.6 D-17): ONE away-path read per sweep, OFF the request path (see
+  // machineAwayReason). A missing proxy.sh IS the false answer; `deps` may inject the verdict.
+  _awayPathProxyExists = typeof deps.awayPathProxyExists === 'boolean'
+    ? deps.awayPathProxyExists
+    : await fs.promises.access(path.join(os.homedir(), '.config', 'ctm-away-path', 'proxy.sh'))
+      .then(() => true, () => false /* expected: an absent proxy.sh is the "no away path" answer */);
+
   // P-8: one credential PER TARGET (pool secret for a member, the legacy env bearer for a box that
   // never joined), so the header builder is resolved per machine, not once per sweep.
   const headersFor = _peerHeadersFor(deps);
@@ -604,6 +1019,9 @@ async function probeMachinesOnce(options = {}, deps = {}) {
     // D-4: the manifest we just read IS the machine's settings + host identity. Cached here so
     // /api/machines serves the machine-owned displayName/favorite/hidden and os/arch/hostname.
     _cacheManifestHost(machine.instanceId, probe.host);
+    // WP-0 (S-2): the same manifest read carries the box's build stamp; cache it here, the one place
+    // the hub learns it, so /api/machines can serve build.sha without a second fetch.
+    _cacheManifestBuild(machine.instanceId, probe.build);
 
     const previous = _agentAuth.get(machine.instanceId);
     if (!previous || now - previous.checkedAt >= AGENT_AUTH_REFRESH_MS) {
@@ -614,6 +1032,50 @@ async function probeMachinesOnce(options = {}, deps = {}) {
       if (previous && (previous.claude !== probed.claude || previous.codex !== probed.codex)) noteRegistryChanged();
     }
 
+    // WP-13b (D-15): the box's OWN available-agents answer, on the SAME tick and under the SAME
+    // per-instance 60 s stamp as the sign-in read — the New Session card and the machine row need to
+    // know whether the box has the DeepSeek Harness BEFORE a create is dialled. A failed / 404 /
+    // unparseable read keeps the last value (P3): only an explicit answer moves it.
+    const presenceEntry = _agentPresence.get(machine.instanceId) || null;
+    if (!presenceEntry || now - presenceEntry.checkedAt >= AGENT_AUTH_REFRESH_MS) {
+      const read = await _probeAgentAvailability(url, { fetchImpl, timeoutMs, peerHeaders: machineHeaders });
+      if (read.state === 'block') _setAgentPresence(machine.instanceId, read.presence, now);
+      // A failed / 404 / unparseable read KEEPS the last value and moves only the stamp, so a box
+      // without this route is asked once a minute rather than on every tick. A FIRST failure stores
+      // nothing at all — there is no previous value to keep, and "never read" is the honest answer.
+      else if (presenceEntry) _setAgentPresence(machine.instanceId, presenceEntry.presence, now);
+    }
+
+    // WP-7 (§6.5/AC-7a/AC-7c): the box's own skill inventory, on the SAME tick and under the SAME
+    // per-instance 60 s stamp as the sign-in read — one pass over `results`, no timer of this
+    // module's own (AC-7b), so a box-created skill shows up on the row within 60 s + one 15 s tick.
+    const skillsEntry = _agentSkills.get(machine.instanceId) || null;
+    if (!skillsEntry || now - skillsEntry.checkedAt >= AGENT_AUTH_REFRESH_MS) {
+      const inventory = await _probeAgentSkills(url, { fetchImpl, timeoutMs, peerHeaders: machineHeaders });
+      if (inventory) {
+        const onBox = await _classifyInventory(inventory, { deps, now });
+        // null = the hub could not read its OWN skills: keep what we hold (a build fault is not news
+        // about the box), and move only the stamp so the next read waits its full 60 s.
+        _setAgentSkills(machine.instanceId, onBox === null ? (skillsEntry ? skillsEntry.onBox : null) : onBox, now);
+      } else if (skillsEntry) {
+        // An older box (404) or a failed read: KEEP the last value, no error noise — and move the
+        // stamp, so a box without this route is asked once a minute rather than on every tick.
+        _setAgentSkills(machine.instanceId, skillsEntry.onBox, now);
+      }
+    }
+
+    // WP-1 (§6.2/D-9): the box's OWN model availability, on the SAME tick and under its own per-
+    // instance ORIGIN_TTL_MS (10 min) stamp — the hub must not ask more often than the box would
+    // re-probe. A failure keeps the last block (never blanked), and a 404 records that the box
+    // predates WP-1 (models: null, the row renders exactly as today).
+    const modelsEntry = _machineModels.get(machine.instanceId) || null;
+    if (!modelsEntry || now - modelsEntry.checkedAt >= MODELS_REFRESH_MS) {
+      const read = await _probeModelsAvailability(url, { fetchImpl, timeoutMs, peerHeaders: machineHeaders });
+      if (read.state === 'block') _setMachineModels(machine.instanceId, read.block, now);
+      else if (read.state === 'null') _setMachineModels(machine.instanceId, null, now);
+      else if (modelsEntry) _setMachineModels(machine.instanceId, modelsEntry.block, now);
+    }
+
     // D-12/P-5: the box's own host sample and its roster version, refreshed on the SAME tick and
     // under the SAME per-instance 60 s stamp as the sign-in read — one pass over `results`, no
     // timer of this module's own. Both are asked ONLY of a box whose manifest probe just answered
@@ -711,6 +1173,204 @@ function agentAuthFor(instanceId) {
   return _agentAuth.get(_string(instanceId, 160)) || null;
 }
 
+/**
+ * WP-13b (D-15): the box's last-read agent presence as `{ dsh: { available: boolean } }`, or null
+ * when this process has never read it. The shape is the one `lib/remote-machine-create.js`'s
+ * `_boxAgentMissing` already accepts verbatim — the gate asks THIS module, never the box, so a
+ * never-read (or restarted) hub holds no verdict and refuses nothing (P3).
+ */
+function agentAvailabilityFor(instanceId) {
+  const entry = _agentPresence.get(_string(instanceId, 160));
+  if (!entry) return null;
+  return { dsh: { available: entry.presence.dsh === true } };
+}
+
+/**
+ * The §6.5 `skills` block for a machine row, or null when this process neither pushed nor read an
+ * inventory for this box.
+ *
+ * WP-7: the block is the UNION of the two module truths — the last push (§6.5, WP-3) and the last
+ * inventory read (D-11/§6.5). A box this hub has read an inventory from but never pushed to still
+ * gets a block (`sentTreeHash: null`, `onBox` populated); that is the WP-9 review card's whole input.
+ * `onBox`/`checkedAt` are null — never absent — when only one half is known, so a reader can always
+ * ask "have we read this box's own skills, and when".
+ */
+/**
+ * WP-8 (§6.5): this machine's per-machine plugin exclusions, read through the caller's provider.
+ *
+ * The provider is INJECTED (`deps.excludePluginsFor`), never imported: the real reader is a hub-side
+ * JSON file that lib/api/machines.js supplies, so this module — which must run in unit tests with a
+ * temp db and no data dir — never reads a real one, and a default `[]` keeps every existing caller
+ * (and the probe sweep) exactly as it was.
+ */
+function _excludePluginsFor(deps = {}, instanceId) {
+  const provider = deps.excludePluginsFor;
+  if (typeof provider !== 'function') return [];
+  try {
+    const list = provider(instanceId);
+    return Array.isArray(list) ? list.map((id) => _string(id, 200)).filter(Boolean) : [];
+  } catch {
+    return []; // expected: an unreadable exclusion file is "nothing excluded", never a failed row read
+  }
+}
+
+/**
+ * WP-9 (§9 S-9): the PLUGIN names the hub's last bundle carried — the Review dialog's exclusion
+ * checklist is "the plugins the hub sends to this box", so it is derived from the push entry's own
+ * item list (never re-read from disk here: this module holds no home dir, and the push already
+ * decided what went out).
+ *
+ * push.js's result reports `sentCount`/`heldBack` and NO items in this release, so the reader accepts
+ * every shape a caller could hand it (`items`, a nested `bundle.items`, or a plain `plugins` list) and
+ * otherwise falls back to what the PREVIOUS push recorded — the same rule the rest of
+ * `recordAgentBundlePush` follows: a failed push must not empty a checklist the user is looking at.
+ */
+function _pluginNamesFromItems(items) {
+  const names = new Set();
+  for (const item of Array.isArray(items) ? items : []) {
+    if (!item || typeof item !== 'object') continue;
+    if (_string(item.kind, 40) !== 'plugin') continue;
+    const name = _string(item.name, 200);
+    if (name) names.add(name);
+  }
+  return [...names].sort();
+}
+
+function _pluginsFromResult(result, previous) {
+  const nested = result && result.bundle && result.bundle.items;
+  if (Array.isArray(result && result.items)) return _pluginNamesFromItems(result.items);
+  if (Array.isArray(nested)) return _pluginNamesFromItems(nested);
+  if (Array.isArray(result && result.plugins)) {
+    const names = new Set();
+    for (const value of result.plugins) {
+      const name = _string(value && typeof value === 'object' ? value.name : value, 200);
+      if (name) names.add(name);
+    }
+    return [...names].sort();
+  }
+  return previous && Array.isArray(previous.plugins) ? previous.plugins.slice() : [];
+}
+
+/**
+ * WP-6 D-13 (§6.3): the per-phase timings a push result carries, kept as a COPY of only the keys
+ * whose values are finite numbers — anything else (a missing object, a string, NaN) is dropped, and
+ * a result that kept nothing reads as null. Recorded for an ok AND a failed push alike.
+ */
+function _pushTimingsOf(result) {
+  const source = result && result.timings;
+  if (!source || typeof source !== 'object') return null;
+  const kept = {};
+  let any = false;
+  for (const key of Object.keys(source)) {
+    const value = source[key];
+    if (typeof value === 'number' && Number.isFinite(value)) {
+      kept[key] = value;
+      any = true;
+    }
+  }
+  return any ? kept : null;
+}
+
+function _skillsView(instanceId, deps = {}) {
+  const id = _string(instanceId, 160);
+  return _skillsViewFrom(_agentBundlePush.get(id) || null, _agentSkills.get(id) || null, _excludePluginsFor(deps, id));
+}
+
+/** The surfaced `skills` block, one shape for the row and the change check below. */
+function _skillsViewFrom(pushEntry, inventoryEntry = null, excludePlugins = []) {
+  const exclusions = Array.isArray(excludePlugins) ? excludePlugins : [];
+  // WP-8: a machine with nothing pushed, nothing read AND nothing excluded has no block at all — the
+  // pre-WP-8 `null` (and every test that pins it) is preserved. A machine with ONLY exclusions does get
+  // a block, because the exclusions are the hub's own setting for it and a reader must be able to see
+  // them before the first probe ever answers.
+  if (!pushEntry && !inventoryEntry && !exclusions.length) return null;
+  return {
+    sentTreeHash: pushEntry ? pushEntry.sentTreeHash : null,
+    sentAt: pushEntry ? pushEntry.sentAt : 0,
+    sentCount: pushEntry ? pushEntry.sentCount : 0,
+    heldBack: pushEntry ? pushEntry.heldBack : [],
+    pushError: pushEntry ? pushEntry.pushError : null,
+    // WP-6 D-13 (§6.3): the per-phase timings of the LAST push — which phase cost the caller its wait.
+    // Null when no push result has carried any yet (a pre-WP-6 push, or none at all).
+    pushTimings: pushEntry && pushEntry.pushTimings ? pushEntry.pushTimings : null,
+    onBox: inventoryEntry ? inventoryEntry.onBox : null,
+    checkedAt: inventoryEntry ? inventoryEntry.checkedAt : null,
+    excludePlugins: exclusions.slice(),
+    // WP-9 (§9 S-9): the plugin names the last push carried, for the Review dialog's checklist.
+    // Always an array on a non-null block, like `heldBack` — a reader never has to treat "no push"
+    // and "no plugins" differently.
+    plugins: pushEntry && Array.isArray(pushEntry.plugins) ? pushEntry.plugins.slice() : [],
+  };
+}
+
+/** A `skills` change is registry news — a reader keeping a snapshot must re-read (`noteRegistryChanged`). */
+function _skillsChanged(previousPush, nextPush, inventoryEntry) {
+  return JSON.stringify(_skillsViewFrom(previousPush, inventoryEntry))
+    !== JSON.stringify(_skillsViewFrom(nextPush, inventoryEntry));
+}
+
+/** WP-3: the last agent-skill push this process made to `instanceId`, or null when it made none. */
+function agentBundlePushFor(instanceId) {
+  return _skillsView(instanceId);
+}
+
+/**
+ * WP-3 (§6.5): record the outcome of a push to `instanceId`.
+ *
+ *   ok      -> sentTreeHash/sentAt/sentCount/heldBack describe THIS push and `pushError` is cleared.
+ *   ok:false-> the failure is stamped (`pushError: {code, message?, continuing?, at}` — `message` is
+ *              the box's own reason, `result.boxCode` from lib/agent-bundle/push.js D-4, present only
+ *              when the box named one; `continuing` is present only when the push outlived the
+ *              caller's wait and is still running, WP-6 D-11) while the last SUCCESSFUL push's fields
+ *              are kept: D-6's whole point is that a failed push changes nothing about the session,
+ *              and a reader must not conclude the box stopped running its last tree.
+ *
+ * WP-6 D-13: BOTH outcomes also store `pushTimings`, the per-phase timings the result carried (only
+ * keys whose values are finite numbers; null when it carried none). A LATE ok result (D-11) clears
+ * `pushError` exactly as an on-time one does — it is `recordAgentBundlePush` either way.
+ *
+ * Bumps the registry revision only when the surfaced `skills` block actually changed.
+ */
+function recordAgentBundlePush(instanceId, result, deps = {}) {
+  const id = _string(instanceId, 160);
+  if (!id) return null;
+  const now = _now(deps);
+  const previous = _agentBundlePush.get(id) || null;
+  const ok = !!(result && result.ok);
+  const pushTimings = _pushTimingsOf(result);
+  const next = ok
+    ? {
+      sentTreeHash: _string(result.treeHash, 80) || null,
+      sentAt: now,
+      sentCount: Number(result.sentCount) || 0,
+      heldBack: Array.isArray(result.heldBack) ? result.heldBack : [],
+      plugins: _pluginsFromResult(result, previous),
+      pushError: null,
+      pushTimings,
+    }
+    : {
+      sentTreeHash: previous ? previous.sentTreeHash : null,
+      sentAt: previous ? previous.sentAt : 0,
+      sentCount: previous ? previous.sentCount : 0,
+      heldBack: previous ? previous.heldBack : [],
+      plugins: _pluginsFromResult(result, previous),
+      pushError: {
+        code: _string(result && result.code, 80) || 'agent_bundle_push_network',
+        // D-4: the box's own reason, so the Machines line can say WHY (public/m/machines.js renders
+        // `error.message || error.code`). Absent when the box named nothing — never an empty string.
+        ...(_string(result && result.boxCode, 80) ? { message: _string(result.boxCode, 80) } : {}),
+        // WP-6 D-11: the push outlived the caller's wait and is running on — its result will arrive
+        // later. Present ONLY when true, like every other optional key here.
+        ...(result && result.continuing === true ? { continuing: true } : {}),
+        at: now,
+      },
+      pushTimings,
+    };
+  _agentBundlePush.set(id, next);
+  if (_skillsChanged(previous, next, _agentSkills.get(id) || null)) noteRegistryChanged();
+  return _skillsViewFrom(next, _agentSkills.get(id) || null);
+}
+
 /**
  * D-12/D-16: the box's own host sample as this hub last read it, with the hub-clock stamp of that
  * read, or null when the box has never been asked successfully. Readers use `checkedAt` to label a
@@ -721,13 +1381,74 @@ function hostStatsFor(instanceId) {
   return entry ? { sample: entry.sample, checkedAt: entry.checkedAt } : null;
 }
 
-/** Test seam: the miss counters, the agent-auth/host-stats/manifest caches and the sweep verdict. */
+/**
+ * WP-8 §6.5 step 7: drop the memoized hub item lists.
+ *
+ * A skill IMPORT changes the hub's own skill tree, and the cache is keyed only by platform — so without
+ * this the hub would keep classifying every OTHER box against the pre-import list for up to 60 s. The
+ * next read rebuilds from the (now-changed) tree.
+ */
+function invalidateHubItemCache() {
+  _hubItemCache.clear();
+}
+
+/**
+ * WP-8 §6.5 step 7: make ONE box's inventory stale, so the next probe tick re-reads it.
+ *
+ * The stamp (not the entry) is zeroed: the last classification stays visible — a reader sees the
+ * pre-import review list rather than a row blanked to "no skills" — and `probeMachinesOnce`'s
+ * `now - checkedAt >= AGENT_AUTH_REFRESH_MS` gate re-reads on the very next tick. Only a box this
+ * process has actually read is touched; a never-read box has nothing to invalidate.
+ */
+function markAgentSkillsStale(instanceId) {
+  const id = _string(instanceId, 160);
+  if (!id) return;
+  const entry = _agentSkills.get(id);
+  if (entry) _agentSkills.set(id, { ...entry, checkedAt: 0 });
+}
+
+/**
+ * WP-4: routes just deleted ON the box are gone from the hub's cached models block at once (the
+ * Review dialog re-reads the list right after the remove), and the stamp is zeroed so the very next
+ * tick re-reads the box's own truth. The block's other fields are left as read — only the box can
+ * say what the removal did to `usable` or to a /delegate pick that named a removed route.
+ */
+function forgetMachineModelRoutes(instanceId, routeIds) {
+  const id = _string(instanceId, 160);
+  const entry = id ? _machineModels.get(id) : null;
+  if (!entry) return;
+  const gone = new Set((Array.isArray(routeIds) ? routeIds : []).map((route) => _string(route, 200)));
+  const block = entry.block && Array.isArray(entry.block.unreachable)
+    ? { ...entry.block, unreachable: entry.block.unreachable.filter((row) => !gone.has(row.id)) }
+    : entry.block;
+  _machineModels.set(id, { block, checkedAt: 0 });
+  noteRegistryChanged();
+}
+
+function markMachineModelsStale(instanceId) {
+  const id = _string(instanceId, 160);
+  if (!id) return;
+  const entry = _machineModels.get(id);
+  if (!entry) return;
+  _machineModels.set(id, { block: entry.block, checkedAt: 0 });
+}
+
+/** Test seam: the miss counters, the agent-auth/host-stats/manifest caches, the skills push state
+ * (WP-3) and the skill inventory + hub-item cache (WP-7), the sweep verdict, and the hub's cached
+ * away-path read (WP-3 rev 3). */
 function _resetMachineRegistryStateForTests() {
   _missStreak.clear();
   _agentAuth.clear();
+  _agentPresence.clear();
   _hostStats.clear();
   _manifestHost.clear();
+  _manifestBuild.clear();
+  _agentBundlePush.clear();
+  _agentSkills.clear();
+  _machineModels.clear();
+  _hubItemCache.clear();
   _lastSweep = { hubNetworkSuspect: false, at: 0 };
+  _awayPathProxyExists = null;
 }
 
 module.exports = {
@@ -737,13 +1458,37 @@ module.exports = {
   AGENT_AUTH_REFRESH_MS,
   HOST_STATS_REFRESH_MS,
   agentAuthFor,
+  // WP-13b (D-15): the box's own available-agents presence as this hub last read it
+  // (`{ dsh: { available } }`), or null when it was never read — the gate in
+  // lib/remote-machine-create.js and the machine row both read it through here.
+  agentAvailabilityFor,
   hostStatsFor,
   listMachines,
+  // WP-3 rev 3 (§13.6 D-17): why an unreachable box cannot be dialled from here (`no_away_path` /
+  // `away_path_down`), or null when that is not this hub's to say. Read straight off the machine view.
+  machineAwayReason,
   registryRevision,
   noteRegistryChanged,
   registerMachine,
   probeMachinesOnce,
   seedMachinesFromSyncPeers,
   summarizeMachines,
+  // WP-3 (docs/remote-agent-skills-bundles-2026-10-25.html D-9/§6.5): the box's os (from the cached
+  // manifest host block) and the agent-skill push state the machine row surfaces.
+  manifestHostFor,
+  recordAgentBundlePush,
+  agentBundlePushFor,
+  // WP-8 (§6.5 step 7): after an import/retire/exclude-plugins write the hub's own item list and this
+  // box's inventory read are both stale — these two make the next read see the change.
+  invalidateHubItemCache,
+  markAgentSkillsStale,
+  // WP-5 (§6.4): after a copy the box has one more row — zero the stamp so the next tick re-reads
+  // it, without dropping the block (the removal path's `forgetMachineModelRoutes` drops ids, which
+  // is the wrong move for an ADDITION: the hub cannot say what the new row's verdict is).
+  markMachineModelsStale,
+  forgetMachineModelRoutes,
+  // WP-5 (§6.4): the §6.2 block as this hub last read it — the hub's "Use on <box>" list reads it
+  // to drop the routes the box already has and the origins the box already said it cannot reach.
+  modelsFor,
   _resetMachineRegistryStateForTests,
 };