dsh-zen-remote 2.3.10 → 2.4.0

package/lib/client.js

@@ -1947,10 +1947,10 @@ exports.RESTART_FIELDS = void 0;
  * effect (T17): `role` chooses which halves load; `port` / `host` /
  * `targetPort` / `rateLimit` / `trustedProxies` become the gateway child's
  * runtime shape; `vapidSubject` / `lang` / `pushEvents` / `pushDebounceMs` /
- * `pushSummary` / `pushTurnEnd` / `pushTool` are the push leg's startup
- * values. Everything else (serverName, idleHours, autoShareNewSessions,
- * serverUrl, deviceToken, and the interface-half knobs) is read live per use
- * and needs no reload.
+ * `pushSummary` / `pushTurnEnd` / `pushTool` / `pushEnabled` /
+ * `pushSessionName` are the push leg's startup values. Everything else
+ * (serverName, idleHours, autoShareNewSessions, serverUrl, deviceToken, and
+ * the interface-half knobs) is read live per use and needs no reload.
  *
  * Single source shared by both halves: the host's restart watcher
  * (src/restart-watcher.ts) fingerprints exactly these fields, and the
@@ -1974,6 +1974,8 @@ exports.RESTART_FIELDS = [
     'pushSummary',
     'pushTurnEnd',
     'pushTool',
+    'pushEnabled',
+    'pushSessionName',
 ];
 };
 __modules["client-data/plugin-bridge.js"] = function (require, module, exports) {
@@ -2122,10 +2124,11 @@ __modules["client-data/settings-form.js"] = function (require, module, exports)
  * (devices / pairing) plus the T14 envelope (ok / gateway / config / viaGateway).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ZenRemoteSettingsForm = exports.SETTINGS_FIELDS = exports.IDLE_HOURS_MAX = exports.SERVER_NAME_MAX = exports.RESTART_FIELDS = exports.PAIRING_CODE_LENGTH = exports.PAIRING_CODE_ALPHABET = exports.DEVICE_TOKEN_FIELD = exports.CLIENT_CONFIG_ROUTE = exports.CLIENT_DEBUG_REPORT_ROUTE = exports.CLIENT_RECONNECT_ROUTE = exports.CLIENT_STATUS_ROUTE = exports.CLIENT_CLAIM_ROUTE = exports.ADMIN_PLUGIN_BRIDGE_ROUTE = exports.ADMIN_PUSH_TEST_ROUTE = exports.ADMIN_ACTION_ROUTE = exports.ADMIN_PAIR_ROUTE = exports.ADMIN_STATUS_ROUTE = void 0;
+exports.ZenRemoteSettingsForm = exports.SETTINGS_FIELDS = exports.IDLE_HOURS_MAX = exports.SERVER_NAME_MAX = exports.RESTART_FIELDS = exports.PAIRING_CODE_LENGTH = exports.PAIRING_CODE_ALPHABET = exports.DEVICE_TOKEN_FIELD = exports.CLIENT_CONFIG_ROUTE = exports.MAX_PAIRED_SERVERS = exports.CLIENT_DEBUG_REPORT_ROUTE = exports.CLIENT_UNPAIR_ROUTE = exports.CLIENT_RECONNECT_ROUTE = exports.CLIENT_STATUS_ROUTE = exports.CLIENT_CLAIM_ROUTE = exports.ADMIN_PLUGIN_BRIDGE_ROUTE = exports.ADMIN_PUSH_TEST_ROUTE = exports.ADMIN_ACTION_ROUTE = exports.ADMIN_PAIR_ROUTE = exports.ADMIN_STATUS_ROUTE = void 0;
 exports.deriveClientStatusView = deriveClientStatusView;
 exports.clientStatusLineOf = clientStatusLineOf;
 exports.normalizePairingCode = normalizePairingCode;
+exports.canSubmitClientPairing = canSubmitClientPairing;
 exports.shouldFollowServerDeviceName = shouldFollowServerDeviceName;
 exports.shouldReloadAfterClientActivation = shouldReloadAfterClientActivation;
 exports.awaitClientStatusReady = awaitClientStatusReady;
@@ -2157,9 +2160,20 @@ exports.CLIENT_CLAIM_ROUTE = '/_dsh/zen-remote/client/claim';
 exports.CLIENT_STATUS_ROUTE = '/_dsh/zen-remote/client/status';
 /** T43: one immediate reconnect — answered 409 unless the client is offline. */
 exports.CLIENT_RECONNECT_ROUTE = '/_dsh/zen-remote/client/reconnect';
+/** MS-6: POST `{ entryId }` (or `{ all: true }`) removes one / all paired
+ * servers from the pool (host half: src/client-routes.ts, mirrored here
+ * because the browser half cannot import the host module). */
+exports.CLIENT_UNPAIR_ROUTE = '/_dsh/zen-remote/client/unpair';
 /** CU-4: the redacted diagnostic report (GET, both roles, machine-local only
  * — a gateway-forwarded fetch is refused server-side). */
 exports.CLIENT_DEBUG_REPORT_ROUTE = '/_dsh/zen-remote/client/debug-report';
+/**
+ * MS-6: the paired-server pool's cap — the browser mirror of
+ * src/state-store.ts's constant of the same name (the host module cannot be
+ * imported here). The settings page and the wizard read it for the
+ * `已配对 N / 8 台` counters and the limit gating.
+ */
+exports.MAX_PAIRED_SERVERS = 8;
 /** The lightweight client-facing config route (host half, both roles): the
  * settings page's FALLBACK role probe (T17) — it registers wherever a
  * webServer exists, and since T17 its body carries the effective `role`
@@ -2177,6 +2191,40 @@ const WIRE_STATE_ALIASES = {
     online: 'connected',
     offline: 'unreachable',
 };
+/** The view `state` for one raw wire word: the vocabulary verbatim, the T55
+ * aliases mapped, anything else the conservative `unpaired`. Shared by the
+ * top level and every `servers[]` row. */
+function clientStateOf(raw) {
+    const word = typeof raw === 'string' ? raw : '';
+    return CLIENT_STATES.includes(word)
+        ? word
+        : WIRE_STATE_ALIASES[word] ?? 'unpaired';
+}
+/** The finite-number gate every epoch-ms wire field passes. */
+function finiteOrUndefined(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
+}
+/** MS-6: one `servers[]` row into its view. Tolerant like the top level —
+ * a junk field degrades, a row without the route's stable `entryId` key
+ * drops whole. */
+function deriveClientServerView(value) {
+    const record = asRecord(value);
+    const entryId = asStringSet(record.entryId);
+    if (entryId === '')
+        return undefined;
+    return {
+        entryId,
+        serverId: asStringSet(record.serverId),
+        serverUrl: asStringSet(record.serverUrl),
+        serverName: asStringSet(record.serverName),
+        displayName: asStringSet(record.displayName),
+        state: clientStateOf(record.state),
+        nextRetryAt: finiteOrUndefined(record.nextRetryAt),
+        lastError: asStringSet(record.lastError),
+        compat: deriveCompatView(record.compat),
+        pluginBridge: (0, plugin_bridge_ts_1.derivePluginBridgeStatuses)(record.pluginBridge),
+    };
+}
 /** At most `cap` strings out of an array-shaped value; anything else is none. */
 function stringListOf(value, cap) {
     if (!Array.isArray(value))
@@ -2264,18 +2312,20 @@ function deriveClientStatusView(body) {
     // diagnostics below it showed live relay calls. `offline` rides the same
     // mapping to the probe word for it; anything else unknown still degrades
     // to `unpaired`.
-    const rawState = typeof safe.state === 'string' ? safe.state : '';
-    const state = CLIENT_STATES.includes(rawState)
-        ? rawState
-        : WIRE_STATE_ALIASES[rawState] ?? 'unpaired';
-    const nextRetryAt = typeof safe.nextRetryAt === 'number' && Number.isFinite(safe.nextRetryAt)
-        ? safe.nextRetryAt
-        : undefined;
+    const state = clientStateOf(safe.state);
+    // MS-6: the pool list rides as `servers[]` (one row per paired entry); a
+    // legacy single-server body answers the empty list and the pre-MS-6 page
+    // shape otherwise.
+    const servers = (Array.isArray(safe.servers) ? safe.servers : [])
+        .map(deriveClientServerView)
+        .filter((row) => row !== undefined);
+    const maxServersRaw = finiteOrUndefined(safe.maxServers);
+    const maxServers = maxServersRaw !== undefined && maxServersRaw >= 1 ? maxServersRaw : exports.MAX_PAIRED_SERVERS;
     return {
         state,
         serverUrl: typeof safe.serverUrl === 'string' ? safe.serverUrl : '',
         serverName: typeof safe.serverName === 'string' ? safe.serverName : '',
-        nextRetryAt,
+        nextRetryAt: finiteOrUndefined(safe.nextRetryAt),
         lastError: typeof safe.lastError === 'string' ? safe.lastError : '',
         deviceName: typeof safe.deviceName === 'string' ? safe.deviceName : '',
         intercept: deriveInterceptView(safe.intercept),
@@ -2285,6 +2335,9 @@ function deriveClientStatusView(body) {
         uploadProbe: safe.serviceProbe !== null && typeof safe.serviceProbe === 'object'
             ? Object.freeze({ ...safe.serviceProbe })
             : undefined,
+        servers,
+        maxServers,
+        limitReached: servers.length >= maxServers,
     };
 }
 function clientStatusLineOf(view, now) {
@@ -2319,6 +2372,39 @@ function normalizePairingCode(input) {
         .replace(/[^ABCDEFGHJKMNPQRSTUVWXYZ23456789]/g, '')
         .slice(0, exports.PAIRING_CODE_LENGTH);
 }
+/**
+ * The address comparison the overwrite judgment makes (MS-6): trim padding,
+ * drop trailing slashes. Light on purpose — the backend re-normalizes the
+ * address authoritatively on claim; here it only decides whether the typed
+ * address NAMES an already-paired server, and `http://x.local:3088/` must
+ * count as that server while `http://x.local:3089` must not.
+ */
+function normalizedPairAddress(url) {
+    return url.trim().replace(/\/+$/u, '');
+}
+/**
+ * The 配对 button's whole gate, as one pure truth table (MS-6): the claim
+ * needs an address and a COMPLETE 8-character pairing code (the input box
+ * normalizes as the user types; this judge is the same bar the route's code
+ * grammar enforces), a quiet page (`busy`), and a valid device-name draft
+ * (`deviceNameInvalid`, T60 — a red-boxed name would silently pair under the
+ * fallback copy). The pool cap blocks only NEW addresses: a full pool still
+ * accepts re-pairing an existing one in place, which is how a user whose
+ * token was revoked at 8/8 gets back in.
+ */
+function canSubmitClientPairing(input) {
+    const maxServers = input.maxServers ?? exports.MAX_PAIRED_SERVERS;
+    const address = normalizedPairAddress(input.pairUrl);
+    const isOverwrite = address !== ''
+        && input.servers.some((server) => normalizedPairAddress(server.serverUrl) === address);
+    const blockedByLimit = !isOverwrite && input.servers.length >= maxServers;
+    const allowed = address !== ''
+        && normalizePairingCode(input.pairCode).length === exports.PAIRING_CODE_LENGTH
+        && !blockedByLimit
+        && input.busy !== true
+        && input.deviceNameInvalid !== true;
+    return { allowed, isOverwrite, blockedByLimit };
+}
 /**
  * Whether the settings page may follow the SERVER's record of this device's
  * name into the row (T59): the body carried a name, it differs from the row
@@ -2580,6 +2666,8 @@ exports.SETTINGS_FIELDS = [
     textField('trustedProxies'),
     intField('rateLimit', 1, Number.MAX_SAFE_INTEGER),
     textField('vapidSubject'),
+    boolField('pushEnabled'),
+    boolField('pushSessionName'),
     boolField('pushSummary'),
     boolField('pushTurnEnd'),
     boolField('pushTool'),
@@ -3251,6 +3339,10 @@ exports.zh = {
     'settings.invalidPort': '需要 1–65535 的整数',
     'settings.invalidPositiveInt': '需要正整数',
     'settings.pushTitle': '推送',
+    'settings.fieldPushEnabled': '启用会话通知',
+    'settings.fieldPushEnabledHint': '总开关：关闭后停止所有自动推送，且不注册 push_notify 工具与系统提示词。',
+    'settings.fieldPushSessionName': '推送来源会话名',
+    'settings.fieldPushSessionNameHint': '在推送正文第一行显示「来源会话：<会话名>」。',
     'settings.fieldPushSummary': '推送内容摘要',
     'settings.fieldPushSummaryHint': '在推送正文中包含回合的最终文本或待回答的问题。',
     'settings.fieldPushTurnEnd': '回合结束推送',
@@ -3328,7 +3420,7 @@ exports.zh = {
     'settings.refreshFailed': '状态刷新失败，当前显示的是上一次成功的数据',
     'settings.resetPreview': '保存后恢复为下一层的值',
     // --- 插件设置页（T16），子客户端区块 ---
-    'settings.client.connectTitle': '连接服务端',
+    'settings.client.connectTitle': '连接主服务端',
     'settings.client.serverUrl': '服务端地址',
     'settings.client.serverUrlHint': '服务端网关地址，例如 http://192.168.1.10:3088 或 https://dsh.example.com。',
     // The label above is the shared 设备名称 field in the role card (T57); this
@@ -3348,7 +3440,27 @@ exports.zh = {
     'settings.client.failUnreachable': '无法连接服务端',
     'settings.client.failRoleMismatch': '该配对码不适用于桌面应用端',
     'settings.client.failUnexpected': '服务端回应无法识别，请确认服务端已安装 dsh-zen-remote 2.0.0',
-    'settings.client.failWrite': '配对成功，但本机保存令牌失败：设置存储不可用或只读',
+    'settings.client.failLimitReached': '已达主服务端数量上限：请先移除旧服务端，或输入已配对服务端的地址覆盖重配',
+    // --- MS-7 多服务端：卡片头计数、8 台上限红字、已配对主服务端列表 ---
+    'settings.client.poolCount': '已配对 {count} / {max} 台',
+    'settings.client.poolCapNote': '最多可同时连接 {max} 台主服务端。',
+    'settings.client.limitReached': '已配满 {count} / {max} 台主服务端（已达上限）。如需添加新服务端，请先移除旧服务端；输入已配对服务端的地址仍可覆盖重配。',
+    'settings.client.serversTitle': '已配对主服务端',
+    'settings.client.serversEmpty': '尚未配对任何主服务端（最多可同时连接 {max} 台）',
+    'settings.client.repair': '重新配对',
+    'settings.client.serverRemove': '移除',
+    'settings.client.unpairServerConfirm': '将从本机移除该主服务端的配对（服务端上的数据与设备记录不受影响）。确定移除？',
+    'settings.client.unpairAllServers': '全部移除',
+    'settings.client.unpairAllServersConfirm': '将从本机移除全部已配对的主服务端（服务端上的数据与设备记录不受影响）。确定移除？',
+    'settings.client.serverStateConnected': '已连接',
+    'settings.client.serverStateRetry': '离线，{seconds} 秒后重试',
+    'settings.client.serverStateRetrySoon': '离线，即将重试',
+    'settings.client.serverStateOffline': '离线',
+    'settings.client.serverStateRevoked': '令牌已吊销',
+    'settings.client.serverStateIncompatible': '不兼容',
+    'settings.client.serverStateInvalidUrl': '地址无效',
+    'settings.client.serverStateUnpaired': '未连接',
+    'settings.client.serverDiagTitle': '各主服务端诊断',
     'settings.client.statusTitle': '连接状态',
     'settings.client.statusUnpaired': '未配对',
     'settings.client.statusConnected': '已连接到 {serverUrl}',
@@ -3527,6 +3639,7 @@ exports.zh = {
     'wizard.desktop.generate': '生成桌面客户端配对码',
     'wizard.desktop.regenerate': '重新生成配对码',
     'wizard.desktop.copyInfo': '复制地址与配对码',
+    'wizard.desktop.copiedText': '服务端地址：{address}\n桌面客户端配对码：{code}',
     'wizard.desktop.guide': '在另一台电脑打开本插件详情页，第 1 步选「作为桌面客户端」，第 2 步填入上方服务端地址与 8 位配对码即可完成连接。',
     'wizard.desktop.pairedTitle': '已连接的桌面客户端（{count}）',
     'wizard.desktop.pairedEmpty': '暂未配对桌面客户端',
@@ -3641,7 +3754,7 @@ exports.zh = {
     'wizard.overview.devicesSummary': '手机/网页 {web} 台 · 桌面客户端 {desktop} 台',
     'wizard.overview.devicesNone': '暂未配对设备',
     'wizard.overview.clientCredLabel': '本地配对凭证',
-    'wizard.overview.clientConnLabel': '服务端连接',
+    'wizard.overview.clientConnLabel': '连接状态',
     'wizard.overview.clientServerLabel': '远端服务端地址',
     'wizard.overview.startSetup': '开始配置向导',
     'wizard.overview.reconfigure': '修改接入配置',
@@ -3663,6 +3776,26 @@ exports.zh = {
     'wizard.devicesModal.title': '已配对设备管理',
     'wizard.devicesModal.subtitle': '查看与管理已配对的手机/网页设备及桌面客户端，支持改名、切换布局或吊销凭证',
     'wizard.devicesModal.retest': '重新测试连通性',
+    'wizard.overview.clientSyncLabel': '会话与插件同步',
+    'wizard.overview.syncOk': '正常',
+    'wizard.overview.syncBad': '异常',
+    'wizard.overview.syncPending': '未连接',
+    'wizard.overview.clientOnlineCount': '在线 {online} / {total} 台',
+    'wizard.overview.clientOfflineCount': '离线 {count} 台',
+    'wizard.overview.clientRevokedCount': '已吊销 {count} 台',
+    'wizard.overview.clientAllOnline': '全部在线',
+    'wizard.overview.clientServersLabel': '已配对服务端',
+    'wizard.overview.clientPairedFull': '已配满 {count} / {max} 台（已达上限）',
+    'wizard.overview.clientPairedNames': '{names}（上限 {max} 台）',
+    'wizard.overview.limitNote': '已达 {max} 台上限，添加前请先移除旧服务端',
+    'wizard.overview.manageServers': '管理服务端',
+    'wizard.overview.addServer': '+ 添加服务端',
+    'wizard.serversModal.title': '已配对主服务端管理',
+    'wizard.serversModal.subtitle': '最多同时连接 {max} 台主服务端（当前 {count} / {max} 台）',
+    'wizard.serversModal.viewStatus': '查看状态',
+    'wizard.client.poolCapNote': '最多同时连接 {max} 台主服务端（当前已配对 {count} / {max} 台）',
+    'wizard.client.continueAdd': '+ 继续添加另一台',
+    'wizard.client.serverPicker': '选择要查看的服务端',
 };
 /** English dictionary, key-identical to the Chinese source of truth. */
 exports.en = {
@@ -3774,6 +3907,10 @@ exports.en = {
     'settings.invalidPort': 'Enter an integer from 1 to 65535',
     'settings.invalidPositiveInt': 'Enter a positive integer',
     'settings.pushTitle': 'Push',
+    'settings.fieldPushEnabled': 'Enable session notifications',
+    'settings.fieldPushEnabledHint': 'Master switch: when off, stops all automatic pushes and does not register the push_notify tool or system prompt.',
+    'settings.fieldPushSessionName': 'Include session name in push',
+    'settings.fieldPushSessionNameHint': 'Show "Session: <name>" on the first line of the push notification body.',
     'settings.fieldPushSummary': 'Push body summary',
     'settings.fieldPushSummaryHint': 'Include the turn\u2019s final text or pending question in push bodies.',
     'settings.fieldPushTurnEnd': 'Turn-end push',
@@ -3850,7 +3987,7 @@ exports.en = {
     'settings.statusUnknown': 'Could not read the plugin status',
     'settings.refreshFailed': 'The status refresh failed — showing the last successful data',
     'settings.resetPreview': 'Saving reverts to the next layer\u2019s value',
-    'settings.client.connectTitle': 'Connect to the server',
+    'settings.client.connectTitle': 'Connect to main servers',
     'settings.client.serverUrl': 'Server address',
     'settings.client.serverUrlHint': 'The server\u2019s gateway address, e.g. http://192.168.1.10:3088 or https://dsh.example.com.',
     // The label above is the shared 设备名称 field in the role card (T57); this
@@ -3870,7 +4007,27 @@ exports.en = {
     'settings.client.failUnreachable': 'Could not reach the server',
     'settings.client.failRoleMismatch': 'This pairing code is not valid for desktop clients',
     'settings.client.failUnexpected': 'The server gave an unrecognized answer — make sure it runs dsh-zen-remote 2.0.0',
-    'settings.client.failWrite': 'Pairing succeeded, but saving the token locally failed: the settings store is unavailable or read-only',
+    'settings.client.failLimitReached': 'The main-server limit is reached: remove an old server first, or enter an already-paired address to re-pair it in place',
+    // --- MS-7 multi-server: card-head count, the 8-server red alert, the paired list ---
+    'settings.client.poolCount': '{count} / {max} paired',
+    'settings.client.poolCapNote': 'Up to {max} main servers can be connected at the same time.',
+    'settings.client.limitReached': 'All {count} / {max} main servers are paired (the limit is reached). To add a new server, remove an old one first; entering an already-paired address still re-pairs it in place.',
+    'settings.client.serversTitle': 'Paired main servers',
+    'settings.client.serversEmpty': 'No main servers paired yet (up to {max} at the same time)',
+    'settings.client.repair': 'Re-pair',
+    'settings.client.serverRemove': 'Remove',
+    'settings.client.unpairServerConfirm': 'This machine will forget this main server\u2019s pairing (data and the device record on the server are untouched). Remove it?',
+    'settings.client.unpairAllServers': 'Remove all',
+    'settings.client.unpairAllServersConfirm': 'This machine will forget every paired main server (data and device records on the servers are untouched). Remove all?',
+    'settings.client.serverStateConnected': 'Connected',
+    'settings.client.serverStateRetry': 'Offline, retrying in {seconds} s',
+    'settings.client.serverStateRetrySoon': 'Offline, retrying now',
+    'settings.client.serverStateOffline': 'Offline',
+    'settings.client.serverStateRevoked': 'Token revoked',
+    'settings.client.serverStateIncompatible': 'Incompatible',
+    'settings.client.serverStateInvalidUrl': 'Invalid address',
+    'settings.client.serverStateUnpaired': 'Not connected',
+    'settings.client.serverDiagTitle': 'Per-server diagnostics',
     'settings.client.statusTitle': 'Connection',
     'settings.client.statusUnpaired': 'Not paired',
     'settings.client.statusConnected': 'Connected to {serverUrl}',
@@ -4047,6 +4204,7 @@ exports.en = {
     'wizard.desktop.generate': 'Generate Desktop Pairing Code',
     'wizard.desktop.regenerate': 'Regenerate Code',
     'wizard.desktop.copyInfo': 'Copy Address & Code',
+    'wizard.desktop.copiedText': 'Server address: {address}\nDesktop client pairing code: {code}',
     'wizard.desktop.guide': 'On the other computer, open this plugin page, choose "Desktop Client" in Step 1, and enter the server address and 8-character code above in Step 2.',
     'wizard.desktop.pairedTitle': 'Paired Desktop Clients ({count})',
     'wizard.desktop.pairedEmpty': 'No desktop clients paired yet',
@@ -4161,7 +4319,7 @@ exports.en = {
     'wizard.overview.devicesSummary': 'Phone/Web {web} · Desktop {desktop}',
     'wizard.overview.devicesNone': 'No paired devices yet',
     'wizard.overview.clientCredLabel': 'Local Credential',
-    'wizard.overview.clientConnLabel': 'Server Connection',
+    'wizard.overview.clientConnLabel': 'Connection',
     'wizard.overview.clientServerLabel': 'Remote Server URL',
     'wizard.overview.startSetup': 'Start Setup Wizard',
     'wizard.overview.reconfigure': 'Reconfigure Wizard',
@@ -4183,6 +4341,26 @@ exports.en = {
     'wizard.devicesModal.title': 'Paired Devices',
     'wizard.devicesModal.subtitle': 'View and manage paired phone/web and desktop client devices — rename, switch layout, or revoke access',
     'wizard.devicesModal.retest': 'Retest Connectivity',
+    'wizard.overview.clientSyncLabel': 'Session & Plugin Sync',
+    'wizard.overview.syncOk': 'Normal',
+    'wizard.overview.syncBad': 'Abnormal',
+    'wizard.overview.syncPending': 'Not connected',
+    'wizard.overview.clientOnlineCount': '{online} / {total} online',
+    'wizard.overview.clientOfflineCount': '{count} offline',
+    'wizard.overview.clientRevokedCount': '{count} revoked',
+    'wizard.overview.clientAllOnline': 'All online',
+    'wizard.overview.clientServersLabel': 'Paired Servers',
+    'wizard.overview.clientPairedFull': 'All {count} / {max} paired (limit reached)',
+    'wizard.overview.clientPairedNames': '{names} (up to {max})',
+    'wizard.overview.limitNote': 'The {max}-server limit is reached — remove an old server before adding another',
+    'wizard.overview.manageServers': 'Manage Servers',
+    'wizard.overview.addServer': '+ Add Server',
+    'wizard.serversModal.title': 'Paired Main Servers',
+    'wizard.serversModal.subtitle': 'Up to {max} main servers at the same time (currently {count} / {max})',
+    'wizard.serversModal.viewStatus': 'View Status',
+    'wizard.client.poolCapNote': 'Up to {max} main servers at the same time ({count} / {max} currently paired)',
+    'wizard.client.continueAdd': '+ Add Another Server',
+    'wizard.client.serverPicker': 'Choose the server to view',
 };
 };
 __modules["client-data/shares.js"] = function (require, module, exports) {
@@ -16738,6 +16916,8 @@ __modules["virtual-id.js"] = function (require, module, exports) {
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VIRTUAL_GROUP_NAME_MARK = exports.VIRTUAL_ID_PREFIX = void 0;
+exports.encodeServerIdZeroWidth = encodeServerIdZeroWidth;
+exports.decodeServerIdZeroWidth = decodeServerIdZeroWidth;
 exports.toVirtual = toVirtual;
 exports.fromVirtual = fromVirtual;
 exports.isVirtual = isVirtual;
@@ -16757,9 +16937,69 @@ exports.VIRTUAL_ID_PREFIX = 'zr~';
  * text.
  */
 exports.VIRTUAL_GROUP_NAME_MARK = '\u2060';
+/** MS-4: the two zero-width code points the serverId rides on inside a
+ * virtual group NAME — ZERO WIDTH SPACE encodes bit 0, ZERO WIDTH
+ * NON-JOINER bit 1. Invisible everywhere, and neither can appear in a
+ * server id's own visible text, so the window between the two marks is
+ * unambiguous. */
+const ZERO_BIT = '\u200b';
+const ONE_BIT = '\u200c';
+const SERVER_ID_BITS = 32;
 /** The server id half: exactly the 8 lowercase hex chars relay-server.ts
  * mints (`randomBytes(4).toString('hex')`). */
 const SERVER_ID_PATTERN = /^[0-9a-f]{8}$/;
+/**
+ * MS-4: the invisible prefix a REMOTE model-menu group heading carries
+ * before its server name (merge-streams.ts mergeModelCatalogs). The full
+ * form is `${MARK}${32 zero-width bits}${MARK}` — the 32 bits of the
+ * 8-hex serverId (MSB first per nibble), ZERO_BIT for 0 and ONE_BIT for 1
+ * — so the browser half can tell WHICH server a remote model group came
+ * from (effects/model-group-side.ts classifies per-server hiding from
+ * heading text alone). A serverId that is not 8 lowercase hex (the format
+ * every real handshake carries) degrades to the bare legacy mark: the
+ * heading stays a marked remote heading, just without a decodable server.
+ */
+function encodeServerIdZeroWidth(serverId) {
+    if (typeof serverId !== 'string' || !SERVER_ID_PATTERN.test(serverId))
+        return exports.VIRTUAL_GROUP_NAME_MARK;
+    let bits = '';
+    for (const nibble of serverId) {
+        for (const bit of Number.parseInt(nibble, 16).toString(2).padStart(4, '0')) {
+            bits += bit === '0' ? ZERO_BIT : ONE_BIT;
+        }
+    }
+    return `${exports.VIRTUAL_GROUP_NAME_MARK}${bits}${exports.VIRTUAL_GROUP_NAME_MARK}`;
+}
+/**
+ * MS-4: read the server id back out of one group heading, or `undefined`.
+ * Strict like every decoder here: the text must start with the mark, the
+ * window right after it must be exactly 32 zero-width bits closed by the
+ * terminator mark — anything else (the legacy bare-mark heading, visible
+ * text, a short or long bit run, a missing terminator) answers
+ * `undefined`, which the classifier reads as "remote, server unknown".
+ */
+function decodeServerIdZeroWidth(headingText) {
+    if (typeof headingText !== 'string' || !headingText.startsWith(exports.VIRTUAL_GROUP_NAME_MARK))
+        return undefined;
+    const rest = headingText.slice(exports.VIRTUAL_GROUP_NAME_MARK.length);
+    if (rest.length < SERVER_ID_BITS + 1 || rest[SERVER_ID_BITS] !== exports.VIRTUAL_GROUP_NAME_MARK)
+        return undefined;
+    let hex = '';
+    for (let i = 0; i < SERVER_ID_BITS; i += 4) {
+        let nibble = 0;
+        for (let bit = 0; bit < 4; bit++) {
+            const bitChar = rest[i + bit];
+            if (bitChar === ZERO_BIT)
+                nibble = nibble << 1;
+            else if (bitChar === ONE_BIT)
+                nibble = (nibble << 1) | 1;
+            else
+                return undefined;
+        }
+        hex += nibble.toString(16);
+    }
+    return hex;
+}
 /** Build the virtual form of one server-side session or workspace id. */
 function toVirtual(serverId, id) {
     return `${exports.VIRTUAL_ID_PREFIX}${serverId}~${id}`;
@@ -17526,9 +17766,38 @@ function pairFailText(fail, t) {
         }
         case 'unreachable': return t('settings.client.failUnreachable');
         case 'role-mismatch': return t('settings.client.failRoleMismatch');
+        case 'limit-reached': return t('settings.client.failLimitReached');
         default: return t('settings.client.failUnexpected');
     }
 }
+/** Whether one paired server has anything for the per-server diagnostics
+ * group (MS-7): a last error, a compat block, or bridge verdicts. */
+function serverHasDiag(server) {
+    return server.lastError !== '' || server.compat !== undefined || server.pluginBridge.length > 0;
+}
+/** One paired server's state badge (MS-7): copy plus the tone the badge
+ * wears — `live` green for connected, `warn` for an offline row (with the
+ * retry countdown when one is armed), `invalid` red for a verdict only a
+ * re-pair or an upgrade fixes. */
+function serverStateBadge(server, now, t) {
+    switch (server.state) {
+        case 'connected': return { text: t('settings.client.serverStateConnected'), tone: 'live' };
+        case 'unreachable':
+        case 'unexpected': {
+            if (server.nextRetryAt === undefined)
+                return { text: t('settings.client.serverStateOffline'), tone: 'warn' };
+            const seconds = Math.max(0, Math.ceil((server.nextRetryAt - now) / 1000));
+            return {
+                text: seconds > 0 ? t('settings.client.serverStateRetry', { seconds }) : t('settings.client.serverStateRetrySoon'),
+                tone: 'warn',
+            };
+        }
+        case 'revoked': return { text: t('settings.client.serverStateRevoked'), tone: 'invalid' };
+        case 'incompatible': return { text: t('settings.client.serverStateIncompatible'), tone: 'invalid' };
+        case 'invalid-url': return { text: t('settings.client.serverStateInvalidUrl'), tone: 'invalid' };
+        default: return { text: t('settings.client.serverStateUnpaired'), tone: undefined };
+    }
+}
 function SettingsSectionPage({ config, shares, t }) {
     const form = (0, react_1.useSyncExternalStore)((0, react_1.useCallback)((cb) => config.subscribe(cb), [config]), () => config.getSnapshot());
     // Latest-wins gates (T15-fix 4): every status request takes a ticket and
@@ -17561,11 +17830,16 @@ function SettingsSectionPage({ config, shares, t }) {
     const [pairCode, setPairCode] = (0, react_1.useState)('');
     const [claimBusy, setClaimBusy] = (0, react_1.useState)(false);
     const [claimFail, setClaimFail] = (0, react_1.useState)(null);
-    const [claimWriteFailed, setClaimWriteFailed] = (0, react_1.useState)(false);
     const [unpairBusy, setUnpairBusy] = (0, react_1.useState)(false);
     const [unpairDone, setUnpairDone] = (0, react_1.useState)(false);
     // T43: the 立即重连 button's in-flight marker.
     const [reconnectBusy, setReconnectBusy] = (0, react_1.useState)(false);
+    // MS-7: the pool list's in-flight row action — the entry id, or 'all' for
+    // the remove-all — and whether the last one failed.
+    const [entryBusy, setEntryBusy] = (0, react_1.useState)(null);
+    const [entryActionFailed, setEntryActionFailed] = (0, react_1.useState)(false);
+    // MS-7: the 重新配对 action focuses the code box.
+    const pairCodeRef = (0, react_1.useRef)(null);
     const loadStatus = (0, react_1.useCallback)(() => {
         const ticket = statusGate.next();
         fetch(settings_form_ts_1.ADMIN_STATUS_ROUTE)
@@ -17599,26 +17873,9 @@ function SettingsSectionPage({ config, shares, t }) {
                 : { state: 'error', status: error instanceof StatusError ? error.status : undefined });
         });
     }, [statusGate]);
-    // T59: the SERVER's record of this device's name wins over the row —
-    // unless the user is mid-edit (a staged draft in the field). One direct
-    // write lands it in the row's serverName; that write's own volatile
-    // update reaches the backend with both sides now EQUAL, so the push path
-    // stays silent and the two ends cannot bounce the name back and forth.
-    // T59-fix: the decision runs HERE, on each FRESH answer, judging the row
-    // and the draft AS THEY ARE at that moment — never off a stale
-    // `clientView` racing a row change (an effect keyed on the row value
-    // would fire on every save with the PREVIOUS poll's name and write the
-    // old one straight back over the user's fresh save).
-    const followServerDeviceName = (0, react_1.useCallback)((view) => {
-        if (!config.savedRoleIsClient())
-            return;
-        if (view.state !== 'connected')
-            return;
-        const rowName = typeof config.rowValue('serverName') === 'string' ? config.rowValue('serverName') : '';
-        if (!(0, settings_form_ts_1.shouldFollowServerDeviceName)(view.deviceName, rowName, config.hasDraft('serverName')))
-            return;
-        void config.writeDeviceName(view.deviceName);
-    }, [config]);
+    // MS-7: the device name flows ONE way — a saved row serverName is
+    // broadcast to every paired server by the backend pool; a server-side
+    // record of this device's name never writes back into the row.
     const loadClientStatus = (0, react_1.useCallback)(() => {
         const ticket = clientGate.next();
         fetch(settings_form_ts_1.CLIENT_STATUS_ROUTE)
@@ -17630,9 +17887,7 @@ function SettingsSectionPage({ config, shares, t }) {
             .then((body) => {
             if (!clientGate.isLatest(ticket))
                 return;
-            const view = (0, settings_form_ts_1.deriveClientStatusView)(body);
-            setClientLoad({ state: 'ready', view });
-            followServerDeviceName(view);
+            setClientLoad({ state: 'ready', view: (0, settings_form_ts_1.deriveClientStatusView)(body) });
         })
             .catch(() => {
             if (!clientGate.isLatest(ticket))
@@ -17641,17 +17896,36 @@ function SettingsSectionPage({ config, shares, t }) {
                 ? { state: 'stale', view: prev.view }
                 : { state: 'error' });
         });
-    }, [clientGate, followServerDeviceName]);
+    }, [clientGate]);
     // The client group's rendered view, hoisted for the countdown ticker and
     // the retry-follow refresh below (T43).
     const clientView = clientLoad.state === 'ready' || clientLoad.state === 'stale' ? clientLoad.view : undefined;
+    // MS-7: the paired-server pool, in pairing order (empty on a legacy body),
+    // and the cap the counters and the red alert read.
+    const serverRows = clientView?.servers ?? [];
+    const maxServers = clientView?.maxServers ?? settings_form_ts_1.MAX_PAIRED_SERVERS;
     // RD-3: the remote drop guard's browser-side counters, read at render
     // time — no snapshot state of its own: the initial mount, the 15s
     // connected-status poll and the countdown ticker all re-render this page,
     // and each render takes the values as they are right then.
     const dropDiag = (0, remote_drop_ts_2.remoteDropDiagnostics)();
-    const clientRetryAt = clientView?.nextRetryAt;
+    // MS-7: the SOONEST armed retry across the top level and every pool row —
+    // each offline row counts down in its own badge, and the follow refresh
+    // below fires after whichever retry comes due first.
+    const clientRetryAt = [clientView?.nextRetryAt, ...serverRows.map((server) => server.nextRetryAt)]
+        .reduce((soonest, at) => (at !== undefined && (soonest === undefined || at < soonest) ? at : soonest), undefined);
     const clientCountingDown = clientRetryAt !== undefined;
+    // MS-7 diagnostics gates: the per-server group, the pre-pool fallback to
+    // the top-level mirrors, and whether the section has any line at all.
+    const legacyTopDiag = clientView !== undefined && serverRows.length === 0;
+    const hasServerDiag = serverRows.some(serverHasDiag);
+    const diagVisible = clientView !== undefined && (clientView.intercept !== undefined
+        || clientView.pluginRouteIntercept !== undefined
+        || clientView.uploadProbe !== undefined
+        || dropDiag.installed
+        || dropDiag.notInstalledReason !== undefined
+        || hasServerDiag
+        || (legacyTopDiag && (clientView.lastError !== '' || clientView.compat !== undefined || (clientView.pluginBridge?.length ?? 0) > 0)));
     // Offline with a pending retry: refresh the status shortly after the
     // retry comes due, so a server that came back flips the line to connected
     // without a manual refresh. A still-offline answer carries the NEXT
@@ -17957,23 +18231,29 @@ function SettingsSectionPage({ config, shares, t }) {
         setPairUrl(rowServerUrl);
     }, [pairUrlTouched, pairUrl, rowServerUrl]);
     const codeNormalized = (0, settings_form_ts_1.normalizePairingCode)(pairCode);
-    // T60: an INVALID device-name draft (red box — blank-but-nonempty or over
-    // the cap) blocks the pairing: the claim would silently substitute the
-    // default copy and the server would register a name the user never asked
-    // for. A VALID draft pairs fine — it lands in the row with the write.
-    const claimAllowed = form.available && form.writable && !claimBusy && codeNormalized.length === 8 && !form.serverName.invalid;
+    // MS-7: the whole gate is the MS-6 pure truth table — an address and a
+    // complete code, a quiet page, a valid device-name draft (T60: a red-boxed
+    // name would silently pair under the fallback copy), and the 8-server cap,
+    // which blocks only a NEW address: re-entering an already-paired one
+    // re-pairs it in place, at 8/8 too.
+    const claimVerdict = (0, settings_form_ts_1.canSubmitClientPairing)({
+        pairUrl,
+        pairCode: codeNormalized,
+        servers: serverRows,
+        maxServers,
+        busy: claimBusy,
+        deviceNameInvalid: form.serverName.invalid,
+    });
+    const claimAllowed = form.available && form.writable && claimVerdict.allowed;
     const runClaim = async () => {
         setClaimBusy(true);
         setClaimFail(null);
-        setClaimWriteFailed(false);
         // UX-1: captured BEFORE the pairing — whether the page ran as client, and
         // whether the backend's stream interceptor was already active per the
         // last client/status diagnostics.
         const wasEffectiveClient = clientRole;
         const streamInterceptAlreadyActive = clientView?.intercept?.installed === true;
-        // T60: one name for both halves of the round-trip — trimmed and legal
-        // ({@link claimDeviceNameOf}), sent to the server AND written into the
-        // row when the claim lands.
+        // T60: the name registers trimmed and legal ({@link claimDeviceNameOf}).
         const claimName = (0, settings_form_ts_1.claimDeviceNameOf)(form.serverName.text, t('settings.client.deviceNameDefault'));
         try {
             const res = await fetch(settings_form_ts_1.CLIENT_CLAIM_ROUTE, {
@@ -17981,8 +18261,7 @@ function SettingsSectionPage({ config, shares, t }) {
                 headers: { 'Content-Type': 'application/json' },
                 // T57: the name registers under the shared 设备名称 field's current
                 // displayed value (a staged draft counts), falling back to the
-                // default copy when the field is empty — the client page reads no
-                // admin baseline (T55), so an unstored name displays empty here.
+                // default copy when the field is empty.
                 body: JSON.stringify({
                     serverUrl: pairUrl.trim(),
                     code: codeNormalized,
@@ -17990,51 +18269,32 @@ function SettingsSectionPage({ config, shares, t }) {
                 }),
             });
             const body = await res.json().catch(() => ({}));
-            if (res.ok && body.ok === true && typeof body.token === 'string' && body.token !== '') {
-                // The backend echoes the address it validated; write the credentials
-                // AND the registered name through ONE mutate, then clear the code
-                // and re-read the connection state. The name is the SERVER's
-                // confirmed echo when the claim carried one (the gateway may have
-                // trimmed or uniquified it at registration), else the name we
-                // actually sent (T60) — either way the row now matches the server.
-                const urlToWrite = typeof body.serverUrl === 'string' && body.serverUrl !== '' ? body.serverUrl : pairUrl.trim();
-                // T59-fix: the echo is judged by the SAME rules as our own draft
-                // (claimDeviceNameOf trims and validates) — a server answer we
-                // could not store falls back to the name we actually sent.
-                const echoed = typeof body.deviceName === 'string' && body.deviceName !== '' ? (0, settings_form_ts_1.claimDeviceNameOf)(body.deviceName, claimName) : claimName;
-                const landed = await config.writeClientPairing(urlToWrite, body.token, echoed);
-                if (landed && (0, settings_form_ts_1.shouldReloadAfterClientActivation)({
+            if (res.ok && body.ok === true) {
+                // MS-5/MS-7: the backend landed the pairing straight into
+                // zen-remote-state.json (the token never reaches the browser), so
+                // there is nothing to write here — only the FIRST activation still
+                // reloads, so the page's resident global streams reopen wrapped.
+                if ((0, settings_form_ts_1.shouldReloadAfterClientActivation)({
                     wasEffectiveClient,
                     nowClientRole: true,
                     savedOrPaired: true,
                     streamInterceptAlreadyActive,
                 })) {
-                    // UX-1: FIRST pairing on a page whose resident global streams were
-                    // opened unwrapped (or with the interceptor inactive) — wait out the
-                    // backend's row-reload window, then reload so the streams reopen
-                    // wrapped and the server's sessions enter the sidebar.
                     setClaimBusy(false);
                     void (0, settings_form_ts_1.awaitClientStatusReady)().then(() => window.location.reload());
                     return;
                 }
-                if (landed) {
-                    // The draft did its job — it now equals the displayed value, and
-                    // keeping it would be a phantom edit (T60).
-                    config.discardField('serverName');
-                    setPairCode('');
-                    setPairUrl(urlToWrite);
-                    setUnpairDone(false);
-                    loadClientStatus();
-                }
-                else {
-                    setClaimWriteFailed(true);
-                }
+                setPairCode('');
+                if (typeof body.serverUrl === 'string' && body.serverUrl !== '')
+                    setPairUrl(body.serverUrl);
+                setUnpairDone(false);
+                loadClientStatus();
             }
             else {
-                // Every other shape is a failure (T16-fix): a non-OK status, a body
-                // whose `ok` is not true, a missing token — shown with the classified
-                // code when the route sent one. The body's `message` is ignored: the
-                // wording is this build's dictionary (pairFailText).
+                // Every other shape is a failure (T16-fix), shown with the classified
+                // code when the route sent one (MS-5 adds `limit-reached`). The
+                // body's `message` is ignored: the wording is this build's
+                // dictionary (pairFailText).
                 const fail = { code: typeof body.code === 'string' && body.code !== '' ? body.code : 'unexpected' };
                 if (typeof body.retryAfterMs === 'number')
                     fail.retryAfterMs = body.retryAfterMs;
@@ -18057,6 +18317,70 @@ function SettingsSectionPage({ config, shares, t }) {
             loadClientStatus();
         }
     };
+    /** MS-7: one POST of the pool list's row actions — whether it answered ok. */
+    const postClientRoute = async (route, payload) => {
+        try {
+            const res = await fetch(route, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: payload,
+            });
+            return res.ok;
+        }
+        catch {
+            return false;
+        }
+    };
+    // MS-7 立即重连 for ONE server: refresh now (the state is at least
+    // "connecting") and once more after the attempt can have settled — the
+    // T43 top-level button's cadence, per entry.
+    const runEntryReconnect = async (entryId) => {
+        setEntryBusy(entryId);
+        setEntryActionFailed(false);
+        if (await postClientRoute(settings_form_ts_1.CLIENT_RECONNECT_ROUTE, JSON.stringify({ entryId }))) {
+            loadClientStatus();
+            refreshTimers.current.push(window.setTimeout(() => { loadClientStatus(); }, 1500));
+        }
+        else {
+            setEntryActionFailed(true);
+        }
+        setEntryBusy(null);
+    };
+    // MS-7 移除: forget one paired server (the server's own device record is
+    // untouched — the confirm copy says so).
+    const runUnpairEntry = async (entryId) => {
+        if (!window.confirm(t('settings.client.unpairServerConfirm')))
+            return;
+        setEntryBusy(entryId);
+        setEntryActionFailed(false);
+        if (await postClientRoute(settings_form_ts_1.CLIENT_UNPAIR_ROUTE, JSON.stringify({ entryId })))
+            loadClientStatus();
+        else
+            setEntryActionFailed(true);
+        setEntryBusy(null);
+    };
+    // MS-7 全部移除: forget every paired server at once.
+    const runUnpairAllServers = async () => {
+        if (!window.confirm(t('settings.client.unpairAllServersConfirm')))
+            return;
+        setEntryBusy('all');
+        setEntryActionFailed(false);
+        if (await postClientRoute(settings_form_ts_1.CLIENT_UNPAIR_ROUTE, JSON.stringify({ all: true })))
+            loadClientStatus();
+        else
+            setEntryActionFailed(true);
+        setEntryBusy(null);
+    };
+    // MS-7 重新配对: point the pairing form at this server — its address in the
+    // box (an already-paired address passes the cap gate), a blank code, the
+    // focus on the code box so the user only types the fresh code.
+    const repurposeServer = (server) => {
+        setPairUrl(server.serverUrl);
+        setPairUrlTouched(true);
+        setPairCode('');
+        setClaimFail(null);
+        pairCodeRef.current?.focus();
+    };
     const formDisabled = !form.available || !form.writable;
     // T17: saving any restart-required field (the role among them) moves the
     // row, and the host half's watcher reloads it — the gateway child restarts
@@ -18095,7 +18419,8 @@ function SettingsSectionPage({ config, shares, t }) {
     // One-of control (the shared fields have no select): the shared field chrome, a select body.
     const select = (state, field, label, hint, options, optionLabel) => ((0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-field", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-head", children: [(0, jsx_runtime_1.jsx)("label", { htmlFor: `zr-settings-${field}`, children: label }), state.overridden && (0, jsx_runtime_1.jsx)("span", { className: "zr-settings-badge", children: t('settings.overridden') }), state.overridden && ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-settings-reset", disabled: formDisabled || state.locked, onClick: () => { config.resetField(field); }, children: t('settings.reset') }))] }), (0, jsx_runtime_1.jsx)("select", { id: `zr-settings-${field}`, className: "zr-settings-input", disabled: formDisabled || state.locked, value: state.text, onChange: (e) => { config.stage(field, e.currentTarget.value); }, children: options.map((option) => (0, jsx_runtime_1.jsx)("option", { value: option, children: optionLabel(option) }, option)) }), hint !== '' && (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", children: hint }), clearPreviewNote(state), annotations(field)] }, field));
     // Boolean control (the shared fields have no checkbox): label row + switch.
-    const bool = (state, field, label, hint) => ((0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-field", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-head", children: [(0, jsx_runtime_1.jsx)("label", { htmlFor: `zr-settings-${field}`, children: label }), state.overridden && (0, jsx_runtime_1.jsx)("span", { className: "zr-settings-badge", children: t('settings.overridden') }), state.overridden && ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-settings-reset", disabled: formDisabled || state.locked, onClick: () => { config.resetField(field); }, children: t('settings.reset') })), (0, jsx_runtime_1.jsx)("span", { className: "zr-settings-check-row", children: (0, jsx_runtime_1.jsx)("input", { id: `zr-settings-${field}`, type: "checkbox", disabled: formDisabled || state.locked, checked: state.text === 'true', onChange: (e) => { config.stage(field, e.currentTarget.checked ? 'true' : 'false'); } }) })] }), (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", children: hint }), clearPreviewNote(state), annotations(field)] }, field));
+    const bool = (state, field, label, hint, parentDisabled = false) => ((0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-field", "data-disabled": parentDisabled ? 'true' : undefined, children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-head", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-settings-head-title", children: label }), state.overridden && (0, jsx_runtime_1.jsx)("span", { className: "zr-settings-badge", children: t('settings.overridden') }), state.overridden && ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-settings-reset", disabled: formDisabled || state.locked || parentDisabled, onClick: () => { config.resetField(field); }, children: t('settings.reset') })), (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Switch, { disabled: formDisabled || state.locked || parentDisabled, checked: !parentDisabled && state.text === 'true', label: label, onChange: (checked) => { config.stage(field, checked ? 'true' : 'false'); } })] }), (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", children: hint }), clearPreviewNote(state), annotations(field)] }, field));
+    const pushOff = form.pushEnabled.text !== 'true';
     const deviceRow = (device) => ((0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-device", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-device-head", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-settings-device-name", children: device.name }), (0, jsx_runtime_1.jsx)("span", { className: "zr-settings-badge", children: device.role === 'web' ? t('settings.deviceRoleWeb') : t('settings.deviceRoleDesktop') }), (0, jsx_runtime_1.jsx)("span", { className: "zr-settings-badge", children: device.hasPush ? t('settings.devicePushOn') : t('settings.devicePushOff') }), (0, jsx_runtime_1.jsx)("span", { className: "zr-settings-hint", children: t('settings.deviceLastSeen', { time: new Date(device.lastSeen).toLocaleString() }) })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-device-actions", children: [(0, jsx_runtime_1.jsxs)("select", { className: "zr-settings-input", "aria-label": t('settings.deviceRoleSelect', { name: device.name }), disabled: !localOps || localBusy, value: device.role, onChange: (e) => { void runDeviceAction({ action: 'set-role', id: device.id, role: e.currentTarget.value }); }, children: [(0, jsx_runtime_1.jsx)("option", { value: "web", children: t('settings.deviceRoleWeb') }), (0, jsx_runtime_1.jsx)("option", { value: "desktop-client", children: t('settings.deviceRoleDesktop') })] }), (0, jsx_runtime_1.jsx)("select", { className: "zr-settings-input", "aria-label": t('settings.deviceKindSelect', { name: device.name }), disabled: !localOps || localBusy, value: device.kind, onChange: (e) => { void runDeviceAction({ action: 'set-kind', id: device.id, kind: e.currentTarget.value }); }, children: DEVICE_KINDS.map((kind) => ((0, jsx_runtime_1.jsx)("option", { value: kind, children: kind === 'auto' ? t('settings.kindAuto') : kind === 'phone' ? t('settings.kindPhone') : t('settings.kindDesktop') }, kind))) }), (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Button, { variant: "ghost", size: "sm", disabled: !localOps || localBusy, onClick: () => { setRenaming({ id: device.id, draft: device.name }); }, children: t('settings.deviceRename') }), (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Button, { variant: "ghost", size: "sm", disabled: !localOps || localBusy, onClick: () => {
                             if (window.confirm(t('settings.revokeConfirm')))
                                 void runDeviceAction({ action: 'revoke', id: device.id });
@@ -18168,7 +18493,7 @@ function SettingsSectionPage({ config, shares, t }) {
                             }
                             saveLanded(reloadsRow);
                         });
-                    }, onDiscard: () => { config.discard(); }, children: [(0, jsx_runtime_1.jsx)("h3", { className: "zr-settings-card-title", children: t('settings.roleTitle') }), select(form.role, 'role', t('settings.role'), t('settings.roleHint'), ['host', 'client'], (option) => (option === 'host' ? t('settings.roleHost') : t('settings.roleClient'))), text(form.serverName, 'serverName', t('settings.fieldServerName'), t(clientRole ? 'settings.fieldServerNameHintClient' : 'settings.fieldServerNameHint'), t('settings.invalidName')), reloadPending && (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-status-line", children: t('settings.reloadNote') }), !clientRole && ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)("h3", { className: "zr-settings-card-title", children: t('settings.gatewayTitle') }), text(form.host, 'host', t('settings.fieldHost'), t('settings.fieldHostHint'), '', false, t('settings.fieldHostNote')), text(form.port, 'port', t('settings.fieldPort'), t('settings.fieldPortHint'), t('settings.invalidPort'), true), text(form.trustedProxies, 'trustedProxies', t('settings.fieldTrustedProxies'), t('settings.fieldTrustedProxiesHint'), ''), text(form.rateLimit, 'rateLimit', t('settings.fieldRateLimit'), t('settings.fieldRateLimitHint'), t('settings.invalidPositiveInt'), true), text(form.vapidSubject, 'vapidSubject', t('settings.fieldVapidSubject'), t('settings.fieldVapidSubjectHint'), ''), (0, jsx_runtime_1.jsx)("h3", { className: "zr-settings-card-title", children: t('settings.pushTitle') }), bool(form.pushSummary, 'pushSummary', t('settings.fieldPushSummary'), t('settings.fieldPushSummaryHint')), bool(form.pushTurnEnd, 'pushTurnEnd', t('settings.fieldPushTurnEnd'), t('settings.fieldPushTurnEndHint')), bool(form.pushTool, 'pushTool', t('settings.fieldPushTool'), t('settings.fieldPushToolHint')), text(form.pushDebounceMs, 'pushDebounceMs', t('settings.fieldPushDebounceMs'), t('settings.fieldPushDebounceMsHint'), t('settings.invalidNonNegativeInt'), true), select(form.lang, 'lang', t('settings.fieldLang'), t('settings.fieldLangHint'), ['auto', 'zh', 'en'], (option) => (option === 'auto' ? t('settings.langAuto') : option === 'zh' ? t('settings.langZh') : t('settings.langEn'))), (0, jsx_runtime_1.jsx)("h3", { className: "zr-settings-card-title", children: t('settings.shareTitle') }), text(form.idleHours, 'idleHours', t('settings.fieldIdleHours'), t('settings.fieldIdleHoursHint'), t('settings.invalidHours'), true), bool(form.autoShareNewSessions, 'autoShareNewSessions', t('settings.fieldAutoShare'), t('settings.fieldAutoShareHint')), (0, jsx_runtime_1.jsx)("h3", { className: "zr-settings-card-title", children: t('settings.bridge.title') }), bridgeState === 'loading' && (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", children: t('settings.bridge.loading') }), bridgeState === 'error' && (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", "data-invalid": "true", children: t('settings.bridge.loadFailed') }), bridgeState === 'empty' && (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", children: t('settings.bridge.empty') }), bridgeLoad.rows.map((row) => {
+                    }, onDiscard: () => { config.discard(); }, children: [(0, jsx_runtime_1.jsx)("h3", { className: "zr-settings-card-title", children: t('settings.roleTitle') }), select(form.role, 'role', t('settings.role'), t('settings.roleHint'), ['host', 'client'], (option) => (option === 'host' ? t('settings.roleHost') : t('settings.roleClient'))), text(form.serverName, 'serverName', t('settings.fieldServerName'), t(clientRole ? 'settings.fieldServerNameHintClient' : 'settings.fieldServerNameHint'), t('settings.invalidName')), reloadPending && (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-status-line", children: t('settings.reloadNote') }), !clientRole && ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)("h3", { className: "zr-settings-card-title", children: t('settings.gatewayTitle') }), text(form.host, 'host', t('settings.fieldHost'), t('settings.fieldHostHint'), '', false, t('settings.fieldHostNote')), text(form.port, 'port', t('settings.fieldPort'), t('settings.fieldPortHint'), t('settings.invalidPort'), true), text(form.trustedProxies, 'trustedProxies', t('settings.fieldTrustedProxies'), t('settings.fieldTrustedProxiesHint'), ''), text(form.rateLimit, 'rateLimit', t('settings.fieldRateLimit'), t('settings.fieldRateLimitHint'), t('settings.invalidPositiveInt'), true), text(form.vapidSubject, 'vapidSubject', t('settings.fieldVapidSubject'), t('settings.fieldVapidSubjectHint'), ''), (0, jsx_runtime_1.jsx)("h3", { className: "zr-settings-card-title", children: t('settings.pushTitle') }), bool(form.pushEnabled, 'pushEnabled', t('settings.fieldPushEnabled'), t('settings.fieldPushEnabledHint')), bool(form.pushSessionName, 'pushSessionName', t('settings.fieldPushSessionName'), t('settings.fieldPushSessionNameHint'), pushOff), bool(form.pushSummary, 'pushSummary', t('settings.fieldPushSummary'), t('settings.fieldPushSummaryHint'), pushOff), bool(form.pushTurnEnd, 'pushTurnEnd', t('settings.fieldPushTurnEnd'), t('settings.fieldPushTurnEndHint'), pushOff), bool(form.pushTool, 'pushTool', t('settings.fieldPushTool'), t('settings.fieldPushToolHint'), pushOff), text(form.pushDebounceMs, 'pushDebounceMs', t('settings.fieldPushDebounceMs'), t('settings.fieldPushDebounceMsHint'), t('settings.invalidNonNegativeInt'), true), select(form.lang, 'lang', t('settings.fieldLang'), t('settings.fieldLangHint'), ['auto', 'zh', 'en'], (option) => (option === 'auto' ? t('settings.langAuto') : option === 'zh' ? t('settings.langZh') : t('settings.langEn'))), (0, jsx_runtime_1.jsx)("h3", { className: "zr-settings-card-title", children: t('settings.shareTitle') }), text(form.idleHours, 'idleHours', t('settings.fieldIdleHours'), t('settings.fieldIdleHoursHint'), t('settings.invalidHours'), true), bool(form.autoShareNewSessions, 'autoShareNewSessions', t('settings.fieldAutoShare'), t('settings.fieldAutoShareHint')), (0, jsx_runtime_1.jsx)("h3", { className: "zr-settings-card-title", children: t('settings.bridge.title') }), bridgeState === 'loading' && (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", children: t('settings.bridge.loading') }), bridgeState === 'error' && (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", "data-invalid": "true", children: t('settings.bridge.loadFailed') }), bridgeState === 'empty' && (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", children: t('settings.bridge.empty') }), bridgeLoad.rows.map((row) => {
                                     let current = {};
                                     try {
                                         const parsed = JSON.parse(form.pluginBridgeConsent.text);
@@ -18189,12 +18514,15 @@ function SettingsSectionPage({ config, shares, t }) {
                                     : t('settings.gatewayDown') }), (0, jsx_runtime_1.jsx)("h3", { className: "zr-settings-card-title", children: t('settings.pairingTitle') }), (0, jsx_runtime_1.jsx)("div", { className: "zr-settings-role-cards", children: PAIR_ROLES.map((role) => ((0, jsx_runtime_1.jsxs)("label", { className: "zr-settings-role-card", "data-active": pairRole === role ? 'true' : undefined, children: [(0, jsx_runtime_1.jsxs)("span", { className: "zr-settings-role-card-title", children: [(0, jsx_runtime_1.jsx)("input", { type: "radio", name: "zr-settings-pair-role", checked: pairRole === role, onChange: () => { setPairRole(role); } }), role === 'web' ? t('settings.deviceRoleWeb') : t('settings.deviceRoleDesktop')] }), (0, jsx_runtime_1.jsx)("span", { className: "zr-settings-hint", children: role === 'web' ? t('settings.pairingWebGuide') : t('settings.pairingDesktopGuide') })] }, role))) }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-row", style: { paddingBottom: 12 }, children: [(0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Button, { variant: "outline", size: "sm", disabled: !localOps || pairBusy, onClick: () => { void runPair(); }, children: pairBusy ? t('settings.pairingGenerating') : t('settings.pairingGenerate') }), pairFailed && (0, jsx_runtime_1.jsx)("span", { className: "zr-settings-hint", "data-invalid": "true", children: t('settings.pairingFail') })] }), shownPairing !== null && ((0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-field", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-head", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-settings-head-title", children: t('settings.pairingCodeLabel') }), (0, jsx_runtime_1.jsx)("span", { className: "zr-settings-badge", children: shownPairing.role === 'web' ? t('settings.deviceRoleWeb') : t('settings.deviceRoleDesktop') }), (0, jsx_runtime_1.jsx)("span", { className: "zr-settings-badge", "data-warn": "true", children: t('settings.pairingRemaining', { count: shownPairing.remainingSeconds }) })] }), (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-pair-code", children: shownPairing.code })] })), (0, jsx_runtime_1.jsx)("h3", { className: "zr-settings-card-title", children: t('settings.devicesTitle') }), (data?.devices.length ?? 0) === 0 && (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", children: t('settings.devicesEmpty') }), data?.devices.map(deviceRow), deviceFailed && (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", "data-invalid": "true", children: t('settings.actionFail') }), (data?.devices.length ?? 0) > 0 && ((0, jsx_runtime_1.jsx)("div", { className: "zr-settings-row", style: { paddingBottom: 12 }, children: (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Button, { variant: "ghost", size: "sm", disabled: !localOps || localBusy, onClick: () => {
                                 if (window.confirm(t('settings.revokeAllConfirm')))
                                     void runDeviceAction({ action: 'revoke-all' });
-                            }, children: t('settings.revokeAll') }) })), (0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-field", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-head", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-settings-head-title", children: t('settings.pushTestLabel') }), (0, jsx_runtime_1.jsx)("span", { style: { flex: 1 } }), (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Button, { variant: "outline", size: "sm", disabled: !localOps || pushTest.state === 'busy', onClick: () => { void runPushTest(); }, children: pushTest.state === 'busy' ? t('settings.pushTestRunning') : t('settings.pushTestRun') })] }), pushTest.state === 'ok' && (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", children: t('settings.pushTestOk', { sent: pushTest.sent, failed: pushTest.failed }) }), pushTest.state === 'fail' && (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", "data-invalid": "true", children: t('settings.pushTestFail') })] }), (0, jsx_runtime_1.jsx)(SharesList, { shares: shares, t: t })] })), clientRole && ((0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-card", children: [(0, jsx_runtime_1.jsx)("h3", { className: "zr-settings-card-title", children: t('settings.client.connectTitle') }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-field", children: [(0, jsx_runtime_1.jsx)("div", { className: "zr-settings-head", children: (0, jsx_runtime_1.jsx)("label", { htmlFor: "zr-settings-client-server", children: t('settings.client.serverUrl') }) }), (0, jsx_runtime_1.jsx)("input", { id: "zr-settings-client-server", className: "zr-settings-input", type: "text", autoComplete: "off", spellCheck: false, value: pairUrl, onChange: (e) => { setPairUrl(e.currentTarget.value); setPairUrlTouched(true); } }), (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", children: t('settings.client.serverUrlHint') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-field", children: [(0, jsx_runtime_1.jsx)("div", { className: "zr-settings-head", children: (0, jsx_runtime_1.jsx)("label", { htmlFor: "zr-settings-client-code", children: t('settings.client.pairingCode') }) }), (0, jsx_runtime_1.jsx)("input", { id: "zr-settings-client-code", className: "zr-settings-input zr-settings-code-input", type: "text", autoComplete: "off", spellCheck: false, 
+                            }, children: t('settings.revokeAll') }) })), (0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-field", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-head", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-settings-head-title", children: t('settings.pushTestLabel') }), (0, jsx_runtime_1.jsx)("span", { style: { flex: 1 } }), (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Button, { variant: "outline", size: "sm", disabled: !localOps || pushTest.state === 'busy', onClick: () => { void runPushTest(); }, children: pushTest.state === 'busy' ? t('settings.pushTestRunning') : t('settings.pushTestRun') })] }), pushTest.state === 'ok' && (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", children: t('settings.pushTestOk', { sent: pushTest.sent, failed: pushTest.failed }) }), pushTest.state === 'fail' && (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", "data-invalid": "true", children: t('settings.pushTestFail') })] }), (0, jsx_runtime_1.jsx)(SharesList, { shares: shares, t: t })] })), clientRole && ((0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-card", children: [(0, jsx_runtime_1.jsxs)("h3", { className: "zr-settings-card-title", children: [t('settings.client.connectTitle'), (0, jsx_runtime_1.jsx)("span", { className: "zr-settings-badge", "data-invalid": clientView?.limitReached === true ? 'true' : undefined, children: t('settings.client.poolCount', { count: serverRows.length, max: maxServers }) })] }), (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", style: { paddingTop: 4 }, children: t('settings.client.poolCapNote', { max: maxServers }) }), clientView?.limitReached === true && ((0, jsx_runtime_1.jsx)("p", { className: "zr-settings-limit-alert", "data-invalid": "true", children: t('settings.client.limitReached', { count: serverRows.length, max: maxServers }) })), (0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-field", children: [(0, jsx_runtime_1.jsx)("div", { className: "zr-settings-head", children: (0, jsx_runtime_1.jsx)("label", { htmlFor: "zr-settings-client-server", children: t('settings.client.serverUrl') }) }), (0, jsx_runtime_1.jsx)("input", { id: "zr-settings-client-server", className: "zr-settings-input", type: "text", autoComplete: "off", spellCheck: false, value: pairUrl, onChange: (e) => { setPairUrl(e.currentTarget.value); setPairUrlTouched(true); } }), (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", children: t('settings.client.serverUrlHint') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-field", children: [(0, jsx_runtime_1.jsx)("div", { className: "zr-settings-head", children: (0, jsx_runtime_1.jsx)("label", { htmlFor: "zr-settings-client-code", children: t('settings.client.pairingCode') }) }), (0, jsx_runtime_1.jsx)("input", { id: "zr-settings-client-code", ref: pairCodeRef, className: "zr-settings-input zr-settings-code-input", type: "text", autoComplete: "off", spellCheck: false, 
                                 // No maxLength: the draft is normalized (uppercased, spaces and
                                 // hyphens stripped) on every keystroke, and only the
                                 // NORMALIZED length gates the pair button — a code pasted with
                                 // separators must survive pasting intact.
-                                value: pairCode, onChange: (e) => { setPairCode((0, settings_form_ts_1.normalizePairingCode)(e.currentTarget.value)); } }), (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", children: t('settings.client.pairingCodeHint') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-row", style: { paddingBottom: 12 }, children: [(0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Button, { variant: "outline", size: "sm", disabled: !claimAllowed, onClick: () => { void runClaim(); }, children: claimBusy ? t('settings.client.pairing') : t('settings.client.pair') }), form.serverName.invalid && (0, jsx_runtime_1.jsx)("span", { className: "zr-settings-hint", "data-invalid": "true", children: t('settings.client.fixDeviceName') }), claimFail !== null && (0, jsx_runtime_1.jsx)("span", { className: "zr-settings-hint", "data-invalid": "true", children: pairFailText(claimFail, t) }), claimWriteFailed && (0, jsx_runtime_1.jsx)("span", { className: "zr-settings-hint", "data-invalid": "true", children: t('settings.client.failWrite') })] }), (0, jsx_runtime_1.jsx)("h3", { className: "zr-settings-card-title", children: t('settings.client.statusTitle') }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-row", style: { paddingBottom: 4 }, children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-settings-status-line", style: { flex: 1 }, "data-down": clientView !== undefined && (clientView.state === 'unreachable' || clientView.state === 'unexpected' || clientView.state === 'revoked' || clientView.state === 'invalid-url' || clientView.state === 'incompatible') ? 'true' : undefined, children: clientView === undefined ? '' : clientStatusText(clientView, now, t) }), (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Button, { variant: "outline", size: "sm", disabled: clientView === undefined || clientView.nextRetryAt === undefined || reconnectBusy, onClick: () => { void runReconnect(); }, children: reconnectBusy ? t('settings.client.reconnectBusy') : t('settings.client.reconnect') }), (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Button, { variant: "outline", size: "sm", disabled: clientLoad.state === 'loading', onClick: loadClientStatus, children: clientLoad.state === 'loading' ? t('settings.client.statusRefreshing') : t('settings.client.statusRefresh') })] }), form.deviceToken.configured && ((0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-row", style: { paddingBottom: 12 }, children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-settings-badge", children: t('settings.client.tokenSet') }), (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Button, { variant: "ghost", size: "sm", disabled: !form.available || !form.writable || unpairBusy, onClick: () => { void runUnpair(); }, children: unpairBusy ? t('settings.client.unpairBusy') : t('settings.client.unpair') })] })), unpairDone && (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", style: { paddingBottom: 12 }, children: t('settings.client.unpairDone') }), clientView !== undefined && (clientView.lastError !== '' || clientView.intercept !== undefined || clientView.compat !== undefined || (clientView.pluginBridge?.length ?? 0) > 0 || clientView.pluginRouteIntercept !== undefined || dropDiag.installed || dropDiag.notInstalledReason !== undefined) && ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)("h3", { className: "zr-settings-card-title", children: t('settings.client.diagTitle') }), clientView.lastError !== '' && ((0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", "data-invalid": clientView.state === 'unreachable' ? 'true' : undefined, children: t('settings.client.diagLastError', { code: clientView.lastError }) })), clientView.intercept !== undefined && ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", children: clientView.intercept.installed
+                                value: pairCode, onChange: (e) => { setPairCode((0, settings_form_ts_1.normalizePairingCode)(e.currentTarget.value)); } }), (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", children: t('settings.client.pairingCodeHint') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-row", style: { paddingBottom: 12 }, children: [(0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Button, { variant: "outline", size: "sm", disabled: !claimAllowed, onClick: () => { void runClaim(); }, children: claimBusy ? t('settings.client.pairing') : t('settings.client.pair') }), form.serverName.invalid && (0, jsx_runtime_1.jsx)("span", { className: "zr-settings-hint", "data-invalid": "true", children: t('settings.client.fixDeviceName') }), claimFail !== null && (0, jsx_runtime_1.jsx)("span", { className: "zr-settings-hint", "data-invalid": "true", children: pairFailText(claimFail, t) })] }), (0, jsx_runtime_1.jsx)("h3", { className: "zr-settings-card-title", children: t('settings.client.serversTitle') }), serverRows.length === 0 && ((0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", style: { padding: '8px 0 12px' }, children: t('settings.client.serversEmpty', { max: maxServers }) })), serverRows.map((server) => {
+                        const badge = serverStateBadge(server, now, t);
+                        return ((0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-device", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-device-head", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-settings-device-name", children: server.displayName !== '' ? server.displayName : server.serverUrl }), (0, jsx_runtime_1.jsx)("span", { className: "zr-settings-badge", "data-live": badge.tone === 'live' ? 'true' : undefined, "data-warn": badge.tone === 'warn' ? 'true' : undefined, "data-invalid": badge.tone === 'invalid' ? 'true' : undefined, children: badge.text }), (0, jsx_runtime_1.jsx)("span", { className: "zr-settings-hint", children: server.serverUrl })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-device-actions", children: [(0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Button, { variant: "ghost", size: "sm", disabled: entryBusy !== null || server.nextRetryAt === undefined, onClick: () => { void runEntryReconnect(server.entryId); }, children: entryBusy === server.entryId ? t('settings.client.reconnectBusy') : t('settings.client.reconnect') }), (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Button, { variant: "ghost", size: "sm", disabled: entryBusy !== null, onClick: () => { repurposeServer(server); }, children: t('settings.client.repair') }), (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Button, { variant: "ghost", size: "sm", disabled: entryBusy !== null, onClick: () => { void runUnpairEntry(server.entryId); }, children: t('settings.client.serverRemove') })] })] }, server.entryId));
+                    }), entryActionFailed && (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", "data-invalid": "true", children: t('settings.actionFail') }), serverRows.length > 0 && ((0, jsx_runtime_1.jsx)("div", { className: "zr-settings-row", style: { paddingBottom: 12 }, children: (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Button, { variant: "ghost", size: "sm", disabled: entryBusy !== null, onClick: () => { void runUnpairAllServers(); }, children: t('settings.client.unpairAllServers') }) })), (0, jsx_runtime_1.jsx)("h3", { className: "zr-settings-card-title", children: t('settings.client.statusTitle') }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-row", style: { paddingBottom: 4 }, children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-settings-status-line", style: { flex: 1 }, "data-down": clientView !== undefined && (clientView.state === 'unreachable' || clientView.state === 'unexpected' || clientView.state === 'revoked' || clientView.state === 'invalid-url' || clientView.state === 'incompatible') ? 'true' : undefined, children: clientView === undefined ? '' : clientStatusText(clientView, now, t) }), (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Button, { variant: "outline", size: "sm", disabled: clientView === undefined || clientView.nextRetryAt === undefined || reconnectBusy, onClick: () => { void runReconnect(); }, children: reconnectBusy ? t('settings.client.reconnectBusy') : t('settings.client.reconnect') }), (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Button, { variant: "outline", size: "sm", disabled: clientLoad.state === 'loading', onClick: loadClientStatus, children: clientLoad.state === 'loading' ? t('settings.client.statusRefreshing') : t('settings.client.statusRefresh') })] }), form.deviceToken.configured && ((0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-row", style: { paddingBottom: 12 }, children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-settings-badge", children: t('settings.client.tokenSet') }), (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Button, { variant: "ghost", size: "sm", disabled: !form.available || !form.writable || unpairBusy, onClick: () => { void runUnpair(); }, children: unpairBusy ? t('settings.client.unpairBusy') : t('settings.client.unpair') })] })), unpairDone && (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", style: { paddingBottom: 12 }, children: t('settings.client.unpairDone') }), diagVisible && clientView !== undefined && ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)("h3", { className: "zr-settings-card-title", children: t('settings.client.diagTitle') }), legacyTopDiag && clientView.lastError !== '' && ((0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", "data-invalid": clientView.state === 'unreachable' ? 'true' : undefined, children: t('settings.client.diagLastError', { code: clientView.lastError }) })), clientView.intercept !== undefined && ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", children: clientView.intercept.installed
                                             ? t('settings.client.diagInterceptInstalled')
                                             : t('settings.client.diagInterceptMissing') }), clientView.intercept.reasons.length > 0 && ((0, jsx_runtime_1.jsxs)("p", { className: "zr-settings-hint", "data-invalid": "true", children: [t('settings.client.diagInterceptDisabled'), clientView.intercept.reasons.map((reason, index) => ((0, jsx_runtime_1.jsx)("span", { className: "zr-settings-hint", children: reason }, index)))] })), clientView.intercept.recentFailures.length > 0 && ((0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-field", children: [(0, jsx_runtime_1.jsx)("div", { className: "zr-settings-head", children: (0, jsx_runtime_1.jsx)("label", { children: t('settings.client.diagRecentFailures') }) }), clientView.intercept.recentFailures.map((failure, index) => ((0, jsx_runtime_1.jsxs)("p", { className: "zr-settings-hint", children: [new Date(failure.time).toLocaleString(), " \u00B7 ", failure.method !== '' ? failure.method : '—', " \u00B7 ", failure.code] }, index)))] }))] })), (dropDiag.installed || dropDiag.notInstalledReason !== undefined) && ((0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-field", children: [(0, jsx_runtime_1.jsx)("div", { className: "zr-settings-head", children: (0, jsx_runtime_1.jsx)("label", { children: t('settings.client.diagRemoteDrop') }) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", children: dropDiag.installed
                                             ? t('settings.client.diagRemoteDropOk', {
@@ -18225,9 +18553,11 @@ function SettingsSectionPage({ config, shares, t }) {
                                             fileUploads: typeof probe.fileUploadsService === 'string' ? probe.fileUploadsService : '—',
                                         });
                                 return ((0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-field", children: [(0, jsx_runtime_1.jsx)("div", { className: "zr-settings-head", children: (0, jsx_runtime_1.jsx)("label", { children: t('settings.client.diagUploadRedirect') }) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", children: text })] }));
-                            })(), clientView.compat !== undefined && ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [clientView.compat.mismatchedGroups.length > 0 && ((0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", "data-invalid": "true", children: t('settings.client.diagCompatGroups', { groups: clientView.compat.mismatchedGroups.join(', ') }) })), clientView.compat.recentCalls.length > 0 && ((0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-field", children: [(0, jsx_runtime_1.jsx)("div", { className: "zr-settings-head", children: (0, jsx_runtime_1.jsx)("label", { children: t('settings.client.diagCompatCalls') }) }), clientView.compat.recentCalls.map((failure, index) => ((0, jsx_runtime_1.jsxs)("p", { className: "zr-settings-hint", children: [new Date(failure.time).toLocaleString(), " \u00B7 ", failure.method !== '' ? failure.method : '—', " \u00B7 ", failure.code] }, index)))] }))] })), (clientView.pluginBridge?.length ?? 0) > 0 && clientView.pluginBridge !== undefined && ((0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-field", children: [(0, jsx_runtime_1.jsx)("div", { className: "zr-settings-head", children: (0, jsx_runtime_1.jsx)("label", { children: t('settings.bridge.title') }) }), clientView.pluginBridge.map((row) => ((0, jsx_runtime_1.jsxs)("p", { className: "zr-settings-hint", children: [row.plugin, " \u00B7 ", row.localVersion !== '' ? `v${row.localVersion}` : '—', " \u00B7", ' ', row.stateKey === 'settings.bridge.stateVersionMismatch'
+                            })(), legacyTopDiag && clientView.compat !== undefined && ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [clientView.compat.mismatchedGroups.length > 0 && ((0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", "data-invalid": "true", children: t('settings.client.diagCompatGroups', { groups: clientView.compat.mismatchedGroups.join(', ') }) })), clientView.compat.recentCalls.length > 0 && ((0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-field", children: [(0, jsx_runtime_1.jsx)("div", { className: "zr-settings-head", children: (0, jsx_runtime_1.jsx)("label", { children: t('settings.client.diagCompatCalls') }) }), clientView.compat.recentCalls.map((failure, index) => ((0, jsx_runtime_1.jsxs)("p", { className: "zr-settings-hint", children: [new Date(failure.time).toLocaleString(), " \u00B7 ", failure.method !== '' ? failure.method : '—', " \u00B7 ", failure.code] }, index)))] }))] })), legacyTopDiag && (clientView.pluginBridge?.length ?? 0) > 0 && clientView.pluginBridge !== undefined && ((0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-field", children: [(0, jsx_runtime_1.jsx)("div", { className: "zr-settings-head", children: (0, jsx_runtime_1.jsx)("label", { children: t('settings.bridge.title') }) }), clientView.pluginBridge.map((row) => ((0, jsx_runtime_1.jsxs)("p", { className: "zr-settings-hint", children: [row.plugin, " \u00B7 ", row.localVersion !== '' ? `v${row.localVersion}` : '—', " \u00B7", ' ', row.stateKey === 'settings.bridge.stateVersionMismatch'
                                                 ? t(row.stateKey, { version: row.serverVersion ?? '?' })
-                                                : t(row.stateKey)] }, row.plugin)))] })), clientView.pluginRouteIntercept !== undefined && !clientView.pluginRouteIntercept.installed && ((0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", "data-invalid": "true", children: t('settings.bridge.interceptOff', { reason: clientView.pluginRouteIntercept.reasons.join('; ') || '—' }) }))] }))] })), (0, jsx_runtime_1.jsx)("div", { className: "zr-settings-card", children: (0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-field", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-head", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-settings-head-title", children: t('settings.debug.title') }), (0, jsx_runtime_1.jsx)("span", { style: { flex: 1 } }), (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Button, { variant: "outline", size: "sm", disabled: debugBusy, onClick: () => { void runDebugExport(); }, children: debugBusy ? t('settings.debug.exporting') : t('settings.debug.export') })] }), (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", children: t('settings.debug.hint') })] }) })] }));
+                                                : t(row.stateKey)] }, row.plugin)))] })), clientView.pluginRouteIntercept !== undefined && !clientView.pluginRouteIntercept.installed && ((0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", "data-invalid": "true", children: t('settings.bridge.interceptOff', { reason: clientView.pluginRouteIntercept.reasons.join('; ') || '—' }) })), hasServerDiag && ((0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-field", children: [(0, jsx_runtime_1.jsx)("div", { className: "zr-settings-head", children: (0, jsx_runtime_1.jsx)("label", { children: t('settings.client.serverDiagTitle') }) }), serverRows.filter(serverHasDiag).map((server) => ((0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-device", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-settings-device-name", children: server.displayName !== '' ? server.displayName : server.serverUrl }), server.lastError !== '' && ((0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", "data-invalid": server.state === 'unreachable' ? 'true' : undefined, children: t('settings.client.diagLastError', { code: server.lastError }) })), server.compat !== undefined && server.compat.mismatchedGroups.length > 0 && ((0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", "data-invalid": "true", children: t('settings.client.diagCompatGroups', { groups: server.compat.mismatchedGroups.join(', ') }) })), server.compat?.recentCalls.map((failure, index) => ((0, jsx_runtime_1.jsxs)("p", { className: "zr-settings-hint", children: [t('settings.client.diagCompatCalls'), " \u00B7 ", new Date(failure.time).toLocaleString(), " \u00B7 ", failure.method !== '' ? failure.method : '—', " \u00B7 ", failure.code] }, index))), server.pluginBridge.map((row) => ((0, jsx_runtime_1.jsxs)("p", { className: "zr-settings-hint", children: [t('settings.bridge.title'), " \u00B7 ", row.plugin, " \u00B7 ", row.localVersion !== '' ? `v${row.localVersion}` : '—', " \u00B7", ' ', row.stateKey === 'settings.bridge.stateVersionMismatch'
+                                                        ? t(row.stateKey, { version: row.serverVersion ?? '?' })
+                                                        : t(row.stateKey)] }, row.plugin)))] }, server.entryId)))] }))] }))] })), (0, jsx_runtime_1.jsx)("div", { className: "zr-settings-card", children: (0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-field", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-settings-head", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-settings-head-title", children: t('settings.debug.title') }), (0, jsx_runtime_1.jsx)("span", { style: { flex: 1 } }), (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Button, { variant: "outline", size: "sm", disabled: debugBusy, onClick: () => { void runDebugExport(); }, children: debugBusy ? t('settings.debug.exporting') : t('settings.debug.export') })] }), (0, jsx_runtime_1.jsx)("p", { className: "zr-settings-hint", children: t('settings.debug.hint') })] }) })] }));
 }
 /** Display name of a value's source layer for the invalid-saved-value note. */
 function sourceName(source, t) {
@@ -18342,6 +18672,9 @@ exports.SETTINGS_CSS = `
 [data-zen-remote="settings"] .zr-settings-field + .zr-settings-field {
   border-top: 1px solid var(--dsw-alias-border-l2);
 }
+[data-zen-remote="settings"] .zr-settings-field[data-disabled="true"] {
+  opacity: 0.5;
+}
 [data-zen-remote="settings"] .zr-settings-head {
   display: flex;
   align-items: center;
@@ -18517,6 +18850,21 @@ exports.SETTINGS_CSS = `
 [data-zen-remote="settings"] .zr-settings-badge[data-live="true"] {
   color: var(--dsw-alias-state-success-primary, #16a34a);
 }
+[data-zen-remote="settings"] .zr-settings-badge[data-invalid="true"] {
+  color: var(--dsw-alias-state-error-primary, #d5304f);
+}
+/* MS-7: the full-pool alert must be impossible to miss — red, bold, framed. */
+[data-zen-remote="settings"] .zr-settings-limit-alert,
+[data-zen-remote="settings"] .zr-settings-limit-alert[data-invalid="true"] {
+  font-size: 13px;
+  font-weight: 700;
+  line-height: 1.5;
+  color: var(--dsw-alias-state-error-primary, #d5304f);
+  border: 1px solid var(--dsw-alias-state-error-primary, #d5304f);
+  border-radius: 8px;
+  padding: 8px 12px;
+  margin: 8px 0 4px;
+}
 [data-zen-remote="settings"] .zr-settings-footer {
   display: flex;
   align-items: center;
@@ -18896,6 +19244,12 @@ __modules["client-data/wizard.js"] = function (require, module, exports) {
  * row layer applies the same rule when the fields land there, so a client
  * that accepts something the resolver would silently drop would only set
  * the user up for a mystery.
+ *
+ * MS-6 adds the paired-pool overview pieces: the pool count is a first-class
+ * "configured" signal (MS-5 pairs straight into the pool store, not the
+ * row), and {@link deriveClientOverviewSummary} derives the overview card's
+ * counters and its two lights (connection health / pool fill) off the
+ * `client/status` pool list.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SNIPPET_KINDS = exports.WIZARD_TUNNEL_STATUS_ROUTE = exports.WIZARD_TUNNEL_STOP_ROUTE = exports.WIZARD_TUNNEL_SETUP_ROUTE = exports.WIZARD_TUNNEL_CHECK_ROUTE = exports.WIZARD_CADDY_STATUS_ROUTE = exports.WIZARD_CADDY_STOP_ROUTE = exports.WIZARD_CADDY_START_ROUTE = exports.WIZARD_TUNNEL_TOKEN_ROUTE = exports.WIZARD_CF_TOKEN_ROUTE = exports.WIZARD_VERIFY_ROUTE = exports.WIZARD_STATUS_ROUTE = void 0;
@@ -18911,12 +19265,15 @@ exports.isValidPort = isValidPort;
 exports.publicUrlFrom = publicUrlFrom;
 exports.configureReadiness = configureReadiness;
 exports.deriveWizardLights = deriveWizardLights;
+exports.deriveClientOverviewSummary = deriveClientOverviewSummary;
 exports.deriveClientWizardLights = deriveClientWizardLights;
+exports.deriveClientServerLights = deriveClientServerLights;
 exports.pairingSecondsLeft = pairingSecondsLeft;
 exports.caddyFailureCopy = caddyFailureCopy;
 exports.nginxSnippetText = nginxSnippetText;
 exports.caddySnippetText = caddySnippetText;
 exports.luckyStepTexts = luckyStepTexts;
+const settings_form_ts_1 = require("./client-data/settings-form.js");
 /** Wizard route constants — mirror of src/wizard/routes.ts. */
 exports.WIZARD_STATUS_ROUTE = '/_dsh/zen-remote/admin/wizard/status';
 exports.WIZARD_VERIFY_ROUTE = '/_dsh/zen-remote/admin/wizard/verify';
@@ -18967,9 +19324,16 @@ function initialStep(status) {
 }
 /**
  * Whether the inline overview card should render the configured status
- * dashboard instead of the first-time setup prompt.
+ * dashboard instead of the first-time setup prompt. MS-6: the paired pool's
+ * size is the client's first-class signal — since MS-5 a claim lands in the
+ * pool store and never touches the row's `serverUrl` / `deviceToken`, so a
+ * freshly multi-paired machine with an empty row must still read as
+ * configured. `> 0` answers true no matter what the other inputs say; the
+ * field is optional and an omitted one (or a zero) changes nothing.
  */
 function isWizardConfigured(input) {
+    if ((input.pairedServerCount ?? 0) > 0)
+        return true;
     if (input.effectiveClient) {
         return input.tokenConfigured || input.clientServerUrl.trim() !== '' || input.clientState === 'connected';
     }
@@ -19100,6 +19464,46 @@ const CLIENT_FAIL_STATES = new Set([
     'invalid-url',
     'unexpected',
 ]);
+/**
+ * The view states that will NOT come back on their own (MS-6): a revoked
+ * token, an incompatible interface, an address that no longer parses — each
+ * needs the settings page before that server serves again. They turn the
+ * overview's connection light red; a merely `unreachable` server is mid-retry
+ * and stays amber.
+ */
+const CLIENT_DEAD_STATES = new Set(['revoked', 'incompatible', 'invalid-url']);
+/**
+ * Derive the sub-client overview summary off one derived pool list: green
+ * only when EVERY paired server is connected; red when any server is in a
+ * state that will not recover on its own (revoked / incompatible /
+ * invalid-url) or when the pool is FULL — the cap is a servers fact, so a
+ * full pool of healthy connections still shows a red servers light while its
+ * connection light stays green; amber for the rest (nothing paired yet, or
+ * servers the retry ladder is still working on).
+ */
+function deriveClientOverviewSummary(servers, maxServers = settings_form_ts_1.MAX_PAIRED_SERVERS) {
+    const totalCount = servers.length;
+    let onlineCount = 0;
+    let revokedCount = 0;
+    let deadCount = 0;
+    for (const server of servers) {
+        if (server.state === 'connected')
+            onlineCount += 1;
+        if (server.state === 'revoked')
+            revokedCount += 1;
+        if (CLIENT_DEAD_STATES.has(server.state))
+            deadCount += 1;
+    }
+    const offlineCount = totalCount - onlineCount - revokedCount;
+    const limitReached = totalCount >= maxServers;
+    const connectionLight = totalCount === 0
+        ? 'pending'
+        : onlineCount === totalCount
+            ? 'pass'
+            : deadCount > 0 ? 'fail' : 'pending';
+    const serversLight = limitReached ? 'fail' : totalCount > 0 ? 'pass' : 'pending';
+    return { totalCount, onlineCount, offlineCount, revokedCount, maxServers, limitReached, connectionLight, serversLight };
+}
 /**
  * Derive the three status lights for the desktop sub-client verification
  * step (`role === 'client'`).
@@ -19113,6 +19517,27 @@ function deriveClientWizardLights(input) {
         sync: connected ? (input.interceptInstalled === false ? 'fail' : 'pass') : 'pending',
     };
 }
+/**
+ * The wizard step-3's three lights for ONE selected paired server (MS-8):
+ * the credential is green by the row's own existence (the token lives in the
+ * pool store, never in the row) and red only when the server refused it
+ * (`revoked`); the connection follows the same fail-set the global lights
+ * use (an offline server mid-retry is red here too — the step is staring at
+ * THAT one server, not the pool); sync is green on a connected row whose
+ * interface groups all match, red on a compat mismatch, amber otherwise.
+ * `undefined` (nothing paired, or nothing selected yet) keeps all three
+ * amber.
+ */
+function deriveClientServerLights(server) {
+    if (server === undefined)
+        return { credential: 'pending', connection: 'pending', sync: 'pending' };
+    const connected = server.state === 'connected';
+    return {
+        credential: server.state === 'revoked' ? 'fail' : 'pass',
+        connection: connected ? 'pass' : CLIENT_FAIL_STATES.has(server.state) ? 'fail' : 'pending',
+        sync: connected ? ((server.compat?.mismatchedGroups.length ?? 0) > 0 ? 'fail' : 'pass') : 'pending',
+    };
+}
 /** Pairing-code countdown, whole seconds, never negative. */
 function pairingSecondsLeft(expiresAt, now) {
     return Math.max(0, Math.ceil((expiresAt - now) / 1000));
@@ -19152,8 +19577,11 @@ function nginxSnippetText(input) {
     const parts = valid(input);
     if (parts === null)
         return null;
+    const headerComment = input.lang === 'en'
+        ? '# Place this in the http {} block (skip if you already have this map)'
+        : '# 这段放在 http {} 层（若已有同名 map 则跳过）';
     return [
-        '# 这段放在 http {} 层（若已有同名 map 则跳过）',
+        headerComment,
         'map $http_upgrade $connection_upgrade {',
         '    default upgrade;',
         "    ''      close;",
@@ -19192,6 +19620,13 @@ function luckyStepTexts(input) {
     const parts = valid(input);
     if (parts === null)
         return null;
+    if (input.lang === 'en') {
+        return [
+            'In Lucky "Web Service", create a new rule listening on port 443 and bind your domain.',
+            `Set the backend (reverse proxy target) to http://${parts.upstream}:${parts.port} and enable WebSocket support.`,
+            'Turn on the catch-all switch to allow all paths, then save.',
+        ];
+    }
     return [
         '在 Lucky 的「Web 服务」里新建一条规则，监听 443 端口，绑定你的域名。',
         `后端（反代目标）填 http://${parts.upstream}:${parts.port}，开启 WebSocket 支持。`,
@@ -19292,7 +19727,8 @@ const wizard_ts_1 = require("./client-data/wizard.js");
 const WizardCard_tsx_1 = require("./client/wizard/WizardCard.js");
 function ProxyCard({ t, domain, upstreamPort, onCheck, onClose }) {
     const [tab, setTab] = (0, react_1.useState)('nginx');
-    const input = { domain, upstreamHost: '127.0.0.1', upstreamPort };
+    const lang = t('wizard.card.close') === 'Close' ? 'en' : 'zh';
+    const input = { domain, upstreamHost: '127.0.0.1', upstreamPort, lang };
     const text = tab === 'nginx'
         ? (0, wizard_ts_1.nginxSnippetText)(input)
         : tab === 'caddy' ? (0, wizard_ts_1.caddySnippetText)(input) : ((0, wizard_ts_1.luckyStepTexts)(input) ?? []).join('\n');
@@ -19407,21 +19843,6 @@ const PATH_OPTIONS = [
     ['cloudflared', 'wizard.path.cloudflared', 'wizard.path.cloudflaredDesc'],
     ['lan', 'wizard.path.lan', 'wizard.path.lanDesc'],
 ];
-function clientStatusCopy(view, now, t) {
-    const line = (0, settings_form_ts_1.clientStatusLineOf)(view, now);
-    switch (line.kind) {
-        case 'connectedName': return t('settings.client.statusConnectedName', { serverName: line.serverName });
-        case 'connected': return t('settings.client.statusConnected', { serverUrl: line.serverUrl });
-        case 'offlineRetry': return t('settings.client.statusOfflineRetry', { seconds: line.seconds });
-        case 'offlineRetrySoon': return t('settings.client.statusOfflineRetrySoon');
-        case 'unreachable': return t('settings.client.statusUnreachable');
-        case 'revoked': return t('settings.client.statusRevoked');
-        case 'incompatible': return t('settings.client.statusIncompatible');
-        case 'unexpected': return t('settings.client.statusUnexpected');
-        case 'invalidUrl': return t('settings.client.statusInvalidUrl');
-        default: return t('settings.client.statusUnpaired');
-    }
-}
 function claimFailCopy(code, retryAfterMs, t) {
     switch (code) {
         case 'invalid': return t('settings.client.failInvalid');
@@ -19433,9 +19854,43 @@ function claimFailCopy(code, retryAfterMs, t) {
         }
         case 'unreachable': return t('settings.client.failUnreachable');
         case 'role-mismatch': return t('settings.client.failRoleMismatch');
+        case 'limit-reached': return t('settings.client.failLimitReached');
         default: return t('settings.client.failUnexpected');
     }
 }
+/** The verdicts that will not recover on their own (MS-8): a pool row's dot
+ * turns red on these, amber on everything else, green only when connected. */
+const SERVER_DEAD_STATES = new Set(['revoked', 'incompatible', 'invalid-url']);
+/** One paired server's dot state in the management surfaces (MS-8). */
+function serverDotState(state) {
+    if (state === 'connected')
+        return 'pass';
+    return SERVER_DEAD_STATES.has(state) ? 'fail' : 'pending';
+}
+/**
+ * One paired server's badge copy + tone (MS-8): the settings page's
+ * per-server wording on the same keys, so the wizard's management modal and
+ * the settings block cannot drift apart in what a state is CALLED.
+ */
+function serverBadgeCopy(server, now, t) {
+    switch (server.state) {
+        case 'connected': return { text: t('settings.client.serverStateConnected'), tone: 'live' };
+        case 'unreachable':
+        case 'unexpected': {
+            if (server.nextRetryAt === undefined)
+                return { text: t('settings.client.serverStateOffline'), tone: 'warn' };
+            const seconds = Math.max(0, Math.ceil((server.nextRetryAt - now) / 1000));
+            return {
+                text: seconds > 0 ? t('settings.client.serverStateRetry', { seconds }) : t('settings.client.serverStateRetrySoon'),
+                tone: 'warn',
+            };
+        }
+        case 'revoked': return { text: t('settings.client.serverStateRevoked'), tone: 'invalid' };
+        case 'incompatible': return { text: t('settings.client.serverStateIncompatible'), tone: 'invalid' };
+        case 'invalid-url': return { text: t('settings.client.serverStateInvalidUrl'), tone: 'invalid' };
+        default: return { text: t('settings.client.serverStateUnpaired'), tone: undefined };
+    }
+}
 function GatewayWizard(props) {
     const { t, config } = props;
     const [modalOpen, setModalOpen] = (0, react_1.useState)(false);
@@ -19506,8 +19961,14 @@ function GatewayWizard(props) {
     const [clientClaimFail, setClientClaimFail] = (0, react_1.useState)(null);
     const [clientView, setClientView] = (0, react_1.useState)();
     const [clientLoading, setClientLoading] = (0, react_1.useState)(false);
-    const [clientReconnectBusy, setClientReconnectBusy] = (0, react_1.useState)(false);
     const [clientUnpairBusy, setClientUnpairBusy] = (0, react_1.useState)(false);
+    // MS-8: the paired-server pool's management surfaces — the 已配对服务端
+    // 管理弹窗, the entry the wizard's step 3 is staring at, and the per-entry
+    // action busy/failed markers both the modal and step 3 share.
+    const [serversModalOpen, setServersModalOpen] = (0, react_1.useState)(false);
+    const [activeClientEntryId, setActiveClientEntryId] = (0, react_1.useState)();
+    const [serverBusyEntry, setServerBusyEntry] = (0, react_1.useState)(null);
+    const [serverActionFailed, setServerActionFailed] = (0, react_1.useState)(false);
     // The saved role, live.
     const roleSnapshot = (0, react_1.useSyncExternalStore)((0, react_1.useCallback)((cb) => config.subscribe(cb), [config]), () => config.getSnapshot());
     const savedClient = config.savedRoleIsClient();
@@ -19637,9 +20098,9 @@ function GatewayWizard(props) {
             setDeviceBusy(false);
         }
     };
-    // Close the wizard modal or devices modal on Escape when no sub-card is open and not mid-save.
+    // Close the wizard modal, devices modal or servers modal on Escape when no sub-card is open and not mid-save.
     (0, react_1.useEffect)(() => {
-        if ((!modalOpen && !devicesModalOpen) || card !== undefined)
+        if ((!modalOpen && !devicesModalOpen && !serversModalOpen) || card !== undefined)
             return;
         const onKey = (event) => {
             if (event.key === 'Escape' && !savingConfig && !clientClaimBusy && !deviceBusy) {
@@ -19651,12 +20112,16 @@ function GatewayWizard(props) {
                     setDevicesModalOpen(false);
                     return;
                 }
+                if (serversModalOpen) {
+                    setServersModalOpen(false);
+                    return;
+                }
                 setModalOpen(false);
             }
         };
         document.addEventListener('keydown', onKey);
         return () => document.removeEventListener('keydown', onKey);
-    }, [modalOpen, devicesModalOpen, card, savingConfig, clientClaimBusy, deviceBusy, renamingDevice]);
+    }, [modalOpen, devicesModalOpen, serversModalOpen, card, savingConfig, clientClaimBusy, deviceBusy, renamingDevice]);
     // Seed the entry step AND the configure forms from the FIRST ready
     // wizard status on a host deployment.
     const seededRef = (0, react_1.useRef)(false);
@@ -20016,12 +20481,12 @@ function GatewayWizard(props) {
         if (wizardStatus?.lanAddress !== undefined && wizardStatus.lanAddress !== '') {
             return `http://${wizardStatus.lanAddress}:${port}`;
         }
-        return `http://<服务端局域网IP>:${port}`;
-    }, [path, serverUrl, readiness, wizardStatus]);
+        return t('wizard.desktop.addressFallback', { port: String(port) });
+    }, [path, serverUrl, readiness, wizardStatus, t]);
     const copyDesktopInfo = async () => {
         if (desktopPairing === undefined)
             return;
-        const text = `服务端地址：${resolvedHostEndpoint}\n桌面客户端配对码：${desktopPairing.code}`;
+        const text = t('wizard.desktop.copiedText', { address: resolvedHostEndpoint, code: desktopPairing.code });
         try {
             await navigator.clipboard?.writeText(text);
             setDesktopCopied(true);
@@ -20049,6 +20514,14 @@ function GatewayWizard(props) {
             setFormError('bad-client-code');
             return;
         }
+        // MS-8: a NEW address at a full pool is refused locally (the button is
+        // gated too — this backs it up); an already-paired address still
+        // re-pairs its entry in place, which is how a revoked token at 8/8
+        // gets back in.
+        if (claimGate.blockedByLimit) {
+            setClientClaimFail({ code: 'limit-reached' });
+            return;
+        }
         setClientClaimBusy(true);
         try {
             // If the deployment is currently running as 'host', switch role to 'client'
@@ -20070,18 +20543,29 @@ function GatewayWizard(props) {
             const response = await fetch(settings_form_ts_1.CLIENT_CLAIM_ROUTE, {
                 method: 'POST',
                 headers: { 'Content-Type': 'application/json' },
+                // MS-5 pool mode: the route reads `name` (the settings page's field).
                 body: JSON.stringify({
                     serverUrl: trimmedUrl,
                     code: normalizedCode,
-                    deviceName,
+                    name: deviceName,
                 }),
             });
             const body = (await response.json());
-            if (body?.ok === true && typeof body.token === 'string' && body.token !== '') {
-                const urlToWrite = typeof body.serverUrl === 'string' && body.serverUrl !== '' ? body.serverUrl : trimmedUrl;
-                const echoed = typeof body.deviceName === 'string' && body.deviceName.trim() !== '' ? body.deviceName.trim() : deviceName;
-                const landed = await config.writeClientPairing(urlToWrite, body.token, echoed);
-                if (landed && (0, settings_form_ts_1.shouldReloadAfterClientActivation)({
+            if (body?.ok === true) {
+                if (typeof body.entryId === 'string' && body.entryId !== '') {
+                    // Pool mode: the pairing landed straight in the pool store (the
+                    // token never rides the answer) — remember WHICH entry the wizard
+                    // just touched so step 3 opens on it.
+                    setActiveClientEntryId(body.entryId);
+                }
+                else if (typeof body.token === 'string' && body.token !== '') {
+                    // Legacy single-server route: the token rides the answer and the
+                    // row is the store.
+                    const urlToWrite = typeof body.serverUrl === 'string' && body.serverUrl !== '' ? body.serverUrl : trimmedUrl;
+                    const echoed = typeof body.deviceName === 'string' && body.deviceName.trim() !== '' ? body.deviceName.trim() : deviceName;
+                    await config.writeClientPairing(urlToWrite, body.token, echoed);
+                }
+                if ((0, settings_form_ts_1.shouldReloadAfterClientActivation)({
                     wasEffectiveClient,
                     nowClientRole: true,
                     savedOrPaired: true,
@@ -20112,32 +20596,42 @@ function GatewayWizard(props) {
             setClientClaimBusy(false);
         }
     };
-    const runClientReconnect = async () => {
-        setClientReconnectBusy(true);
+    const runClientUnpair = async () => {
+        setClientUnpairBusy(true);
         try {
-            await fetch(settings_form_ts_1.CLIENT_RECONNECT_ROUTE, { method: 'POST' });
+            await config.clearDeviceToken();
             await loadClientStatus();
+            setStep('configure');
         }
         catch {
             // ignore
         }
         finally {
-            setClientReconnectBusy(false);
+            setClientUnpairBusy(false);
         }
     };
-    const runClientUnpair = async () => {
-        setClientUnpairBusy(true);
+    // MS-8: one paired server's management action — the reconnect route's
+    // `{ entryId }` shape or the unpair route's. The status refresh runs
+    // either way so the surface re-renders on the pool's verdict.
+    const runServerAction = async (route, entryId, payload) => {
+        setServerBusyEntry(entryId);
+        setServerActionFailed(false);
         try {
-            await config.clearDeviceToken();
-            await loadClientStatus();
-            setStep('configure');
+            const response = await fetch(route, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(payload),
+            });
+            if (!response.ok)
+                setServerActionFailed(true);
         }
         catch {
-            // ignore
+            setServerActionFailed(true);
         }
         finally {
-            setClientUnpairBusy(false);
+            setServerBusyEntry(null);
         }
+        await loadClientStatus();
     };
     // Managed-Caddy & Tunnel controls (GW-13a / GW-13b): keyed strictly off the
     // currently selected `path` so switching away from Tunnel or Caddy never
@@ -20269,6 +20763,22 @@ function GatewayWizard(props) {
         clientState: clientView?.state,
         interceptInstalled: clientView?.intercept?.installed,
     });
+    // MS-8: the paired-server pool as the overview grid, wizard steps 2-3 and
+    // the management modal all read it. The step-3 selection falls back to the
+    // first row (pairing order) when nothing is recorded yet or the recorded
+    // entry was removed.
+    const serverRows = clientView?.servers ?? [];
+    const poolSummary = (0, wizard_ts_1.deriveClientOverviewSummary)(serverRows, clientView?.maxServers);
+    const activeServer = serverRows.find((server) => server.entryId === activeClientEntryId) ?? serverRows[0];
+    const serverLights = (0, wizard_ts_1.deriveClientServerLights)(activeServer);
+    // The pairing form's cap gate (MS-8): blockedByLimit is true only for a NEW
+    // address at a full pool — an already-paired address never trips it.
+    const claimGate = (0, settings_form_ts_1.canSubmitClientPairing)({
+        pairUrl: clientServerUrl,
+        pairCode: clientPairCode,
+        servers: serverRows,
+        ...(clientView !== undefined ? { maxServers: clientView.maxServers } : {}),
+    });
     const verified = poll?.result === 'pass';
     const qr = startResult?.ok === true ? (0, qr_ts_1.qrMatrix)(startResult.publicUrl) : null;
     const stepLabel = (name) => t(name === 'pick' ? 'wizard.step.pick' : name === 'configure' ? 'wizard.step.configure' : 'wizard.step.verify');
@@ -20291,9 +20801,16 @@ function GatewayWizard(props) {
         tokenConfigured: roleSnapshot.deviceToken.configured,
         clientServerUrl,
         clientState: clientView?.state,
+        pairedServerCount: serverRows.length,
     });
     const statusSummary = (() => {
         if (effectiveClient) {
+            if (poolSummary.totalCount > 0) {
+                return {
+                    state: (poolSummary.onlineCount > 0 ? 'pass' : 'pending'),
+                    text: `${t('wizard.role.client')} · ${t('wizard.overview.clientOnlineCount', { online: poolSummary.onlineCount, total: poolSummary.totalCount })}`,
+                };
+            }
             if (clientView?.state === 'connected') {
                 const label = clientView.serverName !== '' ? clientView.serverName : (clientView.serverUrl || t('wizard.role.client'));
                 return { state: 'pass', text: `${t('wizard.role.client')} · ${label}` };
@@ -20328,9 +20845,41 @@ function GatewayWizard(props) {
         setStep(targetStep);
         setModalOpen(true);
     };
-    return ((0, jsx_runtime_1.jsxs)("div", { "data-zen-remote": "wizard", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-header", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-headerText", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-title", children: t('wizard.title') }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-subtitle", children: t('wizard.subtitle') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-statusBadge", "data-state": statusSummary.state, children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": statusSummary.state === 'pass' ? 'pass' : 'pending' }), (0, jsx_runtime_1.jsx)("span", { children: statusSummary.text })] })] }), statusLoaded && viaGateway && !effectiveClient ? (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t('wizard.remoteOnly') }) : null, notWired ? (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", children: t('wizard.notWired') }) : null, configured ? (effectiveClient ? ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewGrid", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewItem", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewLabel", children: t('wizard.overview.roleLabel') }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewValue", children: t('wizard.role.client') }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewSub", children: clientDeviceName.trim() !== '' ? clientDeviceName : t('settings.client.deviceNameDefault') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewItem", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewLabel", children: t('wizard.overview.clientCredLabel') }), (0, jsx_runtime_1.jsxs)("p", { className: "zr-wizard-overviewValue", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": clientLights.credential }), (0, jsx_runtime_1.jsx)("span", { children: roleSnapshot.deviceToken.configured ? t('settings.client.tokenSet') : t('settings.client.statusUnpaired') })] }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewSub", children: t(LIGHT_LABEL[clientLights.credential]) })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewItem", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewLabel", children: t('wizard.overview.clientConnLabel') }), (0, jsx_runtime_1.jsxs)("p", { className: "zr-wizard-overviewValue", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": clientLights.connection }), (0, jsx_runtime_1.jsx)("span", { children: clientView === undefined
-                                                    ? (clientLoading ? t('settings.client.statusRefreshing') : t('settings.client.statusUnpaired'))
-                                                    : clientStatusCopy(clientView, now, t) })] }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewSub", children: t(LIGHT_LABEL[clientLights.connection]) })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewItem", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewLabel", children: t('wizard.overview.clientServerLabel') }), (0, jsx_runtime_1.jsxs)("p", { className: "zr-wizard-overviewValue", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": clientLights.sync }), (0, jsx_runtime_1.jsx)("span", { children: clientView?.serverUrl || clientServerUrl || '—' })] }), (0, jsx_runtime_1.jsxs)("p", { className: "zr-wizard-overviewSub", children: [t('wizard.client.lightSync'), "\uFF1A", t(LIGHT_LABEL[clientLights.sync])] })] })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-footer", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: clientLoading, onClick: () => { void loadClientStatus(); }, children: clientLoading ? t('settings.client.statusRefreshing') : t('settings.client.statusRefresh') }), clientView?.nextRetryAt !== undefined ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: clientReconnectBusy, onClick: () => { void runClientReconnect(); }, children: clientReconnectBusy ? t('settings.client.reconnectBusy') : t('settings.client.reconnect') })) : null] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", onClick: () => openWizardAt('pick', { role: 'client' }), children: t('wizard.overview.reconfigure') }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", onClick: () => openWizardAt(roleSnapshot.deviceToken.configured ? 'verify' : 'configure', { role: 'client' }), children: t('wizard.overview.clientDetail') })] })] })] })) : ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewGrid", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewItem", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewLabel", children: t('wizard.overview.roleLabel') }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewValue", children: t('wizard.role.host') }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewSub", children: hostName.trim() !== '' ? hostName : t('settings.sourceDefault') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewItem", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewLabel", children: t('wizard.overview.gatewayLabel') }), (0, jsx_runtime_1.jsxs)("p", { className: "zr-wizard-overviewValue", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": gatewayReachable ? 'pass' : 'fail' }), (0, jsx_runtime_1.jsx)("span", { children: gatewayReachable
+    // MS-8: 「+ 添加服务端」 — a BLANK pairing form on step 2, so a stale
+    // address or code from an earlier pairing can never ride into the new one.
+    const openAddServerWizard = () => {
+        setClientServerUrl('');
+        setClientPairCode('');
+        setClientClaimFail(null);
+        openWizardAt('configure', { role: 'client' });
+    };
+    return ((0, jsx_runtime_1.jsxs)("div", { "data-zen-remote": "wizard", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-header", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-headerText", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-title", children: t('wizard.title') }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-subtitle", children: t('wizard.subtitle') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-statusBadge", "data-state": statusSummary.state, children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": statusSummary.state === 'pass' ? 'pass' : 'pending' }), (0, jsx_runtime_1.jsx)("span", { children: statusSummary.text })] })] }), statusLoaded && viaGateway && !effectiveClient ? (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t('wizard.remoteOnly') }) : null, notWired ? (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", children: t('wizard.notWired') }) : null, configured ? (effectiveClient ? ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewGrid", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewItem", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewLabel", children: t('wizard.overview.roleLabel') }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewValue", children: t('wizard.role.client') }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewSub", children: clientDeviceName.trim() !== '' ? clientDeviceName : t('settings.client.deviceNameDefault') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewItem", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewLabel", children: t('wizard.overview.clientSyncLabel') }), (0, jsx_runtime_1.jsxs)("p", { className: "zr-wizard-overviewValue", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": clientLights.sync }), (0, jsx_runtime_1.jsx)("span", { children: clientLights.sync === 'pass'
+                                                    ? t('wizard.overview.syncOk')
+                                                    : clientLights.sync === 'fail'
+                                                        ? t('wizard.overview.syncBad')
+                                                        : t('wizard.overview.syncPending') })] }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewSub", children: t(LIGHT_LABEL[clientLights.sync]) })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewItem", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewLabel", children: t('wizard.overview.clientConnLabel') }), (0, jsx_runtime_1.jsxs)("p", { className: "zr-wizard-overviewValue", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": poolSummary.connectionLight }), (0, jsx_runtime_1.jsx)("span", { children: t('wizard.overview.clientOnlineCount', { online: poolSummary.onlineCount, total: poolSummary.totalCount }) })] }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewSub", children: poolSummary.totalCount === 0
+                                            ? t('settings.client.statusUnpaired')
+                                            : poolSummary.offlineCount === 0 && poolSummary.revokedCount === 0
+                                                ? t('wizard.overview.clientAllOnline')
+                                                : [
+                                                    poolSummary.offlineCount > 0 ? t('wizard.overview.clientOfflineCount', { count: poolSummary.offlineCount }) : '',
+                                                    poolSummary.revokedCount > 0 ? t('wizard.overview.clientRevokedCount', { count: poolSummary.revokedCount }) : '',
+                                                ].filter((line) => line !== '').join(' · ') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewItem", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewHead", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewLabel", children: t('wizard.overview.clientServersLabel') }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-linkBtn", onClick: () => {
+                                                    setServerActionFailed(false);
+                                                    setServersModalOpen(true);
+                                                }, children: t('wizard.overview.manageServers') })] }), (0, jsx_runtime_1.jsxs)("p", { className: "zr-wizard-overviewValue", "data-limit": poolSummary.limitReached ? 'true' : undefined, children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": poolSummary.serversLight }), (0, jsx_runtime_1.jsx)("span", { children: poolSummary.limitReached
+                                                    ? t('wizard.overview.clientPairedFull', { count: poolSummary.totalCount, max: poolSummary.maxServers })
+                                                    : t('settings.client.poolCount', { count: poolSummary.totalCount, max: poolSummary.maxServers }) })] }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewSub", "data-limit": poolSummary.limitReached ? 'true' : undefined, children: poolSummary.limitReached
+                                            ? t('wizard.overview.limitNote', { max: poolSummary.maxServers })
+                                            : serverRows.length === 0
+                                                ? t('settings.client.serversEmpty', { max: poolSummary.maxServers })
+                                                : t('wizard.overview.clientPairedNames', {
+                                                    names: serverRows.map((server) => (server.displayName !== '' ? server.displayName : server.serverUrl)).join('、'),
+                                                    max: poolSummary.maxServers,
+                                                }) })] })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-footer", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: clientLoading, onClick: () => { void loadClientStatus(); }, children: clientLoading ? t('settings.client.statusRefreshing') : t('settings.client.statusRefresh') }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", onClick: () => openWizardAt('pick', { role: 'client' }), children: t('wizard.overview.reconfigure') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", onClick: () => {
+                                            setServerActionFailed(false);
+                                            setServersModalOpen(true);
+                                        }, children: t('wizard.overview.manageServers') }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: poolSummary.limitReached, onClick: openAddServerWizard, children: t('wizard.overview.addServer') })] })] })] })) : ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewGrid", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewItem", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewLabel", children: t('wizard.overview.roleLabel') }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewValue", children: t('wizard.role.host') }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewSub", children: hostName.trim() !== '' ? hostName : t('settings.sourceDefault') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewItem", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewLabel", children: t('wizard.overview.gatewayLabel') }), (0, jsx_runtime_1.jsxs)("p", { className: "zr-wizard-overviewValue", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": gatewayReachable ? 'pass' : 'fail' }), (0, jsx_runtime_1.jsx)("span", { children: gatewayReachable
                                                     ? t('wizard.overview.gatewayReady', { port: String((0, wizard_ts_1.upstreamPortOf)(wizardStatus)) })
                                                     : t('wizard.overview.gatewayDown') })] }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewSub", children: autoShare ? t('wizard.autoShare') : t('settings.fieldAutoShare') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewItem", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewLabel", children: t('wizard.overview.ingressLabel') }), (0, jsx_runtime_1.jsxs)("p", { className: "zr-wizard-overviewValue", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": statusSummary.state === 'pass' ? 'pass' : 'pending' }), (0, jsx_runtime_1.jsx)("span", { children: pathName(path) })] }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewSub", children: resolvedHostEndpoint })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewItem", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewHead", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewLabel", children: t('wizard.overview.devicesLabel') }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-linkBtn", disabled: disabled, onClick: () => {
                                                     setDeviceError(false);
@@ -20373,10 +20922,10 @@ function GatewayWizard(props) {
                                                     plan: wizardRole === 'host'
                                                         ? `${t('wizard.role.host')} · ${pathName(path)}`
                                                         : t('wizard.role.client'),
-                                                }) }) }), wizardRole === 'host' ? ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-formStack", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsx)("label", { className: "zr-wizard-label", htmlFor: "zr-wizard-host-name", children: t('wizard.hostName') }), (0, jsx_runtime_1.jsx)("input", { id: "zr-wizard-host-name", className: "zr-wizard-input", type: "text", placeholder: t('wizard.hostNamePlaceholder'), value: hostName, disabled: disabled, onChange: (event) => setHostName(event.target.value) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.hostNameHint') })] }), (0, jsx_runtime_1.jsxs)("label", { className: "zr-wizard-checkRow", children: [(0, jsx_runtime_1.jsx)("input", { type: "checkbox", checked: autoShare, disabled: disabled, onChange: (event) => setAutoShare(event.target.checked) }), (0, jsx_runtime_1.jsx)("span", { children: t('wizard.autoShare') })] })] }), path === 'lan' ? ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsx)("label", { className: "zr-wizard-label", htmlFor: "zr-wizard-lan-url", children: t('wizard.lanUrl') }), (0, jsx_runtime_1.jsx)("input", { id: "zr-wizard-lan-url", className: "zr-wizard-input", type: "url", placeholder: t('wizard.lanUrlPlaceholder'), value: serverUrl, disabled: disabled, onChange: (event) => setServerUrl(event.target.value) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.lanUrlHint') })] })) : path === 'external' ? ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsx)("label", { className: "zr-wizard-label", htmlFor: "zr-wizard-server-url", children: t('wizard.serverUrl') }), (0, jsx_runtime_1.jsx)("input", { id: "zr-wizard-server-url", className: "zr-wizard-input", type: "url", placeholder: "https://dsh.example.com", value: serverUrl, disabled: disabled, onChange: (event) => setServerUrl(event.target.value) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.serverUrlHint') }), (0, jsx_runtime_1.jsx)("div", { className: "zr-wizard-row", children: (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-linkBtn", disabled: disabled, onClick: () => setCard('proxy'), children: t('wizard.proxySnippet') }) })] })) : ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-formStack", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-formGrid", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsx)("label", { className: "zr-wizard-label", htmlFor: "zr-wizard-domain", children: t('wizard.domain') }), (0, jsx_runtime_1.jsx)("input", { id: "zr-wizard-domain", className: "zr-wizard-input", type: "text", placeholder: "dsh.example.com", value: domain, disabled: disabled, onChange: (event) => setDomain(event.target.value) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.domainHint') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field zr-wizard-fieldPort", children: [(0, jsx_runtime_1.jsx)("label", { className: "zr-wizard-label", htmlFor: "zr-wizard-port", children: t('wizard.httpsPort') }), (0, jsx_runtime_1.jsx)("input", { id: "zr-wizard-port", className: "zr-wizard-input", type: "text", inputMode: "numeric", value: httpsPort, disabled: disabled, onChange: (event) => setHttpsPort(event.target.value) })] })] }), path === 'caddy' && (0, wizard_ts_1.isValidPort)(httpsPort.trim()) && httpsPort.trim() !== '443' ? ((0, jsx_runtime_1.jsx)("div", { className: "zr-wizard-row", children: (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-linkBtn", disabled: disabled, onClick: () => setCard('portforward'), children: t('wizard.portForwardEntry') }) })) : null, (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-labelRow", children: [(0, jsx_runtime_1.jsx)("label", { className: "zr-wizard-label", htmlFor: "zr-wizard-token", children: t('wizard.cfToken') }), tokenSaved ? (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-savedTag", children: t('wizard.token.saved') }) : null] }), (0, jsx_runtime_1.jsx)("input", { id: "zr-wizard-token", className: "zr-wizard-input", type: "password", placeholder: tokenSaved ? '••••••••••••••••' : '', value: cfToken, disabled: disabled, onChange: (event) => setCfToken(event.target.value) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.cfTokenHint') }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-linkBtn", disabled: disabled, onClick: () => setCard('token'), children: t('wizard.cfTokenHowTo') }), path === 'cloudflared' ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-linkBtn", disabled: disabled, onClick: () => setCard('migrate'), children: t('wizard.migrateEntry') })) : null] })] })] })), tokenNotice === 'failed' ? ((0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t('wizard.token.saveFailed') })) : null, formError !== null ? ((0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t(formError === 'bad-domain' ? 'wizard.badDomain' : formError === 'bad-port' ? 'wizard.badPort' : formError === 'missing-token' ? 'wizard.missingToken' : 'wizard.badServerUrl') })) : null] })) : ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-formStack", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsx)("label", { className: "zr-wizard-label", htmlFor: "zr-wizard-client-device", children: t('wizard.client.deviceName') }), (0, jsx_runtime_1.jsx)("input", { id: "zr-wizard-client-device", className: "zr-wizard-input", type: "text", placeholder: t('wizard.client.deviceNamePlaceholder'), value: clientDeviceName, disabled: clientClaimBusy, onChange: (event) => setClientDeviceName(event.target.value) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.client.deviceNameHint') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsx)("label", { className: "zr-wizard-label", htmlFor: "zr-wizard-client-url", children: t('wizard.client.serverUrl') }), (0, jsx_runtime_1.jsx)("input", { id: "zr-wizard-client-url", className: "zr-wizard-input", type: "url", placeholder: t('wizard.client.serverUrlPlaceholder'), value: clientServerUrl, disabled: clientClaimBusy, onChange: (event) => setClientServerUrl(event.target.value) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.client.serverUrlHint') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsx)("label", { className: "zr-wizard-label", htmlFor: "zr-wizard-client-code", children: t('wizard.client.pairingCode') }), (0, jsx_runtime_1.jsx)("input", { id: "zr-wizard-client-code", className: "zr-wizard-input", type: "text", autoComplete: "off", spellCheck: false, placeholder: t('wizard.client.pairingCodePlaceholder'), value: clientPairCode, disabled: clientClaimBusy, onChange: (event) => setClientPairCode((0, settings_form_ts_1.normalizePairingCode)(event.target.value)) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.client.pairingCodeHint') })] })] }), formError === 'bad-client-url' ? ((0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t('settings.client.failInvalid') })) : null, formError === 'bad-client-code' ? ((0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t('settings.client.failBadCode') })) : null, clientClaimFail !== null ? ((0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: claimFailCopy(clientClaimFail.code, clientClaimFail.retryAfterMs, t) })) : null] }))] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-modalFooter", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: disabled || savingConfig || clientClaimBusy, onClick: () => {
+                                                }) }) }), wizardRole === 'host' ? ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-formStack", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsx)("label", { className: "zr-wizard-label", htmlFor: "zr-wizard-host-name", children: t('wizard.hostName') }), (0, jsx_runtime_1.jsx)("input", { id: "zr-wizard-host-name", className: "zr-wizard-input", type: "text", placeholder: t('wizard.hostNamePlaceholder'), value: hostName, disabled: disabled, onChange: (event) => setHostName(event.target.value) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.hostNameHint') })] }), (0, jsx_runtime_1.jsxs)("label", { className: "zr-wizard-checkRow", children: [(0, jsx_runtime_1.jsx)("input", { type: "checkbox", checked: autoShare, disabled: disabled, onChange: (event) => setAutoShare(event.target.checked) }), (0, jsx_runtime_1.jsx)("span", { children: t('wizard.autoShare') })] })] }), path === 'lan' ? ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsx)("label", { className: "zr-wizard-label", htmlFor: "zr-wizard-lan-url", children: t('wizard.lanUrl') }), (0, jsx_runtime_1.jsx)("input", { id: "zr-wizard-lan-url", className: "zr-wizard-input", type: "url", placeholder: t('wizard.lanUrlPlaceholder'), value: serverUrl, disabled: disabled, onChange: (event) => setServerUrl(event.target.value) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.lanUrlHint') })] })) : path === 'external' ? ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsx)("label", { className: "zr-wizard-label", htmlFor: "zr-wizard-server-url", children: t('wizard.serverUrl') }), (0, jsx_runtime_1.jsx)("input", { id: "zr-wizard-server-url", className: "zr-wizard-input", type: "url", placeholder: "https://dsh.example.com", value: serverUrl, disabled: disabled, onChange: (event) => setServerUrl(event.target.value) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.serverUrlHint') }), (0, jsx_runtime_1.jsx)("div", { className: "zr-wizard-row", children: (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-linkBtn", disabled: disabled, onClick: () => setCard('proxy'), children: t('wizard.proxySnippet') }) })] })) : ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-formStack", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-formGrid", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsx)("label", { className: "zr-wizard-label", htmlFor: "zr-wizard-domain", children: t('wizard.domain') }), (0, jsx_runtime_1.jsx)("input", { id: "zr-wizard-domain", className: "zr-wizard-input", type: "text", placeholder: "dsh.example.com", value: domain, disabled: disabled, onChange: (event) => setDomain(event.target.value) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.domainHint') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field zr-wizard-fieldPort", children: [(0, jsx_runtime_1.jsx)("label", { className: "zr-wizard-label", htmlFor: "zr-wizard-port", children: t('wizard.httpsPort') }), (0, jsx_runtime_1.jsx)("input", { id: "zr-wizard-port", className: "zr-wizard-input", type: "text", inputMode: "numeric", value: httpsPort, disabled: disabled, onChange: (event) => setHttpsPort(event.target.value) })] })] }), path === 'caddy' && (0, wizard_ts_1.isValidPort)(httpsPort.trim()) && httpsPort.trim() !== '443' ? ((0, jsx_runtime_1.jsx)("div", { className: "zr-wizard-row", children: (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-linkBtn", disabled: disabled, onClick: () => setCard('portforward'), children: t('wizard.portForwardEntry') }) })) : null, (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-labelRow", children: [(0, jsx_runtime_1.jsx)("label", { className: "zr-wizard-label", htmlFor: "zr-wizard-token", children: t('wizard.cfToken') }), tokenSaved ? (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-savedTag", children: t('wizard.token.saved') }) : null] }), (0, jsx_runtime_1.jsx)("input", { id: "zr-wizard-token", className: "zr-wizard-input", type: "password", placeholder: tokenSaved ? '••••••••••••••••' : '', value: cfToken, disabled: disabled, onChange: (event) => setCfToken(event.target.value) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.cfTokenHint') }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-linkBtn", disabled: disabled, onClick: () => setCard('token'), children: t('wizard.cfTokenHowTo') }), path === 'cloudflared' ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-linkBtn", disabled: disabled, onClick: () => setCard('migrate'), children: t('wizard.migrateEntry') })) : null] })] })] })), tokenNotice === 'failed' ? ((0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t('wizard.token.saveFailed') })) : null, formError !== null ? ((0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t(formError === 'bad-domain' ? 'wizard.badDomain' : formError === 'bad-port' ? 'wizard.badPort' : formError === 'missing-token' ? 'wizard.missingToken' : 'wizard.badServerUrl') })) : null] })) : ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", children: t('wizard.client.poolCapNote', { count: serverRows.length, max: poolSummary.maxServers }) }), poolSummary.limitReached ? ((0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t('wizard.overview.limitNote', { max: poolSummary.maxServers }) })) : null, (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-formStack", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsx)("label", { className: "zr-wizard-label", htmlFor: "zr-wizard-client-device", children: t('wizard.client.deviceName') }), (0, jsx_runtime_1.jsx)("input", { id: "zr-wizard-client-device", className: "zr-wizard-input", type: "text", placeholder: t('wizard.client.deviceNamePlaceholder'), value: clientDeviceName, disabled: clientClaimBusy, onChange: (event) => setClientDeviceName(event.target.value) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.client.deviceNameHint') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsx)("label", { className: "zr-wizard-label", htmlFor: "zr-wizard-client-url", children: t('wizard.client.serverUrl') }), (0, jsx_runtime_1.jsx)("input", { id: "zr-wizard-client-url", className: "zr-wizard-input", type: "url", placeholder: t('wizard.client.serverUrlPlaceholder'), value: clientServerUrl, disabled: clientClaimBusy, onChange: (event) => setClientServerUrl(event.target.value) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.client.serverUrlHint') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsx)("label", { className: "zr-wizard-label", htmlFor: "zr-wizard-client-code", children: t('wizard.client.pairingCode') }), (0, jsx_runtime_1.jsx)("input", { id: "zr-wizard-client-code", className: "zr-wizard-input", type: "text", autoComplete: "off", spellCheck: false, placeholder: t('wizard.client.pairingCodePlaceholder'), value: clientPairCode, disabled: clientClaimBusy, onChange: (event) => setClientPairCode((0, settings_form_ts_1.normalizePairingCode)(event.target.value)) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.client.pairingCodeHint') })] })] }), formError === 'bad-client-url' ? ((0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t('settings.client.failInvalid') })) : null, formError === 'bad-client-code' ? ((0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t('settings.client.failBadCode') })) : null, clientClaimFail !== null ? ((0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: claimFailCopy(clientClaimFail.code, clientClaimFail.retryAfterMs, t) })) : null] }))] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-modalFooter", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: disabled || savingConfig || clientClaimBusy, onClick: () => {
                                                 setFormError(null);
                                                 setStep('pick');
-                                            }, children: t('wizard.back') }), wizardRole === 'host' ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: disabled || savingConfig, onClick: () => { void advanceFromConfigure(); }, children: t('wizard.modal.saveAndNext') })) : ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [roleSnapshot.deviceToken.configured ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: clientClaimBusy, onClick: () => setStep('verify'), children: t('wizard.client.skipToStatus') })) : null, (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: clientClaimBusy, onClick: () => { void runClientClaim(); }, children: clientClaimBusy ? t('wizard.client.pairingBusy') : t('wizard.client.pairAndConnect') })] }))] })] })) : null, step === 'verify' ? ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-modalBody", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-stepIntro", children: t('wizard.modal.step3Desc') }), wizardRole === 'host' ? ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [caddyPath ? ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-serviceBar", "data-zen-remote": "wizard-caddy-controls", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-serviceInfo", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": caddyState === 'running' ? 'pass' : 'pending' }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-label", children: t('wizard.ingress') }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-hint", children: caddyBusy
+                                            }, children: t('wizard.back') }), wizardRole === 'host' ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: disabled || savingConfig, onClick: () => { void advanceFromConfigure(); }, children: t('wizard.modal.saveAndNext') })) : ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [roleSnapshot.deviceToken.configured ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: clientClaimBusy, onClick: () => setStep('verify'), children: t('wizard.client.skipToStatus') })) : null, (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: clientClaimBusy || claimGate.blockedByLimit, onClick: () => { void runClientClaim(); }, children: clientClaimBusy ? t('wizard.client.pairingBusy') : t('wizard.client.pairAndConnect') })] }))] })] })) : null, step === 'verify' ? ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-modalBody", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-stepIntro", children: t('wizard.modal.step3Desc') }), wizardRole === 'host' ? ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [caddyPath ? ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-serviceBar", "data-zen-remote": "wizard-caddy-controls", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-serviceInfo", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": caddyState === 'running' ? 'pass' : 'pending' }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-label", children: t('wizard.ingress') }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-hint", children: caddyBusy
                                                                         ? t('wizard.caddy.starting')
                                                                         : t(caddyState === 'running' ? 'wizard.caddy.running' : caddyState === 'stopped' ? 'wizard.caddy.stopped' : 'wizard.caddy.neverStarted') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: disabled || caddyBusy || caddyState === 'running', onClick: () => { void startCaddy(); }, children: caddyBusy ? t('wizard.caddy.starting') : t('wizard.caddy.start') }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: disabled || caddyBusy || caddyState !== 'running', onClick: () => { void stopCaddy(); }, children: t('wizard.caddy.stop') })] })] })) : null, tunnelPath ? ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-serviceBar", "data-zen-remote": "wizard-tunnel-controls", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-serviceInfo", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": tunnelState === 'running' ? 'pass' : 'pending' }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-label", children: t('wizard.ingress') }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-hint", children: t(tunnelState === 'running' ? 'wizard.tunnel.running' : tunnelState === 'stopped' ? 'wizard.tunnel.stopped' : 'wizard.tunnel.neverStarted') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: disabled || tunnelBusy, onClick: () => { void setupTunnelNow(adoptTunnelId); }, children: tunnelBusy ? t('wizard.tunnel.checking') : tunnelState === 'running' ? t('wizard.reverify') : t('wizard.tunnel.setup') }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: disabled || tunnelState !== 'running', onClick: () => {
                                                                         void (async () => {
@@ -20391,7 +20940,7 @@ function GatewayWizard(props) {
                                                     return (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": copy.tone === 'error' ? 'error' : undefined, children: copy.key === 'wizard.check.failed'
                                                             ? t('wizard.check.failed', { reason: tunnelCheck.ok ? '' : String(tunnelCheck.reason) })
                                                             : t(copy.key) });
-                                                })() : null, tunnelPath && tunnelResult !== undefined && !tunnelResult.ok && tunnelResult.reason === 'tunnel-conflict' && tunnelResult.existing !== undefined ? ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-label", children: t('wizard.tunnel.conflict') }), (0, jsx_runtime_1.jsx)("div", { className: "zr-wizard-row", children: tunnelResult.existing.map((tunnel) => ((0, jsx_runtime_1.jsxs)("button", { type: "button", className: "zr-wizard-linkBtn", disabled: disabled || tunnelBusy, onClick: () => { setAdoptTunnelId(tunnel.id); void setupTunnelNow(tunnel.id); }, children: [t('wizard.tunnel.useExisting'), "\uFF1A", tunnel.name, "\uFF08", tunnel.status, "\uFF09"] }, tunnel.id))) })] })) : null, tunnelPath && tunnelResult !== undefined && tunnelResult.ok ? (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", children: t('wizard.tunnel.ok') }) : null, tunnelPath && tunnelResult !== undefined && !tunnelResult.ok && tunnelResult.reason !== 'tunnel-conflict' ? (() => {
+                                                })() : null, tunnelPath && tunnelResult !== undefined && !tunnelResult.ok && tunnelResult.reason === 'tunnel-conflict' && tunnelResult.existing !== undefined ? ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-label", children: t('wizard.tunnel.conflict') }), (0, jsx_runtime_1.jsx)("div", { className: "zr-wizard-row", children: tunnelResult.existing.map((tunnel) => ((0, jsx_runtime_1.jsxs)("button", { type: "button", className: "zr-wizard-linkBtn", disabled: disabled || tunnelBusy, onClick: () => { setAdoptTunnelId(tunnel.id); void setupTunnelNow(tunnel.id); }, children: [t('wizard.tunnel.useExisting'), ": ", tunnel.name, " (", tunnel.status, ")"] }, tunnel.id))) })] })) : null, tunnelPath && tunnelResult !== undefined && tunnelResult.ok ? (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", children: t('wizard.tunnel.ok') }) : null, tunnelPath && tunnelResult !== undefined && !tunnelResult.ok && tunnelResult.reason !== 'tunnel-conflict' ? (() => {
                                                     const copy = (0, wizard_ts_1.tunnelFailureCopy)(tunnelResult.reason, tunnelResult.detail);
                                                     return (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t(copy.key, copy.params) });
                                                 })() : null, caddyPath && caddyStartError !== undefined ? ((0, jsx_runtime_1.jsxs)("p", { className: "zr-wizard-notice", "data-tone": "error", children: [t('wizard.caddy.startFailed', { reason: t(caddyStartError.key, caddyStartError.params) }), caddyStartError.installUrl !== undefined ? ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [" ", (0, jsx_runtime_1.jsx)("a", { className: "zr-wizard-link", href: caddyStartError.installUrl, target: "_blank", rel: "noreferrer", children: caddyStartError.installUrl })] })) : null] })) : null, (0, jsx_runtime_1.jsx)("ul", { className: "zr-wizard-lights", children: LIGHT_ORDER.map(({ key, light }) => {
@@ -20403,9 +20952,17 @@ function GatewayWizard(props) {
                                                     }) }), startResult !== undefined && !startResult.ok ? (() => {
                                                     const copy = startFailureCopy(startResult);
                                                     return (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t('wizard.startFailed', { reason: t(copy.key, copy.params) }) });
-                                                })() : null, (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-targetTabs", role: "tablist", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", role: "tab", "aria-selected": pairTarget === 'web', className: "zr-wizard-targetTab", "data-selected": pairTarget === 'web', disabled: disabled, onClick: () => setPairTarget('web'), children: t('wizard.pairTarget.web') }), (0, jsx_runtime_1.jsx)("button", { type: "button", role: "tab", "aria-selected": pairTarget === 'desktop-client', className: "zr-wizard-targetTab", "data-selected": pairTarget === 'desktop-client', disabled: disabled, onClick: () => setPairTarget('desktop-client'), children: t('wizard.pairTarget.desktop') })] }), pairTarget === 'web' ? ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [webPairRequested && startResult?.ok === true && startResult.pairingCode !== '' ? ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-pairPanel", children: [(0, jsx_runtime_1.jsx)("svg", { className: "zr-wizard-qr", "data-usable": qr !== null, role: "img", "aria-label": t('wizard.qrHint'), shapeRendering: "crispEdges", viewBox: qr === null ? undefined : `-16 -16 ${(qr.length + 8) * 4} ${(qr.length + 8) * 4}`, children: qr === null ? null : ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)("rect", { x: -16, y: -16, width: (qr.length + 8) * 4, height: (qr.length + 8) * 4, fill: "#fff" }), (0, jsx_runtime_1.jsx)("path", { d: qrSvgPath(qr, 4), fill: "#000" })] })) }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-pairMeta", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-label", children: t('wizard.pairingCode') }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-code", children: startResult.pairingCode }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-countdown", children: t('wizard.pairingSeconds', { seconds: String((0, wizard_ts_1.pairingSecondsLeft)(startResult.expiresAt, now)) }) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.qrHint') })] })] })) : null, poll?.result === 'pass' ? (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "ok", children: t('wizard.verifyPass', { deviceId: poll.deviceId }) }) : null, poll?.result === 'cookie-insecure' ? (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t('wizard.verifyCookieInsecure') }) : null, poll?.result === 'code-expired' ? (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t('wizard.verifyExpired') }) : null, poll?.result === 'stale' ? (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t('wizard.verifyStale') }) : null, webPairRequested && (poll?.result === 'pending' || poll?.result === 'not-started') ? (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.verifyPending') }) : null, !webPairRequested && poll === undefined ? (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.verifyNotStarted') }) : null] })) : ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-desktopBox", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.desktop.guide') }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-label", children: t('wizard.desktop.addressLabel') }), (0, jsx_runtime_1.jsx)("code", { className: "zr-wizard-input", children: resolvedHostEndpoint })] }), desktopPairing !== undefined && desktopPairing.expiresAt > now ? ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-pairMeta", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-label", children: t('wizard.pairingCode') }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-code", children: desktopPairing.code }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-countdown", children: t('wizard.pairingSeconds', { seconds: String((0, wizard_ts_1.pairingSecondsLeft)(desktopPairing.expiresAt, now)) }) })] })) : null, (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: disabled || desktopPairBusy, onClick: () => { void runDesktopPair(); }, children: desktopPairing !== undefined && desktopPairing.expiresAt > now ? t('wizard.desktop.regenerate') : t('wizard.desktop.generate') }), desktopPairing !== undefined && desktopPairing.expiresAt > now ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: disabled, onClick: () => { void copyDesktopInfo(); }, children: desktopCopied ? t('wizard.card.copied') : t('wizard.desktop.copyInfo') })) : null] })] }))] })) : ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)("ul", { className: "zr-wizard-lights", children: CLIENT_LIGHT_ORDER.map(({ key, light }) => ((0, jsx_runtime_1.jsxs)("li", { className: "zr-wizard-light", "data-state": clientLights[light], children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-lightMain", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": clientLights[light] }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-lightName", children: t(key) })] }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-lightState", "data-state": clientLights[light], children: t(LIGHT_LABEL[clientLights[light]]) })] }, key))) }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-clientBox", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-label", children: t('settings.client.statusTitle') }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": clientView?.state === 'connected' ? 'ok' : clientLights.connection === 'fail' ? 'error' : undefined, children: clientView === undefined
-                                                                ? (clientLoading ? t('settings.client.statusRefreshing') : t('settings.client.statusUnpaired'))
-                                                                : clientStatusCopy(clientView, now, t) }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: clientLoading, onClick: () => { void loadClientStatus(); }, children: clientLoading ? t('settings.client.statusRefreshing') : t('settings.client.statusRefresh') }), clientView?.nextRetryAt !== undefined ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: clientReconnectBusy, onClick: () => { void runClientReconnect(); }, children: clientReconnectBusy ? t('settings.client.reconnectBusy') : t('settings.client.reconnect') })) : null, roleSnapshot.deviceToken.configured ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: clientUnpairBusy, onClick: () => { void runClientUnpair(); }, children: clientUnpairBusy ? t('settings.client.unpairBusy') : t('settings.client.unpair') })) : null] })] })] }))] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-modalFooter", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: disabled, onClick: () => setStep('configure'), children: t('wizard.back') }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [wizardRole === 'host' && resolvedVerifyUrl !== '' ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: disabled || probingUrl, onClick: () => { void probeAccessUrl(resolvedVerifyUrl); }, children: probingUrl ? t('wizard.light.probing') : t('wizard.devicesModal.retest') })) : null, wizardRole === 'host' && pairTarget === 'web' ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: disabled || probingUrl, onClick: () => { void startVerification(); }, children: verified ? t('wizard.reverify') : t('wizard.startVerify') })) : null, wizardRole === 'host' && pairTarget === 'desktop-client' ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: disabled || desktopPairBusy, onClick: () => { void runDesktopPair(); }, children: desktopPairing !== undefined && desktopPairing.expiresAt > now ? t('wizard.desktop.regenerate') : t('wizard.desktop.generate') })) : null, (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", onClick: () => setModalOpen(false), children: t('wizard.modal.finish') })] })] })] })) : null] }) })) : null, devicesModalOpen ? ((0, jsx_runtime_1.jsx)("div", { "data-zen-remote": "wizard-modal", onClick: () => {
+                                                })() : null, (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-targetTabs", role: "tablist", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", role: "tab", "aria-selected": pairTarget === 'web', className: "zr-wizard-targetTab", "data-selected": pairTarget === 'web', disabled: disabled, onClick: () => setPairTarget('web'), children: t('wizard.pairTarget.web') }), (0, jsx_runtime_1.jsx)("button", { type: "button", role: "tab", "aria-selected": pairTarget === 'desktop-client', className: "zr-wizard-targetTab", "data-selected": pairTarget === 'desktop-client', disabled: disabled, onClick: () => setPairTarget('desktop-client'), children: t('wizard.pairTarget.desktop') })] }), pairTarget === 'web' ? ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [webPairRequested && startResult?.ok === true && startResult.pairingCode !== '' ? ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-pairPanel", children: [(0, jsx_runtime_1.jsx)("svg", { className: "zr-wizard-qr", "data-usable": qr !== null, role: "img", "aria-label": t('wizard.qrHint'), shapeRendering: "crispEdges", viewBox: qr === null ? undefined : `-16 -16 ${(qr.length + 8) * 4} ${(qr.length + 8) * 4}`, children: qr === null ? null : ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)("rect", { x: -16, y: -16, width: (qr.length + 8) * 4, height: (qr.length + 8) * 4, fill: "#fff" }), (0, jsx_runtime_1.jsx)("path", { d: qrSvgPath(qr, 4), fill: "#000" })] })) }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-pairMeta", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-label", children: t('wizard.pairingCode') }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-code", children: startResult.pairingCode }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-countdown", children: t('wizard.pairingSeconds', { seconds: String((0, wizard_ts_1.pairingSecondsLeft)(startResult.expiresAt, now)) }) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.qrHint') })] })] })) : null, poll?.result === 'pass' ? (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "ok", children: t('wizard.verifyPass', { deviceId: poll.deviceId }) }) : null, poll?.result === 'cookie-insecure' ? (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t('wizard.verifyCookieInsecure') }) : null, poll?.result === 'code-expired' ? (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t('wizard.verifyExpired') }) : null, poll?.result === 'stale' ? (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t('wizard.verifyStale') }) : null, webPairRequested && (poll?.result === 'pending' || poll?.result === 'not-started') ? (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.verifyPending') }) : null, !webPairRequested && poll === undefined ? (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.verifyNotStarted') }) : null] })) : ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-desktopBox", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.desktop.guide') }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-label", children: t('wizard.desktop.addressLabel') }), (0, jsx_runtime_1.jsx)("code", { className: "zr-wizard-input", children: resolvedHostEndpoint })] }), desktopPairing !== undefined && desktopPairing.expiresAt > now ? ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-pairMeta", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-label", children: t('wizard.pairingCode') }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-code", children: desktopPairing.code }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-countdown", children: t('wizard.pairingSeconds', { seconds: String((0, wizard_ts_1.pairingSecondsLeft)(desktopPairing.expiresAt, now)) }) })] })) : null, (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: disabled || desktopPairBusy, onClick: () => { void runDesktopPair(); }, children: desktopPairing !== undefined && desktopPairing.expiresAt > now ? t('wizard.desktop.regenerate') : t('wizard.desktop.generate') }), desktopPairing !== undefined && desktopPairing.expiresAt > now ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: disabled, onClick: () => { void copyDesktopInfo(); }, children: desktopCopied ? t('wizard.card.copied') : t('wizard.desktop.copyInfo') })) : null] })] }))] })) : ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [serverRows.length > 1 ? ((0, jsx_runtime_1.jsx)("div", { className: "zr-wizard-targetTabs", role: "tablist", "aria-label": t('wizard.client.serverPicker'), children: serverRows.map((server) => {
+                                                        const selected = activeServer?.entryId === server.entryId;
+                                                        return ((0, jsx_runtime_1.jsx)("button", { type: "button", role: "tab", "aria-selected": selected, className: "zr-wizard-targetTab", "data-selected": selected, onClick: () => setActiveClientEntryId(server.entryId), children: server.displayName !== '' ? server.displayName : server.serverUrl }, server.entryId));
+                                                    }) })) : null, activeServer !== undefined ? ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-serviceInfo", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": serverDotState(activeServer.state) }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-lightName", children: activeServer.displayName !== '' ? activeServer.displayName : activeServer.serverUrl }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-hint", children: activeServer.serverUrl })] })) : null, (0, jsx_runtime_1.jsx)("ul", { className: "zr-wizard-lights", children: CLIENT_LIGHT_ORDER.map(({ key, light }) => ((0, jsx_runtime_1.jsxs)("li", { className: "zr-wizard-light", "data-state": serverLights[light], children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-lightMain", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": serverLights[light] }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-lightName", children: t(key) })] }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-lightState", "data-state": serverLights[light], children: t(LIGHT_LABEL[serverLights[light]]) })] }, key))) }), activeServer !== undefined ? ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [activeServer.nextRetryAt !== undefined ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: serverBusyEntry !== null, onClick: () => { void runServerAction(settings_form_ts_1.CLIENT_RECONNECT_ROUTE, activeServer.entryId, { entryId: activeServer.entryId }); }, children: serverBusyEntry === activeServer.entryId ? t('settings.client.reconnectBusy') : t('settings.client.reconnect') })) : null, (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: serverBusyEntry !== null, onClick: () => {
+                                                                if (!window.confirm(t('settings.client.unpairServerConfirm')))
+                                                                    return;
+                                                                const entryId = activeServer.entryId;
+                                                                void runServerAction(settings_form_ts_1.CLIENT_UNPAIR_ROUTE, entryId, { entryId }).then(() => {
+                                                                    setActiveClientEntryId((current) => (current === entryId ? undefined : current));
+                                                                });
+                                                            }, children: t('settings.client.serverRemove') })] })) : null, serverRows.length === 0 && roleSnapshot.deviceToken.configured ? ((0, jsx_runtime_1.jsx)("div", { className: "zr-wizard-row", children: (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: clientUnpairBusy, onClick: () => { void runClientUnpair(); }, children: clientUnpairBusy ? t('settings.client.unpairBusy') : t('settings.client.unpair') }) })) : null] }))] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-modalFooter", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: disabled, onClick: () => setStep('configure'), children: t('wizard.back') }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [wizardRole === 'host' && resolvedVerifyUrl !== '' ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: disabled || probingUrl, onClick: () => { void probeAccessUrl(resolvedVerifyUrl); }, children: probingUrl ? t('wizard.light.probing') : t('wizard.devicesModal.retest') })) : null, wizardRole === 'host' && pairTarget === 'web' ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: disabled || probingUrl, onClick: () => { void startVerification(); }, children: verified ? t('wizard.reverify') : t('wizard.startVerify') })) : null, wizardRole === 'host' && pairTarget === 'desktop-client' ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: disabled || desktopPairBusy, onClick: () => { void runDesktopPair(); }, children: desktopPairing !== undefined && desktopPairing.expiresAt > now ? t('wizard.desktop.regenerate') : t('wizard.desktop.generate') })) : null, wizardRole === 'client' && !poolSummary.limitReached ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", onClick: openAddServerWizard, children: t('wizard.client.continueAdd') })) : null, (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", onClick: () => setModalOpen(false), children: t('wizard.modal.finish') })] })] })] })) : null] }) })) : null, devicesModalOpen ? ((0, jsx_runtime_1.jsx)("div", { "data-zen-remote": "wizard-modal", onClick: () => {
                     if (!deviceBusy)
                         setDevicesModalOpen(false);
                 }, children: (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-modalDialog", role: "dialog", "aria-modal": "true", "aria-label": t('wizard.devicesModal.title'), onClick: (event) => event.stopPropagation(), children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-modalHeader", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-headerText", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-modalTitle", children: t('wizard.devicesModal.title') }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-subtitle", children: t('wizard.devicesModal.subtitle') })] }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-cardCloseIcon", "aria-label": t('wizard.card.close'), disabled: deviceBusy, onClick: () => setDevicesModalOpen(false), children: "\u00D7" })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-modalBody", children: [deviceError ? ((0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t('settings.actionFail') })) : null, allDevices.length === 0 ? ((0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", children: t('settings.devicesEmpty') })) : ((0, jsx_runtime_1.jsx)("ul", { className: "zr-wizard-deviceList", children: allDevices.map((device) => ((0, jsx_runtime_1.jsxs)("li", { className: "zr-wizard-deviceItem", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-deviceHead", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-deviceTitleRow", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-lightName", children: device.name }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-deviceBadge", children: device.role === 'web' ? t('settings.deviceRoleWeb') : t('settings.deviceRoleDesktop') }), device.role === 'web' ? ((0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-deviceBadge", children: device.hasPush ? t('settings.devicePushOn') : t('settings.devicePushOff') })) : null] }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-hint", children: t('settings.deviceLastSeen', { time: new Date(device.lastSeen).toLocaleString() }) })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-deviceActions", children: [device.role === 'web' ? ((0, jsx_runtime_1.jsxs)("select", { className: "zr-wizard-select", "aria-label": t('settings.deviceKindSelect', { name: device.name }), disabled: disabled || deviceBusy, value: device.kind, onChange: (event) => {
@@ -20440,7 +20997,43 @@ function GatewayWizard(props) {
                                             }, children: t('wizard.overview.pairDesktop') }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: disabled || deviceBusy, onClick: () => {
                                                 setDevicesModalOpen(false);
                                                 openWizardAt('verify', { role: 'host', target: 'web' });
-                                            }, children: t('wizard.overview.pairPhone') }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: deviceBusy, onClick: () => setDevicesModalOpen(false), children: t('wizard.card.close') })] })] })] }) })) : null, card === 'proxy' ? ((0, jsx_runtime_1.jsx)(ProxyCard_tsx_1.ProxyCard, { t: t, domain: (() => {
+                                            }, children: t('wizard.overview.pairPhone') }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: deviceBusy, onClick: () => setDevicesModalOpen(false), children: t('wizard.card.close') })] })] })] }) })) : null, serversModalOpen ? ((0, jsx_runtime_1.jsx)("div", { "data-zen-remote": "wizard-modal", onClick: () => {
+                    if (serverBusyEntry === null)
+                        setServersModalOpen(false);
+                }, children: (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-modalDialog", role: "dialog", "aria-modal": "true", "aria-label": t('wizard.serversModal.title'), onClick: (event) => event.stopPropagation(), children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-modalHeader", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-headerText", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-modalTitle", children: t('wizard.serversModal.title') }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-subtitle", "data-limit": poolSummary.limitReached ? 'true' : undefined, children: t('wizard.serversModal.subtitle', { count: serverRows.length, max: poolSummary.maxServers }) })] }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-cardCloseIcon", "aria-label": t('wizard.card.close'), disabled: serverBusyEntry !== null, onClick: () => setServersModalOpen(false), children: "\u00D7" })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-modalBody", children: [poolSummary.limitReached ? ((0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t('wizard.overview.limitNote', { max: poolSummary.maxServers }) })) : null, serverActionFailed ? ((0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t('settings.actionFail') })) : null, serverRows.length === 0 ? ((0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", children: t('settings.client.serversEmpty', { max: poolSummary.maxServers }) })) : ((0, jsx_runtime_1.jsx)("ul", { className: "zr-wizard-deviceList", children: serverRows.map((server) => {
+                                        const badge = serverBadgeCopy(server, now, t);
+                                        const name = server.displayName !== '' ? server.displayName : server.serverUrl;
+                                        return ((0, jsx_runtime_1.jsxs)("li", { className: "zr-wizard-deviceItem", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-deviceHead", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-deviceTitleRow", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": serverDotState(server.state) }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-lightName", children: name }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-deviceBadge", "data-tone": badge.tone, children: badge.text })] }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-hint", children: server.serverUrl })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-deviceActions", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-linkBtn", disabled: serverBusyEntry !== null, onClick: () => {
+                                                                setServersModalOpen(false);
+                                                                setActiveClientEntryId(server.entryId);
+                                                                openWizardAt('verify', { role: 'client' });
+                                                            }, children: t('wizard.serversModal.viewStatus') }), server.nextRetryAt !== undefined ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-linkBtn", disabled: serverBusyEntry !== null, onClick: () => { void runServerAction(settings_form_ts_1.CLIENT_RECONNECT_ROUTE, server.entryId, { entryId: server.entryId }); }, children: serverBusyEntry === server.entryId ? t('settings.client.reconnectBusy') : t('settings.client.reconnect') })) : null, (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-linkBtn", disabled: serverBusyEntry !== null, onClick: () => {
+                                                                // 覆盖重配 pre-fills the entry's own address, so
+                                                                // it stays usable at a FULL pool (an already-paired
+                                                                // address never trips the cap).
+                                                                setServersModalOpen(false);
+                                                                setClientServerUrl(server.serverUrl);
+                                                                setClientPairCode('');
+                                                                setClientClaimFail(null);
+                                                                openWizardAt('configure', { role: 'client' });
+                                                            }, children: t('settings.client.repair') }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-linkBtn", disabled: serverBusyEntry !== null, onClick: () => {
+                                                                if (!window.confirm(t('settings.client.unpairServerConfirm')))
+                                                                    return;
+                                                                const entryId = server.entryId;
+                                                                void runServerAction(settings_form_ts_1.CLIENT_UNPAIR_ROUTE, entryId, { entryId }).then(() => {
+                                                                    setActiveClientEntryId((current) => (current === entryId ? undefined : current));
+                                                                });
+                                                            }, children: t('settings.client.serverRemove') })] })] }, server.entryId));
+                                    }) }))] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-modalFooter", children: [(0, jsx_runtime_1.jsx)("div", { className: "zr-wizard-row", children: serverRows.length > 0 ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: serverBusyEntry !== null, onClick: () => {
+                                            if (window.confirm(t('settings.client.unpairAllServersConfirm'))) {
+                                                void runServerAction(settings_form_ts_1.CLIENT_UNPAIR_ROUTE, 'all', { all: true }).then(() => {
+                                                    setActiveClientEntryId(undefined);
+                                                });
+                                            }
+                                        }, children: t('settings.client.unpairAllServers') })) : null }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: poolSummary.limitReached || serverBusyEntry !== null, onClick: () => {
+                                                setServersModalOpen(false);
+                                                openAddServerWizard();
+                                            }, children: t('wizard.overview.addServer') }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: serverBusyEntry !== null, onClick: () => setServersModalOpen(false), children: t('wizard.card.close') })] })] })] }) })) : null, card === 'proxy' ? ((0, jsx_runtime_1.jsx)(ProxyCard_tsx_1.ProxyCard, { t: t, domain: (() => {
                     if (domain.trim() !== '')
                         return domain.trim();
                     try {
@@ -20607,6 +21200,18 @@ exports.WIZARD_CSS = `
   overflow-wrap: anywhere;
   word-break: break-word;
 }
+/* MS-8: the pool cap's loud form — the 已配对服务端 cell's value and sub
+   wear data-limit="true" at 8/8 and turn bold red (the same loudness the
+   settings page's limit alert uses). */
+[data-zen-remote="wizard"] .zr-wizard-overviewValue[data-limit="true"] {
+  color: var(--dsw-alias-state-error-primary, #d5304f);
+  font-weight: 700;
+}
+[data-zen-remote="wizard"] .zr-wizard-overviewSub[data-limit="true"],
+[data-zen-remote="wizard-modal"] .zr-wizard-subtitle[data-limit="true"] {
+  color: var(--dsw-alias-state-error-primary, #d5304f);
+  font-weight: 600;
+}
 [data-zen-remote="wizard"] .zr-wizard-emptyBanner {
   display: flex;
   align-items: center;
@@ -21242,6 +21847,17 @@ exports.WIZARD_CSS = `
   background: var(--dsw-alias-bg-layer-2, var(--dsw-alias-bg-module-platform));
   color: var(--dsw-alias-label-secondary);
 }
+/* MS-8: the servers-modal state badge tones — green online, amber offline,
+   red for a verdict only a re-pair or an upgrade fixes. */
+[data-zen-remote="wizard"] .zr-wizard-deviceBadge[data-tone="live"] {
+  color: var(--dsw-alias-state-success-primary, #16a34a);
+}
+[data-zen-remote="wizard"] .zr-wizard-deviceBadge[data-tone="warn"] {
+  color: var(--dsw-alias-state-warning-primary, #b8860b);
+}
+[data-zen-remote="wizard"] .zr-wizard-deviceBadge[data-tone="invalid"] {
+  color: var(--dsw-alias-state-error-primary, #d5304f);
+}
 [data-zen-remote="wizard"] .zr-wizard-deviceActions {
   display: flex;
   align-items: center;
@@ -21834,6 +22450,10 @@ __modules["client-data/remote-status.js"] = function (require, module, exports)
  * - `parseRemoteStatusBody(body, now)` maps the
  *   `GET /_dsh/zen-remote/client/remote-status` body
  *   (`{ state, versionMismatch, serverName, closed }`) into a tolerant view;
+ *   since MS-6 the body's `servers` dict (per handshake serverId) parses
+ *   alongside, and `resolveServerStatusView(view, sessionId)` picks the
+ *   session's OWN server entry — falling back to the top-level mirror (the
+ *   FIRST pool entry) whenever the dict cannot answer;
  * - `describeRemoteStatus(view)` maps one view to the icon's three states —
  *   online (lit) / offline (grey; `revoked` / `unpaired` count as offline —
  *   the link is not serving either way) / mismatch (yellow, only ever while
@@ -21857,6 +22477,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.REMOTE_STATUS_POLL_MS = exports.windowNetworkHint = exports.documentVisibility = exports.BRIDGE_STAMP_ATTRIBUTE = exports.BRIDGE_STAMP_PLUGIN = exports.CLIENT_UNSHARE_ROUTE = exports.NETWORK_HINT_ROUTE = exports.REMOTE_STATUS_ROUTE = void 0;
 exports.parseRemoteStatusBody = parseRemoteStatusBody;
 exports.shouldStampBridgeAttribute = shouldStampBridgeAttribute;
+exports.resolveServerStatusView = resolveServerStatusView;
+exports.shouldStampBridgeForSession = shouldStampBridgeForSession;
 exports.createZhRemoteStatusFormatter = createZhRemoteStatusFormatter;
 exports.describeRemoteStatus = describeRemoteStatus;
 exports.bannerText = bannerText;
@@ -21873,12 +22495,25 @@ exports.REMOTE_STATUS_ROUTE = '/_dsh/zen-remote/client/remote-status';
 exports.NETWORK_HINT_ROUTE = '/_dsh/zen-remote/client/network-hint';
 /** Same-origin client route closing one remote session from this machine. */
 exports.CLIENT_UNSHARE_ROUTE = '/_dsh/zen-remote/client/unshare';
+/** The tolerant per-entry parse the top level and the `servers` dict share:
+ * a garbage shape is "not online yet", a garbage field degrades to its
+ * default — never a throw into the polling loop. */
+function parseServerStatusEntry(value) {
+    const record = value !== null && typeof value === 'object' ? value : {};
+    return {
+        state: record.state === 'online' || record.state === 'revoked' || record.state === 'unpaired' ? record.state : 'offline',
+        versionMismatch: record.versionMismatch === true,
+        serverName: typeof record.serverName === 'string' ? record.serverName : '',
+        bridgedPlugins: Array.isArray(record.bridgedPlugins)
+            ? record.bridgedPlugins.filter((name) => typeof name === 'string' && name !== '')
+            : [],
+    };
+}
 /** Parse one GET body tolerantly: a garbage shape is "not online yet", a
  * garbage field degrades to its default — never a throw into the polling
  * loop. */
 function parseRemoteStatusBody(body, now) {
     const record = body !== null && typeof body === 'object' ? body : {};
-    const state = record.state === 'online' || record.state === 'revoked' || record.state === 'unpaired' ? record.state : 'offline';
     const closed = {};
     if (record.closed !== null && typeof record.closed === 'object') {
         for (const [sessionId, reason] of Object.entries(record.closed)) {
@@ -21887,14 +22522,21 @@ function parseRemoteStatusBody(body, now) {
             closed[sessionId] = reason === 'client' || reason === 'idle' ? reason : 'manual';
         }
     }
+    // MS-6: the per-server dict, keyed by the handshake serverId. A legacy
+    // body (or a broken one) parses to the EMPTY dict — the parts then read
+    // the top-level mirror, the pre-MS-6 answer.
+    const servers = {};
+    if (record.servers !== null && typeof record.servers === 'object' && !Array.isArray(record.servers)) {
+        for (const [serverId, entry] of Object.entries(record.servers)) {
+            if (serverId === '')
+                continue;
+            servers[serverId] = parseServerStatusEntry(entry);
+        }
+    }
     return {
-        state,
-        versionMismatch: record.versionMismatch === true,
-        serverName: typeof record.serverName === 'string' ? record.serverName : '',
+        ...parseServerStatusEntry(record),
         closed,
-        bridgedPlugins: Array.isArray(record.bridgedPlugins)
-            ? record.bridgedPlugins.filter((name) => typeof name === 'string' && name !== '')
-            : [],
+        servers,
         asOf: now,
     };
 }
@@ -21912,6 +22554,41 @@ function parseRemoteStatusBody(body, now) {
 function shouldStampBridgeAttribute(bridgedPlugins, plugin) {
     return Array.isArray(bridgedPlugins) && bridgedPlugins.includes(plugin);
 }
+/**
+ * Which server's facts ONE session reads (MS-6): given the session id on
+ * screen, its virtual form names the owning serverId, and THAT server's
+ * entry answers — per-server isolation for the icon, the banner and the
+ * bridge stamp. Everything else falls back to the TOP-LEVEL view, the
+ * pre-MS-6 answer: a session id that is not virtual (a local session), a
+ * serverId the dict never answered (its entry never handshook), a legacy
+ * body without a dict, or no session id at all. Tolerant the same way as
+ * the parse: hand-rolled views without `servers` never throw here.
+ */
+function resolveServerStatusView(view, sessionId) {
+    if (view === undefined || view === null)
+        return undefined;
+    if (sessionId !== undefined) {
+        const parts = (0, virtual_id_ts_1.fromVirtual)(sessionId);
+        if (parts !== undefined) {
+            const server = view.servers?.[parts.serverId];
+            if (server !== undefined)
+                return server;
+        }
+    }
+    // RemoteStatusView structurally carries every RemoteServerStatusView field.
+    return view;
+}
+/**
+ * Whether the remote session CURRENTLY ON SCREEN has its own server's bridge
+ * verdict going its way (MS-6): the verdict comes from the session's server
+ * entry ({@link resolveServerStatusView}), not the page-wide mirror of the
+ * FIRST pool entry — with several servers paired, A bridging a plugin must
+ * not un-hide it over B's sessions. Tolerant like the 2-argument core it
+ * wraps: a garbage or missing list reads as "not bridged".
+ */
+function shouldStampBridgeForSession(view, sessionId, plugin) {
+    return shouldStampBridgeAttribute(resolveServerStatusView(view, sessionId)?.bridgedPlugins, plugin);
+}
 /** The plugin the bridge stamp names. */
 exports.BRIDGE_STAMP_PLUGIN = 'dsh-better-sidebar';
 /** The html attribute the stamp writes (`data-zr-bridge-dsh-better-sidebar`). */
@@ -21922,15 +22599,20 @@ exports.BRIDGE_STAMP_ATTRIBUTE = `data-zr-bridge-${exports.BRIDGE_STAMP_PLUGIN}`
 function createZhRemoteStatusFormatter() {
     return (key) => locales_ts_1.zh[key];
 }
-function describeRemoteStatus(view, t = createZhRemoteStatusFormatter()) {
-    if (view === undefined || view === null)
+function describeRemoteStatus(view, t = createZhRemoteStatusFormatter(), 
+/** MS-6: the session on screen — its virtual id picks its OWN server's
+ * entry; omitted (or unanswered by the dict) keeps the pre-MS-6 top-level
+ * read. */
+sessionId) {
+    const status = resolveServerStatusView(view, sessionId);
+    if (status === undefined)
         return { state: 'offline', hoverText: t('remoteStatusOffline') };
-    if (view.state === 'revoked')
+    if (status.state === 'revoked')
         return { state: 'revoked', hoverText: t('remoteStatusRevoked') };
-    if (view.state === 'unpaired')
+    if (status.state === 'unpaired')
         return { state: 'unpaired', hoverText: t('remoteStatusUnpaired') };
-    if (view.state === 'online') {
-        return view.versionMismatch
+    if (status.state === 'online') {
+        return status.versionMismatch
             ? { state: 'mismatch', hoverText: t('remoteStatusMismatch') }
             : { state: 'online', hoverText: t('remoteStatusOnline') };
     }
@@ -21948,6 +22630,8 @@ function describeRemoteStatus(view, t = createZhRemoteStatusFormatter()) {
  * no banner.
  */
 function bannerText(view, sessionId, t = (key) => locales_ts_1.zh[key]) {
+    // The closed map is SESSION-keyed (virtual ids embed their server, so one
+    // global dict cannot collide) and outranks every link-level line.
     const reason = view?.closed[sessionId];
     if (reason === 'idle')
         return t('remoteBannerClosedIdle');
@@ -21957,14 +22641,17 @@ function bannerText(view, sessionId, t = (key) => locales_ts_1.zh[key]) {
     // vocabulary): a closure with no certain reason reads as the manual close.
     if (reason !== undefined)
         return t('remoteBannerClosedManual');
-    if (view !== undefined && view !== null) {
-        if (view.state === 'offline')
+    // MS-6: the link-level line reads the SESSION'S OWN server, not the page's
+    // first-entry mirror.
+    const status = resolveServerStatusView(view, sessionId);
+    if (status !== undefined) {
+        if (status.state === 'offline')
             return t('remoteBannerOffline');
         // T41a-fix2: a revoked token / an unpaired client is not "reconnecting"
         // — the composer must not sit disabled on a promise no reconnect keeps.
-        if (view.state === 'revoked')
+        if (status.state === 'revoked')
             return t('remoteBannerRevoked');
-        if (view.state === 'unpaired')
+        if (status.state === 'unpaired')
             return t('remoteBannerUnpaired');
     }
     return undefined;
@@ -22274,7 +22961,10 @@ function RemoteStatusIcon({ sessionId, status, t }) {
     // still be ready from a PREVIOUS remote session when a local one opens.
     if (!(0, virtual_id_js_1.isVirtual)(sessionId) || !snap.ready)
         return null;
-    const description = (0, remote_status_ts_1.describeRemoteStatus)(snap.view, t);
+    // MS-6: the session's virtual id picks its OWN server's entry — with
+    // several servers paired, A online and B offline light and grey their own
+    // sessions independently.
+    const description = (0, remote_status_ts_1.describeRemoteStatus)(snap.view, t, sessionId);
     const close = () => {
         // Offline recovers on its own; revoked / unpaired do not (T34-fix) —
         // each says its own word instead of "reconnecting".
@@ -22545,9 +23235,20 @@ function startCurrentSessionReporter(options = {}) {
             return undefined;
         }
     };
-    const post = (report) => {
+    const readLang = () => {
+        if (options.getLang !== undefined)
+            return options.getLang();
+        const doc = globalThis.document;
+        const htmlLang = doc?.documentElement?.lang;
+        if (typeof htmlLang === 'string' && htmlLang !== '') {
+            return htmlLang.toLowerCase().startsWith('zh') ? 'zh' : 'en';
+        }
+        return undefined;
+    };
+    const post = (report, lang) => {
         const doFetch = options.fetchImpl ?? fetch;
-        const body = report.kind === 'open' ? { sessionId: report.sessionId } : { sessionId: null };
+        const base = report.kind === 'open' ? { sessionId: report.sessionId } : { sessionId: null };
+        const body = lang !== undefined ? { ...base, lang } : base;
         return doFetch(options.route ?? CURRENT_SESSION_ROUTE, {
             method: 'POST',
             headers: { 'content-type': 'application/json; charset=utf-8' },
@@ -22561,6 +23262,7 @@ function startCurrentSessionReporter(options = {}) {
     // T66: the timestamp of the last accepted post drives the slow unconditional
     // re-send (0 = due immediately, which is the page-load post).
     let lastReported;
+    let lastReportedLang;
     let lastSentAt = 0;
     const resendEveryMs = options.resendIntervalMs ?? RESEND_INTERVAL_MS;
     let role;
@@ -22578,16 +23280,22 @@ function startCurrentSessionReporter(options = {}) {
         const report = (0, current_session_ts_1.parseCurrentSessionStorage)(readRaw());
         if (report.kind === 'unavailable')
             return;
+        const lang = readLang();
         const now = Date.now();
         // T66: inside the re-send window an unchanged value says nothing; once
         // the window passes, the CURRENT value re-posts even unchanged — the
         // backend may have been reset underneath the page.
         const resendDue = now - lastSentAt >= resendEveryMs;
-        if (!resendDue && lastReported !== undefined && (0, current_session_ts_1.currentSessionReportEquals)(report, lastReported))
+        if (!resendDue &&
+            lastReported !== undefined &&
+            (0, current_session_ts_1.currentSessionReportEquals)(report, lastReported) &&
+            lang === lastReportedLang) {
             return;
+        }
         try {
-            await post(report);
+            await post(report, lang);
             lastReported = report;
+            lastReportedLang = lang;
             lastSentAt = now;
         }
         catch {
@@ -23291,13 +23999,27 @@ html[data-zr-remote-session="1"]:not([data-zr-bridge-dsh-better-sidebar="1"]) [d
 
    KNOWN BOUNDARY (accepted, not fixed): in a remote session, searching the
    model menu and pressing Enter can commit a HIDDEN local model — the
-   interceptor refuses it with its usual message. */
+   interceptor refuses it with its usual message.
+
+   MS-4, several paired servers: each remote group heading also carries its
+   server id (zero-width bits after the mark, virtual-id.ts
+   encodeServerIdZeroWidth), and the effect reads the open session's server
+   off html[data-zr-remote-server] (effects/remote-session.ts). A remote
+   group of a DIFFERENT server is stamped "remote-other": hidden inside a
+   remote session (only the open session's own server's models can run
+   there) and, like every remote group, outside one. */
 html[data-zr-remote-session="1"] section[role="group"][data-zr-group="local"] {
   display: none !important;
 }
+html[data-zr-remote-session="1"] section[role="group"][data-zr-group="remote-other"] {
+  display: none !important;
+}
 html:not([data-zr-remote-session]) section[role="group"][data-zr-group="remote"] {
   display: none !important;
 }
+html:not([data-zr-remote-session]) section[role="group"][data-zr-group="remote-other"] {
+  display: none !important;
+}
 
 /* ---------- T52-fix: hide the virtual groups in NATIVE <option> pickers ----
    The model menu above is React DOM, but dsh-vision-router's settings render
@@ -23396,6 +24118,85 @@ html[data-zr-remote-session="1"] .zr-download-action[data-phase="error"] {
 }
 `;
 };
+__modules["client-data/model-group-side.js"] = function (require, module, exports) {
+"use strict";
+/**
+ * T74: which side of the pairing a model-menu GROUP belongs to, as pure
+ * functions — the readable core of the browser effect
+ * (src/client/effects/model-group-side.ts).
+ *
+ * WHY: the merged catalog (merge-streams.ts mergeModelCatalogs) appends the
+ * server's provider groups everywhere, but a selection only runs on the side
+ * the open session lives on — the interceptor refuses the other side. Through
+ * DSH 0.1.7 every menu group carried its id in `aria-labelledby`
+ * (`<useId>-<group.id>`), so CSS keyed the hiding on the `zr~` prefix (T52).
+ * DSH 0.2.0 renders the groups with the primitives' MenuGroup, whose
+ * `aria-labelledby` is a bare useId — the id is gone — and the same component
+ * renders OTHER menus' groups too, so attribute scoping misfires in both
+ * directions. Classification therefore moved to the one mark every version
+ * renders: virtual group NAMES start with VIRTUAL_GROUP_NAME_MARK
+ * (virtual-id.ts), read off each group's heading text.
+ *
+ * The container rule is what keeps the effect inert wherever it cannot be
+ * sure: a container with not ONE marked heading — the model menu of a
+ * sub-client with no shared models, every other menu on the page, the whole
+ * rest of the page — classifies as `undefined` for every group, which the
+ * effect reads as "leave the DOM alone". Only a container holding at least
+ * one marked heading is decided, and inside it the unmarked groups are
+ * exactly the LOCAL ones: the merged catalog only ever APPENDS virtual
+ * groups to the local list, never mixes them the other way.
+ *
+ * Defensive like the rest of client-data: an empty or missing heading never
+ * counts as a mark, so it can never decide a container by accident.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REMOTE_SERVER_ATTRIBUTE = void 0;
+exports.classifyModelGroups = classifyModelGroups;
+exports.classifyModelGroupsForSession = classifyModelGroupsForSession;
+const virtual_id_ts_1 = require("./virtual-id.js");
+/** MS-4: the <html> attribute carrying the open REMOTE session's server id
+ * (`zr~<serverId>~…`'s middle half). Written by effects/remote-session.ts
+ * together with `data-zr-remote-session`, read by
+ * effects/model-group-side.ts as the `activeRemoteServerId`. */
+exports.REMOTE_SERVER_ATTRIBUTE = 'data-zr-remote-server';
+function classifyModelGroups(groups) {
+    return classifyModelGroupsForSession(groups);
+}
+/**
+ * The MS-4 extension: with `activeRemoteServerId` set (the `zr~<serverId>~`
+ * half of the session the browser has open, effects/remote-session.ts),
+ * each marked heading's embedded server id (decodeServerIdZeroWidth)
+ * decides between plain `remote` (the open session's own server, or a
+ * heading whose server cannot be decoded — shown, never hidden) and
+ * `remote-other` (a DIFFERENT paired server's group — hidden in a remote
+ * session by remote-session.css.ts). Without the argument the verdicts
+ * are exactly {@link classifyModelGroups}'s — the single-paired-server
+ * behavior, byte for byte.
+ */
+function classifyModelGroupsForSession(groups, activeRemoteServerId) {
+    // Per container: did any heading carry the mark? Containers are decided
+    // independently — one mixed model menu must not turn an all-local
+    // container (a second menu elsewhere on the page) into "hide everything
+    // local" there.
+    const marked = new Map();
+    for (const group of groups) {
+        const had = marked.get(group.containerKey) ?? false;
+        marked.set(group.containerKey, had || group.headingText.startsWith(virtual_id_ts_1.VIRTUAL_GROUP_NAME_MARK));
+    }
+    return groups.map((group) => {
+        if (!marked.get(group.containerKey))
+            return undefined;
+        if (!group.headingText.startsWith(virtual_id_ts_1.VIRTUAL_GROUP_NAME_MARK))
+            return 'local';
+        if (activeRemoteServerId !== undefined) {
+            const groupServerId = (0, virtual_id_ts_1.decodeServerIdZeroWidth)(group.headingText);
+            if (groupServerId !== undefined && groupServerId !== activeRemoteServerId)
+                return 'remote-other';
+        }
+        return 'remote';
+    });
+}
+};
 __modules["client/effects/remote-session.js"] = function (require, module, exports) {
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
@@ -23405,6 +24206,7 @@ const virtual_id_ts_1 = require("./virtual-id.js");
 const remote_session_css_ts_1 = require("./client/styles/remote-session.css.js");
 const remote_status_ts_1 = require("./client-data/remote-status.js");
 const locales_ts_1 = require("./client/locales.js");
+const model_group_side_ts_1 = require("./client-data/model-group-side.js");
 /**
  * The remote-session marker (T41b): the CURRENT main-view session id, read
  * the way the official uiSession `publishMain` reads it (RT
@@ -23414,6 +24216,12 @@ const locales_ts_1 = require("./client/locales.js");
  * every open-on-the-server-machine entry, so the decision lives at the one
  * place that knows the session and never inside component DOM.
  *
+ * MS-4: with several servers paired, the virtual id's serverId half is
+ * stamped alongside as `data-zr-remote-server="<serverId>"` — the model
+ * menu's per-server isolation (effects/model-group-side.ts reads it to hide
+ * the OTHER paired servers' groups; remote-session.css.ts hides them). Both
+ * attributes move together: a local session (or unmount) clears both.
+ *
  * The official tie-break is kept verbatim: when the previous answer is still
  * mainView-retained it STAYS the answer, and only otherwise does the first
  * mainView-retained row in catalog order win — so two simultaneously
@@ -23462,10 +24270,16 @@ function installRemoteSessionGuard(ctx) {
         const apply = () => {
             const sessionId = currentMainSessionIdOf(ctx);
             const root = document.documentElement;
-            if (sessionId !== undefined && (0, virtual_id_ts_1.isVirtual)(sessionId))
+            const parts = sessionId !== undefined ? (0, virtual_id_ts_1.fromVirtual)(sessionId) : undefined;
+            if (parts !== undefined) {
                 root.setAttribute('data-zr-remote-session', '1');
-            else
+                if (root.getAttribute(model_group_side_ts_1.REMOTE_SERVER_ATTRIBUTE) !== parts.serverId)
+                    root.setAttribute(model_group_side_ts_1.REMOTE_SERVER_ATTRIBUTE, parts.serverId);
+            }
+            else {
                 root.removeAttribute('data-zr-remote-session');
+                root.removeAttribute(model_group_side_ts_1.REMOTE_SERVER_ATTRIBUTE);
+            }
         };
         apply();
         const offs = [ctx.sessions.list.subscribe(apply)];
@@ -23479,6 +24293,7 @@ function installRemoteSessionGuard(ctx) {
             for (const off of offs)
                 off();
             document.documentElement.removeAttribute('data-zr-remote-session');
+            document.documentElement.removeAttribute(model_group_side_ts_1.REMOTE_SERVER_ATTRIBUTE);
         };
     }, 'dsh-zen-remote: remote-session attribute');
     // The bridge stamp (PB-14): while a REMOTE session is on screen, the
@@ -23502,7 +24317,7 @@ function installRemoteSessionGuard(ctx) {
         };
         const applyBridge = () => {
             const view = store.getSnapshot().view;
-            if ((0, remote_status_ts_1.shouldStampBridgeAttribute)(view?.bridgedPlugins, remote_status_ts_1.BRIDGE_STAMP_PLUGIN)) {
+            if ((0, remote_status_ts_1.shouldStampBridgeForSession)(view, currentMainSessionIdOf(ctx), remote_status_ts_1.BRIDGE_STAMP_PLUGIN)) {
                 root.setAttribute(remote_status_ts_1.BRIDGE_STAMP_ATTRIBUTE, '1');
                 root.style.removeProperty('--zr-bridge-note');
             }
@@ -23521,7 +24336,13 @@ function installRemoteSessionGuard(ctx) {
                 applyBridge();
                 return;
             }
-            if (!virtualNow && offStore !== undefined) {
+            // MS-6: remote A → remote B keeps the subscription, but the verdict
+            // belongs to the session's own server and must be re-judged.
+            if (virtualNow) {
+                applyBridge();
+                return;
+            }
+            if (offStore !== undefined) {
                 offStore();
                 offStore = undefined;
                 clear();
@@ -23541,57 +24362,6 @@ function installRemoteSessionGuard(ctx) {
     }, 'dsh-zen-remote: bridge stamp');
 }
 };
-__modules["client-data/model-group-side.js"] = function (require, module, exports) {
-"use strict";
-/**
- * T74: which side of the pairing a model-menu GROUP belongs to, as pure
- * functions — the readable core of the browser effect
- * (src/client/effects/model-group-side.ts).
- *
- * WHY: the merged catalog (merge-streams.ts mergeModelCatalogs) appends the
- * server's provider groups everywhere, but a selection only runs on the side
- * the open session lives on — the interceptor refuses the other side. Through
- * DSH 0.1.7 every menu group carried its id in `aria-labelledby`
- * (`<useId>-<group.id>`), so CSS keyed the hiding on the `zr~` prefix (T52).
- * DSH 0.2.0 renders the groups with the primitives' MenuGroup, whose
- * `aria-labelledby` is a bare useId — the id is gone — and the same component
- * renders OTHER menus' groups too, so attribute scoping misfires in both
- * directions. Classification therefore moved to the one mark every version
- * renders: virtual group NAMES start with VIRTUAL_GROUP_NAME_MARK
- * (virtual-id.ts), read off each group's heading text.
- *
- * The container rule is what keeps the effect inert wherever it cannot be
- * sure: a container with not ONE marked heading — the model menu of a
- * sub-client with no shared models, every other menu on the page, the whole
- * rest of the page — classifies as `undefined` for every group, which the
- * effect reads as "leave the DOM alone". Only a container holding at least
- * one marked heading is decided, and inside it the unmarked groups are
- * exactly the LOCAL ones: the merged catalog only ever APPENDS virtual
- * groups to the local list, never mixes them the other way.
- *
- * Defensive like the rest of client-data: an empty or missing heading never
- * counts as a mark, so it can never decide a container by accident.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.classifyModelGroups = classifyModelGroups;
-const virtual_id_ts_1 = require("./virtual-id.js");
-function classifyModelGroups(groups) {
-    // Per container: did any heading carry the mark? Containers are decided
-    // independently — one mixed model menu must not turn an all-local
-    // container (a second menu elsewhere on the page) into "hide everything
-    // local" there.
-    const marked = new Map();
-    for (const group of groups) {
-        const had = marked.get(group.containerKey) ?? false;
-        marked.set(group.containerKey, had || group.headingText.startsWith(virtual_id_ts_1.VIRTUAL_GROUP_NAME_MARK));
-    }
-    return groups.map((group) => marked.get(group.containerKey)
-        ? group.headingText.startsWith(virtual_id_ts_1.VIRTUAL_GROUP_NAME_MARK)
-            ? 'remote'
-            : 'local'
-        : undefined);
-}
-};
 __modules["client/effects/model-group-side.js"] = function (require, module, exports) {
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
@@ -23608,6 +24378,13 @@ const model_group_side_ts_1 = require("./client-data/model-group-side.js");
  * virtual-id.ts) heading is decided at all, so every other menu and the
  * whole rest of the page is never touched.
  *
+ * MS-4: the open remote session's server id (`data-zr-remote-server` on
+ * <html>, written by effects/remote-session.ts) is the classifier's
+ * `activeRemoteServerId` — a remote group whose heading decodes to a
+ * DIFFERENT paired server is stamped `remote-other`. Switching between two
+ * servers' sessions changes no group DOM at all, so a second observer
+ * watches that one <html> attribute and rescans the moment it moves.
+ *
  * Synchronous in the observer callback, never behind rAF: the callback is a
  * microtask and runs before this frame paints, so a group that must be
  * hidden is hidden the first time it is drawn. A rAF would land a frame late
@@ -23618,8 +24395,8 @@ const model_group_side_ts_1 = require("./client-data/model-group-side.js");
  */
 const GROUP_SELECTOR = 'section[role="group"]';
 /** The stamp this effect writes; remote-session.css.ts hides
- * `[data-zr-group="local"]` in a remote session and
- * `[data-zr-group="remote"]` everywhere else. */
+ * `[data-zr-group="local"]` and `[data-zr-group="remote-other"]` in a
+ * remote session and both remote stamps everywhere else. */
 const STAMP = 'data-zr-group';
 /**
  * The heading text a group section renders, across the two DSH layouts:
@@ -23701,7 +24478,8 @@ function installModelGroupSide(ctx) {
                 const text = headingTextOf(section, (id) => document.getElementById(id));
                 rows.push({ section, containerKey: key, headingText: text ?? '' });
             }
-            const verdicts = (0, model_group_side_ts_1.classifyModelGroups)(rows);
+            const activeRemoteServerId = document.documentElement.getAttribute(model_group_side_ts_1.REMOTE_SERVER_ATTRIBUTE) ?? undefined;
+            const verdicts = (0, model_group_side_ts_1.classifyModelGroupsForSession)(rows, activeRemoteServerId);
             rows.forEach((row, i) => applyVerdict(row.section, verdicts[i]));
         };
         // childList + subtree catches mounted/unmounted/re-parented groups,
@@ -23716,12 +24494,18 @@ function installModelGroupSide(ctx) {
             }
         });
         observer.observe(document.body, { childList: true, subtree: true, characterData: true });
+        // MS-4: the session's server moves on <html> alone (A's session → B's
+        // with the menu open touches no group) — rescan synchronously, same
+        // no-rAF discipline as above.
+        const serverObserver = new MutationObserver(() => scan());
+        serverObserver.observe(document.documentElement, { attributes: true, attributeFilter: [model_group_side_ts_1.REMOTE_SERVER_ATTRIBUTE] });
         // The initial paint may already hold groups (session restored under an
         // open menu): stamp them synchronously at install, like every observer
         // effect here does.
         scan();
         return () => {
             observer.disconnect();
+            serverObserver.disconnect();
             // Undo every stamp so the host DOM reads exactly as before the effect
             // ran — the CSS rules key on the stamp, so this un-hides everything.
             for (const section of document.querySelectorAll(`${GROUP_SELECTOR}[${STAMP}]`)) {