dsh-zen-remote 2.3.11 → 2.4.1

package/src/client/wizard/cards/ProxyCard.tsx

@@ -23,7 +23,8 @@ export interface ProxyCardProps {
 
 export function ProxyCard({ t, domain, upstreamPort, onCheck, onClose }: ProxyCardProps): ReactNode {
   const [tab, setTab] = useState<SnippetKind>('nginx')
-  const input = { domain, upstreamHost: '127.0.0.1', upstreamPort }
+  const lang: 'zh' | 'en' = t('wizard.card.close') === 'Close' ? 'en' : 'zh'
+  const input = { domain, upstreamHost: '127.0.0.1', upstreamPort, lang }
   const text = tab === 'nginx'
     ? nginxSnippetText(input)
     : tab === 'caddy' ? caddySnippetText(input) : (luckyStepTexts(input) ?? []).join('\n')

package/src/client/wizard/wizard-css.ts

@@ -138,6 +138,18 @@ export const WIZARD_CSS = `
   overflow-wrap: anywhere;
   word-break: break-word;
 }
+/* MS-8: the pool cap's loud form — the 已配对服务端 cell's value and sub
+   wear data-limit="true" at 8/8 and turn bold red (the same loudness the
+   settings page's limit alert uses). */
+[data-zen-remote="wizard"] .zr-wizard-overviewValue[data-limit="true"] {
+  color: var(--dsw-alias-state-error-primary, #d5304f);
+  font-weight: 700;
+}
+[data-zen-remote="wizard"] .zr-wizard-overviewSub[data-limit="true"],
+[data-zen-remote="wizard-modal"] .zr-wizard-subtitle[data-limit="true"] {
+  color: var(--dsw-alias-state-error-primary, #d5304f);
+  font-weight: 600;
+}
 [data-zen-remote="wizard"] .zr-wizard-emptyBanner {
   display: flex;
   align-items: center;
@@ -773,6 +785,17 @@ export const WIZARD_CSS = `
   background: var(--dsw-alias-bg-layer-2, var(--dsw-alias-bg-module-platform));
   color: var(--dsw-alias-label-secondary);
 }
+/* MS-8: the servers-modal state badge tones — green online, amber offline,
+   red for a verdict only a re-pair or an upgrade fixes. */
+[data-zen-remote="wizard"] .zr-wizard-deviceBadge[data-tone="live"] {
+  color: var(--dsw-alias-state-success-primary, #16a34a);
+}
+[data-zen-remote="wizard"] .zr-wizard-deviceBadge[data-tone="warn"] {
+  color: var(--dsw-alias-state-warning-primary, #b8860b);
+}
+[data-zen-remote="wizard"] .zr-wizard-deviceBadge[data-tone="invalid"] {
+  color: var(--dsw-alias-state-error-primary, #d5304f);
+}
 [data-zen-remote="wizard"] .zr-wizard-deviceActions {
   display: flex;
   align-items: center;

package/src/client-data/model-group-side.ts

@@ -28,7 +28,13 @@
  * counts as a mark, so it can never decide a container by accident.
  */
 
-import { VIRTUAL_GROUP_NAME_MARK } from '../virtual-id.ts'
+import { VIRTUAL_GROUP_NAME_MARK, decodeServerIdZeroWidth } from '../virtual-id.ts'
+
+/** MS-4: the <html> attribute carrying the open REMOTE session's server id
+ * (`zr~<serverId>~…`'s middle half). Written by effects/remote-session.ts
+ * together with `data-zr-remote-session`, read by
+ * effects/model-group-side.ts as the `activeRemoteServerId`. */
+export const REMOTE_SERVER_ATTRIBUTE = 'data-zr-remote-server'
 
 /** One group's display description, as the DOM shows it. */
 export interface ModelGroupHeading {
@@ -42,10 +48,29 @@ export interface ModelGroupHeading {
 /** Per-group verdict, in input order: `remote` for marked headings, `local`
  * for the rest of a container that has at least one, and `undefined` —
  * "stamp nothing" — for every group of a container that holds no mark at
- * all. */
-export type ModelGroupSide = 'remote' | 'local' | undefined
+ * all. MS-4 adds `remote-other`: with a session's own server id known
+ * ({@link classifyModelGroupsForSession}'s `activeRemoteServerId`), a
+ * marked group whose DECODED server id is a DIFFERENT paired server — the
+ * model menu must show only the models of the server the open session
+ * lives on. */
+export type ModelGroupSide = 'remote' | 'local' | 'remote-other' | undefined
 
 export function classifyModelGroups(groups: readonly ModelGroupHeading[]): ModelGroupSide[] {
+  return classifyModelGroupsForSession(groups)
+}
+
+/**
+ * The MS-4 extension: with `activeRemoteServerId` set (the `zr~<serverId>~`
+ * half of the session the browser has open, effects/remote-session.ts),
+ * each marked heading's embedded server id (decodeServerIdZeroWidth)
+ * decides between plain `remote` (the open session's own server, or a
+ * heading whose server cannot be decoded — shown, never hidden) and
+ * `remote-other` (a DIFFERENT paired server's group — hidden in a remote
+ * session by remote-session.css.ts). Without the argument the verdicts
+ * are exactly {@link classifyModelGroups}'s — the single-paired-server
+ * behavior, byte for byte.
+ */
+export function classifyModelGroupsForSession(groups: readonly ModelGroupHeading[], activeRemoteServerId?: string): ModelGroupSide[] {
   // Per container: did any heading carry the mark? Containers are decided
   // independently — one mixed model menu must not turn an all-local
   // container (a second menu elsewhere on the page) into "hide everything
@@ -55,11 +80,13 @@ export function classifyModelGroups(groups: readonly ModelGroupHeading[]): Model
     const had = marked.get(group.containerKey) ?? false
     marked.set(group.containerKey, had || group.headingText.startsWith(VIRTUAL_GROUP_NAME_MARK))
   }
-  return groups.map((group) =>
-    marked.get(group.containerKey)
-      ? group.headingText.startsWith(VIRTUAL_GROUP_NAME_MARK)
-        ? 'remote'
-        : 'local'
-      : undefined,
-  )
+  return groups.map((group) => {
+    if (!marked.get(group.containerKey)) return undefined
+    if (!group.headingText.startsWith(VIRTUAL_GROUP_NAME_MARK)) return 'local'
+    if (activeRemoteServerId !== undefined) {
+      const groupServerId = decodeServerIdZeroWidth(group.headingText)
+      if (groupServerId !== undefined && groupServerId !== activeRemoteServerId) return 'remote-other'
+    }
+    return 'remote'
+  })
 }

package/src/client-data/remote-status.ts

@@ -8,6 +8,10 @@
  * - `parseRemoteStatusBody(body, now)` maps the
  *   `GET /_dsh/zen-remote/client/remote-status` body
  *   (`{ state, versionMismatch, serverName, closed }`) into a tolerant view;
+ *   since MS-6 the body's `servers` dict (per handshake serverId) parses
+ *   alongside, and `resolveServerStatusView(view, sessionId)` picks the
+ *   session's OWN server entry — falling back to the top-level mirror (the
+ *   FIRST pool entry) whenever the dict cannot answer;
  * - `describeRemoteStatus(view)` maps one view to the icon's three states —
  *   online (lit) / offline (grey; `revoked` / `unpaired` count as offline —
  *   the link is not serving either way) / mismatch (yellow, only ever while
@@ -29,7 +33,7 @@
  */
 
 import { createLatestGate } from './settings-form.ts'
-import { isVirtual } from '../virtual-id.ts'
+import { fromVirtual, isVirtual } from '../virtual-id.ts'
 import { zh } from '../client/locales.ts'
 
 /** Same-origin client route feeding this store (host half: T34,
@@ -47,6 +51,21 @@ export type RemoteStatusState = 'online' | 'offline' | 'revoked' | 'unpaired'
 /** Why the server closed a session's remote access. */
 export type RemoteClosedReason = 'manual' | 'client' | 'idle'
 
+/**
+ * ONE paired server's serving state (MS-6): the same four facts the top
+ * level has always carried, scoped to the server whose handshake minted the
+ * `serverId`. The route (src/client-routes.ts, MS-5) serves these under
+ * `servers`, keyed by serverId; the top level mirrors the FIRST pool entry
+ * for the pre-MS-6 page.
+ */
+export interface RemoteServerStatusView {
+  state: RemoteStatusState
+  versionMismatch: boolean
+  serverName: string
+  /** The plugins whose bridge verdict is bridged RIGHT NOW on THIS server. */
+  bridgedPlugins: readonly string[]
+}
+
 /** One parsed status body, stamped with the parse time for future decay. */
 export interface RemoteStatusView {
   state: RemoteStatusState
@@ -58,6 +77,10 @@ export interface RemoteStatusView {
    * nothing is ever considered bridged on a shape the parse does not
    * trust. */
   bridgedPlugins: readonly string[]
+  /** Per-server views keyed by the handshake serverId (MS-6). A legacy body
+   * without the field parses to the empty dict — the parts then fall back to
+   * the top-level mirror. */
+  servers: Readonly<Record<string, RemoteServerStatusView>>
   /** When this view was parsed off a GET body. */
   asOf: number
 }
@@ -69,12 +92,26 @@ export interface RemoteStatusSnapshot {
   view: RemoteStatusView | undefined
 }
 
+/** The tolerant per-entry parse the top level and the `servers` dict share:
+ * a garbage shape is "not online yet", a garbage field degrades to its
+ * default — never a throw into the polling loop. */
+function parseServerStatusEntry(value: unknown): RemoteServerStatusView {
+  const record = value !== null && typeof value === 'object' ? (value as Record<string, unknown>) : {}
+  return {
+    state: record.state === 'online' || record.state === 'revoked' || record.state === 'unpaired' ? record.state : 'offline',
+    versionMismatch: record.versionMismatch === true,
+    serverName: typeof record.serverName === 'string' ? record.serverName : '',
+    bridgedPlugins: Array.isArray(record.bridgedPlugins)
+      ? record.bridgedPlugins.filter((name): name is string => typeof name === 'string' && name !== '')
+      : [],
+  }
+}
+
 /** Parse one GET body tolerantly: a garbage shape is "not online yet", a
  * garbage field degrades to its default — never a throw into the polling
  * loop. */
 export function parseRemoteStatusBody(body: unknown, now: number): RemoteStatusView {
   const record = body !== null && typeof body === 'object' ? (body as Record<string, unknown>) : {}
-  const state = record.state === 'online' || record.state === 'revoked' || record.state === 'unpaired' ? record.state : 'offline'
   const closed: Record<string, RemoteClosedReason> = {}
   if (record.closed !== null && typeof record.closed === 'object') {
     for (const [sessionId, reason] of Object.entries(record.closed as Record<string, unknown>)) {
@@ -82,14 +119,20 @@ export function parseRemoteStatusBody(body: unknown, now: number): RemoteStatusV
       closed[sessionId] = reason === 'client' || reason === 'idle' ? reason : 'manual'
     }
   }
+  // MS-6: the per-server dict, keyed by the handshake serverId. A legacy
+  // body (or a broken one) parses to the EMPTY dict — the parts then read
+  // the top-level mirror, the pre-MS-6 answer.
+  const servers: Record<string, RemoteServerStatusView> = {}
+  if (record.servers !== null && typeof record.servers === 'object' && !Array.isArray(record.servers)) {
+    for (const [serverId, entry] of Object.entries(record.servers as Record<string, unknown>)) {
+      if (serverId === '') continue
+      servers[serverId] = parseServerStatusEntry(entry)
+    }
+  }
   return {
-    state,
-    versionMismatch: record.versionMismatch === true,
-    serverName: typeof record.serverName === 'string' ? record.serverName : '',
+    ...parseServerStatusEntry(record),
     closed,
-    bridgedPlugins: Array.isArray(record.bridgedPlugins)
-      ? record.bridgedPlugins.filter((name): name is string => typeof name === 'string' && name !== '')
-      : [],
+    servers,
     asOf: now,
   }
 }
@@ -110,6 +153,48 @@ export function shouldStampBridgeAttribute(bridgedPlugins: unknown, plugin: stri
   return Array.isArray(bridgedPlugins) && bridgedPlugins.includes(plugin)
 }
 
+/**
+ * Which server's facts ONE session reads (MS-6): given the session id on
+ * screen, its virtual form names the owning serverId, and THAT server's
+ * entry answers — per-server isolation for the icon, the banner and the
+ * bridge stamp. Everything else falls back to the TOP-LEVEL view, the
+ * pre-MS-6 answer: a session id that is not virtual (a local session), a
+ * serverId the dict never answered (its entry never handshook), a legacy
+ * body without a dict, or no session id at all. Tolerant the same way as
+ * the parse: hand-rolled views without `servers` never throw here.
+ */
+export function resolveServerStatusView(
+  view: RemoteStatusView | undefined | null,
+  sessionId?: string,
+): RemoteServerStatusView | undefined {
+  if (view === undefined || view === null) return undefined
+  if (sessionId !== undefined) {
+    const parts = fromVirtual(sessionId)
+    if (parts !== undefined) {
+      const server = view.servers?.[parts.serverId]
+      if (server !== undefined) return server
+    }
+  }
+  // RemoteStatusView structurally carries every RemoteServerStatusView field.
+  return view
+}
+
+/**
+ * Whether the remote session CURRENTLY ON SCREEN has its own server's bridge
+ * verdict going its way (MS-6): the verdict comes from the session's server
+ * entry ({@link resolveServerStatusView}), not the page-wide mirror of the
+ * FIRST pool entry — with several servers paired, A bridging a plugin must
+ * not un-hide it over B's sessions. Tolerant like the 2-argument core it
+ * wraps: a garbage or missing list reads as "not bridged".
+ */
+export function shouldStampBridgeForSession(
+  view: RemoteStatusView | undefined,
+  sessionId: string | undefined,
+  plugin: string,
+): boolean {
+  return shouldStampBridgeAttribute(resolveServerStatusView(view, sessionId)?.bridgedPlugins, plugin)
+}
+
 /** The plugin the bridge stamp names. */
 export const BRIDGE_STAMP_PLUGIN = 'dsh-better-sidebar'
 
@@ -149,12 +234,17 @@ export interface RemoteStatusDescription {
 export function describeRemoteStatus(
   view: RemoteStatusView | undefined | null,
   t: RemoteStatusFormatter = createZhRemoteStatusFormatter(),
+  /** MS-6: the session on screen — its virtual id picks its OWN server's
+   * entry; omitted (or unanswered by the dict) keeps the pre-MS-6 top-level
+   * read. */
+  sessionId?: string,
 ): RemoteStatusDescription {
-  if (view === undefined || view === null) return { state: 'offline', hoverText: t('remoteStatusOffline') }
-  if (view.state === 'revoked') return { state: 'revoked', hoverText: t('remoteStatusRevoked') }
-  if (view.state === 'unpaired') return { state: 'unpaired', hoverText: t('remoteStatusUnpaired') }
-  if (view.state === 'online') {
-    return view.versionMismatch
+  const status = resolveServerStatusView(view, sessionId)
+  if (status === undefined) return { state: 'offline', hoverText: t('remoteStatusOffline') }
+  if (status.state === 'revoked') return { state: 'revoked', hoverText: t('remoteStatusRevoked') }
+  if (status.state === 'unpaired') return { state: 'unpaired', hoverText: t('remoteStatusUnpaired') }
+  if (status.state === 'online') {
+    return status.versionMismatch
       ? { state: 'mismatch', hoverText: t('remoteStatusMismatch') }
       : { state: 'online', hoverText: t('remoteStatusOnline') }
   }
@@ -190,18 +280,23 @@ export function bannerText(
   sessionId: string,
   t: RemoteBannerFormatter = (key) => zh[key],
 ): string | undefined {
+  // The closed map is SESSION-keyed (virtual ids embed their server, so one
+  // global dict cannot collide) and outranks every link-level line.
   const reason = view?.closed[sessionId]
   if (reason === 'idle') return t('remoteBannerClosedIdle')
   if (reason === 'client') return t('remoteBannerClosedClient')
   // 'manual' — and any word this build does not know (a newer server's
   // vocabulary): a closure with no certain reason reads as the manual close.
   if (reason !== undefined) return t('remoteBannerClosedManual')
-  if (view !== undefined && view !== null) {
-    if (view.state === 'offline') return t('remoteBannerOffline')
+  // MS-6: the link-level line reads the SESSION'S OWN server, not the page's
+  // first-entry mirror.
+  const status = resolveServerStatusView(view, sessionId)
+  if (status !== undefined) {
+    if (status.state === 'offline') return t('remoteBannerOffline')
     // T41a-fix2: a revoked token / an unpaired client is not "reconnecting"
     // — the composer must not sit disabled on a promise no reconnect keeps.
-    if (view.state === 'revoked') return t('remoteBannerRevoked')
-    if (view.state === 'unpaired') return t('remoteBannerUnpaired')
+    if (status.state === 'revoked') return t('remoteBannerRevoked')
+    if (status.state === 'unpaired') return t('remoteBannerUnpaired')
   }
   return undefined
 }

package/src/client-data/settings-form.ts

@@ -97,10 +97,22 @@ export const CLIENT_CLAIM_ROUTE = '/_dsh/zen-remote/client/claim'
 export const CLIENT_STATUS_ROUTE = '/_dsh/zen-remote/client/status'
 /** T43: one immediate reconnect — answered 409 unless the client is offline. */
 export const CLIENT_RECONNECT_ROUTE = '/_dsh/zen-remote/client/reconnect'
+/** MS-6: POST `{ entryId }` (or `{ all: true }`) removes one / all paired
+ * servers from the pool (host half: src/client-routes.ts, mirrored here
+ * because the browser half cannot import the host module). */
+export const CLIENT_UNPAIR_ROUTE = '/_dsh/zen-remote/client/unpair'
 /** CU-4: the redacted diagnostic report (GET, both roles, machine-local only
  * — a gateway-forwarded fetch is refused server-side). */
 export const CLIENT_DEBUG_REPORT_ROUTE = '/_dsh/zen-remote/client/debug-report'
 
+/**
+ * MS-6: the paired-server pool's cap — the browser mirror of
+ * src/state-store.ts's constant of the same name (the host module cannot be
+ * imported here). The settings page and the wizard read it for the
+ * `已配对 N / 8 台` counters and the limit gating.
+ */
+export const MAX_PAIRED_SERVERS = 8
+
 /** The lightweight client-facing config route (host half, both roles): the
  * settings page's FALLBACK role probe (T17) — it registers wherever a
  * webServer exists, and since T17 its body carries the effective `role`
@@ -169,6 +181,12 @@ export interface ClientStatusBody {
   /** RD-6: the upload-redirect service probe (presence-gated — an older
    * plugin answers without it). */
   serviceProbe?: unknown
+  /** MS-6: the pool list, one row per paired server (`poolStatusBodyOf`'s
+   * `servers`), presence-gated like every diagnostic field — a pre-MS-5
+   * server (or the row-probe fallback) answers without it. */
+  servers?: unknown
+  /** MS-6: the pool cap as the body reports it (8). */
+  maxServers?: unknown
 }
 
 /** One remote-call failure line in the diagnostics lists. `time` is epoch
@@ -201,6 +219,28 @@ export interface ClientCompatView {
   recentCalls: ClientDiagFailureView[]
 }
 
+/**
+ * MS-6: ONE paired server of the pool, as the per-server list renders it —
+ * the parsed form of one `client/status` `servers[]` row (no token ever
+ * rides any status answer). `state` speaks the same view vocabulary as the
+ * top level (the wire aliases mapped); every field degrades to its default
+ * on a junk row, and a row without an `entryId` (the route's stable key)
+ * drops whole.
+ */
+export interface ClientServerView {
+  entryId: string
+  serverId: string
+  serverUrl: string
+  serverName: string
+  /** The pool's deduplicated display name (`-1` / `-2` suffixes included). */
+  displayName: string
+  state: ClientConnectionView['state']
+  nextRetryAt: number | undefined
+  lastError: string
+  compat: ClientCompatView | undefined
+  pluginBridge: PluginBridgeStatusView[]
+}
+
 /** One client connection as the block renders it. */
 export interface ClientConnectionView {
   state: 'unpaired' | 'connected' | 'revoked' | 'unreachable' | 'unexpected' | 'invalid-url' | 'incompatible'
@@ -227,6 +267,15 @@ export interface ClientConnectionView {
    * through tolerantly (undefined when the body carried none — an older
    * plugin — and the diagnostics row stays hidden). */
   uploadProbe: Readonly<Record<string, unknown>> | undefined
+  /** MS-6: every paired server of the pool, in pairing order. Empty on a
+   * legacy body (or a row-less unpaired answer) — the pre-MS-6 page shape. */
+  servers: readonly ClientServerView[]
+  /** MS-6: the pool's cap, from the body when it carried a sane number,
+   * {@link MAX_PAIRED_SERVERS} otherwise. */
+  maxServers: number
+  /** MS-6: `servers.length >= maxServers` — the red 已配满 note and the
+   * new-address submit gate both read this. */
+  limitReached: boolean
 }
 
 const CLIENT_STATES: readonly ClientConnectionView['state'][] = ['unpaired', 'connected', 'revoked', 'unreachable', 'unexpected', 'invalid-url', 'incompatible']
@@ -240,6 +289,42 @@ const WIRE_STATE_ALIASES: Readonly<Record<string, ClientConnectionView['state']>
   offline: 'unreachable',
 }
 
+/** The view `state` for one raw wire word: the vocabulary verbatim, the T55
+ * aliases mapped, anything else the conservative `unpaired`. Shared by the
+ * top level and every `servers[]` row. */
+function clientStateOf(raw: unknown): ClientConnectionView['state'] {
+  const word = typeof raw === 'string' ? raw : ''
+  return CLIENT_STATES.includes(word as ClientConnectionView['state'])
+    ? word as ClientConnectionView['state']
+    : WIRE_STATE_ALIASES[word] ?? 'unpaired'
+}
+
+/** The finite-number gate every epoch-ms wire field passes. */
+function finiteOrUndefined(value: unknown): number | undefined {
+  return typeof value === 'number' && Number.isFinite(value) ? value : undefined
+}
+
+/** MS-6: one `servers[]` row into its view. Tolerant like the top level —
+ * a junk field degrades, a row without the route's stable `entryId` key
+ * drops whole. */
+function deriveClientServerView(value: unknown): ClientServerView | undefined {
+  const record = asRecord(value)
+  const entryId = asStringSet(record.entryId)
+  if (entryId === '') return undefined
+  return {
+    entryId,
+    serverId: asStringSet(record.serverId),
+    serverUrl: asStringSet(record.serverUrl),
+    serverName: asStringSet(record.serverName),
+    displayName: asStringSet(record.displayName),
+    state: clientStateOf(record.state),
+    nextRetryAt: finiteOrUndefined(record.nextRetryAt),
+    lastError: asStringSet(record.lastError),
+    compat: deriveCompatView(record.compat),
+    pluginBridge: derivePluginBridgeStatuses(record.pluginBridge),
+  }
+}
+
 /** At most `cap` strings out of an array-shaped value; anything else is none. */
 function stringListOf(value: unknown, cap: number): string[] {
   if (!Array.isArray(value)) return []
@@ -325,18 +410,20 @@ export function deriveClientStatusView(body: ClientStatusBody): ClientConnection
   // diagnostics below it showed live relay calls. `offline` rides the same
   // mapping to the probe word for it; anything else unknown still degrades
   // to `unpaired`.
-  const rawState = typeof safe.state === 'string' ? safe.state : ''
-  const state = CLIENT_STATES.includes(rawState as ClientConnectionView['state'])
-    ? rawState as ClientConnectionView['state']
-    : WIRE_STATE_ALIASES[rawState] ?? 'unpaired'
-  const nextRetryAt = typeof safe.nextRetryAt === 'number' && Number.isFinite(safe.nextRetryAt)
-    ? safe.nextRetryAt
-    : undefined
+  const state = clientStateOf(safe.state)
+  // MS-6: the pool list rides as `servers[]` (one row per paired entry); a
+  // legacy single-server body answers the empty list and the pre-MS-6 page
+  // shape otherwise.
+  const servers = (Array.isArray(safe.servers) ? safe.servers : [])
+    .map(deriveClientServerView)
+    .filter((row): row is ClientServerView => row !== undefined)
+  const maxServersRaw = finiteOrUndefined(safe.maxServers)
+  const maxServers = maxServersRaw !== undefined && maxServersRaw >= 1 ? maxServersRaw : MAX_PAIRED_SERVERS
   return {
     state,
     serverUrl: typeof safe.serverUrl === 'string' ? safe.serverUrl : '',
     serverName: typeof safe.serverName === 'string' ? safe.serverName : '',
-    nextRetryAt,
+    nextRetryAt: finiteOrUndefined(safe.nextRetryAt),
     lastError: typeof safe.lastError === 'string' ? safe.lastError : '',
     deviceName: typeof safe.deviceName === 'string' ? safe.deviceName : '',
     intercept: deriveInterceptView(safe.intercept),
@@ -346,6 +433,9 @@ export function deriveClientStatusView(body: ClientStatusBody): ClientConnection
     uploadProbe: safe.serviceProbe !== null && typeof safe.serviceProbe === 'object'
       ? Object.freeze({ ...(safe.serviceProbe as Record<string, unknown>) })
       : undefined,
+    servers,
+    maxServers,
+    limitReached: servers.length >= maxServers,
   }
 }
 
@@ -399,6 +489,11 @@ export interface ClaimRouteBody {
   token?: unknown
   deviceId?: unknown
   deviceName?: unknown
+  /** MS-8: the pool entry the pairing landed in (pool-mode answers carry it;
+   * the legacy single-server answer carries `token` instead and no
+   * `entryId` — the token never reaches the browser in pool mode). The
+   * wizard records it as the step-3 selected server. */
+  entryId?: unknown
   /** The normalized address the backend validated — what the form writes. */
   serverUrl?: unknown
   code?: string
@@ -421,6 +516,61 @@ export function normalizePairingCode(input: string): string {
     .slice(0, PAIRING_CODE_LENGTH)
 }
 
+/**
+ * The address comparison the overwrite judgment makes (MS-6): trim padding,
+ * drop trailing slashes. Light on purpose — the backend re-normalizes the
+ * address authoritatively on claim; here it only decides whether the typed
+ * address NAMES an already-paired server, and `http://x.local:3088/` must
+ * count as that server while `http://x.local:3089` must not.
+ */
+function normalizedPairAddress(url: string): string {
+  return url.trim().replace(/\/+$/u, '')
+}
+
+/** What {@link canSubmitClientPairing} decides. */
+export interface CanSubmitClientPairingVerdict {
+  /** The 配对 button may act: everything locally checkable passes. */
+  allowed: boolean
+  /** The typed address names an already-paired server — the claim will
+   * UPDATE that entry's token in place, not add a ninth one. */
+  isOverwrite: boolean
+  /** A NEW address while the pool is full (`servers.length >= maxServers`):
+   * the claim must not even leave the page (the route would answer
+   * `limit-reached`). An overwrite never sets this. */
+  blockedByLimit: boolean
+}
+
+/**
+ * The 配对 button's whole gate, as one pure truth table (MS-6): the claim
+ * needs an address and a COMPLETE 8-character pairing code (the input box
+ * normalizes as the user types; this judge is the same bar the route's code
+ * grammar enforces), a quiet page (`busy`), and a valid device-name draft
+ * (`deviceNameInvalid`, T60 — a red-boxed name would silently pair under the
+ * fallback copy). The pool cap blocks only NEW addresses: a full pool still
+ * accepts re-pairing an existing one in place, which is how a user whose
+ * token was revoked at 8/8 gets back in.
+ */
+export function canSubmitClientPairing(input: {
+  pairUrl: string
+  pairCode: string
+  servers: readonly ClientServerView[]
+  maxServers?: number
+  busy?: boolean
+  deviceNameInvalid?: boolean
+}): CanSubmitClientPairingVerdict {
+  const maxServers = input.maxServers ?? MAX_PAIRED_SERVERS
+  const address = normalizedPairAddress(input.pairUrl)
+  const isOverwrite = address !== ''
+    && input.servers.some((server) => normalizedPairAddress(server.serverUrl) === address)
+  const blockedByLimit = !isOverwrite && input.servers.length >= maxServers
+  const allowed = address !== ''
+    && normalizePairingCode(input.pairCode).length === PAIRING_CODE_LENGTH
+    && !blockedByLimit
+    && input.busy !== true
+    && input.deviceNameInvalid !== true
+  return { allowed, isOverwrite, blockedByLimit }
+}
+
 /**
  * Whether the settings page may follow the SERVER's record of this device's
  * name into the row (T59): the body carried a name, it differs from the row
@@ -803,6 +953,8 @@ export type SettingsFieldName =
   | 'pushSummary'
   | 'pushTurnEnd'
   | 'pushTool'
+  | 'pushEnabled'
+  | 'pushSessionName'
   | 'pushDebounceMs'
   | 'lang'
   | 'serverName'
@@ -824,6 +976,8 @@ export const SETTINGS_FIELDS: readonly SettingsFieldSpec[] = [
   textField('trustedProxies'),
   intField('rateLimit', 1, Number.MAX_SAFE_INTEGER),
   textField('vapidSubject'),
+  boolField('pushEnabled'),
+  boolField('pushSessionName'),
   boolField('pushSummary'),
   boolField('pushTurnEnd'),
   boolField('pushTool'),
@@ -1042,6 +1196,8 @@ export interface ZenRemoteFormState extends SettingsFormShellState {
   pushSummary: SettingsFieldState
   pushTurnEnd: SettingsFieldState
   pushTool: SettingsFieldState
+  pushEnabled: SettingsFieldState
+  pushSessionName: SettingsFieldState
   pushDebounceMs: SettingsFieldState
   lang: SettingsFieldState
   serverName: SettingsFieldState