Hosted enrollment from the desktop, and paired phones under Local networks and Anywhere

[nedtwigg]

Fifth and last of the Hosted persistent stack, on #870. It is the desktop half; with it, docs/specs/remote-network.md has no ## Future Hosted persistent scope left.

Enroll a Hosted build (Settings → Network → Phones):

• "Enroll with hosted.dormouse.sh" replaces the disabled button. The service begins the device-code enrollment and polls it itself; the device code never enters a webview.
• The panel shows the code, a link to approve it, and the time left. The link is composed by the Burrow at the fixed https://hosted.dormouse.sh (a dev Hosted build follows the Relay's checked link).
• Once enrolled, it shows the self-host enrolled view plus "Manage computers".
• Edge cases handled:
  • redemption completes before the panel leaves its waiting state;
  • a late redemption (after Cancel) is adopted;
  • a lost poll answer reads as "Remove Burrow X from your account", using a marker the Relay keeps until expiry;
  • a second VS Code window joins the waiting code rather than replacing it.

Paired phones:

• Network levels: a Hosted build runs its persistent Burrow under Local networks and Anywhere (runsBurrow is every level but Nothing), and restarts it on any path change.
• Local networks is direct-only:
  • the encrypted connection outcome says so, and Pocket waits for the direct switch before sending protocol-v1;
  • the Burrow ends the session unread on an application message over the Relay, a given-up attempt, or a deadline of the phone's setup plus handoff (30 s).
  • One mechanism in EstablishedE2eSession now serves both this rule and the one-time session's.
• Anywhere may fall back to relaying through Hosted.
• Pocket served by Hosted gathers through Cloudflare STUN. It learns its deployment from a deployment.json that Hosted stages; anything else reads as self-host.
• Settings → Network lists the paired-phone connections. Push follows from the running Burrow.

Changed shared bound: the direct-only deadline went from 15 s to 30 s, so ONE_TIME_EXPIRY_GRACE_MS went from 30 s to 45 s. A room must outlive a session confirmed in a link's last second. This affects the one-time room on Hosted too, so deploy the relay Worker with or before desktop builds carrying this.

Test plan

• Root pnpm test green; Hosted Docker suite 154/154, including an end-to-end device-code enroll → pair → connect through the account's Durable Object, ended unread on a relayed application message; Storybook play for the changed stories.
• Manual: see the stack's manual test plan (top comment on Split Hosted into account, relay, and voice origins #867).

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	7ad70b3
Status:	✅  Deploy successful!
Preview URL:	https://8a68066f.mouseterm.pages.dev
Branch Preview URL:	https://remote-network-hosted-client.mouseterm.pages.dev

View logs

[dormouse-bot]

Three enrollment edge cases are inline. Some text outside the diff still describes Hosted's STUN as one-time-only, but after this PR, Pocket served by Hosted always gathers through Cloudflare STUN, Local networks included (deploymentDirectPeer → hostedDirectPeer):

• docs/specs/security.md, the "Traffic analysis" bullet: "Cloudflare's STUN server sees the one-time phone's public address, and under Anywhere this computer's". That page is published at /security, so it now understates whose addresses Cloudflare sees. A paired phone in Hosted-served Pocket belongs there too.
• lib/src/remote/client/browser-direct-peer.ts: the doc comments on hostedDirectPeer ("The one-time page's, which Hosted serves.") and selfHostDirectPeer ("Pocket's, which a self-host Relay serves.") no longer hold.
• docs/specs/remote-api.md, the ## Future sentence "A paired phone's network levels follow the remote-network scope". This PR builds those levels, so the pointer reads as if they were still unbuilt.

I can push these doc fixes as a commit if you'd like.

[nedtwigg]

@dormouse-bot Please review and approve the current head f12c502 if the findings are resolved. The cancelled-begin and saved-startup-failure fixes are pushed, the lost-body recovery fix is present, and all three stale documentation points from your review summary are corrected. Validation: 172 enrollment/service tests, lib typecheck, and spec lint/self-tests passed. The maintainer explicitly says to IGNORE ARGOS; all other CI must pass. Please report any remaining issue and do not merge.

[dormouse-bot]

One finding is inline, in Pocket's removed-marking.

[dormouse-bot]

Not approving f12c502 yet: the review of this head (posted a minute after your comment) left one open finding. In loadBurrows in lib/src/remote/pocket-app/App.tsx, client.accountId is read after the await. If a sign-in to another account finishes while the list read is in flight, that account's records are compared against the previous account's list, and every one is marked removed. The inline suggestion moves the read above the Promise.all.

The three earlier findings are fixed at this head and their threads are resolved: cancel and disposal clear #enrollBegin, a body lost after a 2xx retries, and removal advice applies only when the save didn't land. The three doc points are fixed too. CI is still running (Build & Test, Webview Boot Smoketest). Once the Pocket fix is pushed, the review of the new head will approve it if nothing else turns up.

[nedtwigg]

@dormouse-bot Please review and approve latest head 837783d if clear. The account-switch removal race from your latest review is fixed with a regression; previous findings remain resolved. PR 870's latest fixes are integrated. Validation: 77 Pocket scan/view tests, 172 enrollment/service tests, 9 shared web-push tests, lib typecheck, spec lint/self-tests pass. Maintainer says IGNORE ARGOS; all other CI must pass. Please report any remaining issue and do not merge.

[dormouse-bot]

Build & Test is red at this head, and at f12c502 before it, on the new starts a fresh begin after %s while the old request is pending test. Each run failed a different variant: cancel at f12c502 (one of two begin requests had arrived), Nothing at this head (none had). That points to timing, not the fix. Approval withdrawn until it's green.

[dormouse-bot]

drain gives up silently after 500 setImmediate turns. Before its fetch, each begin awaits #networkPolicy() and mintNoiseStatic(), and WebCrypto key generation answers from the threadpool, not within a set number of turns. On a loaded runner the 500 turns run out first, so expect(settle).toHaveLength(2) sees 0 or 1. The begins left pending then fail after the test ends, which is the unhandled no result for beginHostedEnrollment in the same log. Only setTimeout and Date are faked here, so a wall-clock bound on performance.now() still works:

Suggested change

	async function drain(until: () => boolean): Promise<void> {
	for (let turn = 0; turn < 500 && !until(); turn += 1) {
	await new Promise((resolve) => setImmediate(resolve));
	}
	}
	async function drain(until: () => boolean): Promise<void> {
	const deadline = performance.now() + 5_000;
	while (!until() && performance.now() < deadline) {
	await new Promise((resolve) => setImmediate(resolve));
	}
	}

CI failed — Build & Test red on a timing-dependent enrollment test.

[nedtwigg]

@dormouse-bot Please review and approve latest head 7ad70b3 if clear. CI exposed a timing flaw in my new cancelled-begin regression: bounded event-loop spins could finish before real WebCrypto reached fetch under suite load. The test now awaits explicit first/second fetch-arrival promises, synchronizes the pending join through the cached-policy read, and fails any unexpected third begin immediately. Production code is unchanged. The full lib pnpm test passed: 286 files, 5190 tests; typecheck passed, 2 files/5 tests skipped. Prior review fixes remain present. Maintainer says IGNORE ARGOS; all other CI must pass. Please report any remaining issue and do not merge.

[dormouse-bot]

The 7ad70b3 diff is test-only. It replaces the event-loop spins with fetch-arrival promises and a third-begin tripwire, which removes the timing dependence behind the red runs on the cancel and Nothing variants. I see no new issues in it. The review run for this head is still going, and it posts the verdict: it approves once Build & Test and the other non-Argos checks are green. I'm leaving the approval to it so the PR doesn't get two verdicts on one head.