docs(web-ui/dashboard): document K3PT ST4T3 stale perms + active model badge

Two undocumented features from recent commits:

feat(core) 6ab0757cc6: K3PT ST4T3 now has two
sub-sections — tombstones (existing) and a new 'stale permission entries'
list showing agents with capability/tool-group JSON entries but no live
container. Lazy-loaded, auto-refreshes on capabilities_changed +
tool_groups_changed; each entry has a 'clear perms' button.

feat(dash) 4375ab6246: container rows show an
active model badge (blue) when the container is running and the harness has
persisted a model name in harness/hyperhive-model. Stale values suppressed
for stopped containers.

docs/web-ui/agent.md

@@ -94,6 +94,13 @@ through. Three flex columns:
     `model_changed` events so it stays accurate when the model is
     changed from another session. Clicking the already-active model
     closes the menu without an extra POST.
+    A second separator + **effort quick-picker** section labelled
+    `effort` appears when the backend declares effort levels in
+    `state.available_efforts`. One button per level (e.g. `medium`,
+    `high`, `xhigh`); clicking POSTs `/api/effort` (same endpoint as
+    the `/effort <level>` slash command). The active level's button is
+    highlighted; `renderEffortChip` keeps the picker in sync with
+    `StateSnapshot.effort` from the cold-load snapshot.
     The popover's display rules are scoped to `:not([hidden])` so the
     `[hidden]` HTML attribute's UA `display: none` isn't overridden by
     the author CSS's `display: flex` — the popover stays hidden until
@@ -152,10 +159,14 @@ messages for this agent are acked, the harness won't receive
 wake-prompts for them. A `{ marked: N }` pill surfaces the count.
 After the drain the inbox list empties on reload (the filter is
 `acked_at IS NULL`, so drained messages disappear). Loose-ends flyout: questions,
-approvals, and reminders pending against this agent (`GET /api/loose-ends`);
+approvals, reminders, pending inbox messages, and unread matrix
+notifications pending against this agent (`GET /api/loose-ends`);
 question rows carry an inline answer form that POSTs cross-origin to
 the core dashboard's `POST /api/answer-question/{id}` so the operator answers
-*as operator* (see `docs/boundary.md`). Tasks flyout: in-flight bash
+*as operator* (see `docs/boundary.md`). Pending inbox messages (`✉ inbox
+— N pending message(s)`) and unread matrix rooms appear informational
+only (not cancellable from the flyout — drain with `recv` / `mark_read`
+in-turn). Tasks flyout: in-flight bash
 tasks (`GET /api/bash-tasks`); each row shows status (`▶ running` /
 `◷ queued`), the task id, elapsed time, and a truncated one-line
 command preview. Read-only — kill/inspect lives in the harness, not
@@ -251,6 +262,10 @@ Slash commands today:
   Takes effect on the next turn; persisted to
   `/state/hyperhive-model` so the override survives harness
   restart / rebuild.
+- `/effort <level>` — `POST /api/effort` setting the claude effort
+  level (`medium` / `high` / `xhigh`). Takes effect on the next
+  turn. The overflow menu surfaces an effort picker that calls the
+  same endpoint; both stay in sync via `StateSnapshot.effort`.
 - `/new-session` — `POST /api/new-session` (confirms first).
   Arms a one-shot on the Bus; next turn runs without
   `--continue`, dropping the resume session entirely.
@@ -320,8 +335,9 @@ shaped).
 - `GET /api/state` — cold-load snapshot (`StateSnapshot`) consumed by
   `app.js` on page load and while `status === 'needs_login_in_progress'`.
   Includes `turn_state`, `context_window_tokens`, `qualified_label`,
-  `available_models`, `available_efforts`, `links`, and other fields described inline
-  throughout this document. All subsequent state updates arrive via SSE.
+  `available_models`, `effort`, `available_efforts`, `links`, and
+  other fields described inline throughout this document. All
+  subsequent state updates arrive via SSE.
 - `GET /api/dashboard-state` — lean snapshot of agent-owned fields
   fetched once per running agent by the dashboard's container row to
   get fresh values without relying on hive-c0re's periodic file-reads.

docs/web-ui/dashboard.md

@@ -193,10 +193,20 @@ so the queue's per-row re-render (rows rebuild as the `step` advances)
 never tears down the open stream; it hides when nothing is building and
 each row keeps its `logs →` link out to the full L0GS history.
 
-**K3PT ST4T3** — destroyed-but-state-kept tombstones (size +
-age + claude-creds badge). Two actions: `⊕ R3V1V3` (queues a
-Spawn approval; existing state is reused), `PURG3` (wipes
-state + applied dirs; `POST /api/purge-tombstone/{name}`).
+**K3PT ST4T3** — two sub-sections on one pane:
+
+*Tombstones*: destroyed-but-state-kept agents (size + age +
+claude-creds badge). Two actions: `⊕ R3V1V3` (queues a Spawn
+approval; existing state is reused), `PURG3` (wipes state + applied
+dirs; `POST /api/purge-tombstone/{name}`).
+
+*Stale permission entries*: agents with explicit capability or
+tool-group JSON entries but no live container — typically renamed or
+deleted agents whose entries persisted in `capabilities.json` /
+`tool-groups.json`. Lazy-loaded on first K3PT ST4T3 tab activation;
+auto-refreshes on `capabilities_changed` + `tool_groups_changed` SSE
+events. Each ghost agent gets a `✕ clear perms` button
+(`DELETE /api/permissions/{name}`).
 
 **C0NT41N3R L04D** — live CPU + memory per agent container, read
 straight from cgroup v2 on the host (`cpu.stat`, `memory.current`,
@@ -781,6 +791,11 @@ fetch entirely.
   `opRunning` flag (driving the `pending-running` row class +
   spinner) is true when (1) is set OR (2) is in `running` state;
   queued entries leave `opRunning` false.
+  An **active model badge** (`model · <name>`, blue) appears when the
+  container is running and the harness has persisted a model name
+  (`harness/hyperhive-model`). Read by hive-c0re's `ContainerView`
+  (`read_active_model`); absent until the agent has completed at least
+  one turn and stale values are suppressed for stopped containers.
   A `ctx · Nk` chip showing the agent's last-turn context size,
   populated from `DashboardState.ctx_tokens` (absent until the
   agent has completed at least one turn). The chip colour (green /
@@ -1309,6 +1324,19 @@ payload):
   tool-group assignments. Emitted from the rebuild-queue worker after
   a `PermChange` / ToolGroups entry commits the JSON file. Same
   shape as `GET /api/tool-groups`; P3RM1SS10NS tab subscribes.
+- `tombstones_changed` (seq, tombstones: `Vec<TombstoneView>`) —
+  full snapshot of destroyed-but-state-kept agents. Emitted on
+  destroy, purge, and revive. C0R3 K3PT ST4T3 tab subscribes.
+- `meta_inputs_changed` (seq, inputs: `Vec<MetaInput>`) — full
+  snapshot of `meta/flake.lock` inputs. BU1LDS M3T4 1NPUTS tab
+  subscribes; same shape as `GET /api/meta-inputs`.
+- `meta_update_running` (running: bool) — emitted when a
+  `nix flake update` ripple starts or completes. BU1LDS M3T4 1NPUTS
+  tab uses this to show/hide the "⏳ meta-update running" banner.
+- `audit_entry_added` (flattened `AuditEntry` fields: id, ts_unix,
+  agent, action, target, outcome, detail) — a single new audit-log
+  row. L0GS AUDIT sub-tab live-prepends the row and bumps the
+  "latest N of M" count, de-duped by id against the cold fetch.
 
 `/api/state` is **only fetched on cold-load and on the few
 forms that mutate non-event-derived state** (PURG3 +