docs(web-ui/dashboard): document K3PT ST4T3 stale perms + active model badge

Two undocumented features from recent commits:

feat(core) 6ab0757cc6: K3PT ST4T3 now has two
sub-sections — tombstones (existing) and a new 'stale permission entries'
list showing agents with capability/tool-group JSON entries but no live
container. Lazy-loaded, auto-refreshes on capabilities_changed +
tool_groups_changed; each entry has a 'clear perms' button.

feat(dash) 4375ab6246: container rows show an
active model badge (blue) when the container is running and the harness has
persisted a model name in harness/hyperhive-model. Stale values suppressed
for stopped containers.

docs/web-ui/dashboard.md

@@ -193,10 +193,20 @@ so the queue's per-row re-render (rows rebuild as the `step` advances)
 never tears down the open stream; it hides when nothing is building and
 each row keeps its `logs →` link out to the full L0GS history.
 
-**K3PT ST4T3** — destroyed-but-state-kept tombstones (size +
-age + claude-creds badge). Two actions: `⊕ R3V1V3` (queues a
-Spawn approval; existing state is reused), `PURG3` (wipes
-state + applied dirs; `POST /api/purge-tombstone/{name}`).
+**K3PT ST4T3** — two sub-sections on one pane:
+
+*Tombstones*: destroyed-but-state-kept agents (size + age +
+claude-creds badge). Two actions: `⊕ R3V1V3` (queues a Spawn
+approval; existing state is reused), `PURG3` (wipes state + applied
+dirs; `POST /api/purge-tombstone/{name}`).
+
+*Stale permission entries*: agents with explicit capability or
+tool-group JSON entries but no live container — typically renamed or
+deleted agents whose entries persisted in `capabilities.json` /
+`tool-groups.json`. Lazy-loaded on first K3PT ST4T3 tab activation;
+auto-refreshes on `capabilities_changed` + `tool_groups_changed` SSE
+events. Each ghost agent gets a `✕ clear perms` button
+(`DELETE /api/permissions/{name}`).
 
 **C0NT41N3R L04D** — live CPU + memory per agent container, read
 straight from cgroup v2 on the host (`cpu.stat`, `memory.current`,
@@ -781,6 +791,11 @@ fetch entirely.
   `opRunning` flag (driving the `pending-running` row class +
   spinner) is true when (1) is set OR (2) is in `running` state;
   queued entries leave `opRunning` false.
+  An **active model badge** (`model · <name>`, blue) appears when the
+  container is running and the harness has persisted a model name
+  (`harness/hyperhive-model`). Read by hive-c0re's `ContainerView`
+  (`read_active_model`); absent until the agent has completed at least
+  one turn and stale values are suppressed for stopped containers.
   A `ctx · Nk` chip showing the agent's last-turn context size,
   populated from `DashboardState.ctx_tokens` (absent until the
   agent has completed at least one turn). The chip colour (green /
@@ -1309,6 +1324,19 @@ payload):
   tool-group assignments. Emitted from the rebuild-queue worker after
   a `PermChange` / ToolGroups entry commits the JSON file. Same
   shape as `GET /api/tool-groups`; P3RM1SS10NS tab subscribes.
+- `tombstones_changed` (seq, tombstones: `Vec<TombstoneView>`) —
+  full snapshot of destroyed-but-state-kept agents. Emitted on
+  destroy, purge, and revive. C0R3 K3PT ST4T3 tab subscribes.
+- `meta_inputs_changed` (seq, inputs: `Vec<MetaInput>`) — full
+  snapshot of `meta/flake.lock` inputs. BU1LDS M3T4 1NPUTS tab
+  subscribes; same shape as `GET /api/meta-inputs`.
+- `meta_update_running` (running: bool) — emitted when a
+  `nix flake update` ripple starts or completes. BU1LDS M3T4 1NPUTS
+  tab uses this to show/hide the "⏳ meta-update running" banner.
+- `audit_entry_added` (flattened `AuditEntry` fields: id, ts_unix,
+  agent, action, target, outcome, detail) — a single new audit-log
+  row. L0GS AUDIT sub-tab live-prepends the row and bumps the
+  "latest N of M" count, de-duped by id against the cold fetch.
 
 `/api/state` is **only fetched on cold-load and on the few
 forms that mutate non-event-derived state** (PURG3 +