Merge forge/main into atlas/5034-s4-remove-hive-model

docs/web-ui/agent.md

@@ -229,16 +229,17 @@ Slash commands today:
 
 - `/help` — list commands locally.
 - `/clear` — wipe the local terminal view (server history kept).
-- `/cancel` — `POST /api/cancel` → host shellouts `pkill -INT
-  claude`, emits a Note. On an ACP agent it sends the agent
-  `session/cancel` instead, and kills it if the turn hasn't ended 10s
-  later. Also surfaces as a `■ cancel turn` button in the state row
-  while state=thinking.
+- `/cancel` — `POST /api/cancel` → SIGINT to the turn's claude and every
+  command it started (its process group), emits a Note. On an ACP agent
+  it sends the agent `session/cancel` instead, and SIGINT if the turn
+  hasn't ended 10s later. Also surfaces as a `■ cancel turn` button in
+  the state row while state=thinking.
 - `/compact` — `POST /api/compact` → sets the deferred
   `Bus::request_compact()` flag and returns immediately. The harness
   runs the `/compact` at the next turn boundary (end of the in-flight
   turn, or `turn::run_pending_compact` when idle); output streams into
-  the live panel. Works mid-turn, not only when idle.
+  the live panel. Works mid-turn, not only when idle. Either way the live
+  panel ends with a `/compact done` or `/compact failed: …` note.
 - `/new-session` — `POST /api/new-session` (confirms first).
   Arms a one-shot on the Bus; next turn runs without
   `--continue`, dropping the resume session entirely.
@@ -266,8 +267,8 @@ shaped).
 - `POST /login/{start,code,cancel}` — claude OAuth login flow.
   Start/cancel emit `LiveEvent::StatusChanged` to flip the
   badge to/from `needs_login_in_progress`.
-- `POST /api/cancel` — SIGINT the in-flight claude turn. Emits a
-  `LiveEvent::Note`.
+- `POST /api/cancel` — SIGINT the in-flight claude turn and the
+  commands it started. Emits a `LiveEvent::Note`.
 - `POST /api/compact` — run `/compact` on the persistent session
   (same MCP config + system prompt + allowed tools as a normal
   turn — only the stdin payload differs). Flips state to
@@ -363,7 +364,8 @@ shaped).
   `{"<name>": "<upstream_url>"}`). Each entry mounts a transparent
   reverse-proxy at `/extra/<name>/` that forwards every request (method,
   headers, body) to the configured upstream, strips hop-by-hop headers
-  on both sides, and buffers the full response body (MVP — SSE
+  on both sides (repeated response headers such as two `Set-Cookie` lines
+  are all forwarded), and buffers the full response body (MVP — SSE
   connections will appear as one large response rather than streaming).
   The `/extra/` namespace ensures user-declared proxies can never
   conflict with native agent endpoints. Upstream values are either an