diff --git a/.gitignore b/.gitignore
index d3f13a7c..a4afea36 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,5 @@
-.directory
-result
-secrets
+/target
+/result
+/result-*
+/.tmp
+/.claude/settings.local.json
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 00000000..97526282
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,243 @@
+# hyperhive — claude entry point
+
+Hey claude. This is your starting page. The detailed docs live in
+[`docs/`](docs/) and are written for humans + you both — read them
+when you need depth on a subsystem. This file is the index.
+
+- High-level project intro: **[README.md](README.md)**.
+- Open work + backlog: the **[forge issue
+  tracker](http://localhost:3000/hyperhive/hyperhive/issues)**.
+- Operator/agent trust-boundary design:
+  **[docs/boundary.md](docs/boundary.md)** (`area:ops` issues
+  for the deployment/gateway/privsep work).
+- Credential isolation + sandbox threat model:
+  **[docs/security.md](docs/security.md)**.
+
+## File map
+
+```
+hive-c0re/         host daemon + CLI (one binary, subcommand-dispatched)
+  src/main.rs           clap setup; serve / spawn / kill / rebuild / list /
+                         pending / approve / deny / destroy [--purge] /
+                         request-spawn / set-parent (--parent / --root);
+                         periodic vacuum tasks
+  src/server.rs         host admin socket (HostRequest → dispatch)
+  src/client.rs         admin-socket client
+  src/manager_server.rs manager-privileged socket (ManagerRequest)
+  src/agent_server.rs   per-sub-agent socket listener (long-poll Recv)
+  src/broker.rs         sqlite Message store + intra-process broadcast
+                         channel (`MessageEvent`) for `recv_blocking_batch` +
+                         the dashboard forwarder; hourly vacuum of acked>30d
+  src/dashboard_events.rs unified wire-facing event channel feeding
+                         `/dashboard/stream`. Carries broker `Sent` /
+                         `Delivered` (mirrored by the forwarder task
+                         in main.rs) + mutation events
+                         (`ApprovalAdded` / `ApprovalResolved`,
+                         `QuestionAdded` / `QuestionResolved`,
+                         `TransientSet` / `TransientCleared`,
+                         `RebuildQueueChanged`). Each frame carries a
+                         monotonic per-process `seq` clients use to
+                         dedupe against snapshot reads.
+  src/approvals.rs      sqlite Approval queue + kinds
+  src/operator_questions.rs  sqlite question queue backing `ask` /
+                         `answer` (both operator + agent-to-agent)
+  src/questions.rs      shared dispatch for `Ask` / `Answer` —
+                         used by both agent + manager surfaces
+  src/reminder_scheduler.rs  5s poll loop: drains due reminders,
+                         resolves file_path container→host, persists
+                         payload + delivers pointer string
+  src/scheduled_prompts.rs  sqlite layer for scheduled prompts —
+                         schema, CRUD helpers (`cancel_all`,
+                         `cancel_targets`, `reap_cancelled`), catch-up
+                         clamp on resume (#444)
+  src/scheduled_prompts_worker.rs  5s poll loop: fires due rows,
+                         fans out one Message per active target,
+                         re-arms recurring rows, deletes fired one-shots
+  src/events_vacuum.rs  host-side hourly sweep of every agent's
+                         /state/hyperhive-events.sqlite
+  src/crash_watch.rs    poll every 10s; fire HelperEvent::ContainerCrash
+                         when a previously-running container disappears
+                         without an operator-initiated transient (or a
+                         RECENT_TRANSIENT_GRACE tombstone within the
+                         last 30s, closes #425)
+  src/container_view.rs ContainerView struct + build_all helper;
+                         shared between dashboard.rs (cold-load via
+                         /api/state) and coordinator.rs's
+                         rescan_containers_and_emit
+  src/coordinator.rs    shared state (broker/approvals/operator_questions/
+                         transient/sockets) + tombstone enumeration +
+                         kick_agent + notify_agent (helper-event push) +
+                         last_containers cache + rescan_and_emit diff helper
+  src/loose_ends.rs     loose-ends aggregator (pending approvals +
+                         unanswered questions + pending reminders) —
+                         for_agent (filtered) and hive_wide (manager
+                         surface). Backs AgentRequest::GetLooseEnds +
+                         ManagerRequest::GetLooseEnds (the
+                         get_loose_ends MCP tool).
+  src/rebuild_queue.rs  global serialised queue for long-running ops
+                         (rebuild / meta_update / spawn / destroy).
+                         Single background worker drains FIFO; dedup
+                         collapses re-enqueued still-queued entries.
+                         `QueueEntry` carries id, agent, kind, state,
+                         source, parent_id (cascade grouping), timing,
+                         reason, error, step (current phase label while
+                         Running; cleared on finish). Emits
+                         `RebuildQueueChanged` snapshots on every
+                         mutation.
+  src/actions.rs        approve/deny/destroy (transient-aware)
+  src/auto_update.rs    startup rebuild scan + ensure_manager +
+                         meta::lock_update_hyperhive bump
+  src/lifecycle.rs      `nixos-container` shellouts; per-agent applied
+                         + proposed git repo seeding; tag plumbing
+  src/meta.rs           single hive-c0re-owned flake at /var/lib/
+                         hyperhive/meta/ — sync_agents, two-phase
+                         prepare/finalize/abort, lock_update_*
+  src/migrate.rs        startup auto-migration from pre-meta layout
+                         (idempotent, marker-guarded phase 4)
+  src/topology.rs       agent parent/child storage at
+                         /var/lib/hyperhive/meta/topology.json — sole
+                         source of truth for who's the parent of whom
+                         (single source the dashboard, render_flake,
+                         and the eventual cap-enforcement plumbing all
+                         read). Reconciled by `meta::sync_agents`;
+                         operator/manager edits land via the
+                         eventual write API (#361 follow-ups).
+  src/forge.rs          optional Forgejo wiring: per-agent users +
+                         tokens, the `agent-configs` org (`push_config`),
+                         and meta read access; mirrors each applied repo
+                         into `agent-configs/<n>` (core-only); agents are
+                         read-only collaborators on `core/meta`
+  src/dashboard.rs      axum HTTP: /api/state JSON + actions
+                         + journald viewer + bind-with-retry (SO_REUSEADDR)
+                         + deployed_sha chip per container +
+                         /dashboard/{stream,history} subscribing to the
+                         unified DashboardEvent channel. Static assets
+                         (HTML/CSS/JS/favicon) served by
+                         tower_http::ServeDir from $HIVE_STATIC_DIR
+                         (= `${frontend}/dashboard` per the c0re module).
+
+frontend/             npm workspaces (esbuild → static dist). Built
+                       hermetically by `nix/frontend.nix`
+                       (`packages.${system}.frontend`).
+  packages/shared/      @hive/shared: terminal pane + Catppuccin palette
+                         + base typography (was hive-fr0nt). ES module
+                         exporting { create, linkify }; pure JS, no IIFE
+                         globals; consumed by dashboard + agent.
+  packages/dashboard/   @hive/dashboard SPA: src/{index.html, tabs.js,
+                         flow.html, flow.js, common.js, dashboard.css} +
+                         build.mjs → dist/{index.html, flow.html,
+                         static/{tabs.js, flow.js, dashboard.css,
+                         stream-worker.js}}.
+  packages/agent/       @hive/agent default per-container UI: src/
+                         {index, stats, screen}.html + {app, stats}.js
+                         + agent.css → dist/{*.html, static/*}.
+
+hive-ag3nt/        in-container harness crate; produces TWO binaries
+  src/lib.rs            re-exports + DEFAULT_SOCKET, DEFAULT_WEB_PORT
+  src/client.rs         generic JSON-line request/response over unix socket
+  src/web_ui.rs         per-container axum HTTP page (incl /api/cancel,
+                         /api/compact, /api/model, /events/history,
+                         /screen, /screen/ws)
+  src/turn_stats.rs     per-turn analytics sink (one sqlite row per
+                         turn at /state/hyperhive-turn-stats.sqlite);
+                         schema + best-effort writer
+  src/stats.rs          read-side aggregations over turn-stats.sqlite
+                         backing the /stats page (bucketed Snapshot:
+                         turns / duration / tokens / model mix)
+  src/events.rs         LiveEvent + broadcast Bus + sqlite-backed history
+                         (/state/hyperhive-events.sqlite) + TurnState +
+                         model selection (persisted at /state/hyperhive-model)
+  src/turn.rs           claude --print + stream-json pump; --compact retry;
+                         proactive compaction + auto session-reset
+  src/mcp.rs            embedded MCP server (rmcp): AgentServer + ManagerServer
+  src/login.rs          probe /root/.claude/ for a valid session
+  src/login_session.rs  drives `claude auth login` over stdio pipes
+  src/bin/hive-ag3nt.rs sub-agent main (Serve + Mcp subcommands)
+  src/bin/hive-m1nd.rs  manager main (Serve + Mcp subcommands)
+                         Static UI assets served by ServeDir from
+                         $HIVE_STATIC_DIR (= hyperhive.frontend
+                         .mergedDist — default agent dist + per-agent
+                         extraFiles, set per the harness-base module).
+  prompts/              static role/tools/settings for claude (include_str!):
+                          agent.md  — sub-agent system prompt
+                          manager.md — manager system prompt
+                          claude-settings.json — --settings JSON
+
+hive-forge/        Forgejo CLI wrapper (`hive-forge` binary)
+  src/main.rs           clap dispatch over the verbs/
+  src/client.rs         blocking reqwest client (Forgejo REST API)
+  src/body.rs           body input resolution (--body / --body-file / piped stdin)
+  src/verbs/<verb>.rs   one module per verb (view, issue, pr, comment,
+                         comments, comment-show, comment-edit, issue-create,
+                         issue-edit, pr-create, pr-reviews, assign,
+                         close, labels, milestone, branches,
+                         tree-sha, diff, subscription, attach-issue,
+                         attach-comment, lint). Replaces the 600-line
+                         hive-forge-tools.nix bash script (closes #280).
+
+hive-sh4re/        wire types (HostRequest/Response, AgentRequest/Response,
+                   ManagerRequest/Response, Message, Approval, HelperEvent)
+
+nix/
+  modules/hive-c0re.nix         systemd service + firewall + git wiring;
+                                 `contextWindowTokens` attrset (per-model,
+                                 injected as env vars into all containers);
+                                 imports hive-forge.nix
+  modules/hive-forge.nix        optional in-container Forgejo
+                                 (`hyperhive.forge.enable`, default on);
+                                 Catppuccin Mocha theme via tmpfiles C+ copy
+  templates/harness-base.nix    shared scaffolding for sub-agents + manager;
+                                 `hyperhive.model` option (HIVE_DEFAULT_MODEL)
+  templates/agent-base.nix      sub-agent nixosConfiguration
+  templates/manager.nix         manager nixosConfiguration
+  templates/weston-vnc.nix      optional `hyperhive.gui.enable`
+                                 — weston + VNC backend systemd unit; writes
+                                 /etc/hyperhive/gui.json (vnc_port + auth) for
+                                 the harness WebSocket relay (/screen/ws)
+  forge-theme/theme-catppuccin-vibec0re.css  Catppuccin Mocha forge theme
+
+docs/
+  conventions.md       naming, identity=socket, async forms, commit style
+  gotchas.md           NixOS / nspawn quirks and lessons learned
+  web-ui.md            dashboard + per-agent page layouts and endpoints
+  turn-loop.md         claude invocation, wake prompt, MCP tool surface
+  approvals.md         approval flow, manager policy, helper events
+  persistence.md       sqlite dbs, retention, state dir layout
+  terminal-rendering.md  per-agent terminal row taxonomy (as built)
+  boundary.md          operator/agent trust model rationale
+  agent-hierarchy.md   tree-shape topology design + manager-privilege audit (#361)
+  damocles-migration.md  future migration plan for damocles → hyperhive
+```
+
+## Reading paths
+
+Pick the doc that matches your task. None depend on the others —
+read them à la carte.
+
+- **"What does the dashboard look like?"** →
+  [`docs/web-ui.md`](docs/web-ui.md).
+- **"How does the per-agent terminal classify + colour
+  events?"** → [`docs/terminal-rendering.md`](docs/terminal-rendering.md).
+- **"How does claude get its prompt and what tools does it have?"** →
+  [`docs/turn-loop.md`](docs/turn-loop.md).
+- **"How do config changes flow from manager to operator to
+  container?"** → [`docs/approvals.md`](docs/approvals.md).
+- **"What state survives destroy / purge / restart?"** →
+  [`docs/persistence.md`](docs/persistence.md).
+- **"Naming, commit style, wire protocol, the `data-async`
+  pattern."** → [`docs/conventions.md`](docs/conventions.md).
+- **"Why does the nspawn flag look like that?"** →
+  [`docs/gotchas.md`](docs/gotchas.md).
+
+## Conventions & process
+
+The docs below own the details — this section just points at them.
+
+- **Commit style, naming, identity, reconcile verb:** →
+  [`docs/conventions.md`](docs/conventions.md).
+- **NixOS / nspawn quirks** (bind mounts, conf flags, etc.): →
+  [`docs/gotchas.md`](docs/gotchas.md).
+- **Turn loop, sentinels (rate-limit, auth-failed), context
+  window:** → [`docs/turn-loop.md`](docs/turn-loop.md).
+- **Two-step spawn, approval flow, flake.lock validation:** →
+  [`docs/approvals.md`](docs/approvals.md).
diff --git a/Cargo.lock b/Cargo.lock
new file mode 100644
index 00000000..e156349b
--- /dev/null
+++ b/Cargo.lock
@@ -0,0 +1,2375 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anstream"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.102"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+
+[[package]]
+name = "async-trait"
+version = "0.1.89"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "autocfg"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+
+[[package]]
+name = "axum"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
+dependencies = [
+ "axum-core",
+ "base64",
+ "bytes",
+ "form_urlencoded",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "itoa",
+ "matchit",
+ "memchr",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "serde_core",
+ "serde_json",
+ "serde_path_to_error",
+ "serde_urlencoded",
+ "sha1",
+ "sync_wrapper",
+ "tokio",
+ "tokio-tungstenite",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "bitflags"
+version = "2.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
+
+[[package]]
+name = "bytes"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
+
+[[package]]
+name = "cc"
+version = "1.2.62"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1dce859f0832a7d088c4f1119888ab94ef4b5d6795d1ce05afb7fe159d79f98"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+
+[[package]]
+name = "chrono"
+version = "0.4.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
+dependencies = [
+ "iana-time-zone",
+ "num-traits",
+ "serde",
+ "windows-link",
+]
+
+[[package]]
+name = "clap"
+version = "4.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+
+[[package]]
+name = "colorchoice"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "darling"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0"
+dependencies = [
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "data-encoding"
+version = "2.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "dyn-clone"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "fallible-iterator"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2acce4a10f12dc2fb14a218589d4f1f62ef011b2d0cc4b3cb1bba8e94da14649"
+
+[[package]]
+name = "fallible-streaming-iterator"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
+
+[[package]]
+name = "fastrand"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "futures"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b147ee9d1f6d097cef9ce628cd2ee62288d963e16fb287bd9286455b241382d"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
+
+[[package]]
+name = "futures-task"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
+
+[[package]]
+name = "futures-util"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "wasi",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "r-efi",
+ "wasip2",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "foldhash",
+]
+
+[[package]]
+name = "hashlink"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7382cf6263419f2d8df38c55d7da83da5c18aef87fc7a7fc1fb1e344edfe14c1"
+dependencies = [
+ "hashbrown",
+]
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hive-ag3nt"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "axum",
+ "clap",
+ "futures-util",
+ "hive-sh4re",
+ "reqwest",
+ "rmcp",
+ "rusqlite",
+ "schemars",
+ "serde",
+ "serde_json",
+ "tokio",
+ "tokio-stream",
+ "tower-http",
+ "tracing",
+ "tracing-subscriber",
+]
+
+[[package]]
+name = "hive-c0re"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "axum",
+ "base64",
+ "clap",
+ "hive-sh4re",
+ "libc",
+ "reqwest",
+ "rusqlite",
+ "serde",
+ "serde_json",
+ "tempfile",
+ "tokio",
+ "tokio-stream",
+ "tower-http",
+ "tracing",
+ "tracing-subscriber",
+]
+
+[[package]]
+name = "hive-forge"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "clap",
+ "reqwest",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "hive-sh4re"
+version = "0.1.0"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "http"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "http-range-header"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9171a2ea8a68358193d15dd5d70c1c10a2afc3e7e4c5bc92bc9f025cebd7359c"
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "hyper"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6299f016b246a94207e63da54dbe807655bf9e00044f73ded42c3ac5305fbcca"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
+dependencies = [
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+ "webpki-roots",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "base64",
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+
+[[package]]
+name = "icu_properties"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
+
+[[package]]
+name = "icu_provider"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
+
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "js-sys"
+version = "0.3.98"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67df7112613f8bfd9150013a0314e196f4800d3201ae742489d999db2f979f08"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "once_cell",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
+[[package]]
+name = "libc"
+version = "0.2.186"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+
+[[package]]
+name = "libsqlite3-sys"
+version = "0.35.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "133c182a6a2c87864fe97778797e46c7e999672690dc9fa3ee8e241aa4a9c13f"
+dependencies = [
+ "cc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "litemap"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
+
+[[package]]
+name = "log"
+version = "0.4.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+
+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
+[[package]]
+name = "matchers"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
+dependencies = [
+ "regex-automata",
+]
+
+[[package]]
+name = "matchit"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
+
+[[package]]
+name = "memchr"
+version = "2.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "mime_guess"
+version = "2.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7c44f8e672c00fe5308fa235f821cb4198414e1c77935c1ab6948d3fd78550e"
+dependencies = [
+ "mime",
+ "unicase",
+]
+
+[[package]]
+name = "mio"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50b7e5b27aa02a74bac8c3f23f448f8d87ff11f92d3aac1a6ed369ee08cc56c1"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "nu-ansi-term"
+version = "0.50.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
+[[package]]
+name = "pastey"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c5a797f0e07bdf071d15742978fc3128ec6c22891c31a3a931513263904c982a"
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+
+[[package]]
+name = "potential_utf"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quinn"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2",
+ "thiserror",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
+dependencies = [
+ "bytes",
+ "getrandom 0.3.4",
+ "lru-slab",
+ "rand",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2",
+ "tracing",
+ "windows-sys 0.60.2",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "rand"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
+dependencies = [
+ "rand_chacha",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
+[[package]]
+name = "ref-cast"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f354300ae66f76f1c85c5f84693f0ce81d747e2c3f21a45fef496d89c960bf7d"
+dependencies = [
+ "ref-cast-impl",
+]
+
+[[package]]
+name = "ref-cast-impl"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
+
+[[package]]
+name = "reqwest"
+version = "0.12.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
+dependencies = [
+ "base64",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "mime_guess",
+ "percent-encoding",
+ "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "webpki-roots",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rmcp"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0810a9f717d9828f475fe1f629f4c305c8464b7f496c3a854b58d29e65f4058e"
+dependencies = [
+ "async-trait",
+ "chrono",
+ "futures",
+ "pastey",
+ "pin-project-lite",
+ "rmcp-macros",
+ "schemars",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "rmcp-macros"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6aefac48c364756e97f04c0401ba3231e8607882c7c1d92da0437dc16307904d"
+dependencies = [
+ "darling",
+ "proc-macro2",
+ "quote",
+ "serde_json",
+ "syn",
+]
+
+[[package]]
+name = "rusqlite"
+version = "0.37.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "165ca6e57b20e1351573e3729b958bc62f0e48025386970b6e4d29e7a7e71f3f"
+dependencies = [
+ "bitflags",
+ "fallible-iterator",
+ "fallible-streaming-iterator",
+ "hashlink",
+ "libsqlite3-sys",
+ "smallvec",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b"
+dependencies = [
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30a7197ae7eb376e574fe940d068c30fe0462554a3ddbe4eca7838e049c937a9"
+dependencies = [
+ "web-time",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
+[[package]]
+name = "schemars"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2b42f36aa1cd011945615b92222f6bf73c599a102a300334cd7f8dbeec726cc"
+dependencies = [
+ "chrono",
+ "dyn-clone",
+ "ref-cast",
+ "schemars_derive",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "schemars_derive"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d115b50f4aaeea07e79c1912f645c7513d81715d0420f8bc77a18c6260b307f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "serde_derive_internals",
+ "syn",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_derive_internals"
+version = "0.29.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18d26a20a969b9e3fdf2fc2d9f21eda6c40e2de84c9408bb5d3b05d499aae711"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.149"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_path_to_error"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
+dependencies = [
+ "itoa",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "sha1"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+
+[[package]]
+name = "socket2"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom 0.3.4",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "thread_local"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f60246a4944f24f6e018aa17cdeffb7818b76356965d03b07d6a9886e8962185"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tokio"
+version = "1.52.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2",
+ "tokio-macros",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-stream"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32da49809aab5c3bc678af03902d4ccddea2a87d028d86392a4b1560c6906c70"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+ "tokio",
+ "tokio-util",
+]
+
+[[package]]
+name = "tokio-tungstenite"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f72a05e828585856dacd553fba484c242c46e391fb0e58917c942ee9202915c"
+dependencies = [
+ "futures-util",
+ "log",
+ "tokio",
+ "tungstenite",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
+dependencies = [
+ "bitflags",
+ "bytes",
+ "futures-core",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "http-range-header",
+ "httpdate",
+ "mime",
+ "mime_guess",
+ "percent-encoding",
+ "pin-project-lite",
+ "tokio",
+ "tokio-util",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "url",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "log",
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
+dependencies = [
+ "matchers",
+ "nu-ansi-term",
+ "once_cell",
+ "regex-automata",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing",
+ "tracing-core",
+ "tracing-log",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "tungstenite"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c01152af293afb9c7c2a57e4b559c5620b421f6d133261c60dd2d0cdb38e6b8"
+dependencies = [
+ "bytes",
+ "data-encoding",
+ "http",
+ "httparse",
+ "log",
+ "rand",
+ "sha1",
+ "thiserror",
+]
+
+[[package]]
+name = "typenum"
+version = "1.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40ce102ab67701b8526c123c1bab5cbe42d7040ccfd0f64af1a385808d2f43de"
+
+[[package]]
+name = "unicase"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
+[[package]]
+name = "valuable"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.3+wasi-0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20064672db26d7cdc89c7798c48a0fdfac8213434a1186e5ef29fd560ae223d6"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.121"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49ace1d07c165b0864824eee619580c4689389afa9dc9ed3a4c75040d82e6790"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.71"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96492d0d3ffba25305a7dc88720d250b1401d7edca02cc3bcd50633b424673b8"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.121"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e68e6f4afd367a562002c05637acb8578ff2dea1943df76afb9e83d177c8578"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.121"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d95a9ec35c64b2a7cb35d3fead40c4238d0940c86d107136999567a4703259f2"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.121"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4e0100b01e9f0d03189a92b96772a1fb998639d981193d7dbab487302513441"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.98"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b572dff8bcf38bad0fa19729c89bb5748b2b9b1d8be70cf90df697e3a8f32aa"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52f5ee44c96cf55f1b349600768e3ece3a8f26010c05265ab73f945bb1a2eb9d"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
+dependencies = [
+ "windows-targets 0.53.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm 0.52.6",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.53.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
+dependencies = [
+ "windows-link",
+ "windows_aarch64_gnullvm 0.53.1",
+ "windows_aarch64_msvc 0.53.1",
+ "windows_i686_gnu 0.53.1",
+ "windows_i686_gnullvm 0.53.1",
+ "windows_i686_msvc 0.53.1",
+ "windows_x86_64_gnu 0.53.1",
+ "windows_x86_64_gnullvm 0.53.1",
+ "windows_x86_64_msvc 0.53.1",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
+
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "writeable"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
+
+[[package]]
+name = "yoke"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abe8c5fda708d9ca3df187cae8bfb9ceda00dd96231bed36e445a1a48e66f9ca"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.48"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eed437bf9d6692032087e337407a86f04cd8d6a16a37199ed57949d415bd68e9"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.48"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70e3cd084b1788766f53af483dd21f93881ff30d7320490ec3ef7526d203bad4"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+
+[[package]]
+name = "zerotrie"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
diff --git a/Cargo.toml b/Cargo.toml
new file mode 100644
index 00000000..b990949f
--- /dev/null
+++ b/Cargo.toml
@@ -0,0 +1,48 @@
+[workspace]
+resolver = "3"
+members = ["hive-ag3nt", "hive-c0re", "hive-forge", "hive-sh4re"]
+
+[workspace.package]
+edition = "2024"
+version = "0.1.0"
+
+[workspace.lints.clippy]
+pedantic = { level = "warn", priority = -1 }
+# Tolerated stylistic pedantic lints (noisy, not actionable).
+missing_errors_doc = "allow"
+missing_panics_doc = "allow"
+module_name_repetitions = "allow"
+must_use_candidate = "allow"
+
+[workspace.dependencies]
+anyhow = "1"
+axum = { version = "0.8", features = ["ws"] }
+base64 = "0.22"
+clap = { version = "4", features = ["derive"] }
+hive-sh4re = { path = "hive-sh4re" }
+tower-http = { version = "0.6", features = ["fs"] }
+rmcp = { version = "1.7", default-features = false, features = [
+  "server",
+  "macros",
+  "transport-io",
+] }
+rusqlite = { version = "0.37", features = ["bundled"] }
+schemars = "1.0"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+similar = "2"
+tokio = { version = "1", features = [
+  "fs",
+  "io-util",
+  "macros",
+  "net",
+  "process",
+  "rt-multi-thread",
+  "signal",
+  "sync",
+  "time",
+] }
+tokio-stream = { version = "0.1", features = ["sync"] }
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
diff --git a/LICENSE b/LICENSE
deleted file mode 100644
index d159169d..00000000
--- a/LICENSE
+++ /dev/null
@@ -1,339 +0,0 @@
-                    GNU GENERAL PUBLIC LICENSE
-                       Version 2, June 1991
-
- Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
- 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-                            Preamble
-
-  The licenses for most software are designed to take away your
-freedom to share and change it.  By contrast, the GNU General Public
-License is intended to guarantee your freedom to share and change free
-software--to make sure the software is free for all its users.  This
-General Public License applies to most of the Free Software
-Foundation's software and to any other program whose authors commit to
-using it.  (Some other Free Software Foundation software is covered by
-the GNU Lesser General Public License instead.)  You can apply it to
-your programs, too.
-
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-this service if you wish), that you receive source code or can get it
-if you want it, that you can change the software or use pieces of it
-in new free programs; and that you know you can do these things.
-
-  To protect your rights, we need to make restrictions that forbid
-anyone to deny you these rights or to ask you to surrender the rights.
-These restrictions translate to certain responsibilities for you if you
-distribute copies of the software, or if you modify it.
-
-  For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must give the recipients all the rights that
-you have.  You must make sure that they, too, receive or can get the
-source code.  And you must show them these terms so they know their
-rights.
-
-  We protect your rights with two steps: (1) copyright the software, and
-(2) offer you this license which gives you legal permission to copy,
-distribute and/or modify the software.
-
-  Also, for each author's protection and ours, we want to make certain
-that everyone understands that there is no warranty for this free
-software.  If the software is modified by someone else and passed on, we
-want its recipients to know that what they have is not the original, so
-that any problems introduced by others will not reflect on the original
-authors' reputations.
-
-  Finally, any free program is threatened constantly by software
-patents.  We wish to avoid the danger that redistributors of a free
-program will individually obtain patent licenses, in effect making the
-program proprietary.  To prevent this, we have made it clear that any
-patent must be licensed for everyone's free use or not licensed at all.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.
-
-                    GNU GENERAL PUBLIC LICENSE
-   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
-
-  0. This License applies to any program or other work which contains
-a notice placed by the copyright holder saying it may be distributed
-under the terms of this General Public License.  The "Program", below,
-refers to any such program or work, and a "work based on the Program"
-means either the Program or any derivative work under copyright law:
-that is to say, a work containing the Program or a portion of it,
-either verbatim or with modifications and/or translated into another
-language.  (Hereinafter, translation is included without limitation in
-the term "modification".)  Each licensee is addressed as "you".
-
-Activities other than copying, distribution and modification are not
-covered by this License; they are outside its scope.  The act of
-running the Program is not restricted, and the output from the Program
-is covered only if its contents constitute a work based on the
-Program (independent of having been made by running the Program).
-Whether that is true depends on what the Program does.
-
-  1. You may copy and distribute verbatim copies of the Program's
-source code as you receive it, in any medium, provided that you
-conspicuously and appropriately publish on each copy an appropriate
-copyright notice and disclaimer of warranty; keep intact all the
-notices that refer to this License and to the absence of any warranty;
-and give any other recipients of the Program a copy of this License
-along with the Program.
-
-You may charge a fee for the physical act of transferring a copy, and
-you may at your option offer warranty protection in exchange for a fee.
-
-  2. You may modify your copy or copies of the Program or any portion
-of it, thus forming a work based on the Program, and copy and
-distribute such modifications or work under the terms of Section 1
-above, provided that you also meet all of these conditions:
-
-    a) You must cause the modified files to carry prominent notices
-    stating that you changed the files and the date of any change.
-
-    b) You must cause any work that you distribute or publish, that in
-    whole or in part contains or is derived from the Program or any
-    part thereof, to be licensed as a whole at no charge to all third
-    parties under the terms of this License.
-
-    c) If the modified program normally reads commands interactively
-    when run, you must cause it, when started running for such
-    interactive use in the most ordinary way, to print or display an
-    announcement including an appropriate copyright notice and a
-    notice that there is no warranty (or else, saying that you provide
-    a warranty) and that users may redistribute the program under
-    these conditions, and telling the user how to view a copy of this
-    License.  (Exception: if the Program itself is interactive but
-    does not normally print such an announcement, your work based on
-    the Program is not required to print an announcement.)
-
-These requirements apply to the modified work as a whole.  If
-identifiable sections of that work are not derived from the Program,
-and can be reasonably considered independent and separate works in
-themselves, then this License, and its terms, do not apply to those
-sections when you distribute them as separate works.  But when you
-distribute the same sections as part of a whole which is a work based
-on the Program, the distribution of the whole must be on the terms of
-this License, whose permissions for other licensees extend to the
-entire whole, and thus to each and every part regardless of who wrote it.
-
-Thus, it is not the intent of this section to claim rights or contest
-your rights to work written entirely by you; rather, the intent is to
-exercise the right to control the distribution of derivative or
-collective works based on the Program.
-
-In addition, mere aggregation of another work not based on the Program
-with the Program (or with a work based on the Program) on a volume of
-a storage or distribution medium does not bring the other work under
-the scope of this License.
-
-  3. You may copy and distribute the Program (or a work based on it,
-under Section 2) in object code or executable form under the terms of
-Sections 1 and 2 above provided that you also do one of the following:
-
-    a) Accompany it with the complete corresponding machine-readable
-    source code, which must be distributed under the terms of Sections
-    1 and 2 above on a medium customarily used for software interchange; or,
-
-    b) Accompany it with a written offer, valid for at least three
-    years, to give any third party, for a charge no more than your
-    cost of physically performing source distribution, a complete
-    machine-readable copy of the corresponding source code, to be
-    distributed under the terms of Sections 1 and 2 above on a medium
-    customarily used for software interchange; or,
-
-    c) Accompany it with the information you received as to the offer
-    to distribute corresponding source code.  (This alternative is
-    allowed only for noncommercial distribution and only if you
-    received the program in object code or executable form with such
-    an offer, in accord with Subsection b above.)
-
-The source code for a work means the preferred form of the work for
-making modifications to it.  For an executable work, complete source
-code means all the source code for all modules it contains, plus any
-associated interface definition files, plus the scripts used to
-control compilation and installation of the executable.  However, as a
-special exception, the source code distributed need not include
-anything that is normally distributed (in either source or binary
-form) with the major components (compiler, kernel, and so on) of the
-operating system on which the executable runs, unless that component
-itself accompanies the executable.
-
-If distribution of executable or object code is made by offering
-access to copy from a designated place, then offering equivalent
-access to copy the source code from the same place counts as
-distribution of the source code, even though third parties are not
-compelled to copy the source along with the object code.
-
-  4. You may not copy, modify, sublicense, or distribute the Program
-except as expressly provided under this License.  Any attempt
-otherwise to copy, modify, sublicense or distribute the Program is
-void, and will automatically terminate your rights under this License.
-However, parties who have received copies, or rights, from you under
-this License will not have their licenses terminated so long as such
-parties remain in full compliance.
-
-  5. You are not required to accept this License, since you have not
-signed it.  However, nothing else grants you permission to modify or
-distribute the Program or its derivative works.  These actions are
-prohibited by law if you do not accept this License.  Therefore, by
-modifying or distributing the Program (or any work based on the
-Program), you indicate your acceptance of this License to do so, and
-all its terms and conditions for copying, distributing or modifying
-the Program or works based on it.
-
-  6. Each time you redistribute the Program (or any work based on the
-Program), the recipient automatically receives a license from the
-original licensor to copy, distribute or modify the Program subject to
-these terms and conditions.  You may not impose any further
-restrictions on the recipients' exercise of the rights granted herein.
-You are not responsible for enforcing compliance by third parties to
-this License.
-
-  7. If, as a consequence of a court judgment or allegation of patent
-infringement or for any other reason (not limited to patent issues),
-conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot
-distribute so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you
-may not distribute the Program at all.  For example, if a patent
-license would not permit royalty-free redistribution of the Program by
-all those who receive copies directly or indirectly through you, then
-the only way you could satisfy both it and this License would be to
-refrain entirely from distribution of the Program.
-
-If any portion of this section is held invalid or unenforceable under
-any particular circumstance, the balance of the section is intended to
-apply and the section as a whole is intended to apply in other
-circumstances.
-
-It is not the purpose of this section to induce you to infringe any
-patents or other property right claims or to contest validity of any
-such claims; this section has the sole purpose of protecting the
-integrity of the free software distribution system, which is
-implemented by public license practices.  Many people have made
-generous contributions to the wide range of software distributed
-through that system in reliance on consistent application of that
-system; it is up to the author/donor to decide if he or she is willing
-to distribute software through any other system and a licensee cannot
-impose that choice.
-
-This section is intended to make thoroughly clear what is believed to
-be a consequence of the rest of this License.
-
-  8. If the distribution and/or use of the Program is restricted in
-certain countries either by patents or by copyrighted interfaces, the
-original copyright holder who places the Program under this License
-may add an explicit geographical distribution limitation excluding
-those countries, so that distribution is permitted only in or among
-countries not thus excluded.  In such case, this License incorporates
-the limitation as if written in the body of this License.
-
-  9. The Free Software Foundation may publish revised and/or new versions
-of the General Public License from time to time.  Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-Each version is given a distinguishing version number.  If the Program
-specifies a version number of this License which applies to it and "any
-later version", you have the option of following the terms and conditions
-either of that version or of any later version published by the Free
-Software Foundation.  If the Program does not specify a version number of
-this License, you may choose any version ever published by the Free Software
-Foundation.
-
-  10. If you wish to incorporate parts of the Program into other free
-programs whose distribution conditions are different, write to the author
-to ask for permission.  For software which is copyrighted by the Free
-Software Foundation, write to the Free Software Foundation; we sometimes
-make exceptions for this.  Our decision will be guided by the two goals
-of preserving the free status of all derivatives of our free software and
-of promoting the sharing and reuse of software generally.
-
-                            NO WARRANTY
-
-  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
-FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
-OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
-PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
-OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
-TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
-PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
-REPAIR OR CORRECTION.
-
-  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
-REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
-INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
-OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
-TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
-YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
-PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGES.
-
-                     END OF TERMS AND CONDITIONS
-
-            How to Apply These Terms to Your New Programs
-
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-convey the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
-    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) <year>  <name of author>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-
-Also add information on how to contact you by electronic and paper mail.
-
-If the program is interactive, make it output a short notice like this
-when it starts in an interactive mode:
-
-    Gnomovision version 69, Copyright (C) year name of author
-    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-    This is free software, and you are welcome to redistribute it
-    under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License.  Of course, the commands you use may
-be called something other than `show w' and `show c'; they could even be
-mouse-clicks or menu items--whatever suits your program.
-
-You should also get your employer (if you work as a programmer) or your
-school, if any, to sign a "copyright disclaimer" for the program, if
-necessary.  Here is a sample; alter the names:
-
-  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
-  `Gnomovision' (which makes passes at compilers) written by James Hacker.
-
-  <signature of Ty Coon>, 1 April 1989
-  Ty Coon, President of Vice
-
-This General Public License does not permit incorporating your program into
-proprietary programs.  If your program is a subroutine library, you may
-consider it more useful to permit linking proprietary applications with the
-library.  If this is what you want to do, use the GNU Lesser General
-Public License instead of this License.
diff --git a/README.md b/README.md
index 3ad5e880..a2f48896 100644
--- a/README.md
+++ b/README.md
@@ -1,46 +1,143 @@
-# nixos-configuration
+# <img src="branding/hyperhive.svg" alt="" width="38" align="top"> hyperhive
 
-Personal NixOS configuration for all machines. Devices are declared in `devices.nix`, per-device configs live in `nixosConfigurations/<name>/`, and shared modules in `nixosModules/`.
+> a swarm of claude-code agents, each in its own nspawn cage, gossiping
+> over unix sockets. config changes flow as git commits, the operator
+> approves them in a browser, every deploy is a tag. cyberpunk-themed
+> dashboard included. 💜⚡
 
-## Distributed builds
+Claude code is great in one window, *exponentielle* across many — but
+only if you can keep the agents from stepping on each other, give them
+durable identity, and stop them from eating production. hyperhive is
+the substrate.
 
-Machines are configured to act as build servers / binary caches for each other in devices.nix.
+- identity = unix socket
+- communication = sqlite-backed broker (`send` / `recv` / `ask` /
+  `answer` / `remind`)
+- config = git (manager proposes, operator approves, deploys land as
+  tagged commits)
+- blast radius = container
 
-### Onboarding a device as a build client
+```
+host (NixOS, runs hive-c0re.service)
+│
+├── operator
+│   ├── browser → :7000               hive-c0re dashboard
+│   ├── browser → :8000 / :8100-8999  per-agent web UIs
+│   └── CLI     → /run/hyperhive/host.sock   admin protocol
+│
+├── hive-c0re  (Rust daemon: lifecycle / broker / approvals /
+│               auto-update / dashboard / sockets)
+│
+└── nixos-containers
+    ├── hm1nd      manager agent (privileged MCP surface)
+    └── h-<name>   sub-agent (vanilla MCP surface + per-agent extras)
+```
 
-1. Generate a key pair on the device:
+Depth lives in [`docs/`](docs/) — pick the one matching your task:
 
-   ```sh
-   sudo ssh-keygen -t ed25519 -f /etc/nix/distributed-build-key -N "" -C "$(hostname)-nix-builds" && sudo cat /etc/nix/distributed-build-key.pub
-   ```
+| reading path | doc |
+| --- | --- |
+| dashboard layout + endpoints | [`docs/web-ui.md`](docs/web-ui.md) |
+| claude turn loop + MCP tools | [`docs/turn-loop.md`](docs/turn-loop.md) |
+| config-edit + approval state machine | [`docs/approvals.md`](docs/approvals.md) |
+| what survives destroy / purge / restart | [`docs/persistence.md`](docs/persistence.md) |
+| naming, wire protocol, commit style | [`docs/conventions.md`](docs/conventions.md) |
+| NixOS / nspawn gotchas | [`docs/gotchas.md`](docs/gotchas.md) |
 
-2. Add the public key to the device entry in `devices.nix`:
+## Host config
 
-   ```nix
-   distributedBuilds.clientPublicKey = "ssh-ed25519 AAAA... <hostname>-nix-builds";
-   ```
+Minimal `flake.nix` for a host that runs hive-c0re:
 
-3. Rebuild all build machines so they pick up the new authorized key.
+```nix
+{
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+    hyperhive.url = "git+https://git.berlin.ccc.de/vinzenz/hyperhive";
+  };
 
-### Adding a build server
+  outputs = { nixpkgs, hyperhive, ... }: {
+    nixosConfigurations.my-host = nixpkgs.lib.nixosSystem {
+      system = "x86_64-linux";
+      modules = [
+        hyperhive.nixosModules.default  # hive-c0re + hive-forge in one import
+        ({ ... }: {
+          services.hive-c0re.enable = true;
+          # services.hive-c0re.operatorPronouns = "they/them";  # default: "she/her"
 
-1. Add to its entry in `devices.nix`:
+          # ... rest of your host config
+          system.stateVersion = "25.11";
+        })
+      ];
+    };
+  };
+}
+```
 
-   ```nix
-   distributedBuilds.isBuilder = true;
-   distributedBuilds.hostPublicKey = "ssh-ed25519 AAAA..."; # from: ssh-keyscan -t ed25519 "$(hostname)"
-   ```
+hive-c0re opens its admin socket + dashboard, auto-creates the
+manager container, and auto-rebuilds any container whose hyperhive
+rev goes stale. `claude-code` is unfree — hyperhive scopes the
+whitelist to itself, nothing for the operator to set.
 
-2. Generate a store signing key on the builder:
+Optional: set `services.hive-c0re.preBuildAgentTemplates = true;`
+to pre-fetch the per-container system closures into your host's
+/nix/store as part of `nixos-rebuild`. First-agent-spawn then
+completes in seconds instead of minutes (no nixpkgs/claude-code
+fetch on the critical path), at the cost of a few GB extra in your
+system closure. Off by default (the toplevels are pinned to
+`x86_64-linux`, so non-x86 hosts would otherwise force a cross-build).
+Alternatively warm the store manually:
+`nix build github:vinzenz/hyperhive#agent-base-toplevel`.
 
-   ```sh
-   sudo nix key generate-secret --key-name "$(hostname)" | sudo tee /etc/nix/signing-key.sec | sudo nix key convert-secret-to-public
-   ```
+## Agent configuration
 
-3. Add the printed public key to `devices.nix`:
+Per-agent settings live in each agent's `agent.nix` and are synced to
+the container as environment variables. Common options:
 
-   ```nix
-   distributedBuilds.storeSigningPublicKey = "<hostname>:<base64...>";
-   ```
+- **`hyperhive.model`** — Claude model for this agent (default: `"haiku"`).
+  Sets `HIVE_DEFAULT_MODEL` in the container; the harness applies it at
+  boot and it takes priority over any persisted runtime override. The
+  operator can still switch the model at runtime via the per-agent web UI,
+  but that choice is reset by any rebuild that changes this option.
+- **`hyperhive.allowedRecipients`** — List of agent names this agent can
+  message (via `send`). If unset, all agents are allowed. Useful to
+  restrict an agent to talking only to the manager.
+- **`hyperhive.forge.url`** — Base URL of the hyperhive-managed Forgejo
+  (default: `"http://localhost:3000"`). Used to configure the agent's
+  tea login at boot; no-op if `/state/forge-token` is missing.
+- **`hyperhive.forge.keepSubscriptions`** — Boolean. If `true`, the agent's
+  forge repo subscriptions are never auto-cleaned during rebuild; useful
+  for agents that want to watch specific repos. Rendered as
+  `HIVE_FORGE_KEEP_SUBSCRIPTIONS`.
+- **`hyperhive.forge.skipNotifyReasons`** — List of forge notification
+  `reason` values to suppress (e.g. `[ "subscribed" "participating" ]`).
+  Notifications matching these reasons are silently dropped; all others
+  including direct mentions and reviews are delivered. Empty list (default)
+  delivers all notifications. Rendered as `HIVE_FORGE_NOTIFY_SKIP_REASONS`
+  (comma-separated).
+- **`hyperhive.frontend.dist`** — Override the default frontend package
+  (`pkgs.hyperhive-frontend`, built by `nix/frontend.nix`). Set to a custom
+  derivation to ship a fully custom per-agent SPA. The JSON contract
+  (`/api/state`, `/events/stream`, action endpoints) is the source of truth
+  for any replacement.
+- **`hyperhive.frontend.extraFiles`** — Attrset of extra files/directories
+  to layer on top of the default agent dist. Each entry has a `source` (nix
+  path) and an optional `target` (URL prefix in the static tree, defaults to
+  the attribute name). Example: `{ bitburner.source = ./bitburner-dist; }`
+  serves that dist at `/bitburner/`. Pure additions only — overwriting an
+  existing default file is a hard eval-time error; use `frontend.dist` to
+  replace the whole dist. Paths with leading `/` or `..` segments are
+  rejected at eval time.
 
-4. Rebuild all machines so they trust the new signing key.
+See `nix/templates/harness-base.nix` for the full list of options and
+their descriptions.
+
+## Build / deploy
+
+```sh
+nix develop -c cargo check
+nix flake check        # rust + nix + toml fmt + clippy
+
+# deploy from a host config that imports hyperhive.nixosModules.hive-c0re
+nix flake update --update-input hyperhive
+sudo nixos-rebuild switch --flake .#<host>
+```
diff --git a/TODO.md b/TODO.md
new file mode 100644
index 00000000..74613421
--- /dev/null
+++ b/TODO.md
@@ -0,0 +1,6 @@
+# Hyperhive TODOs
+
+The backlog moved to the forge issue tracker:
+<http://localhost:3000/hyperhive/hyperhive/issues>
+
+Operator/agent trust-boundary design rationale: [`docs/boundary.md`](docs/boundary.md).
diff --git a/branding/agent-configs.svg b/branding/agent-configs.svg
new file mode 100644
index 00000000..d9e4d358
--- /dev/null
+++ b/branding/agent-configs.svg
@@ -0,0 +1,116 @@
+<svg width="300" height="300" viewBox="0 0 300 300" role="img" xmlns="http://www.w3.org/2000/svg">
+  <title>HyperHive · agent-configs</title>
+  <desc>HyperHive agent-configs org icon — stacked config files, amber on dark, same frame as the main hyperhive mark</desc>
+  <defs>
+    <clipPath id="clipH"><circle cx="150" cy="150" r="140"/></clipPath>
+  </defs>
+
+  <g clip-path="url(#clipH)">
+    <!-- same dark base + faint horizontal scanlines as the parent
+         hyperhive mark, so the agent-configs org reads as a sibling -->
+    <rect x="0" y="0" width="300" height="300" fill="#0a0600"/>
+    <g stroke="#ffb300" stroke-width="0.35" opacity="0.07">
+      <line x1="0" x2="300" y1="10"  y2="10"/>  <line x1="0" x2="300" y1="20"  y2="20"/>
+      <line x1="0" x2="300" y1="30"  y2="30"/>  <line x1="0" x2="300" y1="40"  y2="40"/>
+      <line x1="0" x2="300" y1="50"  y2="50"/>  <line x1="0" x2="300" y1="60"  y2="60"/>
+      <line x1="0" x2="300" y1="70"  y2="70"/>  <line x1="0" x2="300" y1="80"  y2="80"/>
+      <line x1="0" x2="300" y1="90"  y2="90"/>  <line x1="0" x2="300" y1="100" y2="100"/>
+      <line x1="0" x2="300" y1="110" y2="110"/> <line x1="0" x2="300" y1="120" y2="120"/>
+      <line x1="0" x2="300" y1="130" y2="130"/> <line x1="0" x2="300" y1="140" y2="140"/>
+      <line x1="0" x2="300" y1="150" y2="150"/> <line x1="0" x2="300" y1="160" y2="160"/>
+      <line x1="0" x2="300" y1="170" y2="170"/> <line x1="0" x2="300" y1="180" y2="180"/>
+      <line x1="0" x2="300" y1="190" y2="190"/> <line x1="0" x2="300" y1="200" y2="200"/>
+      <line x1="0" x2="300" y1="210" y2="210"/> <line x1="0" x2="300" y1="220" y2="220"/>
+      <line x1="0" x2="300" y1="230" y2="230"/> <line x1="0" x2="300" y1="240" y2="240"/>
+      <line x1="0" x2="300" y1="250" y2="250"/> <line x1="0" x2="300" y1="260" y2="260"/>
+      <line x1="0" x2="300" y1="270" y2="270"/> <line x1="0" x2="300" y1="280" y2="280"/>
+    </g>
+
+    <!-- containment rings, same as parent (visual family) -->
+    <circle cx="150" cy="150" r="118" fill="none" stroke="#ffb300" stroke-width="1" opacity="0.4"/>
+    <circle cx="150" cy="150" r="104" fill="none" stroke="#ff8f00" stroke-width="0.5" opacity="0.25" stroke-dasharray="4 6"/>
+
+    <!-- stack of three offset config sheets. each sheet is a
+         dark-fill rectangle outlined in amber, with thin "content
+         lines" inside to read as a file. offset diagonally so the
+         stack reads top-down: back / mid / front. front sheet is
+         centred on the canvas (150, 150) so the curly-brace glyph
+         at canvas-centre lands at the visual middle of the front
+         sheet; back and mid peek out top-LEFT so the stack reads
+         as a pile. -->
+
+    <!-- BACK sheet (x=70, y=56 — top-left peek) -->
+    <g opacity="0.55">
+      <rect x="70"  y="56"  width="120" height="148" rx="6" ry="6"
+            fill="#150c00" stroke="#ffb300" stroke-width="1.4"/>
+      <g stroke="#ffb300" stroke-width="0.7" opacity="0.55">
+        <line x1="82"  y1="78"  x2="164" y2="78"/>
+        <line x1="82"  y1="94"  x2="144" y2="94"/>
+        <line x1="82"  y1="110" x2="158" y2="110"/>
+        <line x1="82"  y1="126" x2="132" y2="126"/>
+        <line x1="82"  y1="142" x2="164" y2="142"/>
+        <line x1="82"  y1="158" x2="144" y2="158"/>
+        <line x1="82"  y1="174" x2="154" y2="174"/>
+      </g>
+    </g>
+
+    <!-- MID sheet (x=80, y=66) -->
+    <g opacity="0.8">
+      <rect x="80"  y="66"  width="120" height="148" rx="6" ry="6"
+            fill="#1a0f00" stroke="#ffb300" stroke-width="1.6"/>
+      <g stroke="#ffb300" stroke-width="0.8" opacity="0.7">
+        <line x1="92" y1="88"  x2="174" y2="88"/>
+        <line x1="92" y1="104" x2="154" y2="104"/>
+        <line x1="92" y1="120" x2="168" y2="120"/>
+        <line x1="92" y1="136" x2="142" y2="136"/>
+        <line x1="92" y1="152" x2="174" y2="152"/>
+        <line x1="92" y1="168" x2="154" y2="168"/>
+        <line x1="92" y1="184" x2="164" y2="184"/>
+      </g>
+    </g>
+
+    <!-- FRONT sheet (x=90, y=76, width=120, height=148 — centred
+         at canvas (150, 150)). Folded top-right corner + curly-
+         brace glyph. The brace text is anchored at canvas-centre
+         which now coincides with the front-sheet centre. -->
+    <g>
+      <!-- main rectangle with folded top-right corner cut: draw as a
+           path so the corner triangle reads as a tab -->
+      <path d="M 90 76
+               L 192 76
+               L 210 94
+               L 210 224
+               L 90 224
+               Z"
+            fill="#1f1200" stroke="#ffb300" stroke-width="1.8"/>
+      <!-- folded-corner triangle (lighter fill) -->
+      <path d="M 192 76 L 210 94 L 192 94 Z"
+            fill="#2a1900" stroke="#ffb300" stroke-width="1.2"/>
+      <!-- curly braces — the universal "config file" glyph.
+           dominant-baseline=central centres the glyph block on the
+           text y-coordinate so it lands at the front-sheet middle.
+           font-size dropped 78→56 + tighter letter-spacing (#424
+           mara: "braces cross the boundaries of the page") so the
+           glyphs sit comfortably inside the 120-wide sheet with
+           clear breathing room on the left/right edges. -->
+      <text x="150" y="150" text-anchor="middle" dominant-baseline="central"
+            font-family="ui-monospace, 'JetBrains Mono', monospace"
+            font-size="56" font-weight="700" letter-spacing="-3"
+            fill="#ffb300" opacity="0.95">{ }</text>
+    </g>
+
+    <!-- thin centerline crosshair, same flourish as the parent -->
+    <rect x="0" y="143" width="300" height="2" fill="#ffb300" opacity="0.07"/>
+  </g>
+
+  <!-- same outer frame + corner brackets as the parent hyperhive
+       mark so the two orgs read as a visual family -->
+  <circle cx="150" cy="150" r="140" fill="none" stroke="#ffb300" stroke-width="2.5"/>
+  <circle cx="150" cy="150" r="145" fill="none" stroke="#ff8f00" stroke-width="0.5" opacity="0.4" stroke-dasharray="8 4"/>
+  <g stroke="#ffb300" stroke-width="1.5" fill="none" opacity="0.8">
+    <path d="M44,44 L20,44 L20,70"/>
+    <path d="M256,44 L280,44 L280,70"/>
+    <path d="M44,256 L20,256 L20,230"/>
+    <path d="M256,256 L280,256 L280,230"/>
+  </g>
+</svg>
diff --git a/branding/hyperhive.png b/branding/hyperhive.png
new file mode 100644
index 00000000..731d2533
Binary files /dev/null and b/branding/hyperhive.png differ
diff --git a/branding/hyperhive.svg b/branding/hyperhive.svg
new file mode 100644
index 00000000..81d931c1
--- /dev/null
+++ b/branding/hyperhive.svg
@@ -0,0 +1,97 @@
+<svg width="300" height="300" viewBox="0 0 300 300" role="img" xmlns="http://www.w3.org/2000/svg">
+  <title>HyperHive</title>
+  <desc>HyperHive icon — hexagonal hive, amber on dark</desc>
+  <defs>
+    <clipPath id="clipH"><circle cx="150" cy="150" r="140"/></clipPath>
+  </defs>
+
+  <g clip-path="url(#clipH)">
+    <rect x="0" y="0" width="300" height="300" fill="#0a0600"/>
+    <g stroke="#ffb300" stroke-width="0.35" opacity="0.07">
+      <line x1="0" x2="300" y1="10"  y2="10"/>  <line x1="0" x2="300" y1="20"  y2="20"/>
+      <line x1="0" x2="300" y1="30"  y2="30"/>  <line x1="0" x2="300" y1="40"  y2="40"/>
+      <line x1="0" x2="300" y1="50"  y2="50"/>  <line x1="0" x2="300" y1="60"  y2="60"/>
+      <line x1="0" x2="300" y1="70"  y2="70"/>  <line x1="0" x2="300" y1="80"  y2="80"/>
+      <line x1="0" x2="300" y1="90"  y2="90"/>  <line x1="0" x2="300" y1="100" y2="100"/>
+      <line x1="0" x2="300" y1="110" y2="110"/> <line x1="0" x2="300" y1="120" y2="120"/>
+      <line x1="0" x2="300" y1="130" y2="130"/> <line x1="0" x2="300" y1="140" y2="140"/>
+      <line x1="0" x2="300" y1="150" y2="150"/> <line x1="0" x2="300" y1="160" y2="160"/>
+      <line x1="0" x2="300" y1="170" y2="170"/> <line x1="0" x2="300" y1="180" y2="180"/>
+      <line x1="0" x2="300" y1="190" y2="190"/> <line x1="0" x2="300" y1="200" y2="200"/>
+      <line x1="0" x2="300" y1="210" y2="210"/> <line x1="0" x2="300" y1="220" y2="220"/>
+      <line x1="0" x2="300" y1="230" y2="230"/> <line x1="0" x2="300" y1="240" y2="240"/>
+      <line x1="0" x2="300" y1="250" y2="250"/> <line x1="0" x2="300" y1="260" y2="260"/>
+      <line x1="0" x2="300" y1="270" y2="270"/> <line x1="0" x2="300" y1="280" y2="280"/>
+    </g>
+
+    <circle cx="150" cy="150" r="118" fill="none" stroke="#ffb300" stroke-width="1" opacity="0.4"/>
+    <circle cx="150" cy="150" r="104" fill="none" stroke="#ff8f00" stroke-width="0.5" opacity="0.25" stroke-dasharray="4 6"/>
+
+    <!-- RING 2 — 6 between-axis hexes, centered on (150,150) instead of (170,170) -->
+    <g fill="#0e0800" stroke="#ffb300" stroke-width="0.7" opacity="0.4">
+      <polygon points="254,105 241,127.5 215,127.5 202,105 215,82.5  241,82.5"/>
+      <polygon points="98,105  85,127.5  59,127.5  46,105  59,82.5   85,82.5"/>
+      <polygon points="176,60  163,82.5  137,82.5  124,60  137,37.5  163,37.5"/>
+      <polygon points="254,195 241,217.5 215,217.5 202,195 215,172.5 241,172.5"/>
+      <polygon points="98,195  85,217.5  59,217.5  46,195  59,172.5  85,172.5"/>
+      <polygon points="176,240 163,262.5 137,262.5 124,240 137,217.5 163,217.5"/>
+    </g>
+
+    <!-- RING 1 — 6 hexes -->
+    <g fill="#150c00" stroke="#ffb300" stroke-width="1.2" opacity="0.8">
+      <polygon points="228,150 215,172.5 189,172.5 176,150 189,127.5 215,127.5"/>
+      <polygon points="202,105 189,127.5 163,127.5 150,105 163,82.5  189,82.5"/>
+      <polygon points="150,105 137,127.5 111,127.5 98,105  111,82.5  137,82.5"/>
+      <polygon points="124,150 111,172.5 85,172.5  72,150  85,127.5  111,127.5"/>
+      <polygon points="150,195 137,217.5 111,217.5 98,195  111,172.5 137,172.5"/>
+      <polygon points="202,195 189,217.5 163,217.5 150,195 163,172.5 189,172.5"/>
+    </g>
+
+    <!-- CENTER hex -->
+    <polygon points="176,150 163,172.5 137,172.5 124,150 137,127.5 163,127.5"
+             fill="#1a0f00" stroke="#ffb300" stroke-width="1.8"/>
+
+    <!-- connections -->
+    <g stroke="#ffb300" stroke-width="1" opacity="0.6">
+      <line x1="176" y1="150" x2="202" y2="150"/>
+      <line x1="124" y1="150" x2="98"  y2="150"/>
+      <line x1="163" y1="128" x2="176" y2="105"/>
+      <line x1="137" y1="128" x2="124" y2="105"/>
+      <line x1="163" y1="173" x2="176" y2="195"/>
+      <line x1="137" y1="173" x2="124" y2="195"/>
+    </g>
+
+    <!-- CENTER node -->
+    <circle cx="150" cy="150" r="10" fill="#ffb300" opacity="0.95"/>
+    <circle cx="150" cy="150" r="5"  fill="#0a0600"/>
+
+    <!-- ring 1 nodes -->
+    <g fill="#ff8f00" opacity="0.9">
+      <circle cx="202" cy="150" r="6"/>
+      <circle cx="176" cy="105" r="6"/>
+      <circle cx="124" cy="105" r="6"/>
+      <circle cx="98"  cy="150" r="6"/>
+      <circle cx="124" cy="195" r="6"/>
+      <circle cx="176" cy="195" r="6"/>
+    </g>
+    <g fill="#0a0600">
+      <circle cx="202" cy="150" r="2.5"/>
+      <circle cx="176" cy="105" r="2.5"/>
+      <circle cx="124" cy="105" r="2.5"/>
+      <circle cx="98"  cy="150" r="2.5"/>
+      <circle cx="124" cy="195" r="2.5"/>
+      <circle cx="176" cy="195" r="2.5"/>
+    </g>
+
+    <rect x="0" y="143" width="300" height="2" fill="#ffb300" opacity="0.07"/>
+  </g>
+
+  <circle cx="150" cy="150" r="140" fill="none" stroke="#ffb300" stroke-width="2.5"/>
+  <circle cx="150" cy="150" r="145" fill="none" stroke="#ff8f00" stroke-width="0.5" opacity="0.4" stroke-dasharray="8 4"/>
+  <g stroke="#ffb300" stroke-width="1.5" fill="none" opacity="0.8">
+    <path d="M44,44 L20,44 L20,70"/>
+    <path d="M256,44 L280,44 L280,70"/>
+    <path d="M44,256 L20,256 L20,230"/>
+    <path d="M256,256 L280,256 L280,230"/>
+  </g>
+</svg>
diff --git a/devices.nix b/devices.nix
deleted file mode 100644
index 26a274d9..00000000
--- a/devices.nix
+++ /dev/null
@@ -1,80 +0,0 @@
-{ self }:
-let
-  nixos-raspberrypi = self.inputs.nixos-raspberrypi;
-in
-{
-  # keep-sorted start block=yes
-  aur0ra = {
-    system = "aarch64-linux";
-    nixosSystem = nixos-raspberrypi.lib.nixosSystem;
-  };
-  aur0ra-installer = {
-    # build with nix build .\#nixosConfigurations.aur0ra-installer.config.system.build.sdImage
-    system = "aarch64-linux";
-    nixosSystem = nixos-raspberrypi.lib.nixosInstaller;
-  };
-  damocles = {
-    system = "x86_64-linux";
-    distributedBuilds.maxJobs = 0;
-  };
-  damocles-lab = {
-    system = "x86_64-linux";
-    distributedBuilds.maxJobs = 0;
-  };
-  epimetheus = {
-    system = "aarch64-linux";
-  };
-  forgejo-runner-1 = {
-    system = "aarch64-linux";
-    publicFqdn = "forgejo-runner-1.dev.zerforschen.plus";
-    distributedBuilds = {
-      isBuilder = true;
-      speedFactor = 1;
-      clientPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK0NLgg0sFobBWz/bjYs9WkrMvlcvJC5F6+3jQ/b+AnD forgejo-runner-1-nix-builds";
-      hostPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIANGC89GiT5xCsFICwrharrbV3q7acWHqk6ZwOUXbtGT";
-      storeSigningPublicKey = "forgejo-runner-1:ln1FVLL8G5+IveQuBi/Kn3SaqFZ1gaiQrE3yPlMhCMA=";
-    };
-  };
-  hetzner-vpn2 = {
-    system = "aarch64-linux";
-  };
-  hyperforge = {
-    system = "aarch64-linux";
-  };
-  muede-lpt2 = {
-    system = "x86_64-linux";
-    isDesktop = true;
-    home-manager-users = {
-      inherit (self.homeConfigurations) muede;
-    };
-    distributedBuilds = {
-      isBuilder = true;
-      speedFactor = 2;
-      hostPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHGKoZ68wwyVRmPB0SkvpJUyUMDWeFbC5Je9zukyEOh7";
-      clientPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKAbojdhb3PfazSRmudvo381Y+zUFVLMa7AbWbfK/Zp2 muede-lpt2-nix-builds";
-      storeSigningPublicKey = "muede-lpt2:3csut7FW6oZK/ztRLBRC80LSBfFE3qzl+aIYgOixB6U=";
-    };
-  };
-  muede-pc2 = {
-    system = "x86_64-linux";
-    isDesktop = true;
-    home-manager-users = {
-      inherit (self.homeConfigurations) muede;
-    };
-    distributedBuilds = {
-      isBuilder = true;
-      speedFactor = 4;
-      hostPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKEQQS5XNoj62Oj85xQfIuLORwoBRwfqjvfBHHsiI+RH";
-      clientPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHmnyhP6L+kGHV15cb/d31AQr50wSEaQhkUBwy2+OEKk muede-pc2-nix-builds";
-      storeSigningPublicKey = "muede-pc2:fqQO0E0y65MjUWlQnrgWt5ZsmQKlKCv4jls3CmUXDEQ=";
-    };
-  };
-  ronja-pc = {
-    system = "x86_64-linux";
-    isDesktop = true;
-    home-manager-users = {
-      inherit (self.homeConfigurations) ronja;
-    };
-  };
-  # keep-sorted end
-}
diff --git a/docs/agent-hierarchy.md b/docs/agent-hierarchy.md
new file mode 100644
index 00000000..dc3d3b7c
--- /dev/null
+++ b/docs/agent-hierarchy.md
@@ -0,0 +1,204 @@
+# Agent hierarchy & privileges
+
+Design + audit doc for milestone #6 (the
+[issue](http://localhost:3000/hyperhive/hyperhive/issues/361) tree).
+The implementation lands in pieces; this doc tracks what's done, what's
+planned, and what currently special-cases the manager.
+
+## Current state (as of this PR)
+
+Topology lives in the hive-c0re-owned **meta repo**, alongside
+`flake.nix`, at `/var/lib/hyperhive/meta/topology.json`:
+
+```json
+{
+  "manager": null,
+  "alice":   "manager",
+  "bob":     "alice"
+}
+```
+
+`null` = root-level agent. Today only the manager qualifies by default.
+Other agents land under `"manager"` on first sync. Re-parenting is
+operator-driven (#486 / #487):
+
+- CLI: `hive-c0re set-parent <child> --parent <new>` (or `--root` to
+  promote). Exactly one of `--parent` / `--root` is required.
+- Dashboard: `POST /api/topology/set-parent` (form fields `child`,
+  optional `new_parent` — absent / empty ⇒ promote to root).
+- Wire: `HostRequest::SetParent { child, new_parent: Option<String> }`.
+
+All three converge on `topology::set_parent`, which delegates the
+validation rules to a pure `apply_set_parent` helper. Refuses:
+- reparenting the manager (structurally root),
+- unknown `child` / `new_parent` (typo guard),
+- self-parenting,
+- cycles (32-hop ancestor walk, mirroring `is_descendant_of`).
+
+Idempotent no-op fast path skips the disk write when the parent is
+already what's requested. After a successful write the surfaces call
+`Coordinator::rescan_containers_and_emit` so connected dashboard
+viewers see the tree repaint without polling
+(`ContainerView.parent` is sourced from `topology.json`).
+
+**Today's caveat (#361 follow-up):** the move is purely a JSON edit.
+Only the top-level manager (`hm1nd`) gets `/var/lib/hyperhive/agents`
+bind-mounted at `/agents` in its container, so sub-agents don't yet
+see their would-be children's state. Once sub-manager bind mounts
+land alongside #361 enforcement, `set_parent` grows a companion
+umount-old / mount-new / restart-cascade step (tracked via the
+cross-ref comment on #361).
+
+### Why meta, not per-agent `agent.nix`
+
+An agent shouldn't be able to claim a parent without that parent's
+consent, and operator-driven re-parenting shouldn't require touching
+the moved agent's config. Topology IS a system-level concern; meta is
+where system-level facts live.
+
+### Flow
+
+1. **Read**: `topology::read()` parses `topology.json` into a
+   `BTreeMap<String, Option<String>>`. Missing / unparsable file →
+   empty map → every agent treated as root (safe degradation for
+   fresh installs that haven't run `meta::sync_agents` yet).
+2. **Reconcile**: `meta::sync_agents` calls `topology::reconcile`
+   alongside its `flake.nix` regeneration. New agents land at their
+   default position (manager as parent, manager itself as root);
+   removed agents drop. Existing entries are preserved as-is so
+   operator overrides stick across regenerations.
+3. **Inject**: `meta::render_flake` looks up each agent's parent and
+   passes it to `mkAgent`. When non-null, the mkAgent body sets
+   `HIVE_PARENT = parent` in the agent's systemd service environment
+   so the harness / claude prompts can see it.
+4. **Surface**: `container_view::build_all` reads `topology.json` and
+   populates `ContainerView.parent: Option<String>` on every rescan.
+   The dashboard renders the field as a tree (#363 follow-up).
+
+## Target topology semantics
+
+Once enforcement lands the rules collapse into:
+
+| operation | who can do it |
+|---|---|
+| `kill` / `start` / `restart` / `update` (any descendant) | any ancestor |
+| `request_init_config` (spawn a new child) | any agent, child added under self |
+| `request_apply_commit` (any descendant's config) | any ancestor |
+| `get_logs` (any descendant) | any ancestor |
+| moderate questions / reminders (cancel any open thread of a descendant) | any ancestor |
+| `send` / `recv` routing | parent ↔ same-parent siblings ↔ self ↔ descendants; explicit allow-list for anyone else |
+| `request_update_meta_inputs` (bump meta lock) | root agents only (today: just `manager`) |
+
+"Ancestor" walks `ContainerView.parent` chains; cycles are guarded by a
+visited-set at dispatch time (a malformed topology.json can't lock the
+dispatcher into a loop).
+
+## Current manager special-casings — the audit
+
+What currently makes the manager different from every other agent, and
+which axis the post-milestone version reads each special-case along:
+
+### A — naming + bootstrap
+
+- `MANAGER_AGENT = "manager"` (broker recipient name) and
+  `MANAGER_NAME = "hm1nd"` (container name). ~28 grep hits across
+  `hive-c0re/src/`. **Just a name** — the rename plan is `manager` →
+  `root`, executed via the one-shot migration script in
+  `migrate.rs` (idempotent, marker-guarded).
+- `auto_update::ensure_manager` runs at hive-c0re boot and spawns
+  `hm1nd` if missing. Becomes "ensure the root agent exists" once any
+  agent can be at the root. **Topology**: root has no parent, so
+  hive-c0re itself owns its lifecycle (no parent to delegate to).
+
+### B — wire-protocol privileges
+
+The `ManagerRequest::*` variants in `hive-sh4re/src/lib.rs` are
+operations the manager flavour socket can make that sub-agent sockets
+can't:
+
+| variant | semantic | post-milestone |
+|---|---|---|
+| `RequestInitConfig` | seed an agent's proposed config repo | **topology** — descendants only |
+| `RequestApplyCommit` | submit a commit sha for operator approval | **topology** — descendants only |
+| `Kill` / `Start` / `Restart` / `Update` | container lifecycle on an existing agent | **topology** — descendants only |
+| `RequestUpdateMetaInputs` | bump meta `flake.lock` | **per-agent cap** (root-only today; a future "let coder bump its own input" might grant it) |
+| `GetLogs` | journalctl scrape of a sub-agent | **topology** — descendants only |
+| `Wake` | inject a `from: <X>` message into self's inbox | **not really privileged** — the wire surface exists because daemon co-processes (e.g. `forge_notify`) need it. Sub-agents have the same via their own socket. |
+
+### C — storage / mounts (`hive-c0re::lifecycle`)
+
+The manager container's nspawn bind set:
+
+- `HOST_AGENTS_ROOT (/var/lib/hyperhive/agents) → /agents` RW — so the
+  manager can edit any agent's proposed config repo
+- `HOST_APPLIED_ROOT (/var/lib/hyperhive/applied) → /applied` RO — so
+  the manager can diff against what's deployed
+- `HOST_META_ROOT (/var/lib/hyperhive/meta) → /meta` RO — so the
+  manager can read the system-wide deploy log
+
+Tree-shape version:
+- Each agent gets RW to `/agents/<descendant>/` for every descendant in
+  its subtree. The root agent (today: manager) gets RW to the full
+  forest as a special case of "the root has every other agent as a
+  descendant".
+- RO `/meta` access if the agent holds a "meta read" cap.
+- `request_update_meta_inputs` is the only path that actually writes
+  `flake.lock`, gated by the cap; everyone else stays RO.
+
+### D — drop legacy `/state` for manager
+
+`lifecycle.rs::notes_mount` currently ternary's `/state` for the
+manager and `/agents/<name>/state` for everyone else (because the
+manager pre-dates the per-agent state-dir layout). Milestone bullet:
+unify on `/agents/<name>/state` for everyone. One-time `mv` of
+`/var/lib/hyperhive/manager/state` → `/var/lib/hyperhive/agents/manager/state`
+in `migrate.rs` (idempotent, marker-guarded).
+
+### E — prompt + tools
+
+- `prompts/manager.md` vs `prompts/agent.md` — two separate system
+  prompts. **Per-agent cap list** of what the agent can do, rendered
+  into a single parametrised prompt at boot.
+- `mcp.rs::Flavor::{Agent, Manager}` controls which MCP tools claude
+  sees. Already structured this way internally — the per-flavour
+  allow-list becomes a per-cap-set lookup.
+
+### F — drive-by checks across c0re
+
+(`grep -n MANAGER_AGENT` produced ~28 hits)
+
+- `loose_ends.rs`: manager sees hive-wide loose-ends, sub-agents only
+  their own. **Topology** — every agent sees its own + its
+  descendants'.
+- `operator_questions.rs` + `broker.rs`: "manager can cancel any
+  question" override on the owner check. **Topology** — agents can
+  moderate threads of their descendants. (per mara's
+  https://localhost:3000/hyperhive/hyperhive/issues/361#issuecomment-3344)
+- `reminder_scheduler.rs`: same override pattern for reminder cancel.
+  **Topology** — descendants only.
+- `actions.rs`: `destroy` refuses to act on `MANAGER_NAME` (no
+  foot-shooting). **Topology** — agents can destroy descendants but
+  never themselves or ancestors.
+- `crash_watch.rs`: skips `ContainerCrash` for the manager (it
+  auto-restarts via systemd). **Topology** — the root container has
+  different recovery semantics, every other agent falls into the same
+  watch loop.
+
+### G — sub-agents inside the same container
+
+Future work mentioned in #361: when enabled for an agent, it can spawn
+temporary "sub-agents" that run inside its own container. Lighter than
+a full nspawn agent. Open questions, not yet wired:
+
+- Inherit caps from parent, or take an explicit narrower set?
+- Survive container restart, or always ephemeral?
+- Inbox: separate from parent, or shared?
+- Filesystem: share parent's `/state` RW, or a sub-dir?
+- Identity: distinct broker recipient name, or address the parent?
+
+## Cross-references
+
+- Milestone: [#361 "Agent privileges and sub-agents"](http://localhost:3000/hyperhive/hyperhive/issues/361)
+- Dashboard render: [#363 "show agent topology in container list"](http://localhost:3000/hyperhive/hyperhive/issues/363)
+- Audit table source: [comment 3335 on #361](http://localhost:3000/hyperhive/hyperhive/issues/361#issuecomment-3335)
+- Operator/agent trust boundary (orthogonal axis): [`boundary.md`](boundary.md)
diff --git a/docs/approvals.md b/docs/approvals.md
new file mode 100644
index 00000000..5158e8ba
--- /dev/null
+++ b/docs/approvals.md
@@ -0,0 +1,471 @@
+# Approvals + manager + helper events
+
+The approval queue is hyperhive's pivot: nothing that changes the
+shape of an agent (its config, whether it exists) happens without an
+operator click. The manager (`hm1nd`) is the policy gate in front of
+that queue; helper events are how it stays informed about what
+happens after a decision lands.
+
+## End-to-end approval flow
+
+1. Manager edits files under `/agents/<name>/config/` (any tracked
+   path, but `agent.nix` is the contract entry point) and commits
+   with its own git identity.
+2. Manager submits the commit sha via `request_apply_commit(agent,
+   commit_ref)`. `commit_ref` must be a commit **sha** (7-40 hex
+   chars, short or full) — a branch or tag name is rejected so the
+   approval pins an immutable commit.
+3. **hive-c0re immediately fetches that commit from the proposed
+   repo into the applied repo and tags it `proposal/<id>`.** It
+   resolves the sha locally against the proposed repo, fetches all
+   of proposed's heads into applied's object db, then tags the
+   resolved commit — `git fetch <remote> <sha>:<dst>` can't fetch
+   by a bare sha (the left side of a refspec is a remote *ref
+   name*), so the resolution happens on hive-c0re's side. The
+   approval row stores both the manager-supplied sha and the
+   canonical hive-c0re-vouched sha. From here on the proposed
+   repo is irrelevant for this approval — the manager can amend,
+   force-push, or `rm -rf` the proposed repo and the queued
+   approval still points at an immutable git object inside
+   applied.
+3a. **Flake validation (ApplyCommit only):** after the proposal tag
+   is planted, hive-c0re reads `proposal/<id>:flake.lock` and
+   runs two checks (closes #317). If either check fails, no
+   pending approval is created for the operator — the row is
+   marked failed and surfaces on the dashboard with the
+   validation message:
+   - **Stale lock** — materialises the commit in a temp worktree,
+     runs `nix flake lock` (no `--update-input` flags, so it only
+     fills missing entries), and rejects if the committed
+     `flake.lock` differs from the result. Triggered when the
+     manager added or removed `inputs` in `flake.nix` without
+     re-running `nix flake lock`. Fix: run `nix flake lock` in
+     the config repo, commit, and re-submit.
+   - **Duplicate inputs** — groups lock nodes by their canonical
+     `original` field; rejects if two or more nodes share the same
+     source. This usually means an input is missing
+     `inputs.<x>.inputs.nixpkgs.follows = "nixpkgs"`. Fix: add
+     the `follows` directive, re-lock, and re-submit.
+   Both checks only flag *new* violations — agents whose lock
+   already carried duplicates before this check was added are
+   unaffected until a coordinated config-change pass via manager.
+4. Operator sees the proposal as a card on the dashboard — a
+   full multi-file diff, toggleable between three bases (vs the
+   running tree / vs the last approved proposal / vs the
+   previous queued proposal) — and clicks ◆ APPR0VE (or
+   `hive-c0re approve <id>` on the CLI).
+5. hive-c0re moves the working tree to `proposal/<id>` and runs
+   the build under a sequence of tags (see below). On success,
+   `applied/main` fast-forwards to the proposal commit. On
+   failure, main stays put and the working tree resets back to
+   the previous deployed commit.
+6. `HelperEvent::ApprovalResolved` (and `Rebuilt` for the
+   ApplyCommit kind) land in the manager's inbox, carrying both
+   the canonical sha and the terminal tag.
+
+### Withdrawing a pending approval
+
+The manager can call `cancel_loose_end(kind: "approval", id)` to
+withdraw an approval that hasn't been acted on yet (closes #250).
+The row transitions to `ApprovalStatus::Cancelled` (distinct from
+`Denied`/`Failed`), the dashboard pulls the card out of the
+pending pane, and `ApprovalResolved { status: "cancelled" }` fires
+on the manager + dashboard channels. Approvals that have already
+been approved/denied/failed return an error — the resolution is
+final once the operator (or a lifecycle failure) acted on the row.
+
+Sub-agent surface refuses the `approval` kind with a clear error:
+sub-agents don't submit approvals, so they have nothing of their
+own to withdraw. Manager-only.
+
+`InitConfig` approvals are the first step in a two-step spawn
+flow. On approve, hive-c0re seeds the proposed config repo with
+a default `agent.nix` template and sends the manager
+`HelperEvent::ConfigReady { agent }`. The manager then reviews,
+edits, and commits the template before calling `request_apply_commit`
+to proceed to an `ApplyCommit` approval. The first `ApplyCommit`
+creates the container; subsequent ones rebuild it with new config.
+This gives the manager (and operator) an explicit review gate on the
+initial configuration before any container is created.
+
+## Meta flake
+
+The hive-c0re-owned repo at `/var/lib/hyperhive/meta/`
+declares one flake input per agent (`agent-<n>.url =
+"git+file:///var/lib/hyperhive/applied/<n>"`) and one
+`nixosConfigurations.<n>` output per agent. Each output wraps
+`inputs.agent-<n>.nixosModules.default` with the identity +
+`HIVE_PORT` / `HIVE_LABEL` / `HIVE_DASHBOARD_PORT` injection
+module that `setup_applied` used to generate inline.
+Containers run against `--flake /var/lib/hyperhive/meta#<n>`.
+
+Per-deploy lock flow (two-phase, owned by
+`actions::run_apply_commit` → `meta::{prepare,finalize,abort}
+_deploy`):
+
+1. `meta::prepare_deploy(name)` runs
+   `nix flake lock --update-input agent-<n>` without
+   committing. Working tree of meta now points the input at
+   `applied/<n>/main` (which `run_apply_commit` already
+   fast-forwarded to `proposal/<id>`).
+2. `lifecycle::rebuild_no_meta` runs
+   `nixos-container update <c> --flake meta#<name>`. Nix
+   evaluates against the staged lock.
+3. On success — `meta::finalize_deploy(name, sha, "deployed/
+   <id>")` stages `flake.lock` and commits with
+   `deploy <n> deployed/<id> <sha12>`. Meta's git log gains
+   one entry per successful deploy.
+4. On failure — `meta::abort_deploy()` runs
+   `git restore flake.lock` so the meta history shows only
+   successes; the failure stays as an annotated `failed/<id>`
+   tag in `applied/<n>`.
+
+Single-phase variants exist for paths without
+rollback semantics: `meta::lock_update_for_rebuild(name)` for
+the manual `↻ R3BU1LD` button (commits if the lock changed)
+and `meta::lock_update_hyperhive()` for the
+auto-update flake-rev bump (one shot before per-agent
+rebuilds, commits if the lock changed).
+
+`meta::sync_agents(hyperhive_flake, dashboard_port, &agents)`
+is the idempotent reconciler called by `spawn`, `destroy`,
+`rebuild`, and the startup migration. Renders `flake.nix`
+from the agent list; if it differs from disk, runs
+`nix flake lock` + commits as `regenerate meta flake` (or
+`seed meta from N agent(s)` on the very first call).
+
+The manager has `/meta` RO-bound inside its container:
+`git -C /meta log --oneline` is the swarm-wide deploy log,
+`cat /meta/flake.lock | jq '.nodes["agent-<n>"].locked'`
+resolves which sha each agent is pinned at right now.
+Dashboard surfaces the same info as a `deployed:<sha12>` chip
+per container row.
+
+## Two repos per agent
+
+```
+/var/lib/hyperhive/agents/<name>/config/    proposed — manager RW
+└── <anything>                              # any files the manager
+                                            # wants in the commit.
+                                            # agent.nix is the
+                                            # convention entry
+                                            # point; flake.nix is
+                                            # tracked boilerplate
+                                            # (manager doesn't edit
+                                            # it).
+
+/var/lib/hyperhive/applied/<name>/          applied — core-only
+├── .git/                                   # tag-rich history
+├── flake.nix                               # tracked, fixed
+│                                           # boilerplate exporting
+│                                           # nixosModules.default
+├── agent.nix                               # working tree of main
+└── <other manager files>                   # also tracked
+
+/var/lib/hyperhive/meta/                    swarm-wide flake — core
+├── .git/                                   # one commit per successful
+│                                           # deploy
+├── flake.nix                               # generated from agent set
+└── flake.lock                              # pins each agent's sha
+```
+
+Why two physical repos: the manager's `/agents/<n>/config/` is
+RW — a buggy or hostile agent can `git clean -fdx` its own
+proposed tree. The applied repo is never bind-mounted (except
+the read-only `.git` exposure described below) so a destructive
+move inside the container cannot reach it.
+
+The container's `--flake` ref is `/var/lib/hyperhive/meta#<name>`
+(see "Meta flake" above). The agent's own `applied/<n>/flake.nix`
+is a fixed boilerplate that exports `nixosModules.default =
+import ./agent.nix`; the meta flake imports that module and
+wraps it with identity + `HIVE_PORT` / `HIVE_LABEL` /
+`HIVE_DASHBOARD_PORT`.
+
+### Tag state machine
+
+Every approval id walks through a fixed set of tags on the
+underlying commit inside the applied repo:
+
+| Tag | When | Annotated? |
+|---|---|---|
+| `proposal/<id>` | request_apply_commit, after fetch | no |
+| `approved/<id>` | operator approve | no |
+| `building/<id>` | rebuild started | no |
+| `deployed/<id>` | rebuild succeeded — `main` ff's here | no |
+| `failed/<id>` | rebuild failed | yes (body = error) |
+| `denied/<id>` | operator deny | yes (body = operator note) |
+
+`applied/main` is always the latest `deployed/*`. `denied/` and
+`failed/` are terminal; the manager submits a new commit + new
+approval id to retry. Because tags are first-class git objects,
+rejected and failed trees stay browsable forever — `git log
+--tags` in the applied repo is the audit trail.
+
+### Dispatch via `rebuild_queue` (#441)
+
+Long-running approval work — `ApplyCommit`, `UpdateMetaInputs`,
+`Spawn` — no longer runs inline inside `actions::approve`. Instead
+the approval handler enqueues a `QueueEntry` into the global
+`rebuild_queue`:
+
+| `ApprovalKind` | `QueueKind` queued | `QueueSource` |
+|---|---|---|
+| `ApplyCommit` | `Rebuild` | `Approval` |
+| `UpdateMetaInputs` | `MetaUpdate` | `Approval` |
+| `Spawn` | `Spawn` | `Approval` |
+| `InitConfig` | — runs inline (sub-second git seed) | — |
+| `SchedulePrompt` | — runs inline (single sqlite insert) | — |
+
+Each queue entry carries the originating `approval_id` so the
+worker can re-fetch the approval row when it dispatches, run the
+kind-specific pipeline (`run_approval_apply_commit` /
+`run_approval_update_meta_inputs` / `run_approval_spawn`), and
+fire the matching `HelperEvent::*` on completion via
+`finish_approval`.
+
+Two visible consequences:
+
+- **Operator dashboard**: after clicking APPR0VE the work-in-progress
+  shows up on the *rebuild queue* card (`POST /api/state.rebuild_queue`
+  + live `rebuild_queue_changed` events), not on the approvals panel
+  (which already moved the row to "approved"). A long meta-update
+  cascade renders as a parent entry with one child per per-agent
+  rebuild — see `docs/web-ui.md` for the layout.
+- **Cancellation**: the dashboard's *× cancel* button on a `Queued`
+  entry calls `POST /api/rebuild-queue/{id}/cancel`, which flips the
+  entry to `Cancelled` before the worker dispatches it. Returns
+  `{"cancelled": true}` on success, `{"cancelled": false}` if the
+  entry already left `Queued` (running / done / failed) — terminal
+  states can't be retroactively rewritten.
+
+`QueueSource::Approval` carries the `approval_id` so a tail-end
+build failure surfaces back as a failed approval row, not just a
+silent queue entry. `QueueSource::Manual` (dashboard ↻ R3BU1LD)
+and `QueueSource::AutoUpdate` (boot-time sweep) use the same
+queue but skip the approval row plumbing.
+
+### Forge mirror
+
+When the bundled `hive-forge` container is running — on by
+default, `hyperhive.forge.enable` — hive-c0re mirrors every
+agent's applied repo into a private `agent-configs` Forgejo
+org. `forge::push_config(<name>)` pushes `applied/main` plus
+every tag to `agent-configs/<name>` after each ref mutation:
+the spawn that seeds `deployed/0`, every `request_apply_commit`
+(which plants `proposal/<id>`), every approve / deny, and a
+sweep at startup. Pushes are best-effort — a missing or stopped
+forge never blocks a deploy.
+
+The org is private and agents are not members, so only the
+`core` user (a Forgejo site admin) can read it: an agent can't
+reach another agent's config — or even its own — through the
+forge. The tokenised push URL is passed inline to `git push`,
+never written into `applied/<n>/.git/config`; that repo is
+RO-bind-mounted into the manager, and a stored token would leak
+core's admin credential to an agent.
+
+The dashboard deep-links into this org — a `config repo` link
+per container row and a `commit on forge` link per approval
+card. See `docs/web-ui.md`.
+
+### Manager view of applied + meta
+
+The manager container gets three host-side bind mounts via
+`set_nspawn_flags`:
+
+- `/var/lib/hyperhive/agents/` → `/agents/` (RW) — proposed
+  repos. Manager edits + commits per-agent config here.
+- `/var/lib/hyperhive/applied/` → `/applied/` (RO) — every
+  agent's authoritative applied repo, including `.git`.
+- `/var/lib/hyperhive/meta/` → `/meta/` (RO) — the swarm-wide
+  deploy flake.
+
+Each proposed repo (`/agents/<n>/config/`) is pre-configured
+with `applied` as a git remote pointing at
+`/applied/<n>/.git`. Useful incantations from inside the
+manager:
+
+```sh
+git -C /agents/<n>/config fetch applied
+git -C /agents/<n>/config log applied/main --oneline
+git -C /agents/<n>/config show applied/refs/tags/deployed/<id>
+git -C /agents/<n>/config show applied/refs/tags/failed/<id>   # body = build error
+git -C /agents/<n>/config show applied/refs/tags/denied/<id>   # body = operator note
+git -C /agents/<n>/config rebase applied/main                 # base in-flight work on what's deployed
+
+git -C /meta log --oneline                                    # swarm-wide deploy history
+cat /meta/flake.lock | jq '.nodes | with_entries(select(.key | startswith("agent-")))'
+```
+
+The RO binds block push at the kernel level, so the manager
+can only fetch / read — git plumbing inside the container
+cannot corrupt either authoritative repo.
+
+## Migration from the pre-tag / pre-meta schemes
+
+Both overhauls (tag-driven flow + meta flake) ship in-place
+migrations that run on every hive-c0re startup. Idempotent;
+each phase is a no-op once already applied. Behaviour:
+
+- Tag-driven phase: assumes the operator ran the one-shot
+  `git tag deployed/0 main` script (see commit history /
+  earlier docs revisions) once per agent. Tagging is
+  non-destructive: it doesn't touch live containers, state
+  dirs, or claude creds.
+- Meta-flake phase: rewrites each `applied/<n>/flake.nix` to
+  the module-only boilerplate, wires the `applied` remote in
+  each proposed repo, bootstraps the meta repo from the
+  current agent list, and `nixos-container update`s every
+  container at `meta#<n>`. The expensive last step is
+  guarded by `/var/lib/hyperhive/.meta-migration-done` so
+  it only runs once across hive-c0re restarts. Set
+  `HIVE_SKIP_META_MIGRATION=1` on the service to defer.
+
+No state loss in either migration. claude creds, /state/
+notes, the events DB, proposed history, and applied history
+all survive. The manager keeps its session; sub-agents stay
+logged in.
+
+## Manager (`hm1nd`) is hive-c0re-managed
+
+The manager container runs through the **same lifecycle as
+sub-agents**. On `hive-c0re serve` startup, if `hm1nd` is missing,
+hive-c0re creates it. The manager's flake lives at
+`/var/lib/hyperhive/applied/hm1nd/`; its proposed config at
+`/var/lib/hyperhive/agents/hm1nd/config/`. Manager can edit its own
+`agent.nix` (visible inside the container at `/agents/hm1nd/config/`)
+and submit `request_apply_commit("hm1nd", <sha>)` for operator
+approval.
+
+Differences from sub-agents:
+
+- `flake.nix` extends `hyperhive.nixosConfigurations.manager`
+  (vs `agent-base`).
+- Container name is `hm1nd` (no `h-` prefix).
+- Fixed web UI port (`MANAGER_PORT = 8000`).
+- `set_nspawn_flags` adds two extra binds: `/var/lib/hyperhive/agents`
+  → `/agents` (RW) so the manager can edit per-agent proposed repos,
+  and `/var/lib/hyperhive/applied` → `/applied` (RO) so the manager
+  can `git fetch` deployed/failed/denied tags from any agent's
+  authoritative applied repo (see "Manager view of applied" below).
+- First-deploy spawn bypasses the approval queue (manager is
+  required infrastructure).
+- Per-agent socket lives at `/run/hyperhive/manager/`, owned by
+  `manager_server::start`.
+
+**Migration note** (for older hosts): drop any `containers.hm1nd =
+{ ... }` block from your host NixOS config. hyperhive creates and
+updates the manager itself.
+
+## Manager policy
+
+From `hive-ag3nt/prompts/manager.md`: the manager does NOT
+rubber-stamp sub-agent config requests. It verifies (role match,
+package legitimacy, cheaper alternative, blast radius) before
+committing and calling `request_apply_commit`.
+
+For ambiguous cases or anything that needs human signal, the
+manager calls `ask(question, options?, multi?, ttl_seconds?, to?)` —
+queues the question and returns the id immediately. When `to` is
+omitted (or `"operator"`) the question shows up on the dashboard;
+when `to` is a sub-agent's name, the recipient receives a
+`HelperEvent::QuestionAsked` and answers via their own `answer`
+tool. Either way the answer arrives back as
+`HelperEvent::QuestionAnswered { id, question, answer, answerer }`
+in the asker's inbox. Storage is `hive-c0re::operator_questions`
+(sqlite) — same table, with a nullable `target` column
+(NULL = operator). Dispatch goes through
+`hive-c0re/src/questions.rs::{handle_ask, handle_answer}` so both
+the agent + manager surfaces stay aligned. The answer flow is:
+
+```
+POST /answer-question/{id}                       agent: Answer { id, answer }
+  → OperatorQuestions::answer(_, _, "operator")    → questions::handle_answer
+  → notify_agent(asker, QuestionAnswered {         → OperatorQuestions::answer(_, _, agent)
+       answerer: "operator", ... })                → notify_agent(asker, QuestionAnswered {
+                                                       answerer: agent, ... })
+```
+
+Two more paths resolve a pending question with a sentinel answer:
+
+- `POST /cancel-question/{id}` (✗ CANC3L button on the dashboard)
+  resolves with `[cancelled]`. The manager sees a terminal state
+  and can fall back.
+- `ttl_seconds` deadline: a tokio watchdog spawned at submit time
+  fires `answer(id, "[expired]")` once the ttl runs out. Already-
+  resolved races no-op. The dashboard surfaces a `⏳ MM:SS` chip
+  on each pending question with a deadline.
+
+## Helper events to the manager
+
+`Coordinator::notify_manager(&HelperEvent)` enqueues an inbox
+message from sender `system` with the event JSON in the body. The
+manager harness no longer short-circuits these — they drive a
+regular claude turn so the manager can react. Variants
+(`hive_sh4re::HelperEvent`):
+
+- `ApprovalResolved { id, agent, commit_ref, status, note }` —
+  fired by `actions::approve` + `actions::deny` whenever an
+  approval transitions to its terminal state.
+- `Spawned { agent, ok, note }` — `actions::approve` (first-time
+  ApplyCommit-kind) + admin `HostRequest::Spawn` (deprecated).
+- `Rebuilt { agent, ok, note }` — `auto_update::rebuild_agent`
+  (covers startup scan + manual `/rebuild` from dashboard) +
+  `actions::approve` (ApplyCommit).
+- `Killed { agent }` — admin `HostRequest::Kill` + dashboard
+  `/kill` + manager `Kill` MCP tool.
+- `Destroyed { agent }` — `actions::destroy`.
+- `ContainerCrash { agent, note }` — `crash_watch`: a previously-
+  running container went away with no operator-initiated transient
+  state (Stopping / Restarting / Destroying / Rebuilding) AND no
+  such transient was cleared in the last 30s (`RECENT_TRANSIENT_GRACE`
+  tombstone, three `POLL_INTERVAL`s — closes the race where a
+  lifecycle op finishes between two crash-watch polls and the
+  container shows briefly as "stopped without transient" before the
+  next start, #425). Manager can `start` it again or escalate.
+- `NeedsLogin { agent }` — sub-agent has no claude session yet.
+  Manager can't act directly (interactive OAuth); typically flags
+  the operator.
+- `LoggedIn { agent }` — sub-agent just completed login. Manager
+  often greets the agent on this event.
+- `ConfigReady { agent }` — a new agent's proposed config repo was
+  just seeded (post-`InitConfig` approval). The manager can now
+  edit `/agents/<agent>/config/agent.nix`, commit the changes,
+  and submit `request_apply_commit` with the commit sha to create
+  the container (first ApplyCommit also triggers spawn bookkeeping).
+- `NeedsUpdate { agent }` — sub-agent's recorded flake rev is
+  stale. Manager calls `update(name)` to rebuild — idempotent,
+  no approval required.
+- `QuestionAnswered { id, question, answer, answerer }` —
+  dashboard `/answer-question/{id}` (answerer = `"operator"`),
+  peer `Answer` request (answerer = agent name), or ttl watchdog
+  expiry (answerer = `"ttl-watchdog"`, answer = `"[expired]"`).
+- `QuestionAsked { id, asker, question, options, multi }` —
+  fired when an agent calls `Ask { to: Some(<this-agent>), ... }`.
+  The recipient responds via `Answer { id, answer }` and the
+  asker sees the matching `QuestionAnswered`.
+
+To add a new event: new `HelperEvent` variant + call sites + update
+`prompts/manager.md` so the manager knows the new shape.
+
+## Auto-update on startup
+
+`hive-c0re serve` runs `auto_update::run` in a background task right
+after opening the coordinator. It enumerates managed containers and
+rebuilds any whose recorded hyperhive rev differs from the current
+one — sub-agents and manager go through the same `lifecycle::rebuild`
+path.
+
+"Rev" = canonical filesystem path of `cfg.hyperhiveFlake`. Marker
+file: `/var/lib/hyperhive/applied/.<name>.hyperhive-rev`. If the
+flake input has no canonical path (e.g. a `github:` URL),
+auto-update is a no-op — rebuild manually.
+
+The dashboard surfaces pending updates per agent: a clickable
+"needs update ↻" badge appears whenever the marker differs from
+current rev. The badge POSTs `/rebuild/<name>`, calling the same
+`auto_update::rebuild_agent` path so manual triggers and the
+startup scan can't drift. When at least one container is stale, a
+top-level `↻ UPD4TE 4LL` button appears that loops over every
+stale container.
diff --git a/docs/boundary.md b/docs/boundary.md
new file mode 100644
index 00000000..95a07ebc
--- /dev/null
+++ b/docs/boundary.md
@@ -0,0 +1,59 @@
+# The operator/agent boundary
+
+Design rationale for hyperhive's two-principal trust model. The
+*implementation* work — container network isolation, the unifying
+gateway, core-daemon privsep — is tracked as `area:ops` issues on
+the forge.
+
+Today "the operator surface" and "the agent surface" are a
+*convention*, not a boundary — nothing stops a container from
+curling the core daemon on `localhost:<port>`, or another agent's
+web UI. Network isolation, the gateway, and privsep together turn
+that convention into an enforced boundary.
+
+## Two principals, two paths
+
+- **Operator** — reaches every UI (the dashboard + every
+  per-agent page) through the gateway, on one origin.
+  Operator-authority actions (approve / deny, answer-as-operator,
+  lifecycle POSTs) are served by the core daemon and only
+  reachable via the gateway.
+- **Agent** — speaks only for itself, only over its per-agent
+  unix socket. The socket's identity *is* the agent (see
+  `docs/conventions.md`, "identity = socket"). An agent must not
+  be able to reach the core daemon's HTTP surface, another
+  agent's socket, or another agent's web UI.
+
+## Design rule
+
+**Operator-authority actions never get a per-agent-socket entry
+point.** They live on the core backend.
+
+Worked example — answering an operator-targeted question is a
+`POST /answer-question/{id}` on the core dashboard, *never* an
+`AgentRequest` variant. If it were a per-agent-socket request, an
+agent could `curl` its own socket and spoof an operator answer.
+The per-agent web UI POSTs cross-origin to the core for these
+(see the inline-answer feature — the loose-ends section on each
+agent page).
+
+## Why network isolation is the load-bearing step
+
+Containers currently share the host network namespace, so a
+container can reach `localhost:<core-port>`, the dashboard, and
+every other agent's web port. Until that changes, the
+operator/agent split is on the honour system — every boundary
+claim above is aspirational. Network isolation is what makes the
+boundary *real*; the gateway and privsep are ergonomics and
+defence-in-depth layered on top.
+
+Suggested sequencing of the `area:ops` issues:
+
+1. **Gateway** first — pure ergonomics win, unblocks same-origin
+   (lets the cross-origin CORS shim on `/answer-question/{id}` go
+   away), no behavioural risk.
+2. **Network isolation** next — the step that makes the boundary
+   real. Everything before it is honour-system.
+3. **Privsep** last — defence in depth on the core process
+   itself; valuable independent of the other two, but the
+   biggest refactor.
diff --git a/docs/conventions.md b/docs/conventions.md
new file mode 100644
index 00000000..f61a56ae
--- /dev/null
+++ b/docs/conventions.md
@@ -0,0 +1,79 @@
+# Conventions
+
+Code-style and process expectations across the workspace. Most of these
+exist because something already went wrong without them.
+
+## Naming
+
+- Containers are length-bounded by `nixos-container` (≤ 11 chars).
+- Sub-agents are `h-<name>` with `<name>` ≤ 9 chars.
+- The manager is `hm1nd` (no `h-` prefix, fixed name).
+- `MAX_AGENT_NAME` in `lifecycle.rs` enforces the cap.
+- Per-agent web UI port = `WEB_PORT_BASE + FNV1a(name) % WEB_PORT_RANGE`
+  (8100..8999); manager fixed at 8000; dashboard `cfg.dashboardPort`
+  (default 7000).
+
+## Identity = socket
+
+There are no auth tokens on the per-agent unix sockets. The socket
+*path* identifies the principal; perms come from "who has the
+bind-mount." A sub-agent only sees its own `/run/hive/mcp.sock`; the
+manager has access to its privileged socket; hive-c0re owns the host
+admin socket.
+
+## Wire protocol
+
+JSON line-delimited over unix sockets in both directions (host admin
+/ manager / agent). SSE streams (`/dashboard/stream` on hive-c0re,
+`/events/stream` on the per-agent web UIs) are `text/event-stream`;
+each frame carries a `seq` field for the snapshot-dedupe dance
+(see `docs/web-ui.md`). Request/response types live in `hive-sh4re`
+— change them in one place. The dashboard event vocabulary lives
+in `hive-c0re::dashboard_events::DashboardEvent`.
+
+## Async forms
+
+Dashboard + per-agent mutating forms carry `data-async`; a delegated
+`submit` listener in `assets/tabs.js` intercepts, shows a spinner,
+POSTs `application/x-www-form-urlencoded` (axum's `Form` extractor
+rejects multipart), calls `refreshState()` on success. New mutating
+forms should add `data-async` and optionally `data-confirm` (for a
+JS-side `confirm()` prompt) or `data-prompt="…"` (for a
+`window.prompt()` whose answer goes into a hidden input named by
+`data-prompt-field`, default `note`).
+
+`refreshState` defers automatically when `document.activeElement`
+sits inside a managed section so the operator's typing isn't lost;
+collapsible `<details data-restore-key=…>` survive the re-render
+via `snapshotOpenDetails` / `restoreOpenDetails`.
+
+## `rebuild` is the reconcile verb
+
+`lifecycle::rebuild` idempotently rewrites
+`/etc/nixos-containers/<C>.conf` (`PRIVATE_NETWORK=0`, clears
+`HOST_ADDRESS` / `LOCAL_ADDRESS`, sets `EXTRA_NSPAWN_FLAGS`),
+regenerates `applied/<name>/flake.nix`, writes the systemd limits
+drop-in, then `nixos-container update` + stop + start.
+
+Anything that changes per-container state on the host should be
+re-applied here so a manual `↻ R3BU1LD` from the dashboard is
+sufficient to recover.
+
+## Actions are factored
+
+`approve` / `deny` / `destroy` (and the lifecycle helper) live in
+`actions.rs` / `dashboard.rs`. The admin socket and the dashboard
+POST handlers both call into them so the two surfaces never drift.
+
+## Commit messages
+
+Short, lowercase, no `Co-Authored-By` trailer. Imperative mood, no
+period. Body explains *why* if non-obvious; otherwise the subject
+alone is fine. Wrap at ~72 cols.
+
+## Commit before test
+
+Stage and commit when work *looks* ready, then run validation
+(`cargo check`, `nix flake check`, real deploy). Failures get a
+follow-up commit rather than an amend. The commit history is the
+work log; rewriting it loses signal.
diff --git a/docs/damocles-migration.md b/docs/damocles-migration.md
new file mode 100644
index 00000000..3dd649d7
--- /dev/null
+++ b/docs/damocles-migration.md
@@ -0,0 +1,73 @@
+# Migrating damocles onto hyperhive
+
+The plan calls out damocles → hyperhive as a future migration. This doc lays
+out the options + recommended path. Not yet executed.
+
+## Current state (separate from hyperhive)
+
+`damocles` is a declarative nixos-container on `muede-lpt2`:
+
+- Declared in `nixosConfigurations/muede-lpt2/containers.nix`
+- Built from `nixosConfigurations/damocles/` (claude-container.nix + extras)
+- Bind-mounts (RO unless noted):
+  - `/etc/nix/distributed-build-key`
+  - `/persist/damocles-ssh`
+  - `/persist/damocles-lab` (RW — persistent work dir)
+- `privateNetwork = false`
+- Has its own systemd-services override (`TimeoutStopSec = 60s`, `RestartSec = 5s`)
+- Hosts the user's primary day-job Claude Code session, not part of the swarm
+
+## Options
+
+### A. Sub-agent under hive-c0re
+Make damocles a `hive-agent-damocles` (or whatever short name fits the 9-char cap).
+hive-c0re owns its lifecycle; its config flake is the manager-editable
+`/var/lib/hyperhive/agents/damocles/config/`.
+
+Pros: uniform — message broker, dashboard, approval flow apply to damocles too.
+Cons: a lot of damocles-specific state (bind-mounts, ssh keys, build keys) has to
+be modeled as per-agent config. Today's `agent.nix` schema doesn't support
+declaring bind-mounts; would need to extend. And the user's day-job session
+becoming subject to hive-c0re lifecycle (restarts on rebuild) is invasive.
+
+### B. Peer container (broker-integrated, lifecycle-independent)
+Keep damocles declarative; have its harness install `hive-ag3nt` and connect to
+the broker via a bind-mounted socket. damocles can send/recv messages with
+other sub-agents but is not managed by hive-c0re.
+
+Pros: low blast radius. damocles keeps its bind-mounts + its own restart policy.
+Manager can route messages to it (it's just another inbox key on the broker).
+Cons: two lifecycle mechanisms coexist forever; "damocles" doesn't appear in the
+dashboard's container list (it filters `hive-` and `hm1nd`).
+
+### C. Don't migrate
+damocles stays out of hyperhive. The two systems coexist; the user's day-job
+Claude and the swarm are deliberately separate.
+
+Pros: zero work; aligns with the actual usage pattern (day-job vs. experiment).
+Cons: no message routing between damocles and the swarm.
+
+## Recommended
+
+**C for now, B once cross-pollination is wanted.** Hyperhive's invariants
+(11-char container names, manager-driven lifecycle, sealed `applied/` config)
+fit poorly with damocles's role as the user's working Claude. Wait until there's
+a concrete reason to wire them together (e.g. "I want to ask hm1nd from inside
+damocles") and then do B — extend the broker socket bind into damocles and
+install `hive-ag3nt` there. No need to subsume damocles under hive-c0re.
+
+If/when option B is taken:
+
+1. Add `${hyperhive.packages.${system}.default}/bin/hive-ag3nt` (or just
+   `pkgs.hyperhive`) to `nixosConfigurations/damocles/claude-container.nix`.
+2. Bind-mount `/run/hyperhive/agents/damocles/` into damocles at `/run/hive/`.
+   On the host, this is just another dir hive-c0re needs to know about —
+   maybe expose a "peer agents" registration mechanism in the broker.
+3. Run `hive-ag3nt serve` as a systemd unit inside damocles (separate from
+   the user's interactive claude session — broker peer, not turn-loop).
+4. Optionally: add a `hive-c0re register-peer damocles` admin verb so the
+   container appears in `list()` and the dashboard. (Or just hard-list it.)
+
+A is on the table only if the user's workflow shifts toward "the swarm IS the
+day-job environment" — at which point damocles dissolves into a `hive-agent-*`
+naturally.
diff --git a/docs/gotchas.md b/docs/gotchas.md
new file mode 100644
index 00000000..b85376d1
--- /dev/null
+++ b/docs/gotchas.md
@@ -0,0 +1,149 @@
+# Gotchas
+
+NixOS + nspawn quirks and lessons we hit the hard way. If something
+here looks unmotivated in the code, there's usually a story underneath.
+
+## `nixos-container` doesn't expose `--bind` on the CLI
+
+The CLI doesn't accept `--bind`. Path is via `EXTRA_NSPAWN_FLAGS` in
+`/etc/nixos-containers/<NAME>.conf` — the start script
+(`/nix/store/.../container_-start`) expands it unquoted into the
+`systemd-nspawn` invocation. `lifecycle::set_nspawn_flags()` rewrites
+this line.
+
+## `/run/systemd/nspawn/*.nspawn` overrides are ignored
+
+`nixos-container`'s start script builds the nspawn command line
+directly. Dropping a `.nspawn` file under `/run/systemd/nspawn/`
+looks like the obvious extension point and does nothing. Use
+`EXTRA_NSPAWN_FLAGS` (above).
+
+## `boot.isNspawnContainer = true`
+
+Not `boot.isContainer = true`. Renamed in nixos-25.11+.
+
+## `nixos-container create` auto-assigns `HOST_ADDRESS` / `LOCAL_ADDRESS`
+
+…in the `.conf`. The start script's `if HOST_ADDRESS set →
+--network-veth` branch then forces a private netns — silently fatal
+for our web UIs (the bind is invisible from the host). We
+force-clear `HOST_ADDRESS` / `LOCAL_ADDRESS` / `HOST_ADDRESS6` /
+`LOCAL_ADDRESS6` / `HOST_BRIDGE` and set `PRIVATE_NETWORK=0`.
+
+## systemd service PATH ≠ host PATH
+
+The hive-c0re service sets `path = [ pkgs.git "/run/current-system/sw" ]`.
+In-container harness services do the same so anything an agent adds
+to its own `agent.nix` (`environment.systemPackages`) is visible to
+claude's Bash tool without editing the service definition.
+`environment.HYPERHIVE_GIT` bakes git's absolute path in (read by
+`lifecycle::git_command()`) for the host.
+
+## `RuntimeDirectoryPreserve = "yes"`
+
+…keeps `/run/hyperhive/` (and the per-agent sub-dirs) across
+hive-c0re restarts. Without it, every restart wipes bind sources and
+existing containers can't be started.
+
+## `register_agent` is idempotent
+
+Drops any prior socket task before rebinding. Required so a
+hive-c0re restart followed by `rebuild alice` recreates the agent's
+socket without needing a clean reinstall.
+
+## `claude-code` is unfree
+
+The flake pins it to **nixpkgs-unstable** via
+`overlays.claude-unstable` (stable lags too far). The overlay sets
+`config.allowUnfreePredicate` on its unstable import to whitelist
+`claude-code` specifically — scoped, only this one package.
+`harness-base.nix` does the same at the container level because
+each per-agent `nixosConfiguration` evaluates its own nixpkgs
+instance and the operator's host-level `allowUnfree` does **not**
+propagate in. Operators don't need to set anything on their side.
+
+## Claude credentials are per-agent
+
+`/var/lib/hyperhive/agents/<name>/claude/` bind-mounts to
+`/root/.claude` (RW). Sharing one dir across agents is NOT viable —
+OAuth refresh tokens rotate, so any sibling refresh invalidates all
+the others. Login flow runs from the per-agent web UI; creds persist
+across `destroy`/recreate (`--purge` wipes them).
+
+## Persistent notes dir per agent
+
+`/var/lib/hyperhive/agents/<name>/state/` bind-mounts to `/state`
+(RW). System prompts tell agents to keep durable knowledge here
+(`/state/notes.md`, anything else under `/state/`). The harness also
+writes its events log here (`/state/hyperhive-events.sqlite`).
+Survives `destroy`/recreate alongside the claude dir.
+
+## Web UI ports collide on hash
+
+Sub-agent web UI ports are deterministic FNV-1a of the agent name
+modulo 900 (range 8100..8999). With ~30 agents the birthday-paradox
+collision rate gets meaningful; at 2–3 agents you can still get
+unlucky. Operator resolves a collision by renaming the offending
+agent (different hash → different port) and rebuilding. No state
+file, no probing, no port-allocation drift — the value is
+reproducible from just the name. Manager is fixed at 8000;
+dashboard at `cfg.dashboardPort` (default 7000).
+
+## Restart races on TCP bind
+
+Both the dashboard and per-agent web UI use `tokio::net::TcpSocket`
+with `SO_REUSEADDR` plus a retry-on-`AddrInUse` loop (12 tries,
+exponential backoff capped at 2s, ~22s total). REUSEADDR handles
+the `TIME_WAIT` case from a clean previous exit; retry covers the
+genuine "previous process is still alive during a systemd restart
+overlap" case. REUSEADDR does **not** allow two simultaneous
+`LISTEN` sockets on the same port (that would be `SO_REUSEPORT`,
+which we don't use) — exclusivity is preserved.
+
+## Orphan approvals
+
+If state dirs are wiped out from under a pending approval (test
+scripts, manual `rm -rf`), the dashboard's next render marks them
+`failed` with note `"agent state dir missing"` so they fall out of
+`pending`. They stay in sqlite for audit.
+
+## Nix store `cp -r` preserves read-only bits
+
+Copying a nix store path with `cp -r src/. $out/` inside a
+`pkgs.runCommand` derivation preserves the read-only permissions of
+store files. Any subsequent write into the copied tree (adding new
+files in subdirectories) fails with `EPERM`. Fix: pass
+`--no-preserve=mode,ownership` so the output tree is writable.
+
+## `hive-forge`: prefer over raw curl pipelines
+
+Every agent container has `hive-forge` in PATH (installed via
+`harness-base.nix`; lives in `/hive-forge` as a proper Rust binary
+since #280). Use it instead of ad-hoc curl pipelines:
+
+```bash
+hive-forge view 42                          # title + body + comments
+hive-forge comments 42                      # list all comments (human-readable)
+hive-forge --json comments 42               # same as above, JSON array (global flag, closes #421)
+hive-forge comment 42 --body "..."          # post comment (inline body)
+hive-forge comment 42 --body-file - <<EOF   # ...or pipe a HEREDOC
+multi-line body
+EOF
+hive-forge assign 42 damocles
+hive-forge close 42
+hive-forge labels 42 add feature
+hive-forge pr 42                            # PR metadata as JSON
+hive-forge diff 42                          # unified diff (lockfile hunks collapsed by default)
+hive-forge diff 42 --full                   # include unfiltered lockfile hunks
+hive-forge branches deployed/               # filter branches by pattern
+hive-forge -r other-org/other-repo pr 7     # target a different repo
+hive-forge lint unassigned                  # open issues/PRs with no assignee
+hive-forge lint no-reviewer --reviewer argus  # PRs missing a reviewer comment from argus
+hive-forge lint stale-branches --days 14    # branches with no recent activity
+hive-forge lint assignments                 # per-assignee open item count
+```
+
+`hive-forge <verb> --help` prints the full signature for any verb.
+Credentials come from `$HYPERHIVE_STATE_DIR/forge-token`; default
+repo from `$HIVE_FORGE_REPO`, overridden per-invocation by the
+global `-r/--repo` flag.
diff --git a/docs/persistence.md b/docs/persistence.md
new file mode 100644
index 00000000..8acd29f3
--- /dev/null
+++ b/docs/persistence.md
@@ -0,0 +1,167 @@
+# Persistence + retention
+
+Where state lives, what survives what, and how it's bounded.
+
+## Two sqlite databases
+
+### `/var/lib/hyperhive/broker.sqlite` (host)
+
+Three tables, all in one file:
+
+- `messages` — every inter-agent / operator-bound message.
+  `sender / recipient / body / sent_at / delivered_at / acked_at /
+  in_reply_to`. `in_reply_to` links a reply to its parent row id;
+  the dashboard and per-agent inbox render these as threaded rows.
+- `approvals` — the queue. `agent / kind (apply_commit | spawn) /
+  commit_ref / requested_at / status / resolved_at / note`.
+- `operator_questions` — `ask` / `answer` queue (despite the
+  file name, stores both operator-targeted + agent-to-agent
+  questions since the `ask` rename).
+  `asker / question / options_json / multi / asked_at /
+  deadline_at (ttl) / answered_at / answer / target`. `target IS
+  NULL` = operator path (dashboard); `target = '<agent>'` = peer
+  Q&A (`HelperEvent::QuestionAsked` pushed into target's inbox,
+  answered via `Answer` request). Migrated via `ALTER TABLE ADD
+  COLUMN` against `pragma_table_info`.
+
+Retention:
+
+- `Broker::vacuum_delivered` runs hourly via a tokio task in
+  `hive-c0re::main`. Drops delivered rows older than 30 days.
+  Undelivered rows are always kept (still in flight).
+- Approvals and questions are kept indefinitely — both are
+  audit trails. `actions::destroy` and answered questions stay
+  visible to anything that queries by id.
+
+### `/state/hyperhive-events.sqlite` (per agent)
+
+Lives inside each container's bind-mounted `/state/` dir (host
+path: `/var/lib/hyperhive/agents/<name>/state/hyperhive-events.sqlite`).
+One table:
+
+- `events(id, ts, kind, payload_json)` — every `LiveEvent` the
+  harness emits during turn loop execution.
+
+The harness writes; the host vacuums. `hive-c0re::events_vacuum`
+runs hourly and sweeps every existing agent state dir, deleting
+rows older than 7 days. Age-only — no row cap — so a chatty turn
+doesn't lose history sooner than a quiet one; disk pressure on a
+sustained burst is the cheaper problem to have. Centralising
+retention on the host means a misbehaving harness can't disable
+its own vacuum and agents don't need any cleanup wiring of their
+own.
+
+Path overridable via `HYPERHIVE_EVENTS_DB` (for dev / no-`/state`
+setups). On open failure the `Bus` falls back to no-store mode
+rather than crashing the harness — events still broadcast over SSE,
+just nothing persisted.
+
+### `/state/hyperhive-turn-stats.sqlite` (per agent)
+
+Per-turn analytics sink. One row per claude turn captures
+identity (`model`, `wake_from`, `result_kind`), timing
+(`started_at`, `ended_at`, `duration_ms`), cost (input / output /
+cache_read / cache_creation token counts), behaviour
+(`tool_call_count` + `tool_call_breakdown_json`), and post-turn
+snapshot metrics (`open_threads_count`,
+`open_reminders_count` — fetched via the same socket the harness
+already uses for `GetOpenThreads` + `CountPendingReminders`).
+Bin-loop helpers `build_row` + `record` land each row at
+`turn_end`; writes are best-effort, a sqlite hiccup logs + lets
+the turn loop continue.
+
+No host-side vacuum yet — tracked as forge issue
+[#10](http://localhost:3000/hyperhive/hyperhive/issues/10)
+(target retention ~90 days, age-only sweep like events_vacuum).
+
+### `/state/hyperhive-rate-limited` (per agent)
+
+Sentinel file written by `Bus::emit_status("rate_limited")` when the
+harness detects a 429 / rate-limit response from the Claude API, and
+removed when the retry sleep expires (any subsequent status emit
+clears it). The file's presence is checked by hive-c0re's
+`container_view::is_rate_limited` on each `build_all` sweep (~10s) to
+populate `ContainerView.rate_limited` for the dashboard. Survives a
+harness restart (the Bus reads it back at boot and restores the flag),
+so the badge remains accurate if hive-c0re restarts while the harness
+is mid-sleep.
+
+### `/state/hyperhive-model` (per agent)
+
+Single-line text file holding the claude model name currently
+selected for this agent (default `haiku` when absent). Written by
+`Bus::set_model` whenever the operator flips it via `/model
+<name>` in the web terminal. Read once at harness boot in
+`Bus::new`. Path overridable via `HYPERHIVE_MODEL_FILE`.
+Survives destroy/recreate, gone on `--purge`.
+
+## State dirs (per agent)
+
+Under `/var/lib/hyperhive/agents/<name>/`:
+
+- `config/` — the proposed nix repo (manager-editable). Bind-mounted
+  **read-only** to `/agents/<name>/config` inside the sub-agent's own
+  container so the agent can inspect what defines it and request
+  precise changes from the manager; RW into the manager via the
+  `/agents` tree bind.
+- `claude/` — claude OAuth credentials, bind-mounted RW to
+  `/root/.claude` inside the container.
+- `state/` — durable notes, the events.sqlite db, and the
+  turn-stats sqlite db. Bind-mounted to `/agents/<name>/state`
+  inside the container (the manager still uses the legacy
+  `/state` mount point — same host path either way).
+
+Under `/var/lib/hyperhive/applied/<name>/` — the hive-c0re-only
+applied repo. Tracks `flake.nix` (module-only boilerplate; never
+edited after first spawn) + `agent.nix` (the actual config; the
+manager's edits land here via the approval flow) + any other
+files the manager committed. `.git/` carries the proposal /
+approved / building / deployed / failed / denied tag history.
+
+Under `/var/lib/hyperhive/meta/` — the swarm-wide deploy flake.
+Single repo for the whole host; `flake.nix` declares one input
+per agent + one `nixosConfigurations.<n>` output per agent;
+`flake.lock` is the canonical "what's deployed where." The git
+log is the deploy audit trail (one commit per successful
+deploy or hyperhive bump). Manager has this RO-mounted at
+`/meta/`.
+
+Marker file `/var/lib/hyperhive/.meta-migration-done` is
+written by the startup migration after every container has
+been repointed at `meta#<n>`. Removing it forces a re-run on
+next hive-c0re start (idempotent — only the actual repoint
+step would re-fire).
+
+## Destroy vs purge
+
+- `DESTR0Y` (default) — stops + removes the nspawn container,
+  drops the systemd drop-in, fails any pending approvals. State
+  dirs stay put; the agent appears in the dashboard's K3PT ST4T3
+  section as a tombstone with `⊕ R3V1V3` and `PURG3` actions.
+  `R3V1V3` queues a Spawn approval that reuses the kept state on
+  approve (no re-login).
+- `PURG3` (opt-in via the dashboard button or
+  `hive-c0re destroy --purge <name>`) — DESTR0Y plus wipes
+  `/var/lib/hyperhive/{agents,applied}/<name>/`. Config history,
+  claude creds, /state/ notes, and the events db are all gone.
+  No undo.
+
+The manager is non-destroyable from both paths (declarative
+container; would fight with the host's NixOS config).
+
+## Run-time dirs
+
+`/run/hyperhive/` is tmpfs-backed (systemd `RuntimeDirectory=`) but
+preserved across hive-c0re restarts via `RuntimeDirectoryPreserve=yes`.
+Without that, every restart wipes bind sources and existing
+containers can't be started.
+
+- `/run/hyperhive/host.sock` — admin socket (host-side CLI).
+- `/run/hyperhive/manager/mcp.sock` — manager-privileged socket.
+- `/run/hyperhive/agents/<name>/mcp.sock` — per-sub-agent socket
+  (bind-mounted into the container as `/run/hive/mcp.sock`).
+
+On startup, `Coordinator::register_agent` drops any prior socket
+task before rebinding — idempotent so a hive-c0re restart followed
+by `rebuild alice` recreates the agent's socket without a clean
+reinstall.
diff --git a/docs/security.md b/docs/security.md
new file mode 100644
index 00000000..32c6951c
--- /dev/null
+++ b/docs/security.md
@@ -0,0 +1,33 @@
+# Security model
+
+## Nix builds and credential isolation (issue #240)
+
+### Background
+
+Agent containers bind-mount the host's `nix-daemon` socket. The host daemon may
+have `sandbox-fallback = false` (strict NixOS defaults), which causes `nix build`
+inside nspawn containers to fail — containers lack kernel user namespaces, so nix
+cannot set up its build sandbox. `harness-base.nix` sets `sandbox-fallback = true`
+so that builds fall back to unsandboxed execution rather than failing outright.
+
+### Threat model
+
+Unsandboxed nix builds run as `nixbld` users (non-root, typically UIDs 30001-30010).
+Without sandbox isolation, a build derivation's builder script has read access to
+any file in the container that the nixbld user can read.
+
+**What is NOT exposed**:
+
+- `/root/.claude/` — mode `0700`, owned by root. nixbld users cannot read it.
+- `/state/forge-token` — written at mode `0600` by `hive-c0re/src/forge.rs`.
+  nixbld users cannot read it.
+
+**Policy**: all credential files written to agent state directories MUST be mode
+`0600` or stricter. Do not create world-readable secret files in agent state dirs.
+
+### Long-term fix
+
+The proper fix is to enable user namespaces inside nspawn containers
+(`--private-users=inherit` in `EXTRA_NSPAWN_FLAGS`) so nix can set up its real
+sandbox and `sandbox-fallback` becomes a true last resort. This requires verifying
+bind-mount compatibility with user namespace UID mapping and is tracked as a TODO.
diff --git a/docs/terminal-rendering.md b/docs/terminal-rendering.md
new file mode 100644
index 00000000..fce8d21a
--- /dev/null
+++ b/docs/terminal-rendering.md
@@ -0,0 +1,114 @@
+# Per-agent terminal: row taxonomy (as built)
+
+Snapshot of how the per-agent web UI's live pane renders each
+event kind today. Source of truth lives in
+`frontend/packages/agent/src/app.js` (`renderStream`, `fmtToolUse`,
+`renderRichToolUse`, `renderToolResult`, `renderTaskEvent`,
+`mdNode`, `detailsOpenMd`, `fmtArgsGeneric`) +
+`frontend/packages/shared/src/terminal.css` (the shared
+`.live .<class>` styling) + the `marked` npm package (markdown).
+
+## Layout contract
+
+Every row — flat `<div class="row …">` and expandable
+`<details class="row …">` alike — shares one prefix column.
+The mechanism is `padding-left + negative text-indent` on
+`.live .row`: the row's first character (the prefix glyph)
+gets pulled back into the column at ~0.5em, and wrapped
+continuation lines hang under the body, not under the glyph.
+
+`<details>` summaries inherit those metrics. The disclosure
+marker (`▸` / `▾`) is supplied by CSS `summary::before` so it
+lands in the same column as flat-row glyphs. To make that
+work the JS-side summary text **does not** include a
+directional `→` / `←` — the row's colour (cyan = outbound,
+muted = inbound) carries the direction, and the prefix
+column never has to fit two glyphs side-by-side.
+
+Child blocks inside a row (the `.md` markdown wrapper, an
+inner `<details>`) get `text-indent: 0` so their content
+lays out from the body column instead of inheriting the
+parent's negative pull.
+
+## Row taxonomy
+
+| CSS class | Prefix glyph | Color | Triggered by | Source |
+|---|---|---|---|---|
+| `.turn-start` | `◆ TURN ← <from>` | amber, left rule | `LiveEvent::TurnStart` | harness wake |
+| `.turn-body` | (child div under turn-start) | fg | same | the wake-prompt body |
+| `.turn-end-ok` | `✓ turn ok` | green, left rule | `LiveEvent::TurnEnd { ok: true }` | harness |
+| `.turn-end-fail` | `✗ turn fail — note` | red, left rule | `LiveEvent::TurnEnd { ok: false }` | harness |
+| `.text` | (no prefix; markdown body) | fg | claude `assistant.content[].text` | stream-json |
+| `.thinking` | `· thinking …` | muted, italic | claude `assistant.content[].thinking` | stream-json |
+| `.tool-use` (flat) | `→  Name args…` | cyan | tool_use w/o rich renderer | stream-json |
+| `.tool-use` `<details>` | `Write/Edit <path> · +N` (no `→`) | cyan, body is +/- diff | `renderRichToolUse` Write/Edit | stream-json |
+| `.tool-use` `<details open>` | `send → to · NL`, `ask → to`, `answer #id` | cyan, body is markdown | rich renderer for send / ask / answer | stream-json |
+| `.tool-result` (flat) | `←  <txt>` | muted | short `tool_result` (≤120c, non-recv) | stream-json |
+| `.tool-result-block` `<details>` | `Nl · headline` | muted, body is text | long generic `tool_result` | stream-json |
+| `.tool-result-block` `<details open>` | `recv ← <txt>` | muted, body is markdown | `tool_result` correlated to a prior `recv` tool_use via id | stream-json |
+| `.tool-use` | `⌁  task <id> started · <desc> [type]` | cyan | claude Task-tool subagent start | `renderTaskEvent` |
+| `.turn-end-ok` / `.turn-end-fail` / `.tool-result` | `⌁  task <id> ✓/✗/◌ <status> · <desc> · → <output_file>` | green / red / muted | claude Task-tool result | `renderTaskEvent` |
+| `.note` | `· <text>` | muted | harness chatter | `LiveEvent::Note` |
+| `.note.stderr` | `! stderr: <line>` | amber/orange | stderr lines off claude | `LiveEvent::Note` (`text` starts `stderr:`) |
+| `.note.op` | `· operator: <text>` | mauve italic | operator-initiated notes (/cancel, /compact, /model, new-session) | `LiveEvent::Note` (`text` starts `operator:`) |
+| `.sys` | `! {json…}` | amber/orange | catch-all for stream shapes `renderStream` didn't classify | catch-all |
+| Banner shimmer | mauve | turn in flight (ref-counted) | — | `setBannerActive` |
+
+## Renderer dispatch
+
+`renderStream(v, api)` walks each stream-json line:
+
+1. Drops `system/init`, `rate_limit_event`, `result` (noise /
+   handled elsewhere — `result` powers the `cost` badge).
+2. `subtype == "task_started" | "task_notification"` →
+   `renderTaskEvent` (subagent activity gets the `⌁` glyph).
+3. `type == "assistant"` → walk `message.content[]`:
+   - `text` → `.text` row with a markdown body via `mdNode`.
+   - `thinking` → `.thinking` row.
+   - `tool_use` → record `id → name` in `toolNameById`, try
+     `renderRichToolUse` (Write/Edit/send/ask/answer get
+     custom renderings); on miss fall through to a flat
+     `.tool-use` row with `fmtToolUse → fmtArgsGeneric`.
+     `fmtToolUse` surfaces the salient arg per built-in tool —
+     e.g. `recv` shows `wait <N>s` / `max <N>` when set (bare
+     `recv()` otherwise), `Bash` flags `[bg]` for
+     `run_in_background` commands.
+4. `type == "user"` → walk `message.content[]` for
+   `tool_result`; `renderToolResult` correlates via
+   `tool_use_id → toolNameById` to default-open `recv`
+   results with a markdown body, else short = flat /
+   long = collapsed details.
+5. Unrecognised shape → `.sys` row (amber, `!` glyph).
+
+## Markdown
+
+`mdNode(text)` wraps `marked.parse(text)` (the `marked` v4.x npm
+dep, bundled by esbuild into the page's `app.js`) in a `<div
+class="md">`. CSS in `terminal.css` scopes paragraph / code /
+list / blockquote / link styling under `.live .row .md` so
+the markdown body doesn't bleed into the row's own
+text-indent. Falls back to plain text if `marked` didn't
+load. Applied to `text` rows and to send / ask / answer /
+recv message bodies.
+
+## Extra-MCP tools
+
+`fmtArgsGeneric(name, input)` is the fallback when a tool
+isn't in the built-in `fmtToolUse` switch:
+
+- single string field → `name k: "v"`
+- single number/bool field → `name k: v`
+- multi-field → first 4 pairs trimmed to `k: "v"` /
+  `k: [N]` / `k: {…}` with a `…+N` overflow
+
+This keeps `mcp__matrix__send_message` and similar from
+dumping raw JSON.
+
+## Dashboard side (not covered here)
+
+The main dashboard's message-flow pane is a different
+shape: broker messages render as `.msgrow` grid lines (ts /
+arrow / from / → / to / body) with their own styling.
+`.live .msgrow` explicitly resets `text-indent: 0` so the
+per-agent terminal's hanging-indent metrics don't leak into
+the flex-grid broker rows.
diff --git a/docs/turn-loop.md b/docs/turn-loop.md
new file mode 100644
index 00000000..339137ca
--- /dev/null
+++ b/docs/turn-loop.md
@@ -0,0 +1,423 @@
+# Turn loop + MCP
+
+How the harness wakes up, what it asks claude to do, and what tools
+claude has access to in return.
+
+## The loop
+
+Each agent harness (`hive-ag3nt serve` or `hive-m1nd serve`) runs:
+
+1. Long-poll `Recv` on its socket. The host-side broker
+   (`broker.rs::recv_blocking_batch`) returns immediately if there's
+   a pending message, otherwise waits up to 30 s for a broker `Sent`
+   event for this recipient.
+2. Pop one message. Peek the remaining inbox depth with `Status`.
+3. Emit `LiveEvent::TurnStart { from, body, unread }` onto the SSE
+   bus.
+4. Spawn claude (one process per turn) and pipe the wake prompt
+   over stdin.
+5. Stream stdout (JSON lines) into the bus as
+   `LiveEvent::Stream(value)`. Pump stderr as `Note`.
+6. Wait for claude to exit. Compaction is two-pronged — *reactive*
+   on `Prompt is too long` and *proactive* on a context watermark
+   (see [Compaction](#compaction) below). **Rate-limit detection**:
+   on stderr the harness does a raw-line match for `429` /
+   `rate_limit` markers; on stdout it only fires on parsed
+   `{"type":"error"}` JSON events (avoiding false positives when
+   agents discuss `rate_limit_error` in conversation text). On
+   detection the harness sets the `rate_limited` sentinel
+   (`Bus::emit_status("rate_limited")`), sleeps
+   `HIVE_RATE_LIMIT_SLEEP_SECS` (default 300), then retries.
+   The dashboard and per-agent page show a `⊘ rate limited` badge
+   while the harness is parked. **Auth-failed detection** (closes
+   #419): both stdout and stderr pumps also match
+   `AUTH_FAIL_MARKERS` (`"authentication_failed"`, `401`, etc.).
+   On match the harness writes `{state_dir}/hyperhive-needs-login`,
+   emits `needs_login_idle` status, requeues the inflight message
+   (so it replays after re-auth), and parks in `wait_for_login` —
+   the same path used at boot. The operator re-authenticates via
+   the per-agent web UI login flow; on success the sentinel is
+   cleared and the queued message drives the next turn normally.
+7. Emit `LiveEvent::TurnEnd { ok, note }`. Sleep `poll_ms` to avoid
+   tight loops on transient failures.
+
+## The claude invocation
+
+```
+claude --print --verbose --output-format stream-json --model <name> \
+  --continue --settings /run/hive/claude-settings.json \
+  --system-prompt-file /run/hive/claude-system-prompt.md \
+  --mcp-config /run/hive/claude-mcp-config.json --strict-mcp-config \
+  --tools <builtins> --allowedTools <builtins+mcp>
+# wake prompt piped over stdin
+```
+
+`<name>` is read from `Bus::model()` on each turn. The initial
+default is set by `hyperhive.model` in the agent's `agent.nix`
+(NixOS option; propagates via `HIVE_DEFAULT_MODEL` env var; falls
+back to `"haiku"` if unset). The operator can flip it at runtime
+with `/model <name>` in the web terminal — the next turn picks it
+up. The choice is persisted to `/state/hyperhive-model` so it
+survives restart; override path: `HYPERHIVE_MODEL_FILE` env var
+for tests.
+
+Context-window size is looked up per-model via
+`events::context_window_tokens(model)`. Resolution order (first
+match wins):
+
+1. `HIVE_CONTEXT_WINDOW_TOKENS_<KEY>` env var, where `KEY`
+   (lowercased) is a substring of the active model name. Injected
+   by the meta flake from `services.hive-c0re.contextWindowTokens`
+   (host-level NixOS option, defaults: haiku=200k, sonnet=1M,
+   opus=1M). Override these for all agents at once without a
+   per-agent config change.
+2. `HIVE_CONTEXT_WINDOW_TOKENS` — single global override for any
+   model (useful in dev / test).
+3. Hard fallback: `200_000` (conservative; only reached outside
+   NixOS where the env vars aren't set).
+
+The effective window drives watermarks and is exposed at runtime
+via `/api/state.context_window_tokens` so the UI can show a
+percentage-of-window ctx badge.
+
+`--continue` keeps a persistent session per agent (claude stores
+sessions in `~/.claude/projects/`, which is bind-mounted
+persistently). Auto-compact and auto-memory are disabled via
+`--settings` because hyperhive owns compaction — see
+[Compaction](#compaction) below.
+A one-shot `--continue` suppression is available via
+`POST /api/new-session` (or `/new-session` slash command in the
+per-agent terminal) — `Bus::take_skip_continue()` flips an
+`AtomicBool` once per turn, the next claude invocation drops
+`--continue`, every subsequent turn resumes normal behaviour.
+
+### Compaction
+
+claude's own in-session auto-compact is off (`--settings`); hyperhive
+owns it explicitly in `turn::drive_turn`. There are two triggers:
+
+- **Reactive** — claude-code prints `Prompt is too long` (the
+  `PROMPT_TOO_LONG_MARKER`). The session is *already* past the context
+  window, so no turn can run on it — `drive_turn` runs `/compact`
+  straight away and retries the same wake-up prompt once. No
+  notes-checkpoint turn is possible here: the detail is gone.
+- **Proactive** — a turn finishes cleanly but the last inference's
+  context size (`Bus::last_ctx_usage().context_tokens()`) is at or
+  above a watermark. While the session is still healthy, `drive_turn`
+  injects one synthetic *notes-checkpoint* turn (`CHECKPOINT_PROMPT`
+  — "context is filling up, flush durable state into `/state` now")
+  and *then* runs `/compact`. This gives the agent a chance to
+  persist in-flight task state, decisions, and file paths before the
+  conversation detail collapses into a summary.
+
+The compact watermark defaults to **75% of `context_window_tokens(model)`**
+(dynamically derived — 150k for haiku, 750k for sonnet/opus). Override
+with `HIVE_COMPACT_WATERMARK_TOKENS` (absolute token count); set to `0`
+to disable proactive compaction entirely (the reactive path always
+applies). The proactive path is best-effort — a failed checkpoint turn
+or `/compact` is surfaced as a `Note` but never fails the turn that
+already succeeded. The operator can also force a compaction any time
+via `/api/compact`.
+
+- **Auto session-reset** — a third path that fires when both
+  conditions hold: context is ≥ a watermark (`HIVE_AUTO_RESET_WATERMARK_TOKENS`,
+  default **50% of `context_window_tokens(model)`**) AND the time since
+  the last turn exceeds the assumed prompt-cache TTL
+  (`HIVE_CACHE_TTL_SECS`, default `3600`).
+  Claude's prompt cache lives ~5 minutes; if the cache is already
+  cold, resuming with `--continue` pays the full re-upload cost of
+  the current context with no benefit over starting fresh. So:
+  `drive_turn` injects one `AUTO_RESET_CHECKPOINT_PROMPT` notes turn
+  ("flush state to files, cache is cold") then arms
+  `Bus::take_skip_continue()` for the real turn — the next turn runs
+  without `--continue`, starting a fresh session. Unlike proactive
+  compaction the session is dropped entirely, not compacted. Set
+  `HIVE_AUTO_RESET_WATERMARK_TOKENS=0` to disable.
+
+The child runs with `cwd = /state` (when the bind exists; falls
+back to the parent's cwd in dev), so any relative path in a tool
+call (`Read foo.md`, `Bash ls`, `Write notes.md`) lands in the
+agent's durable bind-mounted dir. CLAUDE.md auto-load walks
+upward from `/state` — drop a per-agent CLAUDE.md there if you
+want long-term hints that survive destroy/recreate.
+
+The wake prompt is intentionally minimal: just the popped message's
+`from`/`body`, plus an inline `({unread} more pending — drain via
+…)` hint when `unread > 0`. Claude drives any further `recv`/`send`
+itself via the embedded MCP server.
+
+Whenever hive-c0re starts / restarts / rebuilds a container, it
+also drops a `system` message into the agent's inbox via
+`Coordinator::kick_agent` — a one-line "you were just (re)started,
+check /state/ for your notes, --continue session is intact". The
+next turn picks it up like any other inbox message.
+
+### On-boot files
+
+`hive_ag3nt::turn::write_*` writes three files next to the per-agent
+socket at `/run/hive/` once at startup:
+
+- `claude-mcp-config.json` — re-invokes the running binary as `mcp`
+  child (so the same binary serves as harness + as claude's MCP
+  child process).
+- `claude-settings.json` — the `--settings` blob (auto-compact and
+  auto-memory off, effortLevel medium).
+- `claude-system-prompt.md` — rendered from
+  `hive-ag3nt/prompts/{agent,manager}.md` with `{label}` and
+  `{operator_pronouns}` substituted. Pronouns come from
+  `HIVE_OPERATOR_PRONOUNS` env (set by the meta flake from
+  `services.hive-c0re.operatorPronouns`, default `she/her`).
+  Passed via `--system-prompt-file`.
+
+The shared per-turn plumbing lives in `hive_ag3nt::turn::{write_mcp_config,
+write_settings, write_system_prompt, run_turn, drive_turn,
+emit_turn_end, wait_for_login, compact_session}` so the two binaries
+can't drift.
+
+## MCP surface
+
+The harness ships an embedded MCP server (rmcp 1.7). Claude launches
+it as a stdio child via `--mcp-config`. The hyperhive socket name is
+`hyperhive`, so the tools land in claude as `mcp__hyperhive__<tool>`.
+
+### Sub-agent tools
+
+- `send(to, body, in_reply_to?)` — message a peer (logical agent
+  name), another agent, or the operator (recipient `operator`,
+  surfaces in the dashboard inbox). Optional `in_reply_to: i64`
+  links this message to a prior message id for thread rendering
+  in the dashboard message flow and the per-agent inbox.
+- `recv(wait_seconds?, max?)` — drain inbox messages. Without
+  `wait_seconds` (or with `0`) returns immediately, a cheap
+  "anything pending?" peek. Positive value parks the turn up
+  to that many seconds (cap 180) — incoming messages wake
+  instantly, otherwise returns empty at the timeout. `max`
+  (default 1, server-side cap 32) drains up to N popped rows
+  in one round-trip; `wait_seconds` applies to the *first*
+  message, then the call drains up to `max` total.
+- `ask(question, options?, multi?, ttl_seconds?, to?)` —
+  surface a structured question. Same shape as the manager's;
+  recipient defaults to the operator (dashboard) but can be set
+  to a peer agent name via `to: "<agent>"`. Answer routes back
+  to the asker's own inbox as `HelperEvent::QuestionAnswered`
+  via `coord.notify_agent`. For peer questions the recipient
+  sees a `HelperEvent::QuestionAsked` event and replies with
+  `answer(id, answer)`.
+- `answer(id, answer)` — respond to a `question_asked` event
+  routed to this agent. Authorisation is strict: only the
+  declared target (or the operator via the dashboard) can
+  answer.
+- `get_loose_ends()` — list everything still pending against
+  this agent: unanswered questions it asked / was asked, plus
+  reminders it scheduled. Each row carries an id + kind for
+  `cancel_loose_end`.
+- `cancel_loose_end(kind, id)` — withdraw a `question`
+  (posts `[cancelled by <self>]` to unblock the asker), a
+  `reminder` (hard-delete before fire), or (manager only) an
+  `approval` (transitions to `Cancelled`; sub-agents refused with a
+  clear error). Sub-agents may only cancel rows they own.
+- `remind(message, due)` — schedule a reminder that lands in
+  this agent's own inbox at a future time (sender shows as
+  `reminder`). Large payloads spill to
+  `/agents/<self>/state/reminders/` with the inbox message a
+  short pointer. Each agent's pending-reminder count is capped
+  (default 50, override via `HIVE_REMIND_MAX_PENDING_PER_AGENT`);
+  scheduling a new one fails if the cap is already hit.
+- `set_status(text)` — set a free-text status string visible on
+  the operator dashboard. Persisted to
+  `{state_dir}/hyperhive-status`; survives harness restarts. Pass
+  an empty string to clear.
+- `get_agent_meta(name?)` — fetch identity + status metadata for
+  an agent: `{ name, role, hyperhive_rev, running, status_text,
+  status_set_at }`. Pass `name` to query a peer (e.g. check
+  whether a sub-agent is idle before sending it work). Omit
+  `name` to get your own identity stamp — replaces the previous
+  `whoami` tool. `running` is `true` when the container is up.
+  When `running` is `false` the host clears `status_text` /
+  `status_set_at` (they would be stale snapshots from before the
+  container stopped) before serving the response. Status fields are
+  also `None` when the target has never called `set_status` or
+  has cleared it.
+- `request_next_turn()` — ask the harness to start another turn
+  immediately after this one ends, even if the inbox is empty. Use for
+  multi-turn tasks (long builds, sequential steps) where you want to
+  continue without waiting for an external message. The next turn starts
+  with `from: "self"` and `body: "continue"`. No-op if new inbox
+  messages arrive before this turn ends. No args.
+
+### Waking the agent from inside the container
+
+External MCP servers (and any other in-container process) can
+inject a wake-up event into the agent's inbox via the per-agent
+socket at `/run/hive/mcp.sock`. Two equivalent paths:
+
+- **Shell out to `hive-ag3nt wake --from <label> --body <text>`**
+  (use `--body -` to read body from stdin). Already on the
+  container's `PATH` since the harness binary is in
+  `systemPackages`. Convenient for shell-script integrations.
+
+- **Speak the wire protocol directly** — JSON-line over the
+  unix socket: `{"cmd":"wake","from":"matrix","body":"new dm
+  from @alice"}\n`. Same shape any other AgentRequest uses;
+  see `hive-sh4re::AgentRequest::Wake`.
+
+The wake event lands in the broker as `{from:<label>,
+to:<agent>, body}`, which wakes whatever `recv` call the
+harness is currently blocked on. Next turn fires with the
+wake prompt formed from that message — claude sees "from:
+matrix" (or whatever label) and reacts.
+
+Identity = socket: anything that can connect to
+`/run/hive/mcp.sock` is implicitly trusted to inject these,
+which is fine because the bind-mount is the agent's own
+container only.
+
+### Extra MCP servers (per-agent)
+
+Each agent's NixOS config can declare additional MCP servers via
+`hyperhive.extraMcpServers.<key> = { command, args, env,
+allowedTools }`. The module writes the map to
+`/etc/hyperhive/extra-mcp.json`; the harness reads it at boot and
+merges every entry into `--mcp-config` (under `mcpServers.<key>`)
+and `--allowedTools` (as `mcp__<key>__<pattern>`). The agent's
+flake.nix forwards every flake input to `agent.nix` as the
+`flakeInputs` module arg, so external MCP-server flakes are pulled
+in by adding them to `inputs.*` and referenced as
+`flakeInputs.<name>.packages.${pkgs.system}.default` — the
+resolved sha lands in the agent's own `flake.lock` and rolls up to
+meta's.
+
+### Manager tools (in addition to send/recv)
+
+- `request_init_config(name, description?)` — first step of a
+  two-step spawn. Queues an `InitConfig` approval (≤9 char name);
+  on operator approve, hive-c0re seeds the proposed config repo
+  with a default `agent.nix` template and sends the manager a
+  `HelperEvent::ConfigReady { agent }`. The manager then edits
+  `agent.nix`, commits the changes, and calls `request_apply_commit`
+  with the commit sha — the first ApplyCommit on a freshly-init'd
+  config creates the container. Fails if a proposed repo for this
+  name already exists. (The pre-#442 path through a separate
+  manager-side `request_spawn` was removed; operator can still
+  direct-spawn an empty agent from the dashboard's `◆ R3QU3ST SP4WN`
+  button which routes via `HostRequest::RequestSpawn`.)
+- `kill(name)` — graceful stop. No approval required.
+- `start(name)` — start a stopped sub-agent. No approval.
+- `restart(name)` — stop + start. No approval.
+- `update(name)` — rebuild (re-applies the current hyperhive flake
+  + agent.nix, restarts). No approval, idempotent. Manager calls
+  this on receipt of a `needs_update` system event.
+- `request_apply_commit(agent, commit_ref)` — submit a config
+  change for any agent (`hm1nd` for the manager's own config) for
+  operator approval.
+- `request_update_meta_inputs(inputs?, description?)` — queue an
+  approval to run `nix flake update [inputs...]` on the meta flake.
+  Pass specific input names (e.g. `["bitburner-agent"]`) or omit
+  for all. Returns immediately; lock update runs on operator
+  approval. Does NOT trigger rebuilds — call `update(name)` on
+  affected agents after approval resolves.
+- `ask(question, options?, multi?, ttl_seconds?, to?)` —
+  surface a structured question to the operator (default) or a
+  sub-agent (`to: "<agent>"`). Non-blocking — returns the
+  queued question id; the answer arrives later as
+  `HelperEvent::QuestionAnswered { id, question, answer,
+  answerer }` in the asker's inbox. Options always render
+  alongside a free-text fallback; `multi=true` renders options
+  as checkboxes. `ttl_seconds` auto-cancels with answer
+  `[expired]` (and `answerer: "ttl-watchdog"`) after the
+  deadline (useful for time-sensitive decisions that become moot
+  if no one has responded). The operator can also manually
+  cancel with `[cancelled]` via the dashboard.
+- `answer(id, answer)` — respond to a `question_asked` event
+  that was routed to the manager (a sub-agent did
+  `ask(to: "manager", ...)`). Surfaces in the asker's inbox as
+  the same `question_answered` event.
+- `get_logs(agent, lines?)` — fetch recent journal lines for a
+  sub-agent container (diagnose MCP-registration failures,
+  startup crashes, etc.). Pass the plain logical agent name;
+  hive-c0re resolves the machine name (`h-<name>`, manager
+  `hm1nd`). `lines` defaults to 50, host-capped at 500.
+- `request_schedule_prompt(targets, body, first_fire_at_unix, interval_seconds?, description?)` —
+  queue an operator-approval for a scheduled prompt. On approve,
+  `body` is fanned out to each `targets` agent at
+  `first_fire_at_unix`; recurring if `interval_seconds` is set,
+  one-shot otherwise. Even self-targeted schedules go through
+  approval (use `remind` for unapproved self-wake). Long downtime
+  fires once per recurring row on resume (catch-up clamp).
+- `edit_schedule(id, body?, description?, interval_seconds?, next_fire_at_unix?, targets_add?, targets_remove?)` —
+  partial-update a schedule (#474/#478). Pass only the fields to
+  change; absent fields are left alone. `targets_add` / `targets_remove`
+  mutate the recipient list in the same transaction; re-adding a
+  previously-cancelled target drops its tombstone + history (fresh
+  start). Clearing a scalar (e.g. `interval_seconds: null`) flips
+  recurring→one-shot. Refuses cancelled rows. Same authorization as
+  `cancel_schedule`.
+- `cancel_schedule(id, targets?)` — cancel a schedule. Omit
+  `targets` / pass empty to cancel the whole schedule; pass a list
+  to cancel just those recipients (auto-cancels when every target
+  is removed). Authorization: manager can cancel schedules it owns
+  or any owned by a sub-agent in its topology subtree.
+- `fire_schedule_now(id)` — fire a scheduled prompt out of band.
+  Runs the per-target fan-out once immediately. Recurring schedules
+  keep their cadence (the manual fire is additive); one-shot
+  schedules are consumed by the fire and cancelled afterwards. Same
+  authorization rules as `cancel_schedule`.
+- `list_schedules()` — snapshot every schedule (active +
+  cancelled-but-not-reaped): id, owner, body, per-target
+  `last_fired_at` + `last_result`, `next_fire_at_unix`,
+  `interval_seconds`. Use to look up an id before cancelling or to
+  audit upcoming wake-ups across the swarm.
+- `remind` / `get_loose_ends` / `cancel_loose_end` / `set_status`
+  / `get_agent_meta` — same as the sub-agent tools above.
+  `get_loose_ends` scopes to the manager's own items by default;
+  pass `agent: "*"` for a hive-wide view, or `agent: "<name>"`
+  to inspect one agent.
+  `cancel_loose_end` may cancel any agent's row.
+
+The boundary: lifecycle ops on *existing* sub-agents
+(`kill`/`start`/`restart`) are at the manager's discretion — no
+operator approval. Creating a new agent (`request_init_config` →
+`request_apply_commit` for the first sha) and changing any agent's
+config (`request_apply_commit`) still go through the approval queue.
+
+### Authoritative state
+
+`hive_ag3nt::events::Bus` carries the current turn-loop state in
+addition to the broadcast channel and the events history. Variants:
+
+- `Idle` — sitting on `Recv` waiting for mail.
+- `Thinking` — `claude --print` is running for a turn.
+- `Compacting` — operator-triggered `/compact` is in flight.
+
+The harness flips state at the relevant transitions
+(`set_state(Thinking)` before `drive_turn`, `set_state(Idle)`
+after; `set_state(Compacting)` around `compact_session`). Exposed
+via `/api/state.turn_state` + `turn_state_since` (unix seconds);
+the agent page renders this rather than deriving from SSE events.
+
+### Tool envelope
+
+`mcp::run_tool_envelope`: every MCP tool handler logs the request,
+runs the body, logs the result. Pre-/post-log only — the inbox
+status hint moved to the wake prompt + UI header.
+
+### Tool whitelist (`mcp::ALLOWED_BUILTIN_TOOLS`)
+
+- Allowed built-ins: `Bash`, `Edit`, `Glob`, `Grep`, `Read`, `Write`.
+- Denied by omission: `WebFetch`, `WebSearch`, `Task`,
+  `NotebookEdit`, `TodoWrite`.
+- Allowed MCP tools: as listed above per flavor.
+
+By default `Bash` is approved wholesale — any shell command runs
+without confirmation. To restrict an agent to specific command
+families, set `hyperhive.allowedBashPatterns` in its `agent.nix`:
+
+```nix
+hyperhive.allowedBashPatterns = [ "git *" "ls *" ];
+```
+
+The harness reads `/etc/hyperhive/bash-allow.json` and replaces
+`Bash` in `--allowedTools` with `Bash(git *)` + `Bash(ls *)` etc.
+Commands outside the pattern list require confirmation — which in
+`--print` mode means they will not run. An empty list (default) keeps
+the current wholesale `Bash` entry.
diff --git a/docs/web-ui.md b/docs/web-ui.md
new file mode 100644
index 00000000..9a840e47
--- /dev/null
+++ b/docs/web-ui.md
@@ -0,0 +1,821 @@
+# Web UI
+
+Two web surfaces share the same skeleton: the dashboard (port 7000)
+and the per-agent UIs (manager on :8000, sub-agents on a hashed
+:8100-8999). Both are SPAs — `GET /` returns a static shell,
+`/api/state` returns JSON, JS renders. No full-page reloads.
+
+## Shape (shared by both)
+
+- `GET /` → `index.html` from the bundled frontend dist (see
+  `frontend/`). Both binaries' routers declare their dynamic
+  endpoints first and then `fallback_service(ServeDir::new(...))`
+  pointed at `HIVE_STATIC_DIR` — anything not matched by an API or
+  action route is served from the dist. Dashboard dist lives at
+  `${frontend}/dashboard`; per-agent dist is the merged
+  `hyperhive.frontend.mergedDist` (default agent dist + per-agent
+  `extraFiles` overlay).
+- `GET /static/*` → bundled CSS + JS produced by esbuild
+  (`frontend/packages/{dashboard,agent}/build.mjs`). Both pages
+  pull the shared terminal pane + Catppuccin palette + typography
+  from `@hive/shared` (was `hive-fr0nt`); the CSS bundle inlines
+  `base.css` + `terminal.css` via esbuild's `@import` resolution.
+  `terminal.js` exports `{ create, linkify }` as ES module
+  members (no more `window.HiveTerminal` global outside the
+  back-compat shim the IIFE bodies still use). The dashboard's
+  `#msgflow` and the per-agent `#live` log are both backed by
+  this terminal — sticky-bottom auto-scroll, "↓ N new" pill,
+  history backfill, SSE plumbing all live there. Each page
+  registers a kind→renderer map; unknown kinds fall through to
+  a JSON-dump note row. Bare `http(s)://` URLs in row text are
+  turned into clickable new-tab links by `linkify` (text-node
+  based, no `innerHTML` — XSS-safe); markdown bodies get the
+  same treatment via `marked`'s autolink (npm dep, replacing the
+  vendored UMD bundle), with the rendered `<a>`s rewritten to
+  `target="_blank"` (issue #233).
+- `GET /api/state` → JSON snapshot the JS app renders into the
+  DOM. Includes a top-level `seq` (the dashboard event channel's
+  high-water mark at the moment the snapshot was assembled);
+  clients use it to dedupe their buffered SSE traffic against
+  the snapshot (drop frames with `seq <= snapshot.seq`).
+- `GET /dashboard/stream` (dashboard) / `GET /events/stream`
+  (per-agent) → `text/event-stream` SSE for live updates. The
+  dashboard stream carries broker `Sent` / `Delivered` (mirrored
+  by a forwarder task from the broker's intra-process channel)
+  plus mutation events (`approval_added` / `approval_resolved`,
+  `question_added` / `question_resolved`, `transient_set` /
+  `transient_cleared`). Each frame carries a `seq`. The
+  matching backfill endpoint is `GET /dashboard/history` (last
+  ~200 broker messages wrapped in `{ seq, events }`) on the
+  dashboard and `GET /events/history` (last 2000 `LiveEvent`s
+  also wrapped in `{ seq, events }`) on the agent.
+  **SSE multiplexing** (#448): the dashboard uses a
+  `SharedWorker` (`stream-worker.js`) to hold one upstream
+  `EventSource` per URL. All same-origin tabs share this worker
+  — a second dashboard tab joins the existing connection rather
+  than opening a duplicate. The worker fans SSE events out to
+  each subscribed tab via `MessagePort`; on bfcache restore the
+  page re-subscribes (gets a synthetic `open` event immediately
+  if the upstream is already connected). Falls back gracefully
+  when `SharedWorker` is unavailable (e.g. some private-mode
+  browsers).
+
+The JS app handles all `form[data-async]` submissions via a delegated
+listener: read `data-confirm`, swap the button to a spinner, POST
+`application/x-www-form-urlencoded`, re-enable the button on success
+(refreshState may keep the form mounted, so we don't rely on a
+re-render), call `refreshState()`. State shapes live in
+`dashboard.rs::StateSnapshot` and `web_ui.rs::StateSnapshot` — when
+adding state fields, plumb through the snapshot struct and the
+relevant `assets/tabs.js` render function.
+
+**Focus preservation:** `refreshState` checks whether
+`document.activeElement` sits inside one of the managed sections
+and, if so, skips the refresh (defers 2s). The operator never has
+the form yanked out from under them mid-type; the update lands as
+soon as they blur.
+
+**`<details>` open-state preservation:** any collapsible element
+tagged with `data-restore-key="<stable-key>"` survives the
+refresh. `snapshotOpenDetails()` walks managed sections before
+render, `restoreOpenDetails()` re-applies after. Long-content
+drill-ins (file previews, diffs, journald logs) now open in the
+**side panel** (see below) rather than expanding inline, so the
+only restore-keyed `<details>` left is the answered-questions
+history list.
+
+**Side panel (dashboard):** long content opens in a drawer that
+swipes in from the right — a singleton `#side-panel` with a
+titled header, a close button, and a scrollable body. Closes on
+the button, a backdrop click, or `Escape`. `Panel.open(title,
+node)` swaps the body; the JS builders for file previews,
+approval diffs, and journald logs all render into it. **The
+drawer width is drag-to-resize** (#451): a thin 6px hit-strip on
+the left edge captures pointer events, resizes the drawer in
+real-time (pointer capture keeps dragging even if the cursor
+outpaces the handle), and persists the chosen width to
+`localStorage` (key `hyperhive:side-panel-width`) so it
+survives page reload. Width is clamped to CSS `min-width: 320px`
+/ `max-width: 96vw`; the viewport-resize handler re-clamps
+persisted values after a window shrink. File
+previews are type-aware:
+
+- **Markdown** (`.md` / `.markdown`) — a `rendered` / `plain`
+  tabbed view: `rendered` (default) is the vendored `marked`
+  bundle (`GET /static/marked.js`), `plain` is the raw source.
+- **SVG** (`.svg`) — a `rendered` / `source` tabbed view;
+  `rendered` shows the image via an `<img>` `data:` URI (the
+  browser's secure static mode, so an untrusted SVG can't run
+  scripts), `source` shows the raw markup.
+- **Raster images** (`.png` / `.jpg` / `.gif` / `.webp` /
+  `.bmp` / `.ico` / `.avif`) — render as an `<img>` pointed at
+  `/api/state-file`, which serves them as binary with their
+  real content-type (text files stay UTF-8-lossy `text/plain`).
+- **Everything else** — raw text in a `<pre>`.
+
+Both bind their listeners with `SO_REUSEADDR` via
+`tokio::net::TcpSocket` plus a retry loop on `AddrInUse` (12 tries,
+exponential backoff capped at 2s) so an nspawn restart that races
+the previous process's socket release resolves itself.
+
+## Dashboard layout
+
+The dashboard (`/`) has a fixed chrome header at the top and a
+`<main>` that shows exactly one tab pane at a time. The URL hash
+(`#swarm`, `#call`, `#system`, `#schedules`) drives which pane is
+active; hash changes don't reload the page. FL0W is a separate
+full-page terminal at `/flow.html` — its tab-strip entry is a
+cross-page link (`◆ FL0W ◆ →`), not a pane swap.
+
+**Chrome header** (fixed, overlays the active tab pane):
+- **Tab strip**: `◆ SW4RM ◆`, `◆ Y3R C4LL ◆`, `◆ SYST3M ◆`,
+  `◆ SCH3DUL3S ◆`, and `◆ FL0W ◆ →` (page link). Count pills on
+  SW4RM (container count), Y3R C4LL (pending approvals +
+  questions), and SCH3DUL3S (active schedules); FL0W pill mirrors
+  the operator inbox length (hidden when zero).
+- **Notification controls**: `🔔 enable notifications` when
+  permission ungranted; `🔕 mute / 🔔 unmute` toggle once granted.
+  Always visible in the chrome regardless of active tab.
+- **Banner-thin** (`░▒▓█▓▒░ HYPERHIVE / HIVE-C0RE / WE ARE THE WIRED ░▒▓█▓▒░`)
+  — sits below the tab strip.
+
+### SW4RM tab
+
+**C0NTAINERS** — live containers rendered as a depth-first
+tree using `ContainerView.parent` (populated by `topology.rs`).
+Each container's row is prefixed with ASCII tree glyphs (`├─`,
+`└─`, `│  ` continuation columns) showing the agent
+parent/child hierarchy. When every container has `parent = null`
+(flat topology) the tree collapses to a plain list with no
+glyphs. Children are sorted alphabetically within each parent;
+roots likewise. Cycles in the parent graph are tolerated —
+orphaned containers (not reachable from any root) are appended
+as roots so no agent disappears. Pulsing red banner at the top
+of this section if any two sub-agents hash to the same port
+(`port_conflicts` from `/api/state`): the operator must rename
+one of them and rebuild. `lifecycle::{spawn,rebuild}` also
+preflight this and refuse with a clear error message naming the
+conflicting agent.
+
+`↻ UPD4TE 4LL` button appears above the containers list when any
+agent is stale.
+
+### Y3R C4LL tab
+
+Things blocked on operator decision — approvals and questions
+share a tab because they're the same concept ("something is
+waiting on you").
+
+**P3NDING APPR0VALS** — the queue (see "Approval card" below).
+The R3QU3ST SP4WN form lives at the top of this section.
+
+**M1ND H4S QU3STI0NS** — pending operator-targeted `ask`
+questions (amber pulsing border). Free-text fallback always
+rendered alongside any option list; `multi=true` renders options
+as checkboxes; submit merges selections + free text
+comma-joined. Each row has a `✗ CANC3L` button. Questions with
+a `ttl_seconds` show a `⏳ MM:SS` chip; the host-side watchdog
+auto-cancels with `[expired]` when the deadline fires.
+
+### SYST3M tab
+
+Passive / rare-interaction state.
+
+**M3T4 1NPUTS** — inputs in `meta/flake.lock` the operator can
+selectively `nix flake update`, rendered as an indented tree:
+every fetched input at every depth (`hyperhive`,
+`hyperhive/nixpkgs`, `agent-<n>`, `agent-<n>/mcp-<x>`, …), each
+shown once at its shallowest path. `read_meta_inputs` walks the
+lock graph with a `visited` set — `follows` aliases and rev-less
+nodes are skipped (issue #275). A `select all / select none`
+control sits above the tree. Checking inputs + submitting bumps
+the lock in `/meta/` and rebuilds the selected agents in
+sequence; each outcome reaches the manager as a `rebuilt`
+system event. `POST /meta-update`. While a lock-bump ripple runs,
+the panel shows a pulsing "⏳ meta-update running" banner and the
+update button is disabled (snapshot field `meta_update_running`,
+live event `meta_update_running`).
+
+**R3BU1LD QU3U3** — pending and recently-completed container
+operations: rebuilds, meta-update cascades, and first-spawns.
+One operation runs at a time; the worker drains FIFO. Each row
+shows a state glyph (`⏸` queued / `▶` running / `✔` done /
+`✖` failed / `⊘` cancelled), kind glyph + verb (`↻ rebuild`,
+`◆ meta_update`, `✨ spawn`, `🗑 destroy`), agent name, source
+chip (`manual | meta_update | auto_update | crash_recover | approval`
+— green for operator-approved config changes; #436),
+timing, and an optional reason / error. Meta-update cascade
+rebuilds nest under their parent entry (`parent_id` grouping;
+`rqe-child` CSS class). Dedup: re-enqueueing a still-queued op
+for the same agent collapses into the existing entry. Running
+entries tick elapsed seconds live, and when the worker has
+annotated the current phase (#437) a cyan `↳ <step>` sub-line
+appears under the main row showing the in-flight step name
+(e.g. `↳ meta prepare_deploy` → `↳ nixos-container update` →
+`↳ finalize deploy`). Terminal transitions clear `step` on the
+backend so Done / Failed rows don't render stale labels.
+Cold-loaded from `/api/state.rebuild_queue`; live updates via
+`rebuild_queue_changed` snapshot event.
+
+**K3PT ST4T3** — destroyed-but-state-kept tombstones (size +
+age + claude-creds badge). Two actions: `⊕ R3V1V3` (queues a
+Spawn approval; existing state is reused), `PURG3` (wipes
+state + applied dirs; `POST /purge-tombstone/{name}`).
+
+### SCH3DUL3S tab
+
+Anything that fires at a future time. Operator-set schedules
+go through the creation form at the top; agent self-paced
+reminders surface at the bottom as a sibling list (#460 —
+they share enough conceptual ground to live together).
+
+**N3W SCH3DUL3 / QU3U3D SCH3DUL3S** — operator-managed
+scheduled prompts (#444 / #459). Lists every schedule with
+its description, targets, body, recurrence interval, next-fire
+time, and per-target last-result. Per-row controls: a
+`↯ fire now` button sends an out-of-band manual pulse to
+every active target (#467 — recurring schedules keep their
+cadence; one-shots are consumed after the manual fire), an
+`✎ edit` button opens an inline edit form (#474 — body /
+description / interval / next-fire / targets all editable;
+targets are a multi-select diff'd against the original active
+set so unchecked-was-active = `targets_remove`, checked-not-
+originally-active = `targets_add`; submit PATCHes
+`/api/schedules/{id}`), and a
+`CANC3L` button cancels the whole schedule
+(`POST /api/schedules/{id}/cancel`). Individual target chips
+have their own cancel links. An inline creation form lets
+the operator queue a new schedule directly:
+targets (multi-select checkboxes drawn from live container
+names + `operator` + `manager`), prompt body (textarea),
+first-fire datetime-local (pre-filled to 5 minutes from now),
+an interval composer (#466 — preset chips for common
+durations + separate d/h/m/s number fields with a live
+"↻ every …" preview; all-zero = one-shot),
+and an optional human-readable description. On submit the
+form POSTs to `/api/schedules` as JSON; the tab pill shows
+the count of active schedules (at least one live target not
+yet cancelled). Refreshed on tab activation and after each
+submit/cancel. Backed by `GET /api/schedules`.
+
+**QU3U3D R3M1ND3RS** — reminders agents have scheduled for
+themselves (via the `remind` tool) but not yet delivered.
+Each row shows the owner, due time, and message; a `CANC3L`
+button hard-deletes (`POST /cancel-reminder/{id}`) and a
+`R3TRY` button re-arms one whose delivery failed
+(`POST /retry-reminder/{id}`). Backed by `GET /api/reminders`.
+Lives in the SCH3DUL3S tab alongside operator schedules so the
+operator has one place for everything time-fired (#460).
+
+### FL0W page (`/flow.html`)
+
+A dedicated full-page terminal (not a tab pane — a separate HTML
+page). Reuses the same `<header class="dashboard-chrome">` chrome
+as the dashboard so the tab strip remains visible; SW4RM / Y3R
+C4LL / SYST3M / SCH3DUL3S are cross-page links back to `/#<tab>`,
+and the FL0W entry is marked active (`aria-current="page"`).
+
+**0PER4T0R 1NB0X** — recent messages addressed to `operator`,
+derived client-side from the dashboard event stream. Cold load
+seeds from `/dashboard/history`'s 200-message backfill; subsequent
+`sent` events with `to == "operator"` are appended live. Cap 50,
+newest-first.
+
+**MESS4GE FL0W** — live broker tail wrapped in a `.terminal-wrap`.
+Cold load backfills the last ~200 messages from `/dashboard/history`;
+live frames arrive on `/dashboard/stream`. Each row is one broker
+event — `sent` or `delivered` — with `from → to: body`. Sticky-
+bottom auto-scroll + "↓ N new" pill. Below the stream sits a
+terminal-style compose box: `@name` picks the recipient (sticky via
+localStorage; auto-complete from the live container list, Tab/Enter
+to confirm; `@*` broadcasts). `POST /op-send` drops
+`{from:"operator", to, body}` into the broker; the resulting SSE
+frame re-renders both the terminal row and the inbox section.
+Manager is addressed as `@manager` (the broker recipient string),
+not `@hm1nd` (the container name).
+
+### Container row
+
+A full-height **square agent icon** (5em, capped) on the left. The
+icon is the **selection toggle**: click (or Enter/Space) adds/removes
+the agent from the selection set; `aria-pressed` reflects the state;
+the tooltip says "select … for bulk actions" or "deselect … (or press
+Esc to clear all)". The `<img>` points at `<url>/icon`; load failure
+falls back to the dimmed hyperhive mark (`/favicon.svg`). The card
+body sits to the right with three stacked lines
+(`assets/tabs.js::renderContainers`).
+
+- Line 1: agent name (link → new tab), m1nd/ag3nt chip, an
+  **icon-only nav strip** populated async from the agent backend
+  (`📊 stats`, `🖥 screen` when GUI is enabled, `⬡ forge profile`,
+  `↳ agent-configs mirror`, plus any agent-declared
+  `dashboardLinks` extras — issue #262). The dashboard JS fetches
+  `GET /api/agent/{name}/links`, a same-origin passthrough proxy
+  that forwards the agent's own link list; the agent backend is
+  the single source of truth. The frontend resolves each
+  `AgentLink.kind` (`container` → `http://host:<container.port>`,
+  `forge` → `http://host:3000`, `external` → already absolute).
+  **When the container is stopped** (`ContainerView.running = false`),
+  the host clears live-only fields before emitting the state, so
+  the dashboard never renders stale data: the badge chain is
+  replaced by a single muted `■ not running` badge, the nav-strip
+  fetch is skipped (the agent web server is down), and the
+  self-reported status text is suppressed. The agent icon goes
+  straight to the dimmed `/favicon.svg` fallback instead of
+  attempting a doomed load from the container's URL. Static fields
+  — `needs_update`, `deployed_sha`, `pending_reminders`, `parent`,
+  `config` link — remain visible regardless of run state.
+  When the container is running, status badges follow — `⊘ rate
+  limited` (red, while the harness is parked after a 429), `needs
+  login`, `needs update` — in-flight `◐ pending-state…` pill
+  (replaces buttons during operator-initiated start / stop /
+  restart / rebuild / destroy). Additionally, when a rebuild-queue
+  entry for this agent is `queued` or `running` but no
+  operator-initiated transient is set, the card surfaces a
+  `building…` / `meta-updating…` badge sourced from
+  `rebuildQueueState` (#398) — so the SW4RM tab shows the same
+  rebuild progress visible on the SYST3M tab's R3BU1LD QU3U3.
+  Container name + port, and a `ctx · Nk` chip showing the
+  agent's last-turn context size (from `ContainerView.ctx_tokens`,
+  read from the turn-stats sqlite on each `build_all` sweep;
+  absent until the first turn). The chip colour (green / yellow /
+  red) is keyed off the model's real context window: `build_all`
+  resolves the last turn's model against the host's per-model
+  `contextWindowTokens` config and exposes it as
+  `ContainerView.context_window_tokens`; the badge goes yellow
+  ≥ 50% and red ≥ 75% of that window (the harness compaction
+  watermarks). When the window can't be resolved the badge falls
+  back to fixed 100k / 150k thresholds. (issue #66)
+- Line 2: status badges only (no per-card action buttons — actions
+  moved to the **selection bar**, see below).
+- Line 3: drill-in triggers —
+  - `↳ logs · <container>` — opens the side panel and lazy-
+    fetches journald via `GET /api/journal/{name}?unit=&lines=`
+    (`journalctl -M <container> -b --no-pager --output=short-iso`).
+    A unit dropdown (harness service / full machine journal) and
+    a refresh button live in the panel.
+  - Plain navigation links (config repo, forge profile,
+    `dashboardLinks` extras) now live in the icon-only nav strip
+    on Line 1 — see above (issue #262). The agent's `config` link
+    goes to the repo root; the deployed sha shows separately on
+    Line 1 as the `deployed:<sha>` chip, since the agent harness
+    can't know its own deployed commit.
+
+`↻ UPD4TE 4LL` button appears above the containers list when any
+agent is stale. Banner pulses on each broker SSE event
+(`pulseBanner` with a 4s grace timer).
+
+### Selection bar
+
+When one or more agents are selected (via icon click), a sticky
+frosted-mauve bar slides up from the bottom of the viewport
+(`#selection-bar`, `position: fixed; bottom: 0`). It shows:
+
+- **Count + names** — "N agents selected · name1, name2, …"
+- **Bulk action buttons** — only enabled when ALL selected agents
+  support the action; disabled with a tooltip naming the blockers
+  when the selection is mixed:
+  - `↺ R3ST4RT` — running agents only
+  - `■ ST0P` — running agents only (manager included; no special-case)
+  - `▶ ST4RT` — stopped agents only
+  - `↻ R3BU1LD` — always available
+  - `DESTR0Y` / `PURG3` — sub-agents only (disabled if manager selected)
+- **`✕ clear`** button + `Esc` key clear the entire selection.
+
+Stale selections (agents destroyed while selected) are pruned on
+every render before the bar appears.
+
+### Approval card
+
+Each pending approval renders as a card (`assets/tabs.js::
+renderApprovals`) with three stacked sections:
+
+- **identity header** — glyph, `#id`, agent, kind chip, (for
+  `apply_commit`) the short proposal sha as `<code>`, and a
+  right-aligned `requested <N> ago` relative time from
+  `ApprovalView.requested_at` — amber once the request has been
+  pending ≥ 1h so a stale approval stands out (issue #272).
+- **what-changed body** — the manager's description, then
+  drill-in triggers: `↳ view diff` opens the diff in the side
+  panel; `↳ commit on forge ↗` deep-links the proposal commit
+  into `agent-configs/<agent>` (shown only when `forge_present`).
+  Spawn approvals show a one-line "container will be created"
+  note instead.
+- **decision actions** — `◆ APPR0VE` and `DENY`. Deny pops a
+  `prompt()` for an optional reason carried to the manager as
+  `HelperEvent::ApprovalResolved.note`.
+
+The diff panel has a 3-way base toggle — **vs applied** (the
+running tree, served instantly from the diff already on the
+approval), **vs last-approved**, **vs previous proposal** — the
+latter two fetched on click from `GET /api/approval-diff/{id}
+?base=approved|previous`. Each line is classified client-side
+(`+` / `-` / `@@` / `--- ` / `+++ ` → add / del / hunk / file).
+
+A `pending · N` / `history · N` tab pair switches the section
+between the live queue and the last 30 resolved approvals.
+
+### Browser notifications
+
+Pure frontend (`Notification` API). Three signals trigger them:
+
+- new pending approval (per id, delta on `/api/state`)
+- new pending operator question (per id)
+- new broker message sent `to: "operator"` (live via SSE)
+
+First `/api/state` after page load seeds "seen" sets without
+firing — only items that arrive while the page is open count.
+Per-event tags (`hyperhive:approval:<id>`, `hyperhive:question:<id>`,
+`hyperhive:msg:<at>:<rand>`) so distinct events stack in the OS
+notification center instead of overwriting each other.
+`console.debug` logs at every block point (unsupported,
+permission ungranted, muted) for in-browser debugging. Click
+focuses the dashboard tab. localStorage-backed mute toggle
+silences without revoking the OS permission. Requires a secure
+context (HTTPS or localhost); on other origins the controls hide
+themselves. Browsers typically suppress notifications while the
+originating tab is focused — that's a browser-level decision,
+not ours.
+
+### Dashboard endpoints
+
+- `POST /approve/{id}` — approve a pending approval. Fires
+  `ApprovalResolved` on the dashboard event channel; client
+  updates derived approvals state from the event.
+- `POST /deny/{id}` (`note=<reason>`, optional) — deny a pending
+  approval with an optional operator-supplied reason. The reason
+  travels to the manager as `HelperEvent::ApprovalResolved.note`
+  and also rides on the dashboard's `ApprovalResolved` event.
+  Dashboard prompts via `window.prompt()` on click.
+- `POST /{rebuild,kill,restart,start,destroy}/{name}` — lifecycle.
+  `destroy` accepts `purge=on` to also wipe state dirs.
+- `POST /purge-tombstone/{name}` — wipe a tombstone's state dirs.
+- `POST /answer-question/{id}` — answer a pending operator question.
+- `POST /cancel-question/{id}` — cancel a pending question with
+  the sentinel `[cancelled]`. Same code path as a real answer.
+- `POST /request-spawn` — queue a Spawn approval.
+- `POST /update-all` — rebuild every stale container.
+- `POST /api/rebuild-queue/{id}/cancel` — drop a `Queued` entry
+  (#447). Refuses `Running` / terminal-state entries (in-flight
+  rebuilds can't be safely interrupted). Always 200; body is
+  `{"cancelled": true}` on a successful flip or
+  `{"cancelled": false}` when the entry was not in `Queued` state.
+- `POST /op-send` (`to=<name>`, `body=<text>`) — drop an
+  operator-authored message into `<name>`'s inbox. `to=*` fans
+  out to every registered agent. Returns 200; the broker
+  `Sent` event re-renders both the message-flow terminal and
+  the operator inbox without a snapshot refetch. Used by the
+  compose textbox under MESS4GE FL0W.
+- `GET /api/journal/{name}?unit=&lines=` — journalctl viewer for
+  a managed container; rendered in the side panel.
+- `GET /api/approval-diff/{id}?base=applied|approved|previous` —
+  on-demand unified diff for an `ApplyCommit` approval against
+  the chosen base (running tree / last approved proposal /
+  previous queued proposal). Raw diff text, classified
+  client-side. `GET /static/marked.js` serves the vendored
+  `marked` bundle the side panel uses for markdown previews.
+- `GET /api/state-file?path=<host-or-container-path>` — bounded
+  text read of a file under the per-agent `state/` subtree or
+  the shared `/var/lib/hyperhive/shared/`. Accepts the
+  container-view forms (`/agents/<n>/state/...`, `/shared/...`)
+  and the host form. Canonicalises + verifies the path stays
+  inside the allow-list, refuses anything but a regular file,
+  refuses `/agents/<n>/claude` / `config` subtrees, truncates
+  bodies at 1 MiB. Click-time backing for the inline path-link
+  preview.
+
+  Detection of which tokens *are* path links is done
+  **server-side at broker-message ingest**, not client-side:
+  the broker forwarder calls `scan_validated_paths(body)` —
+  same allow-list helper the read endpoint uses — and attaches
+  the verified file tokens to the event as `file_refs: Vec<String>`.
+  The client trusts that list and linkifies only those tokens,
+  so directories, missing files, and forbidden subtrees never
+  become anchors. No probe endpoint, no client-side regex
+  heuristics. Historical messages get the same treatment on
+  `/dashboard/history` backfill.
+- `GET /api/reminders` — list pending reminders for the
+  dashboard's queued-reminders panel.
+- `POST /cancel-reminder/{id}` — hard-delete a pending reminder.
+- `POST /retry-reminder/{id}` — re-arm a reminder whose delivery
+  failed (clears the failure state so the scheduler retries).
+- `GET /api/schedules` — list all schedules (active and
+  recently cancelled) for the SYST3M scheduled-prompts panel.
+- `POST /api/schedules` — operator-direct schedule create:
+  `{ targets, body, first_fire_at_unix, interval_seconds?, description? }`.
+  Agent-initiated schedules go through the approval queue instead
+  (manager MCP `request_schedule_prompt`).
+- `PATCH /api/schedules/{id}` — partial edit (#474). JSON body
+  `{ body?, description?, interval_seconds?, next_fire_at_unix?,
+  targets_add?, targets_remove? }`.
+  Missing key = "leave alone"; explicit `null` on
+  `description` / `interval_seconds` clears the field (so a
+  recurring schedule flips to one-shot when `interval_seconds`
+  is sent as `null`). `targets_add` is replace-on-conflict:
+  re-adding a previously-cancelled target drops the tombstone
+  and the target starts fresh (operator intent on re-add =
+  "this target is active again"). `targets_remove` delegates
+  to the same path as `cancel_targets` — tombstones preserve
+  audit, parent schedule auto-cancels when no active targets
+  remain. Refuses cancelled rows; returns the updated
+  `WireSchedule` on success.
+- `POST /api/schedules/{id}/cancel` — cancel a schedule. Body
+  `{ targets?: ["name", …] }` cancels just those recipients;
+  absent or empty body cancels the whole schedule.
+- `POST /api/schedules/{id}/fire-now` — out-of-band manual
+  pulse (#467). Fires the schedule body once immediately to
+  every active target. Recurring schedules: `next_fire_at_unix`
+  is untouched; the regular cadence continues. One-shots: the
+  schedule is consumed (cancelled) after the manual fan-out.
+  Per-target `last_result` is annotated as a manual fire so
+  the audit trail distinguishes scheduled fires from operator-
+  triggered ones.
+- `POST /meta-update` — `nix flake update` the selected
+  `meta/flake.lock` inputs, then rebuild the affected agents.
+- `GET /dashboard/stream` — unified live event channel:
+  broker `sent` / `delivered`, plus the mutation events listed
+  below. Each frame carries `seq`.
+- `GET /dashboard/history` — last ~200 broker messages
+  (wrapped as `{ seq, events }`) for the message-flow
+  terminal's backfill on page load.
+
+### Dashboard event channel
+
+Wire vocabulary on `/dashboard/stream` (kind tag is in the JSON
+payload):
+
+- `sent` / `delivered` — broker traffic, mirrored from the
+  intra-process channel by a forwarder task. Both carry `id: i64`
+  (the broker row id) and `in_reply_to: Option<i64>` for thread
+  rendering. The dashboard message-flow terminal renders reply
+  rows with a `↳ reply` tag that scroll-highlights the parent
+  row on click. Used by the message-flow terminal renderer and
+  the operator-inbox derived state.
+- `approval_added` (id, agent, approval_kind, sha_short, diff,
+  description) / `approval_resolved` (id, agent, approval_kind,
+  sha_short, status, resolved_at, note, description) — pending
+  queue + history mutations. Client mutates a derived store and
+  re-renders only the approvals section.
+- `question_added` (id, asker, question, options, multi,
+  asked_at, deadline_at, target) / `question_resolved` (id,
+  answer, answerer, answered_at, cancelled, target) — both
+  operator-targeted and peer (agent-to-agent) threads fire
+  these. The dashboard's questions pane surfaces both, with
+  filter chips (all / @operator / @peer / per-participant) and
+  an `0V3RR1D3` button on peer rows so the operator can
+  answer when an agent is stuck. The ttl watchdog fires
+  `question_resolved` with `answerer = "ttl-watchdog"` on
+  expiry.
+- `transient_set` (name, transient_kind, since_unix) /
+  `transient_cleared` (name) — lifecycle action spinners. The
+  client ticks the elapsed-seconds badge off `since_unix`
+  client-side, no polling.
+- `container_state_changed` (container: ContainerView) /
+  `container_removed` (name) — per-row container mutations,
+  emitted by `Coordinator::rescan_containers_and_emit` from
+  every mutation site (`actions::approve` post-spawn,
+  `actions::destroy`, the lifecycle_action wrapper,
+  `auto_update::rebuild_agent`) and from the 10s
+  `crash_watch` poll. Client upserts/removes by name; the
+  pending overlay is read from `transientsState` since the
+  payload doesn't carry it.
+- `rebuild_queue_changed` (seq, queue: `Vec<QueueEntry>`) —
+  full snapshot of the rebuild queue on every mutation (enqueue,
+  state transition, dedup collapse, terminal-history trim).
+  Same snapshot-over-diff rationale as `tombstones_changed` /
+  `meta_inputs_changed`: the list is small and the client's
+  `parent_id` grouping is most naturally re-derived from the
+  full list. Cold-loaded from `/api/state.rebuild_queue`.
+
+`/api/state` is **only fetched on cold-load and on the few
+forms that mutate non-event-derived state** (PURG3 +
+meta-update, since tombstones + meta_inputs aren't event-
+shaped yet). Every other section — approvals, questions,
+transients, containers, operator inbox, message flow —
+derives from `/dashboard/stream` after the initial snapshot,
+maintaining its own client-side store and applying events on
+top. The 5s periodic poll is gone.
+
+Generalised form helpers: `form[data-confirm="…"]` pops
+`confirm()` before submit; `form[data-prompt="…"]` pops
+`prompt()` and stashes the answer in a hidden input named by
+`data-prompt-field` (default `note`).
+
+## Per-agent page
+
+Three fixed-position layers frame a full-viewport terminal:
+
+**Fixed-overlay header** (`<header class="agent-header">`): frosted
+glass — `backdrop-filter: blur` lets scrolled terminal rows show
+through. Three flex columns (#394 redesign):
+
+- **Agent icon** (`<img class="agent-icon">`): fixed-size square
+  identity anchor (5em, `width: 5em; aspect-ratio: 1;
+  align-self: flex-start` — capped so a tall state-row doesn't
+  inflate the icon, #411). Falls back to the dimmed hyperhive mark
+  on load error.
+- **Main column** (`.agent-header-main`): two rows.
+  - Row 1 (`.agent-header-title-row`): title (`<h2 id="title">`) +
+    meta-nav (`<nav id="meta-links">`). Meta-nav renders
+    backend-supplied `StateSnapshot.links` as icon-only anchors — always
+    `📊 stats` (`kind = Container`); `🖥 screen` when VNC is enabled;
+    `⬡ forge` (profile) + `↳ config` (agent-configs mirror) when the
+    agent has a forge account; any `hyperhive.dashboardLinks` extras
+    (`kind = External`). A `↑ dashboard` link is prepended by the JS
+    so the host dashboard is one click away. `GET /api/agent/{name}/links`
+    is the single source of truth.
+  - Row 2 (`.agent-state-row`): alive badge + state badge + model chip
+    + ctx badge + cost badge + last-turn chip + cancel button.
+    - Alive badge: `● alive` (green) / `⊘ rate limited` (red) /
+      `◌ needs login` / `◌ logging in` / `○ offline` / `… connecting`.
+      Driven by `LiveEvent::StatusChanged`.
+    - State badge: `💤 idle` / `🧠 thinking` / `📦 compacting` /
+      `○ offline` / `… booting` + age suffix. Driven by
+      `LiveEvent::TurnStateChanged ({ state, since_unix })`.
+    - Model chip: `model · <name>`. Driven by `LiveEvent::ModelChanged`.
+    - Ctx badge: `ctx · 142k` — last inference's prompt size.
+      Tooltip shows % of window when `context_window_tokens` is known.
+    - Cost badge: `cost · 1.3M` — cumulative tokens billed across every
+      inference in the last turn (tool-heavy turns rebill the cached
+      prefix per call — cost signal, not size signal).
+    - Both driven by `LiveEvent::TokenUsageChanged { ctx, cost }` at
+      turn-end.
+    - `■ cancel turn` (visible while thinking) → `POST /api/cancel`.
+- **Right cluster** (`.agent-header-pills`): flyout pills + overflow.
+  - **Inbox pill** (`📬 inbox · N`): hidden when empty; click opens
+    the inbox flyout in the side panel.
+  - **Loose-ends pill** (`🪢 loose ends · N`): hidden when empty;
+    click opens the loose-ends flyout.
+  - **Overflow button** (`⋯`): always visible. Opens a frosted popover
+    (`#overflow-menu`, positioned outside the header to escape any
+    stacking context) with three rows: `↑ dashboard` (link), `↻ rebuild
+    container` (POST confirm, same action as the dashboard R3BU1LD
+    button), `↻ new claude session` (POST confirm → `POST
+    /api/new-session`; next turn drops `--continue`). Both destructive
+    actions require one extra click to acknowledge (#394 — rare ops
+    shouldn't live in the primary state strip).
+
+`/api/state` is fetched once on cold load (+ while
+`status === 'needs_login_in_progress'`); all other updates arrive via
+SSE. Snapshot includes `context_window_tokens` for the ctx badge tooltip.
+
+**Main content** (`<main class="agent-main">`): fills the viewport
+and scrolls behind the fixed header + footer.
+- `#status` overlay: empty when online; shows the login form / OAuth
+  URL when `status` is `needs_login_*`.
+- Terminal-wrap: live event tail (sticky-bottom auto-scroll +
+  `↓ N new` pill when not at bottom).
+
+**Fixed-overlay footer** (`<footer class="agent-composer">`): frosted
+glass, symmetric with the header. Contains the operator-input
+textarea (`#term-input`) — multi-line, Enter sends, Shift+Enter
+newlines, Tab-completes slash commands (see "Terminal-embedded
+prompt" below).
+
+**Side panel** (slide-in from right): singleton shared with the
+dashboard's side panel shape. Carries inbox and loose-ends flyouts
+(opened via the header pills) as well as long content (file previews,
+diffs, journald logs). Inbox flyout: last 30 messages addressed to
+this agent (`AgentRequest::Recent { limit: 30 }`); reply messages
+indented with `↳ reply ·` in amber. Loose-ends flyout: questions,
+approvals, and reminders pending against this agent (`GET /api/loose-ends`);
+question rows carry an inline answer form that POSTs cross-origin to
+the core dashboard's `/answer-question/{id}` so the operator answers
+*as operator* (see `docs/boundary.md`).
+
+### Live view
+
+Each agent runs an `events::Bus`: a `tokio::sync::broadcast<LiveEvent>`
+plus a sqlite-backed history at `/state/hyperhive-events.sqlite`.
+The harness emits `TurnStart { from, body, unread }`,
+`Stream(value)` (one per parsed stream-json line), `Note`,
+`TurnEnd { ok, note }`. The web UI:
+
+- fetches `GET /events/history` on page load and replays the last
+  2000 events (oldest first, with `.no-anim` so they don't
+  stagger);
+- then subscribes to `GET /events/stream` (SSE) for live tail;
+- shows a granular state badge above the terminal, driven
+  authoritatively from `/api/state.turn_state`. SSE turn_start /
+  turn_end still flip the badge instantly between renders;
+- sticky-bottom auto-scroll: scrolling up parks the view; new rows
+  surface a "↓ N new" pill instead of yanking;
+- terminal-themed: phosphor mauve glow, Crust bg,
+  backdrop-filter blur, row fade-in slide-up.
+
+Per-stream rendering:
+
+- `Stream` `tool_use` →
+  - `Write` / `Edit`: collapsed `<details>` with a +/- diff body
+    (`-` lines from `input.old_string`, `+` lines from
+    `input.new_string` or every line of `input.content`).
+    Summary carries the path + line counts.
+  - others (`Read /path`, `Bash $ cmd`, `mcp__hyperhive__send →
+    operator: "..."`, etc.): flat one-line per-tool format.
+- `Stream` `tool_result` short → flat `← ...`; long → collapsed
+  `<details>` `▸ ← Nl · headline` (click to expand full body).
+- `Stream` `thinking` → text content if claude provided one,
+  otherwise the bare `· thinking …` indicator.
+- `Stream` `system init`, `result`, `rate_limit_event` are
+  dropped — too noisy.
+- `Note` → `· text`.
+- `TurnEnd` → `✓ turn ok` / `✗ turn fail — note`, triggers a
+  `refreshState()`.
+
+### Terminal-embedded prompt
+
+The operator input lives *inside* the terminal-wrap as a
+prompt-style textarea below the live tail: multi-line (Enter
+sends, Shift+Enter newlines), tab-completes slash commands.
+
+Slash commands today:
+
+- `/help` — list commands locally.
+- `/clear` — wipe the local terminal view (server history kept).
+- `/cancel` — `POST /api/cancel` → host shellouts `pkill -INT
+  claude`, emits a Note. Also surfaces as a `■ cancel turn`
+  button in the state row while state=thinking.
+- `/compact` — `POST /api/compact` → host spawns
+  `turn::compact_session` in the background; output streams into
+  the live panel.
+- `/model <name>` — `POST /api/model` flipping `Bus::set_model`.
+  Takes effect on the next turn; persisted to
+  `/state/hyperhive-model` so the override survives harness
+  restart / rebuild.
+- `/new-session` — `POST /api/new-session` (confirms first).
+  Arms a one-shot on the Bus; next turn runs without
+  `--continue`, dropping the resume session entirely.
+
+Unknown `/foo` shows an error row instead of being silently sent.
+
+### Per-agent endpoints
+
+All POSTs return 200 (no 303 redirects). The matching mutations
+fire `LiveEvent` variants on the per-agent bus, so the client
+doesn't refetch `/api/state` on submit — the SSE stream
+delivers the new state faster anyway. Only the login flow still
+polls (session output streams in updates that aren't event-
+shaped).
+
+- `POST /send` — operator-injected message into this agent's inbox.
+- `POST /login/{start,code,cancel}` — claude OAuth login flow.
+  Start/cancel emit `LiveEvent::StatusChanged` to flip the
+  badge to/from `needs_login_in_progress`.
+- `POST /api/cancel` — SIGINT the in-flight claude turn. Emits a
+  `LiveEvent::Note`.
+- `POST /api/compact` — run `/compact` on the persistent session
+  (same MCP config + system prompt + allowed tools as a normal
+  turn — only the stdin payload differs). Flips state to
+  `Compacting` via `Bus::set_state`, which emits
+  `TurnStateChanged`.
+- `POST /api/model` (`model=<name>`) — switch the model for
+  future turns. `Bus::set_model` emits `ModelChanged`.
+- `POST /api/new-session` — arm a one-shot for the next turn to
+  drop `--continue`. Emits a `LiveEvent::Note`.
+- `GET /events/history` — replay buffer for the terminal.
+- `GET /screen` — VNC viewer page (minimal RFB-over-WebSocket
+  renderer). Only accessible when `hyperhive.gui.enable = true`
+  in the agent's `agent.nix`; the harness shows a 🖥 screen link
+  in the state row when `gui_vnc_port` is present. Toolbar:
+  `⤢ fit` CSS-downscales the canvas to the window; `⤡ match size`
+  sends an RFB `SetDesktopSize` request so the server (weston)
+  changes its real output resolution to the window dimensions —
+  enabled once the server advertises the `ExtendedDesktopSize`
+  pseudo-encoding (issue #133).
+- `GET /screen/ws` — raw RFB byte relay: proxies WebSocket
+  frames to the weston VNC server at `127.0.0.1:<vnc_port>`.
+  Transparent to any RFB variant. VNC port comes from
+  `/etc/hyperhive/gui.json` (written by the weston startup
+  script in `weston-vnc.nix`).
+
+Bus events (new vocabulary on `/events/stream`):
+
+- `status_changed { status }` — `online` / `rate_limited` /
+  `needs_login_idle` / `needs_login_in_progress`. Drives the
+  alive-badge. `rate_limited` is set when the harness detects a
+  429 response and cleared when the retry sleep expires.
+- `model_changed { model }` — drives the model chip.
+- `token_usage_changed { ctx: TokenUsage, cost: TokenUsage }`
+  — drives the ctx + cost badges. Emitted from
+  `Bus::record_turn_usage` at turn-end; `ctx` is the last
+  inference's usage (current context size), `cost` is the
+  cumulative across every inference (the `result` event's
+  totals).
+- `turn_state_changed { state, since_unix }` — drives the
+  state badge (`idle`/`thinking`/`compacting`).
+
+### Stats page
+
+`GET /stats` is a separate per-agent page (served by the
+harness, linked from the per-agent page's `📊 stats →` and from
+each dashboard container row). Turn analytics, read-only, from
+`/state/hyperhive-turn-stats.sqlite`. `GET /api/stats?window=
+24h|7d|30d` returns a time-bucketed `Snapshot`; the page renders
+it with Chart.js (vendored from a CDN). Charts: turns,
+duration (p50 · p95 · avg), context tokens, token cost per
+bucket, a **turns-by-model** stacked bar (model choice drives
+token cost, so it sits directly under the cost chart), and
+doughnuts for tool / wake-source / result mix. A summary chip
+row carries window totals. `stats.rs` opens the sqlite db
+read-only and degrades to an empty snapshot on any error — the
+page is decorative, never authoritative.
diff --git a/flake.lock b/flake.lock
index b21cb3e5..2e3cff8f 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,167 +1,8 @@
 {
   "nodes": {
-    "argononed": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1729566243,
-        "narHash": "sha256-DPNI0Dpk5aym3Baf5UbEe5GENDrSmmXVdriRSWE+rgk=",
-        "owner": "nvmd",
-        "repo": "argononed",
-        "rev": "16dbee54d49b66d5654d228d1061246b440ef7cf",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nvmd",
-        "repo": "argononed",
-        "type": "github"
-      }
-    },
-    "base16": {
-      "inputs": {
-        "fromYaml": "fromYaml"
-      },
-      "locked": {
-        "lastModified": 1755819240,
-        "narHash": "sha256-qcMhnL7aGAuFuutH4rq9fvAhCpJWVHLcHVZLtPctPlo=",
-        "owner": "SenchoPens",
-        "repo": "base16.nix",
-        "rev": "75ed5e5e3fce37df22e49125181fa37899c3ccd6",
-        "type": "github"
-      },
-      "original": {
-        "owner": "SenchoPens",
-        "repo": "base16.nix",
-        "type": "github"
-      }
-    },
-    "base16-fish": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1765809053,
-        "narHash": "sha256-XCUQLoLfBJ8saWms2HCIj4NEN+xNsWBlU1NrEPcQG4s=",
-        "owner": "tomyun",
-        "repo": "base16-fish",
-        "rev": "86cbea4dca62e08fb7fd83a70e96472f92574782",
-        "type": "github"
-      },
-      "original": {
-        "owner": "tomyun",
-        "repo": "base16-fish",
-        "rev": "86cbea4dca62e08fb7fd83a70e96472f92574782",
-        "type": "github"
-      }
-    },
-    "base16-helix": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1760703920,
-        "narHash": "sha256-m82fGUYns4uHd+ZTdoLX2vlHikzwzdu2s2rYM2bNwzw=",
-        "owner": "tinted-theming",
-        "repo": "base16-helix",
-        "rev": "d646af9b7d14bff08824538164af99d0c521b185",
-        "type": "github"
-      },
-      "original": {
-        "owner": "tinted-theming",
-        "repo": "base16-helix",
-        "type": "github"
-      }
-    },
-    "base16-vim": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1732806396,
-        "narHash": "sha256-e0bpPySdJf0F68Ndanwm+KWHgQiZ0s7liLhvJSWDNsA=",
-        "owner": "tinted-theming",
-        "repo": "base16-vim",
-        "rev": "577fe8125d74ff456cf942c733a85d769afe58b7",
-        "type": "github"
-      },
-      "original": {
-        "owner": "tinted-theming",
-        "repo": "base16-vim",
-        "rev": "577fe8125d74ff456cf942c733a85d769afe58b7",
-        "type": "github"
-      }
-    },
-    "binding": {
-      "inputs": {
-        "binding": "binding_2",
-        "nixpkgs": [
-          "servicepoint-tanks",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1759096792,
-        "narHash": "sha256-CW4D1yJecw7Id6AxIEJOW3OpcX3Y4Ehng76/YlR1I9w=",
-        "ref": "refs/heads/main",
-        "rev": "8df2996504866f3193fbe51860ab173d25724e5e",
-        "revCount": 307,
-        "type": "git",
-        "url": "https://git.berlin.ccc.de/servicepoint/servicepoint-binding-csharp.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.berlin.ccc.de/servicepoint/servicepoint-binding-csharp.git"
-      }
-    },
-    "binding_2": {
-      "inputs": {
-        "nixpkgs": [
-          "servicepoint-tanks",
-          "binding",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1759093963,
-        "narHash": "sha256-nis9Xps/P1f/v9FC3LoMLGGCOMMbdrOniDSklqLsH8o=",
-        "ref": "refs/heads/main",
-        "rev": "44ef4bb6d707c46af1bed6244f17a16f26f246c1",
-        "revCount": 304,
-        "type": "git",
-        "url": "https://git.berlin.ccc.de/servicepoint/servicepoint-binding-uniffi.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.berlin.ccc.de/servicepoint/servicepoint-binding-uniffi.git"
-      }
-    },
-    "crane": {
-      "locked": {
-        "lastModified": 1754269165,
-        "narHash": "sha256-0tcS8FHd4QjbCVoxN9jI+PjHgA4vc/IjkUSp+N3zy0U=",
-        "owner": "ipetkov",
-        "repo": "crane",
-        "rev": "444e81206df3f7d92780680e45858e31d2f07a08",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ipetkov",
-        "repo": "crane",
-        "type": "github"
-      }
-    },
-    "crane_2": {
-      "locked": {
-        "lastModified": 1777830388,
-        "narHash": "sha256-2uoQAqUk2H0ijQtGiWAyNeQYGYc6yfAcRRLlJAz4Gp8=",
-        "owner": "ipetkov",
-        "repo": "crane",
-        "rev": "d459c1350e96ce1a7e3859c513ef5e9869d67d6f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ipetkov",
-        "repo": "crane",
-        "type": "github"
-      }
-    },
     "fenix": {
       "inputs": {
         "nixpkgs": [
-          "hyperhive",
           "naersk",
           "nixpkgs"
         ],
@@ -181,248 +22,10 @@
         "type": "github"
       }
     },
-    "fenix_2": {
-      "inputs": {
-        "nixpkgs": [
-          "naersk",
-          "nixpkgs"
-        ],
-        "rust-analyzer-src": "rust-analyzer-src_2"
-      },
-      "locked": {
-        "lastModified": 1752475459,
-        "narHash": "sha256-z6QEu4ZFuHiqdOPbYss4/Q8B0BFhacR8ts6jO/F/aOU=",
-        "owner": "nix-community",
-        "repo": "fenix",
-        "rev": "bf0d6f70f4c9a9cf8845f992105652173f4b617f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "fenix",
-        "type": "github"
-      }
-    },
-    "firefox-gnome-theme": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1764873433,
-        "narHash": "sha256-1XPewtGMi+9wN9Ispoluxunw/RwozuTRVuuQOmxzt+A=",
-        "owner": "rafaelmardojai",
-        "repo": "firefox-gnome-theme",
-        "rev": "f7ffd917ac0d253dbd6a3bf3da06888f57c69f92",
-        "type": "github"
-      },
-      "original": {
-        "owner": "rafaelmardojai",
-        "repo": "firefox-gnome-theme",
-        "type": "github"
-      }
-    },
-    "flake-compat": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1747046372,
-        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "flake-compat_2": {
-      "locked": {
-        "lastModified": 1767039857,
-        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "flake-parts": {
-      "inputs": {
-        "nixpkgs-lib": "nixpkgs-lib"
-      },
-      "locked": {
-        "lastModified": 1778716662,
-        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "flake-parts_2": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "lanzaboote",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1754091436,
-        "narHash": "sha256-XKqDMN1/Qj1DKivQvscI4vmHfDfvYR2pfuFOJiCeewM=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "67df8c627c2c39c41dbec76a1f201929929ab0bd",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "fromYaml": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1731966426,
-        "narHash": "sha256-lq95WydhbUTWig/JpqiB7oViTcHFP8Lv41IGtayokA8=",
-        "owner": "SenchoPens",
-        "repo": "fromYaml",
-        "rev": "106af9e2f715e2d828df706c386a685698f3223b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "SenchoPens",
-        "repo": "fromYaml",
-        "type": "github"
-      }
-    },
-    "gitignore": {
-      "inputs": {
-        "nixpkgs": [
-          "lanzaboote",
-          "pre-commit-hooks-nix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1709087332,
-        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "type": "github"
-      }
-    },
-    "gnome-shell": {
-      "flake": false,
-      "locked": {
-        "host": "gitlab.gnome.org",
-        "lastModified": 1767737596,
-        "narHash": "sha256-eFujfIUQDgWnSJBablOuG+32hCai192yRdrNHTv0a+s=",
-        "owner": "GNOME",
-        "repo": "gnome-shell",
-        "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
-        "type": "gitlab"
-      },
-      "original": {
-        "host": "gitlab.gnome.org",
-        "owner": "GNOME",
-        "ref": "gnome-49",
-        "repo": "gnome-shell",
-        "type": "gitlab"
-      }
-    },
-    "home-manager": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1778905220,
-        "narHash": "sha256-ox/5IHc8uwy6UTw6N7Shp6uCHIgu/S2PsWeuXsOHSo8=",
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "rev": "d1686dc7d36cbd1234cb226ad6ef97e882716acb",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "ref": "release-25.11",
-        "repo": "home-manager",
-        "type": "github"
-      }
-    },
-    "hyperhive": {
-      "inputs": {
-        "naersk": "naersk",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "nixpkgs-unstable": [
-          "nixpkgs-unstable"
-        ],
-        "treefmt-nix": "treefmt-nix"
-      },
-      "locked": {
-        "lastModified": 1779389374,
-        "narHash": "sha256-u/ygppXPZc3VshRDhU9MY3Zc2pJn9QlWvmZiEEefJvA=",
-        "ref": "refs/heads/main",
-        "rev": "0884a5496015472afad97972a7c12fc1cd06a59e",
-        "revCount": 547,
-        "type": "git",
-        "url": "https://git.berlin.ccc.de/vinzenz/hyperhive.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.berlin.ccc.de/vinzenz/hyperhive.git"
-      }
-    },
-    "lanzaboote": {
-      "inputs": {
-        "crane": "crane",
-        "flake-compat": "flake-compat",
-        "flake-parts": "flake-parts_2",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "pre-commit-hooks-nix": "pre-commit-hooks-nix",
-        "rust-overlay": "rust-overlay"
-      },
-      "locked": {
-        "lastModified": 1762205063,
-        "narHash": "sha256-If6vQ+KvtKs3ARBO9G3l+4wFSCYtRBrwX1z+I+B61wQ=",
-        "owner": "nix-community",
-        "repo": "lanzaboote",
-        "rev": "88b8a563ff5704f4e8d8e5118fb911fa2110ca05",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "ref": "v0.4.3",
-        "repo": "lanzaboote",
-        "type": "github"
-      }
-    },
     "naersk": {
       "inputs": {
         "fenix": "fenix",
         "nixpkgs": [
-          "hyperhive",
           "nixpkgs"
         ]
       },
@@ -440,206 +43,6 @@
         "type": "github"
       }
     },
-    "naersk_2": {
-      "inputs": {
-        "fenix": "fenix_2",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1778151388,
-        "narHash": "sha256-lldMJPUeouEjO8/7aLuwhcsIw29vVihm2ZALzjiqfec=",
-        "owner": "nix-community",
-        "repo": "naersk",
-        "rev": "efdddff9ff4d8e7d0056d57ec67dac50f75ab8f6",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "naersk",
-        "type": "github"
-      }
-    },
-    "niri": {
-      "inputs": {
-        "niri-stable": "niri-stable",
-        "niri-unstable": "niri-unstable",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "nixpkgs-stable": [
-          "nixpkgs"
-        ],
-        "xwayland-satellite-stable": "xwayland-satellite-stable",
-        "xwayland-satellite-unstable": "xwayland-satellite-unstable"
-      },
-      "locked": {
-        "lastModified": 1778942403,
-        "narHash": "sha256-SPCWvqeVySTNUgX/shARpRl5fi/NnkObUgDGR/Aco4c=",
-        "owner": "sodiboo",
-        "repo": "niri-flake",
-        "rev": "daefca3370581223fedc24d0101c4915a3689f9e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "sodiboo",
-        "repo": "niri-flake",
-        "type": "github"
-      }
-    },
-    "niri-stable": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1756556321,
-        "narHash": "sha256-RLD89dfjN0RVO86C/Mot0T7aduCygPGaYbog566F0Qo=",
-        "owner": "YaLTeR",
-        "repo": "niri",
-        "rev": "01be0e65f4eb91a9cd624ac0b76aaeab765c7294",
-        "type": "github"
-      },
-      "original": {
-        "owner": "YaLTeR",
-        "ref": "v25.08",
-        "repo": "niri",
-        "type": "github"
-      }
-    },
-    "niri-unstable": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1778858756,
-        "narHash": "sha256-9VvAHNoi2wd0fxLfJOPChZMS7l6rhCtAJmpd59Hv5rw=",
-        "owner": "YaLTeR",
-        "repo": "niri",
-        "rev": "cd5ac3e5e04bb5a11276d3c755fa25242818e05f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "YaLTeR",
-        "repo": "niri",
-        "type": "github"
-      }
-    },
-    "nix-filter": {
-      "locked": {
-        "lastModified": 1757882181,
-        "narHash": "sha256-+cCxYIh2UNalTz364p+QYmWHs0P+6wDhiWR4jDIKQIU=",
-        "owner": "numtide",
-        "repo": "nix-filter",
-        "rev": "59c44d1909c72441144b93cf0f054be7fe764de5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "nix-filter",
-        "type": "github"
-      }
-    },
-    "nix-vscode-extensions": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1778990260,
-        "narHash": "sha256-IE5biNRhbQdrziKZbbS47ELDyv38mI4hdFf9zMq6meU=",
-        "owner": "nix-community",
-        "repo": "nix-vscode-extensions",
-        "rev": "357e5e238302b5908f033b828c5f1d8b3d73b4e0",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nix-vscode-extensions",
-        "type": "github"
-      }
-    },
-    "nixlib": {
-      "locked": {
-        "lastModified": 1736643958,
-        "narHash": "sha256-tmpqTSWVRJVhpvfSN9KXBvKEXplrwKnSZNAoNPf/S/s=",
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "rev": "1418bc28a52126761c02dd3d89b2d8ca0f521181",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "type": "github"
-      }
-    },
-    "nixos-generators": {
-      "inputs": {
-        "nixlib": "nixlib",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1769813415,
-        "narHash": "sha256-nnVmNNKBi1YiBNPhKclNYDORoHkuKipoz7EtVnXO50A=",
-        "owner": "nix-community",
-        "repo": "nixos-generators",
-        "rev": "8946737ff703382fda7623b9fab071d037e897d5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixos-generators",
-        "type": "github"
-      }
-    },
-    "nixos-images": {
-      "inputs": {
-        "nixos-stable": [
-          "nixos-raspberrypi",
-          "nixpkgs"
-        ],
-        "nixos-unstable": [
-          "nixos-raspberrypi",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1747747741,
-        "narHash": "sha256-LUOH27unNWbGTvZFitHonraNx0JF/55h30r9WxqrznM=",
-        "owner": "nvmd",
-        "repo": "nixos-images",
-        "rev": "cbbd6db325775096680b65e2a32fb6187c09bbb4",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nvmd",
-        "ref": "sdimage-installer",
-        "repo": "nixos-images",
-        "type": "github"
-      }
-    },
-    "nixos-raspberrypi": {
-      "inputs": {
-        "argononed": "argononed",
-        "flake-compat": "flake-compat_2",
-        "nixos-images": "nixos-images",
-        "nixpkgs": "nixpkgs"
-      },
-      "locked": {
-        "lastModified": 1779023229,
-        "narHash": "sha256-MInilg7B/06c34SwOuGSBho4l0H1EZcmvxTkSWCs5pE=",
-        "owner": "nvmd",
-        "repo": "nixos-raspberrypi",
-        "rev": "06c6e3513e1ee64b651913193fc6ac38aa4963f5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nvmd",
-        "ref": "main",
-        "repo": "nixos-raspberrypi",
-        "type": "github"
-      }
-    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1778737229,
@@ -656,21 +59,6 @@
         "type": "github"
       }
     },
-    "nixpkgs-lib": {
-      "locked": {
-        "lastModified": 1777168982,
-        "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "type": "github"
-      }
-    },
     "nixpkgs-unstable": {
       "locked": {
         "lastModified": 1778869304,
@@ -687,153 +75,12 @@
         "type": "github"
       }
     },
-    "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1778737229,
-        "narHash": "sha256-6xWoytx8jFW4PF1GjRm/i/53trbpKGfz6zjzQGBr4cI=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "d7a713c0b7e47c908258e71cba7a2d77cc8d71d5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-25.11",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_3": {
-      "locked": {
-        "lastModified": 1757545623,
-        "narHash": "sha256-mCxPABZ6jRjUQx3bPP4vjA68ETbPLNz9V2pk9tO7pRQ=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "8cd5ce828d5d1d16feff37340171a98fc3bf6526",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-25.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nova-shell": {
-      "inputs": {
-        "crane": "crane_2",
-        "nixpkgs": [
-          "nixpkgs-unstable"
-        ],
-        "quickshell": "quickshell",
-        "treefmt-nix": "treefmt-nix_2"
-      },
-      "locked": {
-        "lastModified": 1778182618,
-        "narHash": "sha256-1KzLskWhgJZu0jL03UZZtmHBgk11HMhLFvO9mCWnCao=",
-        "ref": "refs/heads/main",
-        "rev": "628ae67b7def027553c287cfd71f840570469bce",
-        "revCount": 627,
-        "type": "git",
-        "url": "https://git.berlin.ccc.de/vinzenz/nova-shell"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.berlin.ccc.de/vinzenz/nova-shell"
-      }
-    },
-    "nur": {
-      "inputs": {
-        "flake-parts": [
-          "flake-parts"
-        ],
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1779047312,
-        "narHash": "sha256-Q4CSXZehRX3CKnXXaHc2nCMjK9lgZR2Leu5DTwe1Vnw=",
-        "owner": "nix-community",
-        "repo": "NUR",
-        "rev": "8070eab81003118a0d3cde9c316aca3b2c21533e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "NUR",
-        "type": "github"
-      }
-    },
-    "pre-commit-hooks-nix": {
-      "inputs": {
-        "flake-compat": [
-          "lanzaboote",
-          "flake-compat"
-        ],
-        "gitignore": "gitignore",
-        "nixpkgs": [
-          "lanzaboote",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1750779888,
-        "narHash": "sha256-wibppH3g/E2lxU43ZQHC5yA/7kIKLGxVEnsnVK1BtRg=",
-        "owner": "cachix",
-        "repo": "pre-commit-hooks.nix",
-        "rev": "16ec914f6fb6f599ce988427d9d94efddf25fe6d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "cachix",
-        "repo": "pre-commit-hooks.nix",
-        "type": "github"
-      }
-    },
-    "quickshell": {
-      "inputs": {
-        "nixpkgs": [
-          "nova-shell",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1776066068,
-        "narHash": "sha256-SwKVkgEsqsp5ki9m7fqvhncb5MjvH1hlZqbn3s+x/Uk=",
-        "ref": "refs/heads/master",
-        "rev": "fb08eced449e87e47321e95beeb890a63d2c67bd",
-        "revCount": 801,
-        "type": "git",
-        "url": "https://git.outfoxxed.me/outfoxxed/quickshell"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.outfoxxed.me/outfoxxed/quickshell"
-      }
-    },
     "root": {
       "inputs": {
-        "flake-parts": "flake-parts",
-        "home-manager": "home-manager",
-        "hyperhive": "hyperhive",
-        "lanzaboote": "lanzaboote",
-        "naersk": "naersk_2",
-        "niri": "niri",
-        "nix-filter": "nix-filter",
-        "nix-vscode-extensions": "nix-vscode-extensions",
-        "nixos-generators": "nixos-generators",
-        "nixos-raspberrypi": "nixos-raspberrypi",
-        "nixpkgs": "nixpkgs_2",
+        "naersk": "naersk",
+        "nixpkgs": "nixpkgs",
         "nixpkgs-unstable": "nixpkgs-unstable",
-        "nova-shell": "nova-shell",
-        "nur": "nur",
-        "servicepoint-cli": "servicepoint-cli",
-        "servicepoint-simulator": "servicepoint-simulator",
-        "servicepoint-tanks": "servicepoint-tanks",
-        "stylix": "stylix",
-        "treefmt-nix": "treefmt-nix_3",
-        "zerforschen-plus": "zerforschen-plus"
+        "treefmt-nix": "treefmt-nix"
       }
     },
     "rust-analyzer-src": {
@@ -853,258 +100,9 @@
         "type": "github"
       }
     },
-    "rust-analyzer-src_2": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1752428706,
-        "narHash": "sha256-EJcdxw3aXfP8Ex1Nm3s0awyH9egQvB2Gu+QEnJn2Sfg=",
-        "owner": "rust-lang",
-        "repo": "rust-analyzer",
-        "rev": "591e3b7624be97e4443ea7b5542c191311aa141d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "rust-lang",
-        "ref": "nightly",
-        "repo": "rust-analyzer",
-        "type": "github"
-      }
-    },
-    "rust-overlay": {
-      "inputs": {
-        "nixpkgs": [
-          "lanzaboote",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1761791894,
-        "narHash": "sha256-myRIDh+PxaREz+z9LzbqBJF+SnTFJwkthKDX9zMyddY=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "59c45eb69d9222a4362673141e00ff77842cd219",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
-    "servicepoint-cli": {
-      "inputs": {
-        "naersk": [
-          "naersk"
-        ],
-        "nix-filter": [
-          "nix-filter"
-        ],
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "treefmt-nix": [
-          "treefmt-nix"
-        ]
-      },
-      "locked": {
-        "lastModified": 1771709842,
-        "narHash": "sha256-zbKj2waitgCFE/I4DcV4lWMRkQ7gDOa9QgPXVTao5+g=",
-        "ref": "refs/heads/main",
-        "rev": "6c731e3f5ac0fc63e3cf1e727856f3a3327fddfb",
-        "revCount": 52,
-        "type": "git",
-        "url": "https://git.berlin.ccc.de/servicepoint/servicepoint-cli.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.berlin.ccc.de/servicepoint/servicepoint-cli.git"
-      }
-    },
-    "servicepoint-simulator": {
-      "inputs": {
-        "naersk": [
-          "naersk"
-        ],
-        "nix-filter": [
-          "nix-filter"
-        ],
-        "nixpkgs": "nixpkgs_3"
-      },
-      "locked": {
-        "lastModified": 1757763091,
-        "narHash": "sha256-V3E6JKGzCrq5u+hp38sAdKv/EoxU+X0qfSoBIPxALi4=",
-        "ref": "refs/heads/main",
-        "rev": "493b7b0343334019b372176f811a966839ba9aa5",
-        "revCount": 121,
-        "type": "git",
-        "url": "https://git.berlin.ccc.de/servicepoint/servicepoint-simulator.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.berlin.ccc.de/servicepoint/servicepoint-simulator.git"
-      }
-    },
-    "servicepoint-tanks": {
-      "inputs": {
-        "binding": "binding",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1760288584,
-        "narHash": "sha256-2eY1f4LV9s5Hc/tb1iuJYPewE4Seyeguf7VdzC9bbbo=",
-        "ref": "service-improvements",
-        "rev": "1bb73d664dac78c5d69a02ae67169d76cca7aab4",
-        "revCount": 218,
-        "type": "git",
-        "url": "https://git.berlin.ccc.de/vinzenz/servicepoint-tanks.git"
-      },
-      "original": {
-        "ref": "service-improvements",
-        "type": "git",
-        "url": "https://git.berlin.ccc.de/vinzenz/servicepoint-tanks.git"
-      }
-    },
-    "stylix": {
-      "inputs": {
-        "base16": "base16",
-        "base16-fish": "base16-fish",
-        "base16-helix": "base16-helix",
-        "base16-vim": "base16-vim",
-        "firefox-gnome-theme": "firefox-gnome-theme",
-        "flake-parts": [
-          "flake-parts"
-        ],
-        "gnome-shell": "gnome-shell",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "nur": [
-          "nur"
-        ],
-        "systems": "systems",
-        "tinted-foot": "tinted-foot",
-        "tinted-kitty": "tinted-kitty",
-        "tinted-schemes": "tinted-schemes",
-        "tinted-tmux": "tinted-tmux",
-        "tinted-zed": "tinted-zed"
-      },
-      "locked": {
-        "lastModified": 1778680496,
-        "narHash": "sha256-tUq1WASV0dHLv3j18log8V6Esq0NYkXuzNH2EHsstcg=",
-        "owner": "nix-community",
-        "repo": "stylix",
-        "rev": "fc5bec2e44678eeaa221d566d447a0257a884737",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "ref": "release-25.11",
-        "repo": "stylix",
-        "type": "github"
-      }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "tinted-foot": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1726913040,
-        "narHash": "sha256-+eDZPkw7efMNUf3/Pv0EmsidqdwNJ1TaOum6k7lngDQ=",
-        "owner": "tinted-theming",
-        "repo": "tinted-foot",
-        "rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4",
-        "type": "github"
-      },
-      "original": {
-        "owner": "tinted-theming",
-        "repo": "tinted-foot",
-        "rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4",
-        "type": "github"
-      }
-    },
-    "tinted-kitty": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1735730497,
-        "narHash": "sha256-4KtB+FiUzIeK/4aHCKce3V9HwRvYaxX+F1edUrfgzb8=",
-        "owner": "tinted-theming",
-        "repo": "tinted-kitty",
-        "rev": "de6f888497f2c6b2279361bfc790f164bfd0f3fa",
-        "type": "github"
-      },
-      "original": {
-        "owner": "tinted-theming",
-        "repo": "tinted-kitty",
-        "type": "github"
-      }
-    },
-    "tinted-schemes": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1767817087,
-        "narHash": "sha256-eGE8OYoK6HzhJt/7bOiNV2cx01IdIrHL7gXgjkHRdNo=",
-        "owner": "tinted-theming",
-        "repo": "schemes",
-        "rev": "bd99656235aab343e3d597bf196df9bc67429507",
-        "type": "github"
-      },
-      "original": {
-        "owner": "tinted-theming",
-        "repo": "schemes",
-        "type": "github"
-      }
-    },
-    "tinted-tmux": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1767489635,
-        "narHash": "sha256-e6nnFnWXKBCJjCv4QG4bbcouJ6y3yeT70V9MofL32lU=",
-        "owner": "tinted-theming",
-        "repo": "tinted-tmux",
-        "rev": "3c32729ccae99be44fe8a125d20be06f8d7d8184",
-        "type": "github"
-      },
-      "original": {
-        "owner": "tinted-theming",
-        "repo": "tinted-tmux",
-        "type": "github"
-      }
-    },
-    "tinted-zed": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1767488740,
-        "narHash": "sha256-wVOj0qyil8m+ouSsVZcNjl5ZR+1GdOOAooAatQXHbuU=",
-        "owner": "tinted-theming",
-        "repo": "base16-zed",
-        "rev": "11abb0b282ad3786a2aae088d3a01c60916f2e40",
-        "type": "github"
-      },
-      "original": {
-        "owner": "tinted-theming",
-        "repo": "base16-zed",
-        "type": "github"
-      }
-    },
     "treefmt-nix": {
       "inputs": {
         "nixpkgs": [
-          "hyperhive",
           "nixpkgs"
         ]
       },
@@ -1121,100 +119,6 @@
         "repo": "treefmt-nix",
         "type": "github"
       }
-    },
-    "treefmt-nix_2": {
-      "inputs": {
-        "nixpkgs": [
-          "nova-shell",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1775636079,
-        "narHash": "sha256-pc20NRoMdiar8oPQceQT47UUZMBTiMdUuWrYu2obUP0=",
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "rev": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "type": "github"
-      }
-    },
-    "treefmt-nix_3": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1775636079,
-        "narHash": "sha256-pc20NRoMdiar8oPQceQT47UUZMBTiMdUuWrYu2obUP0=",
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "rev": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "type": "github"
-      }
-    },
-    "xwayland-satellite-stable": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1755491097,
-        "narHash": "sha256-m+9tUfsmBeF2Gn4HWa6vSITZ4Gz1eA1F5Kh62B0N4oE=",
-        "owner": "Supreeeme",
-        "repo": "xwayland-satellite",
-        "rev": "388d291e82ffbc73be18169d39470f340707edaa",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Supreeeme",
-        "ref": "v0.7",
-        "repo": "xwayland-satellite",
-        "type": "github"
-      }
-    },
-    "xwayland-satellite-unstable": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1773622265,
-        "narHash": "sha256-wToKwH7IgWdGLMSIWksEDs4eumR6UbbsuPQ42r0oTXQ=",
-        "owner": "Supreeeme",
-        "repo": "xwayland-satellite",
-        "rev": "a879e5e0896a326adc79c474bf457b8b99011027",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Supreeeme",
-        "repo": "xwayland-satellite",
-        "type": "github"
-      }
-    },
-    "zerforschen-plus": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1757965108,
-        "narHash": "sha256-V2U1XbtfvWQ6Bt2dvbUWAlKjqY3zjrbkVveLsyxnq1w=",
-        "ref": "refs/heads/main",
-        "rev": "d794fafc25c8fdead19dcbffc4c0b4bb7ff98272",
-        "revCount": 32,
-        "type": "git",
-        "url": "https://git.berlin.ccc.de/vinzenz/zerforschen.plus"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.berlin.ccc.de/vinzenz/zerforschen.plus"
-      }
     }
   },
   "root": "root",
diff --git a/flake.nix b/flake.nix
index 78e118da..792bf2fb 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,178 +1,243 @@
 {
+  description = "hyperhive — multi-Claude-Code-agent orchestration on nixos-containers";
+
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
     nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
-
-    home-manager = {
-      url = "github:nix-community/home-manager/release-25.11";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
-    #keep-sorted start block=yes
-    flake-parts = {
-      url = "github:hercules-ci/flake-parts";
-      #inputs.nixpkgs.follows = "nixpkgs";
-    };
-    hyperhive = {
-      url = "git+https://git.berlin.ccc.de/vinzenz/hyperhive.git";
-      inputs = {
-        nixpkgs.follows = "nixpkgs";
-        nixpkgs-unstable.follows = "nixpkgs-unstable";
-      };
-    };
-    lanzaboote = {
-      url = "github:nix-community/lanzaboote/v0.4.3";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     naersk = {
       url = "github:nix-community/naersk";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    niri = {
-      url = "github:sodiboo/niri-flake";
-      inputs = {
-        nixpkgs.follows = "nixpkgs";
-        nixpkgs-stable.follows = "nixpkgs";
-      };
-    };
-    nix-filter.url = "github:numtide/nix-filter";
-    nix-vscode-extensions = {
-      url = "github:nix-community/nix-vscode-extensions";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    nixos-generators = {
-      url = "github:nix-community/nixos-generators";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    nixos-raspberrypi = {
-      url = "github:nvmd/nixos-raspberrypi/main";
-    };
-    nova-shell = {
-      url = "git+https://git.berlin.ccc.de/vinzenz/nova-shell";
-      inputs.nixpkgs.follows = "nixpkgs-unstable";
-    };
-    nur = {
-      url = "github:nix-community/NUR";
-      inputs = {
-        nixpkgs.follows = "nixpkgs";
-        flake-parts.follows = "flake-parts";
-      };
-    };
-    servicepoint-cli = {
-      url = "git+https://git.berlin.ccc.de/servicepoint/servicepoint-cli.git";
-      inputs = {
-        nixpkgs.follows = "nixpkgs";
-        naersk.follows = "naersk";
-        nix-filter.follows = "nix-filter";
-        treefmt-nix.follows = "treefmt-nix";
-      };
-    };
-    servicepoint-simulator = {
-      url = "git+https://git.berlin.ccc.de/servicepoint/servicepoint-simulator.git";
-      inputs = {
-        # TODO: update flake to 25.11
-        # nixpkgs.follows = "nixpkgs";
-        naersk.follows = "naersk";
-        nix-filter.follows = "nix-filter";
-      };
-    };
-    servicepoint-tanks = {
-      url = "git+https://git.berlin.ccc.de/vinzenz/servicepoint-tanks.git?ref=service-improvements";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    stylix = {
-      url = "github:nix-community/stylix/release-25.11";
-      inputs = {
-        nixpkgs.follows = "nixpkgs";
-        nur.follows = "nur";
-        flake-parts.follows = "flake-parts";
-      };
-    };
     treefmt-nix = {
       url = "github:numtide/treefmt-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    zerforschen-plus = {
-      url = "git+https://git.berlin.ccc.de/vinzenz/zerforschen.plus";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    #keep-sorted end
   };
 
   outputs =
     inputs@{
       self,
       nixpkgs,
-      # keep-sorted start
-      niri,
-      nix-vscode-extensions,
       nixpkgs-unstable,
+      naersk,
       treefmt-nix,
-      # keep-sorted end
-      ...
     }:
     let
       inherit (nixpkgs) lib;
-      nixosConfigurations = import ./nixosConfigurations.nix { inherit inputs lib; };
-      supported-systems = lib.unique (lib.mapAttrsToList (_: v: v.pkgs.system) nixosConfigurations);
+      systems = [
+        "aarch64-linux"
+        "x86_64-linux"
+      ];
       treefmt-config = {
         projectRootFile = "flake.nix";
         programs = {
-          nixfmt.enable = true;
-          jsonfmt.enable = true;
-          prettier.enable = true;
           keep-sorted.enable = true;
+          nixfmt.enable = true;
+          rustfmt.enable = true;
+          taplo.enable = true;
         };
       };
       forAllSystems =
         f:
-        lib.genAttrs supported-systems (
+        lib.genAttrs systems (
           system:
           f rec {
             inherit system;
             pkgs = nixpkgs.legacyPackages.${system};
             treefmt-eval = treefmt-nix.lib.evalModule pkgs treefmt-config;
+            naersk-lib = pkgs.callPackage naersk { };
           }
         );
-      importModuleDir =
-        directory:
-        nixpkgs.lib.packagesFromDirectoryRecursive {
-          inherit directory;
-          callPackage = path: _args: path;
-        };
     in
     {
-      overlays = {
-        unstable = final: prev: {
-          unstable = import nixpkgs-unstable {
-            localSystem = prev.stdenv.hostPlatform;
-            inherit (prev) config;
+      packages = forAllSystems (
+        { pkgs, naersk-lib, ... }:
+        {
+          default = naersk-lib.buildPackage {
+            src = ./.;
+            # librsvg ships `rsvg-convert`, which hive-c0re/build.rs
+            # invokes to render branding/agent-configs.svg into the
+            # PNG it embeds via `include_bytes!` (#424). Keeps the
+            # raster out of git — SVG stays source-of-truth, PNG is
+            # a build artifact in $OUT_DIR.
+            nativeBuildInputs = [ pkgs.librsvg ];
+            meta.description = "hyperhive workspace (hive-c0re, hive-ag3nt, hive-m1nd)";
           };
+          # Bundled browser assets — see ./nix/frontend.nix. Output is
+          # $out/{dashboard,agent}/ which the Rust binaries serve via
+          # tower_http::ServeDir (wired up in Phase 4 of #273).
+          frontend = pkgs.callPackage ./nix/frontend.nix {
+            branding-svg = ./branding/hyperhive.svg;
+          };
+          # Pre-built per-container system closures. Exposed as packages
+          # so operators can `nix build .#agent-base-toplevel` (or wire
+          # them into their host system closure via the
+          # `preBuildAgentTemplates` option on the hive-c0re module —
+          # see nix/modules/hive-c0re.nix). Speeds up the first agent
+          # spawn dramatically because the heavy lifting (nixpkgs +
+          # claude-code + hive-ag3nt binary) is already in the store
+          # when the meta evaluator goes to build the container.
+          # Closes #97.
+          #
+          # nixosConfigurations are pinned to x86_64-linux (nixos-
+          # containers only run native arch), so these toplevels are
+          # only useful on an x86_64-linux host — flake check across
+          # systems still tolerates evaluating them on aarch64 because
+          # they're plain derivations, but `nix build` from a non-x86
+          # host would only succeed via a remote x86 builder.
+          agent-base-toplevel = self.nixosConfigurations.agent-base.config.system.build.toplevel;
+          manager-toplevel = self.nixosConfigurations.manager.config.system.build.toplevel;
+        }
+      );
+
+      overlays = {
+        default = final: prev: {
+          hyperhive = self.packages.${prev.stdenv.hostPlatform.system}.default;
+          # Bundled frontend dist (see ./nix/frontend.nix). Output is
+          # $out/{dashboard,agent}/; consumers pick the surface they
+          # need. Exposed via the overlay so containers' nix evaluations
+          # can reach it as `pkgs.hyperhive-frontend` once the overlay
+          # is applied (manager + agent containers both apply it via
+          # `mkContainer` further down).
+          hyperhive-frontend = self.packages.${prev.stdenv.hostPlatform.system}.frontend;
         };
-        vscodeExtensions = nix-vscode-extensions.overlays.default;
-        niri = niri.overlays.niri;
+        claude-unstable =
+          final: prev:
+          let
+            # The overlay imports its own nixpkgs-unstable instance to
+            # pin claude-code there. That instance has its own config
+            # (independent from the user's prev.config), so we have to
+            # set allowUnfreePredicate inline to whitelist claude-code
+            # specifically — otherwise the unstable import itself
+            # refuses to evaluate. This is scoped: only claude-code
+            # bypasses unfree, nothing else.
+            unstable = import nixpkgs-unstable {
+              inherit (prev.stdenv.hostPlatform) system;
+              config.allowUnfreePredicate = pkg: builtins.elem (prev.lib.getName pkg) [ "claude-code" ];
+            };
+          in
+          {
+            inherit (unstable) claude-code;
+          };
       };
 
-      nixosModules = (importModuleDir ./nixosModules) // {
-        default = {
-          imports = builtins.attrValues (builtins.removeAttrs self.nixosModules [ "default" ]);
+      nixosModules = {
+        agent-base = ./nix/templates/agent-base.nix;
+        manager = ./nix/templates/manager.nix;
+        # The hive-c0re module wants `pkgs.hyperhive` for its default
+        # `services.hive-c0re.package`. To avoid making operators apply an
+        # overlay (which would also pollute their host pkgs with our
+        # build), we thread the package straight from this flake's
+        # `packages.<system>.default` via a `hyperhivePackage` argument.
+        # The `claude-unstable` overlay only matters inside our container
+        # builds (already applied internally in `nixosConfigurations`).
+        hive-c0re = import ./nix/modules/hive-c0re.nix {
+          hyperhivePackage = system: self.packages.${system}.default;
+          hyperhiveFrontend = system: self.packages.${system}.frontend;
+          hyperhiveFlake = "${self}";
+          # Per-container toplevels — wired into `system.extraDependencies`
+          # when `services.hive-c0re.preBuildAgentTemplates` is on so the
+          # host system closure pre-fetches the heavy build inputs (#97).
+          # Defined only for x86_64-linux because nixosConfigurations are
+          # hardcoded to that system; the option's default keeps the
+          # extra deps gated so aarch64 hosts don't accidentally pull
+          # them in via cross-build.
+          agentBaseToplevel = self.packages.x86_64-linux.agent-base-toplevel;
+          managerToplevel = self.packages.x86_64-linux.manager-toplevel;
         };
+        hive-forge = ./nix/modules/hive-forge.nix;
+        # Convenience alias: one import covers the full hyperhive host
+        # stack (hive-c0re + hive-forge, since hive-c0re already pulls
+        # in hive-forge). Intended usage:
+        #
+        #   imports = [ hyperhive.nixosModules.default ];
+        #   services.hive-c0re.enable = true;
+        #
+        default = self.nixosModules.hive-c0re;
       };
 
-      homeModules = importModuleDir ./homeModules;
-      homeConfigurations = {
-        muede = ./homeConfigurations/muede;
-        ronja = ./homeConfigurations/ronja;
-      };
+      nixosConfigurations =
+        let
+          mkContainer =
+            module:
+            nixpkgs.lib.nixosSystem {
+              system = "x86_64-linux";
+              modules = [
+                module
+                {
+                  nixpkgs.overlays = [
+                    self.overlays.default
+                    self.overlays.claude-unstable
+                  ];
+                }
+              ];
+            };
+        in
+        {
+          agent-base = mkContainer self.nixosModules.agent-base;
+          manager = mkContainer self.nixosModules.manager;
+        };
 
-      inherit nixosConfigurations;
+      devShells = forAllSystems (
+        { pkgs, ... }:
+        {
+          default = pkgs.mkShell {
+            packages = with pkgs; [
+              cargo
+              clippy
+              librsvg # rsvg-convert — hive-c0re/build.rs invokes it (#424)
+              pkg-config
+              rust-analyzer
+              rustc
+              rustfmt
+              sqlite
+            ];
+          };
+        }
+      );
 
       formatter = forAllSystems ({ treefmt-eval, ... }: treefmt-eval.config.build.wrapper);
 
       checks = forAllSystems (
-        { treefmt-eval, ... }:
+        {
+          treefmt-eval,
+          pkgs,
+          naersk-lib,
+          ...
+        }:
         {
           formatting = treefmt-eval.config.build.check self;
+          # Clippy as a check: reuse naersk's vendored-deps environment but
+          # replace the build phase with `cargo clippy --workspace --all-targets
+          # -- -D warnings`. Naersk's own `mode = "clippy"` mangles the `--`
+          # separator, so we go through overrideAttrs instead.
+          clippy =
+            (naersk-lib.buildPackage {
+              src = ./.;
+              # Skip the actual build; we only care about the clippy lint.
+              doCheck = false;
+              copyTarget = false;
+              # hive-c0re/build.rs needs rsvg-convert on PATH (#424);
+              # mirror the runtime derivation's nativeBuildInputs so
+              # clippy's vendored-deps build phase doesn't break on
+              # the missing tool.
+              nativeBuildInputs = [ pkgs.librsvg ];
+            }).overrideAttrs
+              (old: {
+                name = "${old.name}-clippy";
+                nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.clippy ];
+                buildPhase = ''
+                  runHook preBuild
+                  cargo clippy --workspace --all-targets -- -D warnings
+                  runHook postBuild
+                '';
+                installPhase = ''
+                  runHook preInstall
+                  mkdir -p $out
+                  touch $out/.clippy-passed
+                  runHook postInstall
+                '';
+              });
         }
       );
     };
diff --git a/frontend/.gitignore b/frontend/.gitignore
new file mode 100644
index 00000000..31994d81
--- /dev/null
+++ b/frontend/.gitignore
@@ -0,0 +1,2 @@
+node_modules/
+packages/*/dist/
diff --git a/frontend/README.md b/frontend/README.md
new file mode 100644
index 00000000..5564ab0a
--- /dev/null
+++ b/frontend/README.md
@@ -0,0 +1,33 @@
+# hyperhive frontend
+
+npm workspaces project for the hyperhive browser-facing assets:
+
+- `packages/shared/` — shared modules used by both surfaces (terminal
+  pane, Catppuccin palette + body typography).
+- `packages/dashboard/` — the hive-c0re dashboard SPA.
+- `packages/agent/` — the per-container web UI (default agent page,
+  stats, screen).
+
+## Build
+
+```
+npm install            # one-off; uses the checked-in package-lock.json
+npm run build          # builds every workspace into packages/*/dist/
+```
+
+The Rust binaries serve `packages/dashboard/dist/` and
+`packages/agent/dist/` via `tower_http::ServeDir` at runtime; the
+build derivation is wired up in `nix/modules/frontend.nix`. Per-agent
+additions are layered on top of the default agent dist via the
+`hyperhive.frontend.extraFiles` option in `agent.nix`.
+
+## Why npm + esbuild
+
+- **Hermetic**: dependencies vendored via the checked-in lockfile;
+  `buildNpmPackage` in nix uses it as the source-of-truth so the
+  output is reproducible without network access at build time.
+- **esbuild**: vanilla-JS bundler, no framework runtime overhead.
+  Each workspace's `build.mjs` is ~30 lines.
+- **Single-PR migration**: see issue #273 for the design proposal and
+  the four-commit shape (npm scaffold → nix derivations → container
+  plumbing → Rust cutover).
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
new file mode 100644
index 00000000..a2ffd71c
--- /dev/null
+++ b/frontend/package-lock.json
@@ -0,0 +1,549 @@
+{
+  "name": "hyperhive-frontend",
+  "version": "0.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "hyperhive-frontend",
+      "version": "0.0.0",
+      "workspaces": [
+        "packages/shared",
+        "packages/dashboard",
+        "packages/agent"
+      ],
+      "devDependencies": {
+        "esbuild": "0.25.5"
+      }
+    },
+    "node_modules/@esbuild/aix-ppc64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.5.tgz",
+      "integrity": "sha512-9o3TMmpmftaCMepOdA5k/yDw8SfInyzWWTjYTFCX3kPSDJMROQTb8jg+h9Cnwnmm1vOzvxN7gIfB5V2ewpjtGA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.5.tgz",
+      "integrity": "sha512-AdJKSPeEHgi7/ZhuIPtcQKr5RQdo6OO2IL87JkianiMYMPbCtot9fxPbrMiBADOWWm3T2si9stAiVsGbTQFkbA==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.5.tgz",
+      "integrity": "sha512-VGzGhj4lJO+TVGV1v8ntCZWJktV7SGCs3Pn1GRWI1SBFtRALoomm8k5E9Pmwg3HOAal2VDc2F9+PM/rEY6oIDg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-x64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.5.tgz",
+      "integrity": "sha512-D2GyJT1kjvO//drbRT3Hib9XPwQeWd9vZoBJn+bu/lVsOZ13cqNdDeqIF/xQ5/VmWvMduP6AmXvylO/PIc2isw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-arm64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.5.tgz",
+      "integrity": "sha512-GtaBgammVvdF7aPIgH2jxMDdivezgFu6iKpmT+48+F8Hhg5J/sfnDieg0aeG/jfSvkYQU2/pceFPDKlqZzwnfQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-x64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.5.tgz",
+      "integrity": "sha512-1iT4FVL0dJ76/q1wd7XDsXrSW+oLoquptvh4CLR4kITDtqi2e/xwXwdCVH8hVHU43wgJdsq7Gxuzcs6Iq/7bxQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.5.tgz",
+      "integrity": "sha512-nk4tGP3JThz4La38Uy/gzyXtpkPW8zSAmoUhK9xKKXdBCzKODMc2adkB2+8om9BDYugz+uGV7sLmpTYzvmz6Sw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-x64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.5.tgz",
+      "integrity": "sha512-PrikaNjiXdR2laW6OIjlbeuCPrPaAl0IwPIaRv+SMV8CiM8i2LqVUHFC1+8eORgWyY7yhQY+2U2fA55mBzReaw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.5.tgz",
+      "integrity": "sha512-cPzojwW2okgh7ZlRpcBEtsX7WBuqbLrNXqLU89GxWbNt6uIg78ET82qifUy3W6OVww6ZWobWub5oqZOVtwolfw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.5.tgz",
+      "integrity": "sha512-Z9kfb1v6ZlGbWj8EJk9T6czVEjjq2ntSYLY2cw6pAZl4oKtfgQuS4HOq41M/BcoLPzrUbNd+R4BXFyH//nHxVg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ia32": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.5.tgz",
+      "integrity": "sha512-sQ7l00M8bSv36GLV95BVAdhJ2QsIbCuCjh/uYrWiMQSUuV+LpXwIqhgJDcvMTj+VsQmqAHL2yYaasENvJ7CDKA==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-loong64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.5.tgz",
+      "integrity": "sha512-0ur7ae16hDUC4OL5iEnDb0tZHDxYmuQyhKhsPBV8f99f6Z9KQM02g33f93rNH5A30agMS46u2HP6qTdEt6Q1kg==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-mips64el": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.5.tgz",
+      "integrity": "sha512-kB/66P1OsHO5zLz0i6X0RxlQ+3cu0mkxS3TKFvkb5lin6uwZ/ttOkP3Z8lfR9mJOBk14ZwZ9182SIIWFGNmqmg==",
+      "cpu": [
+        "mips64el"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ppc64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.5.tgz",
+      "integrity": "sha512-UZCmJ7r9X2fe2D6jBmkLBMQetXPXIsZjQJCjgwpVDz+YMcS6oFR27alkgGv3Oqkv07bxdvw7fyB71/olceJhkQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-riscv64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.5.tgz",
+      "integrity": "sha512-kTxwu4mLyeOlsVIFPfQo+fQJAV9mh24xL+y+Bm6ej067sYANjyEw1dNHmvoqxJUCMnkBdKpvOn0Ahql6+4VyeA==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-s390x": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.5.tgz",
+      "integrity": "sha512-K2dSKTKfmdh78uJ3NcWFiqyRrimfdinS5ErLSn3vluHNeHVnBAFWC8a4X5N+7FgVE1EjXS1QDZbpqZBjfrqMTQ==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-x64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.5.tgz",
+      "integrity": "sha512-uhj8N2obKTE6pSZ+aMUbqq+1nXxNjZIIjCjGLfsWvVpy7gKCOL6rsY1MhRh9zLtUtAI7vpgLMK6DxjO8Qm9lJw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-arm64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.5.tgz",
+      "integrity": "sha512-pwHtMP9viAy1oHPvgxtOv+OkduK5ugofNTVDilIzBLpoWAM16r7b/mxBvfpuQDpRQFMfuVr5aLcn4yveGvBZvw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-x64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.5.tgz",
+      "integrity": "sha512-WOb5fKrvVTRMfWFNCroYWWklbnXH0Q5rZppjq0vQIdlsQKuw6mdSihwSo4RV/YdQ5UCKKvBy7/0ZZYLBZKIbwQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.5.tgz",
+      "integrity": "sha512-7A208+uQKgTxHd0G0uqZO8UjK2R0DDb4fDmERtARjSHWxqMTye4Erz4zZafx7Di9Cv+lNHYuncAkiGFySoD+Mw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-x64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.5.tgz",
+      "integrity": "sha512-G4hE405ErTWraiZ8UiSoesH8DaCsMm0Cay4fsFWOOUcz8b8rC6uCvnagr+gnioEjWn0wC+o1/TAHt+It+MpIMg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/sunos-x64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.5.tgz",
+      "integrity": "sha512-l+azKShMy7FxzY0Rj4RCt5VD/q8mG/e+mDivgspo+yL8zW7qEwctQ6YqKX34DTEleFAvCIUviCFX1SDZRSyMQA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-arm64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.5.tgz",
+      "integrity": "sha512-O2S7SNZzdcFG7eFKgvwUEZ2VG9D/sn/eIiz8XRZ1Q/DO5a3s76Xv0mdBzVM5j5R639lXQmPmSo0iRpHqUUrsxw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-ia32": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.5.tgz",
+      "integrity": "sha512-onOJ02pqs9h1iMJ1PQphR+VZv8qBMQ77Klcsqv9CNW2w6yLqoURLcgERAIurY6QE63bbLuqgP9ATqajFLK5AMQ==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-x64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.5.tgz",
+      "integrity": "sha512-TXv6YnJ8ZMVdX+SXWVBo/0p8LTcrUYngpWjvm91TMjjBQii7Oz11Lw5lbDV5Y0TzuhSJHwiH4hEtC1I42mMS0g==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@hive/agent": {
+      "resolved": "packages/agent",
+      "link": true
+    },
+    "node_modules/@hive/dashboard": {
+      "resolved": "packages/dashboard",
+      "link": true
+    },
+    "node_modules/@hive/shared": {
+      "resolved": "packages/shared",
+      "link": true
+    },
+    "node_modules/@kurkle/color": {
+      "version": "0.3.4",
+      "resolved": "https://registry.npmjs.org/@kurkle/color/-/color-0.3.4.tgz",
+      "integrity": "sha512-M5UknZPHRu3DEDWoipU6sE8PdkZ6Z/S+v4dD+Ke8IaNlpdSQah50lz1KtcFBa2vsdOnwbbnxJwVM4wty6udA5w==",
+      "license": "MIT"
+    },
+    "node_modules/chart.js": {
+      "version": "4.4.4",
+      "resolved": "https://registry.npmjs.org/chart.js/-/chart.js-4.4.4.tgz",
+      "integrity": "sha512-emICKGBABnxhMjUjlYRR12PmOXhJ2eJjEHL2/dZlWjxRAZT1D8xplLFq5M0tMQK8ja+wBS/tuVEJB5C6r7VxJA==",
+      "license": "MIT",
+      "dependencies": {
+        "@kurkle/color": "^0.3.0"
+      },
+      "engines": {
+        "pnpm": ">=8"
+      }
+    },
+    "node_modules/esbuild": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.5.tgz",
+      "integrity": "sha512-P8OtKZRv/5J5hhz0cUAdu/cLuPIKXpQl1R9pZtvmHWQvrAUVd0UNIPT4IB4W3rNOqVO0rlqHmCIbSwxh/c9yUQ==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.25.5",
+        "@esbuild/android-arm": "0.25.5",
+        "@esbuild/android-arm64": "0.25.5",
+        "@esbuild/android-x64": "0.25.5",
+        "@esbuild/darwin-arm64": "0.25.5",
+        "@esbuild/darwin-x64": "0.25.5",
+        "@esbuild/freebsd-arm64": "0.25.5",
+        "@esbuild/freebsd-x64": "0.25.5",
+        "@esbuild/linux-arm": "0.25.5",
+        "@esbuild/linux-arm64": "0.25.5",
+        "@esbuild/linux-ia32": "0.25.5",
+        "@esbuild/linux-loong64": "0.25.5",
+        "@esbuild/linux-mips64el": "0.25.5",
+        "@esbuild/linux-ppc64": "0.25.5",
+        "@esbuild/linux-riscv64": "0.25.5",
+        "@esbuild/linux-s390x": "0.25.5",
+        "@esbuild/linux-x64": "0.25.5",
+        "@esbuild/netbsd-arm64": "0.25.5",
+        "@esbuild/netbsd-x64": "0.25.5",
+        "@esbuild/openbsd-arm64": "0.25.5",
+        "@esbuild/openbsd-x64": "0.25.5",
+        "@esbuild/sunos-x64": "0.25.5",
+        "@esbuild/win32-arm64": "0.25.5",
+        "@esbuild/win32-ia32": "0.25.5",
+        "@esbuild/win32-x64": "0.25.5"
+      }
+    },
+    "node_modules/marked": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/marked/-/marked-4.3.0.tgz",
+      "integrity": "sha512-PRsaiG84bK+AMvxziE/lCFss8juXjNaWzVbN5tXAm4XjeaS9NAHhop+PjQxz2A9h8Q4M/xGmzP8vqNwy6JeK0A==",
+      "license": "MIT",
+      "bin": {
+        "marked": "bin/marked.js"
+      },
+      "engines": {
+        "node": ">= 12"
+      }
+    },
+    "packages/agent": {
+      "name": "@hive/agent",
+      "version": "0.0.0",
+      "dependencies": {
+        "@hive/shared": "*",
+        "chart.js": "4.4.4",
+        "marked": "4.3.0"
+      }
+    },
+    "packages/dashboard": {
+      "name": "@hive/dashboard",
+      "version": "0.0.0",
+      "dependencies": {
+        "@hive/shared": "*",
+        "marked": "4.3.0"
+      }
+    },
+    "packages/shared": {
+      "name": "@hive/shared",
+      "version": "0.0.0"
+    }
+  }
+}
diff --git a/frontend/package.json b/frontend/package.json
new file mode 100644
index 00000000..282a6480
--- /dev/null
+++ b/frontend/package.json
@@ -0,0 +1,18 @@
+{
+  "name": "hyperhive-frontend",
+  "version": "0.0.0",
+  "private": true,
+  "description": "Frontend assets for the hyperhive dashboard and per-agent UIs. Built with esbuild into static dist directories that the Rust binaries serve via tower_http::ServeDir.",
+  "workspaces": [
+    "packages/shared",
+    "packages/dashboard",
+    "packages/agent"
+  ],
+  "scripts": {
+    "build": "npm run build --workspaces --if-present",
+    "clean": "rm -rf packages/*/dist"
+  },
+  "devDependencies": {
+    "esbuild": "0.25.5"
+  }
+}
diff --git a/frontend/packages/agent/build.mjs b/frontend/packages/agent/build.mjs
new file mode 100644
index 00000000..6b231f38
--- /dev/null
+++ b/frontend/packages/agent/build.mjs
@@ -0,0 +1,60 @@
+// esbuild build for @hive/agent. Output layout (`dist/`):
+//
+//   dist/index.html            served at GET /
+//   dist/stats.html            served at GET /stats
+//   dist/screen.html           served at GET /screen
+//   dist/static/app.js         served at /static/app.js (ESM bundle,
+//                               pulls in @hive/shared + marked)
+//   dist/static/app.js.map     source map sibling
+//   dist/static/stats.js       served at /static/stats.js (pulls in
+//                               chart.js/auto)
+//   dist/static/stats.js.map   source map sibling
+//   dist/static/agent.css      served at /static/agent.css (@import
+//                               resolved from @hive/shared)
+//
+// The in-container Rust binary mounts `dist/` (with per-agent
+// `hyperhive.frontend.extraFiles` layered on top) as a
+// `tower_http::ServeDir` fallback; the layout above keeps every URL
+// the HTML references reachable without rewriting paths.
+
+import { build } from 'esbuild';
+import { mkdirSync, copyFileSync, rmSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const src = (p) => resolve(here, 'src', p);
+const dist = (p) => resolve(here, 'dist', p);
+const staticDir = (p) => resolve(here, 'dist', 'static', p);
+
+rmSync(dist(''), { recursive: true, force: true });
+mkdirSync(staticDir(''), { recursive: true });
+
+// Two JS entries: the main app + the stats page. Both bundle their
+// own deps so each page can be loaded independently.
+await build({
+  entryPoints: [src('app.js'), src('stats.js')],
+  outdir: staticDir(''),
+  bundle: true,
+  format: 'esm',
+  platform: 'browser',
+  target: ['es2022'],
+  sourcemap: true,
+  logLevel: 'info',
+});
+
+// Bundle the CSS — the @import lines pull in shared/base.css and
+// shared/terminal.css from the @hive/shared workspace dep.
+await build({
+  entryPoints: [src('agent.css')],
+  outfile: staticDir('agent.css'),
+  bundle: true,
+  loader: { '.css': 'css' },
+  logLevel: 'info',
+});
+
+for (const html of ['index.html', 'stats.html', 'screen.html']) {
+  copyFileSync(src(html), dist(html));
+}
+
+console.log('agent build ok →', dist(''));
diff --git a/frontend/packages/agent/package.json b/frontend/packages/agent/package.json
new file mode 100644
index 00000000..0d0c1759
--- /dev/null
+++ b/frontend/packages/agent/package.json
@@ -0,0 +1,15 @@
+{
+  "name": "@hive/agent",
+  "version": "0.0.0",
+  "private": true,
+  "description": "hive-ag3nt per-container web UI. Bundled by esbuild into a static dist; served by the in-container Rust binary at runtime via tower_http::ServeDir. Per-agent additions are layered on top via the hyperhive.frontend.extraFiles nix option.",
+  "type": "module",
+  "scripts": {
+    "build": "node ./build.mjs"
+  },
+  "dependencies": {
+    "@hive/shared": "*",
+    "marked": "4.3.0",
+    "chart.js": "4.4.4"
+  }
+}
diff --git a/frontend/packages/agent/src/agent.css b/frontend/packages/agent/src/agent.css
new file mode 100644
index 00000000..cd91696d
--- /dev/null
+++ b/frontend/packages/agent/src/agent.css
@@ -0,0 +1,810 @@
+/* Shared Catppuccin palette + body typography + terminal pane styles.
+   Bundled in front of the agent-only rules below via esbuild. */
+@import "@hive/shared/base.css";
+@import "@hive/shared/terminal.css";
+
+/* ─── full-screen vibec0re overhaul (issue #360) ──────────────────
+   Layout shape: fixed-position frosted-glass header at top, fixed-
+   position composer at bottom, full-viewport terminal in between.
+   The terminal scrolls — its text passes BENEATH the floating
+   header/composer with backdrop-filter blur for the frosted look.
+   Inbox + loose-ends move into the side-panel flyout; header pills
+   surface their counts as the only chrome they get. */
+
+:root {
+  /* Bumped to 6em (#394) so the agent icon can be a full-height
+     square identity anchor without crowding the two-row main column
+     (title + nav-links on top, state strip below). */
+  --agent-header-h: 6em;
+  --agent-composer-h: 3.6em;
+  --agent-frost-bg: rgba(30, 30, 46, 0.72);
+  --agent-frost-blur: blur(12px) saturate(140%);
+}
+
+html, body { height: 100%; margin: 0; }
+
+/* Legacy in-page layout retained for the sibling stats page
+   (`stats.html`) which doesn't apply `body.agent-shell` and stays
+   on a normal-document scroll. */
+body:not(.agent-shell) {
+  max-width: 110em;
+  margin: 1.5em auto;
+  padding: 0 1.5em;
+  height: auto;
+}
+.banner {
+  text-align: center;
+  margin: 0 0 1em 0;
+  font-size: 0.95em;
+  overflow-x: auto;
+  background: linear-gradient(
+    90deg,
+    var(--purple-dim) 0%,
+    var(--purple) 50%,
+    var(--purple-dim) 100%
+  );
+  background-size: 200% 100%;
+  background-position: 50% 0;
+  -webkit-background-clip: text;
+  background-clip: text;
+  color: transparent;
+  filter: drop-shadow(0 0 6px rgba(203, 166, 247, 0.45));
+}
+
+body.agent-shell {
+  background: var(--bg);
+  color: var(--fg);
+  /* Body itself doesn't scroll; the terminal does inside .agent-main. */
+  overflow: hidden;
+  /* Subtle radial accent to give the otherwise-flat full-screen
+     surface some depth and reinforce the vibec0re mood. */
+  background:
+    radial-gradient(ellipse 80% 60% at 50% 0%,
+                    rgba(203, 166, 247, 0.06) 0%,
+                    transparent 60%),
+    var(--bg);
+}
+
+.agent-header {
+  position: fixed;
+  top: 0;
+  left: 0;
+  right: 0;
+  z-index: 30;
+  min-height: var(--agent-header-h);
+  display: flex;
+  /* align-items: stretch lets the icon take the full header height
+     (it sizes itself via aspect-ratio off the stretched height). The
+     main column + pills column self-centre via inner layout. */
+  align-items: stretch;
+  gap: 0.9em;
+  padding: 0.5em 1em;
+  background: var(--agent-frost-bg);
+  -webkit-backdrop-filter: var(--agent-frost-blur);
+  backdrop-filter: var(--agent-frost-blur);
+  border-bottom: 1px solid var(--purple-dim);
+  box-shadow: 0 6px 18px rgba(0, 0, 0, 0.35);
+}
+
+/* Main column: title row on top, state strip below (#394). Centred
+   vertically against the full-height icon on the left. */
+.agent-header-main {
+  display: flex;
+  flex-direction: column;
+  justify-content: center;
+  gap: 0.45em;
+  min-width: 0;
+  flex: 1 1 auto;
+}
+.agent-header-row {
+  display: flex;
+  align-items: center;
+  gap: 0.8em;
+  flex-wrap: wrap;
+  min-width: 0;
+}
+.agent-header-title-row h2 {
+  margin: 0;
+  line-height: 1;
+}
+.agent-nav {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.4em 0.8em;
+  margin: 0;
+}
+
+.agent-state-row {
+  margin: 0;
+  gap: 0.5em;
+}
+
+/* Right cluster — flyout pills stacked / inline with the overflow
+   trigger. Vertically centred against the full-height icon, no
+   wrap; pills can drop to a row of their own under crowding via
+   the flex-wrap of `.agent-header-pills` itself. */
+.agent-header-pills {
+  display: flex;
+  align-items: center;
+  gap: 0.5em;
+  flex-shrink: 0;
+  flex-wrap: wrap;
+  justify-content: flex-end;
+  align-self: center;
+}
+
+h2, h3 {
+  color: var(--purple);
+  text-transform: uppercase;
+  letter-spacing: 0.15em;
+  text-shadow: 0 0 8px rgba(203, 166, 247, 0.4);
+}
+.agent-icon {
+  /* Square identity anchor (#394 — mara's spec). Explicit em sizing
+     so the <img>'s intrinsic (large) dimensions don't push the
+     parent flex container open via `align-items: stretch`-driven
+     height feedback. Width = header content area (header min-h 6em
+     - 2 × 0.5em padding ≈ 5em). Sticks to the top so a state-row
+     wrap doesn't drag the icon down with it. (#411) */
+  width: 5em;
+  height: 5em;
+  flex-shrink: 0;
+  align-self: flex-start;
+  border-radius: 8px;
+  box-shadow: 0 0 18px -2px rgba(203, 166, 247, 0.4);
+  object-fit: cover;
+}
+
+/* Meta-nav links (stats / screen / forge / dashboard / extras) —
+   no underline (#394 mara's spec); hover lights with cyan glow +
+   subtle background tint. Reads as a row of soft tabs rather than
+   default-styled inline anchors. */
+.agent-nav-link {
+  color: var(--cyan);
+  text-decoration: none;
+  font-size: 0.85em;
+  letter-spacing: 0.04em;
+  padding: 0.1em 0.35em;
+  border-radius: 3px;
+  text-shadow: 0 0 4px rgba(137, 220, 235, 0.4);
+  transition: color 0.15s ease, text-shadow 0.15s ease, background 0.15s ease;
+}
+.agent-nav-link:hover {
+  color: var(--fg);
+  background: rgba(137, 220, 235, 0.08);
+  text-shadow: 0 0 10px rgba(137, 220, 235, 0.85);
+}
+
+/* Overflow menu trigger — `⋯` round button on the right of the
+   pills row. Quiet by default, lights on hover / open (#394). */
+.overflow-btn {
+  background: transparent;
+  border: 1px solid var(--purple-dim);
+  color: var(--muted);
+  border-radius: 999px;
+  width: 2em;
+  height: 1.8em;
+  font-size: 1em;
+  line-height: 1;
+  cursor: pointer;
+  padding: 0;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  transition: color 0.15s ease, border-color 0.15s ease, box-shadow 0.15s ease;
+}
+.overflow-btn:hover,
+.overflow-btn[aria-expanded="true"] {
+  color: var(--purple);
+  border-color: var(--purple);
+  box-shadow: 0 0 10px -2px var(--purple);
+}
+
+/* Overflow popover — rebuild + new-session (and the dashboard
+   back-link, prepended in app.js setHeader). Positioned in JS so
+   the menu's top-right corner anchors under the trigger button.
+   `:not([hidden])` scoping (#411): the `[hidden]` HTML attribute
+   sets `display: none` via the UA stylesheet, but author CSS's
+   `display: flex` would override that. Scope display rules so
+   they apply only when the menu is unhidden. */
+.overflow-menu:not([hidden]) {
+  display: flex;
+  flex-direction: column;
+  gap: 0.15em;
+}
+.overflow-menu {
+  position: fixed;
+  background: var(--agent-frost-bg);
+  -webkit-backdrop-filter: var(--agent-frost-blur);
+  backdrop-filter: var(--agent-frost-blur);
+  border: 1px solid var(--purple-dim);
+  border-radius: 6px;
+  padding: 0.35em;
+  z-index: 40;
+  box-shadow: 0 10px 26px rgba(0, 0, 0, 0.45);
+  min-width: 14em;
+}
+.overflow-item {
+  background: transparent;
+  border: 1px solid transparent;
+  color: var(--fg);
+  font-family: inherit;
+  font-size: 0.9em;
+  text-align: left;
+  padding: 0.4em 0.7em;
+  border-radius: 4px;
+  cursor: pointer;
+  display: flex;
+  align-items: center;
+  gap: 0.6em;
+  letter-spacing: 0.06em;
+  text-decoration: none;
+  text-shadow: 0 0 4px currentColor;
+  transition: background 0.15s ease, border-color 0.15s ease, color 0.15s ease;
+}
+.overflow-item:hover {
+  background: rgba(203, 166, 247, 0.08);
+  border-color: var(--purple-dim);
+}
+.overflow-item-icon {
+  font-size: 1.05em;
+  width: 1.4em;
+  text-align: center;
+  flex-shrink: 0;
+}
+.overflow-item-rebuild { color: var(--amber); }
+.overflow-item-new-session { color: var(--amber); }
+.overflow-item-rebuild:hover,
+.overflow-item-new-session:hover {
+  background: rgba(250, 179, 135, 0.1);
+  border-color: var(--amber);
+}
+.overflow-item-dashboard { color: var(--cyan); }
+.overflow-item-dashboard:hover {
+  background: rgba(137, 220, 235, 0.1);
+  border-color: var(--cyan);
+}
+.overflow-item:disabled {
+  opacity: 0.4;
+  cursor: progress;
+}
+
+/* Header pill — inbox / loose-ends triggers. Compact, count-prominent. */
+.header-pill {
+  background: transparent;
+  border: 1px solid var(--purple-dim);
+  color: var(--fg);
+  font-family: inherit;
+  font-size: 0.85em;
+  letter-spacing: 0.04em;
+  border-radius: 999px;
+  padding: 0.25em 0.7em;
+  display: inline-flex;
+  align-items: center;
+  gap: 0.4em;
+  cursor: pointer;
+  transition: border-color 0.15s ease, box-shadow 0.15s ease, color 0.15s ease;
+}
+.header-pill:hover {
+  border-color: var(--purple);
+  color: var(--purple);
+  box-shadow: 0 0 10px -2px var(--purple);
+}
+.header-pill-icon { font-size: 1.05em; line-height: 1; }
+.header-pill-label { color: var(--muted); }
+.header-pill-count {
+  background: var(--purple-dim);
+  color: var(--purple);
+  border-radius: 999px;
+  padding: 0 0.5em;
+  min-width: 1.6em;
+  text-align: center;
+  font-weight: bold;
+  font-variant-numeric: tabular-nums;
+}
+.header-pill-inbox .header-pill-count {
+  background: rgba(250, 179, 135, 0.18);
+  color: var(--amber);
+}
+.header-pill-loose .header-pill-count {
+  background: rgba(243, 139, 168, 0.18);
+  color: var(--red);
+}
+
+.agent-main {
+  position: absolute;
+  top: 0;
+  left: 0;
+  right: 0;
+  bottom: 0;
+  overflow: hidden;
+}
+
+/* Login flow overlay: only rendered when status != online. Sits
+   centred over the (likely-empty) terminal area; doesn't take chrome
+   space in the normal online flow. */
+.agent-status-overlay {
+  position: absolute;
+  top: calc(var(--agent-header-h) + 1.5em);
+  left: 50%;
+  transform: translateX(-50%);
+  max-width: 44em;
+  width: calc(100% - 3em);
+  z-index: 10;
+}
+.agent-status-overlay:empty { display: none; }
+.agent-status-overlay > * {
+  background: var(--bg-elev);
+  border: 1px solid var(--purple-dim);
+  border-radius: 6px;
+  padding: 1em 1.2em;
+  box-shadow: 0 8px 30px rgba(0, 0, 0, 0.4);
+}
+
+.agent-composer {
+  position: fixed;
+  bottom: 0;
+  left: 0;
+  right: 0;
+  z-index: 30;
+  min-height: var(--agent-composer-h);
+  background: var(--agent-frost-bg);
+  -webkit-backdrop-filter: var(--agent-frost-blur);
+  backdrop-filter: var(--agent-frost-blur);
+  border-top: 1px solid var(--purple-dim);
+  box-shadow: 0 -6px 18px rgba(0, 0, 0, 0.35);
+}
+.agent-composer .term-input {
+  /* The composer is its own chrome now — drop the in-terminal-wrap
+     padding the legacy layout assumed. */
+  padding: 0.45em 1em;
+}
+.agent-composer .term-input .sendform-term {
+  /* No dashed top-border in the floating composer — the box-shadow
+     and frosted border already separate it from the terminal. */
+  border-top: 0;
+  padding-top: 0;
+}
+.meta { color: var(--muted); font-size: 0.85em; }
+.status-online { color: var(--green); text-shadow: 0 0 6px rgba(166, 227, 161, 0.55); }
+.status-needs-login { color: var(--amber); text-shadow: 0 0 6px rgba(250, 179, 135, 0.55); }
+code { background: rgba(203, 166, 247, 0.12); padding: 0.05em 0.3em; border-radius: 2px; }
+a {
+  color: var(--cyan);
+  text-shadow: 0 0 4px rgba(137, 220, 235, 0.5);
+}
+a:hover { color: var(--fg); text-shadow: 0 0 12px rgba(137, 220, 235, 0.9); }
+.btn {
+  font-family: inherit;
+  font-size: 1em;
+  background: var(--bg);
+  border: 1px solid var(--purple);
+  color: var(--purple);
+  padding: 0.25em 0.8em;
+  cursor: pointer;
+  letter-spacing: 0.1em;
+}
+.btn {
+  text-shadow: 0 0 4px currentColor;
+  transition: box-shadow 0.15s ease, text-shadow 0.15s ease;
+}
+.btn:hover {
+  background: rgba(205, 214, 244, 0.06);
+  text-shadow: 0 0 10px currentColor;
+  box-shadow: 0 0 10px -2px currentColor;
+}
+.btn-login { color: var(--amber); border-color: var(--amber); }
+.btn-cancel { color: var(--red); border-color: var(--red); font-size: 0.85em; padding: 0.15em 0.6em; }
+/* `.btn-rebuild` was the per-agent header chip — moved into the
+   overflow menu in #394 (`.overflow-item-rebuild` covers it now).
+   The dashboard has its own `.btn-rebuild` rule for the per-row
+   R3BU1LD form on the SW4RM tab; this one was specific to the
+   per-agent header.
+   `.btn-send` was a green send-button variant — orphaned since
+   the dashboard's compose form was retired; no live consumer left
+   in either the agent or dashboard tree. */
+.sendform { display: flex; gap: 0.6em; margin-top: 0.5em; }
+.sendform input {
+  font-family: inherit; font-size: 1em;
+  background: rgba(255, 255, 255, 0.04);
+  color: var(--fg);
+  border: 1px solid var(--purple-dim);
+  padding: 0.4em 0.6em;
+  flex: 1;
+}
+.sendform input:focus { outline: 1px solid var(--purple); }
+.loginform { display: flex; gap: 0.6em; margin-top: 0.5em; }
+.loginform input {
+  font-family: inherit; font-size: 1em;
+  background: rgba(255, 255, 255, 0.04);
+  color: var(--fg);
+  border: 1px solid var(--purple-dim);
+  padding: 0.4em 0.6em;
+  flex: 1;
+}
+.loginform input:focus { outline: 1px solid var(--purple); }
+pre.diff {
+  background: rgba(255, 255, 255, 0.03);
+  border: 1px solid var(--purple-dim);
+  padding: 0.6em 0.8em;
+  overflow-x: auto;
+  white-space: pre-wrap;
+  word-break: break-all;
+  max-height: 30em;
+}
+/* Per-agent inbox section — collapsible, dim, lives between the
+   state row and the terminal so the operator can peek at what
+   landed without scrolling through the live tail. */
+.agent-inbox {
+  margin: 0.4em 0;
+  font-size: 0.85em;
+  color: var(--muted);
+}
+.agent-inbox > summary {
+  cursor: pointer;
+  letter-spacing: 0.05em;
+  list-style: none;
+}
+.agent-inbox > summary::marker { content: ''; }
+.agent-inbox[open] > summary > span::before { content: ''; }
+.agent-inbox ul {
+  list-style: none;
+  padding: 0.4em 0.8em;
+  margin: 0.3em 0 0;
+  background: rgba(255, 255, 255, 0.02);
+  border-left: 2px solid var(--purple-dim);
+  max-height: 16em;
+  overflow-y: auto;
+}
+/* Inbox / loose-ends rows: header (from / sep / ts) on one line,
+   body on its own line below — gives the body the full panel width
+   instead of squeezing it into a fourth grid column that wrapped
+   long messages over many narrow lines (issue #376). */
+.agent-inbox li {
+  padding: 0.4em 0;
+  display: block;
+}
+.agent-inbox .inbox-ts   { color: var(--muted); font-size: 0.9em; margin-left: 0.5em; }
+.agent-inbox .inbox-from { color: var(--amber); }
+.agent-inbox .inbox-sep  { color: var(--muted); margin-left: 0.4em; }
+.agent-inbox .inbox-body {
+  display: block;
+  color: var(--fg);
+  white-space: pre-wrap;
+  word-break: break-word;
+  margin-top: 0.3em;
+  padding-left: 0.8em;
+  border-left: 2px solid var(--purple-dim);
+}
+.agent-inbox li.inbox-reply {
+  padding-left: 1em;
+  border-left: 2px solid var(--border);
+  margin-left: 0.4em;
+}
+.agent-inbox .inbox-reply-tag { color: var(--muted); font-size: 0.85em; }
+
+.agent-inbox .answer-form {
+  /* Block-level under the new layout — `grid-column: 1 / -1` was
+     for the legacy grid; under block layout the form naturally
+     starts on its own row. */
+  display: flex;
+  gap: 0.4em;
+  align-items: flex-start;
+  margin-top: 0.5em;
+  padding-left: 0.8em;
+}
+.agent-inbox .answer-form textarea {
+  flex: 1;
+  font-family: inherit;
+  font-size: inherit;
+  background: var(--bg);
+  color: var(--fg);
+  border: 1px solid var(--border);
+  border-radius: 3px;
+  padding: 0.3em;
+  resize: vertical;
+}
+.agent-inbox .answer-form button {
+  font-family: inherit;
+  font-size: inherit;
+  background: var(--bg-elev);
+  color: var(--fg);
+  border: 1px solid var(--border);
+  border-radius: 3px;
+  padding: 0.3em 0.7em;
+  cursor: pointer;
+  white-space: nowrap;
+}
+.agent-inbox .answer-form button:hover:not(:disabled) {
+  border-color: var(--purple);
+  color: var(--purple);
+}
+.agent-inbox .answer-form button:disabled { opacity: 0.5; cursor: default; }
+.agent-inbox .answer-status { color: var(--muted); align-self: center; }
+
+.last-turn {
+  color: var(--muted);
+  font-size: 0.8em;
+  letter-spacing: 0.05em;
+}
+.model-chip {
+  display: inline-block;
+  padding: 0.1em 0.6em;
+  border: 1px solid var(--purple-dim);
+  border-radius: 999px;
+  color: var(--cyan);
+  font-size: 0.78em;
+  letter-spacing: 0.04em;
+}
+/* Context-window badge. Mirrors Claude Code's bottom-right "N tokens"
+   chip — single primary number (total prompt tokens in use), full
+   breakdown on hover. Sized/coloured like a peer of model-chip so
+   the state row reads as one row of chrome. */
+.ctx-badge {
+  display: inline-block;
+  padding: 0.1em 0.6em;
+  border: 1px solid var(--purple-dim);
+  border-radius: 999px;
+  color: var(--green);
+  font-size: 0.78em;
+  letter-spacing: 0.04em;
+  cursor: default;
+  white-space: pre-line;
+}
+
+/* Harness reachability badge. Same chip shape + sizing as
+   `.state-badge` / `.model-chip` so the state row stays visually
+   uniform; colour communicates the actual reachability state. */
+.status-badge {
+  display: inline-block;
+  padding: 0.25em 0.8em;
+  border: 1px solid;
+  border-radius: 999px;
+  font-size: 0.85em;
+  letter-spacing: 0.05em;
+}
+.status-badge.status-loading      { color: var(--muted);  border-color: var(--purple-dim); }
+.status-badge.status-online       { color: var(--green);  border-color: var(--green);
+  text-shadow: 0 0 6px rgba(166, 227, 161, 0.55); }
+.status-badge.status-rate-limited { color: var(--red);    border-color: var(--red);
+  text-shadow: 0 0 6px rgba(243, 139, 168, 0.55); }
+.status-badge.status-needs-login  { color: var(--amber);  border-color: var(--amber); }
+.status-badge.status-offline      { color: var(--muted);  border-color: var(--muted); }
+/* Orphaned in #394 — `.btn-dashlink` chip beside the title moved
+   into the overflow menu (`.overflow-item-dashboard` covers it). */
+.btn-cancel-turn {
+  font-family: inherit;
+  font-size: 0.8em;
+  letter-spacing: 0.08em;
+  background: transparent;
+  color: var(--red);
+  border: 1px solid var(--red);
+  border-radius: 999px;
+  padding: 0.2em 0.8em;
+  cursor: pointer;
+  text-shadow: 0 0 4px currentColor;
+  transition: box-shadow 0.15s ease, background 0.15s ease;
+}
+.btn-cancel-turn:hover {
+  background: rgba(243, 139, 168, 0.1);
+  box-shadow: 0 0 10px -2px currentColor;
+}
+/* Orphaned in #394 — `.btn-new-session` round-pill moved into the
+   overflow menu (`.overflow-item-new-session` covers it; the
+   `:disabled` opacity treatment lives on the shared
+   `.overflow-item:disabled` rule). */
+.state-badge {
+  display: inline-block;
+  padding: 0.25em 0.8em;
+  border: 1px solid;
+  border-radius: 999px;
+  font-size: 0.85em;
+  letter-spacing: 0.05em;
+  transition: color 280ms ease, border-color 280ms ease,
+              box-shadow 280ms ease, background 280ms ease;
+}
+.state-badge.state-loading {
+  color: var(--muted); border-color: var(--purple-dim);
+}
+.state-badge.state-offline {
+  color: var(--muted); border-color: var(--muted);
+}
+.state-badge.state-idle {
+  color: var(--cyan); border-color: var(--cyan);
+  text-shadow: 0 0 6px rgba(137, 220, 235, 0.55);
+}
+.state-badge.state-thinking {
+  color: var(--amber); border-color: var(--amber);
+  text-shadow: 0 0 6px rgba(250, 179, 135, 0.65);
+  animation: badge-pulse 1.8s ease-in-out infinite;
+}
+.state-badge.state-compacting {
+  color: var(--purple); border-color: var(--purple);
+  text-shadow: 0 0 6px rgba(203, 166, 247, 0.65);
+  animation: badge-pulse 1.8s ease-in-out infinite;
+}
+.state-badge.state-just-changed {
+  animation: state-flash 600ms ease-out;
+}
+@keyframes state-flash {
+  0%   { box-shadow: 0 0 0 0   currentColor, 0 0 0 0   currentColor; }
+  60%  { box-shadow: 0 0 18px -4px currentColor, 0 0 4px 0 currentColor; }
+  100% { box-shadow: 0 0 0 0   currentColor, 0 0 0 0   currentColor; }
+}
+/* Full-screen overrides for the shared terminal rules. The base
+   `.terminal-wrap` (in shared/src/terminal.css) ships a crust-on-
+   black frame for the in-page case; the agent page now owns the
+   whole viewport so the frame chrome would be redundant noise.
+   `.live.terminal` similarly drops the in-page max-height cap so
+   it can fill the main area top-to-bottom; the floating header +
+   composer overlay it via fixed positioning. */
+.agent-main .terminal-wrap {
+  position: absolute;
+  inset: 0;
+  border: 0;
+  background: transparent;
+  box-shadow: none;
+  border-radius: 0;
+  margin: 0;
+  padding: 0;
+}
+.agent-main .live.terminal {
+  position: absolute;
+  inset: 0;
+  height: auto;
+  max-height: none;
+  /* Scroll behind the floating header/composer, but keep the first
+     and last rows reachable with extra padding inside the scroll
+     area. scroll-padding-* keeps anchor-jumps (the `↓ N new` pill,
+     focus restore) clear of the floats too. */
+  padding-top: calc(var(--agent-header-h) + 0.8em);
+  padding-bottom: calc(var(--agent-composer-h) + 0.8em);
+  scroll-padding-top: calc(var(--agent-header-h) + 0.8em);
+  scroll-padding-bottom: calc(var(--agent-composer-h) + 0.8em);
+  overflow: auto;
+}
+/* Tail pill (↓ N new): nudged up so it floats clear of the composer
+   rather than colliding with the frosted bar. z-index bumped above
+   the composer (z-30) so the pill sits on the top layer instead of
+   being clipped by the floating chrome (issue #375). */
+.agent-main .tail-pill {
+  bottom: calc(var(--agent-composer-h) + 0.6em);
+  z-index: 35;
+}
+
+/* Composer chrome — used to live inside `.terminal-wrap`; now lives
+   inside the fixed `.agent-composer` defined further up. The base
+   rules below stay scoped to whichever ancestor owns it. */
+.term-input .sendform-term {
+  display: flex;
+  align-items: flex-start;
+  gap: 0.5em;
+  /* The dashed in-frame separator is dropped — see the
+     .agent-composer .term-input override above for the floating-bar
+     variant. */
+  border-top: 1px dashed var(--purple-dim);
+  padding-top: 0.5em;
+}
+.term-input .prompt, .term-input .submit-hint {
+  padding-top: 0.25em;
+}
+.term-input .prompt {
+  color: var(--green);
+  text-shadow: 0 0 6px rgba(166, 227, 161, 0.6);
+  user-select: none;
+  flex: 0 0 auto;
+}
+.term-input textarea {
+  flex: 1;
+  background: transparent;
+  border: 0;
+  outline: 0;
+  color: var(--fg);
+  font-family: inherit;
+  font-size: 1em;
+  padding: 0.2em 0;
+  caret-color: var(--green);
+  resize: none;
+  overflow-y: auto;
+  line-height: 1.4;
+  min-height: 1.4em;
+}
+.term-input textarea::placeholder { color: var(--muted); }
+.term-input .submit-hint { color: var(--muted); font-size: 0.8em; flex: 0 0 auto; }
+.term-input.disabled .prompt { color: var(--muted); text-shadow: none; }
+.term-input.disabled textarea { color: var(--muted); }
+/* Row + pill + details styling moved to hive-fr0nt::TERMINAL_CSS. */
+
+/* ─── side panel (singleton drawer) ────────────────────────────────
+   Inbox + loose-ends details open here instead of expanding inline
+   (issue #360). Copy of the dashboard's side-panel pattern —
+   candidate for extraction into @hive/shared once both surfaces
+   stabilize. */
+.side-panel {
+  position: fixed;
+  inset: 0;
+  z-index: 50;
+  /* Closed: ignore pointer events so the agent page underneath stays
+     interactive; `.open` flips it back on. */
+  pointer-events: none;
+}
+.side-panel-backdrop {
+  position: absolute;
+  inset: 0;
+  background: rgba(0, 0, 0, 0.55);
+  opacity: 0;
+  transition: opacity 0.2s ease;
+}
+.side-panel-drawer {
+  position: absolute;
+  top: 0;
+  right: 0;
+  bottom: 0;
+  width: min(640px, 92vw);
+  display: flex;
+  flex-direction: column;
+  background: var(--bg-elev);
+  border-left: 2px solid var(--purple);
+  box-shadow: -10px 0 30px rgba(0, 0, 0, 0.45);
+  transform: translateX(100%);
+  transition: transform 0.25s ease;
+}
+.side-panel.open { pointer-events: auto; }
+.side-panel.open .side-panel-backdrop { opacity: 1; }
+.side-panel.open .side-panel-drawer { transform: translateX(0); }
+.side-panel-head {
+  flex: 0 0 auto;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 1em;
+  padding: 0.7em 1em;
+  border-bottom: 1px solid var(--border);
+}
+.side-panel-title {
+  color: var(--purple);
+  font-weight: bold;
+  letter-spacing: 0.05em;
+  word-break: break-all;
+}
+.side-panel-close {
+  flex: 0 0 auto;
+  background: var(--bg);
+  color: var(--fg);
+  border: 1px solid var(--border);
+  font-family: inherit;
+  font-size: 1em;
+  line-height: 1;
+  padding: 0.25em 0.55em;
+  cursor: pointer;
+}
+.side-panel-close:hover { border-color: var(--red); color: var(--red); }
+.side-panel-body {
+  flex: 1 1 auto;
+  overflow: auto;
+  padding: 0.8em 1em;
+}
+/* Inbox / loose-ends lists rendered into the side-panel body. The
+   legacy <details>-collapsible variant of .agent-inbox is gone, so
+   here we strip the inbox-only chrome (background, border-left) and
+   let the panel body's own padding own the framing. */
+.side-panel-body .agent-inbox {
+  margin: 0;
+  font-size: inherit;
+  color: var(--fg);
+}
+.side-panel-body .agent-inbox ul {
+  background: transparent;
+  border-left: 0;
+  padding: 0;
+  max-height: none;
+  overflow: visible;
+}
+
+/* Empty-state placeholders for the side panel (when count drops to 0
+   between the click and the render — rare, but possible). */
+.side-panel-empty {
+  color: var(--muted);
+  font-style: italic;
+  padding: 1em 0;
+}
diff --git a/frontend/packages/agent/src/app.js b/frontend/packages/agent/src/app.js
new file mode 100644
index 00000000..d82ecce1
--- /dev/null
+++ b/frontend/packages/agent/src/app.js
@@ -0,0 +1,1356 @@
+// Per-agent web UI. Renders title + login/online view from `/api/state`,
+// tails `/events/stream` for live claude events, drives async-form
+// actions (send / login/* / dashboard rebuild).
+
+import { create as termCreate, linkify as termLinkify } from '@hive/shared/terminal.js';
+import { marked } from 'marked';
+
+// Expose the previously-script-tag-provided globals so the IIFE below
+// keeps working unchanged. Pre-split these were attached by
+// `/static/hive-fr0nt.js` (HiveTerminal) and `/static/marked.js`
+// (marked) loading before app.js. The bundle now pulls them in via ES
+// imports; once the IIFE is opened up these aliases can be dropped in
+// favour of direct named imports.
+window.HiveTerminal = { create: termCreate, linkify: termLinkify };
+window.marked = marked;
+
+(() => {
+  // ─── helpers ────────────────────────────────────────────────────────────
+  const $ = (id) => document.getElementById(id);
+  const escText = (s) => String(s).replace(/[&<>"]/g, (c) =>
+    ({ '&':'&amp;', '<':'&lt;', '>':'&gt;', '"':'&quot;' }[c])
+  );
+  const el = (tag, attrs = {}, ...children) => {
+    const e = document.createElement(tag);
+    for (const [k, v] of Object.entries(attrs)) {
+      if (k === 'class') e.className = v;
+      else if (k === 'html') e.innerHTML = v;
+      else e.setAttribute(k, v);
+    }
+    for (const c of children) {
+      if (c == null) continue;
+      e.append(c.nodeType ? c : document.createTextNode(c));
+    }
+    return e;
+  };
+
+  // Base URL of the host dashboard (core backend). Set once the first
+  // /api/state lands. Operator-authority actions (answering a question
+  // as the operator) POST here rather than to this agent's own socket —
+  // see docs/boundary.md for why the boundary lives on the core side.
+  let dashboardBase = '';
+
+  // ─── async-form submit (shared with dashboard) ──────────────────────────
+  document.addEventListener('submit', async (e) => {
+    const f = e.target;
+    if (!(f instanceof HTMLFormElement) || !f.hasAttribute('data-async')) return;
+    e.preventDefault();
+    if (f.dataset.confirm && !confirm(f.dataset.confirm)) return;
+    const btn = f.querySelector('button[type="submit"], button:not([type])');
+    const original = btn ? btn.innerHTML : '';
+    if (btn) { btn.disabled = true; btn.innerHTML = '<span class="spinner">◐</span>'; }
+    try {
+      const resp = await fetch(f.action, {
+        method: f.method || 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams(new FormData(f)),
+        redirect: 'manual',
+      });
+      const ok = resp.ok || resp.type === 'opaqueredirect'
+        || (resp.status >= 200 && resp.status < 400);
+      if (!ok) {
+        const text = await resp.text().catch(() => '');
+        alert('action failed: ' + resp.status + (text ? '\n\n' + text : ''));
+        if (btn) { btn.disabled = false; btn.innerHTML = original; }
+        return;
+      }
+      // Clear text inputs the operator typed into (the form value was sent).
+      f.querySelectorAll('input[type="text"], input:not([type]), textarea').forEach((i) => { i.value = ''; });
+      // Re-enable the button — refreshState() often skips re-rendering the
+      // form (status unchanged), so without this the spinner sticks and
+      // the operator can't submit again.
+      if (btn) { btn.disabled = false; btn.innerHTML = original; }
+      refreshState();
+    } catch (err) {
+      alert('action failed: ' + err);
+      if (btn) { btn.disabled = false; btn.innerHTML = original; }
+    }
+  });
+
+  // ─── side panel (singleton drawer for inbox + loose-ends flyouts) ──────
+  // Shared shape with the dashboard's panel. Candidate for extraction
+  // into @hive/shared in a follow-up — keeping the duplication for
+  // now to land #360 without simultaneously refactoring the dashboard.
+  const Panel = (() => {
+    const root = $('side-panel');
+    const titleEl = $('side-panel-title');
+    const bodyEl = $('side-panel-body');
+    /** Owner key (e.g. 'inbox', 'loose-ends'). Refresh hooks check
+     *  against this so a live event only re-renders the panel when
+     *  the matching view is actually visible. null when closed. */
+    let owner = null;
+    function open(name, title, content) {
+      owner = name;
+      titleEl.textContent = title;
+      bodyEl.replaceChildren(...(content ? [content] : []));
+      root.classList.add('open');
+      root.setAttribute('aria-hidden', 'false');
+    }
+    function close() {
+      owner = null;
+      root.classList.remove('open');
+      root.setAttribute('aria-hidden', 'true');
+    }
+    function refresh(name, title, content) {
+      if (owner !== name) return;
+      titleEl.textContent = title;
+      bodyEl.replaceChildren(...(content ? [content] : []));
+    }
+    function bind() {
+      $('side-panel-close').addEventListener('click', close);
+      $('side-panel-backdrop').addEventListener('click', close);
+      document.addEventListener('keydown', (e) => {
+        if (e.key === 'Escape' && root.classList.contains('open')) close();
+      });
+    }
+    return { open, close, refresh, bind, currentOwner: () => owner };
+  })();
+  Panel.bind();
+
+  // Wire the header pills to open the side panel. Pre-built (vs
+  // re-building per-click) so the freshest snapshot already lives
+  // in `lastInbox` / `lastLooseEnds` when the pill is clicked — even
+  // if it fires during a turn the render is the same.
+  (function bindHeaderPills() {
+    const inboxPill = $('inbox-pill');
+    if (inboxPill) {
+      inboxPill.addEventListener('click', () => {
+        Panel.open('inbox', 'inbox · ' + lastInbox.length,
+          buildInboxList(lastInbox));
+      });
+    }
+    const loosePill = $('loose-ends-pill');
+    if (loosePill) {
+      loosePill.addEventListener('click', () => {
+        Panel.open('loose-ends', 'loose ends · ' + lastLooseEnds.length,
+          buildLooseEndsList(lastLooseEnds));
+      });
+    }
+  })();
+
+  // ─── state rendering ────────────────────────────────────────────────────
+  function setHeader(label, dashboardPort) {
+    const title = $('title');
+    // Title is now just the glowing identity glyph — DASHB04RD,
+    // R3BU1LD, NEW SESSION all live in the overflow `⋯` menu now
+    // (#394). Glow + uppercase styling from h2 / .agent-header-title-row.
+    title.textContent = `◆ ${label} ◆`;
+    document.title = `${label} // hyperhive`;
+    const dashUrl = `${location.protocol}//${location.hostname}:${dashboardPort}/`;
+    dashboardBase = dashUrl;
+    populateOverflowMenu(label, dashUrl);
+  }
+
+  // Overflow popover: dashboard back-link + rebuild + new-session.
+  // Per #394 mara's spec — rebuild + new-session both moved off the
+  // header strip into the `⋯` menu (rare actions, both destructive
+  // enough to warrant one extra click; the operator rebuilds from
+  // the host dashboard normally). Dashboard link also slotted in so
+  // every "leave this page" action lives in one menu.
+  let overflowMenuPopulated = false;
+  function populateOverflowMenu(label, dashUrl) {
+    const menu = $('overflow-menu');
+    if (!menu) return;
+    menu.replaceChildren();
+
+    // ↑ dashboard — host dashboard back-link (was `.btn-dashlink`
+    // beside the title pre-#394).
+    menu.append(el('a', {
+      class: 'overflow-item overflow-item-dashboard',
+      href: dashUrl,
+      target: '_blank',
+      rel: 'noopener',
+      role: 'menuitem',
+    },
+      el('span', { class: 'overflow-item-icon', 'aria-hidden': 'true' }, '↑'),
+      'dashboard',
+    ));
+
+    // ↻ rebuild — POST `{dash}/rebuild/{label}` after a confirm.
+    // Same shape as the old `.btn-rebuild` handler.
+    const rebuildBtn = el('button', {
+      type: 'button',
+      class: 'overflow-item overflow-item-rebuild',
+      role: 'menuitem',
+      id: 'rebuild-btn',
+    },
+      el('span', { class: 'overflow-item-icon', 'aria-hidden': 'true' }, '↻'),
+      'rebuild container',
+    );
+    rebuildBtn.addEventListener('click', () => {
+      if (!window.confirm(`rebuild ${label}? container will hot-reload.`)) return;
+      closeOverflowMenu();
+      const f = document.createElement('form');
+      f.method = 'POST';
+      f.action = `${dashUrl}rebuild/${label}`;
+      document.body.appendChild(f);
+      f.submit();
+    });
+    menu.append(rebuildBtn);
+
+    // ↻ new session — arms a one-shot for the next turn. Mildly
+    // destructive (drops --continue context) so we confirm.
+    const newSessBtn = el('button', {
+      type: 'button',
+      class: 'overflow-item overflow-item-new-session',
+      role: 'menuitem',
+      id: 'new-session-btn',
+      title: 'next turn runs without --continue, starting a fresh claude session',
+    },
+      el('span', { class: 'overflow-item-icon', 'aria-hidden': 'true' }, '↻'),
+      'new claude session',
+    );
+    newSessBtn.addEventListener('click', () => {
+      if (!window.confirm('arm a fresh claude session for the next turn? all prior --continue context will be dropped.')) return;
+      newSessBtn.disabled = true;
+      closeOverflowMenu();
+      postNewSession().finally(() => { newSessBtn.disabled = false; });
+    });
+    menu.append(newSessBtn);
+
+    overflowMenuPopulated = true;
+  }
+
+  function openOverflowMenu() {
+    const btn = $('overflow-btn');
+    const menu = $('overflow-menu');
+    if (!btn || !menu || !overflowMenuPopulated) return;
+    // Position the menu so its top-right corner anchors just below
+    // the trigger button's bottom-right edge. Using fixed positioning
+    // + getBoundingClientRect so we don't get trapped in any of the
+    // header's stacking contexts.
+    const r = btn.getBoundingClientRect();
+    menu.style.top = `${Math.round(r.bottom + 6)}px`;
+    // Render off-screen first to measure, then anchor the right edge.
+    menu.hidden = false;
+    const mr = menu.getBoundingClientRect();
+    menu.style.left = `${Math.round(r.right - mr.width)}px`;
+    btn.setAttribute('aria-expanded', 'true');
+  }
+  function closeOverflowMenu() {
+    const btn = $('overflow-btn');
+    const menu = $('overflow-menu');
+    if (!btn || !menu) return;
+    menu.hidden = true;
+    btn.setAttribute('aria-expanded', 'false');
+  }
+  function toggleOverflowMenu() {
+    const menu = $('overflow-menu');
+    if (!menu) return;
+    if (menu.hidden) openOverflowMenu();
+    else closeOverflowMenu();
+  }
+  // Wire once on boot. The trigger itself + click-outside + Escape
+  // dismissal pattern matches the side-panel flyout (Panel).
+  (function bindOverflowMenu() {
+    const btn = $('overflow-btn');
+    if (!btn) return;
+    btn.addEventListener('click', (e) => {
+      e.stopPropagation();
+      toggleOverflowMenu();
+    });
+    document.addEventListener('click', (e) => {
+      const menu = $('overflow-menu');
+      if (!menu || menu.hidden) return;
+      if (menu.contains(e.target) || btn.contains(e.target)) return;
+      closeOverflowMenu();
+    });
+    document.addEventListener('keydown', (e) => {
+      const menu = $('overflow-menu');
+      if (e.key === 'Escape' && menu && !menu.hidden) {
+        closeOverflowMenu();
+        btn.focus();
+      }
+    });
+  })();
+
+  function renderOnline(_label, _root) {
+    // Online state is conveyed by the `#alive-badge` chip in the
+    // state row — no longer a separate paragraph in the status
+    // block (keeps the terminal the star, status row stays compact).
+  }
+
+  function renderNeedsLoginIdle(root) {
+    root.append(
+      el('p', { class: 'status-needs-login' }, '◌ NEEDS L0G1N'),
+      el('p', { html:
+        'No Claude session in <code>~/.claude/</code>. The harness is up but the turn loop is paused until you log in.',
+      }),
+    );
+    const start = el('form', {
+      action: '/login/start', method: 'POST', 'data-async': '',
+    });
+    start.append(
+      el('button', { type: 'submit', class: 'btn btn-login' }, '◆ ST4RT L0G1N'),
+    );
+    root.append(start);
+    root.append(el('p', { class: 'meta', html:
+      'Spawns <code>claude auth login</code> over plain stdio pipes. The OAuth URL will appear here when claude emits it; paste the resulting code back into the form below.',
+    }));
+  }
+
+  function renderLoginInProgress(s, root) {
+    root.append(el('p', { class: 'status-needs-login' }, '◌ L0G1N 1N PR0GRESS'));
+    if (s.url) {
+      const link = el('a', {
+        href: s.url, target: '_blank', rel: 'noreferrer',
+      }, s.url);
+      root.append(el('p', {}, '▶ ', link));
+      root.append(el('p', { class: 'meta' },
+        'open this URL in a browser, complete the OAuth flow, paste the resulting code below.',
+      ));
+    } else {
+      root.append(el('p', { class: 'meta' },
+        'waiting for claude to emit an OAuth URL on stdout… (output below)',
+      ));
+    }
+    if (!s.finished) {
+      const code = el('form', {
+        action: '/login/code', method: 'POST', class: 'loginform', 'data-async': '',
+      });
+      code.append(
+        el('input', {
+          name: 'code', placeholder: 'paste OAuth code here',
+          required: '', autocomplete: 'off',
+        }),
+        el('button', { type: 'submit', class: 'btn btn-login' }, '◆ S3ND C0DE'),
+      );
+      root.append(code);
+    }
+    const cancel = el('form', {
+      action: '/login/cancel', method: 'POST', 'data-async': '',
+      style: 'margin-top: 0.4em;',
+    });
+    cancel.append(el('button', { type: 'submit', class: 'btn btn-cancel' }, 'cancel + kill'));
+    root.append(cancel);
+    if (s.finished) {
+      root.append(el('p', { class: 'status-needs-login' },
+        `claude process exited: ${s.exit_note || 'exited'}. Start over if needed.`,
+      ));
+    }
+    root.append(el('h3', {}, 'output'));
+    root.append(el('pre', { class: 'diff' }, s.output || ''));
+  }
+
+  let headerSet = false;
+  let lastStatus = null;
+  let lastOutputLen = -1;
+  let pollTimer = null;
+  let termInputRendered = false;
+  // Filled in by the live-event IIFE below. Used by the slash-command
+  // dispatcher to print local-only rows ('help', errors) and to clear
+  // the terminal on `/clear`.
+  let termAPI = null;
+  // Label captured from the first /api/state cold load — used by the
+  // bus-driven `status_changed` handler so it can re-enable the
+  // composer without waiting for the next snapshot fetch.
+  let currentLabel = '';
+
+  const SLASH_COMMANDS = [
+    { name: '/help',        desc: 'list slash commands' },
+    { name: '/clear',       desc: 'wipe the terminal panel (local-only)' },
+    { name: '/cancel',      desc: 'SIGINT the in-flight claude turn' },
+    { name: '/compact',     desc: 'compact the persistent claude session' },
+    { name: '/model',       desc: '/model <name>  — switch claude model for future turns' },
+    { name: '/new-session', desc: 'next turn runs without --continue (fresh claude session)' },
+  ];
+
+  async function postModel(name) {
+    try {
+      const resp = await fetch('/api/model', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({ model: name }),
+        redirect: 'manual',
+      });
+      const ok = resp.ok || resp.type === 'opaqueredirect'
+        || (resp.status >= 200 && resp.status < 400);
+      if (!ok && termAPI) {
+        const text = await resp.text().catch(() => '');
+        termAPI.row('turn-end-fail', '✗ /model failed: ' + resp.status
+          + (text ? ' — ' + text : ''));
+      }
+      // No refreshState — the harness emits `model_changed` on the
+      // SSE bus and the chip handler picks it up live.
+    } catch (err) {
+      if (termAPI) termAPI.row('turn-end-fail', '✗ /model failed: ' + err);
+    }
+  }
+
+  async function postSimple(url, label) {
+    try {
+      const resp = await fetch(url, { method: 'POST', redirect: 'manual' });
+      const ok = resp.ok || resp.type === 'opaqueredirect'
+        || (resp.status >= 200 && resp.status < 400);
+      if (!ok && termAPI) {
+        termAPI.row('turn-end-fail', '✗ ' + label + ' failed: http ' + resp.status);
+      }
+    } catch (err) {
+      if (termAPI) termAPI.row('turn-end-fail', '✗ ' + label + ' failed: ' + err);
+    }
+  }
+  const postCancelTurn = () => postSimple('/api/cancel',  '/cancel');
+  const postCompact    = () => postSimple('/api/compact', '/compact');
+  const postNewSession = () => postSimple('/api/new-session', '/new-session');
+
+  function handleSlashCommand(line) {
+    if (!termAPI) return false;
+    const trimmed = line.trim();
+    if (!trimmed.startsWith('/')) return false;
+    const [cmd] = trimmed.split(/\s+/);
+    switch (cmd) {
+      case '/help':
+        termAPI.row('note', '· /help');
+        for (const c of SLASH_COMMANDS) {
+          termAPI.row('note', '    ' + c.name.padEnd(10) + ' — ' + c.desc);
+        }
+        return true;
+      case '/clear':
+        termAPI.clear();
+        termAPI.row('note', '· terminal cleared (local view only — server history kept)');
+        return true;
+      case '/cancel':
+        postCancelTurn();
+        return true;
+      case '/compact':
+        postCompact();
+        return true;
+      case '/new-session':
+        if (window.confirm('arm a fresh claude session for the next turn? all prior --continue context will be dropped.')) {
+          postNewSession();
+        }
+        return true;
+      case '/model': {
+        const parts = trimmed.split(/\s+/);
+        if (parts.length < 2 || !parts[1]) {
+          termAPI.row('turn-end-fail',
+            '✗ /model needs a name (e.g. /model haiku, /model sonnet, /model opus)');
+        } else {
+          postModel(parts[1]);
+        }
+        return true;
+      }
+      default:
+        termAPI.row('turn-end-fail', '✗ unknown slash command: ' + cmd + ' — try /help');
+        return true;
+    }
+  }
+
+  // Cycle through commands when operator hits Tab on a `/…` prefix.
+  function completeSlash(prefix) {
+    const matches = SLASH_COMMANDS.filter((c) => c.name.startsWith(prefix));
+    if (!matches.length) return null;
+    // Cycle: when the current prefix already equals a command name,
+    // advance to the next match.
+    const idx = matches.findIndex((c) => c.name === prefix);
+    return matches[(idx + 1) % matches.length].name;
+  }
+
+  function renderTermInput(label, online) {
+    const slot = $('term-input');
+    if (!slot) return;
+    if (!termInputRendered) {
+      slot.innerHTML = '';
+      const form = el('form', {
+        action: '/send', method: 'POST',
+        class: 'sendform-term', 'data-async': '',
+      });
+      const ta = el('textarea', {
+        name: 'body', placeholder: 'message ' + label + '…',
+        required: '', autocomplete: 'off', rows: '1',
+      });
+      // Enter submits, Shift+Enter inserts a newline. Auto-grow up to
+      // ~8 rows of content, then scroll inside the textarea.
+      const MAX_PX = 12 * 16; // ~8 lines @ 1.5 line-height, 1em base
+      const grow = () => {
+        ta.style.height = 'auto';
+        ta.style.height = Math.min(ta.scrollHeight, MAX_PX) + 'px';
+      };
+      ta.addEventListener('input', grow);
+      ta.addEventListener('keydown', (e) => {
+        // Tab-complete slash commands when the buffer starts with `/`.
+        if (e.key === 'Tab' && ta.value.startsWith('/') && !ta.value.includes(' ')) {
+          const next = completeSlash(ta.value);
+          if (next) { e.preventDefault(); ta.value = next; return; }
+        }
+        if (e.key === 'Enter' && !e.shiftKey && !e.isComposing) {
+          e.preventDefault();
+          const line = ta.value;
+          if (!line.trim()) return;
+          // Intercept slash commands locally; never send them to the agent.
+          if (line.trim().startsWith('/')) {
+            if (handleSlashCommand(line)) {
+              ta.value = '';
+              grow();
+              return;
+            }
+          }
+          form.requestSubmit();
+        }
+      });
+      // Reset height after async submit clears the value.
+      form.addEventListener('submit', () => setTimeout(grow, 0));
+      form.append(
+        el('span', { class: 'prompt' }, 'operator@' + label + ' ▸'),
+        ta,
+        el('span', { class: 'submit-hint' }, '↵ send · ⇧↵ newline · /help'),
+      );
+      slot.append(form);
+      termInputRendered = true;
+    }
+    slot.classList.toggle('disabled', !online);
+    const ta = slot.querySelector('textarea');
+    if (ta) ta.disabled = !online;
+  }
+
+  // Granular state badge: idle / thinking / offline. Driven from SSE
+  // turn_start/turn_end. Age timer ticks client-side; badge re-renders
+  // each second so the "· 12s" suffix stays current. State changes
+  // trigger a short flash animation via .state-just-changed.
+  const STATE_LABELS = {
+    loading:    { glyph: '…',  text: 'booting' },
+    offline:    { glyph: '○',  text: 'offline' },
+    idle:       { glyph: '💤', text: 'idle' },
+    thinking:   { glyph: '🧠', text: 'thinking' },
+    compacting: { glyph: '📦', text: 'compacting' },
+  };
+  let stateName = 'loading';
+  let stateSince = Date.now();
+  let stateTickTimer = null;
+  function fmtAge(ms) {
+    const s = Math.floor(ms / 1000);
+    if (s < 60) return s + 's';
+    const m = Math.floor(s / 60);
+    if (m < 60) return m + 'm ' + (s % 60) + 's';
+    const h = Math.floor(m / 60);
+    return h + 'h ' + (m % 60) + 'm';
+  }
+  const STATE_TOOLTIPS = {
+    loading:    'harness not yet contacted',
+    offline:    'harness unreachable or claude not logged in',
+    idle:       'turn loop running, no claude invocation in flight',
+    thinking:   'claude is executing the current turn',
+    compacting: 'operator-triggered /compact running on the persistent session',
+  };
+  function renderStateBadge() {
+    const badge = $('state-badge');
+    if (!badge) return;
+    const def = STATE_LABELS[stateName] || STATE_LABELS.loading;
+    const age = fmtAge(Date.now() - stateSince);
+    badge.textContent = def.glyph + ' ' + def.text + ' · ' + age;
+    badge.className = 'state-badge state-' + stateName;
+    badge.title = (STATE_TOOLTIPS[stateName] || '') + '\nin this state for ' + age;
+    const cancelBtn = $('cancel-btn');
+    if (cancelBtn) cancelBtn.hidden = stateName !== 'thinking';
+  }
+  function setState(next) {
+    setStateAbs(next, Math.floor(Date.now() / 1000));
+  }
+  /// Set state with an authoritative since-unix from the server. Lets
+  /// `last turn` track the actual server-side duration rather than
+  /// whatever the client perceived between SSE events.
+  function setStateAbs(next, sinceUnix) {
+    if (next === stateName && sinceUnix * 1000 === stateSince) return;
+    if (stateName === 'thinking' && next !== 'thinking') {
+      const elapsedMs = Date.now() - stateSince;
+      renderLastTurn(elapsedMs);
+    }
+    const flashing = next !== stateName;
+    stateName = next;
+    stateSince = sinceUnix * 1000;
+    const badge = $('state-badge');
+    if (badge && flashing) {
+      badge.classList.remove('state-just-changed');
+      void badge.offsetWidth;
+      badge.classList.add('state-just-changed');
+    }
+    renderStateBadge();
+  }
+  // Loose-ends section: same data the get_loose_ends MCP tool
+  // returns. Best-effort fetch on cold load + after every turn_end
+  // (a turn likely answered or asked something). Silent failure
+  // keeps the pill count at zero rather than surfacing a stale chrome.
+  async function refreshLooseEnds() {
+    try {
+      const resp = await fetch('/api/loose-ends');
+      if (!resp.ok) {
+        renderLooseEnds([]);
+        return;
+      }
+      const data = await resp.json();
+      renderLooseEnds(data.loose_ends || []);
+    } catch (err) {
+      console.warn('loose-ends fetch failed', err);
+      renderLooseEnds([]);
+    }
+  }
+  /** Latest snapshot kept in module state so the pill click handler
+   *  has fresh data to render into the panel without re-fetching. */
+  let lastLooseEnds = [];
+  let lastInbox = [];
+
+  function buildLooseEndsList(threads) {
+    // Returns the <div> the side panel renders. The structural shape
+    // mirrors the legacy <details>-collapsible block — same CSS rules
+    // apply via `.side-panel-body .agent-inbox`.
+    const wrap = el('div', { class: 'agent-inbox' });
+    if (!threads.length) {
+      wrap.append(el('p', { class: 'side-panel-empty' },
+        'no loose ends — every question, approval and reminder is resolved.'));
+      return wrap;
+    }
+    const list = el('ul');
+    const fmtAge = (s) => {
+      if (s < 60) return s + 's';
+      if (s < 3600) return Math.floor(s / 60) + 'm';
+      if (s < 86400) return Math.floor(s / 3600) + 'h';
+      return Math.floor(s / 86400) + 'd';
+    };
+    for (const t of threads) {
+      const li = el('li');
+      if (t.kind === 'approval') {
+        li.append(
+          el('span', { class: 'inbox-from' }, '◇ approval #' + t.id), ' ',
+          el('span', { class: 'inbox-sep' }, t.agent + ' @ ' + (t.commit_ref || '').slice(0, 12)), ' ',
+          el('span', { class: 'inbox-ts' }, fmtAge(t.age_seconds || 0) + ' ago'),
+        );
+        if (t.description) {
+          li.append(el('div', { class: 'inbox-body' }, t.description));
+        }
+      } else if (t.kind === 'question') {
+        const target = t.target || 'operator';
+        li.append(
+          el('span', { class: 'inbox-from' }, '? #' + t.id), ' ',
+          el('span', { class: 'inbox-sep' }, t.asker + ' → ' + target), ' ',
+          el('span', { class: 'inbox-ts' }, fmtAge(t.age_seconds || 0) + ' ago'),
+          el('div', { class: 'inbox-body' }, t.question || ''),
+          buildAnswerForm(t.id),
+        );
+      } else if (t.kind === 'reminder') {
+        // due_at is an absolute unix-seconds value; show time-until-fire
+        // (negative when overdue, fmtAge handles 0/positive case here).
+        const now = Math.floor(Date.now() / 1000);
+        const dueIn = (t.due_at || 0) - now;
+        const dueLabel = dueIn >= 0 ? 'in ' + fmtAge(dueIn) : fmtAge(-dueIn) + ' overdue';
+        li.append(
+          el('span', { class: 'inbox-from' }, '⏰ reminder #' + t.id), ' ',
+          el('span', { class: 'inbox-sep' }, t.owner + ' · due ' + dueLabel), ' ',
+          el('span', { class: 'inbox-ts' }, 'scheduled ' + fmtAge(t.age_seconds || 0) + ' ago'),
+          el('div', { class: 'inbox-body' }, t.message || ''),
+        );
+      } else {
+        li.append(el('span', { class: 'inbox-body' }, JSON.stringify(t)));
+      }
+      list.append(li);
+    }
+    wrap.append(list);
+    return wrap;
+  }
+
+  /** Pill-count + open-panel-refresh wiring for loose-ends. The legacy
+   *  in-page `<details>` block is gone — operator clicks the header
+   *  pill to surface the list in the side panel. */
+  function renderLooseEnds(threads) {
+    lastLooseEnds = threads;
+    const pill = $('loose-ends-pill');
+    const count = $('loose-ends-count');
+    if (count) count.textContent = threads.length;
+    if (pill) pill.hidden = threads.length === 0;
+    Panel.refresh('loose-ends', 'loose ends · ' + threads.length,
+      buildLooseEndsList(threads));
+  }
+
+  // Inline "answer as operator" form for a question loose-end. POSTs to
+  // the host dashboard (core backend), never this agent's socket — the
+  // core is the only place that can stamp `operator` as the answerer.
+  function buildAnswerForm(id) {
+    const wrap = el('div', { class: 'answer-form' });
+    const ta = el('textarea', { rows: '2', placeholder: 'answer as operator…' });
+    const btn = el('button', { type: 'button' }, 'send answer');
+    const status = el('span', { class: 'answer-status' });
+    btn.addEventListener('click', async () => {
+      const answer = ta.value.trim();
+      if (!answer) { status.textContent = 'answer required'; return; }
+      if (!dashboardBase) { status.textContent = 'dashboard url unknown'; return; }
+      btn.disabled = true;
+      status.textContent = 'sending…';
+      try {
+        const resp = await fetch(dashboardBase + 'answer-question/' + id, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+          body: 'answer=' + encodeURIComponent(answer),
+        });
+        if (resp.ok) {
+          status.textContent = 'answered ✓';
+          refreshLooseEnds();
+        } else {
+          status.textContent = 'failed: ' + (await resp.text());
+          btn.disabled = false;
+        }
+      } catch (err) {
+        status.textContent = 'failed: ' + err;
+        btn.disabled = false;
+      }
+    });
+    wrap.append(ta, btn, status);
+    return wrap;
+  }
+
+  function buildInboxList(rows) {
+    const wrap = el('div', { class: 'agent-inbox' });
+    if (!rows.length) {
+      wrap.append(el('p', { class: 'side-panel-empty' },
+        'inbox empty.'));
+      return wrap;
+    }
+    const list = el('ul');
+    const fmt = (n) => new Date(n * 1000).toISOString().replace('T', ' ').slice(5, 19);
+    for (const m of rows) {
+      const li = el('li', m.in_reply_to != null ? { class: 'inbox-reply' } : {});
+      if (m.in_reply_to != null) {
+        li.append(el('span', { class: 'inbox-reply-tag' }, '↳ reply · '));
+      }
+      li.append(
+        el('span', { class: 'inbox-ts' }, fmt(m.at)), ' ',
+        el('span', { class: 'inbox-from' }, m.from), ' ',
+        el('span', { class: 'inbox-sep' }, '→'), ' ',
+        el('span', { class: 'inbox-body' }, m.body),
+      );
+      list.append(li);
+    }
+    wrap.append(list);
+    return wrap;
+  }
+
+  /** Pill-count + open-panel-refresh wiring for inbox. */
+  function renderInbox(rows) {
+    lastInbox = rows;
+    const pill = $('inbox-pill');
+    const count = $('inbox-count');
+    if (count) count.textContent = rows.length;
+    if (pill) pill.hidden = rows.length === 0;
+    Panel.refresh('inbox', 'inbox · ' + rows.length, buildInboxList(rows));
+  }
+  // Harness reachability badge: derived from the same `s.status` the
+  // status block reads. Each status maps to a glyph + label + colour
+  // class. Lives in the state row so the operator sees boot/login/
+  // online without losing terminal real-estate to a paragraph.
+  const ALIVE_LABELS = {
+    loading:                  { glyph: '…', text: 'connecting',  cls: 'status-loading' },
+    online:                   { glyph: '●', text: 'alive',       cls: 'status-online' },
+    rate_limited:             { glyph: '⊘', text: 'rate limited', cls: 'status-rate-limited' },
+    needs_login_idle:         { glyph: '◌', text: 'needs login', cls: 'status-needs-login' },
+    needs_login_in_progress:  { glyph: '◌', text: 'logging in',  cls: 'status-needs-login' },
+    offline:                  { glyph: '○', text: 'offline',     cls: 'status-offline' },
+  };
+  function renderAliveBadge(status) {
+    const el_ = $('alive-badge');
+    if (!el_) return;
+    const def = ALIVE_LABELS[status] || ALIVE_LABELS.loading;
+    el_.textContent = def.glyph + ' ' + def.text;
+    el_.className = 'status-badge ' + def.cls;
+  }
+
+  function renderModelChip(model) {
+    const el_ = $('model-chip');
+    if (!el_) return;
+    if (!model) { el_.hidden = true; return; }
+    el_.hidden = false;
+    el_.textContent = 'model · ' + model;
+    el_.title = `claude --model ${model}\nset via the operator's /model command; persists across turns until changed`;
+  }
+  // Token badges — two separate chips:
+  //   ctx · N    last inference's prompt size = current context window
+  //              utilisation (what to watch for compaction decisions)
+  //   cost · M   cumulative billed tokens across the whole last turn
+  //              (sum across every inference; tool-heavy turns rebill
+  //              the cached prompt per call and blow past the model's
+  //              context window — this is a cost signal, not a size
+  //              signal)
+  // Both fed by the same `token_usage_changed` SSE event (`{ ctx, cost }`).
+  const fmtTokens = (n) => {
+    if (n >= 1_000_000) return (n / 1_000_000).toFixed(1) + 'M';
+    if (n >= 1_000) return Math.round(n / 1000) + 'k';
+    return String(n);
+  };
+  function renderOneUsage(elId, label, u, blurb) {
+    const el_ = $(elId);
+    if (!el_) return;
+    if (!u) { el_.hidden = true; return; }
+    const total = u.input_tokens + u.cache_read_input_tokens + u.cache_creation_input_tokens;
+    el_.hidden = false;
+    el_.title = [
+      blurb,
+      'input: ' + u.input_tokens,
+      'cache_read: ' + u.cache_read_input_tokens,
+      'cache_write: ' + u.cache_creation_input_tokens,
+      'output: ' + u.output_tokens,
+    ].join('\n');
+    el_.textContent = label + ' · ' + fmtTokens(total);
+  }
+  function renderTokenUsage(ev) {
+    // `ev` is `{ ctx, cost }` either off /api/state cold-load (each may
+    // be null) or off a `token_usage_changed` SSE event (both present
+    // post-turn).
+    renderOneUsage('ctx-badge', 'ctx', ev && ev.ctx,
+      'last-inference prompt size — the actual context window in use right now');
+    renderOneUsage('cost-badge', 'cost', ev && ev.cost,
+      'cumulative tokens billed across the last turn (sum across every inference)');
+  }
+  function renderLastTurn(ms) {
+    const el_ = $('last-turn');
+    if (!el_) return;
+    let s = '';
+    if (ms < 1000) s = ms + 'ms';
+    else if (ms < 60_000) s = (ms / 1000).toFixed(1) + 's';
+    else s = Math.floor(ms / 60_000) + 'm ' + Math.floor((ms / 1000) % 60) + 's';
+    el_.textContent = '· last turn ' + s;
+    el_.title = `wall-clock duration of the last completed claude turn (${ms} ms)`;
+    el_.hidden = false;
+  }
+  function startStateTicker() {
+    if (stateTickTimer) return;
+    stateTickTimer = setInterval(renderStateBadge, 1000);
+  }
+  startStateTicker();
+
+  // Wire the cancel-turn button (visible only while state === thinking).
+  (() => {
+    const btn = $('cancel-btn');
+    if (!btn) return;
+    btn.addEventListener('click', () => {
+      btn.disabled = true;
+      postCancelTurn().finally(() => { btn.disabled = false; });
+    });
+  })();
+
+  // (#394) — `↻ new session` button moved into the overflow `⋯`
+  // menu and wired by `populateOverflowMenu()` above. Previously
+  // wired here as a static `#new-session-btn` in index.html.
+
+  // Track banner activity by reference-counting in-flight turns. A turn
+  // can begin while the previous turn_end is still in the pipeline (rare
+  // but happens on tight wake cycles), so we count rather than toggle.
+  let activeTurns = 0;
+  function setBannerActive(on) {
+    const banner = $('banner');
+    if (!banner) return;
+    if (on) {
+      activeTurns += 1;
+      banner.classList.add('active');
+    } else {
+      activeTurns = Math.max(0, activeTurns - 1);
+      if (activeTurns === 0) banner.classList.remove('active');
+    }
+  }
+
+  async function refreshState() {
+    try {
+      const resp = await fetch('/api/state');
+      if (!resp.ok) throw new Error('http ' + resp.status);
+      const s = await resp.json();
+      if (!headerSet) { setHeader(s.label, s.dashboard_port); headerSet = true; }
+      currentLabel = s.label;
+      // Render server-supplied navigation links — stats, screen, the
+      // forge profile, the agent-configs mirror, plus any
+      // agent-declared `dashboardLinks` extras (issue #262). Each
+      // NavLink's `kind` says how to resolve `url`: Container →
+      // same-origin path (the agent page is itself container-local);
+      // Forge → `http://<host>:3000<url>`; External → already
+      // absolute. DOM-built via el() — agent-declared icon / label /
+      // url strings must NEVER reach innerHTML.
+      const metaLinks = $('meta-links');
+      if (metaLinks && Array.isArray(s.links)) {
+        metaLinks.replaceChildren();
+        const forgeBase = `http://${window.location.hostname}:3000`;
+        s.links.forEach((lnk, i) => {
+          const href = lnk.kind === 'forge'    ? forgeBase + (lnk.url || '')
+                     : lnk.kind === 'external' ? (lnk.url || '')
+                     : /* container */            (lnk.url || '');
+          const a = el('a', {
+            class: 'agent-nav-link',
+            href,
+            target: '_blank',
+            rel: 'noopener',
+            title: lnk.label || '',
+          });
+          // Layout gap comes from `.agent-nav { gap }` (#394) — drop
+          // the legacy per-link inline `marginLeft`. The trailing `→`
+          // is the "leaves this page" affordance.
+          a.append(((lnk.icon || '') + ' ' + (lnk.label || '')).trim() + ' →');
+          metaLinks.append(a);
+        });
+      }
+      renderTermInput(s.label, s.status === 'online');
+      renderInbox(s.inbox || []);
+      // Authoritative state comes from the harness via /api/state.
+      // Login-not-yet → 'offline'; otherwise use the server-reported
+      // turn_state (idle / thinking / compacting). stateSince in
+      // unix-seconds is converted to a client-side Date.now() anchor.
+      if (s.status !== 'online') {
+        setState('offline');
+      } else if (s.turn_state) {
+        setStateAbs(s.turn_state, s.turn_state_since);
+      }
+      renderAliveBadge(s.status);
+      renderModelChip(s.model);
+      renderTokenUsage({ ctx: s.ctx_usage, cost: s.cost_usage });
+      // Open-threads aren't part of /api/state (kept on the broker
+      // db, fetched via the per-agent socket). Cold-load fetches
+      // it here; turn_end refreshes it via the renderer below.
+      refreshLooseEnds();
+      // Skip the re-render if nothing structurally changed. The most
+      // common case is `online` polling itself — without this guard, the
+      // operator's <input value> gets clobbered every cycle.
+      const outLen = s.session?.output?.length ?? -1;
+      const dirty =
+        s.status !== lastStatus ||
+        (s.status === 'needs_login_in_progress' && outLen !== lastOutputLen);
+      if (dirty) {
+        const root = $('status');
+        root.innerHTML = '';
+        if (s.status === 'online') renderOnline(s.label, root);
+        else if (s.status === 'needs_login_idle') renderNeedsLoginIdle(root);
+        else if (s.status === 'needs_login_in_progress') renderLoginInProgress(s.session || {}, root);
+        lastStatus = s.status;
+        lastOutputLen = outLen;
+      }
+      // Only poll while a login is in flight — otherwise SSE turn_end
+      // events trigger a refresh, and the operator can type into the
+      // send form without it getting cleared every few seconds.
+      if (pollTimer) { clearTimeout(pollTimer); pollTimer = null; }
+      if (s.status === 'needs_login_in_progress') {
+        pollTimer = setTimeout(refreshState, 1500);
+      }
+    } catch (err) {
+      console.error('refreshState failed', err);
+      pollTimer = setTimeout(refreshState, 5000);
+    }
+  }
+  refreshState();
+
+  // ─── live event stream ──────────────────────────────────────────────────
+  // Scrolling, pill, backfill + SSE plumbing live in hive-fr0nt::TERMINAL_JS
+  // (window.HiveTerminal). What stays here is the per-kind rendering:
+  // turn framing, claude stream-json interpretation, tool_use prettyprint,
+  // tool_result collapse, +/- diff bodies for Write/Edit.
+  (function() {
+    const log = $('live');
+    if (!log || !window.HiveTerminal) return;
+    log.innerHTML = '';
+
+    function trim(s, n) { return s.length > n ? s.slice(0, n) + '…' : s; }
+    // Render a message body as markdown into a new <div class="md">.
+    // Wraps `marked.parse` so the per-row body element carries the
+    // `.md` class (CSS in TERMINAL_CSS scopes paragraph/code/list
+    // styles to it). Falls back to a plain text node if marked isn't
+    // loaded (network glitch, asset 404) so the body still renders.
+    function mdNode(text) {
+      const div = document.createElement('div');
+      div.className = 'md';
+      const src = String(text || '');
+      if (window.marked && typeof window.marked.parse === 'function') {
+        try {
+          marked.setOptions({ breaks: true, gfm: true });
+          div.innerHTML = marked.parse(src);
+          // marked autolinks URLs but leaves them same-tab — open them
+          // externally so a click never unloads the terminal. (issue #233)
+          div.querySelectorAll('a[href]').forEach((a) => {
+            a.target = '_blank';
+            a.rel = 'noopener noreferrer';
+          });
+        } catch (err) {
+          console.warn('marked failed', err);
+          div.textContent = src;
+        }
+      } else {
+        div.textContent = src;
+      }
+      return div;
+    }
+    // Build a default-open details row whose body is markdown-rendered.
+    // Used by send / ask / answer tool_use renderers and by `recv`
+    // tool_result so message-bearing rows show their content inline
+    // without an extra click.
+    function detailsOpenMd(api, cls, summary, body) {
+      const d = api.details(cls, summary, '');
+      d.open = true;
+      const pre = d.querySelector('pre.tool-body');
+      if (pre) {
+        pre.replaceWith(mdNode(body));
+      } else {
+        d.appendChild(mdNode(body));
+      }
+      return d;
+    }
+    // Generic args-pretty-printer for unknown / extra-MCP tools. The
+    // built-in switch handles the common claude/hyperhive tools; this
+    // is the fallback so an `mcp__matrix__send_message` or similar
+    // doesn't dump raw JSON. Heuristics: single string-valued field →
+    // `Name field: "value"`; single dict-valued field → `Name field
+    // {…}`; otherwise compact JSON. Always trimmed to fit a row.
+    function fmtArgsGeneric(name, input) {
+      const keys = Object.keys(input || {});
+      if (keys.length === 0) return name + '()';
+      if (keys.length === 1) {
+        const k = keys[0];
+        const v = input[k];
+        if (typeof v === 'string') {
+          const oneline = v.replace(/\s+/g, ' ').trim();
+          return name + ' ' + k + ': ' + JSON.stringify(trim(oneline, 100));
+        }
+        if (typeof v === 'number' || typeof v === 'boolean') {
+          return name + ' ' + k + ': ' + JSON.stringify(v);
+        }
+      }
+      // Multi-field: render `k: v` pairs with strings/numbers inlined and
+      // anything else summarised by type so the row stays readable.
+      const pretty = keys.slice(0, 4).map((k) => {
+        const v = input[k];
+        if (v == null) return k + ': null';
+        if (typeof v === 'string') {
+          const oneline = v.replace(/\s+/g, ' ').trim();
+          return k + ': ' + JSON.stringify(trim(oneline, 40));
+        }
+        if (typeof v === 'number' || typeof v === 'boolean') return k + ': ' + v;
+        if (Array.isArray(v)) return k + `: [${v.length}]`;
+        return k + ': {…}';
+      });
+      const tail = keys.length > 4 ? ' …+' + (keys.length - 4) : '';
+      return name + ' ' + pretty.join(' · ') + tail;
+    }
+    // Pretty-print a tool call: per-known-tool format, fallback to JSON
+    // for unknown tools.
+    function fmtToolUse(c) {
+      const name = c.name || '';
+      const input = c.input || {};
+      const short = name.startsWith('mcp__hyperhive__')
+        ? name.slice('mcp__hyperhive__'.length) + '*' : name;
+      switch (name) {
+        case 'Read':       return short + ' ' + (input.file_path || '');
+        case 'Write':      return short + ' ' + (input.file_path || '');
+        case 'Edit':       return short + ' ' + (input.file_path || '');
+        case 'Glob':       return short + ' ' + (input.pattern || '');
+        case 'Grep':       return short + ' ' + (input.pattern || '');
+        case 'Bash':       return short + (input.run_in_background ? ' [bg]' : '')
+          + ' $ ' + (input.command || '');
+        case 'TodoWrite':  return short + ' (' + ((input.todos || []).length) + ' items)';
+        case 'mcp__hyperhive__send': return short + ' → ' + (input.to || '?') + ': '
+          + JSON.stringify(input.body || '').slice(0, 80);
+        case 'mcp__hyperhive__recv': {
+          // Surface the long-poll wait + batch size — a bare `recv()` row
+          // hides whether the agent is parking a turn (wait_seconds) or
+          // draining a burst (max).
+          const parts = [];
+          if (input.wait_seconds != null) parts.push('wait ' + input.wait_seconds + 's');
+          if (input.max != null) parts.push('max ' + input.max);
+          return short + (parts.length ? ' ' + parts.join(' · ') : '()');
+        }
+        case 'mcp__hyperhive__kill':          return short + ' ' + (input.name || '');
+        case 'mcp__hyperhive__request_apply_commit':
+          return short + ' ' + (input.agent || '') + ' @ ' + (input.commit_ref || '').slice(0, 12);
+        default: return fmtArgsGeneric(short, input);
+      }
+    }
+    // Build a "rich" tool_use row for tools whose input has a body we
+    // want the operator to see in full. Returns null for any other tool
+    // so the caller falls back to the flat-row path.
+    //   Write: every input.content line is "+".
+    //   Edit:  old_string lines as "-", new_string lines as "+".
+    //   mcp__hyperhive__send: collapsed <details>, full body text inside.
+    function renderRichToolUse(c, api) {
+      const name = c.name || '';
+      const input = c.input || {};
+      if (name === 'Write' || name === 'Edit') {
+        const path = input.file_path || '?';
+        let body;
+        let plus = 0;
+        let minus = 0;
+        if (name === 'Write') {
+          const content = String(input.content || '');
+          const lines = content.split('\n');
+          plus = lines.length;
+          body = lines.map(l => '+ ' + l).join('\n');
+        } else {
+          const oldLines = String(input.old_string || '').split('\n');
+          const newLines = String(input.new_string || '').split('\n');
+          minus = oldLines.length;
+          plus = newLines.length;
+          body = oldLines.map(l => '- ' + l).join('\n')
+               + '\n'
+               + newLines.map(l => '+ ' + l).join('\n');
+        }
+        // Summaries on expandable rows omit the row's directional glyph
+        // (`→`) — the disclosure marker (`▸/▾`) from CSS sits in the
+        // prefix column for every row kind, and the row's cyan colour
+        // already signals "outbound tool".
+        const summary = name + ' ' + path + ' · '
+          + (minus ? '-' + minus + ' ' : '') + '+' + plus;
+        return api.detailsDiff('tool-use', summary, body);
+      }
+      // Message-bearing tools render default-open with a markdown body so
+      // the operator sees the content without an extra click. send / ask
+      // address a target; answer attaches to an existing question id.
+      if (name === 'mcp__hyperhive__send') {
+        const to = input.to || '?';
+        const body = String(input.body || '');
+        const lines = body.split('\n').length;
+        return detailsOpenMd(api, 'tool-use',
+          'send → ' + to + (lines > 1 ? ` · ${lines}L` : ''),
+          body);
+      }
+      if (name === 'mcp__hyperhive__ask') {
+        const to = input.to || 'operator';
+        const q = String(input.question || '');
+        const lines = q.split('\n').length;
+        return detailsOpenMd(api, 'tool-use',
+          'ask → ' + to + (lines > 1 ? ` · ${lines}L` : ''),
+          q);
+      }
+      if (name === 'mcp__hyperhive__answer') {
+        const id = input.id != null ? String(input.id) : '?';
+        const a = String(input.answer || '');
+        const lines = a.split('\n').length;
+        return detailsOpenMd(api, 'tool-use',
+          'answer #' + id + (lines > 1 ? ` · ${lines}L` : ''),
+          a);
+      }
+      return null;
+    }
+    // Track tool_use_id → tool name so we can decide on rendering when the
+    // matching tool_result lands later. Lets us default-open the body for
+    // message-bearing tools (`recv`) while keeping shell/file tool output
+    // collapsed unless the operator clicks. Cleared on /clear; otherwise
+    // grows with the session — entries are tiny strings.
+    const toolNameById = new Map();
+    function renderToolResult(c, api) {
+      const txt = Array.isArray(c.content)
+        ? c.content.map(p => p.text || '').join('')
+        : (c.content || '');
+      const sourceName = c.tool_use_id ? toolNameById.get(c.tool_use_id) : null;
+      const isMessageBearing = sourceName === 'mcp__hyperhive__recv';
+      const trimmed = txt.replace(/\s+/g, ' ').trim();
+      const summaryBody = (() => {
+        if (!trimmed) return '(empty)';
+        if (trimmed.length <= 120) return trimmed;
+        const lines = txt.split('\n').filter(l => l.length).length;
+        const headline = trimmed.slice(0, 90) + '…';
+        return `${lines}L · ${headline}`;
+      })();
+      // Flat row: keep the `←` glyph in the prefix column. Details rows
+      // drop it — the `▸/▾` disclosure marker sits in that column via CSS.
+      if (isMessageBearing && txt.trim()) {
+        return detailsOpenMd(api, 'tool-result-block',
+          'recv ← ' + summaryBody, txt);
+      }
+      if (!txt.trim() || txt.length <= 120) {
+        api.row('tool-result', '←  ' + summaryBody);
+      } else {
+        api.details('tool-result-block', summaryBody, txt);
+      }
+    }
+    // Pretty-render claude's background-task subagent events
+    // (`task_started`, `task_notification`). They share the same
+    // task_id so the operator can correlate start ↔ result; render
+    // each as a peer of tool_use / tool_result with a `⌁` glyph to
+    // mark "this happened in a subagent" rather than the main
+    // session.
+    function renderTaskEvent(v, api) {
+      const id = (v.task_id || '').slice(0, 8);
+      const kind = v.task_type ? ` [${v.task_type}]` : '';
+      const desc = v.description || v.summary || '(no description)';
+      if (v.subtype === 'task_started') {
+        api.row('tool-use', `⌁  task ${id} started · ${desc}${kind}`);
+        return true;
+      }
+      if (v.subtype === 'task_notification') {
+        const status = v.status || 'unknown';
+        const glyph = status === 'completed' ? '✓' : status === 'failed' ? '✗' : '◌';
+        const cls = status === 'completed' ? 'turn-end-ok'
+                  : status === 'failed'    ? 'turn-end-fail'
+                                            : 'tool-result';
+        const out = v.output_file ? ` · → ${v.output_file}` : '';
+        api.row(cls, `⌁  task ${id} ${glyph} ${status} · ${desc}${out}`);
+        return true;
+      }
+      return false;
+    }
+    function renderStream(v, api) {
+      // Drop session init, claude's result line, rate-limit — noise.
+      // TurnEnd communicates pass/fail; session init isn't actionable.
+      if (v.type === 'system' && v.subtype === 'init') return;
+      if (v.type === 'rate_limit_event') return;
+      if (v.type === 'result') return;
+      // Background-task subagent events (claude's `Task` tool spawns
+      // a separate session whose progress lands here as `task_*`
+      // subtypes). Match by subtype so we don't have to track which
+      // top-level `type` claude wraps them under across versions.
+      if (v.subtype === 'task_started' || v.subtype === 'task_notification') {
+        if (renderTaskEvent(v, api)) return;
+      }
+      if (v.type === 'assistant' && v.message && v.message.content) {
+        for (const c of v.message.content) {
+          if (c.type === 'text' && c.text && c.text.trim()) {
+            // Assistant prose renders with markdown — claude often
+            // emits bullets / fenced code / inline code; raw text
+            // loses the structure.
+            const row = api.row('text', '');
+            row.appendChild(mdNode(c.text));
+          }
+          else if (c.type === 'thinking') {
+            const txt = (c.thinking || c.text || '').trim();
+            api.row('thinking', txt ? '· ' + txt : '· thinking …');
+          }
+          else if (c.type === 'tool_use') {
+            if (c.id && c.name) toolNameById.set(c.id, c.name);
+            if (!renderRichToolUse(c, api)) {
+              api.row('tool-use', '→  ' + fmtToolUse(c));
+            }
+          }
+        }
+        return;
+      }
+      if (v.type === 'user' && v.message && v.message.content) {
+        for (const c of v.message.content) {
+          if (c.type === 'tool_result') renderToolResult(c, api);
+        }
+        return;
+      }
+      // Catch-all for unrecognised stream-json shapes. Loud (orange) so
+      // silently-dropped event types surface in the scrollback for
+      // follow-up classification.
+      api.row('sys', '! ' + trim(JSON.stringify(v), 200));
+    }
+
+    // Count open turns across the backfill replay so the live banner +
+    // state badge reflect whatever the history last left running. With
+    // shared HiveTerminal this is computed inside each renderer instead
+    // of in a second walk over the events list.
+    let openTurnsFromHistory = 0;
+
+    const term = HiveTerminal.create({
+      logEl: log,
+      // Anchor the `↓ N new` pill in `.agent-main` (NOT the default
+      // `log.parentElement` = `.terminal-wrap`). `.terminal-wrap`
+      // applies `backdrop-filter` for the frost effect, which
+      // creates a CSS stacking context — the pill's z-index 35
+      // (agent.css #375) then gets TRAPPED inside that context and
+      // can't compete with the fixed composer's z-index 30 in the
+      // root stacking context. Anchoring in `.agent-main` (no
+      // backdrop-filter, no other stacking-context creators) lets
+      // the pill's z-index reach the root and properly float above
+      // the composer. Geometry unchanged — `.agent-main` and
+      // `.terminal-wrap` both `inset: 0` fill the same area.
+      pillAnchor: $('agent-main'),
+      historyUrl: '/events/history',
+      streamUrl: '/events/stream',
+      renderers: {
+        turn_start(ev, api) {
+          if (api.fromHistory) openTurnsFromHistory += 1;
+          else { setBannerActive(true); setState('thinking'); }
+          const block = api.row('turn-start', '◆ TURN ← ' + ev.from);
+          if (ev.unread > 0) {
+            const badge = document.createElement('span');
+            badge.className = 'unread-badge';
+            badge.textContent = '· ' + ev.unread + ' unread';
+            block.appendChild(badge);
+          }
+          const body = document.createElement('div');
+          body.className = 'turn-body';
+          body.textContent = ev.body;
+          block.appendChild(body);
+        },
+        turn_end(ev, api) {
+          if (api.fromHistory) {
+            openTurnsFromHistory = Math.max(0, openTurnsFromHistory - 1);
+          } else {
+            setBannerActive(false); setState('idle');
+            // Likely answered/asked/scheduled something — refresh.
+            refreshLooseEnds();
+          }
+          const cls = ev.ok ? 'turn-end-ok' : 'turn-end-fail';
+          api.row(cls,
+            (ev.ok ? '✓' : '✗') + ' turn ' + (ev.ok ? 'ok' : 'fail')
+            + (ev.note ? ' — ' + ev.note : ''));
+        },
+        note(ev, api) {
+          const t = String(ev.text || '');
+          // stderr lines coming off the claude pump get an orange `!`
+          // glyph so they're not visually fused with ambient harness
+          // chatter. Operator-initiated notes (/cancel, /compact,
+          // /model, new-session) get a mauve italic affordance so the
+          // scrollback distinguishes "the operator did this" from
+          // "the harness did this on its own."
+          if (t.startsWith('stderr:')) {
+            api.row('note stderr', '! ' + t);
+          } else if (t.startsWith('operator:')) {
+            api.row('note op', '· ' + t);
+          } else {
+            api.row('note', '· ' + t);
+          }
+        },
+        stream(ev, api) {
+          const v = Object.assign({}, ev); delete v.kind;
+          renderStream(v, api);
+        },
+        // Bus-driven state/badges. `status_changed` may also need a
+        // /api/state refresh to render the login `#status` block
+        // (which carries the OAuth URL + form), so we kick the
+        // existing refresh path on that transition. Online → only
+        // the badge updates; no /api/state fetch needed.
+        status_changed(ev, api) {
+          if (api.fromHistory) return;
+          renderAliveBadge(ev.status);
+          renderTermInput(currentLabel, ev.status === 'online');
+          // Login-flow transitions need the #status block rebuilt
+          // (it carries the OAuth URL + form). The existing
+          // refreshState path also re-arms the in-progress poll for
+          // session output streaming. Online → only the badge moves;
+          // no /api/state fetch is necessary.
+          if (ev.status !== 'online' && ev.status !== lastStatus) {
+            refreshState();
+          } else if (ev.status === 'online' && lastStatus !== 'online') {
+            // Status block stays as-is or shows the previous
+            // login UI; clear it so the operator sees a clean
+            // online state without a separate refetch.
+            const root = $('status');
+            if (root) root.innerHTML = '';
+            lastStatus = 'online';
+          }
+        },
+        model_changed(ev, api) { if (!api.fromHistory) renderModelChip(ev.model); },
+        token_usage_changed(ev, api) {
+          if (!api.fromHistory) renderTokenUsage({ ctx: ev.ctx, cost: ev.cost });
+        },
+        turn_state_changed(ev, api) {
+          if (!api.fromHistory) setStateAbs(ev.state, ev.since_unix);
+        },
+      },
+      onBackfillDone() {
+        // If the last replayed turn never closed, the banner shimmer +
+        // thinking badge should be on. Apply in one pass after replay.
+        for (let i = 0; i < openTurnsFromHistory; i++) setBannerActive(true);
+        if (openTurnsFromHistory > 0) setState('thinking');
+      },
+    });
+
+    // Expose the panel API for slash commands (`/help`, `/clear`).
+    termAPI = {
+      row: (cls, text) => term.row(cls, text),
+      clear: () => { log.innerHTML = ''; },
+    };
+  })();
+
+  // Avoid unused-var lint while keeping `escText` available for future use.
+  void escText;
+})();
diff --git a/frontend/packages/agent/src/index.html b/frontend/packages/agent/src/index.html
new file mode 100644
index 00000000..f39065cc
--- /dev/null
+++ b/frontend/packages/agent/src/index.html
@@ -0,0 +1,109 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <title>hyperhive agent</title>
+  <link rel="icon" type="image/svg+xml" href="/icon">
+  <link rel="stylesheet" href="/static/agent.css">
+</head>
+<body class="agent-shell">
+
+  <!-- Fixed-overlay header (#394 redesign): two-row layout in the
+       main column — row 1 carries the title + meta-nav, row 2 carries
+       the live state strip. The agent icon eats the full header
+       height on the left as the identity anchor; flyout pills + an
+       overflow menu trigger sit on the right. Frosted glass over the
+       terminal — backdrop-filter blur shows the scrolled terminal
+       text behind. -->
+  <header class="agent-header" id="agent-header">
+    <img class="agent-icon" src="/icon" alt="">
+
+    <div class="agent-header-main">
+      <div class="agent-header-row agent-header-title-row">
+        <h2 id="title">◆ … ◆</h2>
+        <!-- Meta-nav: backend-supplied links (stats / screen / forge /
+             …) plus a client-injected `↑ dashboard` link prepended in
+             setHeader so the host dashboard stays one click away
+             without a separate button styled differently. -->
+        <nav class="meta agent-nav" id="meta-links"></nav>
+      </div>
+
+      <div id="state-row" class="agent-state-row agent-header-row">
+        <span id="alive-badge" class="status-badge status-loading" title="harness reachability">…</span>
+        <span id="state-badge" class="state-badge state-loading">… booting</span>
+        <span id="model-chip" class="model-chip" hidden></span>
+        <span id="ctx-badge" class="ctx-badge" hidden title="tokens used in the current context window"></span>
+        <span id="cost-badge" class="ctx-badge" hidden title="cumulative tokens billed across the last turn (sum across every inference; tool-heavy turns rebill the cached prompt per call)"></span>
+        <span id="last-turn" class="last-turn" hidden></span>
+        <button type="button" id="cancel-btn" class="btn-cancel-turn" hidden>■ cancel turn</button>
+      </div>
+    </div>
+
+    <!-- Right cluster: flyout triggers + overflow menu. Pills stay
+         hidden until their list is non-empty; the overflow `⋯` is
+         always visible (rebuild + new-session live inside it per
+         #394 — both rare, both destructive, both deserve one extra
+         click). -->
+    <div class="agent-header-pills">
+      <button type="button" id="inbox-pill" class="header-pill header-pill-inbox" hidden
+              title="open inbox flyout">
+        <span class="header-pill-icon" aria-hidden="true">📬</span>
+        <span class="header-pill-label">inbox</span>
+        <span class="header-pill-count" id="inbox-count">0</span>
+      </button>
+      <button type="button" id="loose-ends-pill" class="header-pill header-pill-loose" hidden
+              title="open loose-ends flyout">
+        <span class="header-pill-icon" aria-hidden="true">🪢</span>
+        <span class="header-pill-label">loose ends</span>
+        <span class="header-pill-count" id="loose-ends-count">0</span>
+      </button>
+      <button type="button" id="overflow-btn" class="overflow-btn"
+              aria-haspopup="menu" aria-expanded="false"
+              title="more actions">⋯</button>
+    </div>
+  </header>
+
+  <!-- Overflow popover. Sits outside the header so the header's
+       `overflow: hidden`-adjacent ancestors don't clip it; positioned
+       in JS relative to the overflow button (top-right anchor). -->
+  <div id="overflow-menu" class="overflow-menu" role="menu" hidden></div>
+
+  <!-- Main content area. The terminal fills it edge-to-edge and
+       scrolls behind the floating header + composer. The `#status`
+       overlay renders only when login is required (transient first-
+       time-setup state); otherwise the terminal owns the screen. -->
+  <main class="agent-main" id="agent-main">
+    <div id="status" class="agent-status-overlay"></div>
+    <div class="terminal-wrap">
+      <div id="live" class="live terminal"><div class="meta">connecting…</div></div>
+    </div>
+  </main>
+
+  <!-- Fixed-overlay composer. Same frosted-glass treatment as the
+       header for symmetric framing. Empty until the harness sets up
+       the textarea via `renderTermInput`. -->
+  <footer class="agent-composer" id="agent-composer">
+    <div id="term-input" class="term-input"></div>
+  </footer>
+
+  <!-- Slide-in side panel. Singleton — JS swaps the title + body
+       and toggles `.open`. Shared shape with the dashboard's panel
+       (candidate for extraction into @hive/shared in a follow-up). -->
+  <div id="side-panel" class="side-panel" aria-hidden="true">
+    <div class="side-panel-backdrop" id="side-panel-backdrop"></div>
+    <aside class="side-panel-drawer" role="dialog" aria-modal="true"
+           aria-labelledby="side-panel-title">
+      <header class="side-panel-head">
+        <span class="side-panel-title" id="side-panel-title"></span>
+        <button type="button" class="side-panel-close" id="side-panel-close"
+                title="close (esc)">✕</button>
+      </header>
+      <div class="side-panel-body" id="side-panel-body"></div>
+    </aside>
+  </div>
+
+  <!-- Single bundled entry. esbuild folds @hive/shared/terminal.js and
+       the marked npm package into app.js. -->
+  <script type="module" src="/static/app.js" defer></script>
+</body>
+</html>
diff --git a/frontend/packages/agent/src/screen.html b/frontend/packages/agent/src/screen.html
new file mode 100644
index 00000000..2b91f126
--- /dev/null
+++ b/frontend/packages/agent/src/screen.html
@@ -0,0 +1,770 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>screen</title>
+<link rel="icon" type="image/svg+xml" href="/icon">
+<style>
+/* Catppuccin Mocha palette (mirrors base.css) */
+:root {
+  --base:    #1e1e2e;
+  --mantle:  #181825;
+  --crust:   #11111b;
+  --text:    #cdd6f4;
+  --subtext0:#a6adc8;
+  --surface0:#313244;
+  --surface1:#45475a;
+  --blue:    #89b4fa;
+  --red:     #f38ba8;
+  --green:   #a6e3a1;
+  --yellow:  #f9e2af;
+}
+*, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
+html, body { height: 100%; background: var(--base); color: var(--text);
+  font-family: 'JetBrains Mono', 'Fira Code', ui-monospace, monospace;
+  font-size: 14px; }
+#toolbar {
+  display: flex; align-items: center; gap: 0.75rem;
+  padding: 0.4rem 0.75rem; background: var(--mantle);
+  border-bottom: 1px solid var(--surface0);
+}
+#toolbar a { color: var(--blue); text-decoration: none; font-size: 0.85rem; }
+#toolbar a:hover { text-decoration: underline; }
+.tbtn {
+  padding: 0.15rem 0.5rem; font-size: 0.72rem; font-family: inherit;
+  background: var(--surface0); color: var(--subtext0);
+  border: 1px solid var(--surface1); border-radius: 4px; cursor: pointer;
+}
+.tbtn.active { color: var(--green); border-color: var(--green); }
+.tbtn:disabled { opacity: 0.4; cursor: default; }
+#status { margin-left: auto; font-size: 0.75rem; color: var(--subtext0); }
+#status.connected { color: var(--green); }
+#status.error     { color: var(--red); }
+#debug-log {
+  position: fixed; bottom: 0; left: 0; right: 0; max-height: 40vh;
+  overflow-y: auto; background: rgba(17,17,27,0.95);
+  border-top: 1px solid var(--surface1);
+  font-size: 0.72rem; font-family: ui-monospace, monospace;
+  padding: 0.4rem 0.6rem; z-index: 100;
+  display: none; /* hidden by default; toggled by toolbar button */
+}
+#debug-log .dbg-line { color: var(--subtext0); margin: 1px 0; white-space: pre; }
+#debug-log .dbg-line.err { color: var(--red); }
+#debug-log .dbg-line.ok  { color: var(--green); }
+#debug-log .dbg-line.send { color: var(--blue); }
+#canvas-wrap {
+  display: flex; justify-content: center; align-items: flex-start;
+  width: 100%; height: calc(100% - 36px); overflow: auto;
+  background: var(--crust);
+}
+/* Fit mode: centre the canvas (relayoutCanvas() scales it in JS to
+   fit the wrap) and clip any sub-pixel rounding overflow. */
+#canvas-wrap.fit { align-items: center; overflow: hidden; }
+canvas { display: block; cursor: default; }
+/* In fit mode relayoutCanvas() sets the canvas display size explicitly.
+   The canvas is a flex item, and flex items default to
+   min-width/min-height: auto — which resolves to the canvas's intrinsic
+   framebuffer resolution and clamps the JS-set size straight back up,
+   defeating the downscale (the bug behind #133 round 1). Pin the canvas
+   to exactly the size relayoutCanvas() sets: min-* 0 lifts the clamp,
+   flex: none stops flex grow/shrink from fighting it. */
+#canvas-wrap.fit canvas { flex: none; min-width: 0; min-height: 0; }
+#msg {
+  position: fixed; bottom: 1rem; left: 50%; transform: translateX(-50%);
+  background: var(--surface0); color: var(--yellow); border-radius: 6px;
+  padding: 0.4rem 0.9rem; font-size: 0.8rem;
+  opacity: 0; transition: opacity 0.3s;
+  pointer-events: none;
+}
+</style>
+</head>
+<body>
+<div id="toolbar">
+  <strong>🖥 screen</strong>
+  <a href="/" title="back to agent page">← agent</a>
+  <button id="fit-toggle" class="tbtn" title="Toggle fit-to-window scaling">⤢ fit</button>
+  <button id="match-toggle" class="tbtn" title="Resize the remote desktop to fit this window" disabled>⤡ match size</button>
+  <button id="debug-toggle" class="tbtn" title="Toggle RFB debug log">debug</button>
+  <span id="status">connecting…</span>
+</div>
+<div id="canvas-wrap"><canvas id="c"></canvas></div>
+<div id="msg"></div>
+<div id="debug-log"></div>
+
+<script>
+// Minimal RFB-over-WebSocket renderer.
+// Connects to /screen/ws on the same host; the harness relays raw
+// RFB bytes to the VNC server running inside the container.
+//
+// This is a deliberately thin implementation — enough to display the
+// desktop and forward pointer + keyboard events. For a production-grade
+// viewer, replace with noVNC (issue #52 vendors the full bundle).
+
+(function () {
+  'use strict';
+
+  const canvas   = document.getElementById('c');
+  const ctx      = canvas.getContext('2d');
+  const status   = document.getElementById('status');
+  const msg      = document.getElementById('msg');
+  const debugLog = document.getElementById('debug-log');
+  const debugBtn = document.getElementById('debug-toggle');
+  const fitBtn   = document.getElementById('fit-toggle');
+  const matchBtn = document.getElementById('match-toggle');
+  const canvasWrap = document.getElementById('canvas-wrap');
+
+  // --- Debug log ---
+  let debugVisible = false;
+  debugBtn.addEventListener('click', () => {
+    debugVisible = !debugVisible;
+    debugLog.style.display = debugVisible ? 'block' : 'none';
+    debugBtn.classList.toggle('active', debugVisible);
+  });
+
+  // --- Fit-to-window toggle ---
+  // Scales the canvas down so the whole desktop is visible without
+  // scrolling. The canvas's intrinsic resolution (width/height attrs)
+  // is untouched — only its CSS display size changes, set explicitly
+  // by relayoutCanvas(). Pointer coordinates are rescaled in
+  // sendPointer to stay accurate. Persisted in localStorage; default
+  // is fit-on.
+  let fitMode = localStorage.getItem('screen-fit') !== 'off';
+  // Size the canvas. In fit mode, scale down (never up) to the wrap,
+  // preserving aspect ratio. Explicit px sizing rather than CSS
+  // max-width/max-height: on a flex item those are overridden by the
+  // automatic minimum size, so fit mode was a silent no-op — the
+  // oversized canvas just got centred and clipped (issue #133).
+  function relayoutCanvas() {
+    if (fitMode && canvas.width && canvas.height
+        && canvasWrap.clientWidth && canvasWrap.clientHeight) {
+      const scale = Math.min(
+        canvasWrap.clientWidth  / canvas.width,
+        canvasWrap.clientHeight / canvas.height,
+        1,
+      );
+      canvas.style.width  = (canvas.width  * scale) + 'px';
+      canvas.style.height = (canvas.height * scale) + 'px';
+    } else if (!fitMode) {
+      canvas.style.width  = '';
+      canvas.style.height = '';
+    }
+  }
+  function applyFitMode() {
+    canvasWrap.classList.toggle('fit', fitMode);
+    fitBtn.classList.toggle('active', fitMode);
+    relayoutCanvas();
+  }
+  fitBtn.addEventListener('click', () => {
+    fitMode = !fitMode;
+    localStorage.setItem('screen-fit', fitMode ? 'on' : 'off');
+    applyFitMode();
+  });
+  window.addEventListener('resize', relayoutCanvas);
+  applyFitMode();
+
+  // --- Match-size: resize the remote desktop to this window ---
+  // Sends an RFB SetDesktopSize request so the VNC server (weston)
+  // changes its actual output resolution to match the browser
+  // viewport — sharper than fit-mode's CSS downscale. The button is
+  // enabled only once the server has advertised the ExtendedDesktopSize
+  // pseudo-encoding (a -308 rect). (issue #133)
+  let extDesktopSupported = false;
+  let screenId = 1;  // captured from the server's ExtendedDesktopSize advert
+  matchBtn.addEventListener('click', () => {
+    if (!extDesktopSupported) return;
+    // Even dimensions — some servers reject odd ones.
+    const w = Math.max(2, canvasWrap.clientWidth  & ~1);
+    const h = Math.max(2, canvasWrap.clientHeight & ~1);
+    dbg('→ request desktop resize to ' + w + 'x' + h, 'send');
+    sendSetDesktopSize(w, h);
+  });
+
+  function hex(bytes) {
+    return Array.from(bytes).map(b => b.toString(16).padStart(2,'0')).join(' ');
+  }
+
+  function dbg(text, cls) {
+    console.log('[rfb]', text);
+    const line = document.createElement('div');
+    line.className = 'dbg-line' + (cls ? ' ' + cls : '');
+    line.textContent = text;
+    debugLog.appendChild(line);
+    debugLog.scrollTop = debugLog.scrollHeight;
+  }
+
+  function setStatus(text, cls) {
+    status.textContent = text;
+    status.className   = cls || '';
+    if (cls === 'error') dbg('ERROR: ' + text, 'err');
+  }
+
+  function flash(text) {
+    msg.textContent = text;
+    msg.style.opacity = '1';
+    setTimeout(() => { msg.style.opacity = '0'; }, 2500);
+  }
+
+  // --- WebSocket connection ---
+  const proto = location.protocol === 'https:' ? 'wss' : 'ws';
+  const ws    = new WebSocket(`${proto}://${location.host}/screen/ws`);
+  ws.binaryType = 'arraybuffer';
+
+  ws.onopen  = () => { dbg('WebSocket open — starting RFB handshake', 'ok'); setStatus('handshaking…'); };
+  ws.onerror = () => setStatus('connection error', 'error');
+  ws.onclose = (e) => {
+    setStatus(`disconnected (${e.code})`, 'error');
+    flash('VNC disconnected — reload to reconnect');
+  };
+
+  // Accumulate received bytes in a simple ring queue
+  const chunks = [];
+  let   totalBytes = 0;
+
+  ws.onmessage = (ev) => {
+    chunks.push(new Uint8Array(ev.data));
+    totalBytes += ev.data.byteLength;
+    processRfb();
+  };
+
+  // --- Minimal RFB state machine ---
+  // We implement just enough to handshake and receive FramebufferUpdate
+  // rectangles encoded as Raw (encoding 0). Other encodings are skipped.
+  // Keyboard and pointer events are forwarded.
+
+  let state = 'version';
+  let fbW = 0, fbH = 0;
+  let pixelFormat = null; // set after ServerInit
+  let updateRects = 0;
+  // ExtendedDesktopSize pseudo-encoding (-308), as the unsigned 32-bit
+  // value the rect-header encoding field is read as.
+  const EXT_DESKTOP_SIZE_U32 = (-308) >>> 0;
+
+  // Drain bytes from the queue into a flat buffer view
+  function drainTo(n) {
+    if (totalBytes < n) return null;
+    const out = new Uint8Array(n);
+    let off = 0;
+    while (off < n) {
+      const c = chunks[0];
+      const take = Math.min(c.length, n - off);
+      out.set(c.subarray(0, take), off);
+      off += take;
+      if (take === c.length) {
+        chunks.shift();
+      } else {
+        chunks[0] = c.subarray(take);
+      }
+    }
+    totalBytes -= n;
+    return out;
+  }
+
+  function send(data) {
+    if (ws.readyState === WebSocket.OPEN) {
+      const arr = data instanceof Uint8Array ? data : new Uint8Array(data);
+      dbg('→ send [' + arr.length + 'b]: ' + hex(arr.slice(0, 32)) + (arr.length > 32 ? '…' : ''), 'send');
+      ws.send(data);
+    }
+  }
+
+  function u32be(b, o) { return ((b[o]<<24)|(b[o+1]<<16)|(b[o+2]<<8)|b[o+3])>>>0; }
+  function u16be(b, o) { return ((b[o]<<8)|b[o+1])>>>0; }
+
+  // ── Apple-DH (security type 30) helpers ─────────────────────────────────
+  // Protocol (from neatvnc apple-dh.c):
+  //   Server → client: generator(2) + key_size(2) + prime[key_size] + server_pub[key_size]
+  //   Client → server: client_pub[key_size] + aes128ecb(MD5(shared_secret), creds[128])
+  //   After SecurityResult=0: normal plaintext VNC (no session encryption)
+  //
+  // BigInt mod-pow — handles 2048-bit DH arithmetic.
+  function modpow(base, exp, mod) {
+    let r = 1n;
+    base = base % mod;
+    while (exp > 0n) {
+      if (exp & 1n) r = r * base % mod;
+      exp >>= 1n;
+      base = base * base % mod;
+    }
+    return r;
+  }
+  function bytesToBigInt(b) {
+    let n = 0n;
+    for (const byte of b) n = (n << 8n) | BigInt(byte);
+    return n;
+  }
+  function bigIntToBytes(n, len) {
+    const out = new Uint8Array(len);
+    for (let i = len - 1; i >= 0; i--) { out[i] = Number(n & 0xffn); n >>= 8n; }
+    return out;
+  }
+
+  // Compact MD5 — needed because Web Crypto doesn't expose MD5.
+  // Based on the RFC 1321 reference implementation, minified.
+  function md5(data) {
+    const b = data instanceof Uint8Array ? data : new Uint8Array(data);
+    const len = b.length;
+    // pad message
+    const padLen = ((len + 8) >>> 6 << 4) + 16;
+    const m = new Uint32Array(padLen);
+    for (let i = 0; i < len; i++) m[i>>2] |= b[i] << ((i&3)*8);
+    m[len>>2] |= 0x80 << ((len&3)*8);
+    m[padLen-2] = len*8;
+    const T = new Int32Array(64);
+    for (let i = 0; i < 64; i++) T[i] = (Math.abs(Math.sin(i+1)) * 0x100000000)|0;
+    let [a, b2, c, d] = [0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476];
+    const S = [7,12,17,22, 5,9,14,20, 4,11,16,23, 6,10,15,21];
+    function add(x,y){return (x+y)|0;}
+    function r(v,s){return (v<<s)|(v>>>(32-s));}
+    for (let i = 0; i < padLen; i += 16) {
+      let [aa,bb,cc,dd] = [a,b2,c,d];
+      for (let j = 0; j < 64; j++) {
+        let [f, g] = j<16 ? [(bb&cc)|((~bb)&dd), j]
+          : j<32 ? [(dd&bb)|((~dd)&cc), (5*j+1)%16]
+          : j<48 ? [bb^cc^dd, (3*j+5)%16]
+          : [cc^(bb|(~dd)), (7*j)%16];
+        f = add(add(aa, f), add(m[i+g], T[j]));
+        // Rotation amount: round = j>>4 (changes every 16 steps),
+        // position-in-round = j%4. S is laid out as 4 rounds × 4.
+        [aa,dd,cc,bb] = [dd, cc, bb, add(bb, r(f, S[(j%4)+((j>>4)*4)]))];
+      }
+      [a,b2,c,d] = [add(a,aa), add(b2,bb), add(c,cc), add(d,dd)];
+    }
+    const out = new Uint8Array(16);
+    [a,b2,c,d].forEach((x,i) => {
+      out[i*4]=(x)&0xff; out[i*4+1]=(x>>8)&0xff;
+      out[i*4+2]=(x>>16)&0xff; out[i*4+3]=(x>>24)&0xff;
+    });
+    return out;
+  }
+
+  // AES-128-ECB encrypt 128 bytes using Web Crypto AES-CBC (null IV per block = ECB).
+  async function aes128ecb(key16, data128) {
+    const keyObj = await crypto.subtle.importKey('raw', key16, {name:'AES-CBC'}, false, ['encrypt']);
+    const out = new Uint8Array(128);
+    const iv = new Uint8Array(16); // zeroed IV → ECB mode for single blocks
+    for (let i = 0; i < 8; i++) {
+      const enc = await crypto.subtle.encrypt({name:'AES-CBC',iv}, keyObj, data128.slice(i*16,(i+1)*16));
+      out.set(new Uint8Array(enc,0,16), i*16);
+    }
+    return out;
+  }
+
+  // Apple-DH state — stored between async continuations.
+  let appleDhState = null;
+  // ────────────────────────────────────────────────────────────────────────
+
+  function processRfb() {
+    while (true) {
+      if (!tryStep()) break;
+    }
+  }
+
+  function tryStep() {
+    switch (state) {
+      case 'version': {
+        const b = drainTo(12);
+        if (!b) return false;
+        dbg('← server version: ' + new TextDecoder().decode(b).replace('\n','\\n'));
+        // Send back same version (RFB 003.008)
+        send(new TextEncoder().encode('RFB 003.008\n'));
+        state = 'security-types';
+        return true;
+      }
+      case 'security-types': {
+        const b = drainTo(1);
+        if (!b) return false;
+        const n = b[0];
+        dbg('← security-types: count=' + n + (n === 0 ? ' (server error!)' : ''));
+        if (n === 0) { setStatus('server sent 0 security types', 'error'); return false; }
+        const types = drainTo(n);
+        if (!types) { chunks.unshift(b); totalBytes += 1; return false; }
+        dbg('← security-types offered: [' + Array.from(types).join(', ') + ']');
+        // Prefer type 1 (None), then type 19 (VeNCrypt — used by neatvnc/weston
+        // even with --disable-transport-layer-security), else first offered.
+        let prefer;
+        if (types.indexOf(1) !== -1)       prefer = 1;   // plain None
+        else if (types.indexOf(19) !== -1) prefer = 19;  // VeNCrypt
+        else                               prefer = types[0];
+        // Prefer: 1 (None) → 19 (VeNCrypt) → 30 (Apple-DH)
+        if (types.indexOf(1)  !== -1) prefer = 1;
+        else if (types.indexOf(19) !== -1) prefer = 19;
+        else if (types.indexOf(30) !== -1) prefer = 30;
+        else {
+          dbg('no supported type in [' + Array.from(types).join(', ') + '] — need 1, 19, or 30', 'err');
+          setStatus('unsupported security types: [' + Array.from(types).join(', ') + ']', 'error');
+          ws.close();
+          return false;
+        }
+        dbg('→ choosing security type ' + prefer +
+          (prefer === 1 ? ' (None)' : prefer === 19 ? ' (VeNCrypt)' : ' (Apple-DH)'));
+        send(new Uint8Array([prefer]));
+        if (prefer === 1)        state = 'security-result';
+        else if (prefer === 19)  state = 'vencrypt-version';
+        else                     state = 'apple-dh-params';
+        return true;
+      }
+      case 'security-vnc-challenge': {
+        // VNC auth (type 2): we don't have the password, so send zeros.
+        // This will fail for password-protected servers; fine for our
+        // weston VNC which uses None via VeNCrypt.
+        const b = drainTo(16);
+        if (!b) return false;
+        dbg('← vnc-challenge (16 bytes): ' + hex(b));
+        send(new Uint8Array(16));
+        state = 'security-result';
+        return true;
+      }
+      // ── VeNCrypt (type 19) sub-handshake ───────────────────────────────
+      // neatvnc (weston VNC backend) uses VeNCrypt as the outer type even
+      // with --disable-transport-layer-security, offering sub-type 1 (None).
+      case 'vencrypt-version': {
+        // Server sends: major (u8), minor (u8) — e.g. 0, 2
+        const b = drainTo(2);
+        if (!b) return false;
+        dbg('← VeNCrypt version: ' + b[0] + '.' + b[1]);
+        // Echo same version back
+        send(new Uint8Array([b[0], b[1]]));
+        state = 'vencrypt-subtypes';
+        return true;
+      }
+      case 'vencrypt-subtypes': {
+        // Server sends: nSubtypes (u8), then nSubtypes × u32 sub-type ids
+        const nb = drainTo(1);
+        if (!nb) return false;
+        const nSub = nb[0];
+        dbg('← VeNCrypt nSubtypes=' + nSub);
+        const raw = drainTo(nSub * 4);
+        if (!raw) { chunks.unshift(nb); totalBytes += 1; return false; }
+        // Build sub-type array from big-endian u32s
+        const subs = [];
+        for (let i = 0; i < nSub; i++) subs.push(u32be(raw, i * 4));
+        dbg('← VeNCrypt sub-types: [' + subs.join(', ') + ']');
+        // Prefer sub-type 1 (VeNCrypt None) — no TLS, no password.
+        // Fall back to first offered.
+        const sub = subs.includes(1) ? 1 : subs[0];
+        dbg('→ choosing VeNCrypt sub-type ' + sub);
+        // Send chosen sub-type as big-endian u32
+        send(new Uint8Array([sub>>>24, (sub>>>16)&0xff, (sub>>>8)&0xff, sub&0xff]));
+        state = 'vencrypt-accept';
+        return true;
+      }
+      case 'vencrypt-accept': {
+        // Server sends 1 byte: 1=accepted, 0=refused
+        const b = drainTo(1);
+        if (!b) return false;
+        dbg('← VeNCrypt accept byte: ' + b[0] + (b[0] === 1 ? ' (ok)' : ' (REFUSED)'));
+        if (b[0] !== 1) { setStatus('VeNCrypt sub-type refused', 'error'); return false; }
+        // Sub-type 1 (None): proceed to SecurityResult
+        state = 'security-result';
+        return true;
+      }
+      // ── Apple-DH (type 30) ────────────────────────────────────────────
+      // Server sends: generator(2 BE) + key_size(2 BE) + prime[key_size] +
+      //               server_pub[key_size]
+      // Client sends: client_pub[key_size] + aes128ecb(MD5(shared), creds[128])
+      // No session encryption after auth — plain RFB follows.
+      case 'apple-dh-params': {
+        const hdr = drainTo(4);
+        if (!hdr) return false;
+        const generator = u16be(hdr, 0);
+        const keySize   = u16be(hdr, 2);
+        dbg('← Apple-DH: generator=' + generator + ' key_size=' + keySize);
+        const rest = drainTo(keySize * 2);
+        if (!rest) { chunks.unshift(hdr); totalBytes += 4; return false; }
+        const prime     = rest.slice(0, keySize);
+        const serverPub = rest.slice(keySize);
+        dbg('← Apple-DH prime[0:4]=' + hex(prime.slice(0,4)) +
+            ' server_pub[0:4]=' + hex(serverPub.slice(0,4)));
+
+        // Async DH computation — pause state machine, resume when done.
+        appleDhState = { generator, keySize, prime, serverPub };
+        state = 'apple-dh-wait';
+        (async () => {
+          try {
+            const p  = bytesToBigInt(appleDhState.prime);
+            const g  = BigInt(appleDhState.generator);
+            const ks = appleDhState.keySize;
+
+            // Generate client private key: random ks bytes, then mod p
+            const privBytes = crypto.getRandomValues(new Uint8Array(ks));
+            const priv = bytesToBigInt(privBytes) % p;
+
+            // Client public key = g ^ priv mod p
+            const clientPub = modpow(g, priv, p);
+            const clientPubBytes = bigIntToBytes(clientPub, ks);
+
+            // Shared secret = server_pub ^ priv mod p
+            const serverPubInt = bytesToBigInt(appleDhState.serverPub);
+            const shared = modpow(serverPubInt, priv, p);
+            const sharedBytes = bigIntToBytes(shared, ks);
+
+            // AES key = MD5(shared_secret)
+            const aesKey = md5(sharedBytes);
+            dbg('Apple-DH: shared MD5 key=' + hex(aesKey));
+
+            // Credentials: 64 bytes username + 64 bytes password.
+            // weston's vnc_handle_auth (libweston/backend-vnc/vnc.c) does
+            // getpwnam(username) and requires pw_uid == weston's own uid
+            // BEFORE PAM is ever consulted — an empty/garbage username is
+            // rejected outright. weston runs as root, so the username must
+            // be "root". The password stays empty; pam_permit.so on the
+            // weston-remote-access PAM service accepts it.
+            const creds = new Uint8Array(128);
+            creds.set(new TextEncoder().encode('root'), 0);
+            const encCreds = await aes128ecb(aesKey, creds);
+
+            // Send: encrypted_creds + client_pub
+            // neatvnc struct rfb_apple_dh_client_msg has encrypted_credentials
+            // at offset 0 and public_key at offset 128 (flexible array after).
+            const response = new Uint8Array(ks + 128);
+            response.set(encCreds, 0);
+            response.set(clientPubBytes, 128);
+            send(response);
+            dbg('→ Apple-DH response sent (' + response.length + ' bytes)', 'ok');
+
+            state = 'security-result';
+            processRfb(); // resume state machine
+          } catch(e) {
+            setStatus('Apple-DH error: ' + e.message, 'error');
+          }
+        })();
+        return false; // pause — async resumes
+      }
+      case 'apple-dh-wait':
+        // Async handshake in progress — don't consume bytes
+        return false;
+      // ──────────────────────────────────────────────────────────────────
+      case 'security-result': {
+        const b = drainTo(4);
+        if (!b) return false;
+        const code = u32be(b, 0);
+        dbg('← security-result: ' + code + ' (bytes: ' + hex(b) + ')' + (code === 0 ? ' ✓' : ' FAIL'), code === 0 ? 'ok' : 'err');
+        if (code !== 0) { setStatus('auth failed (code ' + code + ')', 'error'); return false; }
+        // ClientInit: shared flag = 1
+        send(new Uint8Array([1]));
+        state = 'server-init';
+        return true;
+      }
+      case 'server-init': {
+        const b = drainTo(24);
+        if (!b) return false;
+        // RFB ServerInit: width @ bytes 0-1, height @ bytes 2-3.
+        fbW = u16be(b, 0); fbH = u16be(b, 2);
+        // pixel format: bpp=b[4], depth=b[5], big-endian=b[6], true-colour=b[7]
+        // red/green/blue max/shift at b[8..17]
+        pixelFormat = {
+          bpp: b[4], depth: b[5], bigEndian: b[6], trueColour: b[7],
+          redMax: u16be(b, 8), greenMax: u16be(b, 10), blueMax: u16be(b, 12),
+          redShift: b[14], greenShift: b[15], blueShift: b[16],
+          bytesPerPixel: b[4] / 8,
+        };
+        const nameLen = u32be(b, 20);
+        const nameBytes = drainTo(nameLen);
+        if (!nameBytes) { chunks.unshift(b); totalBytes += 24; return false; }
+        dbg('← server-init: ' + fbW + 'x' + fbH + ' bpp=' + pixelFormat.bpp, 'ok');
+        canvas.width  = fbW;
+        canvas.height = fbH;
+        relayoutCanvas();
+        setStatus('connected', 'connected');
+        // Advertise Raw + the ExtendedDesktopSize pseudo-encoding so the
+        // server reports (and accepts) desktop-size changes. (issue #133)
+        sendSetEncodings([0, -308]);
+        // Request full framebuffer update
+        requestUpdate(0, 0, 0, fbW, fbH);
+        state = 'normal';
+        return true;
+      }
+      case 'normal': {
+        const b = drainTo(1);
+        if (!b) return false;
+        const msgType = b[0];
+        if (msgType === 0) {
+          // FramebufferUpdate: type(1) + padding(1) + nRects(2). The type
+          // byte is already consumed above; hdr covers padding + nRects.
+          const hdr = drainTo(3);
+          if (!hdr) { chunks.unshift(b); totalBytes += 1; return false; }
+          updateRects = u16be(hdr, 1);
+          state = 'rect-header';
+        } else if (msgType === 2) {
+          // Bell: ignore
+        } else if (msgType === 3) {
+          // ServerCutText
+          const hdr = drainTo(7);
+          if (!hdr) { chunks.unshift(b); totalBytes += 1; return false; }
+          const len = u32be(hdr, 3);
+          const text = drainTo(len);
+          if (!text) { chunks.unshift(b); totalBytes += 1 + 7; return false; }
+        }
+        return true;
+      }
+      case 'rect-header': {
+        if (updateRects === 0) { state = 'normal'; requestUpdate(1, 0, 0, fbW, fbH); return true; }
+        const b = drainTo(12);
+        if (!b) return false;
+        const x = u16be(b, 0), y = u16be(b, 2), w = u16be(b, 4), h = u16be(b, 6);
+        const enc = (b[8]<<24|b[9]<<16|b[10]<<8|b[11])>>>0;
+        if (enc === 0 && pixelFormat) {
+          const bytes = w * h * pixelFormat.bytesPerPixel;
+          const pixels = drainTo(bytes);
+          if (!pixels) { chunks.unshift(b); totalBytes += 12; return false; }
+          drawRaw(x, y, w, h, pixels);
+        } else if (enc === EXT_DESKTOP_SIZE_U32) {
+          // ExtendedDesktopSize: w,h carry the new desktop dimensions;
+          // the rect body is nScreens(1) + pad(3) + nScreens×16. The
+          // header's x = change reason, y = request status. (issue #133)
+          const nScreens = peekByte();
+          if (nScreens < 0) { chunks.unshift(b); totalBytes += 12; return false; }
+          const body = drainTo(4 + nScreens * 16);
+          if (!body) { chunks.unshift(b); totalBytes += 12; return false; }
+          if (nScreens > 0) screenId = u32be(body, 4);  // reuse the server's screen id
+          if (!extDesktopSupported) {
+            extDesktopSupported = true;
+            matchBtn.disabled = false;
+          }
+          if (w && h && (w !== fbW || h !== fbH)) {
+            dbg('← desktop resized to ' + w + 'x' + h
+              + ' (reason ' + x + ', status ' + y + ')', 'ok');
+            fbW = w; fbH = h;
+            canvas.width = w; canvas.height = h;
+            relayoutCanvas();
+            requestUpdate(0, 0, 0, fbW, fbH);
+          }
+        }
+        updateRects--;
+        return true;
+      }
+      default: return false;
+    }
+  }
+
+  function drawRaw(x, y, w, h, data) {
+    if (!pixelFormat || w === 0 || h === 0) return;
+    const bpp = pixelFormat.bytesPerPixel;
+    const img = ctx.createImageData(w, h);
+    const d   = img.data;
+    const rs  = pixelFormat.redShift, gs = pixelFormat.greenShift, bs = pixelFormat.blueShift;
+    for (let i = 0, o = 0; i < w * h; i++, o += bpp) {
+      let px = 0;
+      if (bpp === 4) px = pixelFormat.bigEndian
+        ? (data[o]<<24|data[o+1]<<16|data[o+2]<<8|data[o+3])>>>0
+        : (data[o+3]<<24|data[o+2]<<16|data[o+1]<<8|data[o])>>>0;
+      else if (bpp === 2) px = pixelFormat.bigEndian
+        ? (data[o]<<8|data[o+1])>>>0 : (data[o+1]<<8|data[o])>>>0;
+      else px = data[o];
+      d[i*4]   = (px >> rs) & pixelFormat.redMax;
+      d[i*4+1] = (px >> gs) & pixelFormat.greenMax;
+      d[i*4+2] = (px >> bs) & pixelFormat.blueMax;
+      d[i*4+3] = 255;
+    }
+    ctx.putImageData(img, x, y);
+  }
+
+  function requestUpdate(incremental, x, y, w, h) {
+    const b = new Uint8Array(10);
+    b[0] = 3; b[1] = incremental;
+    b[2] = x>>8; b[3] = x&0xff;
+    b[4] = y>>8; b[5] = y&0xff;
+    b[6] = w>>8; b[7] = w&0xff;
+    b[8] = h>>8; b[9] = h&0xff;
+    send(b);
+  }
+
+  // SetEncodings (msg type 2): advertise the encodings we understand.
+  // Negative values are pseudo-encodings (e.g. -308 ExtendedDesktopSize).
+  function sendSetEncodings(encs) {
+    const b = new Uint8Array(4 + encs.length * 4);
+    b[0] = 2;                          // message-type
+    b[1] = 0;                          // padding
+    b[2] = encs.length >> 8; b[3] = encs.length & 0xff;
+    let o = 4;
+    for (const e of encs) {
+      const v = e >>> 0;               // two's-complement for negatives
+      b[o++] = (v>>24)&0xff; b[o++] = (v>>16)&0xff;
+      b[o++] = (v>>8)&0xff;  b[o++] = v&0xff;
+    }
+    send(b);
+  }
+
+  // SetDesktopSize (msg type 251): ask the server to change the desktop
+  // resolution. One screen at the origin, sized to the request. (#133)
+  function sendSetDesktopSize(w, h) {
+    const b = new Uint8Array(24);
+    b[0] = 251; b[1] = 0;              // message-type + padding
+    b[2] = w>>8; b[3] = w&0xff;
+    b[4] = h>>8; b[5] = h&0xff;
+    b[6] = 1;   b[7] = 0;              // number-of-screens + padding
+    // screen: id(4) x(2) y(2) width(2) height(2) flags(4)
+    b[8]  = (screenId>>>24)&0xff; b[9]  = (screenId>>>16)&0xff;
+    b[10] = (screenId>>>8)&0xff;  b[11] = screenId&0xff;
+    b[12] = 0; b[13] = 0;             // x-position
+    b[14] = 0; b[15] = 0;             // y-position
+    b[16] = w>>8; b[17] = w&0xff;
+    b[18] = h>>8; b[19] = h&0xff;
+    b[20] = 0; b[21] = 0; b[22] = 0; b[23] = 0;  // flags
+    send(b);
+  }
+
+  // Peek the first unconsumed byte without draining it. -1 when empty.
+  function peekByte() {
+    for (const c of chunks) { if (c.length) return c[0]; }
+    return -1;
+  }
+
+  // --- Input forwarding ---
+  canvas.addEventListener('mousemove', sendPointer);
+  canvas.addEventListener('mousedown', sendPointer);
+  canvas.addEventListener('mouseup',   sendPointer);
+
+  function sendPointer(ev) {
+    const r = canvas.getBoundingClientRect();
+    // In fit mode the canvas is CSS-scaled, so the rendered rect differs
+    // from the intrinsic resolution — map client coords back to fb pixels.
+    const sx = r.width  ? canvas.width  / r.width  : 1;
+    const sy = r.height ? canvas.height / r.height : 1;
+    const x = Math.max(0, Math.min(fbW-1, Math.round((ev.clientX - r.left) * sx)));
+    const y = Math.max(0, Math.min(fbH-1, Math.round((ev.clientY - r.top) * sy)));
+    let mask = 0;
+    if (ev.buttons & 1) mask |= 1;
+    if (ev.buttons & 4) mask |= 2;
+    if (ev.buttons & 2) mask |= 4;
+    const b = new Uint8Array(6);
+    b[0] = 5; b[1] = mask;
+    b[2] = x>>8; b[3] = x&0xff;
+    b[4] = y>>8; b[5] = y&0xff;
+    send(b);
+  }
+
+  document.addEventListener('keydown', (ev) => sendKey(ev, 1));
+  document.addEventListener('keyup',   (ev) => sendKey(ev, 0));
+
+  function sendKey(ev, down) {
+    ev.preventDefault();
+    const key = rfbKeysym(ev);
+    const b = new Uint8Array(8);
+    b[0] = 4; b[1] = down; b[2] = 0; b[3] = 0;
+    b[4] = key>>24; b[5] = (key>>16)&0xff; b[6] = (key>>8)&0xff; b[7] = key&0xff;
+    send(b);
+  }
+
+  function rfbKeysym(ev) {
+    // Map common keys to X11 keysym values
+    const map = {
+      'BackSpace': 0xff08, 'Tab': 0xff09, 'Enter': 0xff0d, 'Escape': 0xff1b,
+      'Delete': 0xffff, 'Home': 0xff50, 'End': 0xff57, 'PageUp': 0xff55,
+      'PageDown': 0xff56, 'ArrowLeft': 0xff51, 'ArrowUp': 0xff52,
+      'ArrowRight': 0xff53, 'ArrowDown': 0xff54,
+      'Shift': 0xffe1, 'Control': 0xffe3, 'Alt': 0xffe9, 'Meta': 0xffe7,
+      'F1': 0xffbe, 'F2': 0xffbf, 'F3': 0xffc0, 'F4': 0xffc1,
+      'F5': 0xffc2, 'F6': 0xffc3, 'F7': 0xffc4, 'F8': 0xffc5,
+      'F9': 0xffc6, 'F10': 0xffc7, 'F11': 0xffc8, 'F12': 0xffc9,
+    };
+    if (map[ev.key]) return map[ev.key];
+    if (ev.key.length === 1) return ev.key.codePointAt(0);
+    return 0;
+  }
+
+})();
+</script>
+</body>
+</html>
diff --git a/frontend/packages/agent/src/stats.html b/frontend/packages/agent/src/stats.html
new file mode 100644
index 00000000..0795310d
--- /dev/null
+++ b/frontend/packages/agent/src/stats.html
@@ -0,0 +1,98 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <title>hyperhive agent — stats</title>
+  <link rel="icon" type="image/svg+xml" href="/icon">
+  <link rel="stylesheet" href="/static/agent.css">
+  <style>
+    .stats-nav { display: flex; gap: 0.75rem; align-items: baseline; margin-bottom: 0.5rem; }
+    .stats-nav a { color: var(--cyan); text-decoration: none; }
+    .stats-nav a:hover { text-decoration: underline; }
+    .window-tabs { display: flex; gap: 0.4rem; margin: 0.5rem 0 1rem; }
+    .window-tabs button {
+      background: var(--bg-elev); color: var(--fg);
+      border: 1px solid var(--border); padding: 0.3rem 0.8rem;
+      font-family: inherit; cursor: pointer;
+    }
+    .window-tabs button.active { background: var(--purple-dim); border-color: var(--purple); color: var(--purple); }
+    .summary { display: flex; gap: 0.75rem; flex-wrap: wrap; margin-bottom: 1rem; }
+    .summary .chip {
+      display: flex;
+      flex-direction: column;
+      justify-content: center;
+      align-items: stretch;
+      background: var(--bg-elev);
+      border: 1px solid var(--border);
+      padding: 0.5rem 0.9rem;
+      border-radius: 4px;
+      box-sizing: border-box;
+      min-width: 9rem;
+      height: 3.4rem;
+      line-height: 1.2;
+    }
+    .summary .chip .label {
+      color: var(--muted);
+      font-size: 0.75rem;
+      text-transform: uppercase;
+      letter-spacing: 0.05em;
+    }
+    .summary .chip .value {
+      color: var(--cyan);
+      font-weight: bold;
+      font-size: 1.05rem;
+    }
+    .grid {
+      display: grid;
+      grid-template-columns: repeat(auto-fit, minmax(420px, 1fr));
+      gap: 1rem;
+    }
+    .card {
+      background: var(--bg-elev);
+      border: 1px solid var(--border);
+      padding: 0.75rem 1rem 1rem;
+      border-radius: 4px;
+    }
+    .card h3 { margin: 0 0 0.5rem; color: var(--purple); font-size: 0.95rem; font-weight: normal; }
+    .card .chart-wrap { position: relative; height: 220px; }
+    .card.wide { grid-column: 1 / -1; }
+    .card.wide .chart-wrap { height: 260px; }
+    .empty-note { color: var(--muted); font-style: italic; }
+  </style>
+</head>
+<body>
+  <pre class="banner">░▒▓█▓▒░  …  ░▒▓█▓▒░  hyperhive ag3nt · stats  ░▒▓█▓▒░</pre>
+  <div class="stats-nav">
+    <a id="back-link" href="/">← live</a>
+    <a id="dashboard-link" href="#">dashboard</a>
+    <h2 id="title" style="margin: 0;">◆ … ◆</h2>
+  </div>
+
+  <div class="window-tabs" id="window-tabs">
+    <button data-w="1h">last 1h</button>
+    <button data-w="4h">last 4h</button>
+    <button data-w="24h" class="active">last 24h</button>
+    <button data-w="3d">last 3d</button>
+    <button data-w="7d">last 7d</button>
+    <button data-w="30d">last 30d</button>
+  </div>
+
+  <div class="summary" id="summary"></div>
+
+  <div class="grid">
+    <div class="card wide"><h3>turns per bucket</h3><div class="chart-wrap"><canvas id="chart-turns"></canvas></div></div>
+    <div class="card wide"><h3>turn duration (ms) — p50 / p95 / avg</h3><div class="chart-wrap"><canvas id="chart-duration"></canvas></div></div>
+    <div class="card wide"><h3>context tokens (last inference per turn) — avg / max</h3><div class="chart-wrap"><canvas id="chart-ctx"></canvas></div></div>
+    <div class="card wide"><h3>token cost per bucket (sum across inferences)</h3><div class="chart-wrap"><canvas id="chart-cost"></canvas></div></div>
+    <div class="card wide"><h3>turns by model per bucket — model drives token cost</h3><div class="chart-wrap"><canvas id="chart-model"></canvas></div></div>
+    <div class="card"><h3>top tools</h3><div class="chart-wrap"><canvas id="chart-tools"></canvas></div></div>
+    <div class="card"><h3>wake source mix</h3><div class="chart-wrap"><canvas id="chart-wake"></canvas></div></div>
+    <div class="card"><h3>result mix</h3><div class="chart-wrap"><canvas id="chart-result"></canvas></div></div>
+  </div>
+
+  <!-- Chart.js is now bundled into stats.js by esbuild (npm dep
+       chart.js@4.4.4), so the page works offline / on operator
+       machines without internet egress. No SRI hash to maintain. -->
+  <script type="module" src="/static/stats.js" defer></script>
+</body>
+</html>
diff --git a/frontend/packages/agent/src/stats.js b/frontend/packages/agent/src/stats.js
new file mode 100644
index 00000000..546ab190
--- /dev/null
+++ b/frontend/packages/agent/src/stats.js
@@ -0,0 +1,346 @@
+// Per-agent stats page. Fetches /api/state for the title + dashboard link
+// once on load, then /api/stats?window=... for the chart data — re-fetches
+// when the operator clicks a window tab.
+
+import Chart from 'chart.js/auto';
+
+// Expose for the IIFE below — pre-split this was a window global from
+// the jsDelivr CDN script tag. esbuild now bundles chart.js into
+// stats.js; once the IIFE opens up we can use the imported `Chart`
+// directly.
+window.Chart = Chart;
+
+(function () {
+  'use strict';
+
+  const cssVar = (name) => getComputedStyle(document.documentElement).getPropertyValue(name).trim();
+  const palette = {
+    bg: cssVar('--bg'),
+    bgElev: cssVar('--bg-elev'),
+    fg: cssVar('--fg'),
+    muted: cssVar('--muted'),
+    purple: cssVar('--purple'),
+    cyan: cssVar('--cyan'),
+    pink: cssVar('--pink'),
+    amber: cssVar('--amber'),
+    green: cssVar('--green'),
+    red: cssVar('--red'),
+    border: cssVar('--border'),
+  };
+  // Distinct hues for categorical charts (top tools / wake mix / result mix).
+  const wheel = [palette.purple, palette.cyan, palette.pink, palette.amber,
+                 palette.green, palette.red, '#94e2d5', '#f9e2af',
+                 '#74c7ec', '#b4befe'];
+
+  // Apply Catppuccin defaults globally so each Chart inherits without per-call
+  // overrides. Chart.js v4 reads these on chart construction.
+  Chart.defaults.color = palette.fg;
+  Chart.defaults.borderColor = palette.border;
+  Chart.defaults.font.family = '"JetBrains Mono", "Fira Code", monospace';
+  Chart.defaults.font.size = 11;
+  Chart.defaults.plugins.legend.labels.color = palette.fg;
+
+  const charts = {};
+  let currentWindow = '24h';
+
+  function fmtMs(ms) {
+    if (!Number.isFinite(ms) || ms <= 0) return '0';
+    if (ms < 1000) return ms.toFixed(0) + 'ms';
+    return (ms / 1000).toFixed(ms < 10000 ? 2 : 1) + 's';
+  }
+
+  function fmtInt(n) {
+    if (!Number.isFinite(n)) return '0';
+    return new Intl.NumberFormat().format(Math.round(n));
+  }
+
+  function bucketLabel(ts, bucketSecs) {
+    const d = new Date(ts * 1000);
+    if (bucketSecs >= 86400) {
+      return d.toISOString().slice(5, 10); // MM-DD
+    }
+    return d.toISOString().slice(11, 16); // HH:MM
+  }
+
+  function destroy(name) {
+    if (charts[name]) {
+      charts[name].destroy();
+      delete charts[name];
+    }
+  }
+
+  function paintEmpty(canvasId, msg) {
+    destroy(canvasId);
+    const cv = document.getElementById(canvasId);
+    if (!cv) return;
+    const ctx = cv.getContext('2d');
+    ctx.clearRect(0, 0, cv.width, cv.height);
+    ctx.fillStyle = palette.muted;
+    ctx.font = '12px monospace';
+    ctx.textAlign = 'center';
+    ctx.textBaseline = 'middle';
+    ctx.fillText(msg, cv.width / 2, cv.height / 2);
+  }
+
+  function renderSummary(s) {
+    const root = document.getElementById('summary');
+    root.replaceChildren();
+    const chips = [
+      ['turns', fmtInt(s.turn_count)],
+      ['avg duration', fmtMs(s.duration_summary.avg_ms)],
+      ['p50 duration', fmtMs(s.duration_summary.p50_ms)],
+      ['p95 duration', fmtMs(s.duration_summary.p95_ms)],
+      ['window', s.window],
+    ];
+    for (const [label, value] of chips) {
+      const chip = document.createElement('span');
+      chip.className = 'chip';
+      const l = document.createElement('span');
+      l.className = 'label';
+      l.textContent = label;
+      const v = document.createElement('span');
+      v.className = 'value';
+      v.textContent = value;
+      chip.append(l, v);
+      root.append(chip);
+    }
+  }
+
+  function renderTurnsChart(s) {
+    const id = 'chart-turns';
+    destroy(id);
+    const labels = s.buckets.map((b) => bucketLabel(b.ts, s.bucket_seconds));
+    const data = s.buckets.map((b) => b.turn_count);
+    charts[id] = new Chart(document.getElementById(id), {
+      type: 'bar',
+      data: {
+        labels,
+        datasets: [{
+          label: 'turns',
+          data,
+          backgroundColor: palette.purple,
+          borderColor: palette.purple,
+          borderWidth: 1,
+        }],
+      },
+      options: {
+        responsive: true, maintainAspectRatio: false,
+        plugins: { legend: { display: false } },
+        scales: {
+          x: { grid: { color: palette.border } },
+          y: { beginAtZero: true, grid: { color: palette.border }, ticks: { precision: 0 } },
+        },
+      },
+    });
+  }
+
+  function renderDurationChart(s) {
+    const id = 'chart-duration';
+    destroy(id);
+    const labels = s.buckets.map((b) => bucketLabel(b.ts, s.bucket_seconds));
+    const ds = (label, color, key) => ({
+      label, data: s.buckets.map((b) => b[key]),
+      borderColor: color, backgroundColor: color + '33',
+      tension: 0.25, pointRadius: 0, borderWidth: 2, spanGaps: true,
+    });
+    charts[id] = new Chart(document.getElementById(id), {
+      type: 'line',
+      data: {
+        labels,
+        datasets: [
+          ds('p50', palette.cyan, 'p50_duration_ms'),
+          ds('p95', palette.pink, 'p95_duration_ms'),
+          ds('avg', palette.amber, 'avg_duration_ms'),
+        ],
+      },
+      options: {
+        responsive: true, maintainAspectRatio: false,
+        scales: {
+          x: { grid: { color: palette.border } },
+          y: {
+            beginAtZero: true,
+            grid: { color: palette.border },
+            ticks: { callback: (v) => fmtMs(v) },
+          },
+        },
+      },
+    });
+  }
+
+  function renderCtxChart(s) {
+    const id = 'chart-ctx';
+    destroy(id);
+    const labels = s.buckets.map((b) => bucketLabel(b.ts, s.bucket_seconds));
+    charts[id] = new Chart(document.getElementById(id), {
+      type: 'line',
+      data: {
+        labels,
+        datasets: [
+          {
+            label: 'avg ctx',
+            data: s.buckets.map((b) => b.avg_ctx_tokens),
+            borderColor: palette.cyan,
+            backgroundColor: palette.cyan + '33',
+            tension: 0.25, pointRadius: 0, borderWidth: 2, spanGaps: true,
+          },
+          {
+            label: 'max ctx',
+            data: s.buckets.map((b) => b.max_ctx_tokens),
+            borderColor: palette.amber,
+            backgroundColor: palette.amber + '33',
+            tension: 0.25, pointRadius: 0, borderWidth: 2, spanGaps: true,
+          },
+        ],
+      },
+      options: {
+        responsive: true, maintainAspectRatio: false,
+        scales: {
+          x: { grid: { color: palette.border } },
+          y: { beginAtZero: true, grid: { color: palette.border }, ticks: { callback: (v) => fmtInt(v) } },
+        },
+      },
+    });
+  }
+
+  function renderCostChart(s) {
+    const id = 'chart-cost';
+    destroy(id);
+    const labels = s.buckets.map((b) => bucketLabel(b.ts, s.bucket_seconds));
+    // Stacked bars: cache_read (cheap) / cache_creation / input / output.
+    // Highlights "what's actually getting billed at full rate" vs cache hits.
+    charts[id] = new Chart(document.getElementById(id), {
+      type: 'bar',
+      data: {
+        labels,
+        datasets: [
+          { label: 'cache_read', data: s.buckets.map((b) => b.cache_read_input_tokens),
+            backgroundColor: palette.muted },
+          { label: 'cache_creation', data: s.buckets.map((b) => b.cache_creation_input_tokens),
+            backgroundColor: palette.cyan },
+          { label: 'input', data: s.buckets.map((b) => b.input_tokens),
+            backgroundColor: palette.amber },
+          { label: 'output', data: s.buckets.map((b) => b.output_tokens),
+            backgroundColor: palette.pink },
+        ],
+      },
+      options: {
+        responsive: true, maintainAspectRatio: false,
+        scales: {
+          x: { stacked: true, grid: { color: palette.border } },
+          y: { stacked: true, beginAtZero: true,
+               grid: { color: palette.border }, ticks: { callback: (v) => fmtInt(v) } },
+        },
+      },
+    });
+  }
+
+  function renderModelChart(s) {
+    const id = 'chart-model';
+    destroy(id);
+    const models = s.models || [];
+    if (!models.length) { paintEmpty(id, 'no turns in window'); return; }
+    const labels = s.buckets.map((b) => bucketLabel(b.ts, s.bucket_seconds));
+    // One stacked series per model. Model choice drives token cost,
+    // so this lines up against the cost chart above it.
+    const datasets = models.map((m, i) => ({
+      label: m,
+      data: s.buckets.map((b) => (b.model_counts && b.model_counts[m]) || 0),
+      backgroundColor: wheel[i % wheel.length],
+    }));
+    charts[id] = new Chart(document.getElementById(id), {
+      type: 'bar',
+      data: { labels, datasets },
+      options: {
+        responsive: true, maintainAspectRatio: false,
+        plugins: { legend: { position: 'top', labels: { boxWidth: 12 } } },
+        scales: {
+          x: { stacked: true, grid: { color: palette.border } },
+          y: { stacked: true, beginAtZero: true,
+               grid: { color: palette.border }, ticks: { precision: 0 } },
+        },
+      },
+    });
+  }
+
+  function renderKeyCount(canvasId, items, emptyMsg) {
+    destroy(canvasId);
+    if (!items || items.length === 0) {
+      paintEmpty(canvasId, emptyMsg);
+      return;
+    }
+    const labels = items.map((kc) => kc.key);
+    const data = items.map((kc) => kc.count);
+    const colors = items.map((_, i) => wheel[i % wheel.length]);
+    charts[canvasId] = new Chart(document.getElementById(canvasId), {
+      type: 'doughnut',
+      data: { labels, datasets: [{ data, backgroundColor: colors, borderColor: palette.bg, borderWidth: 2 }] },
+      options: {
+        responsive: true, maintainAspectRatio: false,
+        plugins: { legend: { position: 'right', labels: { boxWidth: 12 } } },
+      },
+    });
+  }
+
+  function render(s) {
+    renderSummary(s);
+    if (s.turn_count === 0) {
+      paintEmpty('chart-turns', 'no turns in window');
+      paintEmpty('chart-duration', 'no turns in window');
+      paintEmpty('chart-ctx', 'no turns in window');
+      paintEmpty('chart-cost', 'no turns in window');
+      paintEmpty('chart-model', 'no turns in window');
+      paintEmpty('chart-tools', 'no tool calls');
+      paintEmpty('chart-wake', 'no wakes');
+      paintEmpty('chart-result', 'no results');
+      return;
+    }
+    renderTurnsChart(s);
+    renderDurationChart(s);
+    renderCtxChart(s);
+    renderCostChart(s);
+    renderModelChart(s);
+    renderKeyCount('chart-tools', s.tool_breakdown, 'no tool calls');
+    renderKeyCount('chart-wake', s.wake_mix, 'no wakes');
+    renderKeyCount('chart-result', s.result_mix, 'no results');
+  }
+
+  async function loadStats() {
+    try {
+      const resp = await fetch('/api/stats?window=' + encodeURIComponent(currentWindow));
+      if (!resp.ok) throw new Error('http ' + resp.status);
+      const snap = await resp.json();
+      render(snap);
+    } catch (e) {
+      document.getElementById('summary').textContent = 'stats fetch failed: ' + e;
+    }
+  }
+
+  async function loadIdentity() {
+    try {
+      const resp = await fetch('/api/state');
+      if (!resp.ok) return;
+      const s = await resp.json();
+      document.title = 'stats · ' + s.label;
+      document.getElementById('title').textContent = '◆ ' + s.label + ' ◆';
+      const dl = document.getElementById('dashboard-link');
+      dl.href = 'http://' + window.location.hostname + ':' + s.dashboard_port + '/';
+    } catch (_) { /* non-fatal */ }
+  }
+
+  function bindTabs() {
+    const tabs = document.getElementById('window-tabs');
+    tabs.addEventListener('click', (ev) => {
+      const btn = ev.target.closest('button[data-w]');
+      if (!btn) return;
+      currentWindow = btn.dataset.w;
+      for (const b of tabs.querySelectorAll('button')) b.classList.toggle('active', b === btn);
+      loadStats();
+    });
+  }
+
+  document.addEventListener('DOMContentLoaded', () => {
+    bindTabs();
+    loadIdentity();
+    loadStats();
+  });
+})();
diff --git a/frontend/packages/dashboard/build.mjs b/frontend/packages/dashboard/build.mjs
new file mode 100644
index 00000000..346f1125
--- /dev/null
+++ b/frontend/packages/dashboard/build.mjs
@@ -0,0 +1,85 @@
+// esbuild build for @hive/dashboard. Output layout (`dist/`):
+//
+//   dist/index.html               served by the Rust router at GET /
+//   dist/flow.html                served at GET /flow.html
+//   dist/static/tabs.js           /index.html entry — tab renderers +
+//                                  tab routing + refreshState
+//   dist/static/flow.js           /flow.html entry — broker terminal +
+//                                  operator inbox + @-mention composer
+//   dist/static/{tabs,flow}.js.map source map siblings
+//   dist/static/dashboard.css     served at /static/dashboard.css
+//                                  (@import resolved from @hive/shared)
+//
+// Both JS entries inline `./common.js` (DOM helpers, Panel singleton,
+// NOTIF, path linkification) — esbuild dedupes the shared module
+// between bundles. The Rust binary mounts `dist/` as a
+// `tower_http::ServeDir` fallback; the layout above keeps every URL
+// the HTML files reference reachable without rewriting paths in the
+// HTML.
+
+import { build } from 'esbuild';
+import { mkdirSync, copyFileSync, rmSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const src = (p) => resolve(here, 'src', p);
+const dist = (p) => resolve(here, 'dist', p);
+const staticDir = (p) => resolve(here, 'dist', 'static', p);
+
+rmSync(dist(''), { recursive: true, force: true });
+mkdirSync(staticDir(''), { recursive: true });
+
+// Bundle both JS entries. ES-module output, browser target, no minify
+// (line-aligned source aids debugging; minification belongs in a later
+// follow-up once asset sizes warrant it). esbuild writes each entry
+// to `static/<name>.js` based on the entryPoint basename.
+await build({
+  entryPoints: [src('tabs.js'), src('flow.js')],
+  outdir: staticDir(''),
+  bundle: true,
+  format: 'esm',
+  platform: 'browser',
+  target: ['es2022'],
+  sourcemap: true,
+  logLevel: 'info',
+});
+
+// Stream-worker entry (#448). Lives in a separate bundle: SharedWorker
+// scripts run in a different global (`self` is the worker scope, no
+// `window`) so they can't be inlined into tabs.js / flow.js. Output is
+// at `static/stream-worker.js`; common.js's `openStream` references
+// `/static/stream-worker.js` as the SharedWorker URL. `format: 'iife'`
+// matches the classic-script load (`new SharedWorker(url, name)` with
+// no `{ type: 'module' }`); Firefox is the #448 target and module
+// SharedWorker support there is patchy, so keeping the worker as a
+// classic script + IIFE bundle is the compatible default. argus nit
+// on #453: if a future contributor adds an `import` to this bundle,
+// the IIFE format will surface it as a build error rather than
+// silently shipping broken code.
+await build({
+  entryPoints: [src('stream-worker.js')],
+  outdir: staticDir(''),
+  bundle: true,
+  format: 'iife',
+  platform: 'browser',
+  target: ['es2022'],
+  sourcemap: true,
+  logLevel: 'info',
+});
+
+// Bundle the CSS — esbuild resolves @import including the package
+// re-exports from @hive/shared.
+await build({
+  entryPoints: [src('dashboard.css')],
+  outfile: staticDir('dashboard.css'),
+  bundle: true,
+  loader: { '.css': 'css' },
+  logLevel: 'info',
+});
+
+for (const html of ['index.html', 'flow.html']) {
+  copyFileSync(src(html), dist(html));
+}
+
+console.log('dashboard build ok →', dist(''));
diff --git a/frontend/packages/dashboard/package.json b/frontend/packages/dashboard/package.json
new file mode 100644
index 00000000..de91e6d7
--- /dev/null
+++ b/frontend/packages/dashboard/package.json
@@ -0,0 +1,14 @@
+{
+  "name": "@hive/dashboard",
+  "version": "0.0.0",
+  "private": true,
+  "description": "hive-c0re dashboard SPA. Bundled by esbuild into a static dist; served by the hive-c0re Rust binary at runtime via tower_http::ServeDir.",
+  "type": "module",
+  "scripts": {
+    "build": "node ./build.mjs"
+  },
+  "dependencies": {
+    "@hive/shared": "*",
+    "marked": "4.3.0"
+  }
+}
diff --git a/frontend/packages/dashboard/src/common.js b/frontend/packages/dashboard/src/common.js
new file mode 100644
index 00000000..2bc430d8
--- /dev/null
+++ b/frontend/packages/dashboard/src/common.js
@@ -0,0 +1,591 @@
+// Shared dashboard helpers — extracted from the original monolithic
+// dashboard JS as step 1 of the #406 split. These bits are used by
+// both the tab dashboard (index.html) and the flow page (flow.html):
+// pure DOM helpers, the side-panel singleton, the OS-notification
+// module, and the path-link / file-preview infrastructure for the
+// side panel.
+//
+// Each page now has its own entry point — `./tabs.js` for index.html,
+// `./flow.js` for flow.html — and both import from here directly
+// (#406 steps 2 + 3 complete; #406 closed).
+
+import { linkify as termLinkify } from '@hive/shared/terminal.js';
+
+// ─── helpers ────────────────────────────────────────────────────────────
+export const $ = (id) => document.getElementById(id);
+
+export const fmtAgeSecs = (s) => s < 60 ? `${s}s` : s < 3600 ? `${Math.floor(s/60)}m`
+  : s < 86400 ? `${Math.floor(s/3600)}h` : `${Math.floor(s/86400)}d`;
+
+export const esc = (s) => String(s).replace(/[&<>"]/g, (c) =>
+  ({ '&':'&amp;', '<':'&lt;', '>':'&gt;', '"':'&quot;' }[c])
+);
+
+export const el = (tag, attrs = {}, ...children) => {
+  const e = document.createElement(tag);
+  for (const [k, v] of Object.entries(attrs)) {
+    if (k === 'class') e.className = v;
+    else if (k === 'html') e.innerHTML = v;
+    else if (k.startsWith('data-')) e.setAttribute(k, v);
+    else e.setAttribute(k, v);
+  }
+  for (const c of children) {
+    if (c == null) continue;
+    e.append(c.nodeType ? c : document.createTextNode(c));
+  }
+  return e;
+};
+
+export const form = (action, btnClass, btnLabel, confirmMsg, extra = {}, opts = {}) => {
+  const f = el('form', {
+    method: 'POST', action, class: 'inline', 'data-async': '',
+    ...(confirmMsg ? { 'data-confirm': confirmMsg } : {}),
+    // Endpoints whose mutation fires a DashboardEvent (and whose
+    // derived store applies it live) opt out of the post-submit
+    // /api/state refetch. See the async-form handler.
+    ...(opts.noRefresh ? { 'data-no-refresh': '' } : {}),
+  });
+  for (const [name, value] of Object.entries(extra)) {
+    f.append(el('input', { type: 'hidden', name, value }));
+  }
+  f.append(el('button', { type: 'submit', class: 'btn ' + btnClass }, btnLabel));
+  return f;
+};
+
+// `truncate`, `fmtAgo`, `fmtElapsed`, `fmtDuration` stay in tabs.js
+// for now — each has display-specific phrasing ("X running", "X ago")
+// tied to its caller, so they don't generalise cleanly. We can lift
+// them when a second consumer needs the same shape.
+
+// ─── shared-worker SSE pipe (#448) ──────────────────────────────────────
+// Returns an EventSource-shaped object backed by a SharedWorker that
+// holds ONE upstream `new EventSource(url)` and fans events out to
+// every connected tab. Replaces direct `new EventSource(url)` at the
+// dashboard's two consumer sites (tabs.js inline + flow.js via
+// terminal.js's `streamFactory` option) so N hyperhive tabs share
+// ONE backend connection — way under the browser's per-host
+// connection cap, immune to per-tab throttling that drops the SSE
+// when Firefox suspends background tabs.
+//
+// Graceful fallback to direct EventSource on environments without
+// SharedWorker (some embedded browsers, some Safari versions). The
+// per-tab connection cost is the same as today — no regression.
+//
+// The page consumer uses the returned object like a regular
+// EventSource: assign `onmessage` / `onopen` / `onerror`. `.close()`
+// tells the worker to drop the subscription; the worker closes the
+// upstream EventSource when the last subscriber leaves.
+const SHARED_WORKER_PATH = '/static/stream-worker.js';
+const SHARED_WORKER_NAME = 'hyperhive-stream';
+
+// One SharedWorker port per page, reused by all openStream calls on
+// that page. Invalidated on `pagehide` so a bfcache restore picks up
+// a fresh port (the cached one may have been collected if all other
+// tabs closed while this page was frozen — argus nit on #453).
+let _sharedPort = null;
+function makeSharedPort() {
+  if (typeof SharedWorker === 'undefined') return null;
+  try {
+    const sw = new SharedWorker(SHARED_WORKER_PATH, SHARED_WORKER_NAME);
+    sw.port.start();
+    return sw.port;
+  } catch (err) {
+    console.warn('SharedWorker unavailable, falling back to direct EventSource:', err);
+    return null;
+  }
+}
+function getSharedPort() {
+  if (!_sharedPort) _sharedPort = makeSharedPort();
+  return _sharedPort;
+}
+
+// Registry of live subscriptions on this page. Keyed by url so a
+// second openStream call for the same URL (would only happen on a
+// hypothetical multi-consumer page) attaches to the existing route
+// rather than overlapping. Each entry caches the route function so
+// bfcache-restore re-bind can re-attach it to the fresh port.
+//
+// Today's pages only call openStream once with one URL; the registry
+// shape just keeps the bfcache-restore path correct if that changes
+// (e.g. /index.html later subscribing to two streams).
+const _activeSubs = new Map();
+
+// One-shot wiring of the page-wide lifecycle hooks: on bfcache
+// freeze (`pagehide { persisted: true }`) we unsubscribe so the
+// worker can close the upstream when the last live subscriber
+// leaves; on bfcache restore (`pageshow { persisted: true }`) we
+// invalidate the cached port (it may be dead if all other tabs
+// closed during the freeze) and re-attach every active subscription
+// to a fresh port. argus nit on #453: without this, the consumer's
+// onmessage stays bound but no events flow after a bfcache restore.
+let _lifecycleBound = false;
+function bindLifecycleOnce() {
+  if (_lifecycleBound) return;
+  _lifecycleBound = true;
+  window.addEventListener('pagehide', () => {
+    if (!_sharedPort) return;
+    for (const url of _activeSubs.keys()) {
+      try { _sharedPort.postMessage({ kind: 'unsubscribe', url }); }
+      catch { /* port dead — worker side already cleaned up */ }
+    }
+    // Drop port routes too; the bfcache-restore path will re-add
+    // them on a fresh port. Leaving stale routes on a dead port
+    // would just keep a closure alive without cost, but cleaning
+    // up keeps the registry shape honest.
+    for (const sub of _activeSubs.values()) {
+      try { _sharedPort.removeEventListener('message', sub.route); }
+      catch { /* same */ }
+    }
+    _sharedPort = null;
+  });
+  window.addEventListener('pageshow', (ev) => {
+    if (!ev.persisted) return; // cold load — openStream just bound listeners
+    if (!_activeSubs.size) return;
+    const port = getSharedPort();
+    if (!port) return; // SharedWorker really gone; fallback already in place
+    for (const [url, sub] of _activeSubs) {
+      sub.target.readyState = 0; // CONNECTING — the worker will fire 'open'
+      port.addEventListener('message', sub.route);
+      try { port.postMessage({ kind: 'subscribe', url }); }
+      catch { /* port dead immediately — skip */ }
+    }
+  });
+}
+
+export function openStream(url) {
+  const port = getSharedPort();
+  if (!port) return new EventSource(url);
+  bindLifecycleOnce();
+
+  // Build an EventSource-shaped facade so consumer code is unchanged.
+  // `target.onmessage` / `onopen` / `onerror` are assigned by the
+  // consumer; the routing function below forwards events received
+  // from the worker (filtered by url, since one port can multiplex
+  // multiple subscriptions).
+  const target = {
+    onmessage: null,
+    onopen: null,
+    onerror: null,
+    readyState: 0, // CONNECTING
+    close() {
+      const p = _sharedPort;
+      if (p) {
+        try { p.postMessage({ kind: 'unsubscribe', url }); }
+        catch { /* port dead */ }
+        try { p.removeEventListener('message', route); }
+        catch { /* same */ }
+      }
+      _activeSubs.delete(url);
+    },
+  };
+  const route = (e) => {
+    const m = e.data;
+    if (!m || m.url !== url) return;
+    if (m.kind === 'open') {
+      target.readyState = 1; // OPEN
+      if (target.onopen) {
+        try { target.onopen({ target }); }
+        catch (err) { console.error('openStream onopen threw', err); }
+      }
+    } else if (m.kind === 'message') {
+      if (target.onmessage) {
+        try { target.onmessage({ data: m.data, target }); }
+        catch (err) { console.error('openStream onmessage threw', err); }
+      }
+    } else if (m.kind === 'error') {
+      if (target.onerror) {
+        try { target.onerror({ target }); }
+        catch (err) { console.error('openStream onerror threw', err); }
+      }
+    }
+  };
+  _activeSubs.set(url, { target, route });
+  port.addEventListener('message', route);
+  port.postMessage({ kind: 'subscribe', url });
+  return target;
+}
+
+// ─── side panel ─────────────────────────────────────────────────────────
+// Singleton drawer that swipes in from the right. Long content
+// (file previews, approval diffs, journald logs, applied config)
+// opens here via `Panel.open(title, node)` instead of expanding
+// inline. Body is swapped on each open; closing just slides out so
+// the content stays visible through the transition.
+export const Panel = (() => {
+  let root = null;
+  let titleEl = null;
+  let bodyEl = null;
+  let drawer = null;
+  /** Owner key set by `openNamed` (e.g. 'inbox'). `refresh(name, …)`
+   *  is a no-op when the current owner doesn't match, so live
+   *  updates can re-render an open view without grabbing focus
+   *  from a closed one (or from an unrelated open view like a
+   *  diff drill-in). Untyped calls via `open(title, content)`
+   *  clear the owner — the legacy file-preview/diff/log paths
+   *  don't participate in named-refresh semantics. */
+  let owner = null;
+  function ensure() {
+    if (!root) {
+      root = $('side-panel');
+      titleEl = $('side-panel-title');
+      bodyEl = $('side-panel-body');
+      drawer = root && root.querySelector('.side-panel-drawer');
+    }
+    return root != null;
+  }
+  function open(title, content) {
+    if (!ensure()) return;
+    owner = null;
+    titleEl.textContent = title;
+    bodyEl.replaceChildren(...(content ? [content] : []));
+    root.classList.add('open');
+    root.setAttribute('aria-hidden', 'false');
+  }
+  function openNamed(name, title, content) {
+    open(title, content);
+    owner = name;
+  }
+  function refresh(name, title, content) {
+    if (!ensure()) return;
+    if (owner !== name) return;
+    titleEl.textContent = title;
+    bodyEl.replaceChildren(...(content ? [content] : []));
+  }
+  function close() {
+    if (!ensure()) return;
+    owner = null;
+    root.classList.remove('open');
+    root.setAttribute('aria-hidden', 'true');
+  }
+  // #451: drag-to-resize the drawer's width. Listens on a thin
+  // hit-strip glued to the drawer's left edge; mousedown captures
+  // pointermove + pointerup on the document so the drag continues
+  // even if the cursor strays outside the 6px handle band. Width
+  // persists to localStorage so it survives page reload. The CSS
+  // clamps the value (min-width: 320px, max-width: 96vw) — drop
+  // unparseable / out-of-range stored values silently.
+  const WIDTH_KEY = 'hyperhive:side-panel-width';
+  const WIDTH_MIN = 320;
+  function clampWidth(w) {
+    const max = Math.floor(window.innerWidth * 0.96);
+    return Math.max(WIDTH_MIN, Math.min(max, w));
+  }
+  function applyStoredWidth() {
+    if (!drawer) return;
+    const raw = (() => {
+      try { return localStorage.getItem(WIDTH_KEY); }
+      catch { return null; }
+    })();
+    if (!raw) return;
+    const parsed = parseInt(raw, 10);
+    if (!Number.isFinite(parsed) || parsed <= 0) return;
+    drawer.style.setProperty('--side-panel-w', clampWidth(parsed) + 'px');
+  }
+  function bindResize() {
+    if (!drawer) return;
+    const handle = document.createElement('div');
+    handle.className = 'side-panel-resize';
+    handle.setAttribute('role', 'separator');
+    handle.setAttribute('aria-orientation', 'vertical');
+    handle.setAttribute('aria-label', 'drag to resize side panel');
+    handle.title = 'drag to resize';
+    drawer.prepend(handle);
+    let dragging = false;
+    handle.addEventListener('pointerdown', (e) => {
+      e.preventDefault();
+      dragging = true;
+      document.body.classList.add('side-panel-resizing');
+      // Capture so we keep getting pointermove even when the cursor
+      // outpaces the handle band (drag-fast-then-pause loses the
+      // handle's :hover state otherwise).
+      try { handle.setPointerCapture(e.pointerId); } catch { /* legacy */ }
+    });
+    document.addEventListener('pointermove', (e) => {
+      if (!dragging) return;
+      // Drawer is anchored to the right edge — width = viewport - pointer X.
+      const w = clampWidth(window.innerWidth - e.clientX);
+      drawer.style.setProperty('--side-panel-w', w + 'px');
+    });
+    function stopDrag() {
+      if (!dragging) return;
+      dragging = false;
+      document.body.classList.remove('side-panel-resizing');
+      // Persist the final width. Read the actual rendered width
+      // rather than re-deriving so the stored value matches what
+      // the operator saw at mouseup.
+      const w = drawer.getBoundingClientRect().width;
+      try { localStorage.setItem(WIDTH_KEY, String(Math.round(w))); }
+      catch { /* localStorage unavailable — width is session-only */ }
+    }
+    document.addEventListener('pointerup', stopDrag);
+    document.addEventListener('pointercancel', stopDrag);
+    // Re-clamp on viewport resize so a persisted width that exceeds
+    // 96vw doesn't push the drawer off-screen after a window shrink.
+    window.addEventListener('resize', () => {
+      if (dragging) return;
+      const cur = drawer.getBoundingClientRect().width;
+      const clamped = clampWidth(cur);
+      if (clamped !== Math.round(cur)) {
+        drawer.style.setProperty('--side-panel-w', clamped + 'px');
+      }
+    });
+  }
+  function bind() {
+    if (!ensure()) return;
+    $('side-panel-close').addEventListener('click', close);
+    $('side-panel-backdrop').addEventListener('click', close);
+    document.addEventListener('keydown', (e) => {
+      if (e.key === 'Escape' && root.classList.contains('open')) close();
+    });
+    applyStoredWidth();
+    bindResize();
+  }
+  return { open, openNamed, refresh, close, bind };
+})();
+
+// ─── path linkification ─────────────────────────────────────────────────
+// Agents constantly drop pointer strings into messages + question
+// bodies (it's the 1 KiB-cap escape hatch). Anything matching the
+// PATH_RE patterns becomes a clickable anchor; clicking expands an
+// inline <details> with the file's contents, fetched lazily from
+// /api/state-file. The legacy in-container `/state/...` prefix is
+// deliberately not matched — it's ambiguous from the host's
+// perspective (we'd need to know which agent the message is about
+// to translate it). Prefer `/agents/<name>/state/...` in agent
+// outputs and the link will resolve.
+async function fetchStateFile(path) {
+  const resp = await fetch('/api/state-file?path=' + encodeURIComponent(path));
+  const text = await resp.text();
+  if (!resp.ok) throw new Error(text || ('HTTP ' + resp.status));
+  return text;
+}
+// A 2-tab file preview: a "rendered" tab (default) + a raw-text tab.
+// `renderRendered()` produces the rendered-tab node fresh on each
+// switch; `plainText` backs the raw tab; `plainLabel` names it.
+function buildTabbedPreview(renderRendered, plainText, plainLabel) {
+  const tabs = el('div', { class: 'diff-base-tabs' });
+  const host = el('div', { class: 'preview-host' });
+  function show(mode) {
+    for (const b of tabs.children) {
+      b.classList.toggle('active', b.dataset.mode === mode);
+    }
+    host.replaceChildren(mode === 'plain'
+      ? el('pre', { class: 'path-preview-body' }, plainText)
+      : renderRendered());
+  }
+  for (const [mode, label] of [['rendered', 'rendered'], ['plain', plainLabel]]) {
+    const b = el('button',
+      { type: 'button', class: 'diff-base-tab', 'data-mode': mode }, label);
+    b.addEventListener('click', () => show(mode));
+    tabs.append(b);
+  }
+  show('rendered');
+  return el('div', {}, tabs, host);
+}
+// Rendered <img> for an SVG, loaded via an <img> data: URI —
+// <img>-loaded SVG runs in the browser's secure static mode (no
+// scripts, no external fetches), so an untrusted SVG from an
+// agent's state dir can't execute code in the dashboard.
+function svgImage(text) {
+  const img = el('img', { class: 'img-preview', alt: 'SVG preview' });
+  img.addEventListener('error', () => {
+    img.replaceWith(el('div', { class: 'meta' },
+      '(could not render — see the source tab)'));
+  });
+  img.src = 'data:image/svg+xml,' + encodeURIComponent(text);
+  return img;
+}
+// Marked-rendered markdown node (raw text fallback if `marked`
+// failed to load).
+function mdNode(text) {
+  const div = el('div', { class: 'md' });
+  if (window.marked && typeof window.marked.parse === 'function') {
+    window.marked.setOptions({ breaks: true, gfm: true });
+    div.innerHTML = window.marked.parse(text);
+    // marked autolinks URLs but leaves them same-tab — open externally
+    // so a click never navigates away from the dashboard. (issue #233)
+    div.querySelectorAll('a[href]').forEach((a) => {
+      a.target = '_blank';
+      a.rel = 'noopener noreferrer';
+    });
+  } else {
+    div.textContent = text;
+  }
+  return div;
+}
+// Raster image extensions the preview renders as an <img> pointed
+// straight at /api/state-file (served binary with a real
+// content-type). SVG is handled on the text path instead.
+const RASTER_RE = /\.(png|jpe?g|gif|webp|bmp|ico|avif)$/i;
+// Lazy-load `path` from /api/state-file into the side panel.
+// Markdown + SVG get a rendered/plain tabbed view; raster images
+// render as an <img>; every other file stays raw text in a <pre>.
+async function openFilePanel(path) {
+  if (RASTER_RE.test(path)) {
+    const img = el('img', { class: 'img-preview', alt: path });
+    img.addEventListener('error', () => {
+      img.replaceWith(el('pre', { class: 'path-preview-body' },
+        '(could not load image — it may be missing or over the preview size cap)'));
+    });
+    img.src = '/api/state-file?path=' + encodeURIComponent(path);
+    Panel.open('↳ ' + path, img);
+    return;
+  }
+  const isMd = /\.(md|markdown)$/i.test(path);
+  const isSvg = /\.svg$/i.test(path);
+  const view = el('div');
+  view.textContent = '(fetching…)';
+  Panel.open('↳ ' + path, view);
+  try {
+    const text = await fetchStateFile(path);
+    if (isSvg) {
+      view.replaceChildren(buildTabbedPreview(() => svgImage(text), text, 'source'));
+    } else if (isMd) {
+      view.replaceChildren(buildTabbedPreview(() => mdNode(text), text, 'plain'));
+    } else {
+      view.replaceChildren(el('pre', { class: 'path-preview-body' }, text));
+    }
+  } catch (e) {
+    view.textContent = 'error: ' + (e.message || e);
+  }
+}
+export function makePathLink(path) {
+  const anchor = el('a', {
+    href: '#', class: 'path-link', title: 'open ' + path + ' in panel',
+  }, path);
+  anchor.addEventListener('click', (e) => {
+    e.preventDefault();
+    openFilePanel(path);
+  });
+  return anchor;
+}
+// Append a plain-text run, with bare http(s) URLs turned into clickable
+// links via the shared terminal linkifier.
+export function appendText(parent, s) {
+  if (!s) return;
+  parent.appendChild(termLinkify(s));
+}
+// Append `text` to `parent` as a mix of text nodes + path anchors.
+// `refs` is the server-attached `file_refs` array (verified-file
+// tokens that appear in `text`); each occurrence of a ref becomes a
+// clickable anchor that opens the file in the side panel. Anything
+// not in `refs` stays plain text. No client-side regex, no probe
+// endpoint — the server saw the body first and made the call. When
+// `refs` is empty/missing we just emit plain text.
+export function appendLinkified(parent, text, refs) {
+  if (text == null) return;
+  const str = String(text);
+  const tokens = (refs || []).slice();
+  if (!tokens.length) {
+    appendText(parent, str);
+    return;
+  }
+  // Walk the string left-to-right, at each step looking for the
+  // next occurrence of any token. Longest-first tie-break so a
+  // ref like `/agents/foo/state/x.md` wins over a (hypothetical)
+  // shorter token that prefixes it. O(text * refs) worst case;
+  // refs is bounded server-side to whatever fits in a body, so
+  // this stays cheap.
+  tokens.sort((a, b) => b.length - a.length);
+  let i = 0;
+  while (i < str.length) {
+    let bestStart = -1;
+    let bestToken = null;
+    for (const t of tokens) {
+      const idx = str.indexOf(t, i);
+      if (idx === -1) continue;
+      if (bestStart === -1 || idx < bestStart || (idx === bestStart && t.length > bestToken.length)) {
+        bestStart = idx;
+        bestToken = t;
+      }
+    }
+    if (bestStart === -1) {
+      appendText(parent, str.slice(i));
+      break;
+    }
+    if (bestStart > i) {
+      appendText(parent, str.slice(i, bestStart));
+    }
+    parent.appendChild(makePathLink(bestToken));
+    i = bestStart + bestToken.length;
+  }
+}
+
+// ─── browser notifications ──────────────────────────────────────────────
+// Fires OS notifications on three operator-bound signals:
+//   - new approval landed in the queue
+//   - new operator question queued (ask, target IS NULL)
+//   - broker message sent `to: "operator"`
+// Permission grant is per-browser; a localStorage "muted" toggle lets
+// the operator silence without revoking. Secure-context only (HTTPS /
+// localhost) — on other origins the API is unavailable and we hide
+// the controls.
+export const NOTIF = (() => {
+  const supported = typeof Notification !== 'undefined';
+  const MUTED_KEY = 'hyperhive.notify.muted';
+  const isMuted  = () => localStorage.getItem(MUTED_KEY) === '1';
+  const setMuted = (v) => v
+    ? localStorage.setItem(MUTED_KEY, '1')
+    : localStorage.removeItem(MUTED_KEY);
+  function renderControls() {
+    const enable = $('notif-enable');
+    const mute   = $('notif-mute');
+    const unmute = $('notif-unmute');
+    const status = $('notif-status');
+    if (!enable || !mute || !unmute || !status) return;
+    if (!supported) {
+      enable.hidden = mute.hidden = unmute.hidden = true;
+      status.hidden = false;
+      status.textContent = 'notifications unsupported in this browser';
+      return;
+    }
+    const perm = Notification.permission;
+    enable.hidden = perm === 'granted';
+    mute.hidden   = perm !== 'granted' || isMuted();
+    unmute.hidden = perm !== 'granted' || !isMuted();
+    status.hidden = perm !== 'denied';
+    if (perm === 'denied') status.textContent = 'notifications blocked — grant in site settings';
+  }
+  function bind() {
+    const enable = $('notif-enable');
+    const mute   = $('notif-mute');
+    const unmute = $('notif-unmute');
+    if (!supported || !enable || !mute || !unmute) return;
+    enable.addEventListener('click', async () => {
+      await Notification.requestPermission();
+      renderControls();
+    });
+    mute.addEventListener('click', () => { setMuted(true); renderControls(); });
+    unmute.addEventListener('click', () => { setMuted(false); renderControls(); });
+    renderControls();
+  }
+  function show(title, body, tag) {
+    if (!supported) {
+      console.debug('notify: Notification API not supported');
+      return;
+    }
+    if (Notification.permission !== 'granted') {
+      console.debug('notify: permission not granted', Notification.permission);
+      return;
+    }
+    if (isMuted()) {
+      console.debug('notify: muted');
+      return;
+    }
+    try {
+      // Per-event tag so distinct messages stack instead of
+      // collapsing into one slot. Caller passes a unique tag per
+      // notification kind/id; we don't fall back to 'hyperhive'
+      // because that one tag would replace itself on every fire.
+      const n = new Notification(title, {
+        body,
+        tag: tag || ('hyperhive:' + Date.now()),
+      });
+      n.onclick = () => { window.focus(); n.close(); };
+      console.debug('notify: shown', title, 'tag=', tag);
+    } catch (err) {
+      console.warn('notification show failed', err);
+    }
+  }
+  return { bind, show, renderControls };
+})();
diff --git a/frontend/packages/dashboard/src/dashboard.css b/frontend/packages/dashboard/src/dashboard.css
new file mode 100644
index 00000000..d8339480
--- /dev/null
+++ b/frontend/packages/dashboard/src/dashboard.css
@@ -0,0 +1,1879 @@
+/* Shared Catppuccin palette + body typography + terminal pane styles.
+   Bundled in front of the dashboard-only rules below via esbuild. */
+@import "@hive/shared/base.css";
+@import "@hive/shared/terminal.css";
+
+/* ─── tabbed dashboard chrome (#369) ────────────────────────────────
+   Top-of-page sticky header with banner + tab strip. Tab routing is
+   hash-based; tab panes are show/hide via the `.tab-pane-active`
+   class. SSE stays alive across tab switches so count pills update
+   live on inactive tabs without losing pulse on what's happening
+   elsewhere. */
+
+body.dashboard-shell {
+  /* Full-width layout (#416 — mara: drop the 90em cap so wide screens
+     don't waste real estate on empty side margins). `padding: 0 1.5em
+     1.5em` keeps a small gutter on the left/right so cards don't kiss
+     the viewport edge; `.dashboard-chrome { margin: 0 -1.5em ... }`
+     still pulls the chrome bar edge-to-edge through that gutter. */
+  margin: 0;
+  padding: 0 1.5em 1.5em;
+}
+
+.dashboard-chrome {
+  position: sticky;
+  top: 0;
+  z-index: 25;
+  background: rgba(30, 30, 46, 0.86);
+  -webkit-backdrop-filter: blur(8px) saturate(120%);
+  backdrop-filter: blur(8px) saturate(120%);
+  border-bottom: 1px solid var(--purple-dim);
+  padding: 0.4em 0 0;
+  margin: 0 -1.5em 1em;
+}
+.banner-thin {
+  text-align: center;
+  margin: 0;
+  padding: 0 1em;
+  font-size: 0.78em;
+  color: var(--purple-dim);
+  letter-spacing: 0.15em;
+  white-space: pre;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+
+.tabbar {
+  display: flex;
+  align-items: center;
+  gap: 0.2em;
+  padding: 0.5em 1em 0;
+  border-bottom: 1px solid var(--purple-dim);
+}
+.tabbar .tab {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.5em;
+  padding: 0.55em 1em 0.45em;
+  margin-bottom: -1px; /* overlap the tabbar bottom border */
+  color: var(--muted);
+  font-family: inherit;
+  font-size: 0.92em;
+  letter-spacing: 0.08em;
+  text-decoration: none;
+  border: 1px solid transparent;
+  border-bottom: 0;
+  border-radius: 4px 4px 0 0;
+  cursor: pointer;
+  transition: color 0.15s ease, background 0.15s ease, border-color 0.15s ease;
+}
+.tabbar .tab:hover {
+  color: var(--purple);
+  background: rgba(203, 166, 247, 0.06);
+}
+.tabbar .tab.active {
+  color: var(--purple);
+  border-color: var(--purple-dim);
+  background: var(--bg);
+  /* Lift the active tab visually — the bottom border of the tabbar
+     yields under it via the -1px margin above. */
+  box-shadow: 0 -2px 12px -4px rgba(203, 166, 247, 0.4);
+}
+.tab-label { font-weight: bold; }
+.tab-count {
+  display: inline-block;
+  background: var(--purple-dim);
+  color: var(--purple);
+  border-radius: 999px;
+  padding: 0 0.55em;
+  min-width: 1.6em;
+  text-align: center;
+  font-size: 0.82em;
+  font-variant-numeric: tabular-nums;
+  font-weight: bold;
+}
+.tab-count-attn {
+  /* Y3R C4LL — operator-action-required pill colour, harder to miss. */
+  background: rgba(243, 139, 168, 0.22);
+  color: var(--red);
+}
+
+/* Notification controls cohabit with the tabs (always-on chrome). */
+.tabbar #notif-row {
+  margin-left: auto;
+  display: flex;
+  gap: 0.5em;
+  align-items: center;
+  padding-right: 0.5em;
+}
+
+/* Tab pane visibility — show only the active one. The .tab-pane-active
+   class is set by tabs.js based on the URL hash; default (no hash)
+   resolves to SW4RM. */
+.tab-pane { display: none; }
+.tab-pane.tab-pane-active { display: block; }
+
+/* FL0W is a separate page (`/flow.html`) — its full-viewport vibec0re
+   styling lives further down under `body.flow-shell`. */
+.banner {
+  text-align: center;
+  margin: 0 0 1em 0;
+  font-size: 0.95em;
+  overflow-x: auto;
+  background: linear-gradient(
+    90deg,
+    var(--purple-dim) 0%,
+    var(--purple) 50%,
+    var(--purple-dim) 100%
+  );
+  background-size: 200% 100%;
+  background-position: 50% 0;
+  -webkit-background-clip: text;
+  background-clip: text;
+  color: transparent;
+  filter: drop-shadow(0 0 6px rgba(203, 166, 247, 0.45));
+}
+.banner.active {
+  animation: banner-shimmer 1.8s linear infinite;
+}
+@keyframes banner-shimmer {
+  from { background-position: 200% 0; }
+  to   { background-position: -100% 0; }
+}
+h1, h2 {
+  color: var(--purple);
+  text-transform: uppercase;
+  letter-spacing: 0.15em;
+  margin-top: 2em;
+  text-shadow: 0 0 8px rgba(203, 166, 247, 0.4);
+}
+.divider {
+  color: var(--purple-dim);
+  overflow: hidden;
+  white-space: nowrap;
+  margin-bottom: 0.5em;
+}
+ul { list-style: none; padding-left: 0; }
+li { padding: 0.5em 0; }
+.glyph { color: var(--purple); margin-right: 0.5em; }
+a {
+  color: var(--cyan);
+  text-decoration: none;
+  font-weight: bold;
+  text-shadow: 0 0 4px rgba(137, 220, 235, 0.5);
+}
+a:hover {
+  color: var(--fg);
+  text-shadow: 0 0 12px rgba(137, 220, 235, 0.9);
+}
+.role {
+  display: inline-block;
+  margin-left: 0.4em;
+  padding: 0.05em 0.5em;
+  border: 1px solid;
+  border-radius: 2px;
+  font-size: 0.8em;
+  letter-spacing: 0.1em;
+  text-transform: uppercase;
+}
+.role-m1nd { color: var(--pink); border-color: var(--pink); background: rgba(245, 194, 231, 0.08); }
+.role-ag3nt { color: var(--amber); border-color: var(--amber); background: rgba(250, 179, 135, 0.08); }
+/* Container rows: a full-height square agent icon on the left, the
+   identity / actions / drill-in lines stacked in the card body on the
+   right. Pending rows dim everything except the pending indicator. */
+.containers { display: flex; flex-direction: column; gap: 0.4em; }
+.container-row {
+  padding: 0.6em 0.8em;
+  border: 1px solid var(--border);
+  border-radius: 4px;
+  background: rgba(24, 24, 37, 0.55);
+  transition: opacity 200ms ease, border-color 200ms ease;
+}
+/* Topology indent (#363). Each depth level shifts the row right by one
+   step; the .tree-prefix span (drawn by tabs.js::treePrefix) carries
+   the ├─ / └─ glyph and any continuation lines that thread through
+   ancestor columns. When every container has parent=null (pre-#361
+   state) `[data-depth]` is absent on every row and these rules are
+   no-ops — the layout reads exactly like the legacy flat list.
+   Per-depth indent: hardcoded steps for 6 levels (sufficient for any
+   plausible hive topology) — the typed `attr()` function from CSS
+   Values 5 would collapse this to one rule, but browser support is
+   still partial (Chromium-only as of 2026). */
+.container-row[data-depth] { position: relative; }
+.container-row[data-depth="1"] { margin-left: 1.8em; }
+.container-row[data-depth="2"] { margin-left: 3.6em; }
+.container-row[data-depth="3"] { margin-left: 5.4em; }
+.container-row[data-depth="4"] { margin-left: 7.2em; }
+.container-row[data-depth="5"] { margin-left: 9em; }
+.container-row[data-depth="6"] { margin-left: 10.8em; }
+/* Tree prefix sits in the left margin and paints the connecting
+   ├ / └ / │ lanes as CSS rules rather than text glyphs (#388). Each
+   ancestor depth gets its own `.tree-lane` so we can paint a
+   full-row-height vertical bar that extends through the
+   .containers row gap into the next sibling — text box-drawing
+   glyphs only fill one text line, which left visible breaks
+   between rows once cards grew taller than one line of text (5em
+   square icons + multi-line body). The horizontal stub at the row's
+   own joint lands at the icon midline so the L/T meets the icon
+   edge cleanly. */
+.container-row .tree-prefix {
+  position: absolute;
+  /* Extend into the `.containers { gap: 0.4em }` below so vertical
+     bars connect to the next sibling's prefix without a visual gap. */
+  top: 0;
+  bottom: -0.4em;
+  display: flex;
+  flex-direction: row;
+  pointer-events: none;
+  user-select: none;
+  color: var(--purple-dim);
+}
+/* Each depth step is one 1.8em lane wide — same step as the row's
+   own margin-left ladder above, so the rightmost lane (the joint)
+   sits flush against the row content (the icon). The prefix's left
+   edge is depth*1.8em LEFT of the row's left edge, so its right
+   edge meets the icon, and the leftmost lane lines up with the
+   top-level rows' icons at x=0. */
+.container-row[data-depth="1"] .tree-prefix { left: -1.8em; }
+.container-row[data-depth="2"] .tree-prefix { left: -3.6em; }
+.container-row[data-depth="3"] .tree-prefix { left: -5.4em; }
+.container-row[data-depth="4"] .tree-prefix { left: -7.2em; }
+.container-row[data-depth="5"] .tree-prefix { left: -9em; }
+.container-row[data-depth="6"] .tree-prefix { left: -10.8em; }
+.tree-prefix .tree-lane {
+  flex: 0 0 1.8em;
+  position: relative;
+}
+/* Continuation bar — full row + gap below (so two adjacent
+   ancestor-line lanes from sibling rows visually merge into one
+   unbroken vertical line). Drawn at lane center (0.6em from left)
+   to keep it visually centered in the 1.8em column. */
+.tree-prefix .lane-line::before,
+.tree-prefix .lane-joint::before {
+  content: '';
+  position: absolute;
+  left: 0.6em;
+  top: 0;
+  bottom: 0;
+  border-left: 1px solid currentColor;
+}
+/* Last-child joint (└): vertical bar stops at the icon midline (no
+   continuation below this row). 3.1em ≈ row padding-top 0.6em +
+   icon half-height 2.5em, matching the horizontal stub's y below. */
+.tree-prefix .lane-joint-last::before {
+  bottom: auto;
+  height: 3.1em;
+}
+/* Horizontal stub from the joint's vertical bar across the lane
+   and through the row's padding-left to the icon left edge. Lands
+   at the icon midline so the ├/└ meets the icon cleanly.
+   Width = lane-right (1.2em from lane center) + row padding-left
+   (0.8em) = 2em. */
+.tree-prefix .lane-joint::after {
+  content: '';
+  position: absolute;
+  left: 0.6em;
+  top: 3.1em;
+  width: 2em;
+  border-top: 1px solid currentColor;
+}
+/* Live cards get the icon-left / body-right split; tombstone rows keep
+   the plain stacked block layout. The icon is a background-image div
+   with no intrinsic size, so its load state can never reflow the row
+   (issue #177). It used to `align-self: stretch` to fill the body
+   height, but with state badges / rate-limit pills / etc. wrapping the
+   head row, the body grew taller and the square icon grew with it —
+   so two cards with different content showed different-sized icons
+   (issue #344). Fixed at 5em now; height follows from aspect-ratio. */
+.container-row:not(.tombstone) {
+  display: flex;
+  align-items: flex-start;
+  gap: 0.7em;
+}
+.container-row:not(.tombstone) > .container-icon {
+  position: relative;
+  overflow: hidden;
+  flex: none;
+  width: 5em;
+  aspect-ratio: 1;
+  border-radius: 6px;
+  background-color: rgba(17, 17, 27, 0.6);
+  /* #443 — icon is the selection toggle. Cursor + hover ring make
+     that affordable without a chrome change. The :focus-visible ring
+     covers keyboard activation (Enter / Space). */
+  cursor: pointer;
+  transition: box-shadow 120ms ease, transform 120ms ease;
+}
+.container-row:not(.tombstone) > .container-icon:hover {
+  box-shadow: 0 0 0 2px var(--purple);
+}
+.container-row:not(.tombstone) > .container-icon:focus-visible {
+  outline: 2px solid var(--purple);
+  outline-offset: 2px;
+}
+/* Selected state — mauve ring on the icon + a matching outline on the
+   whole row so a glance at the list shows what's in the active set. */
+.container-row.selected {
+  border-color: var(--purple);
+  box-shadow: inset 0 0 0 1px var(--purple);
+  background: rgba(203, 166, 247, 0.06);
+}
+.container-row.selected > .container-icon {
+  box-shadow: 0 0 0 2px var(--purple), 0 0 12px -4px var(--purple);
+}
+/* The icon image fills the square wrapper and is taken out of flow
+   (absolute) so its load state — pending, loaded, broken — can never
+   contribute intrinsic size or reflow the row. (issue #177) */
+.container-row:not(.tombstone) > .container-icon > .container-icon-img {
+  position: absolute;
+  inset: 0;
+  width: 100%;
+  height: 100%;
+  object-fit: contain;
+}
+/* When the <img> fails to load it falls back to the dimmed hyperhive
+   mark, standing in for the unreachable agent icon (issues #195, #202). */
+.container-row:not(.tombstone) > .container-icon.icon-unreachable {
+  filter: grayscale(1);
+  opacity: 0.4;
+}
+.container-row .card-body {
+  flex: 1;
+  min-width: 0;
+}
+.container-row.pending {
+  border-color: var(--amber);
+  background: rgba(250, 179, 135, 0.05);
+}
+.container-row.pending .actions { opacity: 0.4; pointer-events: none; }
+.container-row .head {
+  display: flex;
+  align-items: center;
+  flex-wrap: wrap;
+  gap: 0.5em;
+  margin-bottom: 0.4em;
+}
+.container-row .head .name {
+  font-size: 1.05em;
+  font-weight: bold;
+}
+.container-row .head .meta { margin-left: auto; }
+/* Icon-only nav strip in the head row — the per-container backend-
+   supplied link list (issue #262). Inline-flex + gap so a longer list
+   (e.g. with `dashboardLinks` extras) doesn't cram (issue #333). Each
+   link gets a comfortable hit target with a subtle hover so the
+   icons read as interactive rather than decorative. */
+.container-row .head .nav-strip {
+  display: inline-flex;
+  align-items: center;
+  flex-wrap: wrap;
+  gap: 0.35em;
+}
+.nav-link {
+  color: var(--muted);
+  font-size: 0.95em;
+  line-height: 1;
+  padding: 0.15em 0.35em;
+  border-radius: 3px;
+  text-decoration: none;
+  transition: background 0.12s ease, color 0.12s ease;
+}
+.nav-link:hover {
+  background: rgba(203, 166, 247, 0.12);
+  color: var(--cyan);
+  text-shadow: 0 0 6px rgba(137, 220, 235, 0.5);
+}
+.container-row .actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.4em;
+}
+.container-row .actions form.inline { display: inline-block; margin: 0; }
+.badge {
+  display: inline-block;
+  padding: 0.05em 0.5em;
+  border: 1px solid;
+  border-radius: 2px;
+  font-size: 0.75em;
+  letter-spacing: 0.08em;
+  text-transform: uppercase;
+}
+.badge-warn {
+  color: var(--amber); border-color: var(--amber);
+  text-shadow: 0 0 6px rgba(250, 179, 135, 0.5);
+}
+.badge-rate-limited {
+  color: var(--red); border-color: var(--red);
+  text-shadow: 0 0 6px rgba(243, 139, 168, 0.5);
+}
+.badge-muted {
+  color: var(--muted); border-color: var(--purple-dim);
+  background: rgba(127, 132, 156, 0.08);
+}
+.badge-reminder {
+  color: var(--cyan); border-color: var(--cyan);
+  text-shadow: 0 0 6px rgba(137, 220, 235, 0.4);
+}
+/* Context-window usage badges on dashboard container rows. Thresholds
+   are derived per-container: yellow ≥ 50% and red ≥ 75% of the model's
+   context window (`ContainerView.context_window_tokens`), mirroring the
+   harness compaction watermarks. Falls back to fixed 100k / 150k when
+   the window is unknown. (issue #66) */
+.badge-ctx-ok {
+  color: var(--green); border-color: var(--green);
+  opacity: 0.85;
+}
+.badge-ctx-caution {
+  color: var(--amber); border-color: var(--amber);
+  text-shadow: 0 0 6px rgba(250, 179, 135, 0.5);
+}
+.badge-ctx-warn {
+  color: var(--red); border-color: var(--red);
+  text-shadow: 0 0 6px rgba(243, 139, 168, 0.5);
+}
+.agent-status {
+  font-size: 0.82em;
+  color: var(--subtext0, #a6adc8);
+  padding: 0.1em 0.3em 0.25em;
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+.agent-status .status-icon { opacity: 0.65; }
+.agent-status .status-age { opacity: 0.5; font-size: 0.9em; margin-left: 0.2em; }
+
+.container-row.tombstone {
+  border-style: dashed;
+  background: rgba(24, 24, 37, 0.35);
+  opacity: 0.85;
+}
+.container-row.tombstone .name { color: var(--muted); }
+/* Per-container journald viewer + applied-config viewer. Both open
+   in the side panel and lazy-fetch on open; output is monospace
+   inside a bordered <pre>, controls (unit select + refresh) above. */
+.journal-controls {
+  display: flex;
+  gap: 0.5em;
+  margin-bottom: 0.4em;
+  align-items: center;
+}
+.journal-unit {
+  font-family: inherit;
+  font-size: 0.9em;
+  background: var(--bg-elev);
+  color: var(--fg);
+  border: 1px solid var(--border);
+  padding: 0.2em 0.4em;
+}
+.journal-refresh { font-size: 0.75em; padding: 0.15em 0.5em; }
+.journal-output {
+  margin: 0;
+  background: #11111b;
+  color: var(--fg);
+  border: 1px solid var(--purple-dim);
+  padding: 0.5em 0.7em;
+  overflow-x: auto;
+  font-size: 0.85em;
+  line-height: 1.4;
+  white-space: pre;
+  word-break: normal;
+}
+
+/* Notification controls — sit between the banner and the
+   containers section. Hidden by JS when notifications are
+   unsupported, denied, or already in the right state. */
+/* Port-collision banner: appears above the containers list when
+   two sub-agents hash to the same web UI port. Critical — without
+   resolution, one of the harnesses will restart-loop on
+   AddrInUse. */
+.port-conflict {
+  background: rgba(243, 139, 168, 0.08);
+  border: 1px solid var(--red);
+  color: var(--red);
+  padding: 0.5em 0.8em;
+  margin-bottom: 0.6em;
+  border-radius: 4px;
+  text-shadow: 0 0 6px rgba(243, 139, 168, 0.4);
+  animation: questions-pulse 2.4s ease-in-out infinite;
+}
+.port-conflict strong { color: var(--red); }
+
+.notif-row {
+  display: flex;
+  gap: 0.5em;
+  align-items: center;
+  margin: 0.5em 0;
+  font-size: 0.85em;
+}
+.btn-notif {
+  font-family: inherit;
+  font-size: 0.85em;
+  background: transparent;
+  color: var(--cyan);
+  border: 1px solid var(--cyan);
+  padding: 0.2em 0.7em;
+  border-radius: 999px;
+  cursor: pointer;
+  text-shadow: 0 0 4px currentColor;
+}
+.btn-notif:hover {
+  background: rgba(137, 220, 235, 0.1);
+  box-shadow: 0 0 10px -2px currentColor;
+}
+
+.pending-state {
+  color: var(--amber);
+  font-size: 0.85em;
+  letter-spacing: 0.08em;
+  text-transform: uppercase;
+  text-shadow: 0 0 6px rgba(250, 179, 135, 0.55);
+  animation: badge-pulse 1.6s ease-in-out infinite;
+}
+@keyframes badge-pulse {
+  0%, 100% { opacity: 1; }
+  50%      { opacity: 0.7; }
+}
+.meta { color: var(--muted); font-size: 0.85em; margin-left: 0.4em; }
+.id { color: var(--pink); font-weight: bold; margin-right: 0.4em; }
+.agent { color: var(--amber); font-weight: bold; margin-right: 0.6em; }
+.empty { color: var(--muted); font-style: italic; }
+code {
+  color: var(--amber);
+  background: var(--bg-elev);
+  padding: 0.1em 0.4em;
+  border: 1px solid var(--border);
+  border-radius: 2px;
+  font-size: 0.9em;
+}
+/* Pending approval: a card with three stacked sections — identity
+   header, what-changed body, decision actions. */
+.approvals { list-style: none; padding: 0; margin: 0.4em 0 0; }
+.approval-card {
+  background: var(--bg-elev);
+  border: 1px solid var(--border);
+  border-left: 3px solid var(--purple);
+  border-radius: 4px;
+  padding: 0.6em 0.8em;
+  margin-bottom: 0.6em;
+}
+.approval-head {
+  display: flex;
+  align-items: baseline;
+  flex-wrap: wrap;
+  gap: 0.3em;
+}
+/* When the approval was requested — right-aligned in the head row;
+   goes amber once it has been pending ≥ 1h so a stale request stands
+   out at a glance (issue #272). */
+.approval-ts {
+  margin-left: auto;
+  color: var(--muted);
+  font-size: 0.85em;
+}
+.approval-ts.stale {
+  color: var(--amber);
+  text-shadow: 0 0 6px rgba(250, 179, 135, 0.5);
+}
+.approval-body {
+  margin: 0.45em 0;
+  padding-left: 1.3em;
+}
+.approval-description {
+  font-size: 0.9em;
+  color: var(--fg);
+  white-space: pre-wrap;
+  margin-bottom: 0.35em;
+}
+.approval-actions {
+  display: flex;
+  gap: 0.5em;
+  padding-top: 0.45em;
+  border-top: 1px solid var(--border);
+}
+.approval-actions form.inline { display: inline; }
+/* Inline drill-in triggers (logs / config repo / view diff). */
+.drill-ins {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.15em 1.1em;
+  margin-top: 0.4em;
+}
+.drill-ins .panel-trigger { margin-top: 0; }
+/* Diff side-panel: base-toggle tabs above the diff host. */
+.diff-panel { display: flex; flex-direction: column; gap: 0.6em; }
+.diff-base-tabs { display: flex; flex-wrap: wrap; gap: 0.4em; }
+.diff-base-tab {
+  background: transparent;
+  border: 1px solid var(--border);
+  color: var(--muted);
+  font: inherit;
+  font-size: 0.85em;
+  padding: 0.2em 0.7em;
+  cursor: pointer;
+}
+.diff-base-tab:hover { color: var(--fg); }
+.diff-base-tab.active {
+  color: var(--purple);
+  border-color: var(--purple);
+  background: rgba(203, 166, 247, 0.08);
+}
+/* Image / tabbed file preview (issues #188, #192) */
+.preview-host { margin-top: 0.5em; }
+.img-preview {
+  display: block;
+  max-width: 100%;
+  height: auto;
+  margin: 0 auto;
+  border: 1px solid var(--border);
+  border-radius: 4px;
+  /* checkerboard so transparent regions of the image read clearly */
+  background: repeating-conic-gradient(#313244 0% 25%, #1e1e2e 0% 50%) 50% / 18px 18px;
+}
+.approval-tabs {
+  display: flex;
+  gap: 0.4em;
+  margin: 0.6em 0 0.4em;
+}
+.approval-tab {
+  background: transparent;
+  border: 1px solid var(--border);
+  color: var(--muted);
+  font: inherit;
+  font-size: 0.85em;
+  letter-spacing: 0.08em;
+  padding: 0.25em 0.9em;
+  cursor: pointer;
+  transition: color 0.15s ease, border-color 0.15s ease, background 0.15s ease;
+}
+.approval-tab:hover { color: var(--fg); }
+.approval-tab.active {
+  color: var(--purple);
+  border-color: var(--purple);
+  background: rgba(203, 166, 247, 0.08);
+  text-shadow: 0 0 4px currentColor;
+}
+.approvals-history .status { font-size: 0.85em; padding: 0 0.5em; }
+.status-approved { color: var(--green); }
+.status-denied { color: var(--red); }
+.status-failed { color: var(--amber); }
+.status-cancelled { color: var(--muted); }
+.glyph-approved { color: var(--green); }
+.glyph-denied { color: var(--red); }
+.glyph-failed { color: var(--amber); }
+.glyph-cancelled { color: var(--muted); }
+.meta-inputs {
+  list-style: none;
+  padding: 0;
+  margin: 0 0 0.8em;
+  display: grid;
+  gap: 0.2em;
+}
+.meta-inputs li {
+  padding: 0.25em 0.6em;
+  border: 1px solid var(--border);
+  background: rgba(24, 24, 37, 0.6);
+}
+.meta-inputs label {
+  display: flex;
+  align-items: baseline;
+  gap: 0.5em;
+  cursor: pointer;
+  font-size: 0.9em;
+}
+.meta-input-name { color: var(--amber); font-weight: bold; }
+.meta-input-rev { color: var(--muted); }
+.meta-input-ts { color: var(--muted); font-size: 0.85em; }
+.meta-input-url {
+  color: var(--muted);
+  font-size: 0.85em;
+  margin-left: auto;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+/* Bulk select-all / -none control above the meta-inputs tree (#275). */
+.meta-inputs-bulk {
+  margin: 0 0 0.5em;
+  font-size: 0.8em;
+  color: var(--muted);
+}
+.meta-bulk-btn {
+  font: inherit;
+  font-size: 1em;
+  background: transparent;
+  border: 1px solid var(--purple-dim);
+  color: var(--cyan);
+  padding: 0.1em 0.6em;
+  margin-right: 0.2em;
+  cursor: pointer;
+}
+.meta-bulk-btn:hover {
+  border-color: var(--cyan);
+  text-shadow: 0 0 6px currentColor;
+}
+/* Tree twig glyph prefixing a nested (sub-)input row (#275). */
+.meta-input-twig {
+  color: var(--purple-dim);
+  margin-right: 0.1em;
+}
+.btn-meta-update {
+  background: rgba(203, 166, 247, 0.12);
+  border: 1px solid var(--purple);
+  color: var(--purple);
+  text-shadow: 0 0 4px currentColor;
+  padding: 0.3em 1em;
+  font: inherit;
+  font-size: 0.85em;
+  letter-spacing: 0.08em;
+  cursor: pointer;
+  transition: box-shadow 0.15s ease, background 0.15s ease;
+}
+.btn-meta-update:hover:not([disabled]) {
+  background: rgba(203, 166, 247, 0.22);
+  box-shadow: 0 0 10px -2px currentColor;
+}
+.btn-meta-update[disabled] {
+  opacity: 0.35;
+  cursor: not-allowed;
+}
+/* In-progress banner for the META INPUTS panel: shown while a
+   dashboard-triggered meta-update runs in the background (issue #259). */
+.meta-update-running {
+  margin: 0 0 0.7em;
+  padding: 0.4em 0.7em;
+  border: 1px solid var(--purple);
+  background: rgba(203, 166, 247, 0.12);
+  color: var(--purple);
+  font-size: 0.85em;
+  animation: badge-pulse 1.6s ease-in-out infinite;
+}
+/* ─── rebuild queue panel ──────────────────────────────────────────────── */
+.rebuild-queue {
+  list-style: none;
+  padding: 0;
+  margin: 0;
+  display: grid;
+  gap: 0.2em;
+}
+.rebuild-queue-entry {
+  padding: 0.3em 0.6em;
+  border: 1px solid var(--border);
+  background: rgba(24, 24, 37, 0.6);
+  font-size: 0.9em;
+  display: flex;
+  flex-wrap: wrap;
+  align-items: baseline;
+  gap: 0.4em;
+}
+.rebuild-queue-entry.rqe-child { margin-left: 1.6em; border-color: var(--purple-dim); }
+.rebuild-queue-entry.rqe-running {
+  border-color: var(--purple);
+  background: rgba(203, 166, 247, 0.12);
+  animation: badge-pulse 1.6s ease-in-out infinite;
+}
+.rebuild-queue-entry.rqe-failed { border-color: var(--red); color: var(--red); }
+.rebuild-queue-entry.rqe-cancelled { opacity: 0.6; }
+.rebuild-queue-entry.rqe-done { opacity: 0.7; color: var(--green); }
+.rqe-state { font-weight: bold; min-width: 1.2em; text-align: center; }
+.rqe-kind { color: var(--cyan); }
+.rqe-agent { color: var(--amber); font-weight: bold; }
+.rqe-source {
+  font-size: 0.75em;
+  padding: 0.05em 0.45em;
+  border-radius: 0.7em;
+  border: 1px solid var(--border);
+  color: var(--muted);
+  text-transform: uppercase;
+  letter-spacing: 0.05em;
+}
+.rqe-source-manual { color: var(--cyan); border-color: var(--cyan); }
+.rqe-source-meta_update { color: var(--purple); border-color: var(--purple); }
+.rqe-source-auto_update { color: var(--muted); }
+.rqe-source-crash_recover { color: var(--amber); border-color: var(--amber); }
+.rqe-source-approval { color: var(--green); border-color: var(--green); }
+.rqe-when { color: var(--muted); font-size: 0.85em; }
+.rqe-reason { color: var(--muted); font-size: 0.85em; flex: 1 1 auto; }
+/* #437: in-flight step indicator on running queue entries — sub-line
+   below the main row, indented under the state glyph + kind. Cyan
+   keeps it visually grouped with the running spinner instead of
+   blending into the muted reason/timing chips. flex-basis: 100% so
+   it always wraps to its own line. */
+.rqe-step {
+  flex-basis: 100%;
+  margin: 0.1em 0 0 1.8em;
+  color: var(--cyan);
+  font-size: 0.85em;
+}
+.rqe-error {
+  flex-basis: 100%;
+  margin: 0.3em 0 0;
+  padding: 0.3em 0.5em;
+  background: rgba(243, 139, 168, 0.1);
+  border-left: 2px solid var(--red);
+  color: var(--red);
+  font-size: 0.8em;
+  white-space: pre-wrap;
+}
+.history-note {
+  margin-left: 1.8em;
+  margin-top: 0.2em;
+  color: var(--muted);
+  font-size: 0.85em;
+  white-space: pre-wrap;
+  word-break: break-word;
+}
+ul form.inline { display: inline-block; }
+.btn {
+  font-family: inherit;
+  font-weight: bold;
+  text-transform: uppercase;
+  letter-spacing: 0.1em;
+  background: transparent;
+  border: 1px solid;
+  padding: 0.25em 0.8em;
+  cursor: pointer;
+  text-shadow: 0 0 4px currentColor;
+  box-shadow: 0 0 0 0 currentColor;
+  transition: box-shadow 0.15s ease;
+}
+.btn:hover {
+  background: rgba(205, 214, 244, 0.06);
+  text-shadow: 0 0 10px currentColor;
+  box-shadow: 0 0 10px -2px currentColor;
+}
+.btn:disabled,
+.btn[disabled] {
+  opacity: 0.32;
+  cursor: not-allowed;
+  text-shadow: none;
+  box-shadow: none;
+}
+.btn:disabled:hover,
+.btn[disabled]:hover {
+  background: transparent;
+  text-shadow: none;
+  box-shadow: none;
+}
+.btn-approve { color: var(--green); border-color: var(--green); }
+.btn-deny { color: var(--red); border-color: var(--red); }
+.btn-destroy { color: var(--red); border-color: var(--red); font-size: 0.75em; padding: 0.15em 0.5em; margin-left: 0.6em; }
+.btn-rebuild { color: var(--amber); border-color: var(--amber); font-size: 0.75em; padding: 0.15em 0.5em; margin-left: 0.6em; }
+.btn-restart { color: var(--cyan); border-color: var(--cyan); font-size: 0.75em; padding: 0.15em 0.5em; margin-left: 0.6em; }
+.btn-stop    { color: var(--pink); border-color: var(--pink); font-size: 0.75em; padding: 0.15em 0.5em; margin-left: 0.6em; }
+.btn-start   { color: var(--green); border-color: var(--green); font-size: 0.75em; padding: 0.15em 0.5em; margin-left: 0.6em; }
+.btn-talk { color: var(--cyan); border-color: var(--cyan); }
+.btn-spawn { color: var(--amber); border-color: var(--amber); }
+.btn-fire-now { color: var(--mauve, #cba6f7); border-color: var(--mauve, #cba6f7); }
+/* Post-fire flash: report renders directly on the button for ~1.5s
+   so the operator sees ok/failed/missing/consumed counts inline
+   without a modal. Green when at least one ok; muted otherwise. */
+.btn-fire-now-flashed {
+  color: var(--green);
+  border-color: var(--green);
+  text-shadow: 0 0 6px currentColor;
+  box-shadow: 0 0 8px -2px currentColor;
+}
+/* #474: inline edit button on each schedule row. Yellow reads as a
+   parallel destructive-adjacent action (edit changes state, but
+   isn't deletion). */
+.btn-edit-schedule { color: var(--yellow, #f9e2af); border-color: var(--yellow, #f9e2af); }
+.spawnform { display: flex; gap: 0.6em; align-items: stretch; margin: 0.5em 0; }
+.spawnform input {
+  font-family: inherit;
+  font-size: 1em;
+  background: var(--bg-elev);
+  color: var(--fg);
+  border: 1px solid var(--border);
+  padding: 0.4em 0.6em;
+  flex: 1;
+}
+.spawnform input::placeholder { color: var(--muted); }
+.spawnform input:focus { outline: 1px solid var(--purple); }
+.role-pending { color: var(--amber); border-color: var(--amber); }
+.btn-inline {
+  font-family: inherit;
+  background: transparent;
+  cursor: pointer;
+  margin-left: 0.4em;
+}
+.btn-inline:hover { background: rgba(255, 184, 77, 0.1); }
+.kind {
+  display: inline-block;
+  margin-left: 0.4em;
+  padding: 0.05em 0.5em;
+  border: 1px solid var(--purple-dim);
+  color: var(--purple-dim);
+  border-radius: 2px;
+  font-size: 0.75em;
+  letter-spacing: 0.1em;
+  text-transform: uppercase;
+}
+.kind-spawn { color: var(--amber); border-color: var(--amber); }
+.spinner {
+  display: inline-block;
+  animation: spin 1s linear infinite;
+  color: var(--amber);
+}
+@keyframes spin { from { transform: rotate(0deg); } to { transform: rotate(360deg); } }
+.talkform {
+  display: flex;
+  gap: 0.6em;
+  align-items: stretch;
+  margin-top: 0.5em;
+}
+.talkform select, .talkform input {
+  font-family: inherit;
+  font-size: 1em;
+  background: var(--bg-elev);
+  color: var(--fg);
+  border: 1px solid var(--border);
+  padding: 0.4em 0.6em;
+}
+.talkform select { color: var(--amber); }
+.talkform input { flex: 1; }
+.talkform input::placeholder { color: var(--muted); }
+.talkform input:focus, .talkform select:focus { outline: 1px solid var(--purple); }
+details { margin-top: 0.5em; }
+summary {
+  cursor: pointer;
+  color: var(--muted);
+  font-size: 0.85em;
+  text-transform: uppercase;
+  letter-spacing: 0.1em;
+}
+summary:hover { color: var(--purple); }
+.diff {
+  background: var(--bg-elev);
+  border: 1px solid var(--border);
+  padding: 0.8em;
+  margin-top: 0.4em;
+  overflow-x: auto;
+  font-size: 0.85em;
+  line-height: 1.4;
+  color: var(--muted);
+  white-space: pre;
+}
+.diff span { display: block; }
+.diff .diff-add  { color: var(--green); }
+.diff .diff-del  { color: var(--red); }
+.diff .diff-hunk { color: var(--cyan); }
+.diff .diff-file { color: var(--purple); font-weight: bold; }
+.diff .diff-ctx  { color: var(--fg); }
+.questions {
+  background: var(--bg-elev);
+  border: 1px solid var(--amber);
+  box-shadow: 0 0 12px -4px var(--amber);
+  padding: 0.6em 0.9em;
+  animation: questions-pulse 2.4s ease-in-out infinite;
+}
+@keyframes questions-pulse {
+  0%, 100% { box-shadow: 0 0 12px -4px rgba(250, 179, 135, 0.55); }
+  50%      { box-shadow: 0 0 22px -2px rgba(250, 179, 135, 0.95); }
+}
+/* Reminders list — rendered from /api/reminders, separate from the
+   main /api/state snapshot. Each row stacks identity, head meta,
+   body, and a small cancel form. */
+.reminders {
+  list-style: none;
+  padding: 0;
+  margin: 0;
+}
+.reminder-row {
+  padding: 0.4em 0;
+  border-bottom: 1px solid var(--border);
+}
+.reminder-row:last-child { border-bottom: 0; }
+.reminder-head { font-size: 0.9em; }
+.reminder-body {
+  color: var(--fg);
+  white-space: pre-wrap;
+  word-break: break-word;
+  margin: 0.3em 0;
+}
+.reminder-row.reminder-failed {
+  border-left: 2px solid var(--red, #f38ba8);
+  padding-left: 0.5em;
+}
+.reminder-error {
+  color: var(--red, #f38ba8);
+  background: rgba(243, 139, 168, 0.06);
+  border: 1px solid rgba(243, 139, 168, 0.25);
+  padding: 0.3em 0.5em;
+  font-size: 0.85em;
+  white-space: pre-wrap;
+  word-break: break-word;
+  margin: 0.2em 0;
+}
+.reminder-actions {
+  display: flex;
+  gap: 0.4em;
+  margin-top: 0.3em;
+}
+
+/* Path linkification — agents drop pointer strings into messages
+   constantly; clicking the anchor opens the file in the side panel,
+   lazy-loaded from /api/state-file. */
+.path-link {
+  color: var(--blue, #89b4fa);
+  text-decoration: underline dotted;
+  cursor: pointer;
+}
+.path-link:hover { color: var(--amber); }
+/* File-preview body — rendered inside the side panel. */
+.path-preview-body {
+  background: var(--bg);
+  border: 1px solid var(--border);
+  padding: 0.5em 0.7em;
+  margin: 0;
+  white-space: pre-wrap;
+  word-break: break-word;
+  font-size: 0.85em;
+  color: var(--fg);
+}
+
+/* Filter chip row above the questions list. The active chip lights
+   up amber to match the rest of the dashboard's selection accents. */
+.questions-filters {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.3em;
+  margin-bottom: 0.5em;
+}
+.q-filter-chip {
+  background: var(--bg);
+  color: var(--muted);
+  border: 1px solid var(--border);
+  border-radius: 999px;
+  padding: 0.15em 0.7em;
+  font: inherit;
+  font-size: 0.85em;
+  cursor: pointer;
+}
+.q-filter-chip:hover { color: var(--fg); }
+.q-filter-chip.active {
+  color: var(--amber);
+  border-color: var(--amber);
+}
+/* Peer (agent-to-agent) question rows get a left rule + dim
+   target-name styling so they read distinctly from operator-bound
+   threads at a glance. */
+.questions li.question-peer {
+  border-left: 2px solid var(--mauve, #cba6f7);
+  padding-left: 0.6em;
+}
+.questions .msg-to-peer { color: var(--mauve, #cba6f7); }
+/* The override button on peer threads picks up a non-default colour
+   so the operator notices they're answering on someone's behalf. */
+.btn-override { background: var(--mauve, #cba6f7) !important; color: var(--bg) !important; }
+.questions li.question {
+  padding: 0.4em 0;
+  border-bottom: 1px solid var(--border);
+}
+.questions li.question:last-child { border-bottom: 0; }
+.questions .q-head { font-size: 0.9em; }
+.questions .q-ttl {
+  color: var(--amber);
+  margin-left: 0.4em;
+  font-size: 0.95em;
+  letter-spacing: 0.05em;
+}
+.questions .q-body {
+  color: var(--fg);
+  margin: 0.3em 0;
+  white-space: pre-wrap;
+  word-break: break-word;
+}
+.qform {
+  display: flex;
+  flex-direction: column;
+  gap: 0.5em;
+  margin-top: 0.4em;
+}
+.qform .q-options {
+  display: flex;
+  flex-direction: column;
+  gap: 0.25em;
+  background: var(--bg);
+  border: 1px solid var(--border);
+  border-radius: 4px;
+  padding: 0.4em 0.6em;
+}
+.qform .q-option label { cursor: pointer; user-select: none; }
+.qform .q-option input { margin-right: 0.4em; accent-color: var(--amber); }
+.qform .q-free { display: flex; }
+.qform .q-free textarea {
+  flex: 1;
+  font-family: inherit;
+  font-size: 1em;
+  background: var(--bg);
+  color: var(--fg);
+  border: 1px solid var(--border);
+  padding: 0.4em 0.6em;
+  resize: vertical;
+  line-height: 1.4;
+}
+.qform .q-free textarea::placeholder { color: var(--muted); }
+.qform .q-free textarea:focus { outline: 1px solid var(--amber); }
+.qform button { align-self: flex-start; }
+.qform-cancel { margin-top: 0.3em; }
+.q-history {
+  margin-top: 0.8em;
+  border: 1px solid var(--border);
+  border-radius: 4px;
+  padding: 0.4em 0.7em;
+}
+.q-history summary { cursor: pointer; color: var(--muted); font-size: 0.9em; user-select: none; }
+.questions-answered {
+  border: none;
+  box-shadow: none;
+  animation: none;
+  padding: 0;
+  margin-top: 0.5em;
+}
+.question-answered { opacity: 0.7; }
+.question-answered .q-body { color: var(--muted); margin-bottom: 0.15em; }
+.q-answer { font-size: 0.9em; color: var(--green, #a6e3a1); padding: 0.1em 0 0.4em 0; }
+.q-answer-text { font-style: italic; }
+.inbox {
+  background: var(--bg-elev);
+  border: 1px solid var(--border);
+  padding: 0.5em 0.8em;
+  /* #450: no max-height cap — let the inbox grow to fill the
+     side-panel-body which already scrolls (`overflow: auto`). The
+     pre-#450 24em cap clamped the list well short of the available
+     panel height even on tall viewports. */
+}
+.inbox li {
+  padding: 0.25em 0;
+  border-bottom: 1px solid var(--border);
+  display: grid;
+  grid-template-columns: auto auto auto 1fr;
+  gap: 0.5em;
+  align-items: baseline;
+}
+.inbox li:last-child { border-bottom: 0; }
+.inbox .msg-ts   { color: var(--muted); font-size: 0.85em; }
+.inbox .msg-from { color: var(--amber); }
+.inbox .msg-sep  { color: var(--muted); }
+.inbox .msg-body { color: var(--fg); white-space: pre-wrap; word-break: break-word; }
+/* `#msgflow` is a shared `.live` pane inside `.terminal-wrap` (see
+   hive-fr0nt::TERMINAL_CSS). The msgrow / msg-* rules below are
+   dashboard-specific: each broker event becomes a grid of timestamp +
+   arrow + from/sep/to + body inside the `.row` shell. */
+/* Flex (not grid): the row carries the header chips (ts / arrow /
+   from / → / to / body) inline. Flex collapses whitespace-only text
+   nodes between items and gives `body` the remaining width via
+   `flex: 1`. Path references inside `body` are inline anchors that
+   open the side panel — no full-width sibling rows. */
+.live .msgrow {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: baseline;
+  gap: 0.5em;
+  padding: 0.1em 0;
+  /* Override the per-agent-terminal's hanging-indent metrics from
+     TERMINAL_CSS — the dashboard's broker rows are flex grids, not
+     glyph-prefixed text, and don't want the prefix column. */
+  text-indent: 0;
+}
+.live .msgrow .msg-body {
+  /* #485: body takes a full flex line of its own beneath the
+     metadata chips (ts / arrow / from / sep / to). Previously the
+     body sat inline with `flex: 1 1 0`, eating whatever the chips
+     left — which on a long timestamp + agent names + arrows meant
+     the body started ~30ch in and wrapped awkwardly. Pushing
+     `flex-basis: 100%` forces the body to wrap to its own line in
+     the existing `flex-wrap: wrap` row, where it can use the full
+     width down to the row's content edge.
+     `min-width: 0` still applies so `word-break: break-word`
+     actually kicks in instead of forcing the row wider than its
+     container. */
+  flex: 1 1 100%;
+  min-width: 0;
+}
+.live .msgrow.sent .msg-arrow { color: var(--cyan); }
+.live .msgrow.delivered .msg-arrow { color: var(--green); }
+/* Reply-thread rendering: indented border-left + muted reply tag. */
+.live .msgrow.msg-reply {
+  padding-left: 1.2em;
+  border-left: 2px solid var(--border);
+  margin-left: 0.6em;
+}
+.msg-reply-tag {
+  color: var(--muted);
+  font-size: 0.8em;
+  white-space: nowrap;
+  order: -1; /* prepend before other flex items */
+}
+.msg-reply-tag a {
+  color: var(--muted);
+  text-shadow: none;
+  font-weight: normal;
+}
+.msg-reply-tag a:hover { color: var(--fg); }
+/* Flash highlight when scrolled to from a reply link. */
+@keyframes msg-highlight-fade {
+  from { background: rgba(203, 166, 247, 0.18); }
+  to   { background: transparent; }
+}
+.msg-highlight { animation: msg-highlight-fade 1.5s ease-out forwards; }
+.msg-ts { color: var(--muted); font-size: 0.85em; }
+.msg-arrow { font-weight: bold; }
+.msg-from { color: var(--amber); }
+.msg-sep { color: var(--muted); }
+.msg-to { color: var(--pink); }
+.msg-body { color: var(--fg); white-space: pre-wrap; word-break: break-word; }
+/* Compose box sits inside `.terminal-wrap`, below the `.live` log. The
+   dashed separator mirrors the agent terminal's prompt divider. */
+.op-compose {
+  position: relative;
+  display: flex;
+  align-items: flex-start;
+  gap: 0.6em;
+  padding: 0.55em 0.8em;
+  border-top: 1px dashed var(--purple-dim);
+}
+.op-compose-prompt {
+  color: var(--purple);
+  text-shadow: 0 0 4px currentColor;
+  font-weight: bold;
+  white-space: nowrap;
+  user-select: none;
+  padding-top: 0.15em;
+}
+.op-compose-input {
+  flex: 1;
+  background: transparent;
+  border: none;
+  outline: none;
+  color: var(--fg);
+  font: inherit;
+  font-size: 0.85em;
+  line-height: 1.5;
+  resize: none;
+  overflow: hidden;
+  min-height: 1.5em;
+  caret-color: var(--purple);
+}
+.op-compose-input::placeholder { color: var(--muted); }
+.op-compose-suggest {
+  position: absolute;
+  bottom: 100%;
+  left: 0.8em;
+  margin-bottom: 0.2em;
+  background: rgba(24, 24, 37, 0.95);
+  border: 1px solid var(--border);
+  font-size: 0.85em;
+  min-width: 12em;
+  max-height: 12em;
+  overflow-y: auto;
+  z-index: 10;
+}
+.op-compose-suggest .item {
+  padding: 0.2em 0.8em;
+  cursor: pointer;
+  color: var(--fg);
+}
+.op-compose-suggest .item.active,
+.op-compose-suggest .item:hover {
+  background: rgba(203, 166, 247, 0.18);
+  color: var(--purple);
+}
+footer {
+  margin-top: 4em;
+  text-align: center;
+  color: var(--muted);
+  font-size: 0.9em;
+}
+footer a { color: var(--purple); }
+/* Slug banner now lives at the page footer (#389 follow-up) — give
+   it a slim top margin so it doesn't crash into the prior content,
+   and bottom margin separating from the divider/link line. */
+footer .banner-thin {
+  margin-bottom: 0.8em;
+}
+
+/* ─── side panel ─────────────────────────────────────────────────
+   Long content (file previews, diffs, journald, applied config)
+   opens in a drawer that swipes in from the right instead of
+   expanding inline. `.panel-trigger` is the inline affordance that
+   opens it. */
+.panel-trigger {
+  background: none;
+  border: none;
+  color: var(--muted);
+  font-family: inherit;
+  font-size: 0.85em;
+  letter-spacing: 0.05em;
+  cursor: pointer;
+  padding: 0;
+  margin-top: 0.5em;
+  display: inline-block;
+  text-align: left;
+  text-decoration: none;
+}
+.panel-trigger:hover { color: var(--cyan); }
+
+.side-panel {
+  position: fixed;
+  inset: 0;
+  z-index: 50;
+  /* Closed: the wrapper ignores pointer events so the dashboard
+     underneath stays interactive; `.open` flips it back on. */
+  pointer-events: none;
+}
+.side-panel-backdrop {
+  position: absolute;
+  inset: 0;
+  background: rgba(0, 0, 0, 0.55);
+  opacity: 0;
+  transition: opacity 0.2s ease;
+}
+.side-panel-drawer {
+  position: absolute;
+  top: 0;
+  right: 0;
+  bottom: 0;
+  /* #451: width is a CSS variable so the drag handle (added by
+     Panel.bind) can update it live, and so localStorage-persisted
+     widths apply on first paint. Default min(760px, 94vw) preserves
+     the pre-#451 behaviour for operators who never drag. JS sets
+     `--side-panel-w` via inline style on the drawer; persistence
+     lives in localStorage (key `hyperhive:side-panel-width`),
+     replayed onto the var by `Panel.applyStoredWidth` at bind. */
+  width: var(--side-panel-w, min(760px, 94vw));
+  /* Clamp so a stored width can never push the drawer off-screen
+     or shrink it past readability. min content width matches the
+     panel-head's natural width with the close button visible. */
+  min-width: 320px;
+  max-width: 96vw;
+  display: flex;
+  flex-direction: column;
+  background: var(--bg-elev);
+  border-left: 2px solid var(--purple);
+  box-shadow: -10px 0 30px rgba(0, 0, 0, 0.45);
+  transform: translateX(100%);
+  transition: transform 0.25s ease;
+}
+.side-panel.open { pointer-events: auto; }
+.side-panel.open .side-panel-backdrop { opacity: 1; }
+.side-panel.open .side-panel-drawer { transform: translateX(0); }
+/* #451: drag-to-resize handle on the drawer's left edge. The handle
+   itself is invisible until hover/drag so it doesn't compete with the
+   2px mauve `border-left` for the visual boundary. Pointer-cursor
+   tells the operator the edge is grabbable; the brighter glow during
+   drag (`body.side-panel-resizing`) is the affordance the eye
+   tracks. */
+.side-panel-resize {
+  position: absolute;
+  top: 0;
+  left: 0;
+  bottom: 0;
+  width: 6px;
+  margin-left: -3px;
+  cursor: ew-resize;
+  z-index: 1;
+  background: transparent;
+  transition: background 120ms ease;
+}
+.side-panel-resize:hover,
+body.side-panel-resizing .side-panel-resize {
+  background: rgba(203, 166, 247, 0.55);
+}
+/* While dragging: kill text selection + force the resize cursor
+   page-wide so the cursor doesn't flip back to default the moment it
+   leaves the 6px handle band. */
+body.side-panel-resizing {
+  cursor: ew-resize !important;
+  user-select: none;
+}
+body.side-panel-resizing * { cursor: ew-resize !important; }
+.side-panel-head {
+  flex: 0 0 auto;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 1em;
+  padding: 0.7em 1em;
+  border-bottom: 1px solid var(--border);
+}
+.side-panel-title {
+  color: var(--purple);
+  font-weight: bold;
+  letter-spacing: 0.05em;
+  word-break: break-all;
+}
+.side-panel-close {
+  flex: 0 0 auto;
+  background: var(--bg);
+  color: var(--fg);
+  border: 1px solid var(--border);
+  font-family: inherit;
+  font-size: 1em;
+  line-height: 1;
+  padding: 0.25em 0.55em;
+  cursor: pointer;
+}
+.side-panel-close:hover { border-color: var(--red); color: var(--red); }
+.side-panel-body {
+  flex: 1 1 auto;
+  overflow: auto;
+  padding: 1em;
+}
+/* Markdown file previews rendered by `marked`. TERMINAL_CSS scopes
+   its own `.md` rules to `.live .row`, so the panel needs its own. */
+.side-panel-body .md { color: var(--fg); line-height: 1.5; }
+.side-panel-body .md > :first-child { margin-top: 0; }
+.side-panel-body .md > :last-child { margin-bottom: 0; }
+.side-panel-body .md p { margin: 0.5em 0; }
+.side-panel-body .md h1,
+.side-panel-body .md h2,
+.side-panel-body .md h3,
+.side-panel-body .md h4 { color: var(--purple); margin: 0.9em 0 0.4em; }
+.side-panel-body .md code {
+  background: var(--bg);
+  border: 1px solid var(--border);
+  border-radius: 3px;
+  padding: 0.05em 0.3em;
+  font-size: 0.9em;
+}
+.side-panel-body .md pre {
+  background: var(--bg);
+  border: 1px solid var(--border);
+  border-radius: 3px;
+  padding: 0.6em 0.8em;
+  overflow-x: auto;
+}
+.side-panel-body .md pre code { background: none; border: none; padding: 0; }
+.side-panel-body .md a { color: var(--cyan); }
+.side-panel-body .md ul,
+.side-panel-body .md ol { margin: 0.4em 0; padding-left: 1.5em; }
+.side-panel-body .md blockquote {
+  margin: 0.5em 0;
+  padding-left: 0.8em;
+  border-left: 2px solid var(--border);
+  color: var(--muted);
+}
+.side-panel-body .md table { border-collapse: collapse; margin: 0.5em 0; }
+.side-panel-body .md th,
+.side-panel-body .md td {
+  border: 1px solid var(--border);
+  padding: 0.2em 0.5em;
+}
+
+/* ─── /flow.html — full-page chat (#369) ───────────────────────────
+   The all-agents chat surface lives on its own page so it can claim
+   full-viewport vibec0re styling (operator @ #369#issuecomment-3437).
+   Same shape as the per-agent live page (#362): frosted-glass header
+   at top, frosted composer docked at bottom, terminal scrolls
+   behind both. Operator inbox lives behind a header pill that opens
+   the side-panel flyout — preserves the "inbox + chat in one view"
+   ergonomics without stealing terminal real estate. */
+
+:root {
+  /* Approximate height of the flow chrome (tabbar + dashboard-chrome
+     padding). The banner-thin slug used to live in the chrome and
+     padded this up to 4.7em; with the slug moved out (#389 follow-up:
+     slug lives at the page footer on /, simply omitted on /flow.html
+     since there's no normal-flow footer position in the full-viewport
+     terminal), the chrome is just tabs now and shrinks accordingly. */
+  --flow-header-h: 3.6em;
+  --flow-composer-h: 3.6em;
+  --flow-frost-bg: rgba(30, 30, 46, 0.74);
+  --flow-frost-blur: blur(12px) saturate(140%);
+}
+
+body.flow-shell {
+  /* Override the dashboard's centred-max-width layout — flow owns
+     the whole viewport. */
+  max-width: none;
+  margin: 0;
+  padding: 0;
+  height: 100vh;
+  overflow: hidden;
+  background:
+    radial-gradient(ellipse 80% 60% at 50% 0%,
+                    rgba(203, 166, 247, 0.06) 0%,
+                    transparent 60%),
+    var(--bg);
+}
+
+/* Flow chrome (#383): reuses the dashboard's `.dashboard-chrome` +
+   tabbar so the operator can switch tabs from the flow page without
+   navigating back first. The chrome must be fixed-position (vs
+   sticky on the dashboard) since flow-shell has `overflow: hidden`
+   on body and the main area absolute-positions the terminal. */
+body.flow-shell .dashboard-chrome.flow-chrome {
+  position: fixed;
+  top: 0;
+  left: 0;
+  right: 0;
+  z-index: 30;
+  margin: 0;
+  padding: 0.4em 0 0;
+  background: var(--flow-frost-bg);
+  -webkit-backdrop-filter: var(--flow-frost-blur);
+  backdrop-filter: var(--flow-frost-blur);
+  border-bottom: 1px solid var(--purple-dim);
+  box-shadow: 0 6px 18px rgba(0, 0, 0, 0.35);
+}
+/* Active tab on the flow page is FL0W. Its `.tab-link` styling (the
+   tab strip's right-most entry on the dashboard, where it represents
+   the *link out* to /flow.html) needs to read as the active tab here.
+   `aria-current="page"` flags it semantically. */
+body.flow-shell .tabbar .tab.active.tab-link {
+  color: var(--purple);
+  background: var(--bg);
+  border-color: var(--purple-dim);
+  box-shadow: 0 -2px 12px -4px rgba(203, 166, 247, 0.4);
+}
+/* Legacy `.flow-title` / `.flow-hint` / `.flow-back` rules were
+   removed in #383 — the flow page now uses the shared chrome with
+   the dashboard tab strip, no need for FL0W-specific title/hint
+   elements. The `.notif-row` styling lives under the shared
+   `.tabbar #notif-row` selector earlier in the file. */
+
+/* Inbox pill — operator inbox flyout trigger. Sits right under the
+   header so it stays in the operator's gaze without crowding the
+   chat. Same shape as the agent page's pills (#362). */
+.flow-pill {
+  position: fixed;
+  top: calc(var(--flow-header-h) + 0.8em);
+  right: 1em;
+  z-index: 25;
+  background: var(--bg-elev);
+  border: 1px solid var(--purple-dim);
+  color: var(--fg);
+  font-family: inherit;
+  font-size: 0.85em;
+  letter-spacing: 0.04em;
+  border-radius: 999px;
+  padding: 0.3em 0.8em;
+  display: inline-flex;
+  align-items: center;
+  gap: 0.5em;
+  cursor: pointer;
+  box-shadow: 0 4px 14px rgba(0, 0, 0, 0.35);
+  transition: border-color 0.15s ease, box-shadow 0.15s ease, color 0.15s ease;
+}
+.flow-pill:hover {
+  border-color: var(--purple);
+  color: var(--purple);
+  box-shadow: 0 0 12px -2px var(--purple);
+}
+.flow-pill-icon { font-size: 1.05em; line-height: 1; }
+.flow-pill-label { color: var(--muted); }
+.flow-pill-count {
+  background: rgba(250, 179, 135, 0.18);
+  color: var(--amber);
+  border-radius: 999px;
+  padding: 0 0.5em;
+  min-width: 1.6em;
+  text-align: center;
+  font-weight: bold;
+  font-variant-numeric: tabular-nums;
+}
+
+.flow-main {
+  position: absolute;
+  top: 0;
+  left: 0;
+  right: 0;
+  bottom: 0;
+  overflow: hidden;
+}
+.flow-main .terminal-wrap {
+  position: absolute;
+  inset: 0;
+  border: 0;
+  background: transparent;
+  box-shadow: none;
+  border-radius: 0;
+  margin: 0;
+  padding: 0;
+}
+.flow-main .live {
+  position: absolute;
+  inset: 0;
+  height: auto;
+  max-height: none;
+  padding-top: calc(var(--flow-header-h) + 0.8em);
+  padding-bottom: calc(var(--flow-composer-h) + 0.8em);
+  scroll-padding-top: calc(var(--flow-header-h) + 0.8em);
+  scroll-padding-bottom: calc(var(--flow-composer-h) + 0.8em);
+  overflow: auto;
+}
+/* Tail pill (↓ N new): bottom offset clears the floating composer.
+   z-index escapes the stacking context the .terminal-wrap's
+   backdrop-filter creates (issue #375) — tabs.js anchors the pill
+   on .flow-main now (not .terminal-wrap), so this z-index reaches
+   the root stacking context and properly floats above the
+   composer at z-index 30. */
+.flow-main .tail-pill {
+  bottom: calc(var(--flow-composer-h) + 0.6em);
+  z-index: 35;
+}
+
+.flow-composer {
+  position: fixed;
+  bottom: 0;
+  left: 0;
+  right: 0;
+  z-index: 30;
+  min-height: var(--flow-composer-h);
+  background: var(--flow-frost-bg);
+  -webkit-backdrop-filter: var(--flow-frost-blur);
+  backdrop-filter: var(--flow-frost-blur);
+  border-top: 1px solid var(--purple-dim);
+  box-shadow: 0 -6px 18px rgba(0, 0, 0, 0.35);
+  padding: 0.4em 1em;
+}
+
+/* Hidden inbox section on the flow page — the renderInbox path
+   wants `#inbox-section` in the DOM (legacy contract), but we
+   surface the messages via the pill/flyout instead. */
+.flow-inbox-headless { display: none !important; }
+
+/* ─── scheduled prompts tab (#459) ─────────────────────────────────────
+   Creation form at the top, list of queued schedule cards below.
+   Cards show: id + source + due-in + cancel-all in the header,
+   the prompt body, then a targets table with per-row cancel. */
+
+.schedule-new-form,
+.schedule-edit-form {
+  display: flex;
+  flex-direction: column;
+  gap: 0.6em;
+  background: var(--bg-elev);
+  border: 1px solid var(--border);
+  border-radius: 4px;
+  padding: 0.8em 1em;
+  margin-bottom: 0.5em;
+}
+/* #474 — inline edit form opens directly under the schedule row's
+   actions strip, indented slightly so it visually nests under the
+   row it edits. */
+.schedule-edit-form-wrapper {
+  margin-top: 0.5em;
+  padding-left: 0.5em;
+  border-left: 2px solid var(--yellow, #f9e2af);
+}
+.schedule-edit-targets-note {
+  color: var(--muted);
+  font-style: italic;
+  font-size: 0.85em;
+  margin: 0.2em 0 0 0;
+}
+.schedule-field {
+  display: flex;
+  flex-direction: column;
+  gap: 0.2em;
+}
+.schedule-field-label {
+  color: var(--muted);
+  font-size: 0.85em;
+  letter-spacing: 0.05em;
+  text-transform: uppercase;
+}
+.schedule-field input,
+.schedule-field textarea {
+  font-family: inherit;
+  font-size: inherit;
+  background: var(--bg);
+  color: var(--fg);
+  border: 1px solid var(--border);
+  border-radius: 3px;
+  padding: 0.35em 0.5em;
+}
+.schedule-field textarea { resize: vertical; min-height: 4em; }
+.schedule-targets {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.4em;
+}
+.schedule-target-chip {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.4em;
+  padding: 0.2em 0.6em;
+  border: 1px solid var(--border);
+  border-radius: 999px;
+  font-size: 0.85em;
+  cursor: pointer;
+  background: rgba(24, 24, 37, 0.4);
+}
+.schedule-target-chip:hover { border-color: var(--purple-dim); }
+.schedule-target-chip:has(input:checked) {
+  border-color: var(--purple);
+  color: var(--purple);
+  background: rgba(203, 166, 247, 0.08);
+}
+.schedule-target-chip input { margin: 0; }
+.schedule-actions {
+  display: flex;
+  gap: 0.5em;
+  justify-content: flex-end;
+}
+
+/* Interval composer (#466). Preset chip row + d/h/m/s inputs + live
+   preview, so the operator never has to multiply seconds by hand. */
+.schedule-interval-presets {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.3em;
+  margin-top: 0.1em;
+}
+.btn-interval-preset {
+  color: var(--cyan);
+  border-color: var(--cyan);
+  font-size: 0.75em;
+  padding: 0.15em 0.55em;
+  letter-spacing: 0.05em;
+}
+.btn-interval-oneshot {
+  color: var(--muted);
+  border-color: var(--muted);
+}
+.schedule-interval-parts {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 0.35em;
+  margin-top: 0.4em;
+}
+.schedule-interval-num {
+  width: 4em;
+  text-align: right;
+  font-variant-numeric: tabular-nums;
+}
+.schedule-interval-unit {
+  color: var(--muted);
+  font-size: 0.85em;
+  margin-right: 0.2em;
+}
+.schedule-interval-preview {
+  margin-top: 0.4em;
+  color: var(--cyan);
+  font-size: 0.9em;
+  font-variant-numeric: tabular-nums;
+}
+.schedule-interval-preview-oneshot { color: var(--muted); font-style: italic; }
+
+.schedules {
+  display: flex;
+  flex-direction: column;
+  gap: 0.5em;
+}
+.schedule-row {
+  padding: 0.6em 0.9em;
+  background: rgba(24, 24, 37, 0.55);
+  border: 1px solid var(--border);
+  border-radius: 4px;
+  display: flex;
+  flex-direction: column;
+  gap: 0.4em;
+}
+.schedule-row.schedule-cancelled { opacity: 0.55; }
+.schedule-head {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 0.4em;
+}
+.schedule-description {
+  color: var(--muted);
+  font-style: italic;
+  font-size: 0.95em;
+}
+.schedule-body {
+  white-space: pre-wrap;
+  word-break: break-word;
+  background: var(--bg);
+  border: 1px solid var(--border);
+  border-radius: 3px;
+  padding: 0.5em 0.7em;
+}
+.schedule-targets-table {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: 0.9em;
+}
+.schedule-targets-table th,
+.schedule-targets-table td {
+  padding: 0.25em 0.6em;
+  text-align: left;
+  border-bottom: 1px solid var(--border);
+}
+.schedule-targets-table th {
+  color: var(--muted);
+  font-weight: normal;
+  text-transform: uppercase;
+  letter-spacing: 0.05em;
+  font-size: 0.8em;
+}
+.schedule-targets-table tr:last-child td { border-bottom: 0; }
+.schedule-target-cancelled td { opacity: 0.5; }
+.btn-inline-small {
+  font-size: 0.7em;
+  padding: 0.1em 0.45em;
+}
+
+/* Selection bar (#443). Sticky-bottom strip that surfaces bulk
+   actions when ≥1 agent is selected (click the icon). Visually
+   echoes the flow composer's frosted-mauve treatment so the chrome
+   reads as part of the same vibecore family. Hidden when empty —
+   leaves the page footer's normal-flow position untouched. */
+.selection-bar {
+  position: fixed;
+  bottom: 0;
+  left: 0;
+  right: 0;
+  z-index: 40;
+  display: flex;
+  align-items: center;
+  flex-wrap: wrap;
+  gap: 0.6em;
+  padding: 0.55em 1em;
+  background: var(--flow-frost-bg);
+  -webkit-backdrop-filter: var(--flow-frost-blur);
+  backdrop-filter: var(--flow-frost-blur);
+  border-top: 1px solid var(--purple);
+  box-shadow: 0 -6px 18px rgba(0, 0, 0, 0.4);
+}
+.selection-bar[hidden] { display: none; }
+.selection-count {
+  color: var(--purple);
+  font-weight: bold;
+  letter-spacing: 0.05em;
+}
+.selection-names {
+  color: var(--muted);
+  font-size: 0.85em;
+  flex: 1 1 auto;
+  min-width: 0;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+.selection-actions {
+  display: inline-flex;
+  flex-wrap: wrap;
+  gap: 0.4em;
+  align-items: center;
+}
+.selection-actions .btn {
+  font-size: 0.75em;
+  padding: 0.2em 0.7em;
+}
+.selection-clear {
+  color: var(--muted);
+  border-color: var(--purple-dim);
+  font-size: 0.75em;
+  padding: 0.2em 0.7em;
+}
+/* Pad the dashboard body so the sticky bar doesn't cover the
+   bottom of the agent list. ~3.4em covers the bar's vertical
+   footprint with breathing room; only applies when the bar is
+   visible (`body.has-selection`, toggled by tabs.js when the
+   selection set is non-empty). */
+body.dashboard-shell.has-selection { padding-bottom: 4.5em; }
diff --git a/frontend/packages/dashboard/src/flow.html b/frontend/packages/dashboard/src/flow.html
new file mode 100644
index 00000000..2b48915e
--- /dev/null
+++ b/frontend/packages/dashboard/src/flow.html
@@ -0,0 +1,120 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <title>hyperhive // FL0W</title>
+  <link rel="icon" type="image/svg+xml" href="/favicon.svg">
+  <link rel="stylesheet" href="/static/dashboard.css">
+</head>
+<body class="flow-shell">
+
+  <!-- Fixed-overlay chrome — just the tab strip (#389 follow-up:
+       slug moved to the dashboard's page footer; the flow page is a
+       full-viewport terminal with no normal-flow footer position, so
+       the slug simply doesn't appear here). The operator can still
+       switch tabs from the flow page without navigating back; FL0W is
+       the current page, SW4RM / Y3R C4LL / SYST3M cross-link to the
+       dashboard with the matching hash. -->
+  <header class="dashboard-chrome flow-chrome" id="flow-header">
+    <nav class="tabbar" id="tabbar" role="tablist">
+      <a class="tab" href="/#swarm" role="tab" data-tab="swarm">
+        <span class="tab-label">◆ SW4RM ◆</span>
+        <span class="tab-count" id="tab-count-swarm" hidden></span>
+      </a>
+      <a class="tab" href="/#call" role="tab" data-tab="call">
+        <span class="tab-label">◆ Y3R C4LL ◆</span>
+        <span class="tab-count tab-count-attn" id="tab-count-call" hidden></span>
+      </a>
+      <a class="tab" href="/#system" role="tab" data-tab="system">
+        <span class="tab-label">◆ SYST3M ◆</span>
+        <span class="tab-count" id="tab-count-system" hidden></span>
+      </a>
+      <a class="tab" href="/#schedules" role="tab" data-tab="schedules">
+        <span class="tab-label">◆ SCH3DUL3S ◆</span>
+        <span class="tab-count" id="tab-count-schedules" hidden></span>
+      </a>
+      <a class="tab tab-link active" id="tab-flow" href="/flow.html"
+         aria-current="page"
+         title="all-agents chat — you are here">
+        <span class="tab-label">◆ FL0W ◆</span>
+        <span class="tab-count" id="tab-count-flow" hidden></span>
+      </a>
+
+      <!-- Notif controls cohabit with the tabs (always-on chrome).
+           Same IDs as on the dashboard so the shared NOTIF binding
+           (from common.js, imported by both tabs.js and flow.js)
+           picks them up unchanged. -->
+      <div id="notif-row" class="notif-row">
+        <button type="button" id="notif-enable" class="btn btn-notif" hidden>🔔 enable notifications</button>
+        <button type="button" id="notif-mute"   class="btn btn-notif" hidden>🔕 mute</button>
+        <button type="button" id="notif-unmute" class="btn btn-notif" hidden>🔔 unmute</button>
+        <span id="notif-status" class="meta" hidden></span>
+      </div>
+    </nav>
+  </header>
+
+  <!-- Operator inbox flyout trigger — count + click → side panel
+       (singleton, declared below). Hidden until the inbox is non-
+       empty. Mirrors the agent page's pill pattern (#362). -->
+  <button type="button" id="inbox-pill" class="flow-pill" hidden
+          title="open operator inbox">
+    <span class="flow-pill-icon" aria-hidden="true">📬</span>
+    <span class="flow-pill-label">inbox</span>
+    <span class="flow-pill-count" id="inbox-pill-count">0</span>
+  </button>
+
+  <!-- Main content: the full-viewport terminal. Padded for the
+       overlay header + composer so the first/last rows stay
+       reachable. -->
+  <main class="flow-main">
+    <div class="terminal-wrap">
+      <div id="msgflow" class="live terminal"><div class="meta">connecting…</div></div>
+    </div>
+  </main>
+
+  <!-- Fixed-overlay composer at the bottom. Same frosted treatment
+       as the header — symmetric framing, terminal goes edge-to-edge
+       between them. -->
+  <footer class="flow-composer">
+    <div id="op-compose" class="op-compose">
+      <span id="op-compose-prompt" class="op-compose-prompt">@—&gt;</span>
+      <textarea id="op-compose-input" class="op-compose-input"
+                placeholder="@agent message…  (enter sends, shift+enter newline, tab completes @-mention)"
+                rows="1" autocomplete="off"></textarea>
+      <div id="op-compose-suggest" class="op-compose-suggest" hidden></div>
+    </div>
+  </footer>
+
+  <!-- Inbox rendered offscreen — kept in the DOM so flow.js's
+       renderInbox keeps working unchanged. The pill click handler
+       opens the side panel which displays a clone of the list. The
+       legacy section heading would otherwise be visible; hidden
+       here. -->
+  <div id="inbox-section" class="flow-inbox-headless" hidden>
+    <p class="meta">loading…</p>
+  </div>
+
+  <!-- Slide-in side panel. Singleton — JS swaps the title + body
+       and toggles `.open`. On this page only used to surface the
+       operator inbox flyout; the dashboard's other panel uses
+       (approval diffs, file previews, logs) don't apply here. -->
+  <div id="side-panel" class="side-panel" aria-hidden="true">
+    <div class="side-panel-backdrop" id="side-panel-backdrop"></div>
+    <aside class="side-panel-drawer" role="dialog" aria-modal="true"
+           aria-labelledby="side-panel-title">
+      <header class="side-panel-head">
+        <span class="side-panel-title" id="side-panel-title"></span>
+        <button type="button" class="side-panel-close" id="side-panel-close"
+                title="close (esc)">✕</button>
+      </header>
+      <div class="side-panel-body" id="side-panel-body"></div>
+    </aside>
+  </div>
+
+  <!-- Flow-specific bundle (#406 step 2). Contains the broker
+       terminal init, the operator-inbox derived store, the inbox
+       pill flyout, and the @-mention composer. Tab renderers etc.
+       live in `/static/tabs.js` which /flow.html doesn't load. -->
+  <script type="module" src="/static/flow.js" defer></script>
+</body>
+</html>
diff --git a/frontend/packages/dashboard/src/flow.js b/frontend/packages/dashboard/src/flow.js
new file mode 100644
index 00000000..d4b1c9eb
--- /dev/null
+++ b/frontend/packages/dashboard/src/flow.js
@@ -0,0 +1,440 @@
+// /flow.html entry point (#406 step 2 — flow-specific split from the
+// previous combined entry; #406 step 3 renamed that combined entry
+// from `app.js` to `tabs.js`).
+//
+// Owns the full-page broker terminal, the operator-inbox derived store
+// (populated from the broker stream), the inbox pill flyout, and the
+// @-mention compose box. Pulls shared infrastructure (DOM helpers, side
+// panel, OS notifications, path linkification) from `./common.js`.
+//
+// Does NOT contain the dashboard's tab renderers, mutation-event
+// dispatchers, or refreshState — that's `./tabs.js`, loaded only by
+// /index.html. The flow page runs purely on the broker stream + an
+// initial /api/state fetch (compose autocomplete needs the live
+// container list).
+
+import { create as termCreate } from '@hive/shared/terminal.js';
+import {
+  $, el,
+  Panel, NOTIF,
+  appendLinkified,
+  openStream,
+} from './common.js';
+
+(() => {
+  Panel.bind();
+  NOTIF.bind();
+
+  // ─── operator inbox (derived from the broker message stream) ───────────
+  // No longer shipped on `/api/state.operator_inbox`. The broker
+  // terminal feeds this via `onAnyEvent` — backfill from
+  // `/dashboard/history` populates on load, live SSE keeps it current.
+  // Newest-first to match the previous behaviour.
+  const INBOX_LIMIT = 50;
+  const operatorInbox = [];
+  function inboxAppendFromEvent(ev) {
+    if (ev.kind !== 'sent' || ev.to !== 'operator') return false;
+    operatorInbox.unshift({
+      from: ev.from,
+      body: ev.body,
+      at: ev.at,
+      file_refs: ev.file_refs || [],
+    });
+    if (operatorInbox.length > INBOX_LIMIT) operatorInbox.length = INBOX_LIMIT;
+    return true;
+  }
+  function buildInboxListNode() {
+    if (!operatorInbox.length) return el('p', { class: 'empty' }, 'no messages');
+    const fmt = (n) => new Date(n * 1000).toISOString().replace('T', ' ').slice(0, 19);
+    const ul = el('ul', { class: 'inbox' });
+    for (const m of operatorInbox) {
+      const li = el('li');
+      const body = el('span', { class: 'msg-body' });
+      appendLinkified(body, m.body, m.file_refs);
+      li.append(
+        el('span', { class: 'msg-ts' }, fmt(m.at)), ' ',
+        el('span', { class: 'msg-from' }, m.from), ' ',
+        el('span', { class: 'msg-sep' }, '→ '),
+        body,
+      );
+      ul.append(li);
+    }
+    return ul;
+  }
+  function renderInbox() {
+    // Flow page surfaces inbox as a pill that opens the side-panel
+    // flyout. Pill is hidden when empty; click handler below opens
+    // the panel with the freshest list. If the panel is already
+    // showing the inbox view, refresh its body in place so live
+    // messages land without a re-open.
+    const pill = $('inbox-pill');
+    const pillCount = $('inbox-pill-count');
+    if (pillCount) pillCount.textContent = String(operatorInbox.length);
+    if (pill) pill.hidden = operatorInbox.length === 0;
+    Panel.refresh('inbox', 'inbox · ' + operatorInbox.length, buildInboxListNode());
+  }
+
+  // Wire the inbox pill to open the side-panel flyout with the
+  // operator inbox.
+  const inboxPill = $('inbox-pill');
+  if (inboxPill) {
+    inboxPill.addEventListener('click', () => {
+      Panel.openNamed('inbox', 'inbox · ' + operatorInbox.length,
+        buildInboxListNode());
+    });
+  }
+
+  // ─── local containers cache (for compose autocomplete) ──────────────────
+  // The compose box's @-mention completion suggests known agent names.
+  // /index.html (tabs.js) maintains the canonical `containersState`
+  // from /api/state + SSE; here we keep a small local mirror updated
+  // by the same `container_state_changed` / `container_removed` events
+  // the dashboard would handle.
+  const flowContainers = new Map();
+  fetch('/api/state').then((r) => r.ok ? r.json() : null).then((s) => {
+    if (!s || !Array.isArray(s.containers)) return;
+    for (const c of s.containers) flowContainers.set(c.name, c);
+  }).catch(() => { /* graceful: compose just shows `*` and nothing else */ });
+
+  // ─── message flow: shared terminal pane ────────────────────────────────
+  // Scroll, pill, backfill + SSE plumbing live in @hive/shared/terminal.
+  // What stays here is the broker-message renderer + the page-local
+  // side effects (banner pulse, inbox refresh on operator-bound
+  // traffic, OS notifications).
+  (() => {
+    const flow = $('msgflow');
+    if (!flow) return;
+    flow.innerHTML = '';
+    const tsFmt = (n) => new Date(n * 1000).toISOString().slice(11, 19);
+    // Pulse the page banner whenever a broker event lands. (Note:
+    // post-#389 the `.banner` lives in the dashboard's <footer>, not
+    // in the flow page chrome — `pulseBanner` no-ops on /flow.html
+    // since there's no element to find. Kept for parity if a future
+    // chrome change reintroduces a banner.)
+    const banner = document.querySelector('.banner');
+    let bannerOffTimer = null;
+    function pulseBanner() {
+      if (!banner) return;
+      banner.classList.add('active');
+      if (bannerOffTimer) clearTimeout(bannerOffTimer);
+      bannerOffTimer = setTimeout(() => banner.classList.remove('active'), 4000);
+    }
+    // Map of broker row id → rendered row element. Lets reply rows add
+    // a visual "↳ in reply to" indicator that links back to the parent.
+    // Bounded by the history window (~200 msgs from /dashboard/history),
+    // well within normal memory.
+    const msgRowMap = new Map();
+
+    function renderMsg(ev, api, glyph) {
+      const isReply = ev.in_reply_to != null;
+      const cls = 'msgrow ' + ev.kind + (isReply ? ' msg-reply' : '');
+      const row = api.row(cls, '');
+      // Build via DOM so path anchors stay live + escape rules are
+      // automatic (text nodes don't need esc()).
+      const ts = document.createElement('span');
+      ts.className = 'msg-ts'; ts.textContent = tsFmt(ev.at);
+      const arrow = document.createElement('span');
+      arrow.className = 'msg-arrow'; arrow.textContent = glyph;
+      const from = document.createElement('span');
+      from.className = 'msg-from'; from.textContent = ev.from;
+      const sep = document.createElement('span');
+      sep.className = 'msg-sep'; sep.textContent = '→';
+      const to = document.createElement('span');
+      to.className = 'msg-to'; to.textContent = ev.to;
+      const body = document.createElement('span');
+      body.className = 'msg-body';
+      appendLinkified(body, ev.body, ev.file_refs);
+      // Reply thread indicator: a small "↳ reply to <from>" hint that
+      // shows which message this is responding to. If we have the parent
+      // in our row map, clicking scrolls it into view.
+      if (isReply) {
+        const replyTag = document.createElement('span');
+        replyTag.className = 'msg-reply-tag';
+        const parentRow = msgRowMap.get(ev.in_reply_to);
+        if (parentRow) {
+          const link = document.createElement('a');
+          link.href = '#';
+          link.textContent = '↳ reply';
+          link.title = 'scroll to parent message';
+          link.addEventListener('click', (e) => {
+            e.preventDefault();
+            parentRow.scrollIntoView({ behavior: 'smooth', block: 'nearest' });
+            parentRow.classList.add('msg-highlight');
+            setTimeout(() => parentRow.classList.remove('msg-highlight'), 1500);
+          });
+          replyTag.append(link);
+        } else {
+          replyTag.textContent = '↳ reply';
+        }
+        row.prepend(replyTag);
+        row.append(ts, ' ', arrow, ' ', from, ' ', sep, ' ', to, ' ', body);
+      } else {
+        row.append(ts, ' ', arrow, ' ', from, ' ', sep, ' ', to, ' ', body);
+      }
+      // Register this row so future replies can reference it.
+      if (ev.id != null && ev.id > 0) msgRowMap.set(ev.id, row);
+    }
+    // Anchor the `↓ N new` pill in `.flow-main` (NOT the default
+    // `log.parentElement` = `.terminal-wrap`). `.terminal-wrap`
+    // applies `backdrop-filter`, which creates a CSS stacking
+    // context — the pill's z-index would otherwise be trapped
+    // inside and clipped under the fixed composer (issue #375).
+    // `.flow-main` has no backdrop-filter / stacking-context
+    // creators, so the pill's z-index reaches the root and floats
+    // above the composer.
+    const flowMain = document.querySelector('.flow-main');
+    termCreate({
+      logEl: flow,
+      pillAnchor: flowMain,
+      historyUrl: '/dashboard/history',
+      // #408: server-side filter — only the kinds this page actually
+      // renders or routes (sent/delivered → broker terminal,
+      // container_state_changed/_removed → local autocomplete cache).
+      // Backend (#499) pre-parses the allow-list at subscribe time so
+      // the per-frame hot path is one HashSet::contains and the
+      // JSON-serialise is skipped entirely on irrelevant kinds. The
+      // dashboard tabs page (tabs.js) keeps the unfiltered subscribe
+      // since it routes every mutation kind into its derived stores.
+      streamUrl: '/dashboard/stream?kinds=sent,delivered,container_state_changed,container_removed',
+      // #448: route through the SharedWorker so this page's SSE shares
+      // a single backend connection with /index.html (and any other
+      // open hyperhive tab). Worker keys on the full URL (incl.
+      // query string), so the filtered subscribe is its own upstream
+      // — won't accidentally share with tabs.js's wider subscribe.
+      streamFactory: openStream,
+      renderers: {
+        sent:      (ev, api) => renderMsg(ev, api, '→'),
+        delivered: (ev, api) => renderMsg(ev, api, '✓'),
+        // Maintain the local containers cache from the same stream
+        // (compose autocomplete reads from `flowContainers`). The
+        // dashboard's tab renderers aren't on this page, so we don't
+        // need to dispatch to applyContainerStateChanged etc. — just
+        // keep the autocomplete list current.
+        container_state_changed: (ev) => {
+          if (ev.container && ev.container.name) {
+            flowContainers.set(ev.container.name, ev.container);
+          }
+        },
+        container_removed: (ev) => { flowContainers.delete(ev.name); },
+        // Drop every other mutation kind silently — without this
+        // they'd fall through to the terminal module's default
+        // renderer and clutter the log with JSON dumps. The dashboard
+        // tabs handle these on /index.html via tabs.js.
+        _default: () => {},
+      },
+      // Both history backfill and live frames flow through here, so the
+      // inbox section ends up populated correctly on first paint and
+      // updated thereafter — no /api/state refetch needed for inbox
+      // freshness.
+      onAnyEvent: (ev /* , { fromHistory } */) => {
+        if (inboxAppendFromEvent(ev)) renderInbox();
+      },
+      // Re-sync the local containers cache on every SSE (re)connect.
+      // Live mutation events that fired during a disconnect window
+      // are never replayed, so without this the compose autocomplete
+      // could drift stale (issue #163). We don't try to recover
+      // missed broker rows here — operator inbox briefly stales on
+      // reconnect; HiveTerminal's history-replay covers the next
+      // page load.
+      onStreamOpen: () => {
+        fetch('/api/state').then((r) => r.ok ? r.json() : null).then((s) => {
+          if (!s || !Array.isArray(s.containers)) return;
+          flowContainers.clear();
+          for (const c of s.containers) flowContainers.set(c.name, c);
+        }).catch(() => {});
+      },
+      onLiveEvent: (ev) => {
+        pulseBanner();
+        if (ev.kind === 'sent' && ev.to === 'operator') {
+          NOTIF.show(
+            '◆ ' + ev.from + ' → operator',
+            String(ev.body || '').slice(0, 200),
+            // Unique-per-arrival tag so a burst stacks instead of
+            // overwriting itself in the OS notification center.
+            'hyperhive:msg:' + ev.at + ':' + Math.random().toString(36).slice(2, 6),
+          );
+        }
+      },
+    });
+  })();
+
+  // ─── compose: @-mention with sticky recipient ───────────────────────────
+  (() => {
+    const input = $('op-compose-input');
+    const prompt = $('op-compose-prompt');
+    const suggest = $('op-compose-suggest');
+    if (!input || !prompt || !suggest) return;
+    const STORAGE_KEY = 'hyperhive:op-compose:to';
+    let stickyTo = localStorage.getItem(STORAGE_KEY) || '';
+    let suggestActive = -1;
+    function renderPrompt() {
+      prompt.textContent = stickyTo ? `@${stickyTo}>` : '@—>';
+    }
+    function knownAgents() {
+      // Read live from the flow-local containers cache so newly-spawned
+      // agents become addressable without a manual reload.
+      // Broker uses the literal recipient `manager` for the manager's
+      // inbox, not the container name `hm1nd`.
+      const names = Array.from(flowContainers.values())
+        .map((c) => (c.is_manager ? 'manager' : c.name));
+      // `*` fans out to every registered agent (server-side
+      // broadcast_send).
+      names.unshift('*');
+      return names;
+    }
+    function autosize() {
+      input.style.height = 'auto';
+      input.style.height = `${input.scrollHeight}px`;
+    }
+    /// Parse "@name body…" — return {to, body} when the input opens
+    /// with a known @-mention, otherwise null.
+    function parseAddressed(raw) {
+      const m = raw.match(/^@([\w*-]+)\s+([\s\S]+)$/);
+      if (!m) return null;
+      return { to: m[1], body: m[2] };
+    }
+    function hideSuggest() {
+      suggest.hidden = true;
+      suggest.innerHTML = '';
+      suggestActive = -1;
+    }
+    function renderSuggest(matches) {
+      suggest.innerHTML = '';
+      if (!matches.length) { hideSuggest(); return; }
+      for (let i = 0; i < matches.length; i += 1) {
+        const item = document.createElement('div');
+        item.className = 'item' + (i === suggestActive ? ' active' : '');
+        item.textContent = '@' + matches[i];
+        item.addEventListener('mousedown', (e) => {
+          e.preventDefault();
+          applySuggestion(matches[i]);
+        });
+        suggest.append(item);
+      }
+      suggest.hidden = false;
+    }
+    function applySuggestion(name) {
+      // Replace the partial @-token at the start with the full name.
+      const v = input.value;
+      const m = v.match(/^@(\S*)/);
+      if (m) {
+        input.value = `@${name} ` + v.slice(m[0].length).replace(/^\s+/, '');
+      } else {
+        input.value = `@${name} ` + v;
+      }
+      hideSuggest();
+      input.focus();
+      input.setSelectionRange(input.value.length, input.value.length);
+      autosize();
+    }
+    function updateSuggest() {
+      const v = input.value;
+      // Only suggest when an @-token sits at the very start of the
+      // input — switching recipient is always "redirect this whole
+      // line." Mid-message @-mentions stay literal.
+      const m = v.match(/^@(\S*)/);
+      if (!m) { hideSuggest(); return; }
+      const partial = m[1].toLowerCase();
+      const matches = knownAgents().filter((n) => n.toLowerCase().startsWith(partial));
+      if (!matches.length) { hideSuggest(); return; }
+      if (suggestActive < 0 || suggestActive >= matches.length) suggestActive = 0;
+      renderSuggest(matches);
+    }
+    async function submit() {
+      const raw = input.value.trim();
+      if (!raw) return;
+      let to;
+      let body;
+      const addressed = parseAddressed(raw);
+      if (addressed) {
+        to = addressed.to;
+        body = addressed.body.trim();
+      } else if (stickyTo) {
+        to = stickyTo;
+        body = raw;
+      } else {
+        flashError('no recipient — start with @name to address a message');
+        return;
+      }
+      if (!body) return;
+      const fd = new FormData();
+      fd.append('to', to);
+      fd.append('body', body);
+      input.disabled = true;
+      try {
+        // /op-send returns 200. The SSE channel carries the resulting
+        // MessageEvent → the terminal renders the sent row + the
+        // inbox updates on its own; no /api/state refetch needed.
+        const resp = await fetch('/op-send', {
+          method: 'POST',
+          body: new URLSearchParams(fd),
+        });
+        if (!resp.ok) {
+          flashError(`send failed: http ${resp.status}`);
+          return;
+        }
+      } catch (err) {
+        flashError(`send failed: ${err}`);
+        return;
+      } finally {
+        input.disabled = false;
+      }
+      stickyTo = to;
+      localStorage.setItem(STORAGE_KEY, to);
+      input.value = '';
+      autosize();
+      renderPrompt();
+      input.focus();
+    }
+    function flashError(msg) {
+      const flow = $('msgflow');
+      if (!flow) return;
+      const row = document.createElement('div');
+      row.className = 'msgrow meta';
+      row.textContent = msg;
+      flow.insertBefore(row, flow.firstChild);
+    }
+    input.addEventListener('input', () => { autosize(); updateSuggest(); });
+    input.addEventListener('keydown', (e) => {
+      if (!suggest.hidden) {
+        if (e.key === 'ArrowDown') {
+          const items = suggest.querySelectorAll('.item');
+          suggestActive = (suggestActive + 1) % items.length;
+          renderSuggest(Array.from(items).map((i) => i.textContent.slice(1)));
+          e.preventDefault();
+          return;
+        }
+        if (e.key === 'ArrowUp') {
+          const items = suggest.querySelectorAll('.item');
+          suggestActive = (suggestActive - 1 + items.length) % items.length;
+          renderSuggest(Array.from(items).map((i) => i.textContent.slice(1)));
+          e.preventDefault();
+          return;
+        }
+        if (e.key === 'Tab' || (e.key === 'Enter' && !e.shiftKey)) {
+          const active = suggest.querySelector('.item.active');
+          if (active) {
+            applySuggestion(active.textContent.slice(1));
+            e.preventDefault();
+            return;
+          }
+        }
+        if (e.key === 'Escape') {
+          hideSuggest();
+          e.preventDefault();
+          return;
+        }
+      }
+      if (e.key === 'Enter' && !e.shiftKey) {
+        e.preventDefault();
+        submit();
+      }
+    });
+    input.addEventListener('blur', () => {
+      // Defer so a click on a suggestion item (mousedown) lands first.
+      setTimeout(hideSuggest, 100);
+    });
+    renderPrompt();
+    autosize();
+  })();
+})();
diff --git a/frontend/packages/dashboard/src/index.html b/frontend/packages/dashboard/src/index.html
new file mode 100644
index 00000000..a14e24e4
--- /dev/null
+++ b/frontend/packages/dashboard/src/index.html
@@ -0,0 +1,226 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <title>hyperhive // h1ve-c0re</title>
+  <link rel="icon" type="image/svg+xml" href="/favicon.svg">
+  <link rel="stylesheet" href="/static/dashboard.css">
+</head>
+<body class="dashboard-shell">
+
+  <!-- Sticky chrome — just the tab strip now (#389 follow-up: the
+       "WE ARE THE WIRED" slug moved out of chrome entirely and lives
+       at the page footer below `<main>`; chrome is navigation only).
+       Tabs route via the URL hash so F5 / back-button / shared links
+       keep you on the same view. JS owns the actual show/hide; this
+       is just the menu. -->
+  <header class="dashboard-chrome">
+    <nav class="tabbar" id="tabbar" role="tablist">
+      <a class="tab" id="tab-swarm" href="#swarm" role="tab"
+         aria-controls="tab-pane-swarm"
+         data-tab="swarm">
+        <span class="tab-label">◆ SW4RM ◆</span>
+        <span class="tab-count" id="tab-count-swarm" hidden></span>
+      </a>
+      <a class="tab" id="tab-call" href="#call" role="tab"
+         aria-controls="tab-pane-call"
+         data-tab="call">
+        <span class="tab-label">◆ Y3R C4LL ◆</span>
+        <span class="tab-count tab-count-attn" id="tab-count-call" hidden></span>
+      </a>
+      <a class="tab" id="tab-system" href="#system" role="tab"
+         aria-controls="tab-pane-system"
+         data-tab="system">
+        <span class="tab-label">◆ SYST3M ◆</span>
+        <span class="tab-count" id="tab-count-system" hidden></span>
+      </a>
+      <!-- SCH3DUL3S (#459): scheduled-prompts surface. List of
+           queued schedules + an operator-direct creation form.
+           Count pill mirrors the active (non-cancelled) schedule
+           count; hidden when zero. -->
+      <a class="tab" id="tab-schedules" href="#schedules" role="tab"
+         aria-controls="tab-pane-schedules"
+         data-tab="schedules">
+        <span class="tab-label">◆ SCH3DUL3S ◆</span>
+        <span class="tab-count" id="tab-count-schedules" hidden></span>
+      </a>
+
+      <!-- FL0W is its own page (`/flow.html`), not a tab — per
+           operator @ #369#issuecomment-3437 ("yes terminal can be a
+           separate page"). The link lives in the tab strip so it
+           reads as a peer surface; clicking navigates rather than
+           swapping panes in place. Count pill mirrors the dashboard's
+           operator-inbox length and is hidden when zero. -->
+      <a class="tab tab-link" id="tab-flow" href="/flow.html"
+         title="open the all-agents chat in a dedicated full-page terminal">
+        <span class="tab-label">◆ FL0W ◆ →</span>
+        <span class="tab-count" id="tab-count-flow" hidden></span>
+      </a>
+
+      <!-- Notification controls live in the chrome (always-on
+           ergonomics; not tab-specific). -->
+      <div id="notif-row" class="notif-row">
+        <button type="button" id="notif-enable" class="btn btn-notif" hidden>🔔 enable notifications</button>
+        <button type="button" id="notif-mute"   class="btn btn-notif" hidden>🔕 mute</button>
+        <button type="button" id="notif-unmute" class="btn btn-notif" hidden>🔔 unmute</button>
+        <span id="notif-status" class="meta" hidden></span>
+      </div>
+    </nav>
+  </header>
+
+  <!-- Tab panes. Exactly one is `.tab-pane-active` at a time;
+       JS toggles based on the URL hash + `hashchange` events. -->
+  <main class="dashboard-main">
+
+    <!-- SW4RM: the swarm itself. Container cards (the central thing
+         the operator looks at) and rebuild queue / cascade visualisation
+         that drives them. The tab label itself reads SW4RM, so the
+         inline C0NTAINERS h2 heading + divider would be redundant —
+         dropped per #385. -->
+    <section class="tab-pane" id="tab-pane-swarm"
+             role="tabpanel" aria-labelledby="tab-swarm">
+      <div id="containers-section">
+        <p class="meta">loading…</p>
+      </div>
+    </section>
+
+    <!-- Y3R C4LL: things blocked on operator decision. Approvals +
+         questions read as the same concept ("something is waiting on
+         you"); both surface their full bodies inline so the operator
+         can decide without leaving the pane. -->
+    <section class="tab-pane" id="tab-pane-call"
+             role="tabpanel" aria-labelledby="tab-call">
+      <h2>◆ P3NDING APPR0VALS ◆</h2>
+      <div class="divider">══════════════════════════════════════════════════════════════</div>
+      <div id="approvals-section">
+        <p class="meta">loading…</p>
+      </div>
+
+      <h2>◆ M1ND H4S QU3STI0NS ◆</h2>
+      <div class="divider">══════════════════════════════════════════════════════════════</div>
+      <div id="questions-section">
+        <p class="meta">loading…</p>
+      </div>
+    </section>
+
+    <!-- SYST3M: passive / rare-interaction state. Meta inputs (lock
+         bumps), rebuild queue (watch only), kept state from previous
+         tombstoned agents. Queued reminders moved to the SCH3DUL3S
+         tab in #460 — they're conceptually "fire X at time Y" too,
+         just self-scheduled by agents instead of operator-set.
+         Headings stay; the per-section content auto-compresses to a
+         one-line summary when empty (separate JS toggle). -->
+    <section class="tab-pane" id="tab-pane-system"
+             role="tabpanel" aria-labelledby="tab-system">
+      <h2>◆ M3T4 1NPUTS ◆</h2>
+      <div class="divider">══════════════════════════════════════════════════════════════</div>
+      <p class="meta">select inputs to <code>nix flake update</code> in <code>/meta/</code>. selected agents rebuild in sequence after the lock bump; manager learns each outcome via the usual <code>rebuilt</code> system event.</p>
+      <div id="meta-inputs-section">
+        <p class="meta">loading…</p>
+      </div>
+
+      <h2>◆ R3BU1LD QU3U3 ◆</h2>
+      <div class="divider">══════════════════════════════════════════════════════════════</div>
+      <p class="meta">pending + running rebuilds, meta-updates, and first-spawns. one runs at a time; meta-update cascades nest under their parent. dedup: re-enqueueing a still-queued op collapses into the existing entry.</p>
+      <div id="rebuild-queue-section">
+        <p class="meta">loading…</p>
+      </div>
+
+      <h2>◆ K3PT ST4T3 ◆</h2>
+      <div class="divider">══════════════════════════════════════════════════════════════</div>
+      <div id="tombstones-section">
+        <p class="meta">loading…</p>
+      </div>
+    </section>
+
+    <!-- SCH3DUL3S (#459): scheduled prompts. operator-direct creation
+         form at the top (POST /api/schedules, no approval gate), live
+         schedules list below (GET /api/schedules) with per-target
+         last-fired timestamps + result, plus per-target / whole-row
+         cancel buttons (POST /api/schedules/{id}/cancel). #444 backend
+         doesn't emit a SchedulesChanged dashboard event yet, so the
+         list re-fetches on tab activation + after each form/cancel
+         submit. Live SSE wiring is the future PR C. -->
+    <section class="tab-pane" id="tab-pane-schedules"
+             role="tabpanel" aria-labelledby="tab-schedules">
+      <h2>◆ N3W SCH3DUL3 ◆</h2>
+      <div class="divider">══════════════════════════════════════════════════════════════</div>
+      <p class="meta">queue a prompt to fire at a future time. operator-direct (no approval gate); recurring when an interval is set. targets are any known agent name or <code>operator</code> / <code>manager</code>.</p>
+      <div id="schedule-new-section">
+        <p class="meta">loading…</p>
+      </div>
+
+      <h2>◆ QU3U3D SCH3DUL3S ◆</h2>
+      <div class="divider">══════════════════════════════════════════════════════════════</div>
+      <p class="meta">all schedules currently in the table. expand each card to see per-target firing history. cancel a single target with the row button or the whole schedule with <code>✕ cancel all</code>.</p>
+      <div id="schedules-section">
+        <p class="meta">loading…</p>
+      </div>
+
+      <!-- QU3U3D R3M1ND3RS (#460): self-scheduled agent reminders.
+           Moved here from the SYST3M tab so the operator has one
+           place for everything that fires at a future time —
+           operator-set schedules above, agent-self reminders here.
+           Backed by GET /api/reminders; refresh handled by
+           refreshReminders() (called from refreshState). -->
+      <h2>◆ QU3U3D R3M1ND3RS ◆</h2>
+      <div class="divider">══════════════════════════════════════════════════════════════</div>
+      <p class="meta">reminders agents have queued for themselves but not yet delivered. cancel to drop a stuck or unwanted entry.</p>
+      <div id="reminders-section">
+        <p class="meta">loading…</p>
+      </div>
+    </section>
+
+    <!-- FL0W: lives on its own page now (`/flow.html`). The
+         message-flow + inbox + compose DOM only exists there — when
+         tabs.js boots on this page the corresponding renderers
+         no-op silently (each guard is `if (!el) return`). -->
+
+  </main>
+
+  <footer>
+    <pre class="banner banner-thin">░▒▓█▓▒░ HYPERHIVE / HIVE-C0RE / WE ARE THE WIRED ░▒▓█▓▒░</pre>
+    <div class="divider">══════════════════════════════════════════════════════════════</div>
+    <p>▲△▲ <a href="https://git.berlin.ccc.de/vinzenz/hyperhive">hyperhive</a> ▲△▲ hive-c0re on this host ▲△▲</p>
+  </footer>
+
+  <!-- Slide-in detail panel. Long content (clicked file previews,
+       approval diffs, journald logs, applied config) opens here
+       instead of expanding inline. Singleton — JS swaps the title +
+       body and toggles `.open`. Lives outside the tab panes so it
+       overlays any active tab. -->
+  <div id="side-panel" class="side-panel" aria-hidden="true">
+    <div class="side-panel-backdrop" id="side-panel-backdrop"></div>
+    <aside class="side-panel-drawer" role="dialog" aria-modal="true"
+           aria-labelledby="side-panel-title">
+      <header class="side-panel-head">
+        <span class="side-panel-title" id="side-panel-title"></span>
+        <button type="button" class="side-panel-close" id="side-panel-close"
+                title="close (esc)">✕</button>
+      </header>
+      <div class="side-panel-body" id="side-panel-body"></div>
+    </aside>
+  </div>
+
+  <!-- Selection action bar (#443). Sticky-bottom strip that slides
+       into view when one or more agent cards is selected (click the
+       icon to toggle). Shows the selection count + actions that
+       apply to ALL selected; disabled-with-tooltip for actions that
+       don't (mara picked option B). Hidden when selection is empty. -->
+  <div id="selection-bar" class="selection-bar" hidden role="toolbar"
+       aria-label="bulk agent actions">
+    <span class="selection-count" id="selection-count"></span>
+    <span class="selection-names" id="selection-names"></span>
+    <span class="selection-actions" id="selection-actions"></span>
+    <button type="button" class="btn selection-clear" id="selection-clear"
+            title="clear selection (esc)">✕ clear</button>
+  </div>
+
+  <!-- Single bundled entry (#406 step 3 — renamed from app.js to
+       tabs.js since this bundle is the dashboard *tabs* surface only;
+       flow.html has its own flow.js bundle). esbuild folds
+       @hive/shared/terminal.js and the marked npm package into
+       tabs.js; load order is preserved by the module bundler. -->
+  <script type="module" src="/static/tabs.js" defer></script>
+</body>
+</html>
diff --git a/frontend/packages/dashboard/src/stream-worker.js b/frontend/packages/dashboard/src/stream-worker.js
new file mode 100644
index 00000000..3d7af676
--- /dev/null
+++ b/frontend/packages/dashboard/src/stream-worker.js
@@ -0,0 +1,110 @@
+// SharedWorker that holds ONE EventSource per stream URL and fans
+// every server-sent event out to every connected tab via MessagePort.
+//
+// Problem this solves (#448 — mara: "firefox disconnects bc of too
+// many tabs"): every dashboard / agent tab opens its own
+// `EventSource('/dashboard/stream')`. Browsers cap concurrent
+// connections per host (~6), and Firefox throttles / disconnects
+// background tabs when many are open. The result: tabs silently
+// drop the SSE, fall behind, and only catch up on focus.
+//
+// Centralising the connection in a SharedWorker means N tabs share
+// ONE backend EventSource regardless of focus state — way under the
+// per-host cap, immune to per-tab throttling, and the worker survives
+// any individual tab being suspended.
+//
+// Wire protocol (port.postMessage payloads):
+//
+//   tab → worker
+//     { kind: 'subscribe',   url: '/dashboard/stream' }
+//     { kind: 'unsubscribe', url: '/dashboard/stream' }
+//
+//   worker → tab
+//     { kind: 'open',    url: '...' }   relayed from EventSource.onopen,
+//                                       plus a synthetic open fired to
+//                                       a brand-new subscriber when the
+//                                       upstream is already OPEN — so
+//                                       the page's onStreamOpen still
+//                                       runs and triggers a snapshot
+//                                       re-sync after a reconnect gap.
+//     { kind: 'message', url: '...', data: '<raw SSE data string>' }
+//     { kind: 'error',   url: '...' }   relayed from EventSource.onerror.
+//
+// Subscriptions are tracked per (port, url): a single port can
+// subscribe to multiple URLs (today only one is in use but the shape
+// stays open for the per-agent /events/stream multiplexing follow-up).
+// Unsubscribing the last port for a URL closes the EventSource so we
+// don't keep idle streams open.
+
+const streams = new Map();
+
+function getOrCreateStream(url) {
+  let entry = streams.get(url);
+  if (entry) return entry;
+  const es = new EventSource(url);
+  entry = { es, url, ports: new Set() };
+  es.onopen = () => {
+    for (const port of entry.ports) {
+      try { port.postMessage({ kind: 'open', url }); }
+      catch { /* port dead — cleanup happens on unsubscribe / next subscribe */ }
+    }
+  };
+  es.onmessage = (e) => {
+    for (const port of entry.ports) {
+      try { port.postMessage({ kind: 'message', url, data: e.data }); }
+      catch { /* same */ }
+    }
+  };
+  es.onerror = () => {
+    for (const port of entry.ports) {
+      try { port.postMessage({ kind: 'error', url }); }
+      catch { /* same */ }
+    }
+  };
+  streams.set(url, entry);
+  return entry;
+}
+
+function unsubscribe(port, url) {
+  const entry = streams.get(url);
+  if (!entry) return;
+  entry.ports.delete(port);
+  if (entry.ports.size === 0) {
+    entry.es.close();
+    streams.delete(url);
+  }
+}
+
+self.onconnect = (connectEvent) => {
+  const port = connectEvent.ports[0];
+  const subscribedUrls = new Set();
+  port.onmessage = (e) => {
+    const msg = e.data;
+    if (!msg || typeof msg.url !== 'string') return;
+    if (msg.kind === 'subscribe') {
+      if (subscribedUrls.has(msg.url)) return; // idempotent
+      const entry = getOrCreateStream(msg.url);
+      entry.ports.add(port);
+      subscribedUrls.add(msg.url);
+      // Synthetic open for late subscribers — the upstream EventSource
+      // may already be OPEN when this tab joins, in which case the
+      // native onopen has long since fired and won't fire again until
+      // the next reconnect. Hand the new tab the open event explicitly
+      // so its onStreamOpen handler runs.
+      if (entry.es.readyState === EventSource.OPEN) {
+        try { port.postMessage({ kind: 'open', url: msg.url }); }
+        catch { /* port dead immediately — give up */ }
+      }
+    } else if (msg.kind === 'unsubscribe') {
+      if (!subscribedUrls.has(msg.url)) return;
+      unsubscribe(port, msg.url);
+      subscribedUrls.delete(msg.url);
+    }
+  };
+  // A port has no explicit "disconnect" event in the SharedWorker API
+  // — tabs close, the GC eventually reclaims the port, but postMessage
+  // to a dead port throws which the senders above catch. We don't
+  // proactively prune ports on a timer because the cost is bounded
+  // (one dead Set entry per stale tab) and the next subscribe / catch
+  // catches it.
+};
diff --git a/frontend/packages/dashboard/src/tabs.js b/frontend/packages/dashboard/src/tabs.js
new file mode 100644
index 00000000..8dcaed8b
--- /dev/null
+++ b/frontend/packages/dashboard/src/tabs.js
@@ -0,0 +1,3019 @@
+// /index.html entry point: tab renderers + tab routing + refreshState
+// + notification deltas. Reads /api/state on cold load and after every
+// async-form submit; live updates run through `applyXxx` mutation
+// handlers triggered by the dashboard event stream.
+//
+// #406 step 1: pure helpers + side panel + OS notifications + path
+// linkification moved to `./common.js`.
+// #406 step 2: the flow-only IIFEs (operator inbox, inbox-pill, broker
+// terminal, @-mention composer) moved to `./flow.js`. /flow.html loads
+// `flow.js` as its own bundle entry; this file is loaded only by
+// /index.html.
+// #406 step 3: file renamed from `app.js` → `tabs.js` since it owns
+// the dashboard *tabs* surface only (the FL0W page has its own bundle).
+// Live SSE subscription is wired through `openStream` from common.js
+// (#406 step 3 hookup; see also #408 for stream-side filtering).
+
+import { marked } from 'marked';
+import {
+  $, el, esc, form,
+  fmtAgeSecs,
+  Panel, NOTIF,
+  makePathLink, appendText, appendLinkified,
+  openStream,
+} from './common.js';
+
+// mdNode (in common.js) reads `window.marked` for the markdown side
+// panel preview path. Set it here on the dashboard entry so file
+// previews work; flow.js does the same for the flow-page entry.
+window.marked = marked;
+
+(() => {
+  // ─── constants ──────────────────────────────────────────────────────────
+  // Context-window badge thresholds. Preferred source is each container's
+  // `context_window_tokens` from /api/state (the real window for the model
+  // it last ran on) — thresholds are then 75% / 50% of it, matching the
+  // harness compaction watermarks (compact at 75%, auto-reset at 50%). The
+  // fixed token constants are the fallback for when that field is absent
+  // (agent has no turns yet, or no per-model config matched the model).
+  const CTX_WARN_FRACTION    = 0.75; // ≥ this share of the window → red
+  const CTX_CAUTION_FRACTION = 0.50; // ≥ this share of the window → yellow
+  const CTX_WARN_TOKENS    = 150_000; // fallback red threshold    (≈ 75% of 200k)
+  const CTX_CAUTION_TOKENS = 100_000; // fallback yellow threshold (≈ 50% of 200k)
+
+  // Helpers ($, el, esc, form, fmtAgeSecs) moved to ./common.js (#406).
+
+  // #464 — atomic-swap render helper. Each managed section's render
+  // function used to do `root.innerHTML = ''; root.append(...);` in
+  // sequence; even though both operations sit in the same JS turn,
+  // operators could still see a "blink" on every poll cycle because
+  // (a) on async paths the await yield gave the browser a paint
+  // opportunity, and (b) complex builds with many `el()` allocations
+  // can blow the browser's per-task budget enough for layout to flash
+  // empty before the new children land.
+  //
+  // The fix: build the new content off-DOM into a `DocumentFragment`,
+  // then move it into the live root in a single `replaceChildren`
+  // call. The browser never sees an intermediate empty state. Builder
+  // callbacks receive the fragment as their `root` argument, so each
+  // renderer's existing `root.append(...)` code carries over with
+  // zero internal changes. Early-return inside the builder is fine —
+  // the commit still happens with whatever the builder appended.
+  function paintAtomic(liveRoot, build) {
+    const buf = document.createDocumentFragment();
+    build(buf);
+    liveRoot.replaceChildren(buf);
+  }
+
+  // Side panel singleton (Panel) moved to ./common.js (#406).
+
+  // Path linkification + file-preview side panel (openFilePanel,
+  // makePathLink, appendText, appendLinkified) moved to ./common.js (#406).
+
+  // OS notification module (NOTIF) moved to ./common.js (#406).
+
+  // Track which items we've already notified about so a re-render
+  // doesn't re-fire for the same row. Keyed by stable ids; reset only
+  // when the page reloads.
+  const seenApprovals  = new Set();
+  const seenQuestions  = new Set();
+  let seededNotify = false;
+
+  function notifyDeltas(s) {
+    const approvals = s.approvals || [];
+    const questions = s.questions || [];
+    if (!seededNotify) {
+      // First render after page load — fill the "seen" sets without
+      // firing notifications. We only want to notify on NEW items
+      // that arrived while the page is open. The inbox no longer
+      // needs seeding here: it's derived from the broker stream which
+      // does its own per-event notification on live arrival, and
+      // history-replayed events are silent by virtue of `fromHistory`.
+      for (const a of approvals) seenApprovals.add(a.id);
+      for (const q of questions) seenQuestions.add(q.id);
+      seededNotify = true;
+      return;
+    }
+    for (const a of approvals) {
+      if (seenApprovals.has(a.id)) continue;
+      seenApprovals.add(a.id);
+      const verb = a.kind === 'spawn' ? 'spawn approval'
+        : a.kind === 'init_config' ? 'config-init approval'
+        : 'config commit';
+      NOTIF.show('◆ approval #' + a.id, `${verb} for ${a.agent}`,
+        'hyperhive:approval:' + a.id);
+    }
+    for (const q of questions) {
+      if (seenQuestions.has(q.id)) continue;
+      seenQuestions.add(q.id);
+      const targetLabel = q.target || 'operator';
+      NOTIF.show(`◆ ${q.asker} → ${targetLabel} asks`,
+        q.question.slice(0, 120),
+        'hyperhive:question:' + q.id);
+    }
+  }
+
+  // ─── async forms ────────────────────────────────────────────────────────
+  document.addEventListener('submit', async (e) => {
+    const f = e.target;
+    if (!(f instanceof HTMLFormElement) || !f.hasAttribute('data-async')) return;
+    e.preventDefault();
+    if (f.dataset.confirm && !confirm(f.dataset.confirm)) return;
+    if (f.dataset.prompt) {
+      const ans = prompt(f.dataset.prompt, '');
+      if (ans === null) return;  // operator hit Cancel
+      // Drop into a hidden input named after `data-prompt-field` (or
+      // 'note' by default) so the value rides along on the POST.
+      const field = f.dataset.promptField || 'note';
+      let input = f.querySelector(`input[name="${field}"]`);
+      if (!input) {
+        input = document.createElement('input');
+        input.type = 'hidden';
+        input.name = field;
+        f.append(input);
+      }
+      input.value = ans;
+    }
+    const btn = f.querySelector('button[type="submit"], button:not([type]), .btn-inline');
+    const original = btn ? btn.innerHTML : '';
+    if (btn) { btn.disabled = true; btn.innerHTML = '<span class="spinner">◐</span>'; }
+    try {
+      const resp = await fetch(f.action, {
+        method: f.method || 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams(new FormData(f)),
+        redirect: 'manual',
+      });
+      const ok = resp.ok || resp.type === 'opaqueredirect'
+        || (resp.status >= 200 && resp.status < 400);
+      if (!ok) {
+        const text = await resp.text().catch(() => '');
+        alert('action failed: ' + resp.status + (text ? '\n\n' + text : ''));
+        if (btn) { btn.disabled = false; btn.innerHTML = original; }
+        return;
+      }
+      // Re-enable the button — refreshState() rebuilds most lists but
+      // skips forms that didn't change (e.g. the spawn form), so without
+      // this the spinner sticks and the button can't be clicked again.
+      if (btn) { btn.disabled = false; btn.innerHTML = original; }
+      // Clear text inputs whose value was just submitted.
+      f.querySelectorAll('input[type="text"], input:not([type]), textarea').forEach((i) => { i.value = ''; });
+      // Forms whose endpoint already emits a DashboardEvent that
+      // updates the derived store can opt out of the post-submit
+      // /api/state refetch (the event delivers the new row faster
+      // than the snapshot poll anyway). Container-lifecycle forms
+      // still rely on the refresh since `ContainerView` isn't yet
+      // event-derivable.
+      if (!f.hasAttribute('data-no-refresh')) {
+        refreshState();
+      }
+    } catch (err) {
+      alert('action failed: ' + err);
+      if (btn) { btn.disabled = false; btn.innerHTML = original; }
+    }
+  });
+
+  // Derived container state — cold-loaded from /api/state.containers,
+  // then mutated live by `container_state_changed` (upsert by name)
+  // and `container_removed` (drop by name). The coordinator's rescan
+  // helper fires these after every mutation site + on a periodic poll
+  // in crash_watch. Keyed by ContainerView.name so the lifecycle
+  // forms' POST → 200 → matching event flips the row without a
+  // snapshot refetch.
+  const containersState = new Map();
+  function syncContainersFromSnapshot(s) {
+    containersState.clear();
+    for (const c of s.containers || []) containersState.set(c.name, c);
+  }
+  function applyContainerStateChanged(ev) {
+    if (!ev.container || !ev.container.name) return;
+    containersState.set(ev.container.name, ev.container);
+    renderContainersFromState();
+  }
+  function applyContainerRemoved(ev) {
+    if (containersState.delete(ev.name)) renderContainersFromState();
+  }
+
+  // Derived tombstones + meta_inputs. Both are emitted as full
+  // snapshots (not diffs) — the lists are tiny and recomputing
+  // avoids ordering races between a same-tick destroy + purge.
+  let tombstonesState = [];
+  let metaInputsState = [];
+  // True while a dashboard-triggered meta-update (flake lock bump +
+  // agent rebuild ripple) runs in the background. Cold-loaded from
+  // `s.meta_update_running`, then flipped live by the
+  // `meta_update_running` event. Drives the META INPUTS panel's
+  // disabled "updating…" state (issue #259).
+  let metaUpdateRunning = false;
+  function syncTombstonesFromSnapshot(s) {
+    tombstonesState = (s.tombstones || []).slice();
+  }
+  function syncMetaInputsFromSnapshot(s) {
+    metaInputsState = (s.meta_inputs || []).slice();
+    metaUpdateRunning = !!s.meta_update_running;
+  }
+  function applyTombstonesChanged(ev) {
+    tombstonesState = (ev.tombstones || []).slice();
+    renderTombstonesFromState();
+  }
+  function applyMetaInputsChanged(ev) {
+    metaInputsState = (ev.inputs || []).slice();
+    renderMetaInputsFromState();
+  }
+  function applyMetaUpdateRunning(ev) {
+    metaUpdateRunning = !!ev.running;
+    renderMetaInputsFromState();
+  }
+  function renderTombstonesFromState() {
+    renderTombstones({ tombstones: tombstonesState });
+  }
+  function renderMetaInputsFromState() {
+    renderMetaInputs({ meta_inputs: metaInputsState });
+  }
+
+  // Derived rebuild queue state — cold-loaded from
+  // `/api/state.rebuild_queue`, then mutated live by the
+  // `rebuild_queue_changed` snapshot event. Same shape as the meta-
+  // inputs panel (full snapshot per change, no diff).
+  let rebuildQueueState = [];
+  function syncRebuildQueueFromSnapshot(s) {
+    rebuildQueueState = (s.rebuild_queue || []).slice();
+  }
+  function applyRebuildQueueChanged(ev) {
+    rebuildQueueState = (ev.queue || []).slice();
+    renderRebuildQueueFromState();
+    // Container cards surface in-flight rebuild / meta-update ops as
+    // a "building..." badge (#398) — re-render the SW4RM tab so
+    // newly-queued / newly-running ops light up the right card,
+    // and finished ops fall back to the regular state badges.
+    renderContainersFromState();
+  }
+  // Map from agent name → highest-priority in-flight queue entry
+  // (`running` beats `queued`). Used by the container row renderer
+  // to surface "building..." / "meta-updating..." badges on the
+  // SW4RM tab when an op is still in the rebuild queue but no
+  // operator-initiated transient is set (#398).
+  function inFlightOpsByAgent() {
+    const out = new Map();
+    for (const e of rebuildQueueState) {
+      if (e.state !== 'queued' && e.state !== 'running') continue;
+      // spawn ops target an agent that doesn't exist yet as a
+      // container — the transient store already drives the
+      // pending row for that case. Skip here to avoid double-
+      // surfacing if the spawn op happens to land in the queue
+      // while the row exists transiently.
+      if (e.kind === 'spawn') continue;
+      const cur = out.get(e.agent);
+      // Prefer running over queued; otherwise keep the first match.
+      if (!cur || (cur.state === 'queued' && e.state === 'running')) {
+        out.set(e.agent, e);
+      }
+    }
+    return out;
+  }
+  function renderRebuildQueueFromState() {
+    renderRebuildQueue({ rebuild_queue: rebuildQueueState });
+  }
+
+  // Derived transient state — cold-loaded from /api/state.transients,
+  // then mutated live by `transient_set` / `transient_cleared`. Keyed
+  // by agent name so add/remove are O(1). `since_unix` is wall-clock so
+  // the elapsed-seconds badge ticks without polling.
+  const transientsState = new Map();
+  function syncTransientsFromSnapshot(s) {
+    transientsState.clear();
+    for (const t of s.transients || []) {
+      // Snapshot ships `secs` (server-computed); reconstruct an
+      // approximate since_unix so the live ticker keeps progressing
+      // without surprising jumps when the next snapshot lands.
+      const nowUnix = Math.floor(Date.now() / 1000);
+      transientsState.set(t.name, {
+        kind: t.kind,
+        since_unix: t.since_unix ?? (nowUnix - (t.secs || 0)),
+      });
+    }
+  }
+  function applyTransientSet(ev) {
+    transientsState.set(ev.name, {
+      kind: ev.transient_kind,
+      since_unix: ev.since_unix,
+    });
+    renderContainersFromState();
+  }
+  function applyTransientCleared(ev) {
+    if (transientsState.delete(ev.name)) renderContainersFromState();
+  }
+  // Re-render using the last cached snapshot (containers come from
+  // /api/state, transients overlay from the derived map). The snapshot
+  // is stashed on window.__hyperhive_state by refreshState; on cold
+  // load before the first snapshot we just skip.
+  function renderContainersFromState() {
+    const s = window.__hyperhive_state;
+    if (s) renderContainers(s);
+  }
+
+  // ─── selection (#443) ───────────────────────────────────────────────
+  // Set of selected agent logical names. Toggled by clicking the
+  // container-row icon. When non-empty, the sticky #selection-bar
+  // becomes visible with the bulk actions. Per-card action buttons
+  // are gone — actions live in the bar.
+  const selectionState = new Set();
+  function toggleSelection(name) {
+    if (selectionState.has(name)) selectionState.delete(name);
+    else selectionState.add(name);
+    renderContainersFromState();
+  }
+  function clearSelection() {
+    if (selectionState.size === 0) return;
+    selectionState.clear();
+    renderContainersFromState();
+  }
+  // Esc clears the current selection (operator escape hatch — mirrors
+  // the side-panel close pattern). Ignored when an editable element
+  // has focus so typing in compose / answer / journal-search isn't
+  // intercepted.
+  document.addEventListener('keydown', (e) => {
+    if (e.key !== 'Escape') return;
+    if (!selectionState.size) return;
+    const a = document.activeElement;
+    if (a && (a.isContentEditable
+        || a.tagName === 'INPUT'
+        || a.tagName === 'TEXTAREA'
+        || a.tagName === 'SELECT')) return;
+    e.preventDefault();
+    clearSelection();
+  });
+  document.addEventListener('click', (e) => {
+    if (e.target && e.target.closest('#selection-clear')) {
+      clearSelection();
+    }
+  });
+
+  // Re-derive port conflicts from the live containers map. Mirrors the
+  // server-side `build_port_conflicts` so the banner reacts to event
+  // updates instead of waiting for a /api/state refetch.
+  function derivePortConflicts(containers) {
+    const byPort = new Map();
+    for (const c of containers) {
+      if (!byPort.has(c.port)) byPort.set(c.port, []);
+      byPort.get(c.port).push(c.name);
+    }
+    const out = [];
+    for (const [port, agents] of byPort) {
+      if (agents.length > 1) {
+        agents.sort();
+        out.push({ port, agents });
+      }
+    }
+    out.sort((a, b) => a.port - b.port);
+    return out;
+  }
+
+  // ─── state rendering ────────────────────────────────────────────────────
+  // ─── agent topology (#363) ──────────────────────────────────────────────
+  // Build a forest from `ContainerView.parent` and walk depth-first to
+  // produce a render order with per-row depth + sibling-position info.
+  // Top-level (parent = null OR parent not in the container map) are
+  // roots. Within each level, children are sorted alphabetically by
+  // name; roots likewise. Cycles in the parent graph (malformed config)
+  // are tolerated: any container not reached via root-walk is appended
+  // as a root at the end, so no agent ever disappears from the list.
+  //
+  // For the visual: each row gets a textual prefix column (`├─`, `└─`,
+  // continuation `│  ` or padding `   ` for ancestor columns). When
+  // every container has `parent = null` (today's pre-#361 state), the
+  // tree collapses to a flat list with no glyphs and no indent — bit-
+  // identical to the legacy render.
+  function buildAgentTree(containers) {
+    const byName = new Map();
+    for (const c of containers) byName.set(c.name, c);
+    const children = new Map();      // parent_name → [child_name, …]
+    const roots = [];
+    for (const c of containers) {
+      const p = c.parent || null;
+      if (p == null || !byName.has(p)) {
+        roots.push(c.name);
+      } else {
+        const list = children.get(p) || [];
+        list.push(c.name);
+        children.set(p, list);
+      }
+    }
+    roots.sort();
+    for (const list of children.values()) list.sort();
+    const out = [];
+    const visited = new Set();
+    function visit(name, depth, ancestorIsLast, isLast) {
+      if (visited.has(name)) return;
+      visited.add(name);
+      const c = byName.get(name);
+      if (!c) return;
+      out.push({ container: c, depth, ancestorIsLast: [...ancestorIsLast], isLast });
+      const kids = children.get(name) || [];
+      kids.forEach((kid, i) =>
+        visit(kid, depth + 1, [...ancestorIsLast, isLast], i === kids.length - 1));
+    }
+    roots.forEach((name, i) => visit(name, 0, [], i === roots.length - 1));
+    // Cycle safety: anything not reached lands at root level so no
+    // agent silently disappears when a config is malformed.
+    for (const c of containers) {
+      if (!visited.has(c.name)) visit(c.name, 0, [], true);
+    }
+    return out;
+  }
+  // Builds the .tree-prefix DOM for a row at the given depth. Each
+  // lane is its own positioned child so CSS can paint full-height
+  // vertical bars that bridge the gap between sibling rows — text
+  // box-drawing glyphs only paint one text-line tall, which left
+  // visible breaks between rows once we grew taller-than-one-line
+  // container cards (#388). Ancestor lanes are either continuation
+  // (vertical bar top→bottom+gap) or blank; the joint at this row's
+  // own depth is ├ (branch — vertical continues below) or └ (last —
+  // vertical stops at the row's icon midline). CSS at
+  // `.container-row .tree-prefix` paints the bars + horizontal stub.
+  function treePrefixDom({ depth, ancestorIsLast, isLast }) {
+    if (depth === 0) return null;
+    const prefix = el('span', { class: 'tree-prefix', 'aria-hidden': 'true' });
+    // Ancestor columns (depth 1..depth-1). Skip depth 0 (root has no
+    // continuation column — top-level rows are separated visually as
+    // top-level rows already).
+    for (let d = 1; d < depth; d++) {
+      const cls = ancestorIsLast[d] ? 'tree-lane lane-blank' : 'tree-lane lane-line';
+      prefix.append(el('span', { class: cls }));
+    }
+    const jointCls = 'tree-lane lane-joint ' + (isLast ? 'lane-joint-last' : 'lane-joint-branch');
+    prefix.append(el('span', { class: jointCls }));
+    return prefix;
+  }
+
+  function renderContainers(s) {
+    const root = $('containers-section');
+    // #containers-section only exists on /index.html. tabs.js is the
+    // bundle for that page only (#406 step 3 — /flow.html loads
+    // flow.js instead), but historical context: pre-split the
+    // `container_state_changed` SSE handler routed through
+    // `applyContainerStateChanged → renderContainersFromState` on
+    // every page that loaded the single combined bundle, and the
+    // guard prevented a `root is null` throw on /flow.html (#399).
+    // Today it's belt-and-suspenders for any future page that adds
+    // tabs.js without a #containers-section. Matches the
+    // no-op-when-target-absent convention the other renderers
+    // (renderTombstones, etc.) follow.
+    if (!root) return;
+    root.innerHTML = '';
+
+    // Containers come from the derived map (event-driven) rather than
+    // `s.containers`; `s` still supplies hostname (for the web-ui
+    // link) and tombstones/meta_inputs (not event-derived yet). The
+    // tree builder handles the ordering — we don't pre-sort here.
+    const containers = Array.from(containersState.values());
+    const portConflicts = derivePortConflicts(containers);
+    const anyStale = containers.some((c) => c.needs_update);
+
+    // Port-hash collisions: rename one of the listed agents and
+    // rebuild. The banner sits above the agent list so it's the
+    // first thing the operator sees when something's wedged.
+    if (portConflicts.length) {
+      const banner = el('div', { class: 'port-conflict' },
+        el('strong', {}, '⚠  port collision'), ' — ');
+      const groups = portConflicts.map((c) =>
+        `:${c.port} (${c.agents.join(' + ')})`).join('; ');
+      banner.append(groups + '. rename one of each and ↻ R3BU1LD.');
+      root.append(banner);
+    }
+
+    if (anyStale) {
+      root.append(form(
+        '/update-all', 'btn-rebuild', '↻ UPD4TE 4LL',
+        'rebuild every stale container?',
+        {}, { noRefresh: true },
+      ));
+    }
+
+    if (transientsState.size) {
+      const ul = el('ul');
+      const nowUnix = Math.floor(Date.now() / 1000);
+      for (const [name, t] of transientsState) {
+        const secs = Math.max(0, nowUnix - t.since_unix);
+        ul.append(el('li', {},
+          el('span', { class: 'glyph spinner' }, '◐'), ' ',
+          el('span', { class: 'agent' }, name), ' ',
+          el('span', { class: 'role role-pending' }, t.kind + '…'), ' ',
+          el('span', { class: 'meta' }, `nixos-container create + start (${secs}s)`),
+        ));
+      }
+      root.append(ul);
+    }
+
+    if (!containers.length && !transientsState.size) {
+      root.append(el('p', { class: 'empty' }, 'no managed containers'));
+      return;
+    }
+
+    // Drop stale selections (agent destroyed while selected). Defensive —
+    // the action bar would otherwise loop POST against a gone agent.
+    const liveNames = new Set(containers.map((c) => c.name));
+    for (const n of Array.from(selectionState)) {
+      if (!liveNames.has(n)) selectionState.delete(n);
+    }
+
+    const hostname = (s && s.hostname) || window.location.hostname;
+    const ul = el('ul', { class: 'containers' });
+    const tree = buildAgentTree(containers);
+    // In-flight rebuild / meta-update / destroy ops per agent name.
+    // Surface them as "building..." style badges on the container
+    // card when no operator-initiated transient already covers the
+    // row (#398). Mara: the SW4RM tab showed an agent as stopped
+    // while SYST3M showed an active rebuild; cross-reference fixes
+    // that.
+    const inFlight = inFlightOpsByAgent();
+    for (const node of tree) {
+      const c = node.container;
+      const url = `http://${hostname}:${c.port}/`;
+      // Pending state is overlaid from the transient store first
+      // (operator-initiated spawn/destroy/rebuild — covers the
+      // create+start window where the container literally isn't up
+      // yet), then from the rebuild_queue (#398 — covers in-flight
+      // ops the worker is running even if no transient was set).
+      // `ContainerStateChanged` doesn't carry either signal.
+      const transientKind = transientsState.get(c.name)?.kind || null;
+      const op = !transientKind ? inFlight.get(c.name) : null;
+      const pending = transientKind
+        || (op && (op.state === 'running'
+              ? (op.kind === 'meta_update' ? 'meta-updating'
+                  : op.kind === 'destroy'  ? 'destroying'
+                  : 'rebuilding')
+              : (op.kind === 'meta_update' ? 'meta-update queued'
+                  : op.kind === 'destroy'  ? 'destroy queued'
+                  : 'rebuild queued')));
+      const selected = selectionState.has(c.name);
+      const li = el('li', {
+        class: 'container-row'
+          + (pending ? ' pending' : '')
+          + (selected ? ' selected' : ''),
+      });
+      // Topology: depth contributes left-padding; the glyph string in
+      // the .tree-prefix span draws the ├─ / └─ joint + continuation
+      // lines (`│  `) for ancestors whose subtree extends below this
+      // row. Both are CSS-driven from the data attributes so the
+      // legacy flat layout (every container at depth 0) is bit-
+      // identical to today's render — no glyph, no indent.
+      if (node.depth > 0) li.dataset.depth = String(node.depth);
+      const prefix = treePrefixDom(node);
+      if (prefix) li.prepend(prefix);
+
+      // Full-height square agent icon, left of the card body. The
+      // icon is an <img> absolutely positioned inside a wrapper div:
+      // the div is the flex child and sizes itself via aspect-ratio +
+      // stretch, the <img> is out of flow so its load state — pending,
+      // loaded or broken — can never contribute intrinsic size or
+      // reflow the row. (issue #177)
+      //
+      // The icon points straight at the agent's `<url>/icon`. We don't
+      // guess whether the agent is reachable from the container row —
+      // we just let the <img> try, and if it actually fails to load
+      // (agent stopped, restarting, rebuilding — web server not
+      // answering) the error handler falls it back to the dimmed
+      // hyperhive mark (`/favicon.svg`, served by the dashboard
+      // itself, always reachable). (issues #195, #202)
+      const iconImg = el('img', { class: 'container-icon-img', alt: '' });
+      // #443: icon is the selection toggle. Click → add/remove from
+      // `selectionState` → re-render. role=button + tabindex makes it
+      // keyboard-accessible; aria-pressed reflects the toggle state.
+      const icon = el('div', {
+        class: 'container-icon',
+        role: 'button',
+        tabindex: '0',
+        'aria-pressed': selected ? 'true' : 'false',
+        title: selected
+          ? `deselect ${c.name} (or press Esc to clear all)`
+          : `select ${c.name} for bulk actions`,
+      }, iconImg);
+      icon.addEventListener('click', (e) => {
+        e.preventDefault();
+        toggleSelection(c.name);
+      });
+      icon.addEventListener('keydown', (e) => {
+        if (e.key === 'Enter' || e.key === ' ') {
+          e.preventDefault();
+          toggleSelection(c.name);
+        }
+      });
+      if (c.running) {
+        iconImg.src = `${url}icon`;
+        iconImg.addEventListener('error', () => {
+          if (iconImg.dataset.fallback) return;  // guard: don't loop if the favicon itself 404s
+          iconImg.dataset.fallback = '1';
+          icon.classList.add('icon-unreachable');
+          iconImg.src = '/favicon.svg';
+        });
+      } else {
+        // Container stopped (#432) — skip the doomed `${url}icon` fetch
+        // and go straight to the dimmed hyperhive mark. Avoids a noisy
+        // failed request in the console + the brief broken-image flash.
+        icon.classList.add('icon-unreachable');
+        iconImg.src = '/favicon.svg';
+      }
+      // Card body: the three stacked content lines, right of the icon.
+      const body = el('div', { class: 'card-body' });
+
+      // ── identity ─────────────────────────────────────────────────
+      const head = el('div', { class: 'head' });
+      head.append(
+        el('a', { class: 'name', href: url, target: '_blank', rel: 'noopener' }, c.name),
+        el('span', { class: c.is_manager ? 'role role-m1nd' : 'role role-ag3nt' },
+          c.is_manager ? 'm1nd' : 'ag3nt'),
+      );
+      // Icon-only nav strip — populated async from `/api/agent/{name}/links`,
+      // a same-origin proxy that forwards the agent backend's own link list
+      // (stats / screen-if-gui / forge profile / agent-configs / extras).
+      // The agent backend is the single source of truth; no hardcoded link
+      // list here (issue #262). DOM-built — link strings come from the
+      // agent's process and must never reach the HTML parser.
+      const navStrip = el('span', { class: 'nav-strip' });
+      head.append(navStrip);
+      const forgeBase = `http://${hostname}:3000`;
+      const containerBase = `http://${hostname}:${c.port}`;
+      if (c.running) {
+        fetch(`/api/agent/${encodeURIComponent(c.name)}/links`)
+          .then((r) => (r.ok ? r.json() : []))
+          .then((links) => {
+            if (!Array.isArray(links)) return;
+            for (const lnk of links) {
+              const href = lnk.kind === 'forge'    ? forgeBase + (lnk.url || '')
+                         : lnk.kind === 'external' ? (lnk.url || '')
+                         : /* container */            containerBase + (lnk.url || '');
+              const a = el('a', {
+                class: 'nav-link',
+                href,
+                target: '_blank',
+                rel: 'noopener',
+                title: lnk.label || '',
+              });
+              // Plain text — agent-controlled strings stay out of innerHTML.
+              a.textContent = lnk.icon || lnk.label || '';
+              navStrip.append(a);
+            }
+          })
+          .catch(() => { /* graceful: agent down → no strip */ });
+      }
+      // Status / runtime badges. Pending transients always win
+      // (start / stop / restart / rebuild is in progress). Otherwise,
+      // when the container is stopped, surface a single `■ not
+      // running` badge; the backend has already cleared rate_limited /
+      // needs_login / ctx_tokens / status_text in that case (#432) so
+      // the rest of the chain is a no-op for stopped containers — but
+      // we still want SOME badge there so the row doesn't look empty.
+      if (pending) {
+        head.append(el('span', { class: 'pending-state' },
+          el('span', { class: 'spinner' }, '◐'), ' ', pending + '…'));
+      } else if (!c.running) {
+        head.append(el('span',
+          { class: 'badge badge-muted', title: 'container is shut down — start it to bring the harness back up' },
+          '■ not running'));
+      } else if (c.rate_limited) {
+        head.append(el('span',
+          { class: 'badge badge-rate-limited', title: 'API rate-limited — harness is parked, will retry automatically' },
+          '⊘ rate limited'));
+      } else if (c.needs_login) {
+        head.append(el('a',
+          { class: 'badge badge-warn', href: url, target: '_blank', rel: 'noopener' },
+          'needs login →'));
+      }
+      if (c.needs_update) {
+        head.append(form(
+          '/rebuild/' + c.name, 'badge badge-warn btn-inline', 'needs update ↻',
+          'rebuild ' + c.name + '? hot-reloads the container.',
+          {}, { noRefresh: true },
+        ));
+      }
+      head.append(el('span', { class: 'meta' }, `${c.container} :${c.port}`));
+      if (c.deployed_sha) {
+        head.append(el('span',
+          { class: 'meta', title: 'sha currently locked in /meta/flake.lock' },
+          `deployed:${c.deployed_sha}`));
+      }
+      if (c.pending_reminders && c.pending_reminders > 0) {
+        head.append(el('span',
+          {
+            class: 'badge badge-reminder',
+            title: 'pending reminders queued for this agent — see the reminders section to view / cancel',
+          },
+          `⏰ ${c.pending_reminders}`));
+      }
+      if (c.ctx_tokens != null) {
+        const k = Math.round(c.ctx_tokens / 1000);
+        // Thresholds track the model's real context window when the
+        // backend supplies it; otherwise fall back to fixed constants.
+        const win = c.context_window_tokens;
+        const warn    = win != null ? win * CTX_WARN_FRACTION    : CTX_WARN_TOKENS;
+        const caution = win != null ? win * CTX_CAUTION_FRACTION : CTX_CAUTION_TOKENS;
+        const ctxClass = c.ctx_tokens >= warn    ? 'badge-ctx-warn'
+          : c.ctx_tokens >= caution ? 'badge-ctx-caution'
+          : 'badge-ctx-ok';
+        const title = win != null
+          ? `last turn context: ${c.ctx_tokens.toLocaleString()} / ${win.toLocaleString()} `
+            + `tokens (${Math.round((c.ctx_tokens / win) * 100)}% of the window)`
+          : `last turn context size: ${c.ctx_tokens.toLocaleString()} tokens`;
+        head.append(el('span',
+          { class: `badge ${ctxClass}`, title },
+          `ctx·${k}k`));
+      }
+      body.append(head);
+
+      // ── agent status text ─────────────────────────────────────────
+      // Self-reported status (via set_status MCP tool) — only fresh
+      // while the harness is up. The backend already clears
+      // `status_text` on stopped containers (#432) so we can render
+      // unconditionally here: a stopped container simply has no
+      // `status_text` and skips this block naturally.
+      if (c.status_text) {
+        const nowUnix = Math.floor(Date.now() / 1000);
+        const ageStr = c.status_set_at != null
+          ? ` (set ${fmtAgeSecs(nowUnix - c.status_set_at)} ago)` : '';
+        body.append(el('div', {
+          class: 'agent-status',
+          title: `agent self-reported status${ageStr}`,
+        },
+          el('span', { class: 'status-icon' }, '◈ '),
+          c.status_text,
+          el('span', { class: 'status-age' }, ageStr),
+        ));
+      }
+
+      // Per-card action buttons used to live here (R3ST4RT / ST0P /
+      // ST4RT / R3BU1LD / DESTR0Y / PURG3). Per mara on #443: "dont
+      // show all the restart buttons etc., just show state and links.
+      // instead, clicking an agent icon selects that agent." Actions
+      // moved into the sticky #selection-bar (see renderSelectionBar)
+      // which appears when the operator has at least one agent
+      // selected via the icon click. The contextual `needs update ↻`
+      // chip in the head row stays — it's a state-hint, not an
+      // action button per se.
+
+      // ── drill-ins ────────────────────────────────────────────────
+      const drill = el('div', { class: 'drill-ins' });
+      // Per-container journald viewer. Opens the side panel and
+      // fetches the last N lines; refresh re-fetches; unit selector
+      // narrows to the harness service (or empty = full machine).
+      const journalUnit = c.is_manager ? 'hive-m1nd.service' : 'hive-ag3nt.service';
+      drill.append(buildJournalTrigger(c.container, journalUnit));
+      // The hardcoded config-repo trigger and the agent-declared
+      // extras block both moved into the unified nav strip in the
+      // head row above (sourced from the agent backend via
+      // `/api/agent/{name}/links` — issue #262). Only the journald
+      // trigger stays here since it opens the side panel rather
+      // than a link.
+      body.append(drill);
+
+      li.append(icon, body);
+      ul.append(li);
+    }
+    root.append(ul);
+    renderSelectionBar(containers);
+  }
+
+  // ─── selection bar (#443) ───────────────────────────────────────────
+  // Sticky-bottom strip; visible when ≥1 agent selected. mara picked
+  // option B: show every action button, disable the ones that don't
+  // apply to the full selection, hover tooltip explains why. Actions
+  // POST per agent in a loop (no new backend wire — endpoints already
+  // exist and are individually idempotent / event-covered).
+  function renderSelectionBar(containers) {
+    const bar = $('selection-bar');
+    if (!bar) return;
+    const countSpan = $('selection-count');
+    const namesSpan = $('selection-names');
+    const actions = $('selection-actions');
+    if (!countSpan || !namesSpan || !actions) return;
+
+    const selected = containers.filter((c) => selectionState.has(c.name));
+    if (!selected.length) {
+      bar.hidden = true;
+      document.body.classList.remove('has-selection');
+      return;
+    }
+    bar.hidden = false;
+    document.body.classList.add('has-selection');
+    countSpan.textContent = selected.length === 1
+      ? '1 agent selected'
+      : selected.length + ' agents selected';
+    namesSpan.textContent = '· ' + selected.map((c) => c.name).join(', ');
+
+    // Recompute action availability + tooltips per render. Each
+    // action declares which agents it CAN'T run on; the bar disables
+    // the button and surfaces the offending names in the tooltip.
+    actions.innerHTML = '';
+    const allRunning = selected.every((c) => c.running);
+    const allStopped = selected.every((c) => !c.running);
+    const noManagers = selected.every((c) => !c.is_manager);
+
+    const stoppedNames = selected.filter((c) => !c.running).map((c) => c.name);
+    const runningNames = selected.filter((c) => c.running).map((c) => c.name);
+    const managerNames = selected.filter((c) => c.is_manager).map((c) => c.name);
+
+    function why(label, blockers) {
+      if (!blockers.length) return null;
+      return `${label} not available — ${blockers.join(', ')} ${blockers.length === 1 ? 'is' : 'are'} blocking it`;
+    }
+
+    addBulkButton(actions, 'btn-restart', '↺ R3ST4RT', allRunning, selected, {
+      action: '/restart/',
+      confirm: (names) => `restart ${names.length} agent${names.length === 1 ? '' : 's'} (${names.join(', ')})?`,
+      disabledTitle: why('↺ R3ST4RT', stoppedNames.map((n) => `\`${n}\` is stopped`)),
+    });
+    // #443 also lifts the manager-stop guard: when the whole selection
+    // is running, ST0P applies — manager included. host-side hive-c0re
+    // keeps serving the dashboard either way + per-agent approvals +
+    // meta-input updates still work without the manager up, so we
+    // don't special-case the confirm prompt when the manager is in
+    // the selection (mara: "dont special case manager for stopping").
+    addBulkButton(actions, 'btn-stop', '■ ST0P', allRunning, selected, {
+      action: '/kill/',
+      confirm: (names) => `stop ${names.length} agent${names.length === 1 ? '' : 's'} (${names.join(', ')})?`,
+      disabledTitle: why('■ ST0P', stoppedNames.map((n) => `\`${n}\` is already stopped`)),
+    });
+    addBulkButton(actions, 'btn-start', '▶ ST4RT', allStopped, selected, {
+      action: '/start/',
+      confirm: (names) => `start ${names.length} agent${names.length === 1 ? '' : 's'} (${names.join(', ')})?`,
+      disabledTitle: why('▶ ST4RT', runningNames.map((n) => `\`${n}\` is already running`)),
+    });
+    addBulkButton(actions, 'btn-rebuild', '↻ R3BU1LD', true, selected, {
+      action: '/rebuild/',
+      confirm: (names) => `rebuild ${names.length} agent${names.length === 1 ? '' : 's'} (${names.join(', ')})? hot-reloads each container.`,
+    });
+    // DESTR0Y / PURG3: sub-agents only (manager has its own
+    // `refusing to destroy` guard at the host layer). When the
+    // selection includes the manager, both buttons go disabled with a
+    // clear reason rather than letting the operator submit and eat a
+    // 500.
+    addBulkButton(actions, 'btn-destroy', 'DESTR0Y', noManagers, selected, {
+      action: '/destroy/',
+      confirm: (names) => `destroy ${names.length} agent${names.length === 1 ? '' : 's'} (${names.join(', ')})? containers are removed; state + creds kept.`,
+      disabledTitle: why('DESTR0Y', managerNames.map((n) => `\`${n}\` is the manager`)),
+    });
+    addBulkButton(actions, 'btn-destroy', 'PURG3', noManagers, selected, {
+      action: '/destroy/',
+      body: { purge: 'on' },
+      confirm: (names) => `PURGE ${names.length} agent${names.length === 1 ? '' : 's'} (${names.join(', ')})? containers, config history, claude creds, and notes are all WIPED. no undo.`,
+      disabledTitle: why('PURG3', managerNames.map((n) => `\`${n}\` is the manager`)),
+    });
+  }
+
+  function addBulkButton(parent, btnClass, label, enabled, selected, opts) {
+    const names = selected.map((c) => c.name);
+    const btn = el('button', {
+      type: 'button',
+      class: 'btn ' + btnClass,
+    }, label);
+    if (!enabled) {
+      btn.disabled = true;
+      if (opts.disabledTitle) btn.title = opts.disabledTitle;
+    }
+    btn.addEventListener('click', async () => {
+      if (btn.disabled) return;
+      const msg = opts.confirm(names);
+      if (msg && !confirm(msg)) return;
+      btn.disabled = true;
+      const original = btn.innerHTML;
+      btn.innerHTML = '<span class="spinner">◐</span> ' + label;
+      const failures = [];
+      // Sequential POSTs to keep server-side serialisation predictable
+      // (rebuild_queue dedups but other endpoints don't); the loop is
+      // short — bulk selections are typically a handful of agents.
+      for (const name of names) {
+        const body = new URLSearchParams(opts.body || {});
+        try {
+          const resp = await fetch(opts.action + encodeURIComponent(name), {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body,
+            redirect: 'manual',
+          });
+          const ok = resp.ok || resp.type === 'opaqueredirect'
+            || (resp.status >= 200 && resp.status < 400);
+          if (!ok) {
+            const text = await resp.text().catch(() => '');
+            failures.push(`${name}: http ${resp.status}${text ? ' — ' + text.slice(0, 200) : ''}`);
+          }
+        } catch (err) {
+          failures.push(`${name}: ${err}`);
+        }
+      }
+      btn.disabled = false;
+      btn.innerHTML = original;
+      if (failures.length) {
+        alert(`${label} completed with ${failures.length} failure${failures.length === 1 ? '' : 's'}:\n\n` + failures.join('\n'));
+      }
+      // Container-lifecycle events (ContainerStateChanged /
+      // ContainerRemoved / RebuildQueueChanged) flow over the existing
+      // SSE channel and update the derived stores live — no manual
+      // refresh needed.
+    });
+    parent.append(btn);
+  }
+
+  // Per-container journald viewer. Returns an inline trigger; the
+  // click opens the side panel and fetches the last N lines. Refresh
+  // re-fetches; the unit toggle switches between the harness service
+  // and the full machine journal.
+  function buildJournalTrigger(containerName, defaultUnit) {
+    const trigger = el('button', { type: 'button', class: 'panel-trigger' },
+      '↳ logs · ' + containerName);
+    trigger.addEventListener('click', () => {
+      const body = el('div', { class: 'journal-body' });
+      const controls = el('div', { class: 'journal-controls' });
+      const unitSelect = el('select', { class: 'journal-unit' });
+      unitSelect.append(
+        el('option', { value: defaultUnit }, defaultUnit),
+        el('option', { value: '' }, '(full machine journal)'),
+      );
+      const refresh = el('button', { type: 'button', class: 'btn btn-restart journal-refresh' },
+        '↻ refresh');
+      const pre = el('pre', { class: 'journal-output' }, 'fetching…');
+      let fetching = false;
+      async function fetchLogs() {
+        if (fetching) return;
+        fetching = true;
+        pre.textContent = 'fetching…';
+        const unit = unitSelect.value;
+        const params = new URLSearchParams({ lines: '500' });
+        if (unit) params.set('unit', unit);
+        try {
+          const resp = await fetch('/api/journal/' + containerName + '?' + params);
+          const text = await resp.text();
+          if (!resp.ok) {
+            pre.textContent = 'error: ' + resp.status + '\n' + text;
+          } else {
+            pre.textContent = text || '(empty)';
+            // Auto-scroll the panel to the newest lines on fresh fetch.
+            const sb = $('side-panel-body');
+            if (sb) sb.scrollTop = sb.scrollHeight;
+          }
+        } catch (err) {
+          pre.textContent = 'fetch failed: ' + err;
+        } finally {
+          fetching = false;
+        }
+      }
+      refresh.addEventListener('click', (e) => { e.preventDefault(); fetchLogs(); });
+      unitSelect.addEventListener('change', fetchLogs);
+      controls.append(unitSelect, refresh);
+      body.append(controls, pre);
+      Panel.open('logs · ' + containerName, body);
+      fetchLogs();
+    });
+    return trigger;
+  }
+
+  function renderTombstones(s) {
+    const root = $('tombstones-section');
+    // #tombstones-section only lives on /index.html (SYST3M tab);
+    // no-op on /flow.html and any other page that loads the shared
+    // bundle without the dashboard's tab panes (#399).
+    if (!root) return;
+    root.innerHTML = '';
+    if (!s.tombstones || !s.tombstones.length) {
+      root.append(el('p', { class: 'empty' }, 'no kept state — clean'));
+      return;
+    }
+    const fmtBytes = (n) => {
+      if (n < 1024) return n + ' B';
+      if (n < 1024 * 1024) return (n / 1024).toFixed(1) + ' KB';
+      if (n < 1024 * 1024 * 1024) return (n / (1024 * 1024)).toFixed(1) + ' MB';
+      return (n / (1024 * 1024 * 1024)).toFixed(2) + ' GB';
+    };
+    const fmtAge = (ts) => {
+      if (!ts) return '?';
+      const d = Math.floor((Date.now() / 1000 - ts) / 86400);
+      if (d <= 0) return 'today';
+      if (d === 1) return '1 day ago';
+      return d + ' days ago';
+    };
+    const ul = el('ul', { class: 'containers' });
+    for (const t of s.tombstones) {
+      const li = el('li', { class: 'container-row tombstone' });
+      const head = el('div', { class: 'head' });
+      head.append(
+        el('span', { class: 'name' }, t.name),
+        el('span', { class: 'badge badge-muted' }, 'destroyed'),
+      );
+      if (t.has_creds) {
+        head.append(el('span', { class: 'badge badge-muted' }, 'creds kept'));
+      }
+      head.append(el('span', { class: 'meta' },
+        `${fmtBytes(t.state_bytes)} · ${fmtAge(t.last_seen)}`));
+      li.append(head);
+
+      const actions = el('div', { class: 'actions' });
+      // Reuse the existing spawn form pattern via /request-spawn — operator
+      // can queue an approval that recreates the agent with the same name
+      // and reuses the kept state.
+      const respawn = el('form', {
+        method: 'POST', action: '/request-spawn',
+        class: 'inline', 'data-async': '',
+        'data-confirm': 'queue spawn approval for ' + t.name + '? state will be reused.',
+      });
+      respawn.append(
+        el('input', { type: 'hidden', name: 'name', value: t.name }),
+        el('button', { type: 'submit', class: 'btn btn-start' }, '⊕ R3V1V3'),
+      );
+      actions.append(respawn);
+      actions.append(form(
+        '/purge-tombstone/' + t.name, 'btn-destroy', 'PURG3',
+        'PURGE ' + t.name + '? config history, claude creds, '
+        + 'and notes are all WIPED. no undo.',
+        {}, { noRefresh: true },
+      ));
+      li.append(actions);
+      ul.append(li);
+    }
+    root.append(ul);
+  }
+
+  // Derived question state — cold-loaded from /api/state, then mutated
+  // live by `question_added` / `question_resolved` dashboard events.
+  const QUESTION_HISTORY_LIMIT = 20;
+  const questionsState = { pending: [], history: [] };
+  function syncQuestionsFromSnapshot(s) {
+    questionsState.pending = (s.questions || []).slice();
+    questionsState.history = (s.question_history || []).slice();
+  }
+  function applyQuestionAdded(ev) {
+    if (questionsState.pending.some((q) => q.id === ev.id)) return;
+    questionsState.pending.push({
+      id: ev.id,
+      asker: ev.asker,
+      question: ev.question,
+      options: ev.options || [],
+      multi: !!ev.multi,
+      asked_at: ev.asked_at,
+      deadline_at: ev.deadline_at ?? null,
+      target: ev.target || null,
+      question_refs: ev.question_refs || [],
+    });
+    renderQuestions();
+  }
+  function applyQuestionResolved(ev) {
+    const idx = questionsState.pending.findIndex((q) => q.id === ev.id);
+    const existing = idx >= 0 ? questionsState.pending[idx] : null;
+    if (idx >= 0) questionsState.pending.splice(idx, 1);
+    // Idempotent: a snapshot re-sync (issue #163) can carry this same
+    // answered row in `question_history` while a live event also
+    // delivers it — guard the unshift so history can't double a row.
+    if (!questionsState.history.some((h) => h.id === ev.id)) {
+      questionsState.history.unshift({
+        id: ev.id,
+        asker: existing?.asker || '?',
+        question: existing?.question || '',
+        options: existing?.options || [],
+        multi: existing?.multi || false,
+        asked_at: existing?.asked_at || ev.answered_at,
+        answered_at: ev.answered_at,
+        answer: ev.answer,
+        answerer: ev.answerer,
+        target: existing?.target ?? ev.target ?? null,
+        question_refs: existing?.question_refs || [],
+        answer_refs: ev.answer_refs || [],
+      });
+      if (questionsState.history.length > QUESTION_HISTORY_LIMIT) {
+        questionsState.history.length = QUESTION_HISTORY_LIMIT;
+      }
+    }
+    renderQuestions();
+  }
+  // Filter selection for the questions section. Persisted so the
+  // operator's preferred view (all / operator-targeted / peer)
+  // survives a reload.
+  const QUESTIONS_FILTER_KEY = 'hyperhive:questions:filter';
+  function getQuestionsFilter() {
+    return localStorage.getItem(QUESTIONS_FILTER_KEY) || 'all';
+  }
+  function setQuestionsFilter(v) {
+    localStorage.setItem(QUESTIONS_FILTER_KEY, v);
+    renderQuestions();
+  }
+  function questionMatchesFilter(q, filter) {
+    if (filter === 'all') return true;
+    if (filter === 'operator') return !q.target;
+    if (filter === 'peer') return !!q.target;
+    // `agent:<name>` matches when the agent appears as asker OR target.
+    if (filter.startsWith('agent:')) {
+      const name = filter.slice('agent:'.length);
+      return q.asker === name || q.target === name;
+    }
+    return true;
+  }
+  function renderQuestions() {
+    const root = $('questions-section');
+    // #questions-section only lives on /index.html (Y3R C4LL tab);
+    // no-op when missing (#406 step 3 — only /index.html loads
+    // tabs.js, but kept as belt-and-suspenders for any future page
+    // adding it without that section). `question_added` /
+    // `question_resolved` SSE events route through here (#399).
+    if (!root) return;
+    root.innerHTML = '';
+    const fmt = (n) => new Date(n * 1000).toISOString().replace('T', ' ').slice(0, 19);
+    const allPending = questionsState.pending;
+    const activeFilter = getQuestionsFilter();
+    const pending = allPending.filter((q) => questionMatchesFilter(q, activeFilter));
+
+    // Filter chips. Always include `all` / `operator` / `peer`; add
+    // per-agent chips for any agent that appears as asker or target
+    // in the pending list so the operator can isolate a single
+    // thread without typing.
+    const participants = new Set();
+    for (const q of allPending) {
+      participants.add(q.asker);
+      if (q.target) participants.add(q.target);
+    }
+    const filterRow = el('div', { class: 'questions-filters' });
+    const mkChip = (value, label) => {
+      const b = el('button', {
+        type: 'button',
+        class: 'q-filter-chip' + (activeFilter === value ? ' active' : ''),
+      }, label);
+      b.addEventListener('click', () => setQuestionsFilter(value));
+      return b;
+    };
+    filterRow.append(
+      mkChip('all', `all · ${allPending.length}`),
+      mkChip('operator', '@operator'),
+      mkChip('peer', '@peer'),
+    );
+    for (const name of Array.from(participants).sort()) {
+      filterRow.append(mkChip('agent:' + name, '@' + name));
+    }
+    root.append(filterRow);
+
+    if (!pending.length) {
+      root.append(el('p', { class: 'empty' },
+        activeFilter === 'all' ? 'no pending questions' : 'no questions match this filter'));
+    }
+    const ul = el('ul', { class: 'questions' });
+    for (const q of pending) {
+      const targetLabel = q.target || 'operator';
+      const li = el('li', { class: 'question' + (q.target ? ' question-peer' : '') });
+      const head = el('div', { class: 'q-head' },
+        el('span', { class: 'msg-ts' }, fmt(q.asked_at)), ' ',
+        el('span', { class: 'msg-from' }, q.asker), ' ',
+        el('span', { class: 'msg-sep' }, '→'), ' ',
+        el('span', { class: q.target ? 'msg-to msg-to-peer' : 'msg-to' }, targetLabel), ' ',
+        el('span', { class: 'msg-sep' }, 'asks:'),
+      );
+      if (q.deadline_at) {
+        // Tag the chip with its deadline so the global 1s ticker
+        // (set up just below this function) can refresh the text
+        // without re-rendering the whole questions section
+        // (issue #335).
+        const ttlEl = el('span', {
+          class: 'q-ttl', 'data-deadline': String(q.deadline_at),
+        });
+        ttlEl.textContent = formatTtl(
+          q.deadline_at - Math.floor(Date.now() / 1000),
+        );
+        head.append(' ', ttlEl);
+      }
+      const qBody = el('div', { class: 'q-body' });
+      appendLinkified(qBody, q.question, q.question_refs);
+      li.append(head, qBody);
+      const f = el('form', {
+        method: 'POST', action: '/answer-question/' + q.id,
+        class: 'qform', 'data-async': '', 'data-no-refresh': '',
+      });
+      const hasOptions = q.options && q.options.length;
+      const isMulti = !!q.multi && hasOptions;
+      const freeText = el('textarea', {
+        name: 'answer-free', rows: '2', autocomplete: 'off',
+        placeholder: (hasOptions ? 'or type your own…' : 'your answer')
+          + '  (shift+enter for newline)',
+      });
+      // Enter submits; shift+enter inserts a newline (textarea default).
+      freeText.addEventListener('keydown', (e) => {
+        if (e.key === 'Enter' && !e.shiftKey) {
+          e.preventDefault();
+          f.requestSubmit();
+        }
+      });
+      const optionGroup = el('div', { class: 'q-options' });
+      if (hasOptions) {
+        for (const opt of q.options) {
+          const inputType = isMulti ? 'checkbox' : 'radio';
+          const id = 'q' + q.id + '-' + Math.random().toString(36).slice(2, 8);
+          const input = el('input', { type: inputType, name: 'choice', value: opt, id });
+          const label = el('label', { for: id }, ' ' + opt);
+          optionGroup.append(el('div', { class: 'q-option' }, input, label));
+        }
+      }
+      // On submit, build the final `answer` field from selected
+      // options + free-text, joined by ', '. This lets the operator
+      // pick options AND add free text in the same form.
+      f.addEventListener('submit', (ev) => {
+        const parts = [];
+        for (const cb of f.querySelectorAll('input[name="choice"]:checked')) {
+          parts.push(cb.value);
+        }
+        const ft = (freeText.value || '').trim();
+        if (ft) parts.push(ft);
+        const merged = parts.join(', ');
+        // Replace the existing hidden `answer` (if any) with the merged value.
+        const existing = f.querySelector('input[name="answer"]');
+        if (existing) existing.remove();
+        f.append(el('input', { type: 'hidden', name: 'answer', value: merged }));
+        if (!merged) { ev.preventDefault(); alert('pick an option or type an answer'); }
+      }, true);
+      if (hasOptions) f.append(optionGroup);
+      const buttons = el('div', { class: 'q-buttons' });
+      // On peer threads the operator's answer is an override —
+      // mark the button so it's clear what the click does (the
+      // backend permits it via OperatorQuestions::answer's
+      // answerer-auth rule).
+      const answerLabel = q.target
+        ? (isMulti ? '⤿ 0V3RR1D3 · ' + q.options.length + ' opts' : '⤿ 0V3RR1D3')
+        : (isMulti ? '▸ ANSW3R · ' + q.options.length + ' opts' : '▸ ANSW3R');
+      buttons.append(
+        el('button', {
+          type: 'submit',
+          class: 'btn btn-approve' + (q.target ? ' btn-override' : ''),
+          title: q.target ? `override-answer on behalf of operator (target was ${q.target})` : '',
+        }, answerLabel),
+      );
+      f.append(
+        el('div', { class: 'q-free' }, freeText),
+        buttons,
+      );
+      li.append(f);
+      // Separate form so the cancel button doesn't get the answer
+      // merge-on-submit handler attached to the main form.
+      const cancelTargetLabel = q.target ? q.target : 'asker';
+      const cancelForm = el('form', {
+        method: 'POST', action: '/cancel-question/' + q.id,
+        class: 'qform-cancel', 'data-async': '', 'data-no-refresh': '',
+        'data-confirm': `cancel this question? ${cancelTargetLabel} will see `
+          + '"[cancelled]" as the answer.',
+      });
+      cancelForm.append(
+        el('button', { type: 'submit', class: 'btn btn-deny' }, '✗ CANC3L'),
+      );
+      li.append(cancelForm);
+      ul.append(li);
+    }
+    if (pending.length) root.append(ul);
+
+    // Answered question history
+    const hist = questionsState.history;
+    if (hist.length) {
+      const details = el('details', { class: 'q-history', 'data-restore-key': 'q-history' });
+      details.append(el('summary', {}, '◆ answ3red (' + hist.length + ')'));
+      const hul = el('ul', { class: 'questions questions-answered' });
+      for (const q of hist) {
+        const targetLabel = q.target || 'operator';
+        const li = el('li', { class: 'question question-answered' + (q.target ? ' question-peer' : '') });
+        const head = el('div', { class: 'q-head' },
+          el('span', { class: 'msg-ts' }, fmt(q.answered_at)), ' ',
+          el('span', { class: 'msg-from' }, q.asker), ' ',
+          el('span', { class: 'msg-sep' }, '→'), ' ',
+          el('span', { class: q.target ? 'msg-to msg-to-peer' : 'msg-to' }, targetLabel), ' ',
+          el('span', { class: 'msg-sep' }, 'asked:'),
+        );
+        const histBody = el('div', { class: 'q-body' });
+        appendLinkified(histBody, q.question, q.question_refs);
+        const ansText = el('span', { class: 'q-answer-text' });
+        appendLinkified(ansText, q.answer || '(none)', q.answer_refs);
+        const ansLine = el('div', { class: 'q-answer' },
+          el('span', { class: 'msg-sep' }, `${q.answerer || '?'}: `),
+          ansText,
+        );
+        li.append(head, histBody, ansLine);
+        hul.append(li);
+      }
+      details.append(hul);
+      root.append(details);
+    }
+  }
+
+  // Format a remaining-seconds count as the `⏳ …` TTL chip text on a
+  // question card. Bucketed at minutes / hours so a long deadline stays
+  // readable; "expiring…" once the deadline has passed (the host-side
+  // ttl-watchdog will fire shortly).
+  function formatTtl(remaining) {
+    if (remaining <= 0) return 'expiring…';
+    if (remaining < 60) return '⏳ ' + remaining + 's';
+    if (remaining < 3600) {
+      return '⏳ ' + Math.floor(remaining / 60) + 'm '
+        + (remaining % 60) + 's';
+    }
+    return '⏳ ' + Math.floor(remaining / 3600) + 'h '
+      + Math.floor((remaining % 3600) / 60) + 'm';
+  }
+
+  // Single page-wide ticker that refreshes every TTL chip in place
+  // each second (issue #335). Renderers stamp `data-deadline` on the
+  // chip; this just updates `textContent`, no re-render of the
+  // questions section. No-op when no chips are on screen, so the
+  // cost is negligible.
+  setInterval(() => {
+    const now = Math.floor(Date.now() / 1000);
+    document.querySelectorAll('.q-ttl[data-deadline]').forEach((node) => {
+      const deadline = Number(node.getAttribute('data-deadline'));
+      if (!Number.isFinite(deadline)) return;
+      node.textContent = formatTtl(deadline - now);
+    });
+  }, 1000);
+
+  // Operator-inbox derived store moved to ./flow.js (#406 step 2).
+
+  const APPROVAL_TAB_KEY = 'hyperhive:approvals:tab';
+  // Derived approval state — cold-loaded from /api/state, then mutated
+  // live by `approval_added` / `approval_resolved` dashboard events.
+  // `pending` is the open queue (newest-first); `history` is the last
+  // 30 resolved rows.
+  const APPROVAL_HISTORY_LIMIT = 30;
+  const approvalsState = { pending: [], history: [] };
+  function syncApprovalsFromSnapshot(s) {
+    approvalsState.pending = (s.approvals || []).slice();
+    approvalsState.history = (s.approval_history || []).slice();
+  }
+  function applyApprovalAdded(ev) {
+    // Upsert by id so a snapshot that already included the row (cold
+    // load + event lands at the same tick) doesn't double it.
+    const existing = approvalsState.pending.findIndex((a) => a.id === ev.id);
+    const row = {
+      id: ev.id,
+      agent: ev.agent,
+      kind: ev.approval_kind,
+      sha_short: ev.sha_short || null,
+      diff: ev.diff || null,
+      description: ev.description || null,
+      // The ApprovalAdded event carries no requested_at; a live-added
+      // approval was queued just now, so client-now is accurate — and
+      // consistent with how fmtAgo compares everything to client-now.
+      // A later /api/state cold-load swaps in the server value. (#272)
+      requested_at: ev.requested_at != null
+        ? ev.requested_at : Math.floor(Date.now() / 1000),
+    };
+    if (existing >= 0) approvalsState.pending[existing] = row;
+    else approvalsState.pending.push(row);
+    renderApprovals();
+  }
+  function applyApprovalResolved(ev) {
+    // Drop from pending; prepend to history (newest-first), cap at 30.
+    approvalsState.pending = approvalsState.pending.filter((a) => a.id !== ev.id);
+    // Idempotent: a snapshot re-sync (issue #163) can carry this same
+    // resolved row in `approval_history` while a live event also
+    // delivers it — guard the unshift so history can't double a row.
+    if (!approvalsState.history.some((h) => h.id === ev.id)) {
+      approvalsState.history.unshift({
+        id: ev.id,
+        agent: ev.agent,
+        kind: ev.approval_kind,
+        sha_short: ev.sha_short || null,
+        status: ev.status,
+        resolved_at: ev.resolved_at,
+        note: ev.note || null,
+        description: ev.description || null,
+      });
+      if (approvalsState.history.length > APPROVAL_HISTORY_LIMIT) {
+        approvalsState.history.length = APPROVAL_HISTORY_LIMIT;
+      }
+    }
+    renderApprovals();
+  }
+  // Classify each unified-diff line by its leading char so
+  // `.diff-add` / `.diff-del` / `.diff-hunk` / `.diff-file` /
+  // `.diff-ctx` colour the output. Built as text-only spans (no
+  // innerHTML) so there's no HTML-escape surface.
+  function buildDiffPre(text) {
+    const pre = el('pre', { class: 'diff' });
+    for (const raw of String(text).split('\n')) {
+      let cls = 'diff-ctx';
+      if (raw.startsWith('--- ') || raw.startsWith('+++ ')) cls = 'diff-file';
+      else if (raw.startsWith('@')) cls = 'diff-hunk';
+      else if (raw.startsWith('+')) cls = 'diff-add';
+      else if (raw.startsWith('-')) cls = 'diff-del';
+      const span = document.createElement('span');
+      span.className = cls;
+      span.textContent = raw + '\n';
+      pre.appendChild(span);
+    }
+    return pre;
+  }
+
+  // Open an approval's diff in the side panel with a 3-way base
+  // toggle: vs applied (running tree), vs last-approved, vs previous
+  // proposal. `applied` uses the diff already shipped on the approval
+  // for instant paint; the other two fetch /api/approval-diff.
+  function openDiffPanel(a) {
+    const bases = [
+      ['applied', 'vs applied'],
+      ['approved', 'vs last-approved'],
+      ['previous', 'vs previous proposal'],
+    ];
+    const tabs = el('div', { class: 'diff-base-tabs' });
+    const host = el('div', { class: 'diff-host' });
+    async function selectBase(base) {
+      for (const btn of tabs.children) {
+        btn.classList.toggle('active', btn.dataset.base === base);
+      }
+      if (base === 'applied' && a.diff != null) {
+        host.replaceChildren(buildDiffPre(a.diff));
+        return;
+      }
+      host.replaceChildren(el('div', { class: 'meta' }, 'loading…'));
+      try {
+        const resp = await fetch('/api/approval-diff/' + a.id + '?base=' + base);
+        const text = await resp.text();
+        host.replaceChildren(resp.ok
+          ? buildDiffPre(text)
+          : el('div', { class: 'meta' }, 'error: ' + text));
+      } catch (e) {
+        host.replaceChildren(el('div', { class: 'meta' }, 'error: ' + e));
+      }
+    }
+    for (const [base, label] of bases) {
+      const btn = el('button',
+        { type: 'button', class: 'diff-base-tab', 'data-base': base }, label);
+      btn.addEventListener('click', () => selectBase(base));
+      tabs.append(btn);
+    }
+    const wrap = el('div', { class: 'diff-panel' }, tabs, host);
+    Panel.open('diff · ' + a.agent + ' #' + a.id, wrap);
+    selectBase('applied');
+  }
+
+  function renderApprovals() {
+    const root = $('approvals-section');
+    // #approvals-section only lives on /index.html (Y3R C4LL tab);
+    // no-op elsewhere — `approval_added` / `approval_resolved` SSE
+    // events route through here on every page that loads the bundle
+    // (#399).
+    if (!root) return;
+    root.innerHTML = '';
+
+    // Spawn request form: submitting it queues a Spawn approval that
+    // lands in this same list, so the form belongs here rather than on
+    // the containers list (the agent doesn't exist yet).
+    const spawn = el('form', {
+      method: 'POST', action: '/request-spawn',
+      class: 'spawnform', 'data-async': '', 'data-no-refresh': '',
+    });
+    spawn.append(
+      el('input', {
+        name: 'name',
+        placeholder: 'new agent name (≤9 chars)',
+        maxlength: '9', required: '', autocomplete: 'off',
+      }),
+      el('button', { type: 'submit', class: 'btn btn-spawn' }, '◆ R3QU3ST SP4WN'),
+    );
+    root.append(spawn);
+
+    const pending = approvalsState.pending;
+    const history = approvalsState.history;
+    const active = localStorage.getItem(APPROVAL_TAB_KEY) || 'pending';
+    const tabs = el('div', { class: 'approval-tabs' });
+    const pendingTab = el(
+      'button',
+      {
+        type: 'button',
+        class: 'approval-tab' + (active === 'pending' ? ' active' : ''),
+      },
+      `pending · ${pending.length}`,
+    );
+    const historyTab = el(
+      'button',
+      {
+        type: 'button',
+        class: 'approval-tab' + (active === 'history' ? ' active' : ''),
+      },
+      `history · ${history.length}`,
+    );
+    pendingTab.addEventListener('click', () => {
+      localStorage.setItem(APPROVAL_TAB_KEY, 'pending');
+      renderApprovals();
+    });
+    historyTab.addEventListener('click', () => {
+      localStorage.setItem(APPROVAL_TAB_KEY, 'history');
+      renderApprovals();
+    });
+    tabs.append(pendingTab, historyTab);
+    root.append(tabs);
+
+    if (active === 'history') {
+      renderApprovalHistory(root, history);
+      return;
+    }
+
+    if (!pending.length) {
+      root.append(el('p', { class: 'empty' }, 'queue empty'));
+      return;
+    }
+    // forge link base — only when the hive-forge container is up.
+    const fs = window.__hyperhive_state;
+    const hostname = (fs && fs.hostname) || window.location.hostname;
+    const forgeBase = (fs && fs.forge_present) ? `http://${hostname}:3000` : null;
+
+    const ul = el('ul', { class: 'approvals' });
+    for (const a of pending) {
+      const isApply = a.kind === 'apply_commit';
+      const isInit = a.kind === 'init_config';
+      const li = el('li', { class: 'approval-card' });
+
+      // ── identity header ──────────────────────────────────────────
+      const head = el('div', { class: 'approval-head' },
+        el('span', { class: 'glyph' }, isApply ? '→' : '⊕'),
+        el('span', { class: 'id' }, '#' + a.id),
+        el('span', { class: 'agent' }, a.agent),
+        el('span', { class: 'kind' + (isApply ? '' : ' kind-spawn') },
+          isApply ? 'apply' : isInit ? 'init' : 'spawn'),
+      );
+      if (isApply && a.sha_short) head.append(el('code', {}, a.sha_short));
+      // When the approval was requested — relative time, right-aligned.
+      // Goes amber once it's been pending an hour so a stale request is
+      // obvious at a glance. (issue #272)
+      if (a.requested_at != null) {
+        const ageSec = Math.max(0, Math.floor(Date.now() / 1000 - a.requested_at));
+        head.append(el('span', {
+          class: 'approval-ts' + (ageSec >= 3600 ? ' stale' : ''),
+          title: 'requested ' + new Date(a.requested_at * 1000).toLocaleString(),
+        }, 'requested ' + fmtAgo(a.requested_at)));
+      }
+      li.append(head);
+
+      // ── what-changed body ────────────────────────────────────────
+      const body = el('div', { class: 'approval-body' });
+      if (a.description) {
+        body.append(el('div', { class: 'approval-description' }, a.description));
+      }
+      if (isApply) {
+        const drill = el('div', { class: 'drill-ins' });
+        const diffBtn = el('button', { type: 'button', class: 'panel-trigger' },
+          '↳ view diff');
+        diffBtn.addEventListener('click', () => openDiffPanel(a));
+        drill.append(diffBtn);
+        if (forgeBase && a.sha_short) {
+          drill.append(el('a', {
+            class: 'panel-trigger', target: '_blank', rel: 'noopener',
+            href: `${forgeBase}/agent-configs/${a.agent}/commit/${a.sha_short}`,
+            title: 'this proposal commit on the hive forge',
+          }, '↳ commit on forge ↗'));
+        }
+        body.append(drill);
+      } else {
+        body.append(el('span', { class: 'meta' },
+          isInit
+            ? 'scaffold proposed config repo — manager customises agent.nix before spawn'
+            : 'new sub-agent — container will be created on approve'));
+      }
+      li.append(body);
+
+      // ── decision actions ─────────────────────────────────────────
+      // Deny prompts the operator for an optional reason; the submit
+      // handler stashes it into a hidden `note` input that rides along
+      // on the POST and is surfaced to the manager via
+      // HelperEvent::ApprovalResolved { note }.
+      const denyForm = el('form', {
+        method: 'POST', action: '/deny/' + a.id,
+        class: 'inline', 'data-async': '', 'data-no-refresh': '',
+        'data-prompt': 'reason for denying (optional, sent to manager):',
+      });
+      denyForm.append(el('button', { type: 'submit', class: 'btn btn-deny' }, 'DENY'));
+      li.append(el('div', { class: 'approval-actions' },
+        form('/approve/' + a.id, 'btn-approve', '◆ APPR0VE', null, {}, { noRefresh: true }),
+        denyForm,
+      ));
+
+      ul.append(li);
+    }
+    root.append(ul);
+  }
+
+  function renderApprovalHistory(root, history) {
+    if (!history.length) {
+      root.append(el('p', { class: 'empty' }, 'no resolved approvals yet'));
+      return;
+    }
+    const ul = el('ul', { class: 'approvals approvals-history' });
+    for (const a of history) {
+      const li = el('li');
+      const row = el('div', { class: 'row' });
+      const glyph = a.status === 'approved' ? '✓'
+        : a.status === 'denied' ? '✗'
+        : a.status === 'cancelled' ? '⊘'
+        : '⚠';
+      row.append(
+        el('span', { class: 'glyph glyph-' + a.status }, glyph), ' ',
+        el('span', { class: 'id' }, '#' + a.id), ' ',
+        el('span', { class: 'agent' }, a.agent), ' ',
+        el('span', { class: 'kind' }, a.kind === 'apply_commit' ? 'apply' : 'spawn'), ' ',
+      );
+      if (a.sha_short) row.append(el('code', {}, a.sha_short), ' ');
+      row.append(
+        el('span', { class: 'status status-' + a.status }, a.status), ' ',
+        el('span', { class: 'msg-ts' }, fmtAgo(a.resolved_at)),
+      );
+      li.append(row);
+      if (a.note) {
+        li.append(el('div', { class: 'history-note' }, a.note));
+      }
+      ul.append(li);
+    }
+    root.append(ul);
+  }
+
+  // Relative time, anchored to now. resolved_at is unix seconds (server-
+  // authored), so we don't have to worry about client/server clock skew
+  // for sub-minute precision.
+  function fmtAgo(unixSecs) {
+    const ageSec = Math.max(0, Math.floor(Date.now() / 1000 - unixSecs));
+    if (ageSec < 60) return ageSec + 's ago';
+    if (ageSec < 3600) return Math.floor(ageSec / 60) + 'm ago';
+    if (ageSec < 86400) return Math.floor(ageSec / 3600) + 'h ago';
+    return Math.floor(ageSec / 86400) + 'd ago';
+  }
+
+  function renderMetaInputs(s) {
+    const root = $('meta-inputs-section');
+    if (!root) return;
+    root.innerHTML = '';
+    const inputs = s.meta_inputs || [];
+    if (!inputs.length) {
+      root.append(el('p', { class: 'empty' }, 'meta repo not seeded yet'));
+      return;
+    }
+    if (metaUpdateRunning) {
+      root.append(el('p', { class: 'meta-update-running' },
+        '⏳ meta-update running — flake lock bump + affected agents rebuilding. '
+        + 'watch the agent cards for per-rebuild progress.'));
+    }
+    const form = el('form', {
+      method: 'POST',
+      action: '/meta-update',
+      class: 'meta-inputs-form',
+      'data-async': '',
+      // run_meta_update emits MetaInputsChanged once the lock
+      // bump finishes; per-agent rebuilds fire their own
+      // ContainerStateChanged. No /api/state refetch needed.
+      'data-no-refresh': '',
+      'data-confirm': 'update selected meta flake inputs + rebuild affected agents?',
+    });
+    // Bulk select — the full input tree gets long; ticking each box
+    // one by one is tedious (issue #275).
+    const bulk = el('div', { class: 'meta-inputs-bulk' });
+    const selAll = el('button', { type: 'button', class: 'meta-bulk-btn' }, 'select all');
+    const selNone = el('button', { type: 'button', class: 'meta-bulk-btn' }, 'select none');
+    bulk.append('bulk: ', selAll, ' ', selNone);
+    form.append(bulk);
+    const ul = el('ul', { class: 'meta-inputs' });
+    for (const inp of inputs) {
+      // `name` is a slash-path from the meta root. Indent depth = its
+      // segment count; the row label shows just the leaf segment, the
+      // full path stays as the checkbox value + the label title.
+      const depth = (inp.name.match(/\//g) || []).length;
+      const leaf = inp.name.slice(inp.name.lastIndexOf('/') + 1);
+      const li = el('li');
+      if (depth > 0) li.style.marginLeft = (depth * 1.3) + 'em';
+      const id = 'meta-input-' + inp.name.replace(/[^a-z0-9-]/gi, '_');
+      const cb = el('input', {
+        type: 'checkbox',
+        name: 'meta_input_' + inp.name,
+        id,
+        value: inp.name,
+        'data-meta-input': inp.name,
+      });
+      const label = el('label', { for: id, title: inp.name });
+      label.append(cb);
+      if (depth > 0) label.append(el('span', { class: 'meta-input-twig' }, '└ '));
+      label.append(
+        el('span', { class: 'meta-input-name' }, leaf), ' ',
+        el('code', { class: 'meta-input-rev' }, inp.rev.slice(0, 12)), ' ',
+        el('span', { class: 'meta-input-ts' }, fmtAgo(inp.last_modified)),
+      );
+      if (inp.url) {
+        label.append(' ', el('span', { class: 'meta-input-url', title: inp.url },
+          '· ' + truncate(inp.url, 48)));
+      }
+      li.append(label);
+      ul.append(li);
+    }
+    form.append(ul);
+    // Hidden input the POST handler reads — populated at submit
+    // time from the checkbox states. axum's Form extractor doesn't
+    // natively decode repeated keys, so we join into one CSV.
+    const hidden = el('input', { type: 'hidden', name: 'inputs', value: '' });
+    form.append(hidden);
+    const btn = el('button', {
+      type: 'submit',
+      class: 'btn btn-meta-update',
+      disabled: '',
+    }, metaUpdateRunning ? '⏳ UPD4T1NG…' : '◆ UPD4TE & R3BU1LD');
+    form.append(btn);
+    function refreshDisabled() {
+      const any = form.querySelectorAll('input[data-meta-input]:checked').length > 0;
+      // Stay disabled while an update is already in flight — no
+      // stacking a second run on top of the rebuild ripple.
+      if (any && !metaUpdateRunning) btn.removeAttribute('disabled');
+      else btn.setAttribute('disabled', '');
+    }
+    form.addEventListener('change', refreshDisabled);
+    function setAllChecked(val) {
+      for (const b of form.querySelectorAll('input[data-meta-input]')) {
+        b.checked = val;
+      }
+      refreshDisabled();
+    }
+    selAll.addEventListener('click', () => setAllChecked(true));
+    selNone.addEventListener('click', () => setAllChecked(false));
+    form.addEventListener('submit', () => {
+      const selected = Array.from(form.querySelectorAll('input[data-meta-input]:checked'))
+        .map((b) => b.dataset.metaInput);
+      hidden.value = selected.join(',');
+    });
+    root.append(form);
+  }
+
+  function truncate(s, n) {
+    return s.length <= n ? s : s.slice(0, n - 1) + '…';
+  }
+
+  // ─── rebuild queue ──────────────────────────────────────────────────────
+  // Glyph + verb per QueueKind. Mirrors the labels used in
+  // hive-c0re::rebuild_queue::QueueKind::as_str.
+  const QUEUE_KIND_GLYPH = {
+    rebuild: '↻',
+    meta_update: '◆',
+    spawn: '✨',
+    destroy: '🗑',
+  };
+  const QUEUE_STATE_GLYPH = {
+    queued: '⏸',
+    running: '▶',
+    done: '✔',
+    failed: '✖',
+    cancelled: '⊘',
+  };
+
+  function renderRebuildQueue(s) {
+    const root = $('rebuild-queue-section');
+    if (!root) return;
+    root.innerHTML = '';
+    const queue = s.rebuild_queue || [];
+    if (!queue.length) {
+      root.append(el('p', { class: 'empty' }, 'queue is empty — nothing pending or in flight.'));
+      return;
+    }
+    // Index by id for parent lookup.
+    const byId = new Map(queue.map((e) => [e.id, e]));
+    // Top-level entries first; children render nested under their parent.
+    const tops = queue.filter((e) => e.parent_id == null);
+    const childrenOf = new Map();
+    for (const e of queue) {
+      if (e.parent_id != null) {
+        if (!childrenOf.has(e.parent_id)) childrenOf.set(e.parent_id, []);
+        childrenOf.get(e.parent_id).push(e);
+      }
+    }
+    const ul = el('ul', { class: 'rebuild-queue' });
+    for (const top of tops) {
+      ul.append(renderQueueEntry(top, byId));
+      for (const child of childrenOf.get(top.id) || []) {
+        ul.append(renderQueueEntry(child, byId, true));
+      }
+    }
+    // Children whose parent isn't in the snapshot (history-evicted) still render flat.
+    const orphans = queue.filter(
+      (e) => e.parent_id != null && !byId.has(e.parent_id),
+    );
+    for (const o of orphans) {
+      ul.append(renderQueueEntry(o, byId, true));
+    }
+    root.append(ul);
+  }
+
+  function renderQueueEntry(entry, _byId, isChild) {
+    const li = el('li', {
+      class: 'rebuild-queue-entry rqe-' + entry.state,
+      'data-id': String(entry.id),
+    });
+    if (isChild) li.classList.add('rqe-child');
+    // State glyph + kind + agent.
+    li.append(
+      el('span', { class: 'rqe-state', title: entry.state }, QUEUE_STATE_GLYPH[entry.state] || '?'),
+      ' ',
+      el('span', { class: 'rqe-kind', title: entry.kind },
+        (QUEUE_KIND_GLYPH[entry.kind] || '?') + ' ' + entry.kind),
+      ' ',
+      el('code', { class: 'rqe-agent' }, entry.agent),
+    );
+    // Source chip (manual / meta_update / auto_update / crash_recover).
+    li.append(' ', el('span', { class: 'rqe-source rqe-source-' + entry.source }, entry.source));
+    // Timing: queued Xs ago when pending, elapsed when running,
+    // finished Xs ago for terminal.
+    if (entry.state === 'queued') {
+      li.append(' ', el('span', { class: 'rqe-when' }, '· queued ' + fmtAgo(entry.enqueued_at)));
+    } else if (entry.state === 'running' && entry.started_at) {
+      const elapsed = Math.max(0, Math.floor(Date.now() / 1000 - entry.started_at));
+      li.append(' ', el('span', {
+        class: 'rqe-when',
+        'data-rqe-elapsed': String(entry.started_at),
+      }, '· ' + fmtElapsed(elapsed)));
+    } else if (entry.finished_at) {
+      li.append(' ', el('span', { class: 'rqe-when' }, '· ' + entry.state + ' ' + fmtAgo(entry.finished_at)));
+    }
+    // Reason (truncated; full text on hover).
+    if (entry.reason) {
+      const r = entry.reason.split('\n')[0];
+      li.append(' ', el('span', { class: 'rqe-reason', title: entry.reason }, '— ' + truncate(r, 60)));
+    }
+    // Current step (#437 / #501): backend annotates the in-flight
+    // phase on `running` entries — sub-line below the main row so the
+    // operator can see "what's happening right now" inside a long
+    // build. Terminal transitions clear `step` on the backend so this
+    // doesn't render stale labels on Done / Failed rows.
+    if (entry.step) {
+      li.append(el('div', { class: 'rqe-step' }, '↳ ' + entry.step));
+    }
+    // Error block, when failed.
+    if (entry.error) {
+      li.append(el('pre', { class: 'rqe-error', title: entry.error }, truncate(entry.error, 200)));
+    }
+    return li;
+  }
+
+  function fmtElapsed(secs) {
+    if (secs < 60) return secs + 's running';
+    if (secs < 3600) return Math.floor(secs / 60) + 'm ' + (secs % 60) + 's running';
+    return Math.floor(secs / 3600) + 'h ' + Math.floor((secs % 3600) / 60) + 'm running';
+  }
+
+  // Tick once per second to refresh "running Xs" badges in place
+  // (mirrors the question-TTL ticker pattern from #335).
+  setInterval(() => {
+    for (const span of document.querySelectorAll('.rqe-when[data-rqe-elapsed]')) {
+      const started = parseInt(span.dataset.rqeElapsed, 10);
+      if (!started) continue;
+      const elapsed = Math.max(0, Math.floor(Date.now() / 1000 - started));
+      span.textContent = '· ' + fmtElapsed(elapsed);
+    }
+  }, 1000);
+
+  // ─── reminders ──────────────────────────────────────────────────────────
+  // Reminders aren't part of /api/state (separate sqlite table, separate
+  // mutation cadence). Refresh fires alongside refreshState() so a
+  // cancel POST or a cold load both reflect within the same tick. A
+  // periodic poll isn't necessary — new reminders are queued by the
+  // agents themselves and the operator already sees them next time
+  // they interact with the page.
+  async function refreshReminders() {
+    const liveRoot = $('reminders-section');
+    if (!liveRoot) return;
+    try {
+      const resp = await fetch('/api/reminders');
+      if (!resp.ok) {
+        paintAtomic(liveRoot, (root) => {
+          root.append(el('p', { class: 'empty' }, 'reminders unavailable: http ' + resp.status));
+        });
+        return;
+      }
+      const rows = await resp.json();
+      renderReminders(rows);
+    } catch (err) {
+      paintAtomic(liveRoot, (root) => {
+        root.append(el('p', { class: 'empty' }, 'reminders fetch failed: ' + err));
+      });
+    }
+  }
+  function renderReminders(rows) {
+    const liveRoot = $('reminders-section');
+    if (!liveRoot) return;
+    paintAtomic(liveRoot, (root) => {
+      if (!rows.length) {
+        root.append(el('p', { class: 'empty' }, 'no queued reminders'));
+        return;
+      }
+      const ul = el('ul', { class: 'reminders' });
+      for (const r of rows) {
+        const failed = (r.attempt_count || 0) > 0;
+        const li = el('li', { class: 'reminder-row' + (failed ? ' reminder-failed' : '') });
+        const dueIn = r.due_at - Math.floor(Date.now() / 1000);
+        const dueLabel = dueIn <= 0
+          ? `overdue ${fmtAgo(r.due_at)}`
+          : `in ${fmtDuration(dueIn)}`;
+        const head = el('div', { class: 'reminder-head' },
+          el('span', { class: 'agent' }, r.agent), ' ',
+          el('span', { class: 'meta', title: new Date(r.due_at * 1000).toISOString() }, dueLabel),
+          ' ',
+          el('span', { class: 'meta' }, `· id ${r.id}`),
+        );
+        if (r.file_path) {
+          head.append(' ', el('span', { class: 'meta' }, '· payload → '));
+          appendLinkified(head, r.file_path);
+        }
+        if (failed) {
+          head.append(' ', el('span',
+            {
+              class: 'badge badge-warn',
+              title: 'consecutive failed delivery attempts (capped at 5; over the cap the scheduler stops retrying until you click R3TRY or cancel)',
+            },
+            `⚠ ${r.attempt_count} failed`));
+        }
+        const body = el('div', { class: 'reminder-body' });
+        appendLinkified(body, r.message);
+        li.append(head, body);
+        if (r.last_error) {
+          li.append(el('div', { class: 'reminder-error' },
+            el('span', { class: 'msg-sep' }, 'error: '),
+            r.last_error,
+          ));
+        }
+        const actions = el('div', { class: 'reminder-actions' });
+        if (failed) {
+          // Retry resets the failure counters so the scheduler picks
+          // the row up again on its next 5s tick. No data-no-refresh
+          // — the resulting refreshState re-fires refreshReminders.
+          const retryForm = el('form', {
+            method: 'POST', action: '/retry-reminder/' + r.id,
+            class: 'inline', 'data-async': '',
+          });
+          retryForm.append(el('button',
+            { type: 'submit', class: 'btn btn-restart' }, '↻ R3TRY'));
+          actions.append(retryForm);
+        }
+        const cancelForm = el('form', {
+          method: 'POST', action: '/cancel-reminder/' + r.id,
+          class: 'inline', 'data-async': '',
+          'data-confirm': `cancel reminder ${r.id} for ${r.agent}? this drops the queued delivery; no undo.`,
+        });
+        cancelForm.append(el('button', { type: 'submit', class: 'btn btn-deny' }, '✗ C4NC3L'));
+        actions.append(cancelForm);
+        li.append(actions);
+        ul.append(li);
+      }
+      root.append(ul);
+    });
+  }
+  function fmtDuration(secs) {
+    if (secs < 60) return secs + 's';
+    if (secs < 3600) return Math.floor(secs / 60) + 'm ' + (secs % 60) + 's';
+    if (secs < 86400) return Math.floor(secs / 3600) + 'h ' + Math.floor((secs % 3600) / 60) + 'm';
+    return Math.floor(secs / 86400) + 'd ' + Math.floor((secs % 86400) / 3600) + 'h';
+  }
+
+  // ─── scheduled prompts (#459) ──────────────────────────────────────────
+  // Backend (#444) exposes `/api/schedules` (snapshot), `/api/schedules`
+  // (POST, operator-direct submit), `/api/schedules/{id}/cancel`
+  // (whole or per-target). No SSE channel for schedule mutations yet,
+  // so we refresh on tab activation + after every submit/cancel POST.
+  // Local cache lets `refreshTabCounts` show the active count without
+  // re-fetching every second.
+  let schedulesState = [];
+  // #474 — schedule ids whose inline edit form is currently open.
+  // The set survives across refreshSchedules() calls so a state
+  // poll doesn't yank the form out from under the operator. Per-id
+  // mid-edit carry sits in `scheduleEditCarry` so unsaved typing
+  // also rides the refresh.
+  const editingSchedules = new Set();
+  const scheduleEditCarry = new Map();
+  async function refreshSchedules() {
+    const listRoot = $('schedules-section');
+    if (!listRoot) return;
+    try {
+      const resp = await fetch('/api/schedules');
+      if (!resp.ok) {
+        paintAtomic(listRoot, (root) => {
+          root.append(el('p', { class: 'empty' }, 'schedules unavailable: http ' + resp.status));
+        });
+        return;
+      }
+      schedulesState = await resp.json();
+    } catch (err) {
+      paintAtomic(listRoot, (root) => {
+        root.append(el('p', { class: 'empty' }, 'schedules fetch failed: ' + err));
+      });
+      return;
+    }
+    renderScheduleNewForm();
+    renderSchedulesList();
+  }
+  // Active = at least one target still alive (no `cancelled_at_unix`)
+  // AND the whole schedule isn't cancelled. Drives the tab pill count.
+  function activeScheduleCount() {
+    let n = 0;
+    for (const s of schedulesState) {
+      if (s.cancelled_at_unix) continue;
+      if ((s.targets || []).some((t) => !t.cancelled_at_unix)) n++;
+    }
+    return n;
+  }
+  // Interval composer (#466) — shared between the new-schedule form
+  // and the edit-schedule form (#474). Builds the preset chip row +
+  // d/h/m/s sub-fields + live preview, and returns helpers to read
+  // and write the value.
+  //
+  // The composer carries no opinion on what "0 / blank" means at the
+  // semantic layer: it just reports the integer total. Callers decide
+  // whether to treat 0 as `null` (one-shot) for their own submit path.
+  function buildIntervalComposer({
+    label = 'interval (blank / all-zero = one-shot)',
+    namePrefix = 'interval_',
+    initialSeconds = 0,
+  } = {}) {
+    const wrapper = el('label', { class: 'schedule-field' },
+      el('span', { class: 'schedule-field-label' }, label));
+    const presets = [
+      ['1m', 60], ['5m', 300], ['15m', 900], ['30m', 1800],
+      ['1h', 3600], ['6h', 21600], ['12h', 43200],
+      ['1d', 86400], ['7d', 604800],
+    ];
+    const presetsRow = el('div', { class: 'schedule-interval-presets' });
+    for (const [presetLabel, secs] of presets) {
+      presetsRow.append(el('button', {
+        type: 'button',
+        class: 'btn btn-interval-preset',
+        'data-secs': String(secs),
+      }, presetLabel));
+    }
+    presetsRow.append(el('button', {
+      type: 'button',
+      class: 'btn btn-interval-preset btn-interval-oneshot',
+      'data-secs': '0',
+    }, 'one-shot'));
+    wrapper.append(presetsRow);
+
+    const partsRow = el('div', { class: 'schedule-interval-parts' });
+    const mkPart = (suffix, unit) => {
+      const inp = el('input', {
+        type: 'number', name: namePrefix + suffix, min: '0', step: '1', placeholder: '0',
+        class: 'schedule-interval-num',
+      });
+      partsRow.append(inp, el('span', { class: 'schedule-interval-unit' }, unit));
+      return inp;
+    };
+    const dInp = mkPart('d', 'd');
+    const hInp = mkPart('h', 'h');
+    const mInp = mkPart('m', 'm');
+    const sInp = mkPart('s', 's');
+    wrapper.append(partsRow);
+
+    const preview = el('div', { class: 'schedule-interval-preview', 'aria-live': 'polite' });
+    wrapper.append(preview);
+
+    function getSeconds() {
+      const n = (v) => {
+        const x = parseInt(v, 10);
+        return Number.isFinite(x) && x > 0 ? x : 0;
+      };
+      return n(dInp.value) * 86400 + n(hInp.value) * 3600
+        + n(mInp.value) * 60 + n(sInp.value);
+    }
+    function fillFromSeconds(total) {
+      const t = Math.max(0, Math.floor(total));
+      const d = Math.floor(t / 86400);
+      const h = Math.floor((t % 86400) / 3600);
+      const m = Math.floor((t % 3600) / 60);
+      const s = t % 60;
+      dInp.value = d > 0 ? String(d) : '';
+      hInp.value = h > 0 ? String(h) : '';
+      mInp.value = m > 0 ? String(m) : '';
+      sInp.value = s > 0 ? String(s) : '';
+    }
+    function setParts({ d, h, m, s }) {
+      if (d !== undefined) dInp.value = d;
+      if (h !== undefined) hInp.value = h;
+      if (m !== undefined) mInp.value = m;
+      if (s !== undefined) sInp.value = s;
+    }
+    function updatePreview() {
+      const total = getSeconds();
+      preview.textContent = total > 0
+        ? '↻ every ' + fmtDuration(total)
+        : 'one-shot (fires once at first-fire time)';
+      preview.classList.toggle('schedule-interval-preview-oneshot', total === 0);
+    }
+    for (const inp of [dInp, hInp, mInp, sInp]) {
+      inp.addEventListener('input', updatePreview);
+    }
+    for (const b of presetsRow.querySelectorAll('button[data-secs]')) {
+      b.addEventListener('click', () => {
+        fillFromSeconds(parseInt(b.getAttribute('data-secs'), 10) || 0);
+        updatePreview();
+      });
+    }
+    if (initialSeconds > 0) fillFromSeconds(initialSeconds);
+    updatePreview();
+
+    return { wrapper, getSeconds, fillFromSeconds, setParts, updatePreview };
+  }
+
+  // Parse the d/h/m/s sub-fields of a `buildIntervalComposer` instance
+  // out of submitted FormData. Returns total seconds, or NaN if any
+  // field carries a non-integer / negative value — the caller alerts
+  // and bails. Total `0` means "one-shot" at the call site (wire is
+  // `interval_seconds: null`). `namePrefix` matches the prefix passed
+  // to `buildIntervalComposer` (e.g. `interval_` or `edit_interval_`).
+  function intervalSecondsFromFormData(fd, namePrefix) {
+    const part = (suffix, mult) => {
+      const raw = String(fd.get(namePrefix + suffix) || '').trim();
+      if (!raw) return 0;
+      const n = parseInt(raw, 10);
+      if (!Number.isFinite(n) || n < 0) return NaN;
+      return n * mult;
+    };
+    return part('d', 86400) + part('h', 3600) + part('m', 60) + part('s', 1);
+  }
+
+  // Targets multi-select chip box — shared between the new-schedule
+  // form and the edit-schedule form. Same DOM shape, same candidate
+  // list (containers + operator + manager); only the chip element id
+  // prefix and checkbox field name vary. Used to be inlined twice in
+  // near-identical 18-line blocks; consolidated here so a future
+  // change (new chip kind, candidate-list source swap, etc.) lives in
+  // one place. Returns the wrapping `<label class="schedule-field">`
+  // ready to append to the form.
+  function buildTargetChips({ idPrefix, fieldName, checked, extraNames = [] }) {
+    const candidates = ['operator', 'manager'];
+    const containerNames = Array.from(containersState.values())
+      .map((c) => c.name)
+      .filter((n) => n !== 'manager' && n !== 'operator')
+      .sort();
+    for (const n of containerNames) candidates.push(n);
+    // `extraNames` lets the edit form keep showing an already-active
+    // target that's vanished from the live container list (operator's
+    // typo, container destroyed mid-schedule, etc.) so it's still
+    // explicitly uncheckable. New-schedule callers pass `[]`.
+    for (const n of extraNames) if (!candidates.includes(n)) candidates.push(n);
+
+    const label = el('label', { class: 'schedule-field' },
+      el('span', { class: 'schedule-field-label' }, 'targets'));
+    const box = el('div', { class: 'schedule-targets' });
+    for (const name of candidates) {
+      const id_ = idPrefix + name;
+      const cb = el('input', {
+        type: 'checkbox', name: fieldName, value: name, id: id_,
+      });
+      if (checked.has(name)) cb.checked = true;
+      box.append(el('label', { class: 'schedule-target-chip', for: id_ },
+        cb, el('span', {}, name)));
+    }
+    label.append(box);
+    return label;
+  }
+
+  function renderScheduleNewForm() {
+    const liveRoot = $('schedule-new-section');
+    if (!liveRoot) return;
+    // Preserve any field the operator was mid-typing in by reading
+    // current values before we re-render. Only `body` + `description`
+    // are big enough to feel — the others are toggle/datetime/number.
+    // Read from the live root BEFORE the swap so we see current
+    // values (the fragment we build into is fresh).
+    const carry = readScheduleFormCarry(liveRoot);
+    paintAtomic(liveRoot, (root) => {
+
+    const form_ = el('form', { class: 'schedule-new-form' });
+    form_.addEventListener('submit', (e) => {
+      e.preventDefault();
+      submitNewSchedule(form_);
+    });
+
+    form_.append(buildTargetChips({
+      idPrefix: 'st-',
+      fieldName: 'targets',
+      checked: new Set(carry.targets),
+    }));
+
+    const bodyLabel = el('label', { class: 'schedule-field' },
+      el('span', { class: 'schedule-field-label' }, 'prompt body'));
+    const bodyInput = el('textarea', {
+      name: 'body', rows: '4', required: 'required', placeholder: 'message delivered to each target at fire time',
+    });
+    bodyInput.value = carry.body;
+    bodyLabel.append(bodyInput);
+    form_.append(bodyLabel);
+
+    const firstFireLabel = el('label', { class: 'schedule-field' },
+      el('span', { class: 'schedule-field-label' }, 'first fire'));
+    const firstFireInput = el('input', {
+      type: 'datetime-local', name: 'first_fire', required: 'required',
+    });
+    // Default to "5 minutes from now" so the operator has a sensible
+    // pre-filled value (also future-positive so worker doesn't fire
+    // immediately on a stale-clock accident).
+    firstFireInput.value = carry.first_fire
+      || isoForDatetimeLocal(new Date(Date.now() + 5 * 60 * 1000));
+    firstFireLabel.append(firstFireInput);
+    form_.append(firstFireLabel);
+
+    // Interval composer (#466). See `buildIntervalComposer` below —
+    // shared between the new-schedule form and the edit-schedule form
+    // (#474) so the same chip/d/h/m/s widget works for both flows.
+    const intervalCx = buildIntervalComposer({
+      label: 'interval (blank / all-zero = one-shot)',
+      namePrefix: 'interval_',
+      initialSeconds: 0,
+    });
+    form_.append(intervalCx.wrapper);
+    // Restore from carry. Prefer the new split fields; fall back to
+    // legacy single seconds value if the page was reloaded mid-edit
+    // against an older bundle.
+    if (carry.interval_d || carry.interval_h
+        || carry.interval_m || carry.interval_s) {
+      intervalCx.setParts({
+        d: carry.interval_d, h: carry.interval_h,
+        m: carry.interval_m, s: carry.interval_s,
+      });
+    } else if (carry.interval) {
+      const legacy = parseInt(carry.interval, 10);
+      if (Number.isFinite(legacy) && legacy > 0) intervalCx.fillFromSeconds(legacy);
+    }
+    intervalCx.updatePreview();
+
+    const descLabel = el('label', { class: 'schedule-field' },
+      el('span', { class: 'schedule-field-label' }, 'description (optional)'));
+    const descInput = el('input', {
+      type: 'text', name: 'description', placeholder: 'shown on the schedule card',
+    });
+    descInput.value = carry.description;
+    descLabel.append(descInput);
+    form_.append(descLabel);
+
+    const actions = el('div', { class: 'schedule-actions' });
+    const submit = el('button', { type: 'submit', class: 'btn btn-spawn' }, '＋ qu3ue prompt');
+    actions.append(submit);
+    form_.append(actions);
+
+    root.append(form_);
+    });  // paintAtomic
+  }
+  function readScheduleFormCarry(root) {
+    return {
+      targets: Array.from(root.querySelectorAll('input[name="targets"]:checked')).map((i) => i.value),
+      body: root.querySelector('textarea[name="body"]')?.value || '',
+      first_fire: root.querySelector('input[name="first_fire"]')?.value || '',
+      // #466: interval is now split into d/h/m/s sub-fields. Keep the
+      // legacy `interval` key in case an older bundle is in the page.
+      interval: root.querySelector('input[name="interval"]')?.value || '',
+      interval_d: root.querySelector('input[name="interval_d"]')?.value || '',
+      interval_h: root.querySelector('input[name="interval_h"]')?.value || '',
+      interval_m: root.querySelector('input[name="interval_m"]')?.value || '',
+      interval_s: root.querySelector('input[name="interval_s"]')?.value || '',
+      description: root.querySelector('input[name="description"]')?.value || '',
+    };
+  }
+  function isoForDatetimeLocal(date) {
+    // `<input type="datetime-local">` expects `YYYY-MM-DDTHH:MM`
+    // in the user's local timezone (with no trailing Z). Build it
+    // by hand rather than slicing toISOString which is always UTC.
+    const pad = (n) => String(n).padStart(2, '0');
+    return `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}`
+      + `T${pad(date.getHours())}:${pad(date.getMinutes())}`;
+  }
+  async function submitNewSchedule(form_) {
+    const fd = new FormData(form_);
+    const targets = fd.getAll('targets').map(String);
+    const body = String(fd.get('body') || '').trim();
+    const firstFireStr = String(fd.get('first_fire') || '');
+    const description = String(fd.get('description') || '').trim();
+
+    if (!targets.length) { alert('schedule must have at least one target'); return; }
+    if (!body) { alert('prompt body must be non-empty'); return; }
+    if (!firstFireStr) { alert('first fire timestamp is required'); return; }
+    const firstFireDate = new Date(firstFireStr);
+    if (Number.isNaN(firstFireDate.getTime())) { alert('first fire is not a valid datetime'); return; }
+    const first_fire_at_unix = Math.floor(firstFireDate.getTime() / 1000);
+    // Interval composer (#466): total seconds from d/h/m/s sub-fields.
+    // `0` means one-shot at the wire level (backend expects null).
+    const intervalTotal = intervalSecondsFromFormData(fd, 'interval_');
+    if (Number.isNaN(intervalTotal)) {
+      alert('interval fields must be non-negative integers (or blank for one-shot)');
+      return;
+    }
+    const interval_seconds = intervalTotal > 0 ? intervalTotal : null;
+    const payload = { targets, body, first_fire_at_unix };
+    if (interval_seconds != null) payload.interval_seconds = interval_seconds;
+    if (description) payload.description = description;
+    const submitBtn = form_.querySelector('button[type="submit"]');
+    const originalLabel = submitBtn ? submitBtn.innerHTML : '';
+    if (submitBtn) { submitBtn.disabled = true; submitBtn.innerHTML = '<span class="spinner">◐</span> queueing…'; }
+    try {
+      const resp = await fetch('/api/schedules', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(payload),
+      });
+      if (!resp.ok) {
+        const text = await resp.text().catch(() => '');
+        alert('schedule submit failed: http ' + resp.status + (text ? '\n\n' + text : ''));
+        return;
+      }
+      // Clear the form (form_ is about to be re-rendered fresh below).
+      form_.reset();
+      await refreshSchedules();
+    } catch (err) {
+      alert('schedule submit failed: ' + err);
+    } finally {
+      if (submitBtn) { submitBtn.disabled = false; submitBtn.innerHTML = originalLabel; }
+    }
+  }
+  function renderSchedulesList() {
+    const liveRoot = $('schedules-section');
+    if (!liveRoot) return;
+    paintAtomic(liveRoot, (root) => {
+      if (!schedulesState.length) {
+        root.append(el('p', { class: 'empty' }, 'no schedules queued'));
+        return;
+      }
+      const ul = el('ul', { class: 'schedules' });
+      // Active schedules first (still firing), then cancelled tail.
+      const sorted = schedulesState.slice().sort((a, b) => {
+        const aDone = a.cancelled_at_unix ? 1 : 0;
+        const bDone = b.cancelled_at_unix ? 1 : 0;
+        if (aDone !== bDone) return aDone - bDone;
+        return a.next_fire_at_unix - b.next_fire_at_unix;
+      });
+      for (const s of sorted) ul.append(renderScheduleCard(s));
+      root.append(ul);
+    });
+  }
+  function renderScheduleCard(s) {
+    const cancelled = !!s.cancelled_at_unix;
+    const li = el('li', { class: 'schedule-row' + (cancelled ? ' schedule-cancelled' : '') });
+    const head = el('div', { class: 'schedule-head' });
+    head.append(
+      el('span', { class: 'meta' }, '#' + s.id), ' ',
+      el('span', { class: 'rqe-source rqe-source-' + (s.source && s.source.kind === 'approval' ? 'approval' : 'manual') },
+        s.source && s.source.kind === 'approval' ? 'approval' : 'operator'),
+    );
+    if (cancelled) {
+      head.append(' ', el('span', { class: 'badge badge-muted', title: 'cancelled ' + new Date(s.cancelled_at_unix * 1000).toISOString() }, 'cancelled'));
+    } else {
+      const dueIn = s.next_fire_at_unix - Math.floor(Date.now() / 1000);
+      const dueLabel = dueIn <= 0
+        ? `overdue ${fmtAgo(s.next_fire_at_unix)}`
+        : `next fire in ${fmtDuration(dueIn)}`;
+      head.append(' ', el('span', {
+        class: 'meta',
+        title: new Date(s.next_fire_at_unix * 1000).toISOString(),
+      }, dueLabel));
+    }
+    if (s.interval_seconds) {
+      head.append(' ', el('span',
+        { class: 'badge badge-muted', title: 'recurring' },
+        `↻ every ${fmtDuration(s.interval_seconds)}`));
+    } else {
+      head.append(' ', el('span', { class: 'badge badge-muted', title: 'one-shot' }, 'one-shot'));
+    }
+    head.append(' ', el('span', { class: 'meta' }, '· owner ' + s.owner));
+    li.append(head);
+
+    if (s.description) {
+      li.append(el('div', { class: 'schedule-description' }, s.description));
+    }
+    const body = el('div', { class: 'schedule-body' });
+    appendLinkified(body, s.body);
+    li.append(body);
+
+    // Targets table — one row per recipient with cancel button +
+    // last-fire metadata.
+    const targets = s.targets || [];
+    if (targets.length) {
+      const table = el('table', { class: 'schedule-targets-table' });
+      const thead = el('thead', {}, el('tr', {},
+        el('th', {}, 'target'),
+        el('th', {}, 'last fire'),
+        el('th', {}, 'last result'),
+        el('th', {}, ''),
+      ));
+      table.append(thead);
+      const tbody = el('tbody', {});
+      for (const t of targets) {
+        const tCancelled = !!t.cancelled_at_unix;
+        const tr = el('tr', { class: tCancelled ? 'schedule-target-cancelled' : '' });
+        tr.append(el('td', {}, t.target));
+        tr.append(el('td', { class: 'meta' },
+          t.last_fired_at_unix
+            ? fmtAgo(t.last_fired_at_unix) + ' ago'
+            : '—'));
+        tr.append(el('td', { class: 'meta' }, t.last_result || '—'));
+        const actionTd = el('td', {});
+        if (!cancelled && !tCancelled) {
+          const btn = el('button', { type: 'button', class: 'btn btn-deny btn-inline-small' }, '✕');
+          btn.title = 'cancel just this target';
+          btn.addEventListener('click', () => cancelScheduleTargets(s.id, [t.target]));
+          actionTd.append(btn);
+        } else if (tCancelled) {
+          actionTd.append(el('span', { class: 'meta' }, '✕ cancelled'));
+        }
+        tr.append(actionTd);
+        tbody.append(tr);
+      }
+      table.append(tbody);
+      li.append(table);
+    }
+
+    if (!cancelled) {
+      const actions = el('div', { class: 'schedule-actions' });
+      // Fire-now (#467): out-of-band manual pulse. Recurring schedules
+      // get an extra fan-out without disturbing `next_fire_at`; one-shots
+      // are consumed (cancelled after fan-out), per damocles's design.
+      // Disabled when every target is cancelled — there's nothing to
+      // fire to. Backend: POST /api/schedules/{id}/fire-now.
+      const activeTargets = (s.targets || []).filter((t) => !t.cancelled_at_unix);
+      const fireBtn = el('button', { type: 'button', class: 'btn btn-fire-now' }, '↯ fire now');
+      const isOneShot = !s.interval_seconds;
+      fireBtn.title = isOneShot
+        ? 'fire this schedule once, immediately (one-shot — schedule is consumed after the manual fire)'
+        : 'fire this schedule once, immediately (recurring — next regularly-scheduled fire is unaffected)';
+      if (!activeTargets.length) {
+        fireBtn.disabled = true;
+        fireBtn.title = 'every target is cancelled — nothing to fire';
+      }
+      fireBtn.addEventListener('click', () => fireScheduleNow(s.id, isOneShot, activeTargets.map((t) => t.target), fireBtn));
+      actions.append(fireBtn);
+      const editBtn = el('button', { type: 'button', class: 'btn btn-edit-schedule' },
+        editingSchedules.has(s.id) ? '✎ close edit' : '✎ edit');
+      editBtn.title = 'edit body / description / interval / next-fire (targets stay immutable)';
+      editBtn.addEventListener('click', () => {
+        if (editingSchedules.has(s.id)) {
+          editingSchedules.delete(s.id);
+          scheduleEditCarry.delete(s.id);
+        } else {
+          editingSchedules.add(s.id);
+        }
+        renderSchedulesList();
+      });
+      actions.append(editBtn);
+      const cancelAll = el('button', { type: 'button', class: 'btn btn-deny' }, '✕ cancel all');
+      cancelAll.title = 'cancel the whole schedule';
+      cancelAll.addEventListener('click', () => cancelScheduleAll(s.id));
+      actions.append(cancelAll);
+      li.append(actions);
+      if (editingSchedules.has(s.id)) {
+        li.append(renderScheduleEditForm(s));
+      }
+    }
+    return li;
+  }
+
+  // #474 — inline edit form. Renders inside the schedule row when the
+  // row's `✎ edit` button is toggled on. Pre-filled with current
+  // values; submit PATCHes /api/schedules/{id}. Targets stay
+  // immutable (per damocles's backend; the workaround for retargeting
+  // is cancel + new schedule). Mid-edit field values survive a
+  // state-poll refresh via `scheduleEditCarry`.
+  function renderScheduleEditForm(s) {
+    const wrapper = el('div', { class: 'schedule-edit-form-wrapper' });
+    const form_ = el('form', { class: 'schedule-edit-form' });
+    form_.addEventListener('submit', (e) => {
+      e.preventDefault();
+      submitEditSchedule(s, form_);
+    });
+
+    const carry = scheduleEditCarry.get(s.id) || {};
+
+    const bodyLabel = el('label', { class: 'schedule-field' },
+      el('span', { class: 'schedule-field-label' }, 'body'));
+    const bodyInput = el('textarea', { name: 'body', rows: '4', required: 'required' });
+    bodyInput.value = carry.body !== undefined ? carry.body : s.body;
+    bodyLabel.append(bodyInput);
+    form_.append(bodyLabel);
+
+    const descLabel = el('label', { class: 'schedule-field' },
+      el('span', { class: 'schedule-field-label' }, 'description (blank to clear)'));
+    const descInput = el('input', { type: 'text', name: 'description' });
+    descInput.value = carry.description !== undefined
+      ? carry.description
+      : (s.description || '');
+    descLabel.append(descInput);
+    form_.append(descLabel);
+
+    const firstFireLabel = el('label', { class: 'schedule-field' },
+      el('span', { class: 'schedule-field-label' }, 'next fire'));
+    const firstFireInput = el('input', {
+      type: 'datetime-local', name: 'next_fire', required: 'required',
+    });
+    firstFireInput.value = carry.next_fire !== undefined
+      ? carry.next_fire
+      : isoForDatetimeLocal(new Date(s.next_fire_at_unix * 1000));
+    firstFireLabel.append(firstFireInput);
+    form_.append(firstFireLabel);
+
+    const intervalCx = buildIntervalComposer({
+      label: 'interval (blank / all-zero = flip to one-shot)',
+      namePrefix: 'edit_interval_',
+      initialSeconds: 0,
+    });
+    form_.append(intervalCx.wrapper);
+    if (carry.interval_d !== undefined || carry.interval_h !== undefined
+        || carry.interval_m !== undefined || carry.interval_s !== undefined) {
+      intervalCx.setParts({
+        d: carry.interval_d || '',
+        h: carry.interval_h || '',
+        m: carry.interval_m || '',
+        s: carry.interval_s || '',
+      });
+    } else if (s.interval_seconds) {
+      intervalCx.fillFromSeconds(s.interval_seconds);
+    }
+    intervalCx.updatePreview();
+
+    // Persist carry on every input + checkbox change so a refresh
+    // repaint preserves it.
+    const saveCarry = () => {
+      const fd = new FormData(form_);
+      scheduleEditCarry.set(s.id, {
+        body: String(fd.get('body') || ''),
+        description: String(fd.get('description') || ''),
+        next_fire: String(fd.get('next_fire') || ''),
+        interval_d: String(fd.get('edit_interval_d') || ''),
+        interval_h: String(fd.get('edit_interval_h') || ''),
+        interval_m: String(fd.get('edit_interval_m') || ''),
+        interval_s: String(fd.get('edit_interval_s') || ''),
+        targets: fd.getAll('edit_targets').map(String),
+      });
+    };
+    form_.addEventListener('input', saveCarry);
+    form_.addEventListener('change', saveCarry);
+
+    // Targets multi-select (#474 fast-follow). Shares the chip-box
+    // pattern with the new-schedule form via `buildTargetChips`;
+    // cancelled tombstones aren't listed (re-adding them flows
+    // through `targets_add`, which the backend replace-on-conflict
+    // drops the tombstone for). Submit diffs against the original
+    // active set to populate `targets_add` / `targets_remove` on the
+    // PATCH body.
+    const originalActiveTargets = new Set(
+      (s.targets || []).filter((t) => !t.cancelled_at_unix).map((t) => t.target),
+    );
+    form_.append(buildTargetChips({
+      idPrefix: 'se-' + s.id + '-',
+      fieldName: 'edit_targets',
+      checked: carry.targets ? new Set(carry.targets) : originalActiveTargets,
+      extraNames: [...originalActiveTargets],
+    }));
+    form_.append(el('p', { class: 'meta schedule-edit-targets-note' },
+      're-adding a previously cancelled target drops its history and starts fresh; '
+      + 'unchecking an active target cancels it.'));
+
+    const actions = el('div', { class: 'schedule-actions' });
+    const submit = el('button', { type: 'submit', class: 'btn btn-spawn' }, '✓ save changes');
+    const cancelEdit = el('button', { type: 'button', class: 'btn' }, 'cancel');
+    cancelEdit.addEventListener('click', () => {
+      editingSchedules.delete(s.id);
+      scheduleEditCarry.delete(s.id);
+      renderSchedulesList();
+    });
+    actions.append(submit, cancelEdit);
+    form_.append(actions);
+
+    wrapper.append(form_);
+    return wrapper;
+  }
+
+  async function submitEditSchedule(originalSchedule, form_) {
+    const s = originalSchedule;
+    const fd = new FormData(form_);
+    const newBody = String(fd.get('body') || '').trim();
+    const newDescription = String(fd.get('description') || '').trim();
+    const newNextFireStr = String(fd.get('next_fire') || '');
+
+    if (!newBody) { alert('body must be non-empty'); return; }
+    if (!newNextFireStr) { alert('next-fire timestamp is required'); return; }
+    const newNextFireDate = new Date(newNextFireStr);
+    if (Number.isNaN(newNextFireDate.getTime())) {
+      alert('next-fire is not a valid datetime'); return;
+    }
+    const newNextFireUnix = Math.floor(newNextFireDate.getTime() / 1000);
+
+    // Compute interval total from the d/h/m/s fields (composer uses
+    // `edit_interval_*` names in this form).
+    const intervalTotal = intervalSecondsFromFormData(fd, 'edit_interval_');
+    if (Number.isNaN(intervalTotal)) {
+      alert('interval fields must be non-negative integers');
+      return;
+    }
+    const newIntervalSeconds = intervalTotal > 0 ? intervalTotal : null;
+
+    // Compute target diff against the schedule's currently-active set
+    // (cancelled tombstones don't count). The backend treats
+    // `targets_add` as replace-on-conflict (re-adding a tombstoned
+    // target drops its history), so we can just blanket "send the
+    // checked list as add, send the unchecked-but-was-active list as
+    // remove."
+    const newTargets = new Set(fd.getAll('edit_targets').map(String));
+    const originalActive = new Set(
+      (s.targets || [])
+        .filter((t) => !t.cancelled_at_unix)
+        .map((t) => t.target),
+    );
+    if (!newTargets.size) {
+      alert('schedule must have at least one target — uncheck submit, or use ✕ cancel all instead');
+      return;
+    }
+    const targetsAdd = [...newTargets].filter((t) => !originalActive.has(t));
+    const targetsRemove = [...originalActive].filter((t) => !newTargets.has(t));
+
+    // Build the PATCH body. Only include keys for fields that
+    // actually changed; explicit `null` clears description / flips
+    // recurring→one-shot. `targets_add` / `targets_remove` only
+    // populated when non-empty so the wire body stays minimal.
+    const patch = {};
+    if (newBody !== s.body) patch.body = newBody;
+    if (newDescription !== (s.description || '')) {
+      patch.description = newDescription || null;
+    }
+    if (newNextFireUnix !== s.next_fire_at_unix) {
+      patch.next_fire_at_unix = newNextFireUnix;
+    }
+    if (newIntervalSeconds !== (s.interval_seconds || null)) {
+      patch.interval_seconds = newIntervalSeconds;
+    }
+    if (targetsAdd.length) patch.targets_add = targetsAdd;
+    if (targetsRemove.length) patch.targets_remove = targetsRemove;
+    if (!Object.keys(patch).length) {
+      // No-op submit. Treat as "close edit form".
+      editingSchedules.delete(s.id);
+      scheduleEditCarry.delete(s.id);
+      renderSchedulesList();
+      return;
+    }
+
+    const submitBtn = form_.querySelector('button[type="submit"]');
+    const originalLabel = submitBtn ? submitBtn.textContent : '';
+    if (submitBtn) { submitBtn.disabled = true; submitBtn.textContent = 'saving…'; }
+    try {
+      const resp = await fetch('/api/schedules/' + encodeURIComponent(s.id), {
+        method: 'PATCH',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(patch),
+      });
+      if (!resp.ok) {
+        const text = await resp.text().catch(() => '');
+        alert('edit failed: http ' + resp.status + (text ? '\n\n' + text : ''));
+        return;
+      }
+      editingSchedules.delete(s.id);
+      scheduleEditCarry.delete(s.id);
+      await refreshSchedules();
+    } catch (err) {
+      alert('edit failed: ' + err);
+    } finally {
+      if (submitBtn) { submitBtn.disabled = false; submitBtn.textContent = originalLabel; }
+    }
+  }
+  async function fireScheduleNow(id, isOneShot, targets, btn) {
+    const targetList = targets.length ? targets.join(', ') : '(no active targets)';
+    const prompt = isOneShot
+      ? `fire schedule #${id} now to ${targetList}?\n\n`
+        + 'this is a ONE-SHOT — firing now consumes the schedule. '
+        + 'the scheduled fire time will no longer trigger.'
+      : `fire schedule #${id} now to ${targetList}?\n\n`
+        + 'this is RECURRING — sends an extra pulse out-of-band. '
+        + 'the regular cadence keeps firing on schedule.';
+    if (!confirm(prompt)) return;
+    // Capture child nodes so we can restore on error, then replace
+    // with DOM-built content (textContent + element children rather
+    // than innerHTML — per argus's review note on #471, the format
+    // string only carries server-side ints/bool today but textContent
+    // is the safer pattern if a stringy field ever lands).
+    const originalChildren = btn ? Array.from(btn.childNodes) : [];
+    const restoreBtn = () => {
+      if (!btn) return;
+      btn.disabled = false;
+      while (btn.firstChild) btn.removeChild(btn.firstChild);
+      for (const n of originalChildren) btn.appendChild(n);
+    };
+    if (btn) {
+      btn.disabled = true;
+      while (btn.firstChild) btn.removeChild(btn.firstChild);
+      btn.append(el('span', { class: 'spinner' }, '◐'), ' firing…');
+    }
+    try {
+      const resp = await fetch('/api/schedules/' + encodeURIComponent(id) + '/fire-now', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+      });
+      if (!resp.ok) {
+        const text = await resp.text().catch(() => '');
+        alert('fire-now failed: http ' + resp.status + (text ? '\n\n' + text : ''));
+        restoreBtn();
+        return;
+      }
+      // Backend returns FireNowReport { ok, failed, missing, one_shot_consumed }.
+      // Flash the per-target outcome on the button itself so the operator
+      // sees the result immediately, then refresh to pick up the
+      // authoritative per-target `last_result` annotations.
+      let report = null;
+      try { report = await resp.json(); } catch { /* shape drift / empty body — ignore */ }
+      if (btn && report) {
+        const bits = [];
+        if (report.ok) bits.push(report.ok + ' ok');
+        if (report.failed) bits.push(report.failed + ' failed');
+        if (report.missing) bits.push(report.missing + ' missing');
+        const suffix = report.one_shot_consumed ? ' — consumed' : '';
+        while (btn.firstChild) btn.removeChild(btn.firstChild);
+        btn.textContent = '↯ fired: ' + (bits.join(', ') || 'no targets') + suffix;
+        btn.classList.add('btn-fire-now-flashed');
+      }
+      // Hold the flash briefly so the operator can read it before the
+      // refresh wipes the row in place.
+      setTimeout(() => { refreshSchedules(); }, 1500);
+    } catch (err) {
+      alert('fire-now failed: ' + err);
+      restoreBtn();
+    }
+  }
+  async function cancelScheduleAll(id) {
+    if (!confirm(`cancel schedule #${id}? this stops all future fires for every target.`)) return;
+    await postScheduleCancel(id, null);
+  }
+  async function cancelScheduleTargets(id, targets) {
+    if (!confirm(`cancel schedule #${id} for ${targets.join(', ')}? other targets keep firing.`)) return;
+    await postScheduleCancel(id, targets);
+  }
+  async function postScheduleCancel(id, targets) {
+    try {
+      const opts = {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+      };
+      if (targets) opts.body = JSON.stringify({ targets });
+      const resp = await fetch('/api/schedules/' + encodeURIComponent(id) + '/cancel', opts);
+      if (!resp.ok) {
+        const text = await resp.text().catch(() => '');
+        alert('cancel failed: http ' + resp.status + (text ? '\n\n' + text : ''));
+        return;
+      }
+      await refreshSchedules();
+    } catch (err) {
+      alert('cancel failed: ' + err);
+    }
+  }
+
+  // ─── state polling ──────────────────────────────────────────────────────
+  let pollTimer = null;
+  // Sections whose innerHTML gets blown away on each refresh. If the
+  // operator is typing in one of them, skip the refresh — the next
+  // tick (or a manual action) will pick it up after they blur.
+  const MANAGED_SECTION_IDS = [
+    'containers-section',
+    'tombstones-section',
+    'questions-section',
+    'inbox-section',
+    'approvals-section',
+    'meta-inputs-section',
+    'rebuild-queue-section',
+    'reminders-section',
+    'schedule-new-section',
+    'schedules-section',
+  ];
+  // <details> sections that should survive a refresh need a stable
+  // `data-restore-key` attribute. snapshotOpenDetails walks managed
+  // sections and records which keys are currently open; restoreOpenDetails
+  // re-applies after the render. (Long-content drill-ins — file
+  // previews, diffs, logs, config — open in the side panel instead,
+  // which lives outside the managed sections and survives re-render
+  // on its own.)
+  function snapshotOpenDetails() {
+    const open = new Set();
+    for (const id of MANAGED_SECTION_IDS) {
+      const sect = document.getElementById(id);
+      if (!sect) continue;
+      for (const d of sect.querySelectorAll('details[data-restore-key]')) {
+        if (d.open) open.add(d.dataset.restoreKey);
+      }
+    }
+    return open;
+  }
+  function restoreOpenDetails(open) {
+    if (!open.size) return;
+    for (const id of MANAGED_SECTION_IDS) {
+      const sect = document.getElementById(id);
+      if (!sect) continue;
+      for (const d of sect.querySelectorAll('details[data-restore-key]')) {
+        if (open.has(d.dataset.restoreKey)) d.open = true;
+      }
+    }
+  }
+
+  function operatorIsTyping() {
+    const el_ = document.activeElement;
+    if (!el_ || el_ === document.body) return false;
+    const tag = el_.tagName;
+    if (tag !== 'INPUT' && tag !== 'TEXTAREA' && tag !== 'SELECT') return false;
+    return MANAGED_SECTION_IDS.some((id) => {
+      const sect = document.getElementById(id);
+      return sect && sect.contains(el_);
+    });
+  }
+  async function refreshState() {
+    // Don't yank the form out from under the operator. Try again
+    // shortly on the next tick; eventually they'll blur and the
+    // refresh lands.
+    if (operatorIsTyping()) {
+      if (pollTimer) clearTimeout(pollTimer);
+      pollTimer = setTimeout(refreshState, 2000);
+      return;
+    }
+    try {
+      const resp = await fetch('/api/state');
+      if (!resp.ok) throw new Error('http ' + resp.status);
+      const s = await resp.json();
+      // Stash the latest snapshot for any sub-widget that wants a
+      // synchronous read (e.g. the compose autocomplete pulls agent
+      // names from here instead of refetching on every keystroke).
+      window.__hyperhive_state = s;
+      const openDetails = snapshotOpenDetails();
+      // Sync transients + containers first so renderContainers below
+      // sees the current derived maps (it reads from
+      // `transientsState` + `containersState`, not from `s.*`).
+      syncTransientsFromSnapshot(s);
+      syncContainersFromSnapshot(s);
+      syncTombstonesFromSnapshot(s);
+      syncMetaInputsFromSnapshot(s);
+      syncRebuildQueueFromSnapshot(s);
+      renderContainers(s);
+      renderTombstones(s);
+      // Sync the derived approvals + questions stores from the
+      // snapshot, then render. Live `*_added` / `*_resolved` events
+      // mutate the stores directly and re-render without a snapshot
+      // refetch.
+      syncQuestionsFromSnapshot(s);
+      renderQuestions();
+      // (renderInbox now lives in ./flow.js — dashboard has no
+      // #inbox-section element to render into.)
+      syncApprovalsFromSnapshot(s);
+      renderApprovals();
+      renderMetaInputs(s);
+      renderRebuildQueue(s);
+      refreshReminders();
+      refreshSchedules();
+      restoreOpenDetails(openDetails);
+      notifyDeltas(s);
+      // No periodic refresh timer. Phase 6 covers every container
+      // mutation with `ContainerStateChanged` / `ContainerRemoved`
+      // (lifecycle ops, destroy, rebuild, crash_watch's 10s poll);
+      // approvals + questions + transients have their own events;
+      // broker traffic flows through the SSE channel. The only
+      // /api/state fetches are the initial cold load and the
+      // post-submit refetch on forms without `data-no-refresh`
+      // (tombstones, meta-input updates).
+      if (pollTimer) { clearTimeout(pollTimer); pollTimer = null; }
+    } catch (err) {
+      console.error('refreshState failed', err);
+      // Schedule a single retry on transient errors so the page
+      // recovers from a brief network blip without making the
+      // operator reload.
+      pollTimer = setTimeout(refreshState, 5000);
+    }
+  }
+  refreshState();
+  NOTIF.bind();
+  Panel.bind();
+
+  // ─── live updates: dashboard event stream (#406 step 3) ────────────────
+  // The dashboard subscribes to /dashboard/stream for live mutation
+  // events so the SW4RM / Y3R C4LL / SYST3M panes update without an
+  // operator action triggering a refreshState. Pre-step-2 this wiring
+  // lived inside the broker-terminal IIFE which only fired on /flow.html
+  // — meaning /index.html only updated on cold load + after async-form
+  // submits.
+  //
+  // Bare `EventSource` (no terminal infrastructure needed — the
+  // dashboard doesn't render broker rows). Each event's `kind` is
+  // looked up against `MUTATION_HANDLERS`; unknown kinds (broker
+  // `sent` / `delivered`, anything new the backend adds) silently
+  // no-op. On (re)connect we kick a refreshState() to recover events
+  // lost during the disconnect window (same pattern as flow.js's
+  // onStreamOpen).
+  //
+  // `#408` will give /index.html its own stream that omits the
+  // broker traffic the dashboard never uses; for now both pages
+  // subscribe to `/dashboard/stream` and filter client-side.
+  const MUTATION_HANDLERS = {
+    approval_added:    applyApprovalAdded,
+    approval_resolved: applyApprovalResolved,
+    question_added:    applyQuestionAdded,
+    question_resolved: applyQuestionResolved,
+    transient_set:     applyTransientSet,
+    transient_cleared: applyTransientCleared,
+    container_state_changed: applyContainerStateChanged,
+    container_removed:       applyContainerRemoved,
+    tombstones_changed:      applyTombstonesChanged,
+    meta_inputs_changed:     applyMetaInputsChanged,
+    meta_update_running:     applyMetaUpdateRunning,
+    rebuild_queue_changed:   applyRebuildQueueChanged,
+  };
+  (function bindDashboardStream() {
+    // #448: route the EventSource through a SharedWorker so all open
+    // hyperhive tabs share ONE backend SSE connection. Survives
+    // Firefox's per-tab connection throttling under many-open-tabs
+    // pressure (the actual mara symptom). `openStream` returns an
+    // EventSource-shaped facade so the rest of this IIFE is unchanged;
+    // graceful fallback to direct `new EventSource` when SharedWorker
+    // isn't supported.
+    const es = openStream('/dashboard/stream');
+    es.onmessage = (e) => {
+      let ev;
+      try { ev = JSON.parse(e.data); } catch { return; }
+      const h = MUTATION_HANDLERS[ev.kind];
+      if (!h) return; // broker rows + future kinds — dashboard doesn't care
+      try { h(ev); }
+      catch (err) { console.error('dashboard SSE handler', ev.kind, err); }
+    };
+    es.onopen = () => {
+      // Re-sync to recover events that fired during a disconnect
+      // window (issue #163). Initial connect also fires onopen — the
+      // first refreshState() above and this one race, but refreshState
+      // is idempotent so the second call just overwrites with the
+      // freshest snapshot. Cheap on a quiescent server, fine to repeat.
+      refreshState();
+    };
+    es.onerror = () => {
+      // EventSource auto-reconnects; nothing to do beyond logging.
+      console.debug('dashboard SSE error, will retry');
+    };
+  })();
+
+  // ─── tab routing (#369) ────────────────────────────────────────────────
+  // Hash-based: `#swarm` / `#call` / `#system` activate the matching
+  // pane on the dashboard. Empty hash defaults to SW4RM. FL0W is NOT
+  // a tab — it's a separate page (`/flow.html`) reached via the
+  // tab-strip link. Tab routing only applies when the tab DOM is
+  // present (e.g. not on the flow page itself, where these elements
+  // don't exist and the loop no-ops).
+  const TABS = ['swarm', 'call', 'system', 'schedules'];
+  function activateTab(name) {
+    const target = TABS.includes(name) ? name : TABS[0];
+    for (const t of TABS) {
+      const tab = $('tab-' + t);
+      const pane = $('tab-pane-' + t);
+      if (tab) tab.classList.toggle('active', t === target);
+      if (pane) pane.classList.toggle('tab-pane-active', t === target);
+    }
+    // #459: schedules pane has no SSE channel yet (PR C follow-up), so
+    // re-fetch on activation so the operator never lands on stale data.
+    if (target === 'schedules') refreshSchedules();
+  }
+  function syncTabFromHash() {
+    const h = (window.location.hash || '#swarm').replace(/^#/, '');
+    activateTab(h);
+  }
+  window.addEventListener('hashchange', syncTabFromHash);
+  syncTabFromHash();
+
+  // Tab count pills — pure derived data from the existing state
+  // stores so SSE-driven updates flow through without extra plumbing.
+  // Set `hidden` when the count is zero so the pill doesn't draw
+  // attention to an empty room.
+  function setTabCount(tab, n) {
+    const el_ = $('tab-count-' + tab);
+    if (!el_) return;
+    el_.textContent = String(n);
+    el_.hidden = n <= 0;
+  }
+  /** Recompute every tab's count from the current state. Called on
+   *  every renderXxx that's tab-relevant. */
+  function refreshTabCounts() {
+    // SW4RM — flag any container that's stale (needs_update). Empty
+    // when everyone's current. Container-row pulse signals state
+    // transitions; the pill catches "deploy-pending" specifically.
+    let swarm = 0;
+    for (const c of containersState.values()) {
+      if (c.needs_update) swarm++;
+    }
+    setTabCount('swarm', swarm);
+    // Y3R C4LL — pending approvals + operator-targeted questions.
+    const callCount =
+      (approvalsState?.pending?.length ?? 0) +
+      (questionsState?.pending?.length ?? 0);
+    setTabCount('call', callCount);
+    // SYST3M — queued + running rebuild_queue entries (terminal
+    // entries are kept for history but aren't 'attention').
+    let sysCount = 0;
+    if (rebuildQueueState) {
+      for (const e of rebuildQueueState) {
+        if (e.state === 'Queued' || e.state === 'Running') sysCount++;
+      }
+    }
+    setTabCount('system', sysCount);
+    // SCH3DUL3S — count of schedules with at least one still-active
+    // target (whole-schedule cancellation or all-targets-cancelled
+    // means "not waiting on the worker"; those don't pull attention).
+    setTabCount('schedules', activeScheduleCount());
+    // FL0W pill count: lives in ./flow.js now (it has the inbox
+    // derived store). Dashboard tab strip's `#tab-count-flow` slot
+    // stays hidden by default; future plumbing could broadcast the
+    // count via localStorage / BroadcastChannel if both pages are
+    // open.
+  }
+  // Poll the state stores on a 1s tick to keep the pill counts in
+  // sync. The state stores are mutated synchronously by every SSE
+  // event + refreshState call, so polling them is correct and cheap
+  // — no per-renderer hookup needed.
+  refreshTabCounts();
+  setInterval(refreshTabCounts, 1000);
+
+  // Flow-specific IIFEs moved to ./flow.js (#406 step 2): inbox-pill
+  // wiring, the broker terminal init, and the @-mention composer.
+  // /index.html no longer loads them — only /flow.html does.
+})();
diff --git a/frontend/packages/shared/package.json b/frontend/packages/shared/package.json
new file mode 100644
index 00000000..795ed42c
--- /dev/null
+++ b/frontend/packages/shared/package.json
@@ -0,0 +1,17 @@
+{
+  "name": "@hive/shared",
+  "version": "0.0.0",
+  "private": true,
+  "description": "Shared frontend modules used by both the dashboard and the per-agent UI: terminal log pane, Catppuccin palette, base typography. Imported by sibling workspaces; not bundled standalone.",
+  "type": "module",
+  "main": "./src/index.js",
+  "exports": {
+    ".": "./src/index.js",
+    "./terminal.js": "./src/terminal.js",
+    "./base.css": "./src/base.css",
+    "./terminal.css": "./src/terminal.css"
+  },
+  "files": [
+    "src/"
+  ]
+}
diff --git a/frontend/packages/shared/src/base.css b/frontend/packages/shared/src/base.css
new file mode 100644
index 00000000..ee7b64e6
--- /dev/null
+++ b/frontend/packages/shared/src/base.css
@@ -0,0 +1,24 @@
+/* Base palette + typography shared by the hive-c0re dashboard and the
+   hive-ag3nt web UI. Catppuccin Mocha. Per-page stylesheets append on
+   top of this and must NOT redeclare the colour variables — the whole
+   point of pulling them out is one source of truth. */
+:root {
+  --bg: #1e1e2e;        /* base */
+  --bg-elev: #181825;   /* mantle */
+  --fg: #cdd6f4;        /* text */
+  --muted: #7f849c;     /* overlay1 */
+  --purple: #cba6f7;    /* mauve */
+  --purple-dim: #45475a;/* surface1 */
+  --cyan: #89dceb;      /* sky */
+  --pink: #f5c2e7;      /* pink */
+  --amber: #fab387;     /* peach */
+  --green: #a6e3a1;     /* green */
+  --red: #f38ba8;       /* red */
+  --border: #313244;    /* surface0 */
+}
+body {
+  background: var(--bg);
+  color: var(--fg);
+  font-family: "JetBrains Mono", "Fira Code", "Cascadia Code", "Source Code Pro", monospace;
+  line-height: 1.6;
+}
diff --git a/frontend/packages/shared/src/index.js b/frontend/packages/shared/src/index.js
new file mode 100644
index 00000000..49f5c1dc
--- /dev/null
+++ b/frontend/packages/shared/src/index.js
@@ -0,0 +1,3 @@
+// Convenience re-export so consumers can `import { create, linkify }
+// from '@hive/shared'` without naming the sub-module path.
+export { create, linkify } from './terminal.js';
diff --git a/frontend/packages/shared/src/terminal.css b/frontend/packages/shared/src/terminal.css
new file mode 100644
index 00000000..b28449a1
--- /dev/null
+++ b/frontend/packages/shared/src/terminal.css
@@ -0,0 +1,228 @@
+/* Shared terminal pane: a scroll-sticky log of rows + a "↓ N new" pill.
+   Pages wrap their stream container in `.terminal-wrap` and give the log
+   itself the `.live` class; renderer JS appends `.row` (flat line) or
+   `details.row` (collapsible body) elements. Row-kind classes
+   (`.turn-start`, `.tool-use`, `.thinking`, etc.) carry the per-event
+   colour; pages that don't emit a given kind simply never produce that
+   class — the unused rule sits in the bundle harmlessly.
+
+   `.terminal-wrap` provides the crust-on-black phosphor chrome that makes
+   the agent page feel like a terminal. Pages can opt in by wrapping a
+   block in this class; or skip it and the rows still render with their
+   class colours, just without the frame.
+
+   No `.term-input` here — composers are a separate concern (see
+   hive-fr0nt::COMPOSER_CSS / COMPOSER_JS once introduced). */
+
+.terminal-wrap {
+  position: relative;
+  background: rgba(17, 17, 27, 0.78);
+  -webkit-backdrop-filter: blur(8px) saturate(120%);
+  backdrop-filter: blur(8px) saturate(120%);
+  border: 1px solid var(--purple-dim);
+  box-shadow: inset 0 0 24px rgba(0, 0, 0, 0.7);
+  border-radius: 4px;
+  font-family: "JetBrains Mono", "Fira Code", "Cascadia Code", "Source Code Pro", monospace;
+  font-size: 0.92em;
+  color: var(--fg);
+  margin-top: 0.6em;
+}
+.live {
+  background: rgba(255, 255, 255, 0.02);
+  border: 1px solid var(--purple-dim);
+  padding: 0.4em 0.6em;
+  overflow-y: auto;
+  max-height: 32em;
+  font-family: inherit;
+}
+.live.terminal {
+  background: transparent;
+  border: 0;
+  box-shadow: none;
+  border-radius: 0;
+  padding: 0.8em 1em 0.4em;
+  overflow-y: auto;
+  height: min(72vh, 60em);
+  max-height: none;
+  font-family: inherit;
+  font-size: inherit;
+  color: inherit;
+}
+.live .row,
+.live details.row {
+  animation: row-fade-in 220ms ease-out both;
+}
+.live .row.no-anim,
+.live details.row.no-anim {
+  animation: none;
+}
+@keyframes row-fade-in {
+  from { opacity: 0; transform: translateY(4px); }
+  to   { opacity: 1; transform: translateY(0); }
+}
+/* Unified prefix column for every row kind. The glyph (`→ ← · ◆ ✓ ✗ ⌁ !`)
+   is the first character of the row's text content; `padding-left` reserves
+   the column and `text-indent: -1.4em` pulls the glyph back into it. Wrapped
+   continuation lines then start under the body, not under the glyph, so
+   wraps don't blur into the next row. `details.row` summaries reuse the
+   same metrics below. */
+.live .row {
+  white-space: pre-wrap;
+  word-break: break-word;
+  padding: 0.05em 0;
+  line-height: 1.45;
+  border-left: 2px solid transparent;
+  padding-left: 1.9em;
+  text-indent: -1.4em;
+  margin: 0.1em 0;
+}
+.live .row + .row { border-top: 0; }
+/* Row-kind colours. Pages register renderers that emit these classes;
+   any class no page emits is just dead CSS, which is fine. Turn-framing
+   classes carry their signal entirely on the coloured border-left rule —
+   no bold, no top/bottom margins, no background tint. The chrome was
+   overweight for what's just a "this is a boundary" marker. */
+.live .turn-start    { color: var(--amber); border-left-color: var(--amber); }
+/* turn-body is a child block under turn-start carrying the wake-prompt
+   body; reset text-indent so wrapped content stays under its own column
+   instead of pulling back into the parent's prefix. */
+.live .turn-body     { color: var(--fg); text-indent: 0; margin-top: 0.15em; }
+/* Any child block (markdown body, nested details) resets the parent
+   row's hanging indent so the content lays out from column 0 of the
+   body area. */
+.live .row .md, .live .row > details { text-indent: 0; }
+.live .turn-end-ok   { color: var(--green); border-left-color: var(--green); }
+.live .turn-end-fail { color: var(--red);   border-left-color: var(--red); }
+.live .text        { color: var(--fg);    }
+.live .thinking    { color: var(--muted); font-style: italic; }
+.live .tool-use    { color: var(--cyan);  }
+.live .tool-result { color: var(--muted); }
+.live .result      { color: var(--green); }
+.live .note        { color: var(--muted); }
+/* Distinguish stderr lines (orange) and operator-initiated notes
+   (mauve, lightly emphasised) from ambient harness chatter so the
+   eye picks out anomalies + operator actions in the scrollback. */
+.live .note.stderr { color: var(--amber); }
+.live .note.op     { color: var(--purple); font-style: italic; }
+/* The .sys catch-all fires when renderStream landed an event shape it
+   couldn't classify. Make it visually loud so silently-dropped event
+   types surface for follow-up. */
+.live .sys         { color: var(--amber); }
+.live .unread-badge {
+  color: var(--amber);
+  font-weight: normal;
+  margin-left: 0.6em;
+  font-size: 0.85em;
+  text-shadow: 0 0 6px rgba(250, 179, 135, 0.55);
+  animation: badge-pulse 1.4s ease-in-out infinite;
+}
+@keyframes badge-pulse {
+  0%, 100% { opacity: 1;   text-shadow: 0 0 6px rgba(250, 179, 135, 0.55); }
+  50%      { opacity: 0.7; text-shadow: 0 0 14px rgba(250, 179, 135, 0.95); }
+}
+/* "↓ N new" pill: shown when new rows arrive while the operator is
+   scrolled up; click to jump to bottom. Positioned by the wrapper's
+   `position: relative` (terminal-wrap supplies it; pages that skip the
+   wrapper must add their own positioned ancestor). */
+.tail-pill {
+  position: absolute;
+  right: 1em;
+  bottom: 4.2em;
+  background: var(--amber);
+  color: #11111b;
+  font-family: inherit;
+  font-size: 0.8em;
+  font-weight: bold;
+  letter-spacing: 0.08em;
+  border: 0;
+  border-radius: 999px;
+  padding: 0.35em 0.9em;
+  cursor: pointer;
+  box-shadow: 0 0 14px -2px rgba(250, 179, 135, 0.85);
+  opacity: 0;
+  transform: translateY(6px);
+  pointer-events: none;
+  transition: opacity 160ms ease, transform 160ms ease;
+}
+.tail-pill.visible {
+  opacity: 1;
+  transform: translateY(0);
+  pointer-events: auto;
+}
+.tail-pill:hover { filter: brightness(1.1); }
+/* Expandable rows reuse the flat-row prefix metrics (padding-left +
+   negative text-indent) so the disclosure glyph (`▸ / ▾`) lands in
+   exactly the same column as flat-row prefix glyphs (`→ ← · ◆ ✓ ✗`).
+   Summary text omits the per-row directional glyph (the row colour
+   already carries cyan = outbound tool, muted = inbound result) so
+   the prefix column doesn't have to fit two glyphs side-by-side. */
+details.row {
+  white-space: normal;
+}
+details.row > summary {
+  cursor: pointer;
+  list-style: none;
+  white-space: pre-wrap;
+  word-break: break-word;
+}
+details.row > summary::before {
+  content: '▸ ';
+  color: inherit;
+}
+details.row[open] > summary::before { content: '▾ '; }
+details.row > pre.diff-body,
+details.row > pre.tool-body {
+  margin: 0.3em 0 0.4em 0;
+  padding: 0.4em 0.6em;
+  text-indent: 0;
+  background: rgba(255, 255, 255, 0.02);
+  border-left: 2px solid var(--purple-dim);
+  white-space: pre-wrap;
+  word-break: break-word;
+  max-height: 22em;
+  overflow-y: auto;
+}
+details.row > pre.tool-body { color: var(--fg); }
+details.row > pre.diff-body .diff-add { color: var(--green); }
+details.row > pre.diff-body .diff-del { color: var(--red); }
+details.row > pre.diff-body .diff-ctx { color: var(--fg); }
+/* Markdown body inside a row (assistant text, send/recv/ask/answer
+   message bodies). Inline elements get muted accents; block elements
+   reset the parent row's hanging indent so content lays out cleanly. */
+.live .row .md p { margin: 0.2em 0; }
+.live .row .md p:first-child { margin-top: 0; }
+.live .row .md p:last-child  { margin-bottom: 0; }
+.live .row .md code {
+  background: rgba(255, 255, 255, 0.06);
+  padding: 0.05em 0.3em;
+  border-radius: 3px;
+  font-size: 0.95em;
+}
+.live .row .md pre {
+  margin: 0.3em 0;
+  padding: 0.4em 0.6em;
+  background: rgba(255, 255, 255, 0.04);
+  border-left: 2px solid var(--purple-dim);
+  text-indent: 0;
+  white-space: pre-wrap;
+  word-break: break-word;
+}
+.live .row .md pre code {
+  background: transparent;
+  padding: 0;
+  border-radius: 0;
+}
+.live .row .md a { color: var(--cyan); text-decoration: underline; }
+/* Auto-linkified bare URLs in plain rows + tool-body blocks (issue #233). */
+.live .row a { color: var(--cyan); text-decoration: underline; }
+.live .row a:hover { color: var(--fg); }
+.live .row .md strong { color: inherit; font-weight: bold; }
+.live .row .md em { color: inherit; font-style: italic; }
+.live .row .md ul, .live .row .md ol { margin: 0.2em 0 0.2em 1.4em; padding: 0; }
+.live .row .md li { margin: 0.05em 0; }
+.live .row .md blockquote {
+  margin: 0.2em 0;
+  padding-left: 0.6em;
+  border-left: 2px solid var(--purple-dim);
+  color: var(--muted);
+}
diff --git a/frontend/packages/shared/src/terminal.js b/frontend/packages/shared/src/terminal.js
new file mode 100644
index 00000000..b47b08c2
--- /dev/null
+++ b/frontend/packages/shared/src/terminal.js
@@ -0,0 +1,471 @@
+// Shared terminal pane: sticky-bottom log + "↓ N new" pill + history
+// backfill + live SSE. Pages provide a kind→renderer map; this module
+// owns scroll behaviour, animation suppression on backfill, and the
+// EventSource lifecycle.
+//
+// Usage:
+//
+//   import { create, linkify } from '@hive/shared/terminal.js';
+//
+//   create({
+//     logEl: document.getElementById('msgflow'),
+//     historyUrl: '/messages/history?limit=200',  // optional
+//     streamUrl:  '/messages/stream',
+//     renderers: {
+//       sent:      (ev, api) => api.row('msgrow sent', ...),
+//       delivered: (ev, api) => api.row('msgrow delivered', ...),
+//       _default:  (ev, api) => api.row('note', JSON.stringify(ev)),
+//     },
+//     onLiveEvent: (ev) => { /* live-only side effects (notif, state pokes) */ },
+//     onAnyEvent:  (ev, { fromHistory }) => { /* runs for every event in
+//       both backfill replay and live — use for derived views that need
+//       the full picture (e.g. a per-recipient inbox built from broker
+//       events) */ },
+//     onBackfillDone: (count) => { /* one-shot after history replay */ },
+//     onStreamOpen: () => { /* fires on every EventSource (re)connect —
+//       use to re-sync snapshot-derived state after a reconnect gap */ },
+//     pillAnchor: document.getElementById('msgflow').parentElement,
+//   });
+//
+// Renderers receive (ev, api) where api exposes:
+//
+//   api.row(cls, text)                  → appends a flat <div class="row cls">
+//   api.details(cls, summary, body)     → appends <details class="row cls">
+//                                          with a <pre.tool-body>
+//   api.detailsDiff(cls, summary, body) → ditto but body is line-coloured by
+//                                          leading "+ " / "- " prefix
+//   api.placeholder(text)               → replaces log content with a single
+//                                          muted "(placeholder)" row, cleared
+//                                          on the next real row
+//   api.fromHistory                     → true while backfill is replaying
+//
+// Each kind is dispatched to `renderers[ev.kind]`; unknown kinds fall
+// through to `renderers._default` (which itself defaults to a JSON-dump
+// note row). The convention is that the SSE/history endpoints emit
+// objects with a `kind` field.
+//
+// Backfill is best-effort: if `historyUrl` is unset or the fetch fails,
+// we skip straight to SSE. The optional `onBackfillDone(count)` hook
+// fires after replay finishes (or after a failed/skipped fetch with
+// count=0); pages use it to set state flags from the replayed history.
+
+const NEAR_BOTTOM_PX = 48;
+// Snap-to-bottom animation duration (#400 + mara feedback). Browser
+// default `scrollTo({ behavior: 'smooth' })` runs ~500ms, which read
+// as "still smooth, but visibly slow." 140ms with ease-out is fast
+// enough to feel snap-y, slow enough that the row's destination
+// reads as motion (not a jump). Distances under SCROLL_SNAP_PX
+// short-circuit to instant — animating a 12px nudge is just jitter.
+const SCROLL_ANIM_MS = 140;
+const SCROLL_SNAP_PX = 24;
+
+export function create(opts) {
+  const log = opts.logEl;
+  if (!log) throw new Error('HiveTerminal.create: logEl is required');
+  const renderers = opts.renderers || {};
+  const defaultRender = renderers._default
+    || ((ev, api) => api.row('note', JSON.stringify(ev)));
+  const pillAnchor = opts.pillAnchor || log.parentElement || log;
+
+  let placeholderEl = null;
+  let pill = null;
+  let unseen = 0;
+  let currentNoAnim = false;
+  // Sticky-bottom intent. True means "keep snapping to bottom on
+  // any mutation"; false means "the operator scrolled up — leave
+  // them alone". Updated synchronously from the scroll event
+  // handler so both programmatic scrollTop assignments and
+  // operator-driven wheel/drag stay in sync.
+  let stickToBottom = true;
+  // Guards scroll-event-handler from misreading the position while
+  // our own animation is mid-flight (#400). The animation drives
+  // scrollTop with rAF, which fires a stream of scroll events as
+  // the position eases toward the target — the position passes
+  // through "not near bottom" before settling. Without this gate,
+  // the scroll handler flips `stickToBottom` to false mid-animation,
+  // which then causes the MutationObserver to skip the next snap
+  // and leaves the operator stranded mid-scroll. Set to the
+  // animation's nominal end + small headroom; each fresh snap
+  // re-arms it so back-to-back snaps stay gated.
+  let smoothScrollingUntil = 0;
+  // rAF id for the current snap animation. Cancelled when a new
+  // snap starts so we never have two animations fighting over
+  // scrollTop.
+  let scrollAnimRaf = 0;
+
+  function isNearBottom() {
+    return log.scrollHeight - log.scrollTop - log.clientHeight <= NEAR_BOTTOM_PX;
+  }
+  // Snap the log to the bottom with a brief eased animation
+  // (#400 + mara: snappier than the browser's default 500ms smooth
+  // scroll). Each call cancels the previous frame loop and starts a
+  // fresh one, so a burst of mutations coalesces into one ride to
+  // the latest bottom. Re-evaluates the target each frame so a
+  // renderer mutation landing mid-animation extends the destination
+  // without a visible jump. Falls back to instant scroll when
+  // `currentNoAnim` is true (backfill replay — operator never sees
+  // intermediate positions, animation is wasted frames) or when the
+  // remaining distance is under SCROLL_SNAP_PX.
+  function snapToBottom(immediate) {
+    stickToBottom = true;
+    if (scrollAnimRaf) {
+      cancelAnimationFrame(scrollAnimRaf);
+      scrollAnimRaf = 0;
+    }
+    const target = log.scrollHeight - log.clientHeight;
+    const start = log.scrollTop;
+    const distance = target - start;
+    if (immediate || currentNoAnim || distance <= SCROLL_SNAP_PX) {
+      smoothScrollingUntil = 0;
+      log.scrollTop = target;
+      return;
+    }
+    smoothScrollingUntil = Date.now() + SCROLL_ANIM_MS + 80;
+    const t0 = performance.now();
+    const easeOut = (t) => 1 - Math.pow(1 - t, 3);
+    const step = (now) => {
+      const elapsed = now - t0;
+      const frac = Math.min(1, elapsed / SCROLL_ANIM_MS);
+      // Re-read target each frame so mutations landing mid-animation
+      // (the common case — a renderer appended badge / body bits
+      // after api.row returned) extend the destination smoothly
+      // rather than landing short.
+      const currentTarget = log.scrollHeight - log.clientHeight;
+      log.scrollTop = start + (currentTarget - start) * easeOut(frac);
+      if (frac < 1) {
+        scrollAnimRaf = requestAnimationFrame(step);
+      } else {
+        // Final exact settle on the as-of-now bottom.
+        log.scrollTop = log.scrollHeight - log.clientHeight;
+        scrollAnimRaf = 0;
+      }
+    };
+    scrollAnimRaf = requestAnimationFrame(step);
+  }
+  function ensurePill() {
+    if (pill) return pill;
+    pill = document.createElement('button');
+    pill.type = 'button';
+    pill.className = 'tail-pill';
+    pill.addEventListener('click', () => snapToBottom());
+    pillAnchor.appendChild(pill);
+    return pill;
+  }
+  function updatePill() {
+    if (unseen <= 0) {
+      if (pill) pill.classList.remove('visible');
+      return;
+    }
+    ensurePill();
+    pill.textContent = '↓ ' + unseen + ' new';
+    pill.classList.add('visible');
+  }
+  log.addEventListener('scroll', () => {
+    // Mid-smooth-scroll: ignore the intermediate scroll events. The
+    // gate releases when the animation has had time to settle (or
+    // when the next snap re-arms it). Without this, easing toward
+    // bottom would flip `stickToBottom` false partway and the next
+    // MO callback would skip the snap.
+    if (Date.now() < smoothScrollingUntil) return;
+    stickToBottom = isNearBottom();
+    if (stickToBottom) { unseen = 0; updatePill(); }
+  });
+  // Post-append mutations (issue #393). Renderers commonly call
+  // `api.row(cls, text)` to create the row shell, then mutate it
+  // by appending more children (badges, multi-line bodies, tool
+  // result panes) AFTER api.row returned. The afterAppend scroll
+  // below only sees the row's INITIAL height — once the renderer
+  // adds the body, the row's grown past the visible bottom and
+  // the operator is left scrolled to the row's TOP, breaking
+  // stick-to-bottom for every subsequent event.
+  //
+  // Fix: MutationObserver on the log subtree. Fires once per
+  // microtask after each batch of synchronous mutations, so it
+  // runs once per renderer call regardless of how many children
+  // the renderer appends. When `stickToBottom` is true, snap to
+  // bottom again — catches whatever the renderer added after the
+  // afterAppend hop. Programmatic `scrollTop = scrollHeight`
+  // assignments don't re-trigger MO (the scroll itself isn't a
+  // DOM mutation), so no feedback loop.
+  const mo = new MutationObserver(() => {
+    if (stickToBottom) snapToBottom();
+  });
+  mo.observe(log, { childList: true, subtree: true, characterData: true });
+
+  // Auto-scroll decision uses the PRE-append scroll position
+  // (issue #375). Checking after the append underestimates
+  // "nearness" because the new row's own height has already pushed
+  // `scrollHeight - scrollTop - clientHeight` past the threshold,
+  // even when the user was visually at the bottom an instant ago.
+  // Each row/details/detailsDiff captures `nearBottomBeforeAppend`
+  // and hands it to afterAppend so the auto-scroll triggers
+  // whenever the operator was at the bottom when the row landed.
+  // (The MutationObserver above catches the AFTER-row mutations
+  // too, but this initial scroll keeps the visual lag to one
+  // frame instead of one microtask + frame.)
+  function afterAppend(wasNearBottom) {
+    if (currentNoAnim || wasNearBottom) {
+      snapToBottom();
+    } else {
+      unseen += 1;
+      updatePill();
+    }
+  }
+  function clearPlaceholder() {
+    if (placeholderEl && placeholderEl.parentElement === log) {
+      log.removeChild(placeholderEl);
+    }
+    placeholderEl = null;
+  }
+  function placeholder(text) {
+    clearPlaceholder();
+    const e = document.createElement('div');
+    e.className = 'row note';
+    e.textContent = text;
+    log.appendChild(e);
+    placeholderEl = e;
+  }
+  function row(cls, text) {
+    clearPlaceholder();
+    const wasNearBottom = isNearBottom();
+    const e = document.createElement('div');
+    e.className = 'row ' + (cls || '') + (currentNoAnim ? ' no-anim' : '');
+    e.appendChild(linkify(text));
+    log.appendChild(e);
+    afterAppend(wasNearBottom);
+    return e;
+  }
+  function details(cls, summary, body) {
+    clearPlaceholder();
+    const wasNearBottom = isNearBottom();
+    const d = document.createElement('details');
+    d.className = 'row ' + (cls || '') + (currentNoAnim ? ' no-anim' : '');
+    const s = document.createElement('summary');
+    s.textContent = summary;
+    d.appendChild(s);
+    const pre = document.createElement('pre');
+    pre.className = 'tool-body';
+    pre.appendChild(linkify(body));
+    d.appendChild(pre);
+    log.appendChild(d);
+    afterAppend(wasNearBottom);
+    return d;
+  }
+  function detailsDiff(cls, summary, body) {
+    clearPlaceholder();
+    const wasNearBottom = isNearBottom();
+    const d = document.createElement('details');
+    d.className = 'row ' + (cls || '') + (currentNoAnim ? ' no-anim' : '');
+    const s = document.createElement('summary');
+    s.textContent = summary;
+    d.appendChild(s);
+    const pre = document.createElement('pre');
+    pre.className = 'tool-body diff-body';
+    for (const line of String(body).split('\n')) {
+      const span = document.createElement('span');
+      if (line.startsWith('+ ')) span.className = 'diff-add';
+      else if (line.startsWith('- ')) span.className = 'diff-del';
+      else span.className = 'diff-ctx';
+      span.textContent = line + '\n';
+      pre.appendChild(span);
+    }
+    d.appendChild(pre);
+    log.appendChild(d);
+    afterAppend(wasNearBottom);
+    return d;
+  }
+
+  function api(extra) {
+    return Object.assign({
+      row, details, detailsDiff, placeholder, linkify,
+      fromHistory: false,
+    }, extra || {});
+  }
+  function dispatch(ev, fromHistory) {
+    const r = renderers[ev.kind] || defaultRender;
+    try {
+      r(ev, api({ fromHistory }));
+    } catch (err) {
+      console.error('terminal renderer threw', ev, err);
+      row('note', '[render err] ' + (err && err.message ? err.message : err));
+    }
+    if (opts.onAnyEvent) {
+      try { opts.onAnyEvent(ev, { fromHistory }); }
+      catch (err) { console.error('onAnyEvent threw', err); }
+    }
+  }
+
+  // Subscribe → buffer → fetch history → dedupe → apply.
+  //
+  // Race the SSE subscription opens before the history fetch starts.
+  // Live events that land before history resolves are buffered, not
+  // rendered. Once the history response (`{ seq, events }`) arrives we:
+  //   1. Replay `events` (fromHistory=true).
+  //   2. Drop buffered events with `seq <= history.seq` — they're
+  //      already reflected in the history rows above.
+  //   3. Apply remaining buffered events (fromHistory=false).
+  //   4. Switch to live mode: each new SSE event dispatches immediately.
+  //
+  // Without this dance an event that fires between history-fetch and
+  // SSE-subscribe goes missing; without seq dedupe the same event
+  // shows twice (once via history, once via live buffer). Both bugs
+  // were latent before.
+  //
+  // If `historyUrl` is unset we skip the dance: buffered events apply
+  // as live the moment the buffer flushes (no dedupe possible without
+  // a boundary seq).
+  function start() {
+    let live = false;
+    let buffered = [];
+
+    // #448: callers can supply a `streamFactory(url)` that returns an
+    // EventSource-shaped object (must expose onmessage/onopen/onerror
+    // + .close()). The dashboard pages pass a SharedWorker-backed
+    // factory so all open hyperhive tabs share ONE upstream SSE
+    // connection. Default keeps the direct `new EventSource(url)`
+    // behaviour so non-dashboard consumers (per-agent UI) are unchanged.
+    const es = opts.streamFactory
+      ? opts.streamFactory(opts.streamUrl)
+      : new EventSource(opts.streamUrl);
+    es.onmessage = (e) => {
+      let ev;
+      try { ev = JSON.parse(e.data); }
+      catch (err) { row('note', '[parse err] ' + e.data); return; }
+      if (!live) { buffered.push(ev); return; }
+      dispatch(ev, false);
+      if (opts.onLiveEvent) {
+        try { opts.onLiveEvent(ev); }
+        catch (err) { console.error('onLiveEvent threw', err); }
+      }
+    };
+    es.onerror = () => {
+      // SharedWorker-backed facades expose `readyState` mirroring the
+      // upstream EventSource state; the native EventSource exposes the
+      // same. Either way the CONNECTING vs. closed distinction works.
+      if (es.readyState === 0 /* CONNECTING */) row('note', '[reconnecting…]');
+      else row('note', '[disconnected]');
+    };
+    es.onopen = () => {
+      // Fires on the initial connect and on every automatic
+      // reconnect. EventSource never replays events that fired
+      // during a disconnect window, so a consumer with
+      // snapshot-derived state (the dashboard's /api/state stores)
+      // must re-sync here or it shows stale state until a manual
+      // reload (issue #163).
+      if (opts.onStreamOpen) {
+        try { opts.onStreamOpen(); }
+        catch (err) { console.error('onStreamOpen threw', err); }
+      }
+    };
+
+    function flushBuffered(boundarySeq, historyKinds) {
+      const drained = buffered;
+      buffered = [];
+      live = true;
+      for (const ev of drained) {
+        // Seq-dedupe only events of a kind that actually appeared in
+        // the history replay — those are the only ones that could
+        // double (once via history, once via the live buffer).
+        // Mutation events (approval/question/container/…) are never
+        // carried by the history endpoint; deduping them against the
+        // broker-history seq would wrongly drop ones that fired
+        // between a consumer's own snapshot read and this history
+        // fetch (issue #163). ev.seq absent/0 → no dedupe possible.
+        if (boundarySeq != null
+            && typeof ev.seq === 'number' && ev.seq <= boundarySeq
+            && historyKinds && historyKinds.has(ev.kind)) {
+          continue;
+        }
+        dispatch(ev, false);
+        if (opts.onLiveEvent) {
+          try { opts.onLiveEvent(ev); }
+          catch (err) { console.error('onLiveEvent threw', err); }
+        }
+      }
+    }
+
+    async function backfill() {
+      if (!opts.historyUrl) {
+        flushBuffered(null);
+        if (opts.onBackfillDone) opts.onBackfillDone(0);
+        return;
+      }
+      try {
+        const resp = await fetch(opts.historyUrl);
+        if (!resp.ok) {
+          flushBuffered(null);
+          if (opts.onBackfillDone) opts.onBackfillDone(0);
+          return;
+        }
+        const body = await resp.json();
+        // Accept the envelope `{ seq, events }`. A bare array means
+        // the server hasn't been updated to include seq yet — treat
+        // it as "no dedupe possible."
+        const events = Array.isArray(body) ? body : (body.events || []);
+        const boundarySeq = Array.isArray(body) ? null : (body.seq ?? null);
+        // Kinds present in the history replay — the only kinds that
+        // can double and therefore the only ones to seq-dedupe.
+        const historyKinds = new Set(events.map((ev) => ev.kind));
+        currentNoAnim = true;
+        for (const ev of events) dispatch(ev, true);
+        currentNoAnim = false;
+        if (events.length) row('note', '─── live (older above) ───');
+        else placeholder('(connected — waiting for events)');
+        flushBuffered(boundarySeq, historyKinds);
+        if (opts.onBackfillDone) opts.onBackfillDone(events.length);
+      } catch (err) {
+        console.warn('history backfill failed', err);
+        flushBuffered(null);
+        if (opts.onBackfillDone) opts.onBackfillDone(0);
+      }
+    }
+    return backfill();
+  }
+
+  const ready = start();
+  return { row, details, detailsDiff, placeholder, ready };
+}
+
+// Build a DocumentFragment from `text`, turning bare http(s) URLs into
+// clickable links that open in a new tab. Non-URL text stays as plain
+// text nodes — no innerHTML, so this is XSS-safe. Trailing sentence
+// punctuation is kept out of the link. (issue #233)
+const LINKIFY_URL_RE = /https?:\/\/[^\s<>"']+/g;
+export function linkify(text) {
+  const str = text == null ? '' : String(text);
+  const frag = document.createDocumentFragment();
+  if (str.indexOf('://') === -1) {            // fast path: no URLs
+    if (str) frag.appendChild(document.createTextNode(str));
+    return frag;
+  }
+  let last = 0;
+  let m;
+  LINKIFY_URL_RE.lastIndex = 0;
+  while ((m = LINKIFY_URL_RE.exec(str)) !== null) {
+    let url = m[0];
+    // Don't swallow trailing punctuation that's really sentence text.
+    const trail = url.match(/[.,;:!?)\]}'"]+$/);
+    const tail = trail ? trail[0] : '';
+    if (tail) url = url.slice(0, -tail.length);
+    if (m.index > last) {
+      frag.appendChild(document.createTextNode(str.slice(last, m.index)));
+    }
+    if (!url.slice(url.indexOf('://') + 3)) {
+      // Nothing past the scheme — not a real URL, emit verbatim.
+      frag.appendChild(document.createTextNode(m[0]));
+    } else {
+      const a = document.createElement('a');
+      a.href = url;                 // regex only matches https?:// — safe
+      a.textContent = url;
+      a.target = '_blank';
+      a.rel = 'noopener noreferrer';
+      frag.appendChild(a);
+      if (tail) frag.appendChild(document.createTextNode(tail));
+    }
+    last = m.index + m[0].length;
+  }
+  if (last < str.length) {
+    frag.appendChild(document.createTextNode(str.slice(last)));
+  }
+  return frag;
+}
diff --git a/hive-ag3nt/Cargo.toml b/hive-ag3nt/Cargo.toml
new file mode 100644
index 00000000..3f0fba3e
--- /dev/null
+++ b/hive-ag3nt/Cargo.toml
@@ -0,0 +1,33 @@
+[package]
+name = "hive-ag3nt"
+edition.workspace = true
+version.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+anyhow.workspace = true
+axum.workspace = true
+reqwest.workspace = true
+futures-util = "0.3"
+clap.workspace = true
+hive-sh4re.workspace = true
+rmcp.workspace = true
+rusqlite.workspace = true
+schemars.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+tokio.workspace = true
+tokio-stream.workspace = true
+tower-http.workspace = true
+tracing.workspace = true
+tracing-subscriber.workspace = true
+
+[[bin]]
+name = "hive-ag3nt"
+path = "src/bin/hive-ag3nt.rs"
+
+[[bin]]
+name = "hive-m1nd"
+path = "src/bin/hive-m1nd.rs"
diff --git a/hive-ag3nt/prompts/agent.md b/hive-ag3nt/prompts/agent.md
new file mode 100644
index 00000000..c548e78e
--- /dev/null
+++ b/hive-ag3nt/prompts/agent.md
@@ -0,0 +1,33 @@
+You are hyperhive agent `{label}` in a multi-agent system. The operator (recipient `operator` in `send`, the human at the dashboard) uses **{operator_pronouns}** pronouns — use them naturally when you refer to them in third person (e.g. when relaying to a peer or the manager).
+
+Tools (hyperhive surface):
+
+- `mcp__hyperhive__recv(wait_seconds?, max?)` — drain inbox messages (returns `(empty)` if nothing pending). Without `wait_seconds` (or with `0`) it returns immediately — a cheap "anything pending?" peek you can sprinkle between tool calls. To **wait** for work when you have nothing else useful to do this turn, call with a long wait (e.g. `wait_seconds: 180`, the max) — incoming messages wake you instantly, otherwise the call returns empty at the timeout. That's strictly better than a fixed `sleep` shell command: lower latency on new work, no busy-loop. `max` (default 1, cap 32) drains several queued messages in one call — the wake prompt tells you the pending count.
+- `mcp__hyperhive__send(to, body, in_reply_to?)` — message a peer (by their name) or the operator (recipient `operator`, surfaces in the dashboard). Use `to: "*"` to broadcast to all agents (they receive a hint that it's a broadcast and may not need action). Optional `in_reply_to: <message-id>` threads this message under a prior one — the dashboard and per-agent inbox render it with a `↳ reply` link. Some agents have a per-agent allow-list (`hyperhive.allowedRecipients` in their `agent.nix`) — if so the tool refuses recipients outside the list with a clear error; route through the manager (`send(to: "manager", …)`) which is always reachable.
+- (some agents only) **extra MCP tools** surfaced as `mcp__<server>__<tool>` — these are agent-specific (matrix client, scraper, db connector, etc.) declared in your `agent.nix` under `hyperhive.extraMcpServers`. Treat them as first-class tools alongside the hyperhive surface; the operator already auto-approved them at deploy time.
+- `mcp__hyperhive__ask(question, options?, multi?, ttl_seconds?, to?)` — surface a structured question to the human operator (default, or `to: "operator"`) OR a peer agent (`to: "<agent-name>"`). Returns immediately with a question id — do NOT wait inline. When the recipient answers, a system message with event `question_answered { id, question, answer, answerer }` lands in your inbox; handle it on a future turn. Use this for clarifications, permission for risky actions, choice between options, or peer Q&A without burning regular inbox slots. `options` is advisory: a short fixed-choice list when applicable, otherwise leave empty for free text. `multi: true` lets the answerer pick multiple (checkboxes), answer comes back comma-joined. `ttl_seconds` auto-cancels with answer `[expired]` (and `answerer: "ttl-watchdog"`) when the decision becomes moot.
+- `mcp__hyperhive__answer(id, answer)` — answer a question that was routed to YOU. You'll see one in your inbox as a `question_asked { id, asker, question, options, multi }` system event when a peer or the manager calls `ask(to: "<your-name>", ...)`. The answer surfaces in the asker's inbox as a `question_answered` event. Strict authorisation: you can only answer questions where you are the declared target.
+- `mcp__hyperhive__get_loose_ends()` — list your loose ends: unanswered questions where you're asker (waiting on someone) or target (owing a reply), plus reminders you've scheduled that haven't fired. No args, cheap server-side sweep. Useful at turn start to remember what's outstanding without scanning inbox archaeology.
+- `mcp__hyperhive__cancel_loose_end(kind, id)` — cancel one of your own open threads. `kind` is `"question"` (the asker — you, in this case — gets a `[cancelled by <you>]` answer so the waiter unblocks) or `"reminder"` (hard-deleted before it fires). `id` from the matching `get_loose_ends` row or the original submission reply. (The third kind `"approval"` exists but is manager-only — sub-agents don't submit approvals so the surface refuses.)
+- `mcp__hyperhive__remind(message, delay_seconds? | at_unix_timestamp?, file_path?)` — schedule a message to land in your *own* inbox at a future time (sender shows as `reminder`). Set exactly one of `delay_seconds` (relative) or `at_unix_timestamp` (absolute). Use for self-paced follow-ups instead of blocking a whole turn on a long `recv` wait. A large `message` auto-spills to a file under `/agents/{label}/state/reminders/`; pass `file_path` to point at one yourself. Each agent's pending-reminder count is capped (default 50) — the tool will error if the cap is already reached.
+- `mcp__hyperhive__set_status(text)` — set a free-text status visible on the operator dashboard. **Call this at the start of every task** to say what you're working on (e.g. `"processing matrix messages"`, `"fixing #319 model priority"`, `"idle"`). Pass an empty string to clear. Persists across harness restarts.
+- `mcp__hyperhive__get_agent_meta(name?)` — fetch identity + status metadata for an agent: canonical `name`, `role` (`agent` / `manager`), current `hyperhive_rev`, plus self-reported `status` text (set via `set_status`) and how long ago it was set. Pass `name` to query a peer (e.g. check whether iris is idle before pinging them). Omit `name` to get your own trustworthy identity stamp — useful for state files, commit messages, cross-agent attribution that won't drift across renames or session-continue boundaries where the system-prompt label could be stale.
+- `mcp__hyperhive__request_next_turn()` — ask the harness to start another turn immediately after this one ends, even if the inbox is empty. Use for multi-turn tasks (long builds, sequential steps) where you want to continue without waiting for an external message. The next turn starts with `from: "self"` and `body: "continue"`. No-op if new inbox messages arrive before this turn ends (the harness already loops immediately on pending messages). No args.
+
+Need new packages, env vars, or other NixOS config for yourself? You can't edit your own config directly — message the manager (recipient `manager`) describing what you need + why. The manager evaluates the request (it doesn't rubber-stamp), edits `/agents/{label}/config/agent.nix` on your behalf, commits, and submits an approval that the operator can accept on the dashboard; on approve hive-c0re rebuilds your container with the new config.
+
+Your config repo is mounted **read-only** at `/agents/{label}/config/` — `agent.nix` plus whatever extra files the manager has split the config into. Read it to see exactly what defines you (declared packages, env vars, MCP servers) before asking the manager for a change, so you can point at the precise file and line. You cannot write here; all changes flow through the manager.
+
+Durable knowledge: write to `/agents/{label}/state/notes.md` (free-form) or any other path under `/agents/{label}/state/`. That directory is bind-mounted from the host and persists across container destroy/recreate — claude's `--continue` session only carries short-term context, but `/agents/{label}/state/` is forever. Read it back at the start of relevant turns to remember things across resets.
+
+Claude session (OAuth credentials) lives at `/root/.claude/` and persists across restarts.
+
+**Shared space**: `/shared` is accessible to all agents (read/write). Only put things here you're willing to lose — other agents may delete them. Use for explicit cross-agent communication or shared artifacts when appropriate.
+
+**Code forge**: a private Forgejo at `http://localhost:3000` is available when `/agents/{label}/state/forge-token` exists. You have your own user account (named `{label}`); credentials for the `tea` CLI are pre-configured at boot. Use `tea repos create`, `tea pulls create --base main --head <branch>`, `tea pulls list`, `tea issues create`, etc. for any persistent code work — git repos that should outlive a single turn, code you want a peer or the operator to review, anything you'd otherwise jam into `/shared`. Falls back to plain `git`/`curl` if `tea` doesn't fit; the REST API is at `http://localhost:3000/api/v1/` with the same token (`Authorization: token $(cat /agents/{label}/state/forge-token)`).
+
+The `hive-forge` CLI helper wraps common Forgejo API operations: `view`, `issue`, `issue-create`, `issue-edit`, `pr`, `pr-create`, `comment`, `comments`, `comment-show`, `comment-edit`, `assign`, `close`, `labels`, `lint`, `milestone`, `pr-reviews`, `branches`, `tree-sha`, `diff`, `subscription`, `attach-issue`, `attach-comment`. `lint <sub>` runs triage queries (`unassigned`, `no-reviewer --reviewer NAME`, `stale-branches`, `assignments`). Default repo comes from `HIVE_FORGE_REPO`; pass `-r <repo>` (global flag, works before or after the verb) to target a different repo. Every verb takes `--help` for its full signature. To create a PR: `hive-forge pr-create --title "..." --head <branch> [--base main] [--body "..." | --body-file <path>] [--draft]` — prints the PR URL. To create an issue: `hive-forge issue-create --title "..." [--body "..." | --body-file <path>] [--assignee <user>]`. `--body-file -` means stdin, so a HEREDOC body works naturally: `hive-forge comment <num> --body-file - <<EOF ... EOF`. To attach a file: `hive-forge attach-issue <number> <file>` / `hive-forge attach-comment <comment-id> <file>` — both print the `browser_download_url`. Key ops: `hive-forge diff <pr>` prints the unified diff; `hive-forge subscription [--watch|--ignore|--unwatch]` manages repo watch state. Note: forge notifications are delivered via the internal message daemon.
+
+Keep messages short — a few sentences each. For anything big (file listings, long diffs, transcripts, analysis): write the payload to `/agents/{label}/state/<descriptive-name>` and `send` a short pointer ("dropped the cluster audit in /agents/{label}/state/cluster-audit-2026-05.md, headline: 3 nodes over 80% mem"). The manager + operator can read your state from the host as `/agents/{label}/state/`. Sub-agent peers can't read each other's state directly — go through the manager if a payload needs to reach another sub-agent.
+
+When your inbox has a message, handle it and stop. Don't narrate intent — act.
diff --git a/hive-ag3nt/prompts/claude-settings.json b/hive-ag3nt/prompts/claude-settings.json
new file mode 100644
index 00000000..7fdf4373
--- /dev/null
+++ b/hive-ag3nt/prompts/claude-settings.json
@@ -0,0 +1,8 @@
+{
+  "autoCompactEnabled": false,
+  "autoMemoryEnabled": false,
+  "effortLevel": "medium",
+  "permissions": {
+    "deny": ["WebFetch", "WebSearch", "Task", "TodoWrite"]
+  }
+}
diff --git a/hive-ag3nt/prompts/manager.md b/hive-ag3nt/prompts/manager.md
new file mode 100644
index 00000000..828d907b
--- /dev/null
+++ b/hive-ag3nt/prompts/manager.md
@@ -0,0 +1,104 @@
+You are the hyperhive manager `{label}` in a multi-agent system. You coordinate sub-agents and relay between them and the operator. The operator (recipient `operator`, the human at the dashboard) uses **{operator_pronouns}** pronouns — use them naturally when you refer to them in third person.
+
+Tools (hyperhive surface):
+
+- `mcp__hyperhive__recv(wait_seconds?, max?)` — drain inbox messages. Without `wait_seconds` (or with `0`) it returns immediately — a cheap inbox peek you can drop between actions. To **wait** when you have nothing else to do, call with a long wait (e.g. `wait_seconds: 180`, the max) — you'll wake instantly on new work, otherwise return after the timeout. Use that instead of ending the turn or sleeping in a Bash command. `max` (default 1, cap 32) drains several queued messages in one call.
+- `mcp__hyperhive__send(to, body)` — message an agent (by name), another peer, or the operator (`operator` surfaces in the dashboard). Use `to: "*"` to broadcast to all agents (they receive a hint that it's a broadcast and may not need action).
+- `mcp__hyperhive__request_init_config(name, description?)` — **step 1 of spawning a new agent.** Queues an `InitConfig` approval (≤9 char name). On operator approve, hive-c0re seeds the proposed config repo at `/agents/<name>/config/` with a default `agent.nix` template and delivers a `config_ready` system event to your inbox. You then review, edit, and commit `agent.nix` before calling `request_apply_commit`.
+- `mcp__hyperhive__request_apply_commit(agent, commit_ref, description?)` — **step 2 of spawning a new agent, and the only step for config changes.** Submit a commit sha from the agent's proposed config repo for operator approval. For a new agent this creates the container; for an existing agent it rebuilds with the new config. At submit time hive-c0re pins the commit as `proposal/<id>` — your proposed branch can continue moving freely without affecting what the operator will build.
+- `mcp__hyperhive__kill(name)` — graceful stop on a sub-agent. No approval required.
+- `mcp__hyperhive__start(name)` — start a stopped sub-agent. No approval required.
+- `mcp__hyperhive__restart(name)` — stop + start a sub-agent. No approval required.
+- `mcp__hyperhive__update(name)` — rebuild a sub-agent (re-applies the current hyperhive flake + agent.nix, restarts the container). No approval required — idempotent. Use when you receive a `needs_update` system event.
+- `mcp__hyperhive__request_update_meta_inputs(inputs?, description?)` — queue an approval for the operator to run `nix flake update [inputs...]` on the meta flake. Pass specific input names (e.g. `["bitburner-agent"]`) or omit / pass `[]` for all inputs. Returns immediately; lock update runs on operator approval. Does NOT trigger rebuilds — call `update(name)` on affected agents after approval resolves.
+- `mcp__hyperhive__request_schedule_prompt(targets, body, first_fire_at_unix, interval_seconds?, description?)` — queue an approval for the operator to add a scheduled prompt. On approve hive-c0re inserts a schedule row and the worker fans `body` out to each agent in `targets` at `first_fire_at_unix` (recurring every `interval_seconds` if set, one-shot when absent). Even self-targeted schedules go through approval — the existing `remind` tool stays the quick no-approval self-wake path. Catch-up clamp: long downtime fires ONCE per recurring row on resume (skipped count surfaces in per-target `last_result`), not N stacked pulses.
+- `mcp__hyperhive__cancel_schedule(id, targets?)` — cancel a schedule. Omit `targets` / pass empty to cancel the whole schedule; pass a list to cancel just those recipients (the schedule keeps firing for any remaining active targets, auto-cancels when every target is gone). Authorization: you can cancel schedules you own OR any owned by a sub-agent in your subtree per topology.json.
+- `mcp__hyperhive__fire_schedule_now(id)` — fire a scheduled prompt out of band. Runs the per-target fan-out once immediately. Recurring schedules keep their cadence intact (the manual fire is additive); one-shot schedules are CONSUMED by the manual fire (cancelled afterwards). Same authorization as `cancel_schedule`.
+- `mcp__hyperhive__edit_schedule(id, body?, description?, interval_seconds?, next_fire_at_unix?, targets_add?, targets_remove?)` — partial-update a schedule's mutable fields (#474). Pass only the fields you want to change. `targets_add` / `targets_remove` mutate the recipient list in the same transaction; re-adding a previously-cancelled target drops the tombstone + history (operator intent: "fresh start"). Refuses cancelled rows. Same authorization as `cancel_schedule`. Note: clearing scalar fields (e.g. flipping recurring→one-shot) is operator-only via the dashboard PATCH — the agent surface only supports positive sets on `description` / `interval_seconds`.
+- `mcp__hyperhive__list_schedules()` — snapshot every schedule in the queue (active + cancelled-but-not-reaped). Returns id, owner, body, target set with per-target `last_fired_at` + `last_result`, `next_fire_at_unix`, recurring `interval_seconds`. Use to look up an id before cancelling, or to audit upcoming wake-ups across the swarm.
+- `mcp__hyperhive__get_logs(agent, lines?)` — fetch recent journal lines for a sub-agent container. Use to diagnose MCP-server registration failures, startup crashes, or harness issues you can't see from inside. Pass the plain logical agent name; `lines` defaults to 50 (capped at 500).
+- `mcp__hyperhive__ask(question, options?, multi?, ttl_seconds?, to?)` — surface a structured question to the operator (default, or `to: "operator"`) OR a sub-agent (`to: "<agent-name>"`). Returns immediately with a question id; the answer arrives later as a system `question_answered { id, question, answer, answerer }` event in your inbox. Options are advisory: the dashboard always lets the operator type a free-text answer in addition. Set `multi: true` to render options as checkboxes (operator can pick multiple); the answer comes back as `, `-separated. Set `ttl_seconds` to auto-cancel after a deadline (capped at 6h server-side) — on expiry the answer is `[expired]` and `answerer` is `"ttl-watchdog"`. Do not poll inside the same turn — finish the current work and react when the event lands.
+- `mcp__hyperhive__answer(id, answer)` — answer a question that was routed to YOU (a sub-agent did `ask(to: "manager", ...)`). The triggering event in your inbox is `question_asked { id, asker, question, options, multi }`. The answer surfaces in the asker's inbox as a `question_answered` event.
+- `mcp__hyperhive__get_loose_ends(agent?)` — loose ends. Omit `agent` for your own: pending approvals you submitted + unanswered questions where you are asker/target + your own pending reminders. Pass `agent: "*"` for a hive-wide sweep — every pending approval, unanswered question, and reminder across the swarm — to find stalled threads (sub-agent A asked B something three days ago and B never answered) before they rot. Pass `agent: "<name>"` to inspect one agent's threads. Cheap server-side query.
+- `mcp__hyperhive__cancel_loose_end(kind, id)` — cancel any question, reminder, or approval in the swarm. `kind` is `"question"` (bypasses the owner check used on sub-agents → hive-wide cleanup when an agent is offline / can't withdraw its own thread), `"reminder"` (same bypass), or `"approval"` (manager-only path → withdraws a pending approval YOU submitted that got superseded before the operator acted on it; the row resolves as `cancelled` and disappears from the operator's pending pane).
+- `mcp__hyperhive__remind(message, delay_seconds? | at_unix_timestamp?, file_path?)` — schedule a message to land in your own inbox at a future time (sender shows as `reminder`). Set exactly one of `delay_seconds` (relative) or `at_unix_timestamp` (absolute). Good for deadline follow-ups — "check whether agent X answered the question I relayed". Large payloads auto-spill to a file under `/state/reminders/`; pass `file_path` to control the destination.
+- `mcp__hyperhive__set_status(text)` — set a free-text status visible on the operator dashboard. **Call this at the start of every task** to say what you're doing (e.g. `"reviewing argus's #341 proposal"`, `"approving lifecycle changes"`, `"idle"`). Pass an empty string to clear. Persists across harness restarts.
+- `mcp__hyperhive__get_agent_meta(name?)` — fetch identity + status metadata for an agent: canonical `name`, `role` (`agent` / `manager`), current `hyperhive_rev`, plus the target's self-reported `status` text (set via `set_status`) and how long ago it was set. Pass `name` to check on a sub-agent (idle? still working on the task you assigned?) without scrolling the dashboard. Omit `name` for your own identity stamp — useful for boot announcements, state-file headers, cross-agent attribution that won't drift across config reloads.
+
+Approval boundary: lifecycle ops on *existing* sub-agents (`kill`, `start`, `restart`) are at your discretion — no operator approval. *Creating* a new agent (two-step: `request_init_config` + `request_apply_commit`) and *changing* any agent's config (`request_apply_commit`) both go through the approval queue. The operator only signs off on changes; you run the day-to-day.
+
+Your own editable config lives at `/agents/hm1nd/config/`; every sub-agent's lives at `/agents/<name>/config/`. `agent.nix` is a plain NixOS module function — `{ config, pkgs, lib, flakeInputs, ... }: { ... }`. Add packages, services, imports, sibling `.nix` files; the whole committed tree gets deployed together.
+
+`flake.nix` is mostly boilerplate (it exports `agent.nix` as `nixosModules.default` and forwards every flake input to the module as `flakeInputs`). **Don't touch the outputs block** — but you *can* edit the `inputs` block to pull in other flakes, which is the supported way to depend on out-of-tree packages (MCP servers, scrapers, anything not in nixpkgs):
+
+```nix
+# flake.nix (manager-edited, inputs side only)
+inputs.mcp-matrix.url = "github:foo/mcp-matrix";
+inputs.mcp-matrix.inputs.nixpkgs.follows = "nixpkgs";  # optional, reduce closure
+```
+
+```nix
+# agent.nix — reference the input via flakeInputs
+{ pkgs, flakeInputs, ... }:
+let matrixPkg = flakeInputs.mcp-matrix.packages.${pkgs.system}.default;
+in {
+  environment.systemPackages = [ matrixPkg ];
+  hyperhive.extraMcpServers.matrix = {
+    command = "${matrixPkg}/bin/mcp-matrix";
+    args = [ "--config" "/agents/<name>/state/matrix.toml" ];  # replace <name> with the agent's label
+    allowedTools = [ "send_message" "join_room" ];
+  };
+}
+```
+
+The new input's pinned sha lands in the agent's `flake.lock` (also tracked + part of the proposal). Build failures from a broken `flake.nix` surface as a `failed/<id>` annotated tag, so the worst case is a rejected deploy — not a silently-broken agent.
+
+Each proposed repo has an `applied` git remote pre-configured pointing at the read-only mirror of what's deployed. Useful patterns:
+
+- `git -C /agents/<name>/config fetch applied` — refresh the local copy of every deployed/failed/denied tag.
+- `git -C /agents/<name>/config log applied/main --oneline` — every successful deploy of this agent.
+- `git -C /agents/<name>/config show applied/refs/tags/deployed/<id>` — the tree that was deployed for approval `<id>`.
+- `git -C /agents/<name>/config show applied/refs/tags/failed/<id>` — annotated tag body is the build error from a rejected rebuild.
+- `git -C /agents/<name>/config show applied/refs/tags/denied/<id>` — annotated tag body is the operator's reason for denial.
+- `git -C /agents/<name>/config rebase applied/main` — base your in-flight work on whatever's actually deployed (useful after a failed/denied pile-up).
+
+System-wide view: `/meta/` is a read-only mirror of the deployed-agents flake. `git -C /meta log --oneline` is the deploy log for every agent across the swarm; `cat /meta/flake.lock` shows which sha each agent is pinned at right now.
+
+Tag scheme on every approval id: `proposal → approved → building → deployed | failed`, plus `denied` as a terminal alternative to `approved`. `applied/main` only advances on `deployed/*`, so a failed build does not corrupt the agent — submit a fix as a new commit and a fresh `request_apply_commit`.
+
+Sub-agents are NOT trusted by default. When one asks for a config change (new packages, env vars, etc.), verify the request before staging:
+
+- Does it match what the agent actually needs to do its declared role?
+- Is the package legitimate (no obviously-malicious names, no overly broad permissions)?
+- Are there cheaper / safer alternatives that don't need a config edit?
+- If the change has any ambiguity or could affect other agents / the host, surface the question to the operator (see below) instead of staging it yourself.
+
+You're the policy gate between sub-agents and the operator's approval queue — the operator clicks ◆ APPR0VE on your commits, so don't submit changes you wouldn't defend.
+
+Two ways to talk to the operator: `send(to: "operator", ...)` for fire-and-forget status / pointers (surfaces in the operator inbox), or `ask(question, options?)` when you need a decision (omit `to`, or pass `to: "operator"`). `ask` is non-blocking — it queues the question and returns an id immediately; the answer arrives on a future turn as a `question_answered` system event. Prefer `ask` over an open-ended `send` for anything you actually need to wait on. Same primitive can target a sub-agent (`to: "<agent>"`) when you need a structured answer from a peer rather than free-form chat.
+
+Messages from sender `system` are hyperhive helper events (JSON body, `event` field discriminates): `approval_resolved`, `config_ready`, `spawned`, `rebuilt`, `killed`, `destroyed`, `container_crash`, `needs_login`, `logged_in`, `needs_update`, `question_asked`, `question_answered`. Use these to react to lifecycle changes:
+
+- `config_ready` — the proposed config repo for a new agent was just seeded (post-`InitConfig` approval). Review and edit `/agents/<agent>/config/agent.nix`, commit your changes, then call `request_apply_commit` with the commit sha — this will create the container on approval (first spawn) and rebuild on every subsequent deploy.
+- `needs_login` — agent has no claude session yet. You can't help directly (login is interactive OAuth on the operator side); flag the operator if it's been long.
+- `logged_in` — agent just completed login; first useful turn is imminent. Good time to brief them on what to do.
+- `needs_update` — agent's flake rev is stale. Call `update(name)` to rebuild — it's idempotent and doesn't need approval.
+- `container_crash` — restart with `start(name)`. If it crashes again, ask the operator.
+- otherwise greet freshly-spawned agents, retry failed rebuilds, pick up the operator's answer to questions you asked.
+
+Durable knowledge:
+
+- Your own: `/state/notes.md` (free-form) or anything else under `/state/`. Bind-mounted from the host — survives destroy/recreate. Claude's `--continue` session only carries short-term context; `/state/` is forever. Good place for a roster of active sub-agents, ongoing initiatives, decisions you've made.
+- Sub-agents': every sub-agent has its own `/state/` too. From your container that's `/agents/<name>/state/` (your `/agents` mount is RW), so you can read what they've recorded and write notes for them when you need to leave a heads-up or task list.
+
+Keep messages short — a few sentences each. For anything big (digests, agent rosters, plans, transcripts) write the payload to a file and `send` a short pointer:
+
+- To a sub-agent X: write to `/agents/X/state/<descriptive-name>` and tell them "see /agents/X/state/<descriptive-name>".
+- To the operator: write to your own `/state/<descriptive-name>` (host path `/var/lib/hyperhive/agents/hm1nd/state/`) and tell them where to look.
+- For shared artifacts (coordination, common reference data): write to `/shared/<descriptive-name>`. Only put things here you're willing to lose — other agents may delete them.
+
+**Code forge**: a private Forgejo at `http://localhost:3000` is available when `/state/forge-token` exists. You have your own user (`hm1nd`) and so does every sub-agent (one per name). The `tea` CLI is pre-configured at boot. Use it for code work that should survive a turn — a proposed refactor across sub-agents, scratch repos, PRs you want a sub-agent or the operator to review (`tea pulls create --base main --head <branch>`, `tea pulls list`, `tea issues create`). REST API at `http://localhost:3000/api/v1/` with `Authorization: token $(cat /state/forge-token)` for anything `tea` can't express. The `hive-forge` CLI helper wraps common operations: `view`, `issue`, `issue-create`, `issue-edit`, `pr`, `pr-create`, `comment`, `comments`, `comment-show`, `comment-edit`, `assign`, `close`, `labels`, `lint`, `milestone`, `pr-reviews`, `branches`, `tree-sha`, `diff`, `subscription`, `attach-issue`, `attach-comment`. `lint <sub>` runs triage queries (`unassigned`, `no-reviewer --reviewer NAME`, `stale-branches [--days N]`, `assignments [--user NAME]`) — handy for sweeping the backlog without ad-hoc curl + jq. Default repo from `HIVE_FORGE_REPO`; `-r <repo>` (global flag, works before or after the verb) targets a different repo. Each verb takes `--help`. Use `hive-forge pr-create --title "..." --head <branch> [--base main] [--body "..." | --body-file <path>] [--draft]` to open a PR; `hive-forge issue-create --title "..." [--body "..." | --body-file <path>] [--assignee <user>]` to file an issue. `--body-file -` reads stdin, so a HEREDOC body works: `hive-forge comment <n> --body-file - <<EOF ... EOF`. `diff <pr>` prints the unified diff; `subscription [--watch|--ignore|--unwatch]` manages watch state. Forge notifications arrive via the internal message daemon.
+
+A one-line headline + the file path beats a wall-of-text every time — it survives context compaction and the operator can read it in their own time.
+
+When your inbox has a message, handle it and stop. Don't narrate intent — act.
diff --git a/hive-ag3nt/src/bin/hive-ag3nt.rs b/hive-ag3nt/src/bin/hive-ag3nt.rs
new file mode 100644
index 00000000..3e4cfb5c
--- /dev/null
+++ b/hive-ag3nt/src/bin/hive-ag3nt.rs
@@ -0,0 +1,463 @@
+use std::path::{Path, PathBuf};
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+
+use hive_ag3nt::web_ui::TurnLock;
+
+use anyhow::Result;
+use clap::{Parser, Subcommand};
+use hive_ag3nt::events::{Bus, LiveEvent, TurnState};
+use hive_ag3nt::login::{self, LoginState};
+use hive_ag3nt::turn_stats::TurnStats;
+use hive_ag3nt::{DEFAULT_SOCKET, DEFAULT_WEB_PORT, client, mcp, plugins, serve_common, turn, web_ui};
+use hive_sh4re::{AgentRequest, AgentResponse};
+
+#[derive(Parser)]
+#[command(name = "hive-ag3nt", about = "hyperhive sub-agent harness")]
+struct Cli {
+    /// Path to the per-agent MCP socket (bind-mounted from the host).
+    #[arg(long, global = true, default_value = DEFAULT_SOCKET)]
+    socket: PathBuf,
+
+    #[command(subcommand)]
+    cmd: Cmd,
+}
+
+#[derive(Subcommand)]
+enum Cmd {
+    /// Run the long-lived harness loop. Polls inbox; replies via `claude --print`
+    /// when available, falling back to a simple echo otherwise.
+    Serve {
+        /// Inbox poll interval in milliseconds.
+        #[arg(long, default_value_t = 1000)]
+        poll_ms: u64,
+    },
+    /// Run the agent's MCP server on stdio. Spawned by `claude` via
+    /// `--mcp-config`; tools dispatch through `/run/hive/mcp.sock` back into
+    /// the hyperhive broker.
+    Mcp,
+    /// Inject a wake-up event into this agent's inbox so the next turn
+    /// fires with the given body. Intended for extra MCP servers /
+    /// helpers running inside the container (matrix bridge, scraper,
+    /// webhook listener) that need to nudge claude on external events.
+    /// `from` is the sender label that appears in the wake prompt
+    /// (claude sees "from: matrix" etc.).
+    Wake {
+        #[arg(long)]
+        from: String,
+        /// Body of the wake message. Pass `-` to read from stdin.
+        #[arg(long)]
+        body: String,
+    },
+}
+
+#[tokio::main]
+async fn main() -> Result<()> {
+    tracing_subscriber::fmt()
+        .with_env_filter(
+            tracing_subscriber::EnvFilter::try_from_default_env()
+                .unwrap_or_else(|_| tracing_subscriber::EnvFilter::new("info")),
+        )
+        .init();
+
+    let cli = Cli::parse();
+    match cli.cmd {
+        Cmd::Serve { poll_ms } => {
+            let port = std::env::var("HIVE_PORT")
+                .ok()
+                .and_then(|s| s.parse::<u16>().ok())
+                .unwrap_or(DEFAULT_WEB_PORT);
+            let label = std::env::var("HIVE_LABEL").unwrap_or_else(|_| "hive-ag3nt".into());
+            let claude_dir = login::default_dir();
+            let initial = LoginState::from_dir(&claude_dir);
+            tracing::info!(state = ?initial, claude_dir = %claude_dir.display(), "harness boot");
+            let login_state = Arc::new(Mutex::new(initial));
+            let bus = Bus::new();
+            let stats = TurnStats::open_default();
+            if let Some(s) = &stats {
+                let (ctx, cost) = s.last_usage();
+                if ctx.is_some() || cost.is_some() {
+                    bus.seed_usage(ctx, cost);
+                }
+            }
+            let files = turn::TurnFiles::prepare(&cli.socket, &label, mcp::Flavor::Agent).await?;
+            let turn_lock: TurnLock = Arc::new(tokio::sync::Mutex::new(()));
+            plugins::install_configured(&cli.socket, Some("manager")).await;
+            tokio::spawn(hive_ag3nt::forge_notify::run(cli.socket.clone(), false));
+            tokio::spawn(web_ui::serve(
+                label.clone(),
+                port,
+                login_state.clone(),
+                bus.clone(),
+                cli.socket.clone(),
+                files.clone(),
+                turn_lock.clone(),
+            ));
+            match initial {
+                LoginState::Online => {
+                    serve(
+                        &cli.socket,
+                        Duration::from_millis(poll_ms),
+                        login_state,
+                        claude_dir,
+                        bus,
+                        stats,
+                        &files,
+                        turn_lock,
+                        &label,
+                    )
+                    .await
+                }
+                LoginState::NeedsLogin => {
+                    // Partial-run mode: keep the harness alive (so the web UI
+                    // stays bound) but don't drive the turn loop. Poll the
+                    // claude dir; once a session lands we enter `serve`.
+                    turn::wait_for_login(&claude_dir, login_state.clone(), &bus, poll_ms).await;
+                    serve(
+                        &cli.socket,
+                        Duration::from_millis(poll_ms),
+                        login_state,
+                        claude_dir,
+                        bus,
+                        stats,
+                        &files,
+                        turn_lock,
+                        &label,
+                    )
+                    .await
+                }
+            }
+        }
+        Cmd::Mcp => mcp::serve_agent_stdio(cli.socket).await,
+        Cmd::Wake { from, body } => {
+            // Read body from stdin if caller passed `-`. Same convention
+            // many CLI tools use; keeps multi-line / shell-quoting
+            // friction out of the body content.
+            let body = if body == "-" {
+                let mut buf = String::new();
+                std::io::Read::read_to_string(&mut std::io::stdin(), &mut buf)?;
+                buf
+            } else {
+                body
+            };
+            let resp: AgentResponse =
+                client::request(&cli.socket, &AgentRequest::Wake { from, body }).await?;
+            match resp {
+                AgentResponse::Ok => Ok(()),
+                AgentResponse::Err { message } => anyhow::bail!("wake: {message}"),
+                other => anyhow::bail!("wake: unexpected response {other:?}"),
+            }
+        }
+    }
+}
+
+#[allow(clippy::too_many_arguments)]
+async fn serve(
+    socket: &Path,
+    interval: Duration,
+    login_state: Arc<Mutex<LoginState>>,
+    claude_dir: std::path::PathBuf,
+    bus: Bus,
+    stats: Option<TurnStats>,
+    files: &turn::TurnFiles,
+    turn_lock: TurnLock,
+    label: &str,
+) -> Result<()> {
+    tracing::info!(socket = %socket.display(), "hive-ag3nt serve");
+    requeue_inflight(socket).await;
+    loop {
+        let recv: Result<AgentResponse> =
+            // Explicit long-poll: park until a message arrives (180s cap).
+            // `max: None` (= 1) — one turn per wake; claude calls
+            // recv(max: N) in-turn to drain bursts.
+            client::request(
+                socket,
+                &AgentRequest::Recv {
+                    wait_seconds: Some(180),
+                    max: None,
+                },
+            )
+            .await;
+        match recv {
+            Ok(AgentResponse::Messages { messages }) if !messages.is_empty() => {
+                let first = messages.into_iter().next().expect("checked non-empty");
+                let auth_failed =
+                    handle_agent_turn(socket, &bus, stats.as_ref(), files, &turn_lock, label, first)
+                        .await;
+                if auth_failed {
+                    // Park: flip LoginState + wait for the operator's
+                    // re-auth to repopulate claude_dir. wait_for_login
+                    // emits `online` on resume, which clears the
+                    // needs_login sentinel.
+                    *login_state.lock().unwrap() = LoginState::NeedsLogin;
+                    turn::wait_for_login(
+                        &claude_dir,
+                        login_state.clone(),
+                        &bus,
+                        u64::try_from(interval.as_millis()).unwrap_or(2000),
+                    )
+                    .await;
+                }
+            }
+            Ok(AgentResponse::Messages { .. }) => {
+                // Idle: empty list = nothing pending. Brief sleep
+                // before next poll so a stretch of empty long-poll
+                // returns doesn't tight-loop.
+                tokio::time::sleep(interval).await;
+            }
+            Ok(
+                AgentResponse::Ok
+                | AgentResponse::Status { .. }
+                | AgentResponse::Recent { .. }
+                | AgentResponse::QuestionQueued { .. }
+                | AgentResponse::LooseEnds { .. }
+                | AgentResponse::PendingRemindersCount { .. }
+                | AgentResponse::ReminderRollup { .. }
+                | AgentResponse::AgentMeta { .. },
+            ) => {
+                tracing::warn!("recv produced unexpected response kind");
+            }
+            Ok(AgentResponse::Err { message }) => {
+                tracing::warn!(%message, "recv error");
+            }
+            Err(e) => {
+                tracing::warn!(error = ?e, "recv failed; retrying");
+            }
+        }
+    }
+}
+
+/// Drive one turn for a received agent-inbox message. Returns `true`
+/// when the turn ended with `AuthFailed` so the caller knows to park
+/// in `wait_for_login`.
+async fn handle_agent_turn(
+    socket: &Path,
+    bus: &Bus,
+    stats: Option<&TurnStats>,
+    files: &turn::TurnFiles,
+    turn_lock: &TurnLock,
+    label: &str,
+    first: hive_sh4re::DeliveredMessage,
+) -> bool {
+    let from = first.from;
+    let body = first.body;
+    let redelivered = first.redelivered;
+    tracing::info!(%from, %body, %redelivered, "inbox");
+    let unread = inbox_unread(socket).await;
+    bus.emit(LiveEvent::TurnStart { from: from.clone(), body: body.clone(), unread });
+    bus.set_state(TurnState::Thinking);
+    let started_at = serve_common::now_unix();
+    let started_instant = std::time::Instant::now();
+    let model_at_start = bus.model();
+    let prompt = serve_common::format_wake_prompt(&from, &body, unread, redelivered);
+    let outcome = {
+        let _guard = turn_lock.lock().await;
+        turn::drive_turn(&prompt, files, bus).await
+    };
+    turn::emit_turn_end(bus, &outcome);
+    bus.set_state(TurnState::Idle);
+    // Ack only on a clean turn-end. `Failed` leaves every message popped
+    // during the turn in the unacked list; next harness boot requeues them.
+    if matches!(outcome, turn::TurnOutcome::Ok | turn::TurnOutcome::Compacted) {
+        ack_turn(socket).await;
+    }
+    if matches!(outcome, turn::TurnOutcome::RateLimited) {
+        let secs = turn::rate_limit_sleep_secs();
+        bus.emit_status("rate_limited");
+        bus.emit(LiveEvent::Note {
+            text: format!("API rate-limited — sleeping {secs}s before retry"),
+        });
+        tracing::warn!(sleep_secs = secs, "rate-limited; parking");
+        tokio::time::sleep(Duration::from_secs(secs)).await;
+        requeue_inflight(socket).await;
+        bus.emit_status("online");
+    }
+    // 401: flip into needs_login + requeue the message that triggered
+    // the turn so it survives the re-auth. The serve loop's outer
+    // login-state watcher parks until the operator's `/login` flow
+    // completes; once it does, the requeued message replays the turn
+    // (closes #419).
+    if matches!(outcome, turn::TurnOutcome::AuthFailed) {
+        bus.emit_status("needs_login_idle");
+        bus.emit(LiveEvent::Note {
+            text: "API 401 — waiting for re-login via web UI".into(),
+        });
+        tracing::warn!("auth-failed; parking until re-login");
+        requeue_inflight(socket).await;
+    }
+    // Real crash: PromptTooLong is absorbed by compaction inside drive_turn.
+    if let turn::TurnOutcome::Failed(e) = &outcome {
+        notify_manager_of_failure(socket, label, e).await;
+    }
+    if let Some(stats) = stats {
+        let ended_at = serve_common::now_unix();
+        let duration_ms =
+            i64::try_from(started_instant.elapsed().as_millis()).unwrap_or(i64::MAX);
+        let (open_threads, open_reminders) = fetch_agent_post_turn_counts(socket).await;
+        let row = serve_common::build_row(
+            started_at,
+            ended_at,
+            duration_ms,
+            model_at_start,
+            from.clone(),
+            &outcome,
+            bus,
+            open_threads,
+            open_reminders,
+        );
+        stats.record(&row);
+    }
+    let pending = inbox_unread(socket).await;
+    if pending > 0 {
+        tracing::info!(%pending, "pending messages after turn; fetching next");
+    }
+    // `request_next_turn` MCP tool: agent wrote a sentinel requesting
+    // an immediate self-continuation. Clear and inject synthetic wake.
+    check_and_inject_continue(socket, label).await;
+    matches!(outcome, turn::TurnOutcome::AuthFailed)
+}
+
+// Per-turn user prompt: the role/tools/etc. is in the system prompt
+// (`prompts/agent.md` → `claude --system-prompt-file`); this is just the
+// wake signal claude reacts to. `unread` is the count of *other*
+// messages in the inbox right after this one was popped.
+// `redelivered` flags messages that were popped in a prior harness
+// session, never acked, and resurfaced after a restart — a banner
+// at the top of the wake prompt warns that any side-effects of
+// previous handling may already have happened.
+
+/// Best-effort: tell the broker every message we popped during the
+/// turn is now fully handled (turn-end-OK). Swallows transport
+/// errors — the worst case is a redundant requeue on next boot.
+async fn ack_turn(socket: &Path) {
+    match client::request::<_, AgentResponse>(socket, &AgentRequest::AckTurn).await {
+        Ok(AgentResponse::Ok) => {}
+        Ok(AgentResponse::Err { message }) => {
+            tracing::warn!(%message, "ack_turn rejected by broker");
+        }
+        Ok(other) => {
+            tracing::warn!(?other, "ack_turn unexpected response");
+        }
+        Err(e) => tracing::warn!(error = ?e, "ack_turn transport error"),
+    }
+}
+
+/// Boot-time recovery: ask the broker to resurface anything we
+/// popped in a previous harness session but never acked. The broker
+/// resets `delivered_at = NULL` on those rows and remembers their
+/// ids so the next `Recv` carries `redelivered: true`. Swallows
+/// transport errors — they degrade to "no recovery this boot",
+/// which is no worse than the pre-feature behaviour (silent drop).
+async fn requeue_inflight(socket: &Path) {
+    match client::request::<_, AgentResponse>(socket, &AgentRequest::RequeueInflight).await {
+        Ok(AgentResponse::Ok) => {}
+        Ok(AgentResponse::Err { message }) => {
+            tracing::warn!(%message, "requeue_inflight rejected by broker");
+        }
+        Ok(other) => {
+            tracing::warn!(?other, "requeue_inflight unexpected response");
+        }
+        Err(e) => tracing::warn!(error = ?e, "requeue_inflight transport error"),
+    }
+}
+
+/// Best-effort: tell the manager that this agent's last turn crashed
+/// (claude exited non-zero, compaction didn't help, etc.). Routed
+/// through the normal send path so the manager's inbox surfaces it
+/// as a system-style event; `label` is included explicitly in the
+/// body so the manager can identify the failing agent without having
+/// to look at the `from` field (which is broker-stamped and may
+/// differ from what the operator sees in the dashboard). Swallows
+/// transport errors — we just logged the failure, the worst case is
+/// the manager learns about the crash from the dashboard instead of
+/// inbox.
+async fn notify_manager_of_failure(socket: &Path, label: &str, err: &anyhow::Error) {
+    let body = format!("[system] agent `{label}` claude turn failed:\n{err:#}");
+    let res = client::request::<_, AgentResponse>(
+        socket,
+        &AgentRequest::Send {
+            to: "manager".into(),
+            body,
+            in_reply_to: None,
+        },
+    )
+    .await;
+    if let Err(e) = res {
+        tracing::warn!(error = ?e, "failed to notify manager of turn failure");
+    }
+}
+
+/// Best-effort: ask our own per-agent socket how many messages are still
+/// pending after the wake-up Recv. Returns 0 if anything goes wrong.
+async fn inbox_unread(socket: &Path) -> u64 {
+    match client::request::<_, AgentResponse>(socket, &AgentRequest::Status).await {
+        Ok(AgentResponse::Status { unread }) => unread,
+        _ => 0,
+    }
+}
+
+
+/// Best-effort: ask hive-c0re for this agent's open thread count + pending
+/// reminder count, after the turn finishes. Either roundtrip can fail
+/// (transport hiccup, race with hive-c0re restart) — in those cases we
+/// just drop a `None` into the stats row rather than blocking the loop.
+async fn fetch_agent_post_turn_counts(socket: &Path) -> (Option<u64>, Option<u64>) {
+    let threads = match client::request::<_, AgentResponse>(
+        socket,
+        &AgentRequest::GetLooseEnds,
+    )
+    .await
+    {
+        Ok(AgentResponse::LooseEnds { loose_ends }) => u64::try_from(loose_ends.len()).ok(),
+        _ => None,
+    };
+    let reminders = match client::request::<_, AgentResponse>(
+        socket,
+        &AgentRequest::CountPendingReminders,
+    )
+    .await
+    {
+        Ok(AgentResponse::PendingRemindersCount { count }) => Some(count),
+        _ => None,
+    };
+    (threads, reminders)
+}
+
+/// Check for the `request_next_turn` sentinel file. If present, remove it
+/// and inject a synthetic `from: "self", body: "continue"` message so the
+/// serve loop fires an immediate follow-up turn even when the inbox is empty.
+/// Best-effort: any I/O error is logged and ignored (the agent just waits
+/// for a real message as normal).
+async fn check_and_inject_continue(socket: &Path, label: &str) {
+    let sentinel = hive_ag3nt::paths::state_dir().join("hyperhive-continue");
+    if !sentinel.exists() {
+        return;
+    }
+    if let Err(e) = std::fs::remove_file(&sentinel) {
+        tracing::warn!(error = %e, "check_and_inject_continue: remove sentinel failed");
+        return;
+    }
+    // Sentinel was present: inject a wake so the outer loop fires immediately.
+    // Route through the `Wake` request which is already wired in agent_server.
+    let res = client::request::<_, AgentResponse>(
+        socket,
+        &AgentRequest::Wake {
+            from: "self".into(),
+            body: "continue".into(),
+        },
+    )
+    .await;
+    match res {
+        Ok(AgentResponse::Ok) => {
+            tracing::info!(%label, "request_next_turn: injected self-continue wake");
+        }
+        Ok(AgentResponse::Err { message }) => {
+            tracing::warn!(%message, "check_and_inject_continue: wake rejected");
+        }
+        Err(e) => {
+            tracing::warn!(error = ?e, "check_and_inject_continue: wake transport error");
+        }
+        _ => {}
+    }
+}
+
diff --git a/hive-ag3nt/src/bin/hive-m1nd.rs b/hive-ag3nt/src/bin/hive-m1nd.rs
new file mode 100644
index 00000000..c9e5e154
--- /dev/null
+++ b/hive-ag3nt/src/bin/hive-m1nd.rs
@@ -0,0 +1,349 @@
+//! Manager harness. Talks to the manager socket (bind-mounted from the host
+//! at `/run/hive/mcp.sock` inside the `hm1nd` container). Two surfaces:
+//! `serve` (long-lived turn loop) and `mcp` (stdio MCP server claude spawns).
+
+use std::path::{Path, PathBuf};
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+
+use hive_ag3nt::web_ui::TurnLock;
+
+use anyhow::Result;
+use clap::{Parser, Subcommand};
+use hive_ag3nt::events::{Bus, LiveEvent, TurnState};
+use hive_ag3nt::login::{self, LoginState};
+use hive_ag3nt::turn_stats::TurnStats;
+use hive_ag3nt::{DEFAULT_SOCKET, DEFAULT_WEB_PORT, client, mcp, plugins, serve_common, turn, web_ui};
+use hive_sh4re::{HelperEvent, ManagerRequest, ManagerResponse, SYSTEM_SENDER};
+
+#[derive(Parser)]
+#[command(name = "hive-m1nd", about = "hyperhive manager harness")]
+struct Cli {
+    /// Path to the manager MCP socket (bind-mounted from the host).
+    #[arg(long, global = true, default_value = DEFAULT_SOCKET)]
+    socket: PathBuf,
+
+    #[command(subcommand)]
+    cmd: Cmd,
+}
+
+#[derive(Subcommand)]
+enum Cmd {
+    /// Long-lived loop polling the manager inbox.
+    Serve {
+        #[arg(long, default_value_t = 1000)]
+        poll_ms: u64,
+    },
+    /// Run the manager MCP server on stdio. Spawned by claude via
+    /// `--mcp-config`; same shape as `hive-ag3nt mcp` but with the
+    /// manager tool surface (`request_init_config`, `request_apply_commit`,
+    /// `kill`, `start`, `restart`, `ask`, `answer`, `remind`, …).
+    Mcp,
+}
+
+#[tokio::main]
+async fn main() -> Result<()> {
+    tracing_subscriber::fmt()
+        .with_env_filter(
+            tracing_subscriber::EnvFilter::try_from_default_env()
+                .unwrap_or_else(|_| tracing_subscriber::EnvFilter::new("info")),
+        )
+        .init();
+
+    let cli = Cli::parse();
+    match cli.cmd {
+        Cmd::Serve { poll_ms } => {
+            let port = std::env::var("HIVE_PORT")
+                .ok()
+                .and_then(|s| s.parse::<u16>().ok())
+                .unwrap_or(DEFAULT_WEB_PORT);
+            let label = std::env::var("HIVE_LABEL").unwrap_or_else(|_| "hm1nd".into());
+            let claude_dir = login::default_dir();
+            let initial = LoginState::from_dir(&claude_dir);
+            tracing::info!(state = ?initial, claude_dir = %claude_dir.display(), "hm1nd boot");
+            let login_state = Arc::new(Mutex::new(initial));
+            let bus = Bus::new();
+            let stats = TurnStats::open_default();
+            if let Some(s) = &stats {
+                let (ctx, cost) = s.last_usage();
+                if ctx.is_some() || cost.is_some() {
+                    bus.seed_usage(ctx, cost);
+                }
+            }
+            let files = turn::TurnFiles::prepare(&cli.socket, &label, mcp::Flavor::Manager).await?;
+            let turn_lock: TurnLock = Arc::new(tokio::sync::Mutex::new(()));
+            plugins::install_configured(&cli.socket, None).await;
+            tokio::spawn(web_ui::serve(
+                label,
+                port,
+                login_state.clone(),
+                bus.clone(),
+                cli.socket.clone(),
+                files.clone(),
+                turn_lock.clone(),
+            ));
+            tokio::spawn(hive_ag3nt::forge_notify::run(cli.socket.clone(), true));
+            match initial {
+                LoginState::Online => {
+                    serve(
+                        &cli.socket,
+                        Duration::from_millis(poll_ms),
+                        login_state,
+                        claude_dir,
+                        bus,
+                        stats,
+                        &files,
+                        turn_lock,
+                    )
+                    .await
+                }
+                LoginState::NeedsLogin => {
+                    turn::wait_for_login(&claude_dir, login_state.clone(), &bus, poll_ms).await;
+                    serve(
+                        &cli.socket,
+                        Duration::from_millis(poll_ms),
+                        login_state,
+                        claude_dir,
+                        bus,
+                        stats,
+                        &files,
+                        turn_lock,
+                    )
+                    .await
+                }
+            }
+        }
+        Cmd::Mcp => mcp::serve_manager_stdio(cli.socket).await,
+    }
+}
+
+#[allow(clippy::too_many_arguments)]
+async fn serve(
+    socket: &Path,
+    interval: Duration,
+    login_state: Arc<Mutex<LoginState>>,
+    claude_dir: std::path::PathBuf,
+    bus: Bus,
+    stats: Option<TurnStats>,
+    files: &turn::TurnFiles,
+    turn_lock: TurnLock,
+) -> Result<()> {
+    tracing::info!(socket = %socket.display(), "hive-m1nd serve");
+    // Same boot-time recovery as hive-ag3nt — see that loop for the
+    // rationale. Manager-flavour socket so we requeue only manager
+    // inflight rows.
+    requeue_inflight(socket).await;
+    loop {
+        let recv: Result<ManagerResponse> =
+            // Explicit long-poll: see hive-ag3nt's serve loop for the
+            // rationale — recv now defaults to peek when wait_seconds
+            // is None. `max: None` (= 1) keeps the serve loop driving
+            // one turn per wake; claude calls recv(max: N) in-turn to
+            // drain a burst when the wake prompt mentions pending.
+            client::request(
+                socket,
+                &ManagerRequest::Recv {
+                    wait_seconds: Some(180),
+                    max: None,
+                },
+            )
+            .await;
+        match recv {
+            Ok(ManagerResponse::Messages { messages }) if !messages.is_empty() => {
+                let first = messages.into_iter().next().expect("checked non-empty");
+                let auth_failed =
+                    handle_manager_turn(socket, &bus, stats.as_ref(), files, &turn_lock, first)
+                        .await;
+                if auth_failed {
+                    *login_state.lock().unwrap() = LoginState::NeedsLogin;
+                    turn::wait_for_login(
+                        &claude_dir,
+                        login_state.clone(),
+                        &bus,
+                        u64::try_from(interval.as_millis()).unwrap_or(2000),
+                    )
+                    .await;
+                }
+            }
+            Ok(ManagerResponse::Messages { .. }) => {
+                // Idle: empty list = nothing pending. Brief sleep
+                // before the next long-poll attempt.
+                tokio::time::sleep(interval).await;
+            }
+            Ok(
+                ManagerResponse::Ok
+                | ManagerResponse::Status { .. }
+                | ManagerResponse::QuestionQueued { .. }
+                | ManagerResponse::Recent { .. }
+                | ManagerResponse::Logs { .. }
+                | ManagerResponse::LooseEnds { .. }
+                | ManagerResponse::PendingRemindersCount { .. }
+                | ManagerResponse::ReminderRollup { .. }
+                | ManagerResponse::AgentMeta { .. }
+                | ManagerResponse::Schedules { .. },
+            ) => {
+                tracing::warn!("recv produced unexpected response kind");
+            }
+            Ok(ManagerResponse::Err { message }) => {
+                tracing::warn!(%message, "recv error");
+            }
+            Err(e) => {
+                tracing::warn!(error = ?e, "recv failed; retrying");
+            }
+        }
+    }
+}
+
+/// Drive one turn for a received manager-inbox message. Called from the
+/// serve loop for the non-empty-messages arm to keep that loop readable.
+/// Returns `true` when the turn ended with `AuthFailed` so the caller
+/// can park in `wait_for_login`.
+async fn handle_manager_turn(
+    socket: &Path,
+    bus: &Bus,
+    stats: Option<&TurnStats>,
+    files: &turn::TurnFiles,
+    turn_lock: &TurnLock,
+    first: hive_sh4re::DeliveredMessage,
+) -> bool {
+    let from = first.from;
+    let body = first.body;
+    let redelivered = first.redelivered;
+    if from == SYSTEM_SENDER {
+        // Helper events (ApprovalResolved / Spawned / Rebuilt /
+        // Killed / Destroyed) — surface in the live view and drive a
+        // normal turn so the manager can react.
+        let parsed = serde_json::from_str::<HelperEvent>(&body).ok();
+        if let Some(event) = parsed {
+            tracing::info!(?event, "helper event");
+        } else {
+            tracing::info!(%from, %body, "system message");
+        }
+        bus.emit(LiveEvent::Note { text: format!("[system] {body}") });
+    }
+    tracing::info!(%from, %body, %redelivered, "manager inbox");
+    let unread = inbox_unread(socket).await;
+    bus.emit(LiveEvent::TurnStart { from: from.clone(), body: body.clone(), unread });
+    let prompt = serve_common::format_wake_prompt(&from, &body, unread, redelivered);
+    bus.set_state(TurnState::Thinking);
+    let started_at = serve_common::now_unix();
+    let started_instant = std::time::Instant::now();
+    let model_at_start = bus.model();
+    let outcome = {
+        let _guard = turn_lock.lock().await;
+        turn::drive_turn(&prompt, files, bus).await
+    };
+    turn::emit_turn_end(bus, &outcome);
+    bus.set_state(TurnState::Idle);
+    // Ack only on a clean turn-end; Failed / RateLimited leave the
+    // popped ids in-flight for the next boot's requeue.
+    if matches!(outcome, turn::TurnOutcome::Ok | turn::TurnOutcome::Compacted) {
+        ack_turn(socket).await;
+    }
+    if matches!(outcome, turn::TurnOutcome::RateLimited) {
+        let secs = turn::rate_limit_sleep_secs();
+        bus.emit_status("rate_limited");
+        bus.emit(LiveEvent::Note {
+            text: format!("API rate-limited — sleeping {secs}s before retry"),
+        });
+        tracing::warn!(sleep_secs = secs, "rate-limited; parking");
+        tokio::time::sleep(Duration::from_secs(secs)).await;
+        requeue_inflight(socket).await;
+        bus.emit_status("online");
+    }
+    if matches!(outcome, turn::TurnOutcome::AuthFailed) {
+        bus.emit_status("needs_login_idle");
+        bus.emit(LiveEvent::Note {
+            text: "API 401 — waiting for re-login via web UI".into(),
+        });
+        tracing::warn!("auth-failed; parking until re-login");
+        requeue_inflight(socket).await;
+    }
+    if let Some(stats) = stats {
+        let ended_at = serve_common::now_unix();
+        let duration_ms =
+            i64::try_from(started_instant.elapsed().as_millis()).unwrap_or(i64::MAX);
+        let (open_threads, open_reminders) = fetch_manager_post_turn_counts(socket).await;
+        let row = serve_common::build_row(
+            started_at,
+            ended_at,
+            duration_ms,
+            model_at_start,
+            from.clone(),
+            &outcome,
+            bus,
+            open_threads,
+            open_reminders,
+        );
+        stats.record(&row);
+    }
+    let pending = inbox_unread(socket).await;
+    if pending > 0 {
+        tracing::info!(%pending, "pending messages after turn; fetching next");
+    }
+    matches!(outcome, turn::TurnOutcome::AuthFailed)
+}
+
+/// Best-effort: tell the broker every message popped during the turn
+/// is now handled. Mirror of `hive-ag3nt::ack_turn` on the manager
+/// surface.
+async fn ack_turn(socket: &Path) {
+    match client::request::<_, ManagerResponse>(socket, &ManagerRequest::AckTurn).await {
+        Ok(ManagerResponse::Ok) => {}
+        Ok(ManagerResponse::Err { message }) => {
+            tracing::warn!(%message, "ack_turn rejected by broker");
+        }
+        Ok(other) => {
+            tracing::warn!(?other, "ack_turn unexpected response");
+        }
+        Err(e) => tracing::warn!(error = ?e, "ack_turn transport error"),
+    }
+}
+
+/// Boot-time recovery: ask the broker to resurface any inflight (popped
+/// but not acked) messages so the next `Recv` re-delivers them with
+/// the redelivery banner. Mirror of `hive-ag3nt::requeue_inflight`.
+async fn requeue_inflight(socket: &Path) {
+    match client::request::<_, ManagerResponse>(socket, &ManagerRequest::RequeueInflight).await {
+        Ok(ManagerResponse::Ok) => {}
+        Ok(ManagerResponse::Err { message }) => {
+            tracing::warn!(%message, "requeue_inflight rejected by broker");
+        }
+        Ok(other) => {
+            tracing::warn!(?other, "requeue_inflight unexpected response");
+        }
+        Err(e) => tracing::warn!(error = ?e, "requeue_inflight transport error"),
+    }
+}
+
+async fn inbox_unread(socket: &Path) -> u64 {
+    match client::request::<_, ManagerResponse>(socket, &ManagerRequest::Status).await {
+        Ok(ManagerResponse::Status { unread }) => unread,
+        _ => 0,
+    }
+}
+
+/// Manager-flavour equivalent of the agent helper. Mirror shape, just
+/// uses ManagerRequest/ManagerResponse instead of the agent variants.
+async fn fetch_manager_post_turn_counts(socket: &Path) -> (Option<u64>, Option<u64>) {
+    let threads = match client::request::<_, ManagerResponse>(
+        socket,
+        &ManagerRequest::GetLooseEnds { agent: None },
+    )
+    .await
+    {
+        Ok(ManagerResponse::LooseEnds { loose_ends }) => u64::try_from(loose_ends.len()).ok(),
+        _ => None,
+    };
+    let reminders = match client::request::<_, ManagerResponse>(
+        socket,
+        &ManagerRequest::CountPendingReminders { agent: None },
+    )
+    .await
+    {
+        Ok(ManagerResponse::PendingRemindersCount { count }) => Some(count),
+        _ => None,
+    };
+    (threads, reminders)
+}
+
diff --git a/hive-ag3nt/src/client.rs b/hive-ag3nt/src/client.rs
new file mode 100644
index 00000000..5f4963be
--- /dev/null
+++ b/hive-ag3nt/src/client.rs
@@ -0,0 +1,124 @@
+use std::path::Path;
+use std::time::Duration;
+
+use anyhow::{Context, Result, anyhow};
+use serde::Serialize;
+use serde::de::DeserializeOwned;
+use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
+use tokio::net::UnixStream;
+
+/// Backoff schedule between attempts. Five entries → up to 5 retries on
+/// top of the initial attempt; total wall-clock cap = 2+4+8+16+30 = 60s.
+/// Sized to ride out a hive-c0re restart (systemd usually has the unix
+/// socket back inside ~5s) without the agent-side claude session having
+/// to handle the transient itself — burning tokens on a tool-error retry
+/// loop is more expensive than 60s of in-harness sleep.
+const RETRY_BACKOFFS_MS: &[u64] = &[2_000, 4_000, 8_000, 16_000, 30_000];
+
+/// Transparent retry wrapper around [`request_retried`] that throws away
+/// the retry count. Use this from non-tool callers (the harness serve
+/// loop, web UI, CLI subcommands) where we just want the socket-restart
+/// resilience without surfacing the bookkeeping.
+///
+/// # Errors
+///
+/// Returns an error if the socket is unreachable after all retries, or if
+/// serialization / deserialization of the request or response fails.
+pub async fn request<Req, Resp>(socket: &Path, req: &Req) -> Result<Resp>
+where
+    Req: Serialize + ?Sized,
+    Resp: DeserializeOwned,
+{
+    request_retried(socket, req).await.map(|(resp, _)| resp)
+}
+
+/// Same wire shape as [`request`], but reports how many retries it took
+/// past the initial attempt (0 = succeeded first try). MCP tool handlers
+/// use this so they can append a one-line hint to the tool result when
+/// retries happened — that way claude knows the prior socket flake
+/// wasn't a content error and shouldn't trigger an LLM-level retry of
+/// its own.
+///
+/// # Errors
+///
+/// Returns an error if all retries are exhausted, or on a fatal protocol
+/// error (serialization / deserialization failure).
+///
+/// # Panics
+///
+/// Panics if `RETRY_BACKOFFS_MS.len()` does not fit in a `u32`, which
+/// cannot happen with the current compile-time constant.
+pub async fn request_retried<Req, Resp>(socket: &Path, req: &Req) -> Result<(Resp, u32)>
+where
+    Req: Serialize + ?Sized,
+    Resp: DeserializeOwned,
+{
+    let mut last_err: Option<anyhow::Error> = None;
+    let max_retries = u32::try_from(RETRY_BACKOFFS_MS.len()).unwrap();
+    for attempt in 0..=max_retries {
+        match try_once::<Req, Resp>(socket, req).await {
+            Ok(resp) => return Ok((resp, attempt)),
+            Err(RequestError::Fatal(e)) => return Err(e),
+            Err(RequestError::Transient(e)) => {
+                if attempt < max_retries {
+                    let sleep_ms = RETRY_BACKOFFS_MS[attempt as usize];
+                    tracing::warn!(
+                        attempt = attempt + 1,
+                        sleep_ms,
+                        error = %e,
+                        "hive socket attempt failed; retrying"
+                    );
+                    last_err = Some(e);
+                    tokio::time::sleep(Duration::from_millis(sleep_ms)).await;
+                } else {
+                    last_err = Some(e);
+                }
+            }
+        }
+    }
+    Err(last_err.unwrap_or_else(|| anyhow!("hive socket: retries exhausted")))
+}
+
+/// Transient = connect / IO error worth a retry (server restart, broken
+/// pipe). Fatal = serialization / deserialization / protocol error
+/// where retrying would just repeat the same failure.
+enum RequestError {
+    Transient(anyhow::Error),
+    Fatal(anyhow::Error),
+}
+
+async fn try_once<Req, Resp>(socket: &Path, req: &Req) -> Result<Resp, RequestError>
+where
+    Req: Serialize + ?Sized,
+    Resp: DeserializeOwned,
+{
+    let stream = UnixStream::connect(socket)
+        .await
+        .with_context(|| format!("connect to {}", socket.display()))
+        .map_err(RequestError::Transient)?;
+    let (read, mut write) = stream.into_split();
+
+    let mut payload = serde_json::to_string(req).map_err(|e| RequestError::Fatal(e.into()))?;
+    payload.push('\n');
+    write
+        .write_all(payload.as_bytes())
+        .await
+        .map_err(|e| RequestError::Transient(e.into()))?;
+    write
+        .flush()
+        .await
+        .map_err(|e| RequestError::Transient(e.into()))?;
+
+    let mut reader = BufReader::new(read);
+    let mut line = String::new();
+    let read_bytes = reader
+        .read_line(&mut line)
+        .await
+        .map_err(|e| RequestError::Transient(e.into()))?;
+    if read_bytes == 0 || line.is_empty() {
+        return Err(RequestError::Transient(anyhow!(
+            "server closed connection without responding"
+        )));
+    }
+    serde_json::from_str(line.trim()).map_err(|e| RequestError::Fatal(e.into()))
+}
diff --git a/hive-ag3nt/src/events.rs b/hive-ag3nt/src/events.rs
new file mode 100644
index 00000000..bae95e30
--- /dev/null
+++ b/hive-ag3nt/src/events.rs
@@ -0,0 +1,769 @@
+//! Live event stream for the per-agent web UI. The harness emits one
+//! `LiveEvent` per interesting thing that happens during a turn — wake-up
+//! (the popped inbox message), every line claude prints on stdout
+//! (parsed from `--output-format stream-json`), and the turn-end summary.
+//! The web UI subscribes via SSE and renders rows live.
+//!
+//! Channel type is `tokio::sync::broadcast`. New subscribers see only
+//! future events; the dashboard JS deals with the cold-start case by
+//! showing "connecting…" until the first event arrives.
+
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicBool, AtomicI64, AtomicU64, Ordering};
+use std::sync::{Arc, Mutex};
+
+use rusqlite::{Connection, params};
+use serde::{Deserialize, Serialize};
+use tokio::sync::broadcast;
+
+const CHANNEL_CAPACITY: usize = 256;
+/// Max `LiveEvent`s the `Bus` returns from `history()` and keeps in
+/// sqlite. Older rows are vacuumed on a periodic sweep.
+const HISTORY_CAPACITY: usize = 2000;
+/// Path to the persisted event db. Overridable via `HYPERHIVE_EVENTS_DB`
+/// for dev / tests; otherwise derived from the agent's state dir.
+fn events_db_path() -> PathBuf {
+    std::env::var_os("HYPERHIVE_EVENTS_DB").map_or_else(
+        || crate::paths::state_dir().join("hyperhive-events.sqlite"),
+        PathBuf::from,
+    )
+}
+
+/// Path to the persisted model file. Overridable via `HYPERHIVE_MODEL_FILE`
+/// for dev / tests; otherwise derived from the agent's state dir.
+fn model_file_path() -> PathBuf {
+    std::env::var_os("HYPERHIVE_MODEL_FILE").map_or_else(
+        || crate::paths::state_dir().join("hyperhive-model"),
+        PathBuf::from,
+    )
+}
+
+fn load_model() -> Option<String> {
+    let s = std::fs::read_to_string(model_file_path()).ok()?;
+    let name = s.trim();
+    if name.is_empty() {
+        None
+    } else {
+        Some(name.to_owned())
+    }
+}
+
+fn persist_model(name: &str) -> std::io::Result<()> {
+    let path = model_file_path();
+    if let Some(parent) = path.parent() {
+        let _ = std::fs::create_dir_all(parent);
+    }
+    std::fs::write(path, format!("{name}\n"))
+}
+
+fn now_unix() -> i64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .ok()
+        .and_then(|d| i64::try_from(d.as_secs()).ok())
+        .unwrap_or(0)
+}
+
+const SCHEMA: &str = "
+CREATE TABLE IF NOT EXISTS events (
+    id           INTEGER PRIMARY KEY AUTOINCREMENT,
+    ts           INTEGER NOT NULL,
+    kind         TEXT    NOT NULL,
+    payload_json TEXT    NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_events_ts ON events (ts);
+";
+
+/// Envelope carried over the broadcast channel: the `LiveEvent` itself
+/// plus a monotonic per-process seq stamped by `Bus::emit`. SSE consumers
+/// serialize this directly (seq becomes a sibling of the `kind` tag);
+/// clients use seq to dedupe their buffered live traffic against the
+/// snapshot/history responses (drop anything with `seq <= snapshot.seq`).
+#[derive(Debug, Clone, Serialize)]
+pub struct BusEvent {
+    pub seq: u64,
+    #[serde(flatten)]
+    pub event: LiveEvent,
+}
+
+/// One row of the agent's live stream. Serialised to JSON for SSE delivery.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum LiveEvent {
+    /// Harness popped a wake-up message and is about to invoke claude.
+    /// `unread` is the count of *other* messages still in the inbox at
+    /// that moment — surfaced as a badge in the live panel header.
+    TurnStart {
+        from: String,
+        body: String,
+        unread: u64,
+    },
+    /// One line of claude's `--output-format stream-json` stdout, parsed as
+    /// a generic JSON value (so we don't have to track every claude-code
+    /// event variant). The frontend pretty-prints by `type` field.
+    Stream(serde_json::Value),
+    /// Free-form note from the harness (e.g. "claude exited 0",
+    /// "stream-json parse error: ..."). Useful when stream-json itself
+    /// fails so the UI doesn't just go silent.
+    ///
+    /// Must be a struct variant (not `Note(String)`): internally-tagged
+    /// enums can't flatten a tag onto a primitive newtype, and serde
+    /// fails serialization at runtime — silently, because the SSE
+    /// handler's `filter_map(... .ok()? ...)` swallows the error. From
+    /// 2025-08 through 2026-05 every `Note` emission was a no-op + the
+    /// sqlite history persisted them as the literal string `"null"`.
+    /// The web UI's `note` renderer already reads `ev.text`, so the
+    /// wire shape matches without a JS change.
+    Note { text: String },
+    /// Turn finished. `ok=false` means claude exited non-zero or the
+    /// harness hit a transport error.
+    TurnEnd { ok: bool, note: Option<String> },
+    /// Harness reachability flipped: `"online"` /
+    /// `"needs_login_idle"` / `"needs_login_in_progress"`. The web UI
+    /// drives the alive badge from this so the operator sees a login
+    /// land (or get revoked) without polling. Session detail
+    /// (`url`/`output`/`finished`) is still served by `/api/state`
+    /// during the short-lived in-progress window — the client
+    /// re-fetches only while that flow is active.
+    StatusChanged { status: String },
+    /// `/api/model` switched the active claude model. The web UI
+    /// updates the chip + the per-turn stats sink will key off this
+    /// to mark the boundary in its log.
+    ModelChanged { model: String },
+    /// Token usage for the turn just ended. Carries two snapshots:
+    /// - `ctx` is the LAST inference's usage block (the actual context
+    ///   window in use right now — what the operator needs to decide
+    ///   whether to compact / reset).
+    /// - `cost` is the cumulative usage across every inference in the
+    ///   turn (sum of per-call billed tokens — the cost signal). For
+    ///   tool-heavy turns the cumulative blows past the model's window
+    ///   because each tool call's prompt is rebilled.
+    TokenUsageChanged { ctx: TokenUsage, cost: TokenUsage },
+    /// Harness's `TurnState` transitioned (idle / thinking /
+    /// compacting). `since_unix` matches `Bus::state_snapshot().1`
+    /// so the client's elapsed-time ticker keeps progressing across
+    /// SSE reconnects without drift.
+    TurnStateChanged {
+        state: TurnState,
+        since_unix: i64,
+    },
+}
+
+/// sqlite-backed event log. Wraps a `Connection` behind a `Mutex` so the
+/// `Bus` (which clones cheaply) shares one writer.
+struct EventStore {
+    conn: Mutex<Connection>,
+}
+
+impl EventStore {
+    fn open(path: &Path) -> rusqlite::Result<Self> {
+        if let Some(parent) = path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        let conn = Connection::open(path)?;
+        conn.execute_batch(SCHEMA)?;
+        Ok(Self {
+            conn: Mutex::new(conn),
+        })
+    }
+
+    fn append(&self, event: &LiveEvent) -> rusqlite::Result<()> {
+        let ts = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .ok()
+            .and_then(|d| i64::try_from(d.as_secs()).ok())
+            .unwrap_or(0);
+        let kind = match event {
+            LiveEvent::TurnStart { .. } => "turn_start",
+            LiveEvent::Stream(_) => "stream",
+            LiveEvent::Note { .. } => "note",
+            LiveEvent::TurnEnd { .. } => "turn_end",
+            LiveEvent::StatusChanged { .. } => "status_changed",
+            LiveEvent::ModelChanged { .. } => "model_changed",
+            LiveEvent::TokenUsageChanged { .. } => "token_usage_changed",
+            LiveEvent::TurnStateChanged { .. } => "turn_state_changed",
+        };
+        let payload = serde_json::to_string(event).unwrap_or_else(|_| "null".into());
+        let conn = self.conn.lock().unwrap();
+        conn.execute(
+            "INSERT INTO events (ts, kind, payload_json) VALUES (?1, ?2, ?3)",
+            params![ts, kind, payload],
+        )?;
+        Ok(())
+    }
+
+    fn recent(&self, limit: usize) -> rusqlite::Result<Vec<LiveEvent>> {
+        let limit_i = i64::try_from(limit).unwrap_or(i64::MAX);
+        let conn = self.conn.lock().unwrap();
+        let mut stmt = conn.prepare(
+            "SELECT payload_json FROM events
+              ORDER BY id DESC
+              LIMIT ?1",
+        )?;
+        let rows = stmt.query_map(params![limit_i], |row| {
+            let s: String = row.get(0)?;
+            Ok(serde_json::from_str::<LiveEvent>(&s).ok())
+        })?;
+        let mut out: Vec<LiveEvent> = rows.flatten().flatten().collect();
+        out.reverse();
+        Ok(out)
+    }
+}
+
+/// Token usage emitted by claude in the final `result` stream-json event.
+/// All counts are in tokens. `None` fields mean the server didn't report them.
+#[derive(Debug, Clone, Copy, Default, Serialize, Deserialize, PartialEq, Eq)]
+pub struct TokenUsage {
+    pub input_tokens: u64,
+    pub output_tokens: u64,
+    pub cache_read_input_tokens: u64,
+    pub cache_creation_input_tokens: u64,
+}
+
+impl TokenUsage {
+    /// Total context consumed this turn (input + cache reads + cache writes).
+    /// This is the per-inference context footprint that counts against the
+    /// model's `contextWindow` limit. Tracked from the last `assistant` event
+    /// in the stream-json (per-inference usage, not the cumulative `result`
+    /// event which sums across all inferences in a tool-heavy turn and can
+    /// far exceed the per-inference window).
+    #[must_use]
+    pub fn context_tokens(&self) -> u64 {
+        self.input_tokens + self.cache_read_input_tokens + self.cache_creation_input_tokens
+    }
+
+    /// Parse usage from the terminal `result` stream-json event. This is the
+    /// **cumulative** sum across every inference in the turn — useful as a
+    /// cost signal, but NOT the current context size (a tool-heavy turn
+    /// sums per-call cached prompts and easily exceeds the model window).
+    #[must_use]
+    pub fn from_stream_event(v: &serde_json::Value) -> Option<Self> {
+        if v.get("type").and_then(|t| t.as_str()) != Some("result") {
+            return None;
+        }
+        Some(Self::from_usage_obj(v.get("usage")?))
+    }
+
+    /// Parse usage from a per-inference `assistant` event's
+    /// `.message.usage` block. Each turn fires one of these for every
+    /// model call; tracking the LAST one over the turn gives the actual
+    /// conversation context size — the number to watch for compaction.
+    #[must_use]
+    pub fn from_assistant_event(v: &serde_json::Value) -> Option<Self> {
+        if v.get("type").and_then(|t| t.as_str()) != Some("assistant") {
+            return None;
+        }
+        Some(Self::from_usage_obj(v.get("message")?.get("usage")?))
+    }
+
+    fn from_usage_obj(u: &serde_json::Value) -> Self {
+        let field = |k: &str| u.get(k).and_then(serde_json::Value::as_u64).unwrap_or(0);
+        Self {
+            input_tokens: field("input_tokens"),
+            output_tokens: field("output_tokens"),
+            cache_read_input_tokens: field("cache_read_input_tokens"),
+            cache_creation_input_tokens: field("cache_creation_input_tokens"),
+        }
+    }
+
+    /// Extract the per-inference context-window limit from a `result`
+    /// stream-json event's `modelUsage` map. The API reports this as
+    /// `modelUsage.<model-name>.contextWindow`; we take the first non-zero
+    /// value across all model keys.
+    ///
+    /// Returns `None` if the event is not a `result` type or has no
+    /// `contextWindow` field. The returned value is the authoritative
+    /// per-inference active window (e.g. 200 000 for `claude-sonnet-4-6`).
+    /// It may be smaller than the full prompt-cache capacity (which can
+    /// be several million tokens via cache reads).
+    #[must_use]
+    pub fn context_window_from_result_event(v: &serde_json::Value) -> Option<u64> {
+        if v.get("type").and_then(|t| t.as_str()) != Some("result") {
+            return None;
+        }
+        let model_usage = v.get("modelUsage")?;
+        let map = model_usage.as_object()?;
+        for (_model, stats) in map {
+            if let Some(w) = stats.get("contextWindow").and_then(serde_json::Value::as_u64) {
+                if w > 0 {
+                    return Some(w);
+                }
+            }
+        }
+        None
+    }
+}
+
+/// Authoritative turn-loop state. The harness owns it; the web UI
+/// reads via `/api/state` and renders. Lives alongside the bus
+/// because everyone who has a `Bus` already has the right handle to
+/// poke the state on transitions.
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum TurnState {
+    /// Inbox is empty / waiting on `Recv`.
+    Idle,
+    /// `claude --print` is running for a turn.
+    Thinking,
+    /// Operator-triggered `/compact` is running on the persistent
+    /// session.
+    Compacting,
+}
+
+/// Compiled-in fallback model used when neither `HIVE_DEFAULT_MODEL` nor a
+/// persisted runtime override is present.
+pub const DEFAULT_MODEL: &str = "haiku";
+
+/// Return the model declared in `HIVE_DEFAULT_MODEL` (set from
+/// `hyperhive.model` in `agent.nix`), or `None` if the env var is absent /
+/// empty.  When `Some`, this takes precedence over any persisted runtime
+/// override so that nix config changes always take effect on rebuild.
+#[must_use]
+pub fn configured_model() -> Option<&'static str> {
+    // Leak once at startup — acceptable for a single config value.
+    std::env::var("HIVE_DEFAULT_MODEL")
+        .ok()
+        .filter(|s| !s.trim().is_empty())
+        .map(|s| &*Box::leak(s.into_boxed_str()))
+}
+
+/// Return the model to use when no config and no persisted override exist.
+#[must_use]
+pub fn default_model() -> &'static str {
+    configured_model().unwrap_or(DEFAULT_MODEL)
+}
+
+/// Context-window size in tokens for a given model name.
+///
+/// Canonical per-model sizes are declared in `harness-base.nix` as
+/// `hyperhive.contextWindowTokens` and injected as
+/// `HIVE_CONTEXT_WINDOW_TOKENS_<KEY_UPPER>` env vars — so this function
+/// normally just reads them. The Rust code carries no model knowledge;
+/// updating model families only requires a Nix change.
+///
+/// Resolution order (first match wins):
+/// 1. `HIVE_CONTEXT_WINDOW_TOKENS_<KEY>` — key (lowercased) is a
+///    substring of the active model name. Populated by the Nix default
+///    map for all known families; add/override in `agent.nix`.
+/// 2. `HIVE_CONTEXT_WINDOW_TOKENS` — single global override (any model).
+/// 3. Hard fallback: `200_000` (conservative; only hit outside NixOS).
+#[must_use]
+pub fn context_window_tokens(model: &str) -> u64 {
+    let m = model.to_ascii_lowercase();
+    // Per-model env vars set by `hyperhive.contextWindowTokens` in Nix.
+    for (key, val) in std::env::vars() {
+        if let Some(suffix) = key.strip_prefix("HIVE_CONTEXT_WINDOW_TOKENS_")
+            && !suffix.is_empty() && m.contains(&suffix.to_ascii_lowercase())
+                && let Ok(v) = val.trim().parse::<u64>()
+                    && v > 0 {
+                        return v;
+                    }
+    }
+    // Global override (single value, any model).
+    if let Ok(s) = std::env::var("HIVE_CONTEXT_WINDOW_TOKENS")
+        && let Ok(v) = s.trim().parse::<u64>()
+            && v > 0 {
+                return v;
+            }
+    // Hard fallback for dev/test outside NixOS where env vars aren't set.
+    200_000
+}
+
+#[derive(Clone)]
+pub struct Bus {
+    tx: Arc<broadcast::Sender<BusEvent>>,
+    /// Monotonic per-process counter stamped onto every `BusEvent`.
+    /// Persisted nowhere — a harness restart resets seq to 0; clients
+    /// always treat reconnect as "fresh state, fresh stream of seqs."
+    /// Historical events served from sqlite carry no seq (they predate
+    /// the live channel the seq is meant to dedupe against).
+    event_seq: Arc<AtomicU64>,
+    /// Persistent event log. `None` only if opening the sqlite db failed
+    /// at construction — we keep going so the harness doesn't die on a
+    /// missing state dir mount in dev / test scenarios.
+    store: Option<Arc<EventStore>>,
+    /// Current turn-loop state + since-when (unix seconds).
+    state: Arc<Mutex<(TurnState, i64)>>,
+    /// Model name passed to `claude --model`. Default `haiku`; the
+    /// operator can override at runtime via `POST /api/model`.
+    model: Arc<Mutex<String>>,
+    /// Last-inference token usage from the most recent turn's final
+    /// `assistant` event. Represents the actual context window size at
+    /// turn-end — the number the operator watches to decide whether to
+    /// compact. `None` until the first turn completes.
+    last_ctx_usage: Arc<Mutex<Option<TokenUsage>>>,
+    /// Cumulative token usage from the most recent turn's `result`
+    /// event (sum across every inference in the turn). This is the cost
+    /// signal — tool-heavy turns rebill the cached prompt per call and
+    /// blow past the model window. `None` until the first turn completes.
+    last_cost_usage: Arc<Mutex<Option<TokenUsage>>>,
+    /// True while the harness is parked after a rate-limit response.
+    /// Set by `emit_status("rate_limited")`, cleared by
+    /// `emit_status("online")`. Also mirrored to a sentinel file at
+    /// `{state_dir}/hyperhive-rate-limited` so the host-side
+    /// `container_view` can surface the status on the dashboard without
+    /// a live socket call.
+    rate_limited: Arc<AtomicBool>,
+    /// One-shot: next `run_claude` call drops `--continue`, starting
+    /// a fresh claude session. Set by `POST /api/new-session` from
+    /// the per-agent web UI; consumed (cleared back to false) by the
+    /// next turn. Subsequent turns resume normal `--continue`
+    /// behavior. Atomic so the consumer can take-and-clear without a
+    /// lock.
+    skip_continue_once: Arc<AtomicBool>,
+    /// Per-turn tool-call counter. Reset by the bin loop between
+    /// turns via `take_tool_calls`. Populated by `observe_stream` as
+    /// the stdout pump parses each stream-json line. Powers the
+    /// `tool_call_count` + `tool_call_breakdown_json` columns on the
+    /// per-turn stats sink.
+    tool_calls: Arc<Mutex<std::collections::HashMap<String, u64>>>,
+    /// Unix timestamp of the most recent completed turn (set by
+    /// `record_turn_usage`). Used by the auto-reset heuristic in
+    /// `turn.rs` to compute how long the session has been idle and
+    /// whether the prompt cache has gone cold. `0` = no turn yet.
+    last_turn_ended_unix: Arc<AtomicI64>,
+    /// Per-inference context-window size as reported by the Anthropic API
+    /// in the stream-json `result` event (`modelUsage.*.contextWindow`).
+    /// Set by the stdout pump on every completed turn. Takes precedence
+    /// over the Nix-configured `HIVE_CONTEXT_WINDOW_TOKENS_*` env vars
+    /// for compaction watermark calculations — it reflects the actual
+    /// limit the model enforces, which may differ from what the operator
+    /// configured (e.g. 200 k active window on a 1 M cache-enabled model).
+    api_context_window: Arc<Mutex<Option<u64>>>,
+}
+
+impl Bus {
+    /// Open the events db (path from `events_db_path()`). On failure, fall back
+    /// to a no-store bus — the harness still works, just without persistent history.
+    #[must_use]
+    pub fn new() -> Self {
+        let path = events_db_path();
+        let store = match EventStore::open(&path) {
+            Ok(s) => Some(Arc::new(s)),
+            Err(e) => {
+                tracing::warn!(error = ?e, path = %path.display(), "events db open failed; running without history");
+                None
+            }
+        };
+        let (tx, _) = broadcast::channel(CHANNEL_CAPACITY);
+        // Priority: HIVE_DEFAULT_MODEL (from hyperhive.model in agent.nix) >
+        // persisted runtime override > compiled-in DEFAULT_MODEL.
+        // The nix config always wins on rebuild; the persisted file is kept
+        // for within-session tracking only (see persist_model / set_model).
+        let initial_model = configured_model()
+            .map(str::to_owned)
+            .unwrap_or_else(|| load_model().unwrap_or_else(|| DEFAULT_MODEL.to_owned()));
+        // Restore rate_limited from the sentinel file — if the harness
+        // crashed while parked, we should still show the right status on
+        // cold load until the next turn clears it.
+        let sentinel = crate::paths::state_dir().join("hyperhive-rate-limited");
+        let was_rate_limited = sentinel.exists();
+        Self {
+            tx: Arc::new(tx),
+            event_seq: Arc::new(AtomicU64::new(0)),
+            store,
+            state: Arc::new(Mutex::new((TurnState::Idle, now_unix()))),
+            model: Arc::new(Mutex::new(initial_model)),
+            last_ctx_usage: Arc::new(Mutex::new(None)),
+            last_cost_usage: Arc::new(Mutex::new(None)),
+            rate_limited: Arc::new(AtomicBool::new(was_rate_limited)),
+            skip_continue_once: Arc::new(AtomicBool::new(false)),
+            tool_calls: Arc::new(Mutex::new(std::collections::HashMap::new())),
+            last_turn_ended_unix: Arc::new(AtomicI64::new(0)),
+            api_context_window: Arc::new(Mutex::new(None)),
+        }
+    }
+
+    /// Current high-water seq. Snapshot endpoints read this before
+    /// gathering state so the resulting (snapshot.seq, snapshot) pair
+    /// satisfies: any live event with seq > snapshot.seq is post-snapshot
+    /// (not yet reflected). Clients dedupe buffered SSE traffic against
+    /// this value.
+    #[must_use]
+    pub fn current_seq(&self) -> u64 {
+        self.event_seq.load(Ordering::SeqCst)
+    }
+
+    fn next_seq(&self) -> u64 {
+        self.event_seq.fetch_add(1, Ordering::SeqCst) + 1
+    }
+
+    /// Arm the one-shot: the next claude invocation will run without
+    /// `--continue`, dropping any prior session context. Idempotent
+    /// — calling twice in a row before the next turn still consumes
+    /// to a single fresh-start.
+    pub fn request_new_session(&self) {
+        self.skip_continue_once.store(true, Ordering::SeqCst);
+    }
+
+    /// Take + clear the one-shot. Returns true iff the caller should
+    /// run claude without `--continue` for this turn.
+    #[must_use]
+    pub fn take_skip_continue(&self) -> bool {
+        self.skip_continue_once.swap(false, Ordering::SeqCst)
+    }
+
+    /// Currently-selected claude model name. Read on every turn so a
+    /// `/model <name>` flip takes effect on the next turn.
+    ///
+    /// # Panics
+    ///
+    /// Panics if the internal lock is poisoned.
+    #[must_use]
+    pub fn model(&self) -> String {
+        self.model.lock().unwrap().clone()
+    }
+
+    /// Switch the model for future turns. The current turn (if any)
+    /// keeps the model it was already running. Persisted to the agent's
+    /// state dir (`hyperhive-model`) so the override survives harness
+    /// restart and container rebuild (gone on `--purge`, matching
+    /// every other piece of agent state).
+    ///
+    /// # Panics
+    ///
+    /// Panics if the internal lock is poisoned.
+    pub fn set_model(&self, name: impl Into<String>) {
+        let value: String = name.into();
+        self.model.lock().unwrap().clone_from(&value);
+        if let Err(e) = persist_model(&value) {
+            tracing::warn!(error = ?e, "model: persist failed");
+        }
+        self.emit(LiveEvent::ModelChanged { model: value });
+    }
+
+    /// Seed `last_ctx_usage` + `last_cost_usage` at startup without
+    /// emitting a SSE event. Used by the bin entrypoints to backfill
+    /// from the most recent `turn_stats` row so the per-agent web UI's
+    /// ctx + cost badges paint real numbers on cold load.
+    ///
+    /// # Panics
+    ///
+    /// Panics if an internal lock is poisoned.
+    pub fn seed_usage(&self, ctx: Option<TokenUsage>, cost: Option<TokenUsage>) {
+        if ctx.is_some() {
+            *self.last_ctx_usage.lock().unwrap() = ctx;
+        }
+        if cost.is_some() {
+            *self.last_cost_usage.lock().unwrap() = cost;
+        }
+    }
+
+    /// Record the just-ended turn's usage. `ctx` is the last inference's
+    /// usage (current context size); `cost` is the cumulative across
+    /// every inference in the turn (cost signal). One SSE event fires
+    /// per turn carrying both.
+    ///
+    /// # Panics
+    ///
+    /// Panics if an internal lock is poisoned.
+    pub fn record_turn_usage(&self, ctx: TokenUsage, cost: TokenUsage) {
+        *self.last_ctx_usage.lock().unwrap() = Some(ctx);
+        *self.last_cost_usage.lock().unwrap() = Some(cost);
+        self.last_turn_ended_unix.store(now_unix(), Ordering::Relaxed);
+        self.emit(LiveEvent::TokenUsageChanged { ctx, cost });
+    }
+
+    /// Unix timestamp of the most recent completed turn (`record_turn_usage`
+    /// call), or `0` if no turn has finished yet.
+    #[must_use]
+    pub fn last_turn_ended_unix(&self) -> i64 {
+        self.last_turn_ended_unix.load(Ordering::Relaxed)
+    }
+
+    /// Update the API-reported context-window size from the stream-json
+    /// `result` event's `modelUsage.*.contextWindow` field. Called by the
+    /// stdout pump once per completed turn. `0` is ignored (sentinel for
+    /// "not reported").
+    pub fn set_api_context_window(&self, window: u64) {
+        if window > 0 {
+            *self.api_context_window.lock().unwrap() = Some(window);
+        }
+    }
+
+    /// Return the API-reported per-inference context-window size, if the
+    /// harness has seen at least one completed turn for this session.
+    /// `None` until the first result event is processed.
+    #[must_use]
+    pub fn api_context_window(&self) -> Option<u64> {
+        *self.api_context_window.lock().unwrap()
+    }
+
+    /// Walk a stream-json value for `tool_use` blocks and bump the
+    /// per-turn counter for each one we find. Called by the stdout
+    /// pump on every parsed line. Cheap when the line isn't an
+    /// assistant message — the field-check short-circuits.
+    ///
+    /// # Panics
+    ///
+    /// Panics if the internal lock is poisoned.
+    pub fn observe_stream(&self, v: &serde_json::Value) {
+        if v.get("type").and_then(|t| t.as_str()) != Some("assistant") {
+            return;
+        }
+        let Some(content) = v
+            .get("message")
+            .and_then(|m| m.get("content"))
+            .and_then(|c| c.as_array())
+        else {
+            return;
+        };
+        let mut counts = self.tool_calls.lock().unwrap();
+        for block in content {
+            if block.get("type").and_then(|t| t.as_str()) != Some("tool_use") {
+                continue;
+            }
+            let name = block
+                .get("name")
+                .and_then(|n| n.as_str())
+                .unwrap_or("<unnamed>")
+                .to_owned();
+            *counts.entry(name).or_insert(0) += 1;
+        }
+    }
+
+    /// Snapshot + clear the per-turn tool-call counter. The harness
+    /// calls this between turns to fold the breakdown into a
+    /// `turn_stats` row, then start the next turn with an empty map.
+    ///
+    /// # Panics
+    ///
+    /// Panics if the internal lock is poisoned.
+    #[must_use]
+    pub fn take_tool_calls(&self) -> std::collections::HashMap<String, u64> {
+        std::mem::take(&mut *self.tool_calls.lock().unwrap())
+    }
+
+    /// Last context-size snapshot (last inference of the most recent
+    /// turn), or `None` if no turn has completed yet.
+    ///
+    /// # Panics
+    ///
+    /// Panics if the internal lock is poisoned.
+    #[must_use]
+    pub fn last_ctx_usage(&self) -> Option<TokenUsage> {
+        *self.last_ctx_usage.lock().unwrap()
+    }
+
+    /// Last cumulative cost snapshot (sum across the most recent turn's
+    /// inferences), or `None` if no turn has completed yet.
+    ///
+    /// # Panics
+    ///
+    /// Panics if the internal lock is poisoned.
+    #[must_use]
+    pub fn last_cost_usage(&self) -> Option<TokenUsage> {
+        *self.last_cost_usage.lock().unwrap()
+    }
+
+    /// Update the harness's authoritative turn-loop state. Records
+    /// the transition time so `state_snapshot` can return a since-age.
+    ///
+    /// # Panics
+    ///
+    /// Panics if the internal lock is poisoned.
+    pub fn set_state(&self, next: TurnState) {
+        let since;
+        {
+            let mut guard = self.state.lock().unwrap();
+            if guard.0 == next {
+                return;
+            }
+            *guard = (next, now_unix());
+            since = guard.1;
+        }
+        self.emit(LiveEvent::TurnStateChanged {
+            state: next,
+            since_unix: since,
+        });
+    }
+
+    /// Broadcast a status flip (online / `needs_login_*` / `rate_limited`).
+    /// Called by the bin entry points + `turn::wait_for_login` + the
+    /// `post_login_*` handlers — every site that mutates the
+    /// `Arc<Mutex<LoginState>>` should also call this so the web UI
+    /// drops its periodic /api/state poll while a turn loop is running.
+    ///
+    /// Sentinel files survive harness restart so the host-side dashboard
+    /// can render the status without a live socket call:
+    /// - `"rate_limited"` writes `{state_dir}/hyperhive-rate-limited`
+    ///   (cleared by any other status).
+    /// - `"needs_login_idle"` writes `{state_dir}/hyperhive-needs-login`
+    ///   so a 401-triggered re-auth flag persists across harness restart
+    ///   (#419). The web UI's `/login` POST handler clears it via
+    ///   `clear_needs_login_sentinel` once the operator re-auths.
+    /// - `"online"` clears both sentinels — the agent is healthy again.
+    pub fn emit_status(&self, status: impl Into<String>) {
+        let status = status.into();
+        let rate_limited_path = crate::paths::state_dir().join("hyperhive-rate-limited");
+        let needs_login_path = crate::paths::state_dir().join("hyperhive-needs-login");
+        if status == "rate_limited" {
+            self.rate_limited.store(true, Ordering::Relaxed);
+            let _ = std::fs::write(&rate_limited_path, b"");
+        } else {
+            self.rate_limited.store(false, Ordering::Relaxed);
+            let _ = std::fs::remove_file(&rate_limited_path);
+        }
+        if status == "needs_login_idle" {
+            let _ = std::fs::write(&needs_login_path, b"");
+        } else if status == "online" {
+            // Re-auth completed (or manual flip back to online) — drop
+            // the sentinel. `needs_login_in_progress` is a transient
+            // mid-flow status and shouldn't clear yet.
+            let _ = std::fs::remove_file(&needs_login_path);
+        }
+        self.emit(LiveEvent::StatusChanged { status });
+    }
+
+    /// Returns true while the harness is parked after a rate-limit response.
+    #[must_use]
+    pub fn is_rate_limited(&self) -> bool {
+        self.rate_limited.load(Ordering::Relaxed)
+    }
+
+    /// Current state + since-when (unix seconds). Snapshot copy, no lock held.
+    ///
+    /// # Panics
+    ///
+    /// Panics if the internal lock is poisoned.
+    #[must_use]
+    pub fn state_snapshot(&self) -> (TurnState, i64) {
+        *self.state.lock().unwrap()
+    }
+
+    pub fn emit(&self, event: LiveEvent) {
+        if let Some(store) = &self.store
+            && let Err(e) = store.append(&event)
+        {
+            tracing::warn!(error = ?e, "events: append failed");
+        }
+        let envelope = BusEvent {
+            seq: self.next_seq(),
+            event,
+        };
+        // Lagged subscribers drop events — fine; the UI is a tail, not a log.
+        let _ = self.tx.send(envelope);
+    }
+
+    #[must_use]
+    pub fn subscribe(&self) -> broadcast::Receiver<BusEvent> {
+        self.tx.subscribe()
+    }
+
+    /// Most recent events, oldest first, capped at `HISTORY_CAPACITY`.
+    /// Drives the terminal pre-fill when the operator opens the agent
+    /// page; without a store (db open failed) this is empty.
+    #[must_use]
+    pub fn history(&self) -> Vec<LiveEvent> {
+        let Some(store) = &self.store else {
+            return Vec::new();
+        };
+        store.recent(HISTORY_CAPACITY).unwrap_or_default()
+    }
+}
+
+impl Default for Bus {
+    fn default() -> Self {
+        Self::new()
+    }
+}
diff --git a/hive-ag3nt/src/forge_notify.rs b/hive-ag3nt/src/forge_notify.rs
new file mode 100644
index 00000000..fad34d8f
--- /dev/null
+++ b/hive-ag3nt/src/forge_notify.rs
@@ -0,0 +1,775 @@
+//! Background Forgejo notification poller.
+//!
+//! Reads `HIVE_FORGE_URL` + `{HYPERHIVE_STATE_DIR}/forge-token`, polls
+//! `GET /notifications?all=false` every 30 seconds, and delivers each
+//! unread notification as a broker `Wake { from: "forge" }` message so
+//! claude's normal turn loop picks it up.
+//!
+//! Each notification is enriched with the subject body and/or latest
+//! comment body so the agent sees actual content, not just a title.
+//!
+//! Graceful no-ops:
+//! - `HIVE_FORGE_URL` not set → disabled (no forge configured)
+//! - token file absent → disabled (agent has no forge account yet)
+//! - HTTP errors → logged at debug, retry next tick
+//!
+//! After successfully delivering a notification it is marked read via
+//! `PATCH /notifications/threads/{id}` so it does not re-fire. If delivery
+//! fails the thread is left unread so it resurfaces next tick.
+//!
+//! Self-notification filtering (closes #230):
+//! - New issues/PRs created by this agent (`reason == "author"` + `state == open`)
+//!   are silently marked read — the agent already knows it opened them.
+//! - Comment notifications where the comment author matches this agent's own
+//!   forge login are silently marked read.
+//!
+//! Own login is fetched once at startup via `GET /user` and cached for the
+//! lifetime of the polling loop.
+//!
+//! PR review formatting (closes #231):
+//! - When `latest_comment_url` points to a review (the fetched JSON has a
+//!   `state` field like `APPROVED` / `REQUEST_CHANGES` / `COMMENT`), the
+//!   notification is formatted as `[PR approved #N repo]` instead of the
+//!   generic `[comment on PR #N repo]` so agents can action it immediately.
+
+use std::collections::HashSet;
+use std::fmt::Write as _;
+use std::path::{Path, PathBuf};
+use std::time::Duration;
+
+use tracing::{debug, info, warn};
+
+const POLL_INTERVAL_SECS: u64 = 30;
+const HTTP_TIMEOUT_SECS: u64 = 10;
+/// Maximum characters of a body/comment to include in the wake message.
+const BODY_TRUNCATE: usize = 500;
+
+/// Spawn point: called once from `hive-ag3nt serve` (agent) or
+/// `hive-m1nd serve` (manager). Returns immediately if the forge is not
+/// configured. Otherwise loops forever, polling every
+/// `POLL_INTERVAL_SECS` seconds. Errors are never fatal.
+///
+/// `is_manager`: when true, wakes the inbox via `ManagerRequest::Wake`
+/// instead of `AgentRequest::Wake` (the manager socket rejects the agent
+/// request type).
+pub async fn run(socket: PathBuf, is_manager: bool) {
+    let forge_url = match std::env::var("HIVE_FORGE_URL") {
+        Ok(u) if !u.is_empty() => u,
+        _ => {
+            debug!("forge_notify: HIVE_FORGE_URL not set — disabled");
+            return;
+        }
+    };
+
+    let state_dir = std::env::var("HYPERHIVE_STATE_DIR").unwrap_or_default();
+    let token_path = format!("{state_dir}/forge-token");
+    let token = match tokio::fs::read_to_string(&token_path).await {
+        Ok(t) => {
+            let t = t.trim().to_owned();
+            if t.is_empty() {
+                debug!("forge_notify: empty forge token at {token_path} — disabled");
+                return;
+            }
+            t
+        }
+        Err(e) => {
+            debug!("forge_notify: no forge token at {token_path} ({e}) — disabled");
+            return;
+        }
+    };
+
+    let client = match reqwest::Client::builder()
+        .timeout(Duration::from_secs(HTTP_TIMEOUT_SECS))
+        .build()
+    {
+        Ok(c) => c,
+        Err(e) => {
+            warn!("forge_notify: failed to build HTTP client: {e}");
+            return;
+        }
+    };
+
+    // Fetch own login once for self-notification filtering (closes #230).
+    // Falls back to empty string on failure — no filtering (safe degradation).
+    let own_login = {
+        let url = format!("{forge_url}/api/v1/user");
+        fetch_json(&client, &url, &token)
+            .await
+            .and_then(|v| v["login"].as_str().map(std::borrow::ToOwned::to_owned))
+            .unwrap_or_default()
+    };
+    if own_login.is_empty() {
+        warn!("forge_notify: could not resolve own login — self-notification filtering disabled");
+    } else {
+        debug!(%own_login, "forge_notify: own login resolved");
+    }
+
+    let mut interval = tokio::time::interval(Duration::from_secs(POLL_INTERVAL_SECS));
+    interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
+    // First tick fires immediately — skip it so we don't race the broker
+    // socket becoming available right at boot.
+    interval.tick().await;
+
+    // HIVE_FORGE_KEEP_SUBSCRIPTIONS=1 disables auto-unsubscribe for agents
+    // that intentionally consume the full repo notification firehose (e.g. triage).
+    let keep_subscriptions = std::env::var("HIVE_FORGE_KEEP_SUBSCRIPTIONS")
+        .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
+        .unwrap_or(false);
+
+    // Optional reason drop-list. `HIVE_FORGE_NOTIFY_SKIP_REASONS` is a
+    // comma-separated list of Forgejo notification `reason` values to
+    // suppress (e.g. `subscribed,participating`). Notifications with
+    // those reasons are marked read and silently dropped; everything
+    // else -- including notifications with a null/unrecognised reason --
+    // is delivered. Drop-list is safer than an allow-list: it kills the
+    // firehose without risking silent misses of directed signals
+    // (review_requested, assigned) or future unknown reason strings.
+    // Configurable per-agent via `hyperhive.forge.skipNotifyReasons` in agent.nix.
+    let skip_reasons: Vec<String> = std::env::var("HIVE_FORGE_NOTIFY_SKIP_REASONS")
+        .unwrap_or_default()
+        .split(',')
+        .map(str::trim)
+        .filter(|s| !s.is_empty())
+        .map(str::to_owned)
+        .collect();
+
+    if skip_reasons.is_empty() {
+        info!(forge_url = %forge_url, "forge_notify: polling started (all reasons)");
+    } else {
+        info!(forge_url = %forge_url, skip = ?skip_reasons, "forge_notify: polling started");
+    }
+
+    // Repos we have already unsubscribed this process lifetime. Persists
+    // across polls so we don't hammer DELETE on every cycle.
+    let mut unsubbed_repos: HashSet<String> = HashSet::new();
+
+    loop {
+        interval.tick().await;
+        poll_once(
+            &client,
+            &forge_url,
+            &token,
+            &socket,
+            is_manager,
+            keep_subscriptions,
+            &mut unsubbed_repos,
+            &own_login,
+            &skip_reasons,
+        )
+        .await;
+    }
+}
+
+/// Fetch a JSON value from a URL using the agent's forge token. Returns
+/// `None` on any HTTP or parse error (best-effort enrichment).
+async fn fetch_json(
+    client: &reqwest::Client,
+    url: &str,
+    token: &str,
+) -> Option<serde_json::Value> {
+    let resp = client
+        .get(url)
+        .header("Authorization", format!("token {token}"))
+        .send()
+        .await
+        .ok()?;
+    if !resp.status().is_success() {
+        return None;
+    }
+    resp.json().await.ok()
+}
+
+/// Map a Forgejo notification `subject.type` to a human-readable label.
+/// Known values: "Pull", "Issue", "Commit", "Repository". Any unknown
+/// type is passed through as-is so new Forgejo types degrade gracefully
+/// rather than silently collapsing into a generic label.
+fn notif_type_label(t: &str) -> &str {
+    match t {
+        "Pull" => "PR",
+        "Issue" => "issue",
+        other => other,
+    }
+}
+
+/// Truncate a string to `max` bytes at a char boundary, appending `…` if cut.
+/// Escape ATX-style markdown headings (`# h`, `## h`, …) in a
+/// comment/review body before we embed it inline in the forge-notify
+/// wrapper. The wrapper is the markdown context the dashboard's
+/// `marked.parse` sees; without this, a body line like `## argus
+/// review` blows into a top-level h2 in the agent's chat row,
+/// dwarfing the rest of the wrapper text (closes #455).
+///
+/// Backslash before `#` is the standard markdown escape — `\#` renders
+/// as the literal character `#`, so the line is preserved verbatim
+/// without claiming heading-level styling. Indented lines keep their
+/// indentation. Lines that don't start with `#` (ignoring leading
+/// whitespace) are passed through unchanged. Setext-style headings
+/// (`heading\n===`) are not handled here — rarer in practice and
+/// would need multi-line lookahead; revisit if it actually shows up.
+///
+/// **ATX shape strictly:** CommonMark requires a space (or end-of-line)
+/// after the 1-6 leading `#`s to count as an ATX heading. Lines like
+/// `#tag`, `#123`, `#!/bin/bash` are NOT headings — passing them through
+/// untouched avoids the cosmetic noise argus flagged on PR #518 (`\#tag`
+/// renders the same as `#tag`, but the escape is unnecessary).
+///
+/// **Trailing newline preserved:** `split_inclusive('\n')` keeps each
+/// line's terminator so the join round-trips a body that ended in `\n`.
+fn escape_md_headings(body: &str) -> String {
+    let mut out = String::with_capacity(body.len());
+    for line in body.split_inclusive('\n') {
+        let (content, terminator) = match line.strip_suffix('\n') {
+            Some(rest) => (rest, "\n"),
+            None => (line, ""),
+        };
+        let trimmed = content.trim_start();
+        if is_atx_heading(trimmed) {
+            let lead = &content[..content.len() - trimmed.len()];
+            out.push_str(lead);
+            out.push('\\');
+            out.push_str(trimmed);
+        } else {
+            out.push_str(content);
+        }
+        out.push_str(terminator);
+    }
+    out
+}
+
+/// Strict CommonMark ATX-heading detector: 1-6 leading `#`s followed
+/// by either a space, tab, or end-of-line. Anything tighter (`#tag`,
+/// `#123`) is a non-heading line that the renderer will not promote.
+fn is_atx_heading(line: &str) -> bool {
+    let hashes = line.bytes().take_while(|&b| b == b'#').count();
+    if !(1..=6).contains(&hashes) {
+        return false;
+    }
+    match line.as_bytes().get(hashes) {
+        None => true,                            // bare `#` / `##` / ... on its own line
+        Some(b' ') | Some(b'\t') => true,        // proper ATX with space/tab after #s
+        _ => false,                              // `#tag` / `#123` — not a heading
+    }
+}
+
+fn truncate(s: &str, max: usize) -> String {
+    if s.len() <= max {
+        return s.to_owned();
+    }
+    let end = s
+        .char_indices()
+        .map(|(i, _)| i)
+        .take_while(|&i| i <= max - 3)
+        .last()
+        .unwrap_or(0);
+    format!("{}…", &s[..end])
+}
+
+/// Map a Forgejo review state to a readable action label.
+/// Returns `None` for non-review states (regular comments have no `state` field;
+/// `PENDING` means the review was saved but not submitted yet).
+/// Forgejo review states: "APPROVED", "`REQUEST_CHANGES`", "COMMENT", "PENDING".
+fn review_state_label(state: &str) -> Option<&str> {
+    match state {
+        "APPROVED" => Some("approved"),
+        "REQUEST_CHANGES" => Some("changes requested"),
+        "COMMENT" => Some("review comment"),
+        _ => None,
+    }
+}
+
+/// Build a human-readable wake message for one Forgejo notification.
+/// Returns `None` when the notification is a self-echo (actor is `own_login`)
+/// and should be silently discarded (and marked read by the caller).
+///
+/// Formats:
+/// - Comment:  `[comment on PR #N repo] title\nurl: ...\n\nauthor: body\nassignee: user\nreason: mention`
+/// - Review:   `[PR approved #N repo] title\nurl: ...\n\nreviewer: body\nassignee: user\nreason: review_requested`
+/// - New item: `[new issue #N repo] title\nurl: ...\nassignee: user\nreason: author`
+/// - State:    `[PR merged #N repo] title\nurl: ...\nassignee: user\nreason: subscribed`
+///
+/// Assignees (and, for PRs, `requested_reviewers`) are appended unconditionally
+/// on all issue/PR notifications (closes #256).
+///
+/// The `reason` field from the Forgejo notification is always appended (closes #110).
+/// Forgejo emits one notification entry per reason for the same event, so including
+/// it makes otherwise-identical messages distinguishable (e.g. `mention` vs
+/// `subscribed` both arriving for the same PR comment).
+///
+/// Number is extracted from `html_url` last path segment before any `#`.
+/// Repo slug (`owner/name`) is always included — agents may watch multiple repos.
+async fn format_notification(
+    client: &reqwest::Client,
+    token: &str,
+    notif: &serde_json::Value,
+    own_login: &str,
+) -> Option<String> {
+    let title = notif["subject"]["title"].as_str().unwrap_or("?");
+    let notif_type = notif["subject"]["type"].as_str().unwrap_or("?");
+    let html_url = notif["subject"]["html_url"]
+        .as_str()
+        .unwrap_or_else(|| notif["subject"]["url"].as_str().unwrap_or(""));
+
+    // Extract issue/PR number from the html_url. URL ends with /issues/N or
+    // /pulls/N (possibly followed by #anchor for comments). Best-effort.
+    let num = html_url
+        .split('#')
+        .next()
+        .and_then(|u| u.rsplit('/').next())
+        .and_then(|s| s.parse::<u64>().ok())
+        .map(|n| format!(" #{n}"))
+        .unwrap_or_default();
+
+    // Repo slug for multi-repo disambiguation. Falls back gracefully when absent.
+    let repo = notif["repository"]["full_name"]
+        .as_str()
+        .map(|r| format!(" {r}"))
+        .unwrap_or_default();
+
+    // API URLs for fetching content
+    let subject_api_url = notif["subject"]["url"].as_str().unwrap_or("");
+    let comment_api_url = notif["subject"]["latest_comment_url"].as_str().unwrap_or("");
+    let comment_html_url = notif["subject"]["latest_comment_html_url"]
+        .as_str()
+        .unwrap_or("");
+
+    // Always fetch subject detail for assignee/reviewer metadata (#256).
+    // Keeps agents informed of current ownership without a follow-up fetch.
+    let subject = if subject_api_url.is_empty() {
+        None
+    } else {
+        fetch_json(client, subject_api_url, token).await
+    };
+
+    let is_pr = matches!(notif_type, "Pull Request" | "Pull");
+    let reason = notif["reason"].as_str().unwrap_or("");
+    let meta_suffix = build_meta_suffix(subject.as_ref(), is_pr, reason);
+
+    // Determine whether this notification was triggered by a comment/review or
+    // by creation/state-change of the subject itself.
+    let has_comment = !comment_api_url.is_empty() && comment_api_url != subject_api_url;
+
+    let meta = NotifMeta { title, notif_type, html_url, num, repo, meta_suffix, reason, subject, is_pr };
+    if has_comment {
+        format_comment_notification(client, token, &meta, comment_api_url, comment_html_url, own_login).await
+    } else {
+        format_state_change_notification(notif, &meta, own_login)
+    }
+}
+
+/// Shared notification metadata extracted from the raw Forgejo JSON.
+struct NotifMeta<'a> {
+    title: &'a str,
+    notif_type: &'a str,
+    html_url: &'a str,
+    num: String,
+    repo: String,
+    meta_suffix: String,
+    /// Forgejo `reason` value (e.g. "mention", "assigned", "subscribed").
+    /// Appended to every formatted message so that multiple notifications for
+    /// the same event (each with a different reason) are distinguishable (closes #110).
+    reason: &'a str,
+    /// Fetched subject detail (issue/PR JSON); used for review-request detection.
+    subject: Option<serde_json::Value>,
+    is_pr: bool,
+}
+
+/// Build the `\nassignee: ...` (and optionally `\nreviewer: ...` and `\nreason: ...`) suffix
+/// appended to all notification kinds.
+fn build_meta_suffix(subject: Option<&serde_json::Value>, is_pr: bool, reason: &str) -> String {
+    let assignees: Vec<&str> = subject
+        .and_then(|s| s["assignees"].as_array())
+        .map(|arr| arr.iter().filter_map(|a| a["login"].as_str()).collect())
+        .unwrap_or_default();
+    let assignee_line = if assignees.is_empty() {
+        "assignee: unassigned".to_owned()
+    } else {
+        format!("assignee: {}", assignees.join(", "))
+    };
+    // For PRs, include requested_reviewers when present.
+    let reviewer_line = if is_pr {
+        let reviewers: Vec<&str> = subject
+            .and_then(|s| s["requested_reviewers"].as_array())
+            .map(|arr| arr.iter().filter_map(|r| r["login"].as_str()).collect())
+            .unwrap_or_default();
+        if reviewers.is_empty() { None } else { Some(format!("reviewer: {}", reviewers.join(", "))) }
+    } else {
+        None
+    };
+    // Always include reason so multiple notifications for the same event
+    // (each with a different Forgejo reason) are distinguishable (closes #110).
+    let reason_line = if reason.is_empty() { None } else { Some(format!("reason: {reason}")) };
+    let mut out = format!("\n{assignee_line}");
+    if let Some(r) = reviewer_line { write!(out, "\n{r}").ok(); }
+    if let Some(r) = reason_line   { write!(out, "\n{r}").ok(); }
+    out
+}
+
+/// Format a notification triggered by a new comment or review submission.
+async fn format_comment_notification(
+    client: &reqwest::Client,
+    token: &str,
+    meta: &NotifMeta<'_>,
+    comment_api_url: &str,
+    comment_html_url: &str,
+    own_login: &str,
+) -> Option<String> {
+    let payload = fetch_json(client, comment_api_url, token).await;
+
+    let actor_login = payload
+        .as_ref()
+        .and_then(|c| c["user"]["login"].as_str())
+        .unwrap_or("");
+
+    // Self-notification filter (#230): skip if we authored the comment/review.
+    if !own_login.is_empty() && actor_login == own_login {
+        debug!(%own_login, "forge_notify: skipping self-authored comment/review");
+        return None;
+    }
+
+    let body_text = payload
+        .as_ref()
+        .and_then(|c| c["body"].as_str())
+        .unwrap_or("")
+        .trim();
+
+    // PR review detection (#231): Forgejo review objects carry a `state` field
+    // with values like "APPROVED" / "REQUEST_CHANGES" / "COMMENT". Regular
+    // issue/PR comments have no such field. Format reviews distinctly so the
+    // agent knows the review outcome immediately without reading the body.
+    let review_state = payload
+        .as_ref()
+        .and_then(|c| c["state"].as_str())
+        .and_then(review_state_label);
+
+    let url = if comment_html_url.is_empty() { meta.html_url } else { comment_html_url };
+    let author = if actor_login.is_empty() { "?" } else { actor_login };
+    let NotifMeta { title, notif_type, num, repo, meta_suffix, .. } = meta;
+
+    // Escape ATX headings in the user-authored body so the embedded
+    // text doesn't blow into top-level h1/h2 in the wrapper message
+    // when the dashboard renders it (closes #455). Done once here
+    // because both code paths fall through the same truncate+embed
+    // pattern.
+    let escaped = escape_md_headings(body_text);
+    let body_for_embed = truncate(&escaped, BODY_TRUNCATE);
+    if let Some(review_label) = review_state {
+        // Review submission on a PR.
+        let kind = format!("PR {review_label}{num}{repo}");
+        let mut out = format!("[{kind}] {title}\nurl: {url}");
+        if body_text.is_empty() {
+            write!(out, "\n\nreviewer: {author}").ok();
+        } else {
+            write!(out, "\n\n{author}: {body_for_embed}").ok();
+        }
+        out.push_str(meta_suffix);
+        Some(out)
+    } else {
+        // Regular comment.
+        let kind = format!("comment on {}{num}{repo}", notif_type_label(notif_type));
+        let mut out = format!("[{kind}] {title}\nurl: {url}\n\n{author}: {body_for_embed}");
+        if out.ends_with('\n') {
+            out.pop();
+        }
+        out.push_str(meta_suffix);
+        Some(out)
+    }
+}
+
+/// Format a notification triggered by creation or state change of the subject.
+fn format_state_change_notification(
+    notif: &serde_json::Value,
+    meta: &NotifMeta<'_>,
+    own_login: &str,
+) -> Option<String> {
+    // Classification uses notif["subject"]["state"] directly — Forgejo
+    // returns "open" / "closed" / "merged" here. We do NOT rely on
+    // fetching the PR/issue detail for `merged`:
+    //   - `subject.url` points to the *issues* endpoint, which returns
+    //     `pull_request.merged`, not top-level `merged`.
+    //   - Forgejo API type is "Pull" / "Issue", never "Pull Request".
+    let notif_state = notif["subject"]["state"].as_str().unwrap_or("");
+
+    // Self-notification filter (#230): skip new items we authored ourselves.
+    // `reason == "author"` combined with open state means we just opened the
+    // issue/PR. We do NOT filter merged/closed state changes — those are
+    // triggered by someone else and we want them.
+    let is_new = notif_state == "open" || notif_state.is_empty();
+    if is_new && meta.reason == "author" && !own_login.is_empty() {
+        debug!(%own_login, "forge_notify: skipping self-authored new item");
+        return None;
+    }
+
+    let NotifMeta { title, notif_type, html_url, num, repo, meta_suffix, reason: _, subject, is_pr } = meta;
+    let label = notif_type_label(notif_type);
+    let kind = match notif_state {
+        "merged" => format!("{label} merged{num}{repo}"),
+        "closed" => format!("{label} closed{num}{repo}"),
+        "open" | "" => format!("new {label}{num}{repo}"),
+        other => format!("{label}{num}{repo}: {other}"),
+    };
+
+    // Review-request detection (#253): Forgejo does not always set
+    // reason == "review_requested" (observed as null). Check
+    // requested_reviewers instead, which is reliable. If own_login is
+    // in the list, override the kind.
+    // subject and is_pr are already fetched unconditionally above (#256).
+    let is_review_request = is_new
+        && *is_pr
+        && !own_login.is_empty()
+        && subject
+            .as_ref()
+            .and_then(|s| s["requested_reviewers"].as_array())
+            .is_some_and(|arr| arr.iter().any(|r| r["login"].as_str() == Some(own_login)));
+    let kind = if is_review_request {
+        format!("review requested{num}{repo}")
+    } else {
+        kind
+    };
+
+    let mut out = format!("[{kind}] {title}\nurl: {html_url}");
+    out.push_str(meta_suffix);
+    Some(out)
+}
+
+#[allow(clippy::too_many_arguments)]
+async fn poll_once(
+    client: &reqwest::Client,
+    forge_url: &str,
+    token: &str,
+    socket: &Path,
+    is_manager: bool,
+    keep_subscriptions: bool,
+    unsubbed_repos: &mut HashSet<String>,
+    own_login: &str,
+    skip_reasons: &[String],
+) {
+    let url = format!("{forge_url}/api/v1/notifications?all=false&limit=50");
+    let resp = match client
+        .get(&url)
+        .header("Authorization", format!("token {token}"))
+        .send()
+        .await
+    {
+        Ok(r) => r,
+        Err(e) => {
+            debug!("forge_notify: poll request failed: {e}");
+            return;
+        }
+    };
+
+    if !resp.status().is_success() {
+        debug!("forge_notify: poll status {}", resp.status());
+        return;
+    }
+
+    let notifications: Vec<serde_json::Value> = match resp.json().await {
+        Ok(v) => v,
+        Err(e) => {
+            warn!("forge_notify: response parse error: {e}");
+            return;
+        }
+    };
+
+    if notifications.is_empty() {
+        return;
+    }
+
+    debug!(count = notifications.len(), "forge_notify: delivering notifications");
+
+    for notif in &notifications {
+        let Some(id) = notif["id"].as_u64() else { continue };
+
+        // Reason drop-list: suppress noisy reasons (subscribed/participating).
+        // null/unknown reasons pass through — directed signals are never
+        // silently dropped even if Forgejo returns an unexpected value.
+        if !skip_reasons.is_empty() {
+            let reason = notif["reason"].as_str().unwrap_or("");
+            if !reason.is_empty() && skip_reasons.iter().any(|r| r == reason) {
+                debug!(%id, %reason, "forge_notify: skipping (reason in drop-list)");
+                mark_read(client, forge_url, token, id).await;
+                continue;
+            }
+        }
+
+        let body_opt = format_notification(client, token, notif, own_login).await;
+
+        // None means self-echo — mark read silently, no delivery.
+        let Some(body) = body_opt else {
+            mark_read(client, forge_url, token, id).await;
+            continue;
+        };
+
+        let delivered = if is_manager {
+            let req = hive_sh4re::ManagerRequest::Wake {
+                from: "forge".to_owned(),
+                body,
+            };
+            crate::client::request::<_, hive_sh4re::ManagerResponse>(socket, &req)
+                .await
+                .map(|_| ())
+        } else {
+            let req = hive_sh4re::AgentRequest::Wake {
+                from: "forge".to_owned(),
+                body,
+            };
+            crate::client::request::<_, hive_sh4re::AgentResponse>(socket, &req)
+                .await
+                .map(|_| ())
+        };
+        match delivered {
+            Ok(()) => {
+                debug!(%id, "forge_notify: delivered");
+            }
+            Err(e) => {
+                warn!(%id, error = ?e, "forge_notify: deliver failed — leaving unread");
+                continue;
+            }
+        }
+
+        // Mark as read only after successful delivery so a failed-delivery
+        // notification resurfaces on the next poll tick.
+        mark_read(client, forge_url, token, id).await;
+
+        // Auto-unsubscribe from broad repo watches when the notification
+        // reason is "subscribed" (agent watching the whole repo). Skipped
+        // when HIVE_FORGE_KEEP_SUBSCRIPTIONS=1 — triage and other firehose
+        // consumers set this to retain broad repo visibility.
+        let reason = notif["reason"].as_str().unwrap_or("");
+        if !keep_subscriptions && reason == "subscribed"
+            && let Some(repo) = notif["repository"]["full_name"].as_str()
+                && !unsubbed_repos.contains(repo) {
+                    let unsub_url = format!("{forge_url}/api/v1/repos/{repo}/subscription");
+                    match client
+                        .delete(&unsub_url)
+                        .header("Authorization", format!("token {token}"))
+                        .send()
+                        .await
+                    {
+                        Ok(r) if r.status().is_success() || r.status().as_u16() == 404 => {
+                            debug!(%repo, "forge_notify: unsubscribed from repo watch");
+                            unsubbed_repos.insert(repo.to_owned());
+                        }
+                        Ok(r) => {
+                            debug!(%repo, status = %r.status(), "forge_notify: unsub non-2xx (ignored)");
+                        }
+                        Err(e) => {
+                            debug!(%repo, error = ?e, "forge_notify: unsub request failed (ignored)");
+                        }
+                    }
+                }
+    }
+}
+
+/// Mark a notification thread as read. Best-effort — logs on failure but
+/// does not abort the poll loop. A notification left unread will resurface
+/// on the next poll tick (desirable for delivery failures; for self-echo
+/// silencing we call this without prior delivery).
+async fn mark_read(client: &reqwest::Client, forge_url: &str, token: &str, id: u64) {
+    let mark_url = format!("{forge_url}/api/v1/notifications/threads/{id}");
+    match client
+        .patch(&mark_url)
+        .header("Authorization", format!("token {token}"))
+        .send()
+        .await
+    {
+        Err(e) => {
+            warn!(%id, error = ?e, "forge_notify: mark-read request failed — notification will resurface");
+        }
+        Ok(r) if !r.status().is_success() => {
+            warn!(%id, status = %r.status(), "forge_notify: mark-read returned non-2xx — notification will resurface");
+        }
+        Ok(_) => {
+            debug!(%id, "forge_notify: marked read");
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn escape_md_headings_escapes_top_level_atx() {
+        // The #455 repro: argus reviews start with `## argus review`,
+        // which would otherwise become an h2 in the wrapper message.
+        assert_eq!(
+            escape_md_headings("## argus review\n\nlgtm."),
+            "\\## argus review\n\nlgtm.",
+        );
+    }
+
+    #[test]
+    fn escape_md_headings_escapes_all_heading_depths() {
+        let body = "# h1\n## h2\n### h3\n###### h6\nbody";
+        assert_eq!(
+            escape_md_headings(body),
+            "\\# h1\n\\## h2\n\\### h3\n\\###### h6\nbody",
+        );
+    }
+
+    #[test]
+    fn escape_md_headings_preserves_indent() {
+        // Indented "headings" inside lists / nested quotes keep
+        // their leading whitespace so structure isn't visually
+        // collapsed by the escape.
+        assert_eq!(
+            escape_md_headings("  ## indented\nbody"),
+            "  \\## indented\nbody",
+        );
+    }
+
+    #[test]
+    fn escape_md_headings_passes_non_heading_lines_through() {
+        let body = "plain text\nwith a #hashtag in middle\n```\n# in fenced code\n```";
+        let escaped = escape_md_headings(body);
+        // Lines without leading `#` are untouched. The `# in fenced
+        // code` line still gets escaped (we don't track fenced-code
+        // state) — acceptable: inside a fenced block the escape is
+        // visually inert anyway because the renderer treats the
+        // content as literal.
+        assert!(escaped.contains("plain text"));
+        assert!(escaped.contains("with a #hashtag in middle"));
+        assert!(escaped.contains("\\# in fenced code"));
+    }
+
+    #[test]
+    fn escape_md_headings_handles_empty_and_whitespace_only() {
+        assert_eq!(escape_md_headings(""), "");
+        assert_eq!(escape_md_headings("   "), "   ");
+        assert_eq!(escape_md_headings("\n\n"), "\n\n");
+    }
+
+    #[test]
+    fn escape_md_headings_skips_non_atx_hash_lines() {
+        // ATX requires a space after the `#`s. Lines like `#tag`,
+        // `#123`, `#!/bin/bash` are NOT headings — argus's PR #518
+        // yellow nit: don't add cosmetic noise where the renderer
+        // wouldn't promote the line in the first place.
+        let body = "#tag\n#123\n#!/bin/bash\n####### too many hashes\nbody";
+        let escaped = escape_md_headings(body);
+        // All four leading `#` lines pass through untouched: too few
+        // (still need space), seven `#`s (over the cap), shebang
+        // (no space).
+        assert_eq!(escaped, body);
+    }
+
+    #[test]
+    fn escape_md_headings_handles_bare_hash_lines() {
+        // `#` alone on a line IS a valid ATX (h1 with empty text) per
+        // CommonMark; escape it to match the renderer's behaviour.
+        assert_eq!(escape_md_headings("#"), "\\#");
+        assert_eq!(escape_md_headings("##"), "\\##");
+        assert_eq!(escape_md_headings("###"), "\\###");
+    }
+
+    #[test]
+    fn escape_md_headings_preserves_trailing_newline() {
+        // `split_inclusive('\n')` round-trips a body ending in a
+        // newline. Important for embedded forge-notify bodies whose
+        // source already terminates with `\n` — the wrapper's spacing
+        // otherwise gets eaten.
+        assert_eq!(escape_md_headings("## h\n"), "\\## h\n");
+        assert_eq!(escape_md_headings("body\n"), "body\n");
+        assert_eq!(escape_md_headings("no trailing"), "no trailing");
+    }
+}
diff --git a/hive-ag3nt/src/lib.rs b/hive-ag3nt/src/lib.rs
new file mode 100644
index 00000000..3b2f7172
--- /dev/null
+++ b/hive-ag3nt/src/lib.rs
@@ -0,0 +1,22 @@
+//! Shared in-container harness code used by both `hive-ag3nt` (agent) and
+//! `hive-m1nd` (manager) binaries.
+
+pub mod client;
+pub mod events;
+pub mod forge_notify;
+pub mod login;
+pub mod login_session;
+pub mod mcp;
+pub mod paths;
+pub mod plugins;
+pub mod serve_common;
+pub mod stats;
+pub mod turn;
+pub mod turn_stats;
+pub mod web_ui;
+
+/// Default socket path inside the container — bind-mounted by `hive-c0re`.
+pub const DEFAULT_SOCKET: &str = "/run/hive/mcp.sock";
+
+/// Default web UI port — used when `HIVE_PORT` env is unset.
+pub const DEFAULT_WEB_PORT: u16 = 8042;
diff --git a/hive-ag3nt/src/login.rs b/hive-ag3nt/src/login.rs
new file mode 100644
index 00000000..68578dbb
--- /dev/null
+++ b/hive-ag3nt/src/login.rs
@@ -0,0 +1,56 @@
+//! Login-state probe for the bind-mounted `~/.claude/` dir. The dir is
+//! provided by hive-c0re and persists across container destroy/recreate so
+//! OAuth tokens survive.
+//!
+//! "Has session" today means "the dir contains at least one regular file."
+//! That's a heuristic: a fresh bind-mount starts empty, and `claude auth login`
+//! writes credentials into the dir. We may refine later (probe for the
+//! specific credentials filename, or run a no-op `claude` call) once the
+//! exact layout is locked in.
+
+use std::path::{Path, PathBuf};
+
+/// Returns the Claude credentials directory for this agent, derived from
+/// `HIVE_LABEL`. Manager ("hm1nd") uses `/root/.claude`; sub-agents use
+/// `/agents/{label}/claude`. Overridable via `HYPERHIVE_CLAUDE_DIR`.
+#[must_use]
+pub fn default_dir() -> PathBuf {
+    crate::paths::claude_dir()
+}
+
+/// Returns `true` if `dir` exists and contains any regular file. Used at
+/// startup to decide whether to enter the turn loop (logged in) or stay in
+/// the partial-run "needs login" state.
+#[must_use]
+pub fn has_session(dir: &Path) -> bool {
+    let Ok(entries) = std::fs::read_dir(dir) else {
+        return false;
+    };
+    for entry in entries.flatten() {
+        if entry.file_type().is_ok_and(|t| t.is_file()) {
+            return true;
+        }
+    }
+    false
+}
+
+/// Login state the harness reports to its web UI.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum LoginState {
+    /// `~/.claude/` has credentials; turn loop is running.
+    Online,
+    /// `~/.claude/` is empty; harness is up, web UI is bound, turn loop is NOT
+    /// running. Operator needs to complete login from the web UI.
+    NeedsLogin,
+}
+
+impl LoginState {
+    #[must_use]
+    pub fn from_dir(dir: &Path) -> Self {
+        if has_session(dir) {
+            Self::Online
+        } else {
+            Self::NeedsLogin
+        }
+    }
+}
diff --git a/hive-ag3nt/src/login_session.rs b/hive-ag3nt/src/login_session.rs
new file mode 100644
index 00000000..956375be
--- /dev/null
+++ b/hive-ag3nt/src/login_session.rs
@@ -0,0 +1,302 @@
+//! `claude auth login` driver. Spawns the login command under plain stdio pipes,
+//! accumulates stdout+stderr in a shared buffer (so the web UI can show
+//! whatever URL/prompt claude emits), and writes paste-back codes from the
+//! UI into the child's stdin.
+//!
+//! No PTY — we're betting `claude` produces a parseable URL on stdout and
+//! accepts a code on stdin even when not on a terminal. If it refuses or
+//! garbles, we'll redo this module backed by `portable-pty` (see PLAN.md
+//! Phase 8).
+
+use std::process::Stdio;
+use std::sync::{Arc, Mutex};
+
+use anyhow::{Context, Result};
+use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
+use tokio::process::{Child, ChildStdin, Command};
+
+const DEFAULT_CMD: &str = "claude";
+const DEFAULT_ARGS: &[&str] = &["auth", "login"];
+
+#[derive(Default)]
+struct State {
+    /// Concatenated stdout+stderr as it streams from the child.
+    output: String,
+    /// First URL-looking substring we saw in the output. Surface this on the
+    /// web UI as the link the operator should open.
+    url: Option<String>,
+    /// Set when the child has exited. The web UI uses this to know whether
+    /// the operator can still paste a code.
+    finished: bool,
+    /// Exit status note (e.g. "exited with code 0", "killed by signal 15"),
+    /// shown next to a "finished" badge once the child returns.
+    exit_note: Option<String>,
+}
+
+/// A running `claude auth login` subprocess.
+pub struct LoginSession {
+    child: Mutex<Child>,
+    /// Tokio mutex because we hold the guard across the `write_all().await`
+    /// in `submit_code`. The other locks are blocking-only and stay on
+    /// `std::sync::Mutex`.
+    stdin: tokio::sync::Mutex<Option<ChildStdin>>,
+    state: Arc<Mutex<State>>,
+}
+
+impl LoginSession {
+    /// Spawn the login command. The exact binary/args are configurable via
+    /// `HYPERHIVE_LOGIN_CMD` (single string, shell-split into argv); by
+    /// default we run `claude auth login`. Failing to spawn returns an error
+    /// before any state is registered.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if spawning the login command fails, or if the child's
+    /// stdio handles cannot be acquired.
+    pub fn start() -> Result<Self> {
+        let (cmd, args) = resolve_command();
+        tracing::info!(%cmd, ?args, "spawning login session");
+
+        let mut child = Command::new(&cmd)
+            .args(&args)
+            .stdin(Stdio::piped())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            // `claude` reads $HOME for the credentials dir; the bind-mount
+            // puts it at /root/.claude, which is already the default home
+            // for uid 0 inside the container. Nothing extra to set here.
+            .kill_on_drop(true)
+            .spawn()
+            .with_context(|| format!("spawn `{cmd}`"))?;
+
+        let stdin = child.stdin.take().context("child stdin")?;
+        let stdout = child.stdout.take().context("child stdout")?;
+        let stderr = child.stderr.take().context("child stderr")?;
+
+        let state = Arc::new(Mutex::new(State::default()));
+        tokio::spawn(pump(BufReader::new(stdout), state.clone(), "stdout"));
+        tokio::spawn(pump(BufReader::new(stderr), state.clone(), "stderr"));
+
+        Ok(Self {
+            child: Mutex::new(child),
+            stdin: tokio::sync::Mutex::new(Some(stdin)),
+            state,
+        })
+    }
+
+    /// Write `code` (plus a newline) to the child's stdin. Returns an error
+    /// if the stdin has already been closed (e.g. after the child exited or
+    /// after a prior submission consumed it).
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the login stdin is already closed, or if writing
+    /// to or flushing the stdin pipe fails.
+    pub async fn submit_code(&self, code: &str) -> Result<()> {
+        let mut guard = self.stdin.lock().await;
+        let stdin = guard.as_mut().context("login stdin already closed")?;
+        let line = format!("{}\n", code.trim());
+        stdin
+            .write_all(line.as_bytes())
+            .await
+            .context("write code to claude stdin")?;
+        stdin.flush().await.context("flush claude stdin")?;
+        Ok(())
+    }
+
+    /// Close stdin so claude sees EOF (useful if it's waiting for more input
+    /// after the code submit).
+    pub async fn close_stdin(&self) {
+        let _ = self.stdin.lock().await.take();
+    }
+
+    /// # Panics
+    ///
+    /// Panics if the internal lock is poisoned.
+    #[must_use]
+    pub fn output(&self) -> String {
+        self.state.lock().unwrap().output.clone()
+    }
+
+    /// # Panics
+    ///
+    /// Panics if the internal lock is poisoned.
+    #[must_use]
+    pub fn url(&self) -> Option<String> {
+        self.state.lock().unwrap().url.clone()
+    }
+
+    /// # Panics
+    ///
+    /// Panics if the internal lock is poisoned.
+    #[must_use]
+    pub fn finished(&self) -> bool {
+        self.state.lock().unwrap().finished
+    }
+
+    /// # Panics
+    ///
+    /// Panics if the internal lock is poisoned.
+    #[must_use]
+    pub fn exit_note(&self) -> Option<String> {
+        self.state.lock().unwrap().exit_note.clone()
+    }
+
+    /// Best-effort: poll the child once and update `finished`/`exit_note`.
+    /// Called by the web UI on each render so the state stays fresh without
+    /// running a dedicated reaper task.
+    ///
+    /// # Panics
+    ///
+    /// Panics if an internal lock is poisoned.
+    pub fn poll(&self) {
+        let mut child = self.child.lock().unwrap();
+        match child.try_wait() {
+            Ok(Some(status)) => {
+                let mut s = self.state.lock().unwrap();
+                s.finished = true;
+                s.exit_note = Some(format!("{status}"));
+            }
+            Ok(None) => {}
+            Err(e) => {
+                let mut s = self.state.lock().unwrap();
+                s.finished = true;
+                s.exit_note = Some(format!("try_wait error: {e}"));
+            }
+        }
+    }
+
+    /// Kill the child if it's still running. Idempotent.
+    ///
+    /// # Panics
+    ///
+    /// Panics if the internal lock is poisoned.
+    pub fn kill(&self) {
+        if let Err(e) = self.child.lock().unwrap().start_kill() {
+            tracing::warn!(error = ?e, "kill login child");
+        }
+    }
+}
+
+fn resolve_command() -> (String, Vec<String>) {
+    if let Ok(raw) = std::env::var("HYPERHIVE_LOGIN_CMD") {
+        // Whitespace-only split — no quote handling. Fine for "claude auth login"
+        // style overrides; if we need anything with embedded spaces we'll
+        // switch to shell-words.
+        let mut parts = raw.split_whitespace().map(str::to_owned);
+        if let Some(cmd) = parts.next() {
+            return (cmd, parts.collect());
+        }
+    }
+    (
+        DEFAULT_CMD.into(),
+        DEFAULT_ARGS.iter().map(|s| (*s).to_owned()).collect(),
+    )
+}
+
+async fn pump<R: tokio::io::AsyncRead + Unpin>(
+    mut reader: BufReader<R>,
+    state: Arc<Mutex<State>>,
+    tag: &'static str,
+) {
+    let mut buf = String::new();
+    loop {
+        buf.clear();
+        // read_line breaks on \n; for claude's TUI output that flushes by
+        // line this is fine. If it ever blasts a single un-newlined blob,
+        // we'll miss it until EOF (acceptable for the URL surface — claude
+        // prints the URL on its own line).
+        match reader.read_line(&mut buf).await {
+            Ok(0) => {
+                state.lock().unwrap().finished = true;
+                break;
+            }
+            Ok(_) => {
+                let mut s = state.lock().unwrap();
+                if s.url.is_none()
+                    && let Some(url) = extract_url(&buf)
+                {
+                    tracing::info!(%url, %tag, "login URL detected");
+                    s.url = Some(url);
+                }
+                s.output.push_str(&buf);
+            }
+            Err(e) => {
+                tracing::warn!(error = ?e, %tag, "login pump read error");
+                let mut s = state.lock().unwrap();
+                s.finished = true;
+                s.exit_note = Some(format!("pump {tag} error: {e}"));
+                break;
+            }
+        }
+    }
+}
+
+/// Return the first `https://…` substring on the line, terminating at any
+/// ASCII whitespace. Good enough for capturing claude's OAuth link without a
+/// regex dependency.
+fn extract_url(line: &str) -> Option<String> {
+    let start = line.find("https://")?;
+    let tail = &line[start..];
+    let end = tail
+        .find(|c: char| c.is_ascii_whitespace())
+        .unwrap_or(tail.len());
+    let url = tail[..end].trim_end_matches(['.', ',', ')', ']']);
+    if url.len() > "https://".len() {
+        Some(url.to_owned())
+    } else {
+        None
+    }
+}
+
+/// Helper used by the web UI to gate "is there a session running right now"
+/// without holding both this module's mutex and the `AppState`'s at once.
+///
+/// # Panics
+///
+/// Panics if the internal lock is poisoned.
+pub fn drop_if_finished(slot: &Mutex<Option<Arc<LoginSession>>>) {
+    let mut guard = slot.lock().unwrap();
+    if let Some(s) = guard.as_ref() {
+        s.poll();
+        if s.finished() {
+            *guard = None;
+        }
+    }
+}
+
+impl Drop for LoginSession {
+    fn drop(&mut self) {
+        // kill_on_drop on the Command also ensures the child dies, but we
+        // belt-and-brace it in case the runtime detaches.
+        let _ = self.child.lock().unwrap().start_kill();
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::extract_url;
+
+    #[test]
+    fn picks_first_https() {
+        let line = "  Go to https://claude.ai/oauth/abc?xyz=1 in your browser.\n";
+        assert_eq!(
+            extract_url(line).as_deref(),
+            Some("https://claude.ai/oauth/abc?xyz=1"),
+        );
+    }
+
+    #[test]
+    fn trailing_punctuation_stripped() {
+        let line = "Open https://example.com/abc).\n";
+        assert_eq!(
+            extract_url(line).as_deref(),
+            Some("https://example.com/abc"),
+        );
+    }
+
+    #[test]
+    fn no_url() {
+        assert_eq!(extract_url("nothing here\n"), None);
+    }
+}
diff --git a/hive-ag3nt/src/mcp.rs b/hive-ag3nt/src/mcp.rs
new file mode 100644
index 00000000..4cbafcde
--- /dev/null
+++ b/hive-ag3nt/src/mcp.rs
@@ -0,0 +1,1977 @@
+//! Embedded MCP server. Claude Code (running inside the agent container)
+//! launches this as a stdio child via `--mcp-config`; tool calls land here
+//! and are translated to `AgentRequest::*` / `ManagerRequest::*` against
+//! hyperhive's own per-container unix socket at `/run/hive/mcp.sock`.
+//!
+//! Two protocols, two surfaces:
+//! - **hyperhive socket** at `/run/hive/mcp.sock` — JSON-line, our
+//!   broker-routed protocol. Unaffected by this module.
+//! - **MCP stdio** owned by this module — what claude actually speaks.
+//!
+//! Two server flavors:
+//! - `AgentServer` — sub-agent tools (`send`, `recv`).
+//! - `ManagerServer` — agent tools + lifecycle (`kill`,
+//!   `request_init_config`, `request_apply_commit`).
+//!
+//! Both go through the same `run_tool_envelope` helper so logging + status
+//! line stay uniform.
+
+use std::future::Future;
+use std::path::PathBuf;
+
+use anyhow::Result;
+use rmcp::{
+    ServerHandler, ServiceExt, handler::server::wrapper::Parameters, schemars, tool, tool_handler,
+    tool_router, transport::stdio,
+};
+
+use crate::client;
+
+/// Wire-protocol-agnostic view of a hyperhive socket response. Both
+/// `AgentResponse` and `ManagerResponse` convert into this so the tool
+/// formatters can be shared between `AgentServer` and `ManagerServer`.
+#[derive(Debug)]
+pub enum SocketReply {
+    Ok,
+    Err(String),
+    /// Unified `recv` result: zero or more messages popped in one
+    /// round-trip. Empty vec = "(empty)" path; single-message = the
+    /// standard wake body; multi = batch render with per-message
+    /// separators. Per-row `id` is opaque to claude (the bin loops
+    /// drive ack via `AckTurn`, not per-id); `redelivered` triggers
+    /// the "may already be handled" banner in `format_recv` for that
+    /// specific row.
+    Messages(Vec<hive_sh4re::DeliveredMessage>),
+    Status(u64),
+    QuestionQueued(i64),
+    Recent(Vec<hive_sh4re::InboxRow>),
+    Logs(String),
+    /// `list_schedules` result — used by the manager surface only;
+    /// AgentResponse has no equivalent variant.
+    Schedules(Vec<hive_sh4re::WireSchedule>),
+    LooseEnds(Vec<hive_sh4re::LooseEnd>),
+    PendingRemindersCount(u64),
+    ReminderRollup(hive_sh4re::ReminderStats),
+    AgentMeta {
+        name: String,
+        role: String,
+        running: bool,
+        hyperhive_rev: Option<String>,
+        status_text: Option<String>,
+        status_set_at: Option<i64>,
+    },
+}
+
+impl From<hive_sh4re::AgentResponse> for SocketReply {
+    fn from(r: hive_sh4re::AgentResponse) -> Self {
+        match r {
+            hive_sh4re::AgentResponse::Ok => Self::Ok,
+            hive_sh4re::AgentResponse::Err { message } => Self::Err(message),
+            hive_sh4re::AgentResponse::Messages { messages } => Self::Messages(messages),
+            hive_sh4re::AgentResponse::Status { unread } => Self::Status(unread),
+            hive_sh4re::AgentResponse::Recent { rows } => Self::Recent(rows),
+            hive_sh4re::AgentResponse::QuestionQueued { id } => Self::QuestionQueued(id),
+            hive_sh4re::AgentResponse::LooseEnds { loose_ends } => Self::LooseEnds(loose_ends),
+            hive_sh4re::AgentResponse::PendingRemindersCount { count } => {
+                Self::PendingRemindersCount(count)
+            }
+            hive_sh4re::AgentResponse::ReminderRollup(stats) => Self::ReminderRollup(stats),
+            hive_sh4re::AgentResponse::AgentMeta {
+                name,
+                role,
+                running,
+                hyperhive_rev,
+                status_text,
+                status_set_at,
+            } => Self::AgentMeta {
+                name,
+                role,
+                running,
+                hyperhive_rev,
+                status_text,
+                status_set_at,
+            },
+        }
+    }
+}
+
+impl From<hive_sh4re::ManagerResponse> for SocketReply {
+    fn from(r: hive_sh4re::ManagerResponse) -> Self {
+        match r {
+            hive_sh4re::ManagerResponse::Ok => Self::Ok,
+            hive_sh4re::ManagerResponse::Err { message } => Self::Err(message),
+            hive_sh4re::ManagerResponse::Messages { messages } => Self::Messages(messages),
+            hive_sh4re::ManagerResponse::Status { unread } => Self::Status(unread),
+            hive_sh4re::ManagerResponse::QuestionQueued { id } => Self::QuestionQueued(id),
+            hive_sh4re::ManagerResponse::Recent { rows } => Self::Recent(rows),
+            hive_sh4re::ManagerResponse::Logs { content } => Self::Logs(content),
+            hive_sh4re::ManagerResponse::Schedules { schedules } => Self::Schedules(schedules),
+            hive_sh4re::ManagerResponse::LooseEnds { loose_ends } => Self::LooseEnds(loose_ends),
+            hive_sh4re::ManagerResponse::PendingRemindersCount { count } => {
+                Self::PendingRemindersCount(count)
+            }
+            hive_sh4re::ManagerResponse::ReminderRollup(stats) => Self::ReminderRollup(stats),
+            hive_sh4re::ManagerResponse::AgentMeta {
+                name,
+                role,
+                running,
+                hyperhive_rev,
+                status_text,
+                status_set_at,
+            } => Self::AgentMeta {
+                name,
+                role,
+                running,
+                hyperhive_rev,
+                status_text,
+                status_set_at,
+            },
+        }
+    }
+}
+
+/// Format helper for "send-like" tools (anything that expects an `Ok`).
+/// `tool` and `ok_msg` only appear in the result string; they don't change
+/// behavior.
+#[must_use]
+pub fn format_ack(resp: Result<SocketReply, anyhow::Error>, tool: &str, ok_msg: String) -> String {
+    match resp {
+        Ok(SocketReply::Ok) => ok_msg,
+        Ok(SocketReply::Err(m)) => format!("{tool} failed: {m}"),
+        Ok(other) => format!("{tool} unexpected response: {other:?}"),
+        Err(e) => format!("{tool} transport error: {e:#}"),
+    }
+}
+
+/// Format helper for `recv`: renders zero, one, or many popped
+/// messages. Empty list collapses to "(empty)" so claude doesn't go
+/// hunting for content. A single message renders as the historical
+/// `from: X\n\nbody` block (banner first if `redelivered`). A
+/// multi-message batch renders with a `popped N message(s):` header
+/// and `---` separators between bodies so the model can tell where
+/// one ends and the next begins; per-message redelivery banners
+/// included.
+#[must_use]
+pub fn format_recv(resp: Result<SocketReply, anyhow::Error>) -> String {
+    use std::fmt::Write as _;
+    let messages = match resp {
+        Ok(SocketReply::Messages(m)) => m,
+        Ok(SocketReply::Err(m)) => return format!("recv failed: {m}"),
+        Ok(other) => return format!("recv unexpected response: {other:?}"),
+        Err(e) => return format!("recv transport error: {e:#}"),
+    };
+    if messages.is_empty() {
+        return "(empty)".to_owned();
+    }
+    if messages.len() == 1 {
+        let m = &messages[0];
+        let banner = if m.redelivered { REDELIVERY_HINT } else { "" };
+        return format!("{banner}from: {}\n\n{}", m.from, m.body);
+    }
+    let n = messages.len();
+    let mut out = format!("popped {n} message(s):\n\n");
+    for (i, m) in messages.iter().enumerate() {
+        if i > 0 {
+            out.push_str("\n---\n\n");
+        }
+        let banner = if m.redelivered { REDELIVERY_HINT } else { "" };
+        let _ = write!(out, "{banner}from: {}\n\n{}", m.from, m.body);
+    }
+    out
+}
+
+/// Header prepended to message bodies that were popped by a prior
+/// harness session, never acked (turn crash / OOM / restart), and
+/// resurfaced by `RequeueInflight` on this session's boot. Same
+/// string surfaces in the wake prompt (see the bin loops) and the
+/// in-turn `recv` tool result so claude sees the warning either way.
+pub const REDELIVERY_HINT: &str =
+    "[redelivered after harness restart — may already be handled]\n";
+
+/// Format helper for `get_loose_ends`: renders a short bulleted list
+/// of pending approvals + questions + reminders. Empty list collapses
+/// to a clear marker so claude doesn't go hunting for a payload that
+/// isn't there.
+#[must_use]
+pub fn format_loose_ends(resp: Result<SocketReply, anyhow::Error>) -> String {
+    use std::fmt::Write as _;
+    let loose_ends = match resp {
+        Ok(SocketReply::LooseEnds(t)) => t,
+        Ok(SocketReply::Err(m)) => return format!("get_loose_ends failed: {m}"),
+        Ok(other) => return format!("get_loose_ends unexpected response: {other:?}"),
+        Err(e) => return format!("get_loose_ends transport error: {e:#}"),
+    };
+    if loose_ends.is_empty() {
+        return "(no loose ends)".to_owned();
+    }
+    let mut out = format!("{} loose end(s):\n", loose_ends.len());
+    for t in &loose_ends {
+        match t {
+            hive_sh4re::LooseEnd::Approval {
+                id,
+                agent,
+                commit_ref,
+                description,
+                age_seconds,
+            } => {
+                let desc = description
+                    .as_deref()
+                    .map(|d| format!(" — {d}"))
+                    .unwrap_or_default();
+                let _ = writeln!(
+                    out,
+                    "- approval #{id} ({agent} @ {commit_ref}, {age_seconds}s old){desc}"
+                );
+            }
+            hive_sh4re::LooseEnd::Question {
+                id,
+                asker,
+                target,
+                question,
+                age_seconds,
+            } => {
+                let to = target.as_deref().unwrap_or("operator");
+                let _ = writeln!(
+                    out,
+                    "- question #{id} ({asker} → {to}, {age_seconds}s old): {question}"
+                );
+            }
+            hive_sh4re::LooseEnd::Reminder {
+                id,
+                owner,
+                message,
+                due_at,
+                age_seconds,
+            } => {
+                let _ = writeln!(
+                    out,
+                    "- reminder #{id} ({owner}, scheduled {age_seconds}s ago, due_at={due_at}): {message}"
+                );
+            }
+        }
+    }
+    out
+}
+
+/// Parse the user-facing `kind` string for `cancel_loose_end` into the
+/// wire enum. Accepts a small alias set so claude doesn't have to
+/// remember the exact spelling (`"q"` / `"r"` shorthand falls out
+/// for free).
+fn parse_loose_end_kind(raw: &str) -> Result<hive_sh4re::CancelLooseEndKind, String> {
+    match raw.trim().to_ascii_lowercase().as_str() {
+        "question" | "q" => Ok(hive_sh4re::CancelLooseEndKind::Question),
+        "reminder" | "r" => Ok(hive_sh4re::CancelLooseEndKind::Reminder),
+        "approval" | "a" => Ok(hive_sh4re::CancelLooseEndKind::Approval),
+        other => Err(format!(
+            "cancel_loose_end: unknown kind '{other}' \
+             (expected \"question\", \"reminder\", or \"approval\")"
+        )),
+    }
+}
+
+/// Canonical user-facing label for a `CancelLooseEndKind` — used in
+/// the success ack so the caller always sees `"question"` /
+/// `"reminder"` instead of whatever alias they passed in (`"q"` /
+/// `"r"`).
+fn loose_end_kind_label(kind: hive_sh4re::CancelLooseEndKind) -> &'static str {
+    match kind {
+        hive_sh4re::CancelLooseEndKind::Question => "question",
+        hive_sh4re::CancelLooseEndKind::Reminder => "reminder",
+        hive_sh4re::CancelLooseEndKind::Approval => "approval",
+    }
+}
+
+/// Format helper for `get_agent_meta`: renders an agent's identity +
+/// current status as a short human-readable block. `name`, `role`,
+/// `hyperhive_rev`, and `running` are always shown; `status` only
+/// appears when one is set, otherwise the line reads `status: <none>`.
+/// When `running` is false the host has already cleared `status_text`
+/// (it would be stale from before the stop, #432) so the status line
+/// is implicitly `<none>` in that case — but the explicit `running:
+/// no` line tells the caller WHY.
+#[must_use]
+pub fn format_agent_meta(resp: Result<SocketReply, anyhow::Error>) -> String {
+    match resp {
+        Ok(SocketReply::AgentMeta {
+            name,
+            role,
+            running,
+            hyperhive_rev,
+            status_text,
+            status_set_at,
+        }) => {
+            let rev = hyperhive_rev.as_deref().unwrap_or("<unknown>");
+            let run = if running { "yes" } else { "no" };
+            let mut out =
+                format!("name: {name}\nrole: {role}\nhyperhive_rev: {rev}\nrunning: {run}");
+            match status_text {
+                None => out.push_str("\nstatus: <none>"),
+                Some(s) => {
+                    let age = status_set_at.and_then(|ts| {
+                        let now = std::time::SystemTime::now()
+                            .duration_since(std::time::UNIX_EPOCH)
+                            .ok()?
+                            .as_secs();
+                        let secs = now.saturating_sub(ts as u64);
+                        Some(format_age_secs(secs))
+                    });
+                    match age {
+                        Some(a) => out.push_str(&format!("\nstatus: {s} (set {a} ago)")),
+                        None => out.push_str(&format!("\nstatus: {s}")),
+                    }
+                }
+            }
+            out
+        }
+        Ok(SocketReply::Err(m)) => format!("get_agent_meta failed: {m}"),
+        Ok(other) => format!("get_agent_meta unexpected response: {other:?}"),
+        Err(e) => format!("get_agent_meta transport error: {e:#}"),
+    }
+}
+
+/// Format a duration in seconds as a human-readable age string.
+fn format_age_secs(secs: u64) -> String {
+    if secs < 60 {
+        format!("{secs}s")
+    } else if secs < 3600 {
+        format!("{}m", secs / 60)
+    } else if secs < 86400 {
+        format!("{}h", secs / 3600)
+    } else {
+        format!("{}d", secs / 86400)
+    }
+}
+
+/// Common envelope around every MCP tool handler: pre-log → run →
+/// post-log. The inbox-status hint used to be appended to every tool
+/// result; that lives in the wake prompt + UI header now, so tool
+/// results stay clean.
+pub async fn run_tool_envelope<F>(tool: &'static str, args: String, body: F) -> String
+where
+    F: Future<Output = String>,
+{
+    tracing::info!(tool, %args, "tool: request");
+    let result = body.await;
+    tracing::info!(tool, result = %result, "tool: result");
+    result
+}
+
+/// Append a short note to a tool result when the underlying socket call
+/// took retries to land. Lets claude distinguish "my request was wrong"
+/// from "c0re flickered and the harness rode it out" — without the
+/// hint, a tool result that took 30s to come back looks identical to a
+/// content failure and the model would burn a turn retrying it.
+#[must_use]
+pub fn annotate_retries(mut s: String, retries: u32) -> String {
+    if retries > 0 {
+        use std::fmt::Write as _;
+        let suffix = if retries == 1 { "retry" } else { "retries" };
+        let _ = write!(
+            s,
+            "\n\n(note: hive socket connect needed {retries} {suffix} — c0re likely \
+             restarted. Your request did succeed on the final attempt; no action needed.)"
+        );
+    }
+    s
+}
+
+#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
+pub struct SendArgs {
+    /// Logical agent name to deliver the message to (e.g. `"manager"`,
+    /// `"alice"`, or the literal `"operator"` for the dashboard's T4LK box).
+    pub to: String,
+    /// Message body. Plain text; the broker doesn't parse it.
+    pub body: String,
+    /// Optional broker row-id of the message this is a reply to. Lets
+    /// the dashboard render conversation threads. Pass the `id` from the
+    /// `DeliveredMessage` you're responding to; omit for new threads.
+    /// Silently ignored if the id is unknown or out of retention.
+    #[serde(default)]
+    pub in_reply_to: Option<i64>,
+}
+
+#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
+pub struct RecvArgs {
+    /// How long to long-poll for the FIRST message before returning
+    /// the empty marker. Capped at 60s server-side. Default (None)
+    /// is 30s. Useful when an agent wants to park its turn waiting
+    /// for any new work — pick a longer wait to coalesce bursts.
+    #[serde(default)]
+    pub wait_seconds: Option<u64>,
+    /// Maximum number of messages to pop in this round-trip. Default
+    /// (None) is 1 (single-message behaviour — exactly what you want
+    /// when you're called to drive a turn off the first wake). Pass
+    /// a higher value (capped at 32 server-side) when you've been
+    /// told the inbox has more queued (the wake prompt mentions
+    /// pending count) and want to drain everything in one tool call.
+    /// Once the long-poll wakes up, the call drains up to `max` in
+    /// total before returning — no extra round-trip needed.
+    #[serde(default)]
+    pub max: Option<u32>,
+}
+
+/// MCP tool args for `remind`. Exactly one of `delay_seconds` or
+/// `at_unix_timestamp` must be set; both / neither is a tool-side error.
+/// Hides the tagged `ReminderTiming` enum behind a flatter schema so the
+/// model picks one field instead of building `{"timing_type": "in_seconds",
+/// "seconds": 60}` shaped objects.
+#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
+pub struct RemindArgs {
+    /// Body that lands in your inbox when the reminder fires (sender
+    /// will appear as `reminder`). Soft cap at 4 KiB inline — anything
+    /// larger gets auto-persisted to a file under
+    /// `/agents/<you>/state/reminders/auto-<ts>.md` and the inbox
+    /// message becomes a short pointer. Pass `file_path` if you want
+    /// to control the destination yourself.
+    pub message: String,
+    /// Fire `delay_seconds` from now (relative). Set this OR
+    /// `at_unix_timestamp`, not both.
+    #[serde(default)]
+    pub delay_seconds: Option<u64>,
+    /// Fire at this absolute unix timestamp (seconds since epoch). Set
+    /// this OR `delay_seconds`, not both.
+    #[serde(default)]
+    pub at_unix_timestamp: Option<i64>,
+    /// Optional path to a file the scheduler should reference instead of
+    /// inlining a long `message`. Use this for large payloads (research
+    /// notes, file lists, intermediate state). Path must be reachable from
+    /// the agent's container — typically under `/agents/<you>/state/`.
+    #[serde(default)]
+    pub file_path: Option<String>,
+}
+
+/// Per-agent tool surface. Holds the socket path so each tool call doesn't
+/// re-derive it; the socket itself is the per-container `/run/hive/mcp.sock`.
+#[derive(Debug, Clone)]
+pub struct AgentServer {
+    socket: PathBuf,
+}
+
+impl AgentServer {
+    #[must_use]
+    pub fn new(socket: PathBuf) -> Self {
+        Self { socket }
+    }
+
+    /// Issue any `AgentRequest` through the retry-aware client and pull
+    /// the reply through `SocketReply`. Returns the retry count so tool
+    /// handlers can annotate their result (see `annotate_retries`).
+    async fn dispatch(
+        &self,
+        req: hive_sh4re::AgentRequest,
+    ) -> (Result<SocketReply, anyhow::Error>, u32) {
+        match client::request_retried::<_, hive_sh4re::AgentResponse>(&self.socket, &req).await {
+            Ok((r, n)) => (Ok(SocketReply::from(r)), n),
+            Err(e) => (Err(e), 0),
+        }
+    }
+}
+
+// IMPORTANT: when adding a new `#[tool]` fn to this impl, also add
+// its name to `allowed_mcp_tools(Flavor::Agent)` below. Claude
+// Code's permission gate refuses uninlisted MCP tools in
+// non-interactive `--print` mode with "permissions not granted yet"
+// — same failure mode #511 cleaned up on the manager side. Keep the
+// two lists in lockstep.
+#[tool_router]
+impl AgentServer {
+    #[tool(
+        description = "Send a message to another hyperhive agent (or to the operator). \
+            Use this to talk to peers or to surface output for the human at the dashboard."
+    )]
+    async fn send(&self, Parameters(args): Parameters<SendArgs>) -> String {
+        let log = format!("{args:?}");
+        let to = args.to.clone();
+        if let Err(refusal) = check_send_allowed(&to) {
+            return run_tool_envelope("send", log, async move { refusal }).await;
+        }
+        run_tool_envelope("send", log, async move {
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::AgentRequest::Send {
+                    to: args.to,
+                    body: args.body,
+                    in_reply_to: args.in_reply_to,
+                })
+                .await;
+            annotate_retries(format_ack(resp, "send", format!("sent to {to}")), retries)
+        })
+        .await
+    }
+
+    #[tool(
+        description = "Surface a structured question to either the operator OR a peer agent. \
+        Returns immediately with a question id — do NOT wait inline. When the recipient \
+        answers, a system message with event `question_answered { id, question, answer, \
+        answerer }` lands in your inbox; handle it on a future turn. \n\n\
+        Recipient: omit `to` (or set `to: \"operator\"`) for the human operator on the \
+        dashboard. Set `to: \"<agent-name>\"` to ask a peer agent — they receive a \
+        `question_asked { id, asker, question, options, multi }` event in their inbox \
+        and answer via `mcp__hyperhive__answer`. \n\n\
+        `options` is advisory: pass a short fixed-choice list when applicable, otherwise \
+        leave empty for free text. Set `multi: true` to let the answerer pick multiple \
+        options (checkboxes on the dashboard, hint to the agent otherwise) — answer comes \
+        back as a comma-separated string. Set `ttl_seconds` to auto-cancel a \
+        no-longer-relevant question — on expiry the answer is `[expired]` (with \
+        `answerer: \"ttl-watchdog\"`) and the same `question_answered` event fires."
+    )]
+    async fn ask(&self, Parameters(args): Parameters<AskArgs>) -> String {
+        let log = format!("{args:?}");
+        run_tool_envelope("ask", log, async move {
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::AgentRequest::Ask {
+                    question: args.question,
+                    options: args.options,
+                    multi: args.multi,
+                    ttl_seconds: args.ttl_seconds,
+                    to: args.to,
+                })
+                .await;
+            let s = match resp {
+                Ok(SocketReply::QuestionQueued(id)) => format!(
+                    "question queued (id={id}); answer will arrive as a system \
+                     `question_answered` event in your inbox"
+                ),
+                Ok(SocketReply::Err(m)) => format!("ask failed: {m}"),
+                Ok(other) => format!("ask unexpected response: {other:?}"),
+                Err(e) => format!("ask transport error: {e:#}"),
+            };
+            annotate_retries(s, retries)
+        })
+        .await
+    }
+
+    #[tool(
+        description = "Answer a question that was routed to YOU via a `question_asked` system \
+        event in your inbox. Pass the `id` from that event and your `answer` string. The \
+        answer will surface in the asker's inbox as a `question_answered { id, question, \
+        answer, answerer: <your-name> }` event. \n\n\
+        Authorisation is strict — you can only answer questions where you are the declared \
+        target (i.e. the asker did `ask(to: \"<your-name>\", ...)`). Trying to answer an \
+        operator-targeted question or a question addressed to a different agent will fail."
+    )]
+    async fn answer(&self, Parameters(args): Parameters<AnswerArgs>) -> String {
+        let log = format!("{args:?}");
+        let id = args.id;
+        run_tool_envelope("answer", log, async move {
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::AgentRequest::Answer {
+                    id,
+                    answer: args.answer,
+                })
+                .await;
+            annotate_retries(
+                format_ack(resp, "answer", format!("answered question {id}")),
+                retries,
+            )
+        })
+        .await
+    }
+
+    #[tool(
+        description = "Pop messages from this agent's inbox. Returns one or more messages, or \
+            an empty marker if nothing is waiting. \n\n\
+            **Single-message default**: with no args (or `max: 1`) you get the next message — \
+            same behaviour the harness uses to drive a turn. Without `wait_seconds` (or with 0) \
+            the call returns immediately — a cheap 'anything pending?' peek. Pass a positive \
+            `wait_seconds` (capped at 180) to park the turn waiting for new work — incoming \
+            messages wake you instantly, otherwise the call returns empty at the timeout. \
+            That's strictly better than a fixed shell `sleep`. \n\n\
+            **Batch drain**: pass `max: N` (capped at 32) to drain up to N messages in one \
+            round-trip. Use this when the wake prompt told you the inbox has more queued, or \
+            any time you expect a burst — one tool call beats N consecutive single recvs. \
+            `wait_seconds` still applies to the FIRST message; once one arrives the call drains \
+            up to `max` in total. Empty result reported the same way regardless of `max`. \n\n\
+            Typical pattern: when you have nothing else useful to do, call \
+            `recv(wait_seconds: 180)` to park until something arrives."
+    )]
+    async fn recv(&self, Parameters(args): Parameters<RecvArgs>) -> String {
+        let log = format!("{args:?}");
+        run_tool_envelope("recv", log, async move {
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::AgentRequest::Recv {
+                    wait_seconds: args.wait_seconds,
+                    max: args.max,
+                })
+                .await;
+            annotate_retries(format_recv(resp), retries)
+        })
+        .await
+    }
+
+    #[tool(
+        description = "List loose ends pending against this agent: unanswered questions \
+        where you are the asker (waiting on someone) or the target (someone's waiting on \
+        you), pending reminders you scheduled, plus — for the manager only — pending \
+        approvals you submitted that the operator hasn't acted on yet. Cheap server-side \
+        sweep, no args. Useful at turn start to remember what you owe / what's owed to \
+        you without scrolling inbox history. Output is a short bulleted list with ids, \
+        ages in seconds, and the relevant context. Each `question` or `reminder` row \
+        can be cancelled by passing its id + kind to `cancel_loose_end`. Empty result \
+        is reported clearly."
+    )]
+    async fn get_loose_ends(&self) -> String {
+        run_tool_envelope("get_loose_ends", String::new(), async move {
+            let (resp, retries) = self.dispatch(hive_sh4re::AgentRequest::GetLooseEnds).await;
+            annotate_retries(format_loose_ends(resp), retries)
+        })
+        .await
+    }
+
+    #[tool(
+        description = "Set a free-text status string visible on the operator dashboard. \
+        Call this at the START of every task to describe what you're working on (e.g. \
+        `\"processing matrix messages\"`, `\"fixing bitburner crash\"`, `\"idle\"`). Pass an empty \
+        string to clear. The status is shown on your dashboard card and persists across \
+        harness restarts."
+    )]
+    async fn set_status(&self, Parameters(args): Parameters<SetStatusArgs>) -> String {
+        run_tool_envelope("set_status", args.text.clone(), async move {
+            let (resp, retries) =
+                self.dispatch(hive_sh4re::AgentRequest::SetStatus { text: args.text }).await;
+            annotate_retries(format_ack(resp, "set_status", "status updated".to_owned()), retries)
+        })
+        .await
+    }
+
+    #[tool(
+        description = "Fetch identity + status metadata for an agent. Returns canonical \
+        `name`, `role` (`agent` / `manager`), the current `hyperhive_rev` hive-c0re is \
+        running against, and the target's self-reported `status` text (set via \
+        `set_status`) plus how long ago it was set. Pass `name` to query a peer (e.g. \
+        check whether iris is idle before pinging them); omit `name` to get your own \
+        identity stamp — handy for state files / commit messages / cross-agent \
+        attribution that won't drift across renames or session-continue boundaries \
+        where the system-prompt label could be stale. Status reads `<none>` when the \
+        target has never called `set_status` or has cleared it."
+    )]
+    async fn get_agent_meta(
+        &self,
+        Parameters(args): Parameters<GetAgentMetaArgs>,
+    ) -> String {
+        let log = args.name.clone().unwrap_or_else(|| "<self>".to_owned());
+        run_tool_envelope("get_agent_meta", log, async move {
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::AgentRequest::GetAgentMeta { name: args.name })
+                .await;
+            annotate_retries(format_agent_meta(resp), retries)
+        })
+        .await
+    }
+
+    #[tool(
+        description = "Cancel an open thread you own — a `question` you asked (the \
+        asker gets `[cancelled by <you>]` as the answer and unblocks) or a `reminder` \
+        you scheduled (hard-deleted before it fires). `kind` is `\"question\"` or \
+        `\"reminder\"`; `id` is the row id from the matching `get_loose_ends` entry \
+        or the `question_queued` reply you got when you submitted. Auth: you can only \
+        cancel rows where you're the asker / owner. Returns `ok` or an error string."
+    )]
+    async fn cancel_loose_end(&self, Parameters(args): Parameters<CancelLooseEndArgs>) -> String {
+        let log = format!("{args:?}");
+        let id = args.id;
+        run_tool_envelope("cancel_loose_end", log, async move {
+            let kind = match parse_loose_end_kind(&args.kind) {
+                Ok(k) => k,
+                Err(e) => return e,
+            };
+            let kind_label = loose_end_kind_label(kind);
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::AgentRequest::CancelLooseEnd { kind, id })
+                .await;
+            annotate_retries(
+                format_ack(resp, "cancel_loose_end", format!("cancelled {kind_label} {id}")),
+                retries,
+            )
+        })
+        .await
+    }
+
+    #[tool(
+        description = "Schedule a reminder that lands in this agent's own inbox at a future \
+        time (sender will appear as `reminder`). Use for self-paced follow-ups: 'check task \
+        status in 60s', 'retry failed deploy at 14:00 UTC', 'nudge me when the operator's \
+        deploy window opens'. Set EXACTLY ONE of `delay_seconds` (fire N seconds from now) \
+        or `at_unix_timestamp` (fire at absolute epoch second). Body soft-caps at 4 KiB \
+        inline — anything larger gets auto-persisted to a file under your \
+        `/agents/<you>/state/reminders/` dir and the inbox message becomes a short pointer; \
+        pass `file_path` if you want to control the destination yourself. Returns \
+        immediately — the reminder lives in the broker until due."
+    )]
+    async fn remind(&self, Parameters(args): Parameters<RemindArgs>) -> String {
+        let log = format!("{args:?}");
+        run_tool_envelope("remind", log, async move {
+            let timing = match (args.delay_seconds, args.at_unix_timestamp) {
+                (Some(_), Some(_)) => {
+                    return "remind failed: pass exactly one of `delay_seconds` or \
+                            `at_unix_timestamp`, not both"
+                        .to_string();
+                }
+                (None, None) => {
+                    return "remind failed: pass exactly one of `delay_seconds` or \
+                            `at_unix_timestamp`"
+                        .to_string();
+                }
+                (Some(s), None) => hive_sh4re::ReminderTiming::InSeconds { seconds: s },
+                (None, Some(t)) => hive_sh4re::ReminderTiming::At { unix_timestamp: t },
+            };
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::AgentRequest::Remind {
+                    message: args.message,
+                    timing,
+                    file_path: args.file_path,
+                })
+                .await;
+            annotate_retries(format_ack(resp, "remind", "reminder scheduled".to_string()), retries)
+        })
+        .await
+    }
+
+    #[tool(
+        description = "Ask the harness to start another turn immediately after this one \
+            completes, even if the inbox is empty. Use this when you have ongoing work that \
+            spans multiple turns (long builds, multi-step tasks) and you want to continue \
+            without waiting for an external message. The next turn will start with \
+            `from: \"self\"` and `body: \"continue\"`. Has no effect if a new inbox message \
+            arrives before this turn ends — the harness already loops immediately on pending \
+            messages. No args."
+    )]
+    async fn request_next_turn(&self) -> String {
+        run_tool_envelope("request_next_turn", String::new(), async move {
+            let sentinel = crate::paths::state_dir().join("hyperhive-continue");
+            match std::fs::write(&sentinel, b"") {
+                Ok(()) => "ok — harness will start another turn immediately after this one",
+                Err(e) => {
+                    tracing::warn!(error = %e, path = %sentinel.display(), "request_next_turn: write failed");
+                    return format!("request_next_turn failed: {e}");
+                }
+            }
+            .to_string()
+        })
+        .await
+    }
+}
+
+#[tool_handler(
+    instructions = "You are a hyperhive agent. Use `send` to talk to peers (by their logical \
+        name) or to the operator (recipient `operator`). Use `recv` to drain your inbox one \
+        message at a time. Use `remind` to schedule a future wake-up message for yourself."
+)]
+impl ServerHandler for AgentServer {}
+
+/// Run the agent MCP server over stdio. Returns when the client disconnects.
+///
+/// # Errors
+///
+/// Returns an error if the MCP server fails to initialize or the transport
+/// encounters a fatal error.
+pub async fn serve_agent_stdio(socket: PathBuf) -> Result<()> {
+    let server = AgentServer::new(socket);
+    let service = server.serve(stdio()).await?;
+    service.waiting().await?;
+    Ok(())
+}
+
+/// Run the manager MCP server over stdio. Same idea, different tool surface.
+///
+/// # Errors
+///
+/// Returns an error if the MCP server fails to initialize or the transport
+/// encounters a fatal error.
+pub async fn serve_manager_stdio(socket: PathBuf) -> Result<()> {
+    let server = ManagerServer::new(socket);
+    let service = server.serve(stdio()).await?;
+    service.waiting().await?;
+    Ok(())
+}
+
+// -----------------------------------------------------------------------------
+// Manager tool surface
+// -----------------------------------------------------------------------------
+
+#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
+pub struct RequestInitConfigArgs {
+    /// New sub-agent name (≤9 chars). Queues an `InitConfig` approval; on
+    /// approval hive-c0re seeds the proposed config repo at
+    /// `/agents/<name>/config/agent.nix` with the default template. After
+    /// the approval the manager edits + commits the config and calls
+    /// `request_apply_commit` to pin the customised sha for the container's
+    /// first build.
+    pub name: String,
+    /// Optional description shown on the dashboard approval card.
+    #[serde(default)]
+    pub description: Option<String>,
+}
+
+#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
+pub struct KillArgs {
+    /// Sub-agent name (without the `h-` container prefix).
+    pub name: String,
+}
+
+#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
+pub struct SetStatusArgs {
+    /// Status text to display on the dashboard card. Pass an empty string to clear.
+    pub text: String,
+}
+
+#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
+pub struct GetAgentMetaArgs {
+    /// Logical name of the agent to query (e.g. `"iris"`, `"manager"`).
+    /// Omit to query your own identity + status — replaces the
+    /// previous `whoami` self-introspection tool.
+    #[serde(default)]
+    pub name: Option<String>,
+}
+
+#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
+pub struct StartArgs {
+    /// Sub-agent name (without the `h-` container prefix).
+    pub name: String,
+}
+
+#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
+pub struct RestartArgs {
+    /// Sub-agent name (without the `h-` container prefix).
+    pub name: String,
+}
+
+#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
+pub struct UpdateArgs {
+    /// Sub-agent name (without the `h-` container prefix).
+    pub name: String,
+}
+
+#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
+pub struct AskArgs {
+    /// The question to surface.
+    pub question: String,
+    /// Optional fixed-choice answers. The dashboard renders these as
+    /// chips alongside a free-text fallback ("Other…") so the operator
+    /// is never trapped by an incomplete list; peer-agent recipients
+    /// see the list in their inbox event and can return any string.
+    #[serde(default)]
+    pub options: Vec<String>,
+    /// When true, options are rendered as checkboxes — the answerer
+    /// can pick any subset. The answer comes back as a single string
+    /// with selections joined by ", ". Ignored when `options` is empty.
+    #[serde(default)]
+    pub multi: bool,
+    /// Optional auto-cancel after `ttl_seconds` (capped server-side at
+    /// 6 hours). On expiry the question resolves with answer
+    /// `[expired]` and the asker receives the usual
+    /// `question_answered` system event (with `answerer:
+    /// "ttl-watchdog"`). `None` (default) = wait indefinitely.
+    #[serde(default)]
+    pub ttl_seconds: Option<u64>,
+    /// Recipient. Omit (or pass `"operator"`) to ask the human
+    /// operator via the dashboard. Pass another agent's logical name
+    /// to ask that peer — they receive a `question_asked` event in
+    /// their inbox and answer via `mcp__hyperhive__answer`.
+    #[serde(default)]
+    pub to: Option<String>,
+}
+
+#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
+pub struct AnswerArgs {
+    /// Id of the question being answered — comes from the
+    /// `question_asked` event in your inbox.
+    pub id: i64,
+    /// Free-text answer body. Soft-capped at 4 KiB by the same
+    /// `MESSAGE_MAX_BYTES` limit as `send`; keep it short or write the
+    /// detail to a file and pass a path.
+    pub answer: String,
+}
+
+#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
+pub struct CancelLooseEndArgs {
+    /// Which kind of thread to cancel — `"question"` for an open
+    /// `ask` that's still waiting on an answer, `"reminder"` for a
+    /// scheduled `remind` that hasn't fired yet. Use the `kind`
+    /// field straight off the `get_loose_ends` row.
+    pub kind: String,
+    /// Row id from the matching `get_loose_ends` entry (or the
+    /// `question_queued` reply when you submitted it).
+    pub id: i64,
+}
+
+#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
+pub struct GetLooseEndsArgs {
+    /// Whose loose ends to list. Omit (or `null`) for your own — the
+    /// manager's: approvals you submitted + questions where you are
+    /// asker/target + your own pending reminders. Pass `"*"` for a
+    /// hive-wide view of EVERY pending approval, unanswered question,
+    /// and reminder across the swarm. Pass a specific agent name to
+    /// inspect just that agent's threads.
+    #[serde(default)]
+    pub agent: Option<String>,
+}
+
+#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
+pub struct RequestApplyCommitArgs {
+    /// Agent whose config repo the commit lives in (use `"hm1nd"` for the
+    /// manager's own config).
+    pub agent: String,
+    /// Commit sha (full or short, 7-40 hex chars) in that agent's
+    /// proposed config repo. Must be a sha — a branch or tag name
+    /// (e.g. `main`) is rejected; the approval pins the exact commit.
+    pub commit_ref: String,
+    /// Optional description shown on the dashboard approval card so the
+    /// operator knows what the change does without opening the diff.
+    #[serde(default)]
+    pub description: Option<String>,
+}
+
+#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
+pub struct UpdateMetaInputsArgs {
+    /// Flake input names to update (e.g. `["bitburner-agent", "nixpkgs"]`).
+    /// Pass an empty list to update ALL inputs.
+    #[serde(default)]
+    pub inputs: Vec<String>,
+    /// Optional description shown on the dashboard approval card.
+    #[serde(default)]
+    pub description: Option<String>,
+}
+
+#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
+pub struct RequestSchedulePromptArgs {
+    /// Recipient agents — one schedule fires to many inboxes at the
+    /// scheduled time. `operator` is a legitimate target (mara: "we
+    /// want to get rid of the manager special case so yes manager
+    /// can be recipient" — the operator slot follows the same rule).
+    pub targets: Vec<String>,
+    /// Message body delivered to each target's inbox at fire time.
+    /// Same size budget as `send` bodies.
+    pub body: String,
+    /// Absolute unix timestamp (seconds) for the FIRST fire. For
+    /// recurring schedules the worker re-arms in
+    /// `interval_seconds` steps from this point on.
+    pub first_fire_at_unix: i64,
+    /// `None` / absent = one-shot. `Some(n > 0)` = recurring every
+    /// `n` seconds. The worker clamps catch-up so a long downtime
+    /// fires ONCE on resume (skipped-cycle count surfaces in the
+    /// per-target last_result), not N delayed pulses in a row.
+    #[serde(default)]
+    pub interval_seconds: Option<u64>,
+    /// Optional description shown on the dashboard approval card +
+    /// preserved on the schedule row for later operator reference.
+    #[serde(default)]
+    pub description: Option<String>,
+}
+
+#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
+pub struct FireScheduleNowArgs {
+    /// Schedule id to fire out of band. Get this from a prior
+    /// `list_schedules` call or the approval-resolved event for
+    /// the originating `request_schedule_prompt`.
+    pub id: i64,
+}
+
+#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
+pub struct CancelScheduleArgs {
+    /// Schedule id from a prior `list_schedules` call or the
+    /// approval-resolved event for a `request_schedule_prompt`.
+    pub id: i64,
+    /// Optional target list. `None` / empty = cancel the entire
+    /// schedule. `Some(["alice", "bob"])` = cancel just those
+    /// recipients (the schedule keeps firing for any remaining
+    /// active targets, and auto-cancels its parent row when every
+    /// target is gone).
+    #[serde(default)]
+    pub targets: Option<Vec<String>>,
+}
+
+#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
+pub struct EditScheduleArgs {
+    /// Schedule id from a prior `list_schedules` call or the
+    /// approval-resolved event for a `request_schedule_prompt`.
+    pub id: i64,
+    /// New body text. Omit to keep the existing one.
+    #[serde(default)]
+    pub body: Option<String>,
+    /// New description. Omit to keep the existing one. (To CLEAR
+    /// the description, use the dashboard PATCH endpoint
+    /// directly — the agent surface intentionally keeps the args
+    /// flat / non-nullable to dodge the doubly-wrapped Option
+    /// schemars quirk; clearing fields is rare and operator-side.)
+    #[serde(default)]
+    pub description: Option<String>,
+    /// Recurring interval in seconds. Omit to keep the existing
+    /// cadence; pass an explicit value to set a new one. Toggling
+    /// recurring↔one-shot (clearing the interval) is operator-only
+    /// for the same reason as `description` above.
+    #[serde(default)]
+    pub interval_seconds: Option<u64>,
+    /// New absolute unix timestamp for the next fire. Omit to
+    /// leave the schedule on its current cadence.
+    #[serde(default)]
+    pub next_fire_at_unix: Option<i64>,
+    /// Names of new targets to add. Replace-on-conflict: re-adding
+    /// a previously cancelled target resets its history (operator
+    /// intent on re-add = "this target is active again").
+    #[serde(default)]
+    pub targets_add: Option<Vec<String>>,
+    /// Names of targets to cancel. Tombstones preserve per-target
+    /// audit; when no active targets remain the schedule
+    /// auto-cancels.
+    #[serde(default)]
+    pub targets_remove: Option<Vec<String>>,
+}
+
+#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
+pub struct GetLogsArgs {
+    /// Logical agent name to fetch logs for (e.g. `gui`, `hm1nd`).
+    /// hive-c0re maps it to the underlying machine name (`h-gui`)
+    /// itself — pass the plain agent name, not the `h-` form.
+    pub agent: String,
+    /// How many journal lines to return (default: 50, max: 500).
+    #[serde(default)]
+    pub lines: Option<u32>,
+}
+
+#[derive(Debug, Clone)]
+pub struct ManagerServer {
+    socket: PathBuf,
+}
+
+impl ManagerServer {
+    #[must_use]
+    pub fn new(socket: PathBuf) -> Self {
+        Self { socket }
+    }
+
+    /// Helper: issue any `ManagerRequest` through the retry-aware
+    /// client, convert the reply through `SocketReply`, and return the
+    /// retry count alongside so the tool handler can `annotate_retries`
+    /// on the final string.
+    async fn dispatch(
+        &self,
+        req: hive_sh4re::ManagerRequest,
+    ) -> (Result<SocketReply, anyhow::Error>, u32) {
+        match client::request_retried::<_, hive_sh4re::ManagerResponse>(&self.socket, &req).await {
+            Ok((r, n)) => (Ok(SocketReply::from(r)), n),
+            Err(e) => (Err(e), 0),
+        }
+    }
+}
+
+// IMPORTANT: when adding a new `#[tool]` fn to this impl, also add
+// its name to `allowed_mcp_tools(Flavor::Manager)` below. Claude
+// Code's permission gate refuses uninlisted MCP tools in
+// non-interactive `--print` mode with "permissions not granted yet"
+// — exactly the failure mode PR #511 cleaned up. Keep the two lists
+// in lockstep.
+#[tool_router]
+impl ManagerServer {
+    #[tool(
+        description = "Send a message to a sub-agent (by logical name), to another agent, \
+        or to the operator (recipient `operator`, surfaces in the dashboard)."
+    )]
+    async fn send(&self, Parameters(args): Parameters<SendArgs>) -> String {
+        let log = format!("{args:?}");
+        let to = args.to.clone();
+        run_tool_envelope("send", log, async move {
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::ManagerRequest::Send {
+                    to: args.to,
+                    body: args.body,
+                    in_reply_to: args.in_reply_to,
+                })
+                .await;
+            annotate_retries(format_ack(resp, "send", format!("sent to {to}")), retries)
+        })
+        .await
+    }
+
+    #[tool(
+        description = "Pop messages from the manager inbox. Default returns one (sender + \
+            body) or empty. Without `wait_seconds` (or 0) returns immediately — a cheap inbox \
+            peek. Pass a positive value (capped at 180) to park until either a message arrives \
+            or the timeout fires; prefer a long wait (120 or 180) over ending a turn early \
+            when you have nothing else to do. \n\n\
+            Pass `max: N` (capped at 32) to drain up to N messages in one round-trip — useful \
+            when the wake prompt tells you the inbox has more queued. `wait_seconds` still \
+            applies to the FIRST message; once one lands the call drains up to `max` in total."
+    )]
+    async fn recv(&self, Parameters(args): Parameters<RecvArgs>) -> String {
+        let log = format!("{args:?}");
+        run_tool_envelope("recv", log, async move {
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::ManagerRequest::Recv {
+                    wait_seconds: args.wait_seconds,
+                    max: args.max,
+                })
+                .await;
+            annotate_retries(format_recv(resp), retries)
+        })
+        .await
+    }
+
+    #[tool(
+        description = "Step 1 of 2 for creating a new agent: initialise the proposed config \
+        repo and queue an InitConfig approval. On operator approval hive-c0re seeds \
+        `/agents/<name>/config/agent.nix` with the default template so the manager can \
+        customise it before spawning. After the ConfigReady helper event arrives, edit \
+        agent.nix, commit the changes, then call `request_apply_commit` with the commit \
+        sha — that's what creates the container. Fails if a config repo for this name \
+        already exists (use `request_apply_commit` directly to update an existing agent)."
+    )]
+    async fn request_init_config(
+        &self,
+        Parameters(args): Parameters<RequestInitConfigArgs>,
+    ) -> String {
+        let log = format!("{args:?}");
+        let name = args.name.clone();
+        run_tool_envelope("request_init_config", log, async move {
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::ManagerRequest::RequestInitConfig {
+                    name: args.name,
+                    description: args.description,
+                })
+                .await;
+            annotate_retries(
+                format_ack(
+                    resp,
+                    "request_init_config",
+                    format!("init_config approval queued for {name}"),
+                ),
+                retries,
+            )
+        })
+        .await
+    }
+
+    #[tool(
+        description = "Stop a sub-agent container (graceful). The state dir is kept; \
+        recreating reuses prior config + Claude credentials. No approval required."
+    )]
+    async fn kill(&self, Parameters(args): Parameters<KillArgs>) -> String {
+        let log = format!("{args:?}");
+        let name = args.name.clone();
+        run_tool_envelope("kill", log, async move {
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::ManagerRequest::Kill { name: args.name })
+                .await;
+            annotate_retries(format_ack(resp, "kill", format!("killed {name}")), retries)
+        })
+        .await
+    }
+
+    #[tool(
+        description = "Start a stopped sub-agent container. No approval required — \
+        lifecycle ops on existing containers are at the manager's discretion."
+    )]
+    async fn start(&self, Parameters(args): Parameters<StartArgs>) -> String {
+        let log = format!("{args:?}");
+        let name = args.name.clone();
+        run_tool_envelope("start", log, async move {
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::ManagerRequest::Start { name: args.name })
+                .await;
+            annotate_retries(
+                format_ack(resp, "start", format!("started {name}")),
+                retries,
+            )
+        })
+        .await
+    }
+
+    #[tool(description = "Restart a sub-agent container (stop + start). No approval required.")]
+    async fn restart(&self, Parameters(args): Parameters<RestartArgs>) -> String {
+        let log = format!("{args:?}");
+        let name = args.name.clone();
+        run_tool_envelope("restart", log, async move {
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::ManagerRequest::Restart { name: args.name })
+                .await;
+            annotate_retries(
+                format_ack(resp, "restart", format!("restarted {name}")),
+                retries,
+            )
+        })
+        .await
+    }
+
+    #[tool(
+        description = "Rebuild a sub-agent: re-applies the current hyperhive flake + agent.nix \
+        and restarts the container. No approval required — idempotent. Use when you receive a \
+        `needs_update` system event for an agent."
+    )]
+    async fn update(&self, Parameters(args): Parameters<UpdateArgs>) -> String {
+        let log = format!("{args:?}");
+        let name = args.name.clone();
+        run_tool_envelope("update", log, async move {
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::ManagerRequest::Update { name: args.name })
+                .await;
+            annotate_retries(
+                format_ack(resp, "update", format!("updated {name}")),
+                retries,
+            )
+        })
+        .await
+    }
+
+    #[tool(
+        description = "Queue an approval for the operator to run `nix flake update` on the \
+        meta flake and commit the resulting lock changes. Pass specific input names to update \
+        only those inputs (e.g. `[\"bitburner-agent\"]`), or pass an empty list to update ALL \
+        inputs. Returns immediately — the lock update runs when the operator approves. \
+        Does NOT trigger container rebuilds — call `update` on each affected agent \
+        separately after the approval resolves."
+    )]
+    async fn request_update_meta_inputs(
+        &self,
+        Parameters(args): Parameters<UpdateMetaInputsArgs>,
+    ) -> String {
+        let log = format!("{args:?}");
+        run_tool_envelope("request_update_meta_inputs", log, async move {
+            let label = if args.inputs.is_empty() {
+                "all inputs".to_string()
+            } else {
+                args.inputs.join(", ")
+            };
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::ManagerRequest::RequestUpdateMetaInputs {
+                    inputs: args.inputs,
+                    description: args.description,
+                })
+                .await;
+            annotate_retries(
+                format_ack(
+                    resp,
+                    "request_update_meta_inputs",
+                    format!("approval queued: {label}"),
+                ),
+                retries,
+            )
+        })
+        .await
+    }
+
+    #[tool(
+        description = "Queue an approval to add a scheduled prompt — one body delivered to \
+        N agent inboxes at a target time, optionally recurring every `interval_seconds`. \
+        The operator approves; on approve hive-c0re inserts the schedule and the worker \
+        fans it out. Even self-targeted schedules go through this flow (the operator pays \
+        for the wake-up tokens); the existing `remind` MCP tool stays the quick \
+        no-approval self-wake path. \n\n\
+        Catch-up clamp: if hive-c0re is down across multiple intervals, only ONE delayed \
+        fire happens on resume (per recurring schedule). The skipped-cycle count surfaces \
+        in the per-target `last_result` for the operator's audit trail. \n\n\
+        Per-target failure: a target name that doesn't resolve to a live agent → operator \
+        gets a one-line advisory `Message` from `system`; the schedule keeps firing for \
+        the other (live) targets."
+    )]
+    async fn request_schedule_prompt(
+        &self,
+        Parameters(args): Parameters<RequestSchedulePromptArgs>,
+    ) -> String {
+        let log = format!("{args:?}");
+        run_tool_envelope("request_schedule_prompt", log, async move {
+            let target_count = args.targets.len();
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::ManagerRequest::RequestSchedulePrompt(
+                    hive_sh4re::SchedulePromptPayload {
+                        targets: args.targets,
+                        body: args.body,
+                        first_fire_at_unix: args.first_fire_at_unix,
+                        interval_seconds: args.interval_seconds,
+                        description: args.description,
+                    },
+                ))
+                .await;
+            annotate_retries(
+                format_ack(
+                    resp,
+                    "request_schedule_prompt",
+                    format!("approval queued: {target_count} target(s)"),
+                ),
+                retries,
+            )
+        })
+        .await
+    }
+
+    #[tool(
+        description = "Fire a scheduled prompt out of band — runs the per-target fan-out \
+        once immediately without disturbing the schedule's cadence. Recurring schedules \
+        keep their next_fire_at unchanged (the manual fire is additive). One-shot \
+        schedules are CONSUMED by the manual fire (cancelled afterwards): the operator's \
+        intent on a one-shot is 'send this now, the scheduled time was wrong'. \n\n\
+        Authorization mirrors `cancel_schedule`: you can fire your own schedules + any \
+        owned by a sub-agent in your subtree per topology.json."
+    )]
+    async fn fire_schedule_now(
+        &self,
+        Parameters(args): Parameters<FireScheduleNowArgs>,
+    ) -> String {
+        let log = format!("{args:?}");
+        run_tool_envelope("fire_schedule_now", log, async move {
+            let id = args.id;
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::ManagerRequest::FireScheduleNow { id })
+                .await;
+            annotate_retries(
+                format_ack(resp, "fire_schedule_now", format!("fired #{id} now")),
+                retries,
+            )
+        })
+        .await
+    }
+
+    #[tool(
+        description = "Cancel a scheduled prompt. With no `targets` field, cancels the \
+        whole schedule (all recipients flipped). With a non-empty `targets` list, cancels \
+        just those recipients; the schedule keeps firing for any remaining active targets \
+        and auto-cancels its parent row when every target is cancelled. \n\n\
+        Authorization: the manager can cancel its own schedules + any schedule whose \
+        owner is one of its sub-agents per topology.json. Other owners are refused."
+    )]
+    async fn cancel_schedule(&self, Parameters(args): Parameters<CancelScheduleArgs>) -> String {
+        let log = format!("{args:?}");
+        run_tool_envelope("cancel_schedule", log, async move {
+            let id = args.id;
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::ManagerRequest::CancelSchedule {
+                    id: args.id,
+                    targets: args.targets,
+                })
+                .await;
+            annotate_retries(format_ack(resp, "cancel_schedule", format!("cancelled #{id}")), retries)
+        })
+        .await
+    }
+
+    #[tool(
+        description = "Edit an existing scheduled prompt's mutable fields (#474). Pass only \
+        the fields you want to change — anything omitted keeps its current value. Editable: \
+        `body`, `description`, `interval_seconds` (positive only via this tool; flipping \
+        recurring→one-shot is operator-only via the dashboard), `next_fire_at_unix`, and \
+        the target set via `targets_add` / `targets_remove` (#478). Both target lists are \
+        applied in the same transaction with removes-before-adds, so a single edit can \
+        swap a target atomically. Re-adding a previously-removed target starts a fresh \
+        per-target history (drops the tombstone). Draining all targets auto-cancels the \
+        parent schedule. \n\n\
+        Authorization mirrors `cancel_schedule` / `fire_schedule_now`: you can edit your \
+        own schedules + any owned by a sub-agent in your subtree per topology.json. \
+        Refuses cancelled schedules (the row's terminal — submit a fresh one)."
+    )]
+    async fn edit_schedule(&self, Parameters(args): Parameters<EditScheduleArgs>) -> String {
+        let log = format!("{args:?}");
+        run_tool_envelope("edit_schedule", log, async move {
+            let id = args.id;
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::ManagerRequest::EditSchedule {
+                    id: args.id,
+                    body: args.body,
+                    // The agent-side args use plain Option<T>; the
+                    // manager wire type's `Some(None)` ("set to
+                    // null") cases stay operator-exclusive, so we
+                    // promote agent-supplied values into
+                    // `Some(Some(v))` and omit when the agent
+                    // didn't pass a value.
+                    description: args.description.map(Some),
+                    interval_seconds: args.interval_seconds.map(Some),
+                    next_fire_at_unix: args.next_fire_at_unix,
+                    targets_add: args.targets_add,
+                    targets_remove: args.targets_remove,
+                })
+                .await;
+            annotate_retries(
+                format_ack(resp, "edit_schedule", format!("edited #{id}")),
+                retries,
+            )
+        })
+        .await
+    }
+
+    #[tool(
+        description = "List every scheduled prompt in the queue (active + cancelled but \
+        not yet reaped). Returns the full snapshot — schedule id, owner, body, target set \
+        with per-target last_fired_at + last_result, next fire time, recurring interval. \
+        Use this to look up an id before calling `cancel_schedule`, or to audit what \
+        the swarm is going to be woken up about next."
+    )]
+    async fn list_schedules(&self) -> String {
+        run_tool_envelope("list_schedules", String::new(), async move {
+            let (resp, retries) = self.dispatch(hive_sh4re::ManagerRequest::ListSchedules).await;
+            let body = match resp {
+                Ok(SocketReply::Schedules(schedules)) => serde_json::to_string(&schedules)
+                    .unwrap_or_else(|e| format!("list_schedules: serialise: {e:#}")),
+                Ok(SocketReply::Err(m)) => format!("list_schedules: {m}"),
+                Ok(other) => format!("list_schedules unexpected response: {other:?}"),
+                Err(e) => format!("list_schedules transport error: {e:#}"),
+            };
+            annotate_retries(body, retries)
+        })
+        .await
+    }
+
+    #[tool(
+        description = "Surface a structured question to either the operator OR a sub-agent. \
+        Returns immediately with a question id — do NOT wait inline. When the recipient \
+        answers, a system message with event `question_answered { id, question, answer, \
+        answerer }` lands in your inbox; handle it on a future turn. \n\n\
+        Recipient: omit `to` (or set `to: \"operator\"`) for the human operator on the \
+        dashboard. Set `to: \"<agent-name>\"` to ask a sub-agent — they receive a \
+        `question_asked` event in their inbox and answer via their `mcp__hyperhive__answer` \
+        tool. Useful for delegating decisions / clarifications without losing the \
+        question id correlation. \n\n\
+        `options` is advisory: pass a short fixed-choice list when applicable, otherwise \
+        leave empty for free text. Set `multi: true` to render checkboxes; the answer \
+        comes back as a comma-separated string. Set `ttl_seconds` to auto-cancel — on \
+        expiry the answer is `[expired]` (with `answerer: \"ttl-watchdog\"`) and the same \
+        `question_answered` event fires."
+    )]
+    async fn ask(&self, Parameters(args): Parameters<AskArgs>) -> String {
+        let log = format!("{args:?}");
+        run_tool_envelope("ask", log, async move {
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::ManagerRequest::Ask {
+                    question: args.question,
+                    options: args.options,
+                    multi: args.multi,
+                    ttl_seconds: args.ttl_seconds,
+                    to: args.to,
+                })
+                .await;
+            let s = match resp {
+                Ok(SocketReply::QuestionQueued(id)) => format!(
+                    "question queued (id={id}); answer will arrive as a system \
+                     `question_answered` event in your inbox"
+                ),
+                Ok(SocketReply::Err(m)) => format!("ask failed: {m}"),
+                Ok(other) => format!("ask unexpected response: {other:?}"),
+                Err(e) => format!("ask transport error: {e:#}"),
+            };
+            annotate_retries(s, retries)
+        })
+        .await
+    }
+
+    #[tool(
+        description = "Answer a question that was routed to the manager via a `question_asked` \
+        system event in the manager's inbox (i.e. a sub-agent did `ask(to: \"manager\", \
+        ...)`). Pass the `id` from the event and your `answer`. The answer surfaces in the \
+        asker's inbox as a `question_answered` event."
+    )]
+    async fn answer(&self, Parameters(args): Parameters<AnswerArgs>) -> String {
+        let log = format!("{args:?}");
+        let id = args.id;
+        run_tool_envelope("answer", log, async move {
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::ManagerRequest::Answer {
+                    id,
+                    answer: args.answer,
+                })
+                .await;
+            annotate_retries(
+                format_ack(resp, "answer", format!("answered question {id}")),
+                retries,
+            )
+        })
+        .await
+    }
+
+    #[tool(
+        description = "Submit a config change for operator approval. Pass the agent name \
+        (e.g. `alice` or `hm1nd` for the manager's own config) and a commit sha (7-40 hex \
+        chars, full or short) in that agent's proposed config repo — a branch/tag name like \
+        `main` is rejected, the approval pins the exact commit. On approval hive-c0re \
+        rebuilds the container."
+    )]
+    async fn request_apply_commit(
+        &self,
+        Parameters(args): Parameters<RequestApplyCommitArgs>,
+    ) -> String {
+        let log = format!("{args:?}");
+        let agent = args.agent.clone();
+        let commit_ref = args.commit_ref.clone();
+        run_tool_envelope("request_apply_commit", log, async move {
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::ManagerRequest::RequestApplyCommit {
+                    agent: args.agent,
+                    commit_ref: args.commit_ref,
+                    description: args.description,
+                })
+                .await;
+            annotate_retries(
+                format_ack(
+                    resp,
+                    "request_apply_commit",
+                    format!("apply approval queued for {agent} @ {commit_ref}"),
+                ),
+                retries,
+            )
+        })
+        .await
+    }
+
+    #[tool(
+        description = "Schedule a reminder that lands in the manager's own inbox at a future \
+        time (sender will appear as `reminder`). Use for self-paced manager follow-ups: \
+        'recheck pending approval in 10m', 'nudge alice if she hasn't replied by 14:00 \
+        UTC'. Set EXACTLY ONE of `delay_seconds` (fire N seconds from now) or \
+        `at_unix_timestamp` (fire at absolute epoch second). Body soft-caps at 4 KiB \
+        inline — anything larger gets auto-persisted to a file under `/state/reminders/` \
+        (the manager's own state mount) and the inbox message becomes a short pointer. \
+        Pass `file_path` if you want to control the destination yourself."
+    )]
+    async fn remind(&self, Parameters(args): Parameters<RemindArgs>) -> String {
+        let log = format!("{args:?}");
+        run_tool_envelope("remind", log, async move {
+            let timing = match (args.delay_seconds, args.at_unix_timestamp) {
+                (Some(_), Some(_)) => {
+                    return "remind failed: pass exactly one of `delay_seconds` or \
+                            `at_unix_timestamp`, not both"
+                        .to_string();
+                }
+                (None, None) => {
+                    return "remind failed: pass exactly one of `delay_seconds` or \
+                            `at_unix_timestamp`"
+                        .to_string();
+                }
+                (Some(s), None) => hive_sh4re::ReminderTiming::InSeconds { seconds: s },
+                (None, Some(t)) => hive_sh4re::ReminderTiming::At { unix_timestamp: t },
+            };
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::ManagerRequest::Remind {
+                    message: args.message,
+                    timing,
+                    file_path: args.file_path,
+                })
+                .await;
+            annotate_retries(format_ack(resp, "remind", "reminder scheduled".to_string()), retries)
+        })
+        .await
+    }
+
+    #[tool(
+        description = "List loose ends. By default returns your OWN — the manager's: \
+        pending approvals you submitted + unanswered questions where you are \
+        asker/target + your own pending reminders. Pass `agent: \"*\"` for a \
+        hive-wide scan (EVERY pending approval, unanswered question, and reminder \
+        across the swarm) — use it to spot stalled coordination, e.g. questions \
+        sub-agents asked each other that nobody's answering. Pass `agent: \
+        \"<name>\"` to inspect one agent's threads. Cancel any question or reminder \
+        row via `cancel_loose_end` (manager bypasses the owner check)."
+    )]
+    async fn get_loose_ends(&self, Parameters(args): Parameters<GetLooseEndsArgs>) -> String {
+        run_tool_envelope("get_loose_ends", String::new(), async move {
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::ManagerRequest::GetLooseEnds { agent: args.agent })
+                .await;
+            annotate_retries(format_loose_ends(resp), retries)
+        })
+        .await
+    }
+
+    #[tool(
+        description = "Set a free-text status string visible on the operator dashboard. \
+        Call this at the START of every task to describe what you're working on. \
+        Pass an empty string to clear. Persists across harness restarts."
+    )]
+    async fn set_status(&self, Parameters(args): Parameters<SetStatusArgs>) -> String {
+        run_tool_envelope("set_status", args.text.clone(), async move {
+            let (resp, retries) =
+                self.dispatch(hive_sh4re::ManagerRequest::SetStatus { text: args.text }).await;
+            annotate_retries(format_ack(resp, "set_status", "status updated".to_owned()), retries)
+        })
+        .await
+    }
+
+    #[tool(
+        description = "Fetch identity + status metadata for an agent. Returns canonical \
+        `name`, `role` (`agent` / `manager`), the current `hyperhive_rev` hive-c0re is \
+        running against, and the target's self-reported `status` text (set via \
+        `set_status`) plus how long ago it was set. Pass `name` to query a sub-agent or \
+        peer manager; omit `name` for the manager's own identity stamp — useful for \
+        boot announcements, state-file headers, or cross-agent attribution that won't \
+        drift across renames. Status reads `<none>` when the target has never called \
+        `set_status` or has cleared it."
+    )]
+    async fn get_agent_meta(
+        &self,
+        Parameters(args): Parameters<GetAgentMetaArgs>,
+    ) -> String {
+        let log = args.name.clone().unwrap_or_else(|| "<self>".to_owned());
+        run_tool_envelope("get_agent_meta", log, async move {
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::ManagerRequest::GetAgentMeta { name: args.name })
+                .await;
+            annotate_retries(format_agent_meta(resp), retries)
+        })
+        .await
+    }
+
+    #[tool(
+        description = "Cancel any open thread in the swarm — a `question` (cancels \
+        with the operator-override sentinel so the asker unblocks), a `reminder` \
+        (hard-deleted before fire), or an `approval` (withdraws a pending approval \
+        you submitted; the dashboard pulls the card from pending and the row resolves \
+        as `cancelled` instead of approved/denied/failed — closes #250). `kind` is \
+        `\"question\"`, `\"reminder\"`, or `\"approval\"`; `id` is the row id from \
+        `get_loose_ends` or the original submission reply. Manager surface bypasses \
+        the owner check on the sub-agent flavour — use for hive-wide cleanup of \
+        stuck or stale threads, or to drop your own approvals that got superseded."
+    )]
+    async fn cancel_loose_end(&self, Parameters(args): Parameters<CancelLooseEndArgs>) -> String {
+        let log = format!("{args:?}");
+        let id = args.id;
+        run_tool_envelope("cancel_loose_end", log, async move {
+            let kind = match parse_loose_end_kind(&args.kind) {
+                Ok(k) => k,
+                Err(e) => return e,
+            };
+            let kind_label = loose_end_kind_label(kind);
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::ManagerRequest::CancelLooseEnd { kind, id })
+                .await;
+            annotate_retries(
+                format_ack(resp, "cancel_loose_end", format!("cancelled {kind_label} {id}")),
+                retries,
+            )
+        })
+        .await
+    }
+
+    #[tool(
+        description = "Fetch recent journal log lines for a sub-agent container. Useful \
+        for diagnosing MCP server registration failures, startup crashes, plugin install \
+        errors, or any harness issue you can't see from inside the container. Pass the \
+        plain logical agent name (e.g. `gui`) — hive-c0re resolves the machine name. \
+        `lines` defaults to 50 (max capped at 500 on the host side)."
+    )]
+    async fn get_logs(&self, Parameters(args): Parameters<GetLogsArgs>) -> String {
+        let log = format!("{args:?}");
+        let agent = args.agent.clone();
+        run_tool_envelope("get_logs", log, async move {
+            let lines = args.lines.map(|n| n.min(500));
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::ManagerRequest::GetLogs {
+                    agent: agent.clone(),
+                    lines,
+                })
+                .await;
+            let s = match resp {
+                Ok(SocketReply::Logs(content)) => {
+                    if content.is_empty() {
+                        format!("(no journal output for {agent})")
+                    } else {
+                        content
+                    }
+                }
+                Ok(SocketReply::Err(m)) => format!("get_logs failed: {m}"),
+                Ok(other) => format!("get_logs unexpected response: {other:?}"),
+                Err(e) => format!("get_logs transport error: {e:#}"),
+            };
+            annotate_retries(s, retries)
+        })
+        .await
+    }
+}
+
+#[tool_handler(
+    instructions = "You are the hyperhive manager (hm1nd). You coordinate sub-agents and \
+        relay between them and the operator. Use `send` to talk to agents/operator, `recv` \
+        to drain your inbox. Privileged: `request_init_config` (step 1 of new-agent \
+        creation — seeds the proposed config repo so you can customise agent.nix; \
+        operator-approved), `kill` (graceful stop), `request_apply_commit` (config \
+        change for any agent including yourself — also doubles as step 2 of new-agent \
+        creation: the first ApplyCommit on a freshly-init'd config creates the \
+        container), `ask` (structured question to the operator or a \
+        sub-agent — non-blocking, answer arrives later as a `question_answered` event), \
+        `answer` (respond to a `question_asked` event directed at you), \
+        `get_loose_ends` (hive-wide loose ends — pending approvals + unanswered \
+        questions + pending reminders across the swarm), `cancel_loose_end` (cancel any \
+        question or reminder row by id), `set_status` / `get_agent_meta` (publish your \
+        own status text + query identity/status of any agent — `get_agent_meta` with \
+        no arg replaces the old `whoami` self-introspection). The manager's own config lives at \
+        `/agents/hm1nd/config/agent.nix`."
+)]
+impl ServerHandler for ManagerServer {}
+
+/// Name of the hyperhive MCP server inside claude's view. Claude prefixes
+/// tools as `mcp__<this>__<tool>` (e.g. `mcp__hyperhive__send`).
+pub const SERVER_NAME: &str = "hyperhive";
+
+/// Built-in claude tools the turn loop enables via `--tools`. Anything not
+/// in this list literally doesn't exist in the session (claude won't even
+/// try to call it). Web egress (`WebFetch`/`WebSearch`) and nested agents
+/// (`Task`) are intentionally omitted for now; `Bash` is allowed pending a
+/// finer-grained allow-list system for shell command patterns. `TodoWrite`
+/// is omitted because the todo list lives in claude's in-process session
+/// state and silently evaporates on /compact or session reset — agents
+/// should plan in /state notes instead. Edit later as our trust model
+/// evolves.
+pub const ALLOWED_BUILTIN_TOOLS: &[&str] = &["Bash", "Edit", "Glob", "Grep", "Read", "Write"];
+
+/// Which MCP tool surface to advertise via `--allowedTools`. The agent
+/// list is the strict subset of the manager list, so we just thread the
+/// flavor through.
+#[derive(Debug, Clone, Copy)]
+pub enum Flavor {
+    Agent,
+    Manager,
+}
+
+/// MCP tools claude is allowed to call without prompting. Mirrors the
+/// hyperhive surface so a new tool added in the corresponding `#[tool_router]`
+/// impl needs to be listed here too.
+#[must_use]
+pub fn allowed_mcp_tools(flavor: Flavor) -> Vec<String> {
+    let names: &[&str] = match flavor {
+        Flavor::Agent => &[
+            "send",
+            "recv",
+            "ask",
+            "answer",
+            "remind",
+            "get_loose_ends",
+            "set_status",
+            "get_agent_meta",
+            "cancel_loose_end",
+        ],
+        Flavor::Manager => &[
+            "send",
+            "recv",
+            "request_init_config",
+            "kill",
+            "start",
+            "restart",
+            "update",
+            "request_apply_commit",
+            // Tools added post-#444 / #235 / #467 / #472 / #474 / #478 that
+            // got missed in the allow-list when their `#[tool]` impls
+            // landed. Claude Code's permission gate refuses uninlisted
+            // tools in non-interactive `--print` mode with a "permissions
+            // not granted yet" error (hm1nd hit this trying to run the
+            // dedup pass for #509). Keep this block in lockstep with the
+            // `#[tool]` fns in the `ManagerServer` impl.
+            "request_update_meta_inputs",
+            "request_schedule_prompt",
+            "fire_schedule_now",
+            "cancel_schedule",
+            "edit_schedule",
+            "list_schedules",
+            "ask",
+            "answer",
+            "get_logs",
+            "get_loose_ends",
+            "remind",
+            "set_status",
+            "get_agent_meta",
+            "cancel_loose_end",
+        ],
+    };
+    let mut out: Vec<String> = names
+        .iter()
+        .map(|t| format!("mcp__{SERVER_NAME}__{t}"))
+        .collect();
+    // Extra MCP servers declared via `hyperhive.extraMcpServers` in
+    // the agent's NixOS config. Each entry maps its `allowedTools`
+    // pattern list to `mcp__<server>__<pattern>` so claude can call
+    // them without per-tool operator approval. `["*"]` (the default)
+    // expands to `mcp__<server>__*` — every tool from that server.
+    for (server, spec) in load_extra_mcp() {
+        if server == SERVER_NAME {
+            continue;
+        }
+        for pat in spec.allowed_tools {
+            out.push(format!("mcp__{server}__{pat}"));
+        }
+    }
+    out
+}
+
+/// Combined allow-list passed to `--allowedTools` (auto-approve) — covers
+/// both the built-ins and the MCP surface. If `hyperhive.allowedBashPatterns`
+/// is configured (non-empty list in `/etc/hyperhive/bash-allow.json`),
+/// `Bash` is replaced with one `Bash(pattern)` entry per pattern so
+/// only vetted command families auto-approve without a blanket shell grant.
+/// An empty or missing allow file keeps the current wholesale `Bash` entry.
+#[must_use]
+pub fn allowed_tools_arg(flavor: Flavor) -> String {
+    let mut all: Vec<String> = ALLOWED_BUILTIN_TOOLS
+        .iter()
+        .flat_map(|s| {
+            if *s == "Bash" {
+                let patterns = load_bash_allow();
+                if patterns.is_empty() {
+                    vec!["Bash".to_owned()]
+                } else {
+                    patterns
+                        .into_iter()
+                        .map(|p| format!("Bash({p})"))
+                        .collect()
+                }
+            } else {
+                vec![(*s).to_owned()]
+            }
+        })
+        .collect();
+    all.extend(allowed_mcp_tools(flavor));
+    all.join(",")
+}
+
+/// Built-in tools list for `--tools` (which built-ins exist in this
+/// session). Same as `ALLOWED_BUILTIN_TOOLS` but joined comma-separated.
+#[must_use]
+pub fn builtin_tools_arg() -> String {
+    ALLOWED_BUILTIN_TOOLS.join(",")
+}
+
+/// Where the NixOS module writes the per-agent Bash command allow-list
+/// (see `nix/templates/harness-base.nix`). Contains a JSON array of
+/// command-pattern strings like `["git *", "ls *"]`. Empty array =
+/// wholesale `Bash` approval (the default). Non-empty = one
+/// `Bash(pattern)` entry per item in `--allowedTools`.
+const BASH_ALLOW_PATH: &str = "/etc/hyperhive/bash-allow.json";
+
+/// Where the NixOS module writes the per-agent extra-MCP spec (see
+/// `nix/templates/harness-base.nix`). Each entry becomes an additional
+/// `mcpServers.<key>` block in the rendered claude config + a
+/// `mcp__<key>__<tool>` pattern in `--allowedTools`.
+const EXTRA_MCP_PATH: &str = "/etc/hyperhive/extra-mcp.json";
+
+/// Where the NixOS module writes the per-agent send allow-list (see
+/// `nix/templates/harness-base.nix`). Empty list = unrestricted (the
+/// default). Non-empty list constrains `mcp__hyperhive__send`'s `to`
+/// field; the manager is always implicitly permitted regardless of
+/// the list contents.
+const SEND_ALLOW_PATH: &str = "/etc/hyperhive/send-allow.json";
+
+/// Enforce the per-agent send allow-list. Returns `Ok` when the
+/// recipient is permitted (no list configured, manager always
+/// allowed, or `to` is in the list); returns `Err(refusal)` with a
+/// claude-readable string when blocked — the harness surfaces the
+/// refusal as the tool result so claude knows the message didn't
+/// land and can react (e.g. route via the manager instead).
+fn check_send_allowed(to: &str) -> Result<(), String> {
+    if to == hive_sh4re::MANAGER_AGENT {
+        // Always allow agents to talk to the manager — otherwise a
+        // misconfigured allow-list could leave a sub-agent unable
+        // to ask for help.
+        return Ok(());
+    }
+    let Ok(raw) = std::fs::read_to_string(SEND_ALLOW_PATH) else {
+        return Ok(()); // file missing → no policy configured → unrestricted
+    };
+    let allow: Vec<String> = match serde_json::from_str(&raw) {
+        Ok(v) => v,
+        Err(e) => {
+            tracing::warn!(
+                path = SEND_ALLOW_PATH,
+                error = ?e,
+                "send allow-list parse failed; falling back to unrestricted",
+            );
+            return Ok(());
+        }
+    };
+    if allow.is_empty() {
+        return Ok(()); // empty list = unrestricted (back-compat)
+    }
+    if allow.iter().any(|n| n == to) {
+        return Ok(());
+    }
+    Err(format!(
+        "send refused: recipient '{to}' not in hyperhive.allowedRecipients \
+         (configured in agent.nix). Allowed: {allow:?}. The manager is \
+         always reachable — route through `send(to: \"manager\", …)` if \
+         you need to reach someone outside the allow-list."
+    ))
+}
+
+#[derive(Debug, serde::Deserialize)]
+struct ExtraMcpServer {
+    command: String,
+    #[serde(default)]
+    args: Vec<String>,
+    #[serde(default)]
+    env: std::collections::BTreeMap<String, String>,
+    #[serde(default = "default_allowed_tools")]
+    #[serde(rename = "allowedTools")]
+    allowed_tools: Vec<String>,
+}
+
+fn default_allowed_tools() -> Vec<String> {
+    vec!["*".to_owned()]
+}
+
+/// Read + parse the Bash command allow-list. Returns an empty vec when
+/// the file is missing or unparsable (degrade to wholesale `Bash`
+/// approval — same as the pre-feature behaviour).
+fn load_bash_allow() -> Vec<String> {
+    let Ok(raw) = std::fs::read_to_string(BASH_ALLOW_PATH) else {
+        return Vec::new();
+    };
+    serde_json::from_str::<Vec<String>>(&raw).unwrap_or_else(|e| {
+        tracing::warn!(
+            path = BASH_ALLOW_PATH,
+            error = ?e,
+            "bash-allow list parse failed; falling back to wholesale Bash approval",
+        );
+        Vec::new()
+    })
+}
+
+/// Read + parse the extra-MCP spec. Returns an empty map when
+/// the file is missing or unparsable (the agent has none configured,
+/// or the file is malformed — both cases degrade to "no extra servers").
+fn load_extra_mcp() -> std::collections::BTreeMap<String, ExtraMcpServer> {
+    let Ok(raw) = std::fs::read_to_string(EXTRA_MCP_PATH) else {
+        return std::collections::BTreeMap::new();
+    };
+    serde_json::from_str(&raw).unwrap_or_else(|e| {
+        tracing::warn!(
+            path = EXTRA_MCP_PATH,
+            error = ?e,
+            "extra-mcp spec parse failed; ignoring",
+        );
+        std::collections::BTreeMap::new()
+    })
+}
+
+/// Render the MCP config blob claude reads from `--mcp-config <path>`.
+/// `agent_binary` is the path (or PATH-resolvable name) of the `hive-ag3nt`
+/// executable; `socket` is the hyperhive per-agent socket bind-mounted into
+/// the container (forwarded to the child as `--socket <path>`). Merges in
+/// any extra MCP servers declared via `hyperhive.extraMcpServers` in the
+/// agent's NixOS config.
+#[must_use]
+pub fn render_claude_config(agent_binary: &str, socket: &std::path::Path) -> String {
+    let mut servers = serde_json::Map::new();
+    servers.insert(
+        SERVER_NAME.to_owned(),
+        serde_json::json!({
+            "command": agent_binary,
+            "args": ["--socket", socket.display().to_string(), "mcp"],
+            "env": {}
+        }),
+    );
+    // Auto-inject HYPERHIVE_STATE_DIR so extra MCP servers can resolve the
+    // agent's durable state dir without the agent author hard-coding it.
+    // User-supplied env takes precedence — we only fill in the missing key.
+    let state_dir = crate::paths::state_dir();
+    for (name, mut spec) in load_extra_mcp() {
+        if name == SERVER_NAME {
+            tracing::warn!(
+                "extra MCP server name `{SERVER_NAME}` collides with the built-in surface; ignoring",
+            );
+            continue;
+        }
+        spec.env
+            .entry("HYPERHIVE_STATE_DIR".to_owned())
+            .or_insert_with(|| state_dir.display().to_string());
+        servers.insert(
+            name,
+            serde_json::json!({
+                "command": spec.command,
+                "args": spec.args,
+                "env": spec.env,
+            }),
+        );
+    }
+    let config = serde_json::json!({ "mcpServers": servers });
+    serde_json::to_string_pretty(&config).unwrap_or_else(|_| "{}".into())
+}
diff --git a/hive-ag3nt/src/paths.rs b/hive-ag3nt/src/paths.rs
new file mode 100644
index 00000000..7564ebfb
--- /dev/null
+++ b/hive-ag3nt/src/paths.rs
@@ -0,0 +1,32 @@
+//! Per-agent path resolution for state and credential directories.
+//!
+//! All agents (including the manager "hm1nd") use `/agents/{label}/state`.
+//! Claude credentials are always at `/root/.claude` for all agents.
+//!
+//! Both paths can be overridden via env vars (`HYPERHIVE_STATE_DIR`,
+//! `HYPERHIVE_CLAUDE_DIR`) for dev / test scenarios.
+
+use std::path::PathBuf;
+
+/// Durable state directory for the current agent. Reads `HYPERHIVE_STATE_DIR`
+/// first (always set by the meta flake to `/agents/{label}/state`); falls back
+/// to the same pattern derived from `HIVE_LABEL` for dev/test environments
+/// where the env var may not be set.
+#[must_use]
+pub fn state_dir() -> PathBuf {
+    if let Some(p) = std::env::var_os("HYPERHIVE_STATE_DIR") {
+        return PathBuf::from(p);
+    }
+    let label = std::env::var("HIVE_LABEL").unwrap_or_default();
+    PathBuf::from(format!("/agents/{label}/state"))
+}
+
+/// Claude credentials directory for the current agent. Always `/root/.claude`
+/// because the `claude` CLI reads `$HOME/.claude` (uid 0 → `/root`), and
+/// hive-c0re binds the per-agent credentials dir there for every container.
+/// Overridable via `HYPERHIVE_CLAUDE_DIR` for dev / test scenarios.
+#[must_use]
+pub fn claude_dir() -> PathBuf {
+    std::env::var_os("HYPERHIVE_CLAUDE_DIR")
+        .map_or_else(|| PathBuf::from("/root/.claude"), PathBuf::from)
+}
diff --git a/hive-ag3nt/src/plugins.rs b/hive-ag3nt/src/plugins.rs
new file mode 100644
index 00000000..a75246f2
--- /dev/null
+++ b/hive-ag3nt/src/plugins.rs
@@ -0,0 +1,184 @@
+//! Boot-time `claude plugin install` driver. Reads the list declared
+//! via the `hyperhive.claudePlugins` NixOS option (rendered to
+//! `/etc/hyperhive/claude-plugins.json` by the harness module) and
+//! shells out `claude plugin install <spec>` for each entry. Runs once
+//! per harness boot before the turn loop; `claude plugin install`
+//! is expected to be idempotent so reinstalling on each container
+//! recreate is fine. Failures log a warning but do not abort boot —
+//! we'd rather start without a plugin than refuse to serve.
+//!
+//! Before installing, all configured marketplaces are updated so that
+//! plugin specs resolve against current index data. Marketplace update
+//! failures are non-fatal — stale index is better than no install attempt.
+
+use std::path::Path;
+
+use tokio::process::Command;
+
+use crate::client;
+
+const PLUGINS_PATH: &str = "/etc/hyperhive/claude-plugins.json";
+const MARKETPLACES_PATH: &str = "/etc/hyperhive/claude-marketplaces.json";
+const AUTO_UPDATE_PATH: &str = "/etc/hyperhive/claude-plugins-auto-update.json";
+
+/// Add every marketplace from `/etc/hyperhive/claude-marketplaces.json`
+/// via `claude plugin marketplace add <source>`. Idempotent: re-add of
+/// an existing marketplace is treated as success (claude prints an
+/// "already exists" message and exits non-zero on some versions).
+/// Required before any `<plugin>@<marketplace>` install can resolve.
+async fn add_marketplaces() {
+    let Ok(raw) = tokio::fs::read_to_string(MARKETPLACES_PATH).await else {
+        return;
+    };
+    let sources: Vec<String> = match serde_json::from_str(&raw) {
+        Ok(v) => v,
+        Err(e) => {
+            tracing::warn!(path = MARKETPLACES_PATH, error = ?e, "claude-marketplaces spec parse failed; skipping");
+            return;
+        }
+    };
+    for source in sources {
+        match Command::new("claude")
+            .args(["plugin", "marketplace", "add", &source])
+            .output()
+            .await
+        {
+            Ok(out) if out.status.success() => {
+                tracing::info!(source = %source, "claude plugin marketplace add ok");
+            }
+            Ok(out) => {
+                let stderr = String::from_utf8_lossy(&out.stderr);
+                if stderr.contains("already") {
+                    tracing::debug!(source = %source, "marketplace already added");
+                } else {
+                    tracing::warn!(
+                        source = %source,
+                        status = ?out.status,
+                        stderr = %stderr,
+                        "claude plugin marketplace add failed (non-fatal)",
+                    );
+                }
+            }
+            Err(e) => {
+                tracing::warn!(source = %source, error = ?e, "claude plugin marketplace add spawn failed");
+            }
+        }
+    }
+}
+
+/// Read the `hyperhive.claudePluginsAutoUpdate` flag written by the NixOS
+/// module. Defaults to `false` when the file is absent or unparseable.
+async fn auto_update_enabled() -> bool {
+    match tokio::fs::read_to_string(AUTO_UPDATE_PATH).await {
+        Ok(s) => serde_json::from_str::<bool>(s.trim()).unwrap_or(false),
+        Err(_) => false,
+    }
+}
+
+/// Update all configured plugin marketplaces. Non-fatal — logs a warning
+/// on failure but does not abort the install sequence.
+async fn update_marketplaces() {
+    match Command::new("claude")
+        .args(["plugin", "marketplace", "update"])
+        .output()
+        .await
+    {
+        Ok(out) if out.status.success() => {
+            tracing::info!("claude plugin marketplace update ok");
+        }
+        Ok(out) => {
+            tracing::warn!(
+                status = ?out.status,
+                stderr = %String::from_utf8_lossy(&out.stderr),
+                "claude plugin marketplace update failed (non-fatal)",
+            );
+        }
+        Err(e) => {
+            tracing::warn!(error = ?e, "claude plugin marketplace update spawn failed (non-fatal)");
+        }
+    }
+}
+
+/// Install every plugin in `/etc/hyperhive/claude-plugins.json`. When
+/// `notify_recipient` is `Some(name)`, install failures also get sent
+/// as a hyperhive message to that recipient (typically `"manager"` for
+/// sub-agents) so it surfaces in the inbox rather than being buried in
+/// journald. The manager itself passes `None` — there's nobody above
+/// it to notify.
+pub async fn install_configured(socket: &Path, notify_recipient: Option<&str>) {
+    let Ok(raw) = tokio::fs::read_to_string(PLUGINS_PATH).await else {
+        return;
+    };
+    let specs: Vec<String> = match serde_json::from_str(&raw) {
+        Ok(v) => v,
+        Err(e) => {
+            tracing::warn!(path = PLUGINS_PATH, error = ?e, "claude-plugins spec parse failed; skipping");
+            return;
+        }
+    };
+    if specs.is_empty() {
+        return;
+    }
+    add_marketplaces().await;
+    if auto_update_enabled().await {
+        update_marketplaces().await;
+    } else {
+        tracing::debug!("claudePluginsAutoUpdate=false, skipping marketplace update");
+    }
+    for spec in specs {
+        match Command::new("claude")
+            .args(["plugin", "install", &spec])
+            .output()
+            .await
+        {
+            Ok(out) if out.status.success() => {
+                tracing::info!(spec = %spec, "claude plugin install ok");
+            }
+            Ok(out) => {
+                let stderr = String::from_utf8_lossy(&out.stderr).into_owned();
+                tracing::warn!(
+                    spec = %spec,
+                    status = ?out.status,
+                    stderr = %stderr,
+                    "claude plugin install failed",
+                );
+                if let Some(to) = notify_recipient {
+                    notify(
+                        socket,
+                        to,
+                        format!(
+                            "claude plugin install failed for `{spec}`:\n{}",
+                            stderr.trim()
+                        ),
+                    )
+                    .await;
+                }
+            }
+            Err(e) => {
+                tracing::warn!(spec = %spec, error = ?e, "claude plugin install spawn failed");
+                if let Some(to) = notify_recipient {
+                    notify(
+                        socket,
+                        to,
+                        format!("claude plugin install spawn failed for `{spec}`: {e}"),
+                    )
+                    .await;
+                }
+            }
+        }
+    }
+}
+
+/// Best-effort hyperhive send. Swallows transport errors — the warn log
+/// is already in journald and the harness boot must not stall waiting
+/// for the broker to be reachable.
+async fn notify(socket: &Path, to: &str, body: String) {
+    let req = hive_sh4re::AgentRequest::Send {
+        to: to.to_owned(),
+        body,
+        in_reply_to: None,
+    };
+    if let Err(e) = client::request::<_, hive_sh4re::AgentResponse>(socket, &req).await {
+        tracing::warn!(error = ?e, "failed to notify {to} of plugin install failure");
+    }
+}
diff --git a/hive-ag3nt/src/serve_common.rs b/hive-ag3nt/src/serve_common.rs
new file mode 100644
index 00000000..44c80a1f
--- /dev/null
+++ b/hive-ag3nt/src/serve_common.rs
@@ -0,0 +1,93 @@
+//! Helpers shared between `hive-ag3nt` (agent) and `hive-m1nd` (manager)
+//! serve loops. Only pure functions with no wire-type dependency live here;
+//! request/response-flavored helpers (`requeue_inflight`, `ack_turn`, etc.)
+//! stay in each binary because they use different request enum variants.
+
+use crate::events::Bus;
+use crate::mcp::REDELIVERY_HINT;
+use crate::turn::TurnOutcome;
+use crate::turn_stats::TurnStatRow;
+
+/// Assemble the per-turn wake prompt string. The role/tools/etc. live in the
+/// system prompt; this is just the wake signal body. `unread` is the inbox
+/// depth after this message was popped. `redelivered` prepends a "may already
+/// be handled" banner.
+#[must_use]
+pub fn format_wake_prompt(from: &str, body: &str, unread: u64, redelivered: bool) -> String {
+    let banner = if redelivered { REDELIVERY_HINT } else { "" };
+    let pending = if unread == 0 {
+        String::new()
+    } else {
+        format!(
+            "\n\n({unread} more message(s) pending in your inbox — call `mcp__hyperhive__recv` \
+             with `max: {unread}` to drain them all in one round-trip before acting.)"
+        )
+    };
+    format!("{banner}Incoming message from `{from}`:\n---\n{body}\n---{pending}")
+}
+
+/// Current time as a Unix timestamp (seconds). Returns 0 on any error.
+#[must_use]
+pub fn now_unix() -> i64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .ok()
+        .and_then(|d| i64::try_from(d.as_secs()).ok())
+        .unwrap_or(0)
+}
+
+/// Assemble a `TurnStatRow` from the harness's per-turn state. Used by both
+/// the agent and manager serve loops — the shape is identical, only the
+/// post-turn count fetch helpers differ (and those stay in each binary).
+#[must_use]
+#[allow(clippy::too_many_arguments)]
+pub fn build_row(
+    started_at: i64,
+    ended_at: i64,
+    duration_ms: i64,
+    model: String,
+    wake_from: String,
+    outcome: &TurnOutcome,
+    bus: &Bus,
+    open_threads_count: Option<u64>,
+    open_reminders_count: Option<u64>,
+) -> TurnStatRow {
+    let cost = bus.last_cost_usage().unwrap_or_default();
+    let ctx = bus.last_ctx_usage().unwrap_or(cost);
+    let tool_calls = bus.take_tool_calls();
+    let tool_call_count: u64 = tool_calls.values().copied().sum();
+    let tool_call_breakdown_json = if tool_calls.is_empty() {
+        None
+    } else {
+        serde_json::to_string(&tool_calls).ok()
+    };
+    let (result_kind, note) = match outcome {
+        TurnOutcome::Ok => ("ok", None),
+        TurnOutcome::Compacted => ("compacted", None),
+        TurnOutcome::PromptTooLong => ("prompt_too_long", None),
+        TurnOutcome::RateLimited => ("rate_limited", None),
+        TurnOutcome::AuthFailed => ("auth_failed", None),
+        TurnOutcome::Failed(e) => ("failed", Some(format!("{e:#}"))),
+    };
+    TurnStatRow {
+        started_at,
+        ended_at,
+        duration_ms,
+        model,
+        wake_from,
+        input_tokens: cost.input_tokens,
+        output_tokens: cost.output_tokens,
+        cache_read_input_tokens: cost.cache_read_input_tokens,
+        cache_creation_input_tokens: cost.cache_creation_input_tokens,
+        last_input_tokens: ctx.input_tokens,
+        last_output_tokens: ctx.output_tokens,
+        last_cache_read_input_tokens: ctx.cache_read_input_tokens,
+        last_cache_creation_input_tokens: ctx.cache_creation_input_tokens,
+        tool_call_count,
+        tool_call_breakdown_json,
+        open_threads_count,
+        open_reminders_count,
+        result_kind,
+        note,
+    }
+}
diff --git a/hive-ag3nt/src/stats.rs b/hive-ag3nt/src/stats.rs
new file mode 100644
index 00000000..1731a20c
--- /dev/null
+++ b/hive-ag3nt/src/stats.rs
@@ -0,0 +1,557 @@
+//! Read-side aggregations over the per-agent `turn_stats.sqlite` for
+//! the agent's `/stats` web page. Owned by the agent (same process
+//! that writes the sink) so per-MCP extensions can register more
+//! providers without the host needing to know their schemas.
+//!
+//! Best-effort: any sqlite error returns an empty snapshot rather than
+//! propagating — the stats page is decorative, not authoritative, and
+//! a missing db on a brand-new agent shouldn't 500 the route.
+
+use std::collections::{HashMap, HashSet};
+use std::path::{Path, PathBuf};
+
+use anyhow::{Context, Result};
+use rusqlite::{Connection, OpenFlags};
+use serde::Serialize;
+
+use hive_sh4re::ReminderStats;
+
+/// Window param accepted by `/api/stats?window=`. Each maps to a
+/// total span + the bucket width used to roll up trend series.
+#[derive(Debug, Clone, Copy)]
+pub enum Window {
+    Hour,
+    FourHour,
+    Day,
+    ThreeDay,
+    Week,
+    Month,
+}
+
+impl Window {
+    #[must_use]
+    pub fn parse(s: &str) -> Self {
+        match s {
+            "1h" => Self::Hour,
+            "4h" => Self::FourHour,
+            "3d" => Self::ThreeDay,
+            "7d" => Self::Week,
+            "30d" => Self::Month,
+            _ => Self::Day,
+        }
+    }
+
+    fn label(self) -> &'static str {
+        match self {
+            Self::Hour => "1h",
+            Self::FourHour => "4h",
+            Self::Day => "24h",
+            Self::ThreeDay => "3d",
+            Self::Week => "7d",
+            Self::Month => "30d",
+        }
+    }
+
+    #[must_use]
+    pub fn span_secs(self) -> i64 {
+        match self {
+            Self::Hour => 3600,
+            Self::FourHour => 4 * 3600,
+            Self::Day => 24 * 3600,
+            Self::ThreeDay => 3 * 24 * 3600,
+            Self::Week => 7 * 24 * 3600,
+            Self::Month => 30 * 24 * 3600,
+        }
+    }
+
+    fn bucket_secs(self) -> i64 {
+        match self {
+            // 5-min buckets for 1h (12 buckets), 15-min for 4h (16 buckets),
+            // hourly for 24h + 3d, daily for 7d + 30d.
+            Self::Hour => 300,
+            Self::FourHour => 900,
+            Self::Day | Self::ThreeDay => 3600,
+            Self::Week | Self::Month => 24 * 3600,
+        }
+    }
+}
+
+#[derive(Debug, Serialize)]
+pub struct Snapshot {
+    pub window: &'static str,
+    pub bucket_seconds: i64,
+    pub now: i64,
+    pub from: i64,
+    /// Total turns in the window.
+    pub turn_count: u64,
+    /// Time-bucketed trend series, oldest first. Always covers the
+    /// full window even for empty buckets (so charts paint a stable
+    /// x-axis instead of skipping gaps).
+    pub buckets: Vec<Bucket>,
+    /// Top tools by call count across the window. Capped to 10.
+    pub tool_breakdown: Vec<KeyCount>,
+    pub wake_mix: Vec<KeyCount>,
+    pub result_mix: Vec<KeyCount>,
+    /// Distinct models seen in the window, sorted. Each bucket's
+    /// `model_counts` keys into this set; the stats page uses it as
+    /// the stacked-bar series list (stable order + colours).
+    pub models: Vec<String>,
+    /// Across-window p50 / p95 / avg of `duration_ms`. Same numbers
+    /// as the per-bucket fields but aggregated over the whole window
+    /// for the headline summary chips.
+    pub duration_summary: DurationSummary,
+    /// Reminder activity stats: counts of scheduled, delivered, and
+    /// pending reminders over the window (fetched from the broker RPC).
+    /// None if the RPC call failed or hasn't been integrated yet.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub reminder_stats: Option<ReminderStats>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct Bucket {
+    /// Unix timestamp of the bucket start.
+    pub ts: i64,
+    pub turn_count: u64,
+    pub avg_duration_ms: f64,
+    pub p50_duration_ms: f64,
+    pub p95_duration_ms: f64,
+    /// Sums across the bucket. JS picks how to combine them
+    /// (input + output for cost, etc.) so we don't bake a policy in.
+    pub input_tokens: u64,
+    pub output_tokens: u64,
+    pub cache_read_input_tokens: u64,
+    pub cache_creation_input_tokens: u64,
+    /// Mean of `last_input_tokens` across the bucket (the context
+    /// size at turn-end — useful for spotting drift toward compaction).
+    pub avg_ctx_tokens: f64,
+    pub max_ctx_tokens: u64,
+    /// Turn count per model in this bucket. Model choice greatly
+    /// affects token cost, so this lets the operator line model usage
+    /// up against the cost series over time.
+    pub model_counts: HashMap<String, u64>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct KeyCount {
+    pub key: String,
+    pub count: u64,
+}
+
+#[derive(Debug, Default, Serialize)]
+pub struct DurationSummary {
+    pub avg_ms: f64,
+    pub p50_ms: f64,
+    pub p95_ms: f64,
+}
+
+#[must_use]
+pub fn snapshot_default(window: Window) -> Snapshot {
+    let path = default_path();
+    match snapshot(&path, window) {
+        Ok(s) => s,
+        Err(e) => {
+            tracing::warn!(error = ?e, path = %path.display(), "stats: snapshot failed");
+            empty_snapshot(window)
+        }
+    }
+}
+
+fn default_path() -> PathBuf {
+    crate::paths::state_dir().join("hyperhive-turn-stats.sqlite")
+}
+
+fn empty_snapshot(window: Window) -> Snapshot {
+    let now = now_secs();
+    let from = now - window.span_secs();
+    let buckets = fill_buckets(from, now, window.bucket_secs(), &HashMap::new());
+    Snapshot {
+        window: window.label(),
+        bucket_seconds: window.bucket_secs(),
+        now,
+        from,
+        turn_count: 0,
+        buckets,
+        tool_breakdown: Vec::new(),
+        wake_mix: Vec::new(),
+        result_mix: Vec::new(),
+        models: Vec::new(),
+        duration_summary: DurationSummary::default(),
+        reminder_stats: None,
+    }
+}
+
+fn snapshot(path: &Path, window: Window) -> Result<Snapshot> {
+    // Read-only open so an in-flight writer (the harness's own
+    // turn_stats sink) never blocks us and we can't corrupt the db
+    // via a query bug.
+    let conn = Connection::open_with_flags(path, OpenFlags::SQLITE_OPEN_READ_ONLY)
+        .with_context(|| format!("open {} read-only", path.display()))?;
+    let now = now_secs();
+    let from = now - window.span_secs();
+    let bucket_secs = window.bucket_secs();
+
+    let mut stmt = conn.prepare(
+        "SELECT started_at, duration_ms,
+                input_tokens, output_tokens,
+                cache_read_input_tokens, cache_creation_input_tokens,
+                last_input_tokens,
+                tool_call_breakdown_json,
+                wake_from, result_kind, model
+         FROM turn_stats
+         WHERE started_at >= ?1
+         ORDER BY started_at ASC",
+    )?;
+    let rows = stmt.query_map([from], |row| {
+        Ok(Row {
+            started_at: row.get(0)?,
+            duration_ms: row.get::<_, i64>(1)?,
+            input_tokens: u64_from_i64(row.get::<_, i64>(2)?),
+            output_tokens: u64_from_i64(row.get::<_, i64>(3)?),
+            cache_read_input_tokens: u64_from_i64(row.get::<_, i64>(4)?),
+            cache_creation_input_tokens: u64_from_i64(row.get::<_, i64>(5)?),
+            last_input_tokens: u64_from_i64(row.get::<_, i64>(6)?),
+            tool_breakdown_json: row.get::<_, Option<String>>(7)?,
+            wake_from: row.get::<_, String>(8)?,
+            result_kind: row.get::<_, String>(9)?,
+            model: row.get::<_, String>(10)?,
+        })
+    })?;
+
+    let mut by_bucket: HashMap<i64, BucketAcc> = HashMap::new();
+    let mut tool_totals: HashMap<String, u64> = HashMap::new();
+    let mut wake_totals: HashMap<String, u64> = HashMap::new();
+    let mut result_totals: HashMap<String, u64> = HashMap::new();
+    let mut model_set: HashSet<String> = HashSet::new();
+    let mut all_durations: Vec<i64> = Vec::new();
+    let mut turn_count: u64 = 0;
+
+    for r in rows {
+        let r = r?;
+        turn_count += 1;
+        let bucket_ts = (r.started_at / bucket_secs) * bucket_secs;
+        let acc = by_bucket.entry(bucket_ts).or_default();
+        acc.turn_count += 1;
+        acc.durations.push(r.duration_ms.max(0));
+        acc.input_tokens = acc.input_tokens.saturating_add(r.input_tokens);
+        acc.output_tokens = acc.output_tokens.saturating_add(r.output_tokens);
+        acc.cache_read_input_tokens = acc
+            .cache_read_input_tokens
+            .saturating_add(r.cache_read_input_tokens);
+        acc.cache_creation_input_tokens = acc
+            .cache_creation_input_tokens
+            .saturating_add(r.cache_creation_input_tokens);
+        acc.ctx_sum = acc.ctx_sum.saturating_add(r.last_input_tokens);
+        acc.ctx_max = acc.ctx_max.max(r.last_input_tokens);
+        *acc.model_counts.entry(r.model.clone()).or_insert(0) += 1;
+
+        all_durations.push(r.duration_ms.max(0));
+        *wake_totals.entry(r.wake_from).or_insert(0) += 1;
+        *result_totals.entry(r.result_kind).or_insert(0) += 1;
+        model_set.insert(r.model);
+
+        if let Some(json) = r.tool_breakdown_json
+            && let Ok(map) = serde_json::from_str::<HashMap<String, u64>>(&json)
+        {
+            for (k, v) in map {
+                *tool_totals.entry(k).or_insert(0) += v;
+            }
+        }
+    }
+
+    let buckets = fill_buckets(from, now, bucket_secs, &by_bucket);
+    let duration_summary = summarize_durations(&mut all_durations);
+    let mut models: Vec<String> = model_set.into_iter().collect();
+    models.sort_unstable();
+
+    Ok(Snapshot {
+        window: window.label(),
+        bucket_seconds: bucket_secs,
+        now,
+        from,
+        turn_count,
+        buckets,
+        tool_breakdown: top_n(tool_totals, 10),
+        wake_mix: top_n(wake_totals, 20),
+        result_mix: top_n(result_totals, 20),
+        models,
+        duration_summary,
+        reminder_stats: None, // TODO: fetch via ReminderRollup RPC
+    })
+}
+
+struct Row {
+    started_at: i64,
+    duration_ms: i64,
+    input_tokens: u64,
+    output_tokens: u64,
+    cache_read_input_tokens: u64,
+    cache_creation_input_tokens: u64,
+    last_input_tokens: u64,
+    tool_breakdown_json: Option<String>,
+    wake_from: String,
+    result_kind: String,
+    model: String,
+}
+
+#[derive(Default)]
+struct BucketAcc {
+    turn_count: u64,
+    durations: Vec<i64>,
+    input_tokens: u64,
+    output_tokens: u64,
+    cache_read_input_tokens: u64,
+    cache_creation_input_tokens: u64,
+    ctx_sum: u64,
+    ctx_max: u64,
+    model_counts: HashMap<String, u64>,
+}
+
+fn fill_buckets(
+    from: i64,
+    now: i64,
+    bucket_secs: i64,
+    by_bucket: &HashMap<i64, BucketAcc>,
+) -> Vec<Bucket> {
+    let start = (from / bucket_secs) * bucket_secs;
+    let mut out = Vec::new();
+    let mut ts = start;
+    while ts <= now {
+        let bucket = if let Some(acc) = by_bucket.get(&ts) {
+            let mut sorted = acc.durations.clone();
+            sorted.sort_unstable();
+            let avg = if sorted.is_empty() {
+                0.0
+            } else {
+                #[allow(clippy::cast_precision_loss)]
+                let sum_f = sorted.iter().sum::<i64>() as f64;
+                #[allow(clippy::cast_precision_loss)]
+                let len_f = sorted.len() as f64;
+                sum_f / len_f
+            };
+            let p50 = percentile(&sorted, 50);
+            let p95 = percentile(&sorted, 95);
+            let avg_ctx = if acc.turn_count == 0 {
+                0.0
+            } else {
+                #[allow(clippy::cast_precision_loss)]
+                let sum_f = acc.ctx_sum as f64;
+                #[allow(clippy::cast_precision_loss)]
+                let cnt_f = acc.turn_count as f64;
+                sum_f / cnt_f
+            };
+            Bucket {
+                ts,
+                turn_count: acc.turn_count,
+                avg_duration_ms: avg,
+                p50_duration_ms: p50,
+                p95_duration_ms: p95,
+                input_tokens: acc.input_tokens,
+                output_tokens: acc.output_tokens,
+                cache_read_input_tokens: acc.cache_read_input_tokens,
+                cache_creation_input_tokens: acc.cache_creation_input_tokens,
+                avg_ctx_tokens: avg_ctx,
+                max_ctx_tokens: acc.ctx_max,
+                model_counts: acc.model_counts.clone(),
+            }
+        } else {
+            Bucket {
+                ts,
+                turn_count: 0,
+                avg_duration_ms: 0.0,
+                p50_duration_ms: 0.0,
+                p95_duration_ms: 0.0,
+                input_tokens: 0,
+                output_tokens: 0,
+                cache_read_input_tokens: 0,
+                cache_creation_input_tokens: 0,
+                avg_ctx_tokens: 0.0,
+                max_ctx_tokens: 0,
+                model_counts: HashMap::new(),
+            }
+        };
+        out.push(bucket);
+        ts += bucket_secs;
+    }
+    out
+}
+
+fn summarize_durations(all: &mut [i64]) -> DurationSummary {
+    if all.is_empty() {
+        return DurationSummary::default();
+    }
+    all.sort_unstable();
+    #[allow(clippy::cast_precision_loss)]
+    let sum_f = all.iter().sum::<i64>() as f64;
+    #[allow(clippy::cast_precision_loss)]
+    let len_f = all.len() as f64;
+    DurationSummary {
+        avg_ms: sum_f / len_f,
+        p50_ms: percentile(all, 50),
+        p95_ms: percentile(all, 95),
+    }
+}
+
+#[allow(clippy::cast_precision_loss, clippy::cast_possible_truncation, clippy::cast_sign_loss)]
+fn percentile(sorted: &[i64], pct: u8) -> f64 {
+    if sorted.is_empty() {
+        return 0.0;
+    }
+    if sorted.len() == 1 {
+        return sorted[0] as f64;
+    }
+    // Nearest-rank, clamped.
+    let rank = ((f64::from(pct) / 100.0) * (sorted.len() as f64 - 1.0)).round() as usize;
+    sorted[rank.min(sorted.len() - 1)] as f64
+}
+
+fn top_n(map: HashMap<String, u64>, n: usize) -> Vec<KeyCount> {
+    let mut v: Vec<KeyCount> = map
+        .into_iter()
+        .map(|(key, count)| KeyCount { key, count })
+        .collect();
+    v.sort_unstable_by(|a, b| b.count.cmp(&a.count).then_with(|| a.key.cmp(&b.key)));
+    v.truncate(n);
+    v
+}
+
+fn u64_from_i64(v: i64) -> u64 {
+    u64::try_from(v).unwrap_or(0)
+}
+
+fn now_secs() -> i64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map_or(0, |d| i64::try_from(d.as_secs()).unwrap_or(i64::MAX))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use rusqlite::params;
+    use std::sync::atomic::{AtomicU32, Ordering};
+
+    static SEQ: AtomicU32 = AtomicU32::new(0);
+
+    fn tmp_db() -> PathBuf {
+        let n = SEQ.fetch_add(1, Ordering::SeqCst);
+        let pid = std::process::id();
+        std::env::temp_dir().join(format!("hyperhive-stats-test-{pid}-{n}.sqlite"))
+    }
+
+    fn seed_db(path: &Path, rows: &[(i64, i64, &str, &str, &str, &str)]) {
+        let conn = Connection::open(path).unwrap();
+        conn.execute_batch(
+            "CREATE TABLE turn_stats (
+                id INTEGER PRIMARY KEY,
+                started_at INTEGER NOT NULL,
+                ended_at INTEGER NOT NULL,
+                duration_ms INTEGER NOT NULL,
+                model TEXT NOT NULL,
+                wake_from TEXT NOT NULL,
+                input_tokens INTEGER NOT NULL DEFAULT 0,
+                output_tokens INTEGER NOT NULL DEFAULT 0,
+                cache_read_input_tokens INTEGER NOT NULL DEFAULT 0,
+                cache_creation_input_tokens INTEGER NOT NULL DEFAULT 0,
+                last_input_tokens INTEGER NOT NULL DEFAULT 0,
+                last_output_tokens INTEGER NOT NULL DEFAULT 0,
+                last_cache_read_input_tokens INTEGER NOT NULL DEFAULT 0,
+                last_cache_creation_input_tokens INTEGER NOT NULL DEFAULT 0,
+                tool_call_count INTEGER NOT NULL DEFAULT 0,
+                tool_call_breakdown_json TEXT,
+                open_threads_count INTEGER,
+                open_reminders_count INTEGER,
+                result_kind TEXT NOT NULL,
+                note TEXT
+            );",
+        )
+        .unwrap();
+        for (started, dur, model, wake, result, tools_json) in rows {
+            conn.execute(
+                "INSERT INTO turn_stats
+                    (started_at, ended_at, duration_ms, model, wake_from,
+                     last_input_tokens, tool_call_breakdown_json, result_kind)
+                 VALUES (?1, ?2, ?3, ?4, ?5, 1000, ?6, ?7)",
+                params![started, started + dur / 1000, dur, model, wake, tools_json, result],
+            )
+            .unwrap();
+        }
+    }
+
+    #[test]
+    fn snapshot_aggregates_rows() {
+        let db = tmp_db();
+        let _ = std::fs::remove_file(&db);
+        let now = now_secs();
+        seed_db(
+            &db,
+            &[
+                (now - 600, 5_000, "opus", "recv", "ok", r#"{"Read":2,"Bash":1}"#),
+                (now - 300, 10_000, "opus", "recv", "ok", r#"{"Read":3}"#),
+                (now - 100, 20_000, "sonnet", "operator", "failed", "{}"),
+            ],
+        );
+        let s = snapshot(&db, Window::Day).unwrap();
+        assert_eq!(s.turn_count, 3);
+        assert_eq!(s.window, "24h");
+        assert_eq!(s.bucket_seconds, 3600);
+        let tool_map: HashMap<_, _> = s
+            .tool_breakdown
+            .iter()
+            .map(|kc| (kc.key.clone(), kc.count))
+            .collect();
+        assert_eq!(tool_map.get("Read").copied(), Some(5));
+        assert_eq!(tool_map.get("Bash").copied(), Some(1));
+        let wake_map: HashMap<_, _> = s
+            .wake_mix
+            .iter()
+            .map(|kc| (kc.key.clone(), kc.count))
+            .collect();
+        assert_eq!(wake_map.get("recv").copied(), Some(2));
+        assert_eq!(wake_map.get("operator").copied(), Some(1));
+        let result_map: HashMap<_, _> = s
+            .result_mix
+            .iter()
+            .map(|kc| (kc.key.clone(), kc.count))
+            .collect();
+        assert_eq!(result_map.get("ok").copied(), Some(2));
+        assert_eq!(result_map.get("failed").copied(), Some(1));
+        // Model breakdown: 2 opus + 1 sonnet, all in the same hour
+        // bucket given the 24h window.
+        assert_eq!(s.models, vec!["opus".to_string(), "sonnet".to_string()]);
+        let mut model_totals: HashMap<String, u64> = HashMap::new();
+        for b in &s.buckets {
+            for (k, v) in &b.model_counts {
+                *model_totals.entry(k.clone()).or_insert(0) += v;
+            }
+        }
+        assert_eq!(model_totals.get("opus").copied(), Some(2));
+        assert_eq!(model_totals.get("sonnet").copied(), Some(1));
+        // Durations: [5000, 10000, 20000] → avg ≈ 11666.67, p50 = 10000, p95 ~ 20000
+        assert!((s.duration_summary.avg_ms - 11_666.666_666_666_666).abs() < 1.0);
+        assert!((s.duration_summary.p50_ms - 10_000.0).abs() < 1.0);
+        assert!((s.duration_summary.p95_ms - 20_000.0).abs() < 1.0);
+    }
+
+    #[test]
+    fn empty_window_still_paints_buckets() {
+        let db = tmp_db();
+        let _ = std::fs::remove_file(&db);
+        seed_db(&db, &[]);
+        let s = snapshot(&db, Window::Day).unwrap();
+        assert_eq!(s.turn_count, 0);
+        // 24h / 1h buckets = ~24-25 buckets covering the window.
+        assert!(s.buckets.len() >= 24);
+        assert!(s.buckets.iter().all(|b| b.turn_count == 0));
+    }
+
+    #[test]
+    fn week_uses_daily_buckets() {
+        let db = tmp_db();
+        let _ = std::fs::remove_file(&db);
+        seed_db(&db, &[]);
+        let s = snapshot(&db, Window::Week).unwrap();
+        assert_eq!(s.window, "7d");
+        assert_eq!(s.bucket_seconds, 86_400);
+        assert!(s.buckets.len() >= 7);
+    }
+}
diff --git a/hive-ag3nt/src/turn.rs b/hive-ag3nt/src/turn.rs
new file mode 100644
index 00000000..73fa2cbd
--- /dev/null
+++ b/hive-ag3nt/src/turn.rs
@@ -0,0 +1,753 @@
+//! Per-turn claude invocation shared by `hive-ag3nt` and `hive-m1nd`. The
+//! two binaries differ only in their MCP `Flavor` (agent surface vs.
+//! manager surface) and their wake-prompt wording; the spawn shape,
+//! arg-vector, stdin plumbing, and stream-json pumping are identical.
+
+use std::collections::VecDeque;
+use std::path::{Path, PathBuf};
+use std::process::Stdio;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+
+use anyhow::{Result, bail};
+use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
+use tokio::process::Command;
+
+use crate::events::{Bus, LiveEvent};
+use crate::login::{self, LoginState};
+use crate::mcp;
+
+/// `--settings` JSON applied to every claude invocation. Lives as a
+/// properly-formatted file in `prompts/claude-settings.json` so it's easy
+/// to read and edit; we ship it via `include_str!`. We turn off claude's
+/// in-session auto-compaction and its cross-session auto-memory because
+/// hyperhive owns those concerns (`/compact` on overflow, notes
+/// persistence under `/state`). Unknown keys are silently ignored by
+/// claude-code; if a key gets renamed we'll spot it because the
+/// corresponding behavior will start firing mid-turn again.
+const CLAUDE_SETTINGS: &str = include_str!("../prompts/claude-settings.json");
+
+/// Regex-ish marker claude-code emits when context overflows. Same string
+/// bitburner-agent watches for. Empirically reliable across claude-code
+/// versions; if it ever changes, compaction won't fire and we'll see a
+/// claude exit with a useful error in the live view.
+const PROMPT_TOO_LONG_MARKER: &str = "Prompt is too long";
+
+/// Substrings that indicate the Anthropic API is refusing the request due
+/// to a rate limit, per-account usage cap, or exhausted credit balance.
+/// Matched against both stdout and stderr; any hit returns
+/// `TurnOutcome::RateLimited` so the serve loop can park + retry instead
+/// of propagating a hard failure that looks identical to a crash.
+const RATE_LIMIT_MARKERS: &[&str] = &[
+    "rate_limit_error",
+    "overloaded_error",
+    "Credit balance is too low",
+    "Usage limit reached",
+    "Request rate limit exceeded",
+];
+
+/// Substrings that indicate the Anthropic API rejected the request as
+/// unauthenticated — the OAuth session in `/root/.claude/` has expired
+/// or been revoked. Surfaced as `TurnOutcome::AuthFailed`, which the
+/// harness uses to flip the container into `needs_login_idle` so the
+/// dashboard's re-auth flow takes over (closes #419). Matched against
+/// both stdout JSON `error` events and stderr; the markers come from
+/// claude-code's `api_retry` events (`{"error":"authentication_failed",
+/// "error_status":401,...}`) and the human-readable
+/// "Failed to authenticate. API Error: 401" line claude prints on giveup.
+const AUTH_FAIL_MARKERS: &[&str] = &[
+    "\"error\":\"authentication_failed\"",
+    "\"error_status\":401",
+    "Failed to authenticate. API Error: 401",
+];
+
+/// How long to sleep after detecting a rate-limit before re-entering the
+/// serve loop. Overridable via `HIVE_RATE_LIMIT_SLEEP_SECS`. Default is
+/// 5 minutes — enough for most short-lived throttles; the operator can
+/// tune down for tight retry scenarios or up if they're hitting sustained
+/// capacity limits.
+const DEFAULT_RATE_LIMIT_SLEEP_SECS: u64 = 300;
+
+/// Assumed prompt-cache TTL. Claude caches prompt prefixes — ~5 minutes on
+/// the API (pay-per-token), ~1 hour on Claude Max (subscription). When the
+/// idle gap exceeds this, the cache prefix has likely expired and the next
+/// turn re-uploads the full transcript regardless of whether we resume or
+/// start fresh. A fresh session with a small context is therefore equally
+/// cheap but gives the model a clean slate. Default is 3600s (1h) matching
+/// the subscription TTL; API (pay-per-token) users should set
+/// `HIVE_CACHE_TTL_SECS=300`. Override via `HIVE_CACHE_TTL_SECS`; set to
+/// `0` to disable (always resume).
+const DEFAULT_CACHE_TTL_SECS: u64 = 3600;
+
+/// Synthetic wake prompt for the proactive notes-checkpoint turn. Not an
+/// inbox message — the harness injects it directly so the agent gets one
+/// turn to persist durable state before `/compact` collapses the
+/// turn-by-turn history into a summary.
+const CHECKPOINT_PROMPT: &str = "[system] Context checkpoint — no inbox message to handle.\n\n\
+Your conversation context has grown large and the harness is about to run `/compact`, \
+which collapses the detailed turn-by-turn history into a short summary. Anything you \
+do not persist now is effectively lost after the next turn.\n\n\
+Use THIS turn to flush anything worth keeping into your durable `/state` files: update \
+your notes / CLAUDE.md / TODO.md with in-flight task state, decisions made, important \
+file paths, and whatever you would need to resume cleanly with only a summary of this \
+conversation to go on. Do not start new work or reply to anyone — just write your notes \
+and end the turn.";
+
+/// The set of files claude reads on every invocation: the MCP server
+/// config (`--mcp-config`), static settings (`--settings`), and the
+/// pre-rendered role/tools system prompt (`--system-prompt-file`).
+/// Materialised once at harness startup; shared between the turn loop
+/// and the operator-driven `/compact` path so both invocations look
+/// identical to claude (same MCP surface, same allowed tools, same
+/// role prompt — only the stdin payload differs).
+#[derive(Clone)]
+pub struct TurnFiles {
+    pub mcp_config: PathBuf,
+    pub settings: PathBuf,
+    pub system_prompt: PathBuf,
+    pub flavor: mcp::Flavor,
+}
+
+impl TurnFiles {
+    /// Write all three files into the per-agent runtime dir alongside
+    /// `socket`. Idempotent — overwrites whatever was there.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if any of the config files cannot be written to disk.
+    pub async fn prepare(socket: &Path, label: &str, flavor: mcp::Flavor) -> Result<Self> {
+        Ok(Self {
+            mcp_config: write_mcp_config(socket).await?,
+            settings: write_settings(socket).await?,
+            system_prompt: write_system_prompt(socket, label, flavor).await?,
+            flavor,
+        })
+    }
+}
+
+/// Drop the MCP config blob claude reads from `--mcp-config <path>`.
+/// `socket` is the hyperhive per-container socket (forwarded to the child
+/// as `--socket <path>`); `binary_subcommand` is e.g. `"mcp"` for sub-agents
+/// or `"mcp"` for the manager (both binaries name their MCP subcommand the
+/// same — the differentiator is which binary `/proc/self/exe` resolves to).
+///
+/// # Errors
+///
+/// Returns an error if the config file cannot be written.
+pub async fn write_mcp_config(socket: &Path) -> Result<PathBuf> {
+    let parent = socket.parent().unwrap_or_else(|| Path::new("/run/hive"));
+    tokio::fs::create_dir_all(parent).await.ok();
+    let path = parent.join("claude-mcp-config.json");
+    let exe = std::env::current_exe()
+        .ok()
+        .map_or_else(|| "hive-ag3nt".into(), |p| p.display().to_string());
+    let body = mcp::render_claude_config(&exe, socket);
+    tokio::fs::write(&path, body).await?;
+    tracing::info!(path = %path.display(), "wrote claude MCP config");
+    Ok(path)
+}
+
+/// Drop the static `--settings` JSON next to the MCP config so we can
+/// pass a path (`--settings <file>`) instead of an ever-growing inline
+/// blob — the CLI argv has a finite length budget.
+///
+/// # Errors
+///
+/// Returns an error if the settings file cannot be written.
+pub async fn write_settings(socket: &Path) -> Result<PathBuf> {
+    let parent = socket.parent().unwrap_or_else(|| Path::new("/run/hive"));
+    tokio::fs::create_dir_all(parent).await.ok();
+    let path = parent.join("claude-settings.json");
+    tokio::fs::write(&path, CLAUDE_SETTINGS).await?;
+    tracing::info!(path = %path.display(), "wrote claude settings");
+    Ok(path)
+}
+
+/// Write the agent's / manager's static system prompt to a file next to
+/// the MCP config and return the path. Passed to claude via
+/// `--system-prompt-file`, replacing claude's default system prompt with
+/// the role + tools instructions. Per-turn prompts become much smaller
+/// (just the wake message body).
+///
+/// # Errors
+///
+/// Returns an error if the system prompt file cannot be written.
+pub async fn write_system_prompt(
+    socket: &Path,
+    label: &str,
+    flavor: mcp::Flavor,
+) -> Result<PathBuf> {
+    let parent = socket.parent().unwrap_or_else(|| Path::new("/run/hive"));
+    tokio::fs::create_dir_all(parent).await.ok();
+    let template = match flavor {
+        mcp::Flavor::Agent => include_str!("../prompts/agent.md"),
+        mcp::Flavor::Manager => include_str!("../prompts/manager.md"),
+    };
+    let pronouns = std::env::var("HIVE_OPERATOR_PRONOUNS").unwrap_or_else(|_| "she/her".to_owned());
+    let body = template
+        .replace("{label}", label)
+        .replace("{operator_pronouns}", &pronouns);
+    let path = parent.join("claude-system-prompt.md");
+    tokio::fs::write(&path, body).await?;
+    tracing::info!(path = %path.display(), "wrote claude system prompt");
+    Ok(path)
+}
+
+/// One claude turn's outcome. The harness uses this to decide whether to
+/// transparently kick off a compaction and retry.
+#[derive(Debug)]
+pub enum TurnOutcome {
+    Ok,
+    /// Turn completed and proactive context-size compaction fired afterwards.
+    /// Treated like `Ok` for ack and failure-notification purposes; recorded
+    /// as `result_kind = "compacted"` in turn stats so the stats page can
+    /// distinguish normal turns from turns that triggered a compaction.
+    Compacted,
+    /// claude saw "Prompt is too long" — the session needs compacting.
+    /// Run `compact_session()` then retry the same wake-up prompt.
+    PromptTooLong,
+    /// The Anthropic API refused the request due to a rate limit, per-account
+    /// usage cap, or exhausted credit balance. The serve loop should park for
+    /// `rate_limit_sleep_secs()` and retry — NOT bubble up as a crash.
+    RateLimited,
+    /// The Anthropic API rejected the request with 401 (OAuth session
+    /// expired or revoked). The serve loop should flip the container
+    /// into `needs_login_idle` and stop driving turns until the
+    /// operator re-auths via the per-agent web UI (closes #419).
+    AuthFailed,
+    Failed(anyhow::Error),
+}
+
+/// How long to sleep after a rate-limit before re-entering the serve loop.
+/// Reads `HIVE_RATE_LIMIT_SLEEP_SECS` if set to a valid positive integer.
+#[must_use]
+pub fn rate_limit_sleep_secs() -> u64 {
+    std::env::var("HIVE_RATE_LIMIT_SLEEP_SECS")
+        .ok()
+        .and_then(|s| s.trim().parse::<u64>().ok())
+        .filter(|&v| v > 0)
+        .unwrap_or(DEFAULT_RATE_LIMIT_SLEEP_SECS)
+}
+
+/// Resolve the effective context-window size for watermark calculations.
+/// Priority order (first wins):
+/// 1. API-reported window from the last `result` event's `modelUsage.*.contextWindow`.
+/// 2. `HIVE_CONTEXT_WINDOW_TOKENS_*` env vars (Nix-configured per-model defaults).
+/// 3. Hard fallback: 200 000.
+///
+/// The API-reported window is the authoritative per-inference active
+/// context limit. It reflects what the model actually enforces — which
+/// for models with large prompt caches (e.g. 1 M total cache) may be
+/// significantly smaller than the cache capacity (e.g. 200 k active window
+/// for `claude-sonnet-4-6`).
+fn effective_context_window(bus: &Bus) -> u64 {
+    bus.api_context_window()
+        .unwrap_or_else(|| crate::events::context_window_tokens(&bus.model()))
+}
+
+/// Resolve the auto-reset watermark. Priority order:
+/// 1. `HIVE_AUTO_RESET_WATERMARK_TOKENS` env var (explicit override).
+/// 2. 50% of `effective_context_window(bus)`.
+/// `0` disables auto-reset entirely.
+fn auto_reset_watermark_tokens(bus: &Bus) -> u64 {
+    if let Some(v) = std::env::var("HIVE_AUTO_RESET_WATERMARK_TOKENS")
+        .ok()
+        .and_then(|s| s.trim().parse::<u64>().ok())
+    {
+        return v;
+    }
+    effective_context_window(bus) / 2
+}
+
+/// Resolve the assumed cache TTL: `HIVE_CACHE_TTL_SECS` if set, else
+/// `DEFAULT_CACHE_TTL_SECS`.
+fn cache_ttl_secs() -> u64 {
+    std::env::var("HIVE_CACHE_TTL_SECS")
+        .ok()
+        .and_then(|s| s.trim().parse::<u64>().ok())
+        .filter(|&v| v > 0)
+        .unwrap_or(DEFAULT_CACHE_TTL_SECS)
+}
+
+/// Resolve the proactive-compaction watermark. Priority order:
+/// 1. `HIVE_COMPACT_WATERMARK_TOKENS` env var (explicit override).
+/// 2. 75% of `effective_context_window(bus)`.
+/// `0` disables proactive compaction (reactive path still applies).
+fn compact_watermark_tokens(bus: &Bus) -> u64 {
+    if let Some(v) = std::env::var("HIVE_COMPACT_WATERMARK_TOKENS")
+        .ok()
+        .and_then(|s| s.trim().parse::<u64>().ok())
+    {
+        return v;
+    }
+    effective_context_window(bus) * 3 / 4
+}
+
+/// Drive one turn end-to-end. Three paths layer on top of the raw `run_turn`:
+///
+/// - **Auto-reset (pre-turn)** — context is large AND the prompt cache has
+///   gone cold (idle gap ≥ cache TTL). Resuming would re-upload the full
+///   transcript uncached at the same cost as a fresh start. The harness runs
+///   one checkpoint turn (agent flushes state), then arms a one-shot
+///   `request_new_session` so the actual turn starts fresh.
+/// - **Reactive (on overflow)** — `run_turn` returns `PromptTooLong`: the
+///   session is already past the context window and *no* turn can run on it,
+///   so we compact immediately and retry the same wake-up prompt once. No
+///   notes-checkpoint turn is possible here — the detail is gone.
+/// - **Proactive (post-turn)** — the turn finished cleanly but its context
+///   size has crept past the watermark: while the session is still healthy we
+///   give the agent one dedicated turn to checkpoint its `/state` notes, then
+///   compact. This keeps a later turn from hitting the reactive path (where
+///   there is no chance to save anything first).
+///
+/// Both the sub-agent and manager loops call this.
+pub async fn drive_turn(prompt: &str, files: &TurnFiles, bus: &Bus) -> TurnOutcome {
+    maybe_auto_reset(bus);
+    let outcome = match run_turn(prompt, files, bus).await {
+        TurnOutcome::PromptTooLong => {
+            // Compact has its own three-flag surface (it's the same claude
+            // binary). Treat any non-Ok outcome the same as if `run_turn`
+            // had returned it — the serve loop already knows what to do
+            // with each variant, no point re-wrapping. PromptTooLong from
+            // /compact itself would be absurd recursion; bubble it up as
+            // a normal failure path.
+            match compact_session(files, bus).await {
+                TurnOutcome::Ok | TurnOutcome::Compacted => {
+                    run_turn(prompt, files, bus).await
+                }
+                other => return other,
+            }
+        }
+        // Rate-limited: no point retrying immediately — bubble up so the
+        // serve loop can park + emit status before the next attempt.
+        TurnOutcome::RateLimited => return TurnOutcome::RateLimited,
+        other => other,
+    };
+    // Proactive: a turn just completed on a still-healthy session. If its
+    // context crossed the watermark, checkpoint + compact before a later
+    // turn overflows into the reactive path. Best-effort — never changes
+    // the outcome of the turn that already succeeded, but records it as
+    // `Compacted` so turn stats can distinguish it from a plain `Ok`.
+    if matches!(outcome, TurnOutcome::Ok)
+        && maybe_checkpoint_and_compact(files, bus).await {
+            return TurnOutcome::Compacted;
+        }
+    outcome
+}
+
+/// Proactive post-turn compaction. If the last inference's context size
+/// has crossed the watermark, run one notes-checkpoint turn so the agent
+/// can persist durable state, then `/compact`. Best-effort: a failed
+/// checkpoint or compaction is logged + surfaced as a Note but never
+/// fails the turn that already succeeded. Returns `true` if compaction
+/// was attempted (watermark crossed), `false` if skipped.
+async fn maybe_checkpoint_and_compact(files: &TurnFiles, bus: &Bus) -> bool {
+    let watermark = compact_watermark_tokens(bus);
+    if watermark == 0 {
+        return false; // proactive compaction disabled
+    }
+    let Some(used) = bus.last_ctx_usage().map(|u| u.context_tokens()) else {
+        return false; // no usage reading yet — nothing to compare against
+    };
+    if used < watermark {
+        return false;
+    }
+    bus.emit(LiveEvent::Note {
+        text: format!(
+            "context at {used} tokens (watermark {watermark}) — running a \
+             notes-checkpoint turn before /compact"
+        ),
+    });
+    // Give the agent one turn to flush durable state into /state. If the
+    // session is somehow already too far gone to run even this, fall
+    // through to compaction anyway — the checkpoint is best-effort.
+    match run_turn(CHECKPOINT_PROMPT, files, bus).await {
+        TurnOutcome::Ok | TurnOutcome::Compacted => {}
+        TurnOutcome::PromptTooLong => bus.emit(LiveEvent::Note {
+            text: "checkpoint turn overflowed the window — compacting without it".into(),
+        }),
+        TurnOutcome::RateLimited => bus.emit(LiveEvent::Note {
+            text: "checkpoint turn was rate-limited — compacting anyway".into(),
+        }),
+        TurnOutcome::AuthFailed => bus.emit(LiveEvent::Note {
+            text: "checkpoint turn hit 401 — skipping compaction, parking for re-login".into(),
+        }),
+        TurnOutcome::Failed(e) => bus.emit(LiveEvent::Note {
+            text: format!("checkpoint turn failed ({e:#}) — compacting anyway"),
+        }),
+    }
+    // Best-effort: never changes the outcome of the turn that already
+    // succeeded. Mirror the checkpoint-turn handling above — emit a Note
+    // for each failure mode and move on; the next real turn will surface
+    // the underlying issue (rate-limit / 401 / etc.) through the normal
+    // path anyway.
+    match compact_session(files, bus).await {
+        TurnOutcome::Ok | TurnOutcome::Compacted => {}
+        TurnOutcome::PromptTooLong => bus.emit(LiveEvent::Note {
+            text: "/compact unexpectedly returned PromptTooLong — next turn will retry".into(),
+        }),
+        TurnOutcome::RateLimited => bus.emit(LiveEvent::Note {
+            text: "/compact was rate-limited — next turn will park + retry".into(),
+        }),
+        TurnOutcome::AuthFailed => bus.emit(LiveEvent::Note {
+            text: "/compact hit 401 — next turn will trigger the re-login flow".into(),
+        }),
+        TurnOutcome::Failed(e) => {
+            tracing::warn!(error = %format!("{e:#}"), "post-checkpoint compact failed");
+            bus.emit(LiveEvent::Note {
+                text: format!("/compact after checkpoint failed: {e:#}"),
+            });
+        }
+    }
+    true
+}
+
+/// Pre-turn auto-reset check. If context is large AND the prompt cache has
+/// gone cold (idle time >= cache TTL), arm `request_new_session` so the
+/// next wake-up turn starts fresh. No preceding checkpoint turn — running
+/// any turn before the reset would re-upload and re-warm the cache, which
+/// defeats the cost-optimisation purpose entirely.
+fn maybe_auto_reset(bus: &Bus) {
+    let watermark = auto_reset_watermark_tokens(bus);
+    if watermark == 0 {
+        return; // auto-reset disabled
+    }
+    let Some(ctx_tokens) = bus.last_ctx_usage().map(|u| u.context_tokens()) else {
+        return; // no usage reading yet — first turn, nothing to reset
+    };
+    if ctx_tokens < watermark {
+        return;
+    }
+    let last_ended = bus.last_turn_ended_unix();
+    if last_ended == 0 {
+        return; // no completed turn yet
+    }
+    // Compute idle seconds using the same clock as now_unix (unix epoch, i64).
+    let now = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.as_secs())
+        .unwrap_or(0);
+    let idle_secs = now.saturating_sub(u64::try_from(last_ended).unwrap_or(0));
+    let ttl = cache_ttl_secs();
+    if idle_secs < ttl {
+        return;
+    }
+    bus.emit(LiveEvent::Note {
+        text: format!(
+            "context {ctx_tokens} tokens, idle {idle_secs}s >= cache TTL {ttl}s \
+             — dropping session (cache cold, fresh start is equally cheap)"
+        ),
+    });
+    bus.request_new_session();
+}
+
+/// Emit the per-turn `TurnEnd` event + log line. Single owner so the
+/// agent and manager loops agree on outcome semantics.
+pub fn emit_turn_end(bus: &Bus, outcome: &TurnOutcome) {
+    match outcome {
+        TurnOutcome::Ok | TurnOutcome::Compacted | TurnOutcome::PromptTooLong => {
+            bus.emit(LiveEvent::TurnEnd {
+                ok: true,
+                note: None,
+            });
+            tracing::info!("turn finished");
+        }
+        TurnOutcome::RateLimited => {
+            bus.emit(LiveEvent::TurnEnd {
+                ok: false,
+                note: Some("rate limited — parking until quota resets".into()),
+            });
+            tracing::warn!("turn rate-limited");
+        }
+        TurnOutcome::AuthFailed => {
+            bus.emit(LiveEvent::TurnEnd {
+                ok: false,
+                note: Some("authentication failed (401) — waiting for re-login".into()),
+            });
+            tracing::warn!("turn auth-failed (401)");
+        }
+        TurnOutcome::Failed(e) => {
+            let note = format!("{e:#}");
+            bus.emit(LiveEvent::TurnEnd {
+                ok: false,
+                note: Some(note.clone()),
+            });
+            tracing::warn!(error = %note, "turn failed");
+        }
+    }
+}
+
+/// Block until the bound `~/.claude/` dir contains a session, polling
+/// `claude_dir` on a `poll_ms` interval (min 2s). Flips `state` to
+/// `Online` when login lands; caller resumes its serve loop.
+///
+/// # Panics
+///
+/// Panics if the internal login-state lock is poisoned.
+pub async fn wait_for_login(
+    claude_dir: &Path,
+    state: Arc<Mutex<LoginState>>,
+    bus: &Bus,
+    poll_ms: u64,
+) {
+    tracing::warn!(
+        claude_dir = %claude_dir.display(),
+        "no claude session — staying in partial-run mode (web UI only)"
+    );
+    let probe = Duration::from_millis(poll_ms.max(2000));
+    loop {
+        tokio::time::sleep(probe).await;
+        if login::has_session(claude_dir) {
+            tracing::info!("claude session detected — entering turn loop");
+            *state.lock().unwrap() = LoginState::Online;
+            bus.emit_status("online");
+            return;
+        }
+    }
+}
+
+/// Spawn `claude` for one turn and pump `stream-json` stdout into the
+/// live event bus. Prompt goes over stdin (variadic
+/// `--allowedTools`/`--tools` would otherwise eat a trailing positional
+/// prompt). The session is persistent across turns via `--continue` and
+/// claude's in-session auto-compact is disabled via `--settings` so it
+/// doesn't stall mid-turn — hyperhive owns compaction.
+pub async fn run_turn(prompt: &str, files: &TurnFiles, bus: &Bus) -> TurnOutcome {
+    match run_claude(prompt, files, bus).await {
+        Ok((true, _, _)) => TurnOutcome::PromptTooLong,
+        Ok((_, true, _)) => TurnOutcome::RateLimited,
+        Ok((_, _, true)) => TurnOutcome::AuthFailed,
+        Ok(_) => TurnOutcome::Ok,
+        Err(e) => TurnOutcome::Failed(e),
+    }
+}
+
+/// Run claude's built-in `/compact` slash command on the persistent
+/// session. Takes the *same* params as `run_turn` because compact
+/// re-initialises claude with the full session shape — same MCP
+/// surface, same system prompt, same allowed-tools — so the post-
+/// compact state matches a normal turn's. Only the prompt over stdin
+/// differs (`/compact` vs the wake-up payload).
+///
+/// Returns the same `TurnOutcome` shape as `run_turn` so callers can
+/// react identically to all three failure flags (`prompt_too_long`,
+/// `rate_limited`, `auth_failed`). The reactive caller bubbles any
+/// non-Ok outcome up so the serve loop's normal handling (park +
+/// retry on rate-limit, flip to `needs_login` on 401, etc.) kicks in;
+/// the proactive post-checkpoint caller stays best-effort and only
+/// emits a Note for each failure mode.
+pub async fn compact_session(files: &TurnFiles, bus: &Bus) -> TurnOutcome {
+    bus.emit(LiveEvent::Note {
+        text: "context overflow — running /compact on the persistent session".into(),
+    });
+    let outcome = match run_claude("/compact", files, bus).await {
+        Ok((true, _, _)) => TurnOutcome::PromptTooLong,
+        Ok((_, true, _)) => TurnOutcome::RateLimited,
+        Ok((_, _, true)) => TurnOutcome::AuthFailed,
+        Ok(_) => TurnOutcome::Ok,
+        Err(e) => TurnOutcome::Failed(e),
+    };
+    match &outcome {
+        TurnOutcome::Ok | TurnOutcome::Compacted => bus.emit(LiveEvent::Note {
+            text: "/compact done".into(),
+        }),
+        TurnOutcome::PromptTooLong => bus.emit(LiveEvent::Note {
+            text: "/compact reported PromptTooLong — bubbling up".into(),
+        }),
+        TurnOutcome::RateLimited => bus.emit(LiveEvent::Note {
+            text: "/compact was rate-limited — bubbling up".into(),
+        }),
+        TurnOutcome::AuthFailed => bus.emit(LiveEvent::Note {
+            text: "/compact hit 401 — bubbling up for re-login flow".into(),
+        }),
+        TurnOutcome::Failed(e) => bus.emit(LiveEvent::Note {
+            text: format!("/compact failed: {e:#}"),
+        }),
+    }
+    outcome
+}
+
+#[allow(clippy::too_many_lines)]
+async fn run_claude(prompt: &str, files: &TurnFiles, bus: &Bus) -> Result<(bool, bool, bool)> {
+    // Keep the last STDERR_TAIL_LINES of stderr so a non-zero exit can
+    // include real context in the bail message (and downstream in the
+    // failure notification to the manager) instead of just "exit 1".
+    const STDERR_TAIL_LINES: usize = 20;
+    let model = bus.model();
+    let resume = !bus.take_skip_continue();
+    if !resume {
+        bus.emit(LiveEvent::Note {
+            text: "fresh session (--continue suppressed for this turn)".into(),
+        });
+    }
+    let mut cmd = Command::new("claude");
+    // Spawn inside the agent's state dir so relative paths in tool calls
+    // (Read foo.md, Bash ls, Write notes.md) land in the durable dir
+    // instead of wherever the harness systemd unit started. Falls back
+    // silently if the dir is missing (dev / test without the bind mount).
+    let state_dir = crate::paths::state_dir();
+    if state_dir.is_dir() {
+        cmd.current_dir(&state_dir);
+    }
+    cmd.arg("--print")
+        .arg("--verbose")
+        .arg("--output-format")
+        .arg("stream-json")
+        .arg("--model")
+        .arg(&model)
+        .arg("--settings")
+        .arg(&files.settings);
+    if resume {
+        cmd.arg("--continue");
+    }
+    cmd.arg("--system-prompt-file").arg(&files.system_prompt);
+    cmd.arg("--mcp-config")
+        .arg(&files.mcp_config)
+        .arg("--strict-mcp-config")
+        .arg("--tools")
+        .arg(mcp::builtin_tools_arg())
+        .arg("--allowedTools")
+        .arg(mcp::allowed_tools_arg(files.flavor));
+    let mut child = cmd
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .spawn()?;
+
+    if let Some(mut stdin) = child.stdin.take() {
+        stdin.write_all(prompt.as_bytes()).await?;
+        stdin.shutdown().await.ok();
+        drop(stdin);
+    }
+    let stdout = child.stdout.take().expect("piped stdout");
+    let stderr = child.stderr.take().expect("piped stderr");
+
+    let prompt_too_long = Arc::new(AtomicBool::new(false));
+    let rate_limited = Arc::new(AtomicBool::new(false));
+    let auth_failed = Arc::new(AtomicBool::new(false));
+    let flag_out = prompt_too_long.clone();
+    let flag_err = prompt_too_long.clone();
+    let rate_out = rate_limited.clone();
+    let rate_err = rate_limited.clone();
+    let auth_out = auth_failed.clone();
+    let auth_err = auth_failed.clone();
+    let bus_out = bus.clone();
+    let bus_err = bus.clone();
+    let pump_stdout = tokio::spawn(async move {
+        let mut reader = BufReader::new(stdout).lines();
+        // Track usage as the turn unfolds. `last_inference` overwrites on
+        // every assistant event so at result-time it holds the most recent
+        // model call's usage — the actual context size. The `result` event
+        // carries the cumulative-across-the-turn usage (cost signal). Both
+        // get handed to `record_turn_usage` together so a single SSE
+        // event updates both badges.
+        let mut last_inference: Option<crate::events::TokenUsage> = None;
+        while let Ok(Some(line)) = reader.next_line().await {
+            if line.contains(PROMPT_TOO_LONG_MARKER) {
+                flag_out.store(true, Ordering::Relaxed);
+            }
+            // Auth-fail check happens on the raw line first so we
+            // catch both the `api_retry` JSON events (which can land
+            // before they're fully parseable) and any stderr-shaped
+            // text that snuck onto stdout.
+            if AUTH_FAIL_MARKERS.iter().any(|m| line.contains(m)) {
+                auth_out.store(true, Ordering::Relaxed);
+            }
+            match serde_json::from_str::<serde_json::Value>(&line) {
+                Ok(v) => {
+                    // Rate-limit detection: only fire on JSON `error` events,
+                    // not on arbitrary text content. An agent discussing a past
+                    // rate limit in its response would otherwise trigger a false
+                    // positive (the full conversation flows through stdout as
+                    // stream-json, so any text the model outputs is visible here).
+                    if v.get("type").and_then(|t| t.as_str()) == Some("error") {
+                        let raw = v.to_string();
+                        if RATE_LIMIT_MARKERS.iter().any(|m| raw.contains(m)) {
+                            rate_out.store(true, Ordering::Relaxed);
+                        }
+                    }
+                    if let Some(u) = crate::events::TokenUsage::from_assistant_event(&v) {
+                        last_inference = Some(u);
+                    }
+                    if let Some(cost) = crate::events::TokenUsage::from_stream_event(&v) {
+                        // Fallback to `cost` if the turn somehow produced
+                        // a result without any assistant event — keeps the
+                        // ctx badge from going stale on a degenerate turn.
+                        let ctx = last_inference.unwrap_or(cost);
+                        bus_out.record_turn_usage(ctx, cost);
+                    }
+                    // Seed the API-reported context-window from the result
+                    // event's `modelUsage.*.contextWindow` field. This is
+                    // the authoritative per-inference active window used for
+                    // compaction watermarks — it reflects what the model
+                    // actually enforces, which may differ from the Nix
+                    // config (e.g. 200k active window on a 1M cache model).
+                    if let Some(w) =
+                        crate::events::TokenUsage::context_window_from_result_event(&v)
+                    {
+                        bus_out.set_api_context_window(w);
+                    }
+                    bus_out.observe_stream(&v);
+                    bus_out.emit(LiveEvent::Stream(v));
+                }
+                Err(_) => {
+                    // Non-JSON stdout: raw text check is fine here since these
+                    // are claude CLI messages, not conversation content.
+                    if RATE_LIMIT_MARKERS.iter().any(|m| line.contains(m)) {
+                        rate_out.store(true, Ordering::Relaxed);
+                    }
+                    bus_out.emit(LiveEvent::Note {
+                        text: format!("(non-json) {line}"),
+                    });
+                }
+            }
+        }
+    });
+    let stderr_tail: Arc<Mutex<VecDeque<String>>> =
+        Arc::new(Mutex::new(VecDeque::with_capacity(STDERR_TAIL_LINES)));
+    let tail_clone = stderr_tail.clone();
+    let pump_stderr = tokio::spawn(async move {
+        let mut reader = BufReader::new(stderr).lines();
+        while let Ok(Some(line)) = reader.next_line().await {
+            if line.contains(PROMPT_TOO_LONG_MARKER) {
+                flag_err.store(true, Ordering::Relaxed);
+            }
+            if RATE_LIMIT_MARKERS.iter().any(|m| line.contains(m)) {
+                rate_err.store(true, Ordering::Relaxed);
+            }
+            if AUTH_FAIL_MARKERS.iter().any(|m| line.contains(m)) {
+                auth_err.store(true, Ordering::Relaxed);
+            }
+            // Mirror to journald so post-mortems work without the web UI
+            // or the events sqlite. The bus event is what the dashboard
+            // renders; the tracing line is what `journalctl -M <c> -b`
+            // surfaces when claude exits non-zero.
+            tracing::warn!(line = %line, "claude stderr");
+            bus_err.emit(LiveEvent::Note {
+                text: format!("stderr: {line}"),
+            });
+            let mut t = tail_clone.lock().unwrap();
+            if t.len() >= STDERR_TAIL_LINES {
+                t.pop_front();
+            }
+            t.push_back(line);
+        }
+    });
+
+    let status = child.wait().await?;
+    let _ = pump_stdout.await;
+    let _ = pump_stderr.await;
+    let too_long = prompt_too_long.load(Ordering::Relaxed);
+    let is_rate_limited = rate_limited.load(Ordering::Relaxed);
+    let is_auth_failed = auth_failed.load(Ordering::Relaxed);
+    if !status.success() && !too_long && !is_rate_limited && !is_auth_failed {
+        let tail = stderr_tail.lock().unwrap();
+        if tail.is_empty() {
+            bail!("claude exited {status} (no stderr)");
+        }
+        let tail_str = tail.iter().cloned().collect::<Vec<_>>().join("\n");
+        bail!("claude exited {status}\nstderr tail:\n{tail_str}");
+    }
+    Ok((too_long, is_rate_limited, is_auth_failed))
+}
diff --git a/hive-ag3nt/src/turn_stats.rs b/hive-ag3nt/src/turn_stats.rs
new file mode 100644
index 00000000..a17f81ad
--- /dev/null
+++ b/hive-ag3nt/src/turn_stats.rs
@@ -0,0 +1,266 @@
+//! Per-turn analytics sink. One sqlite row per claude turn captures:
+//! identity (`model`, `wake_from`, `result_kind`), timing (`started_at`,
+//! `ended_at`, `duration_ms`), cost (token counts), behaviour (tool-call
+//! count + per-tool breakdown), and post-turn snapshot metrics
+//! (`open_threads_count`, `open_reminders_count`).
+//!
+//! Lives next to `hyperhive-events.sqlite` in the agent's state dir
+//! so the host-side state vacuum sweep can reach both. Schema is
+//! intentionally append-only — every column has a default so future
+//! additions don't break old readers; new columns land via
+//! `ALTER TABLE ... ADD COLUMN ... DEFAULT ...` in the migration
+//! block.
+//!
+//! Writes are best-effort: a failed insert logs a warning and lets
+//! the turn loop continue. The next turn either succeeds or the
+//! operator sees the journal trail.
+
+use std::path::{Path, PathBuf};
+use std::sync::Mutex;
+
+use anyhow::{Context, Result};
+use rusqlite::{Connection, params};
+
+/// SQL bootstrap. CREATE TABLE IF NOT EXISTS so first-boot agents
+/// and existing ones converge on the same shape. The base table is
+/// fresh-install only; additive migrations land via `MIGRATIONS`
+/// below as try-and-ignore ALTERs so existing dbs catch up.
+const SCHEMA: &str = "
+CREATE TABLE IF NOT EXISTS turn_stats (
+    id                              INTEGER PRIMARY KEY AUTOINCREMENT,
+    started_at                      INTEGER NOT NULL,
+    ended_at                        INTEGER NOT NULL,
+    duration_ms                     INTEGER NOT NULL,
+    model                           TEXT    NOT NULL,
+    wake_from                       TEXT    NOT NULL,
+    input_tokens                    INTEGER NOT NULL DEFAULT 0,
+    output_tokens                   INTEGER NOT NULL DEFAULT 0,
+    cache_read_input_tokens         INTEGER NOT NULL DEFAULT 0,
+    cache_creation_input_tokens     INTEGER NOT NULL DEFAULT 0,
+    last_input_tokens               INTEGER NOT NULL DEFAULT 0,
+    last_output_tokens              INTEGER NOT NULL DEFAULT 0,
+    last_cache_read_input_tokens    INTEGER NOT NULL DEFAULT 0,
+    last_cache_creation_input_tokens INTEGER NOT NULL DEFAULT 0,
+    tool_call_count                 INTEGER NOT NULL DEFAULT 0,
+    tool_call_breakdown_json        TEXT,
+    open_threads_count              INTEGER,
+    open_reminders_count            INTEGER,
+    result_kind                     TEXT    NOT NULL,
+    note                            TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_turn_stats_started
+    ON turn_stats (started_at DESC);
+";
+
+/// Additive column migrations. Each runs unconditionally and ignores
+/// `duplicate column name` errors — sqlite < 3.35 lacks
+/// `ADD COLUMN IF NOT EXISTS`, so try-and-ignore is the portable path.
+/// New columns MUST carry a default so existing rows decode.
+const MIGRATIONS: &[&str] = &[
+    "ALTER TABLE turn_stats ADD COLUMN last_input_tokens INTEGER NOT NULL DEFAULT 0",
+    "ALTER TABLE turn_stats ADD COLUMN last_output_tokens INTEGER NOT NULL DEFAULT 0",
+    "ALTER TABLE turn_stats ADD COLUMN last_cache_read_input_tokens INTEGER NOT NULL DEFAULT 0",
+    "ALTER TABLE turn_stats ADD COLUMN last_cache_creation_input_tokens INTEGER NOT NULL DEFAULT 0",
+];
+
+/// One row to be inserted. `Option`-wrapped fields default to NULL
+/// when the harness couldn't gather them (e.g. socket roundtrip for
+/// `open_threads` failed) so a partial row beats no row.
+#[derive(Debug, Clone)]
+pub struct TurnStatRow {
+    pub started_at: i64,
+    pub ended_at: i64,
+    pub duration_ms: i64,
+    pub model: String,
+    pub wake_from: String,
+    /// Cumulative across every inference in the turn (cost signal).
+    pub input_tokens: u64,
+    pub output_tokens: u64,
+    pub cache_read_input_tokens: u64,
+    pub cache_creation_input_tokens: u64,
+    /// Last inference's usage — the actual context size at turn end.
+    pub last_input_tokens: u64,
+    pub last_output_tokens: u64,
+    pub last_cache_read_input_tokens: u64,
+    pub last_cache_creation_input_tokens: u64,
+    pub tool_call_count: u64,
+    /// Per-tool breakdown as JSON: `{"Read":12,"Bash":3,...}`. None
+    /// when no tools were called (saves a sqlite write of `"{}"`).
+    pub tool_call_breakdown_json: Option<String>,
+    pub open_threads_count: Option<u64>,
+    pub open_reminders_count: Option<u64>,
+    /// `"ok" | "failed" | "prompt_too_long"`.
+    pub result_kind: &'static str,
+    pub note: Option<String>,
+}
+
+/// Thin sqlite wrapper. Cloning is cheap (Arc-shared connection).
+#[derive(Clone)]
+pub struct TurnStats {
+    inner: std::sync::Arc<Mutex<Connection>>,
+}
+
+impl TurnStats {
+    /// Open the per-agent stats db, creating the file + schema if
+    /// missing. Returns `None` when the db can't be opened (read-only
+    /// fs in tests, missing state dir) — the harness logs and
+    /// continues without a sink rather than failing the turn loop.
+    #[must_use]
+    pub fn open_default() -> Option<Self> {
+        let path = default_path();
+        match Self::open(&path) {
+            Ok(s) => Some(s),
+            Err(e) => {
+                tracing::warn!(
+                    error = ?e,
+                    path = %path.display(),
+                    "turn_stats: open failed; per-turn analytics disabled"
+                );
+                None
+            }
+        }
+    }
+
+    fn open(path: &Path) -> Result<Self> {
+        if let Some(parent) = path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        let conn = Connection::open(path)
+            .with_context(|| format!("open turn_stats db {}", path.display()))?;
+        conn.execute_batch(SCHEMA)
+            .context("apply turn_stats schema")?;
+        for stmt in MIGRATIONS {
+            // Ignore "duplicate column name" — the migration already ran.
+            // Any other error is logged but doesn't fail open() because the
+            // base schema works and we'd rather keep the harness alive than
+            // crash on an upgrade hiccup.
+            if let Err(e) = conn.execute(stmt, []) {
+                let msg = e.to_string();
+                if !msg.contains("duplicate column name") {
+                    tracing::warn!(error = %msg, stmt, "turn_stats migration failed");
+                }
+            }
+        }
+        Ok(Self {
+            inner: std::sync::Arc::new(Mutex::new(conn)),
+        })
+    }
+
+    /// Insert a row. Best-effort — logs + swallows errors so a sqlite
+    /// hiccup (locked db, full disk) doesn't crash the harness.
+    ///
+    /// # Panics
+    ///
+    /// Panics if the internal lock is poisoned.
+    pub fn record(&self, row: &TurnStatRow) {
+        let conn = self.inner.lock().unwrap();
+        let res = conn.execute(
+            "INSERT INTO turn_stats (
+                started_at, ended_at, duration_ms, model, wake_from,
+                input_tokens, output_tokens,
+                cache_read_input_tokens, cache_creation_input_tokens,
+                last_input_tokens, last_output_tokens,
+                last_cache_read_input_tokens, last_cache_creation_input_tokens,
+                tool_call_count, tool_call_breakdown_json,
+                open_threads_count, open_reminders_count,
+                result_kind, note
+             ) VALUES (
+                ?1, ?2, ?3, ?4, ?5,
+                ?6, ?7,
+                ?8, ?9,
+                ?10, ?11,
+                ?12, ?13,
+                ?14, ?15,
+                ?16, ?17,
+                ?18, ?19
+             )",
+            params![
+                row.started_at,
+                row.ended_at,
+                row.duration_ms,
+                row.model,
+                row.wake_from,
+                i64::try_from(row.input_tokens).unwrap_or(i64::MAX),
+                i64::try_from(row.output_tokens).unwrap_or(i64::MAX),
+                i64::try_from(row.cache_read_input_tokens).unwrap_or(i64::MAX),
+                i64::try_from(row.cache_creation_input_tokens).unwrap_or(i64::MAX),
+                i64::try_from(row.last_input_tokens).unwrap_or(i64::MAX),
+                i64::try_from(row.last_output_tokens).unwrap_or(i64::MAX),
+                i64::try_from(row.last_cache_read_input_tokens).unwrap_or(i64::MAX),
+                i64::try_from(row.last_cache_creation_input_tokens).unwrap_or(i64::MAX),
+                i64::try_from(row.tool_call_count).unwrap_or(i64::MAX),
+                row.tool_call_breakdown_json,
+                row.open_threads_count
+                    .map(|n| i64::try_from(n).unwrap_or(i64::MAX)),
+                row.open_reminders_count
+                    .map(|n| i64::try_from(n).unwrap_or(i64::MAX)),
+                row.result_kind,
+                row.note,
+            ],
+        );
+        if let Err(e) = res {
+            tracing::warn!(error = ?e, "turn_stats: insert failed");
+        }
+    }
+
+    /// Token counts from the most recently inserted row, if any.
+    /// Returns `(ctx, cost)` — both backfill `Bus` on startup so the
+    /// per-agent web UI's ctx + cost badges paint with real numbers on
+    /// cold load instead of waiting for the next `TokenUsageChanged`
+    /// SSE event. Best-effort: any sqlite error returns `(None, None)`.
+    ///
+    /// Pre-migration rows (before the `last_*_tokens` columns existed)
+    /// have last-inference zeros — those rows yield `ctx = None` so the
+    /// badge stays empty until the next real turn rather than showing a
+    /// misleading 0.
+    /// # Panics
+    ///
+    /// Panics if the internal lock is poisoned.
+    #[must_use]
+    pub fn last_usage(
+        &self,
+    ) -> (
+        Option<crate::events::TokenUsage>,
+        Option<crate::events::TokenUsage>,
+    ) {
+        let conn = self.inner.lock().unwrap();
+        conn.query_row(
+            "SELECT input_tokens, output_tokens,
+                    cache_read_input_tokens, cache_creation_input_tokens,
+                    last_input_tokens, last_output_tokens,
+                    last_cache_read_input_tokens, last_cache_creation_input_tokens
+             FROM turn_stats
+             ORDER BY started_at DESC
+             LIMIT 1",
+            [],
+            |row| {
+                let g = |i: usize| -> rusqlite::Result<u64> {
+                    Ok(u64::try_from(row.get::<_, i64>(i)?).unwrap_or(0))
+                };
+                let cost = crate::events::TokenUsage {
+                    input_tokens: g(0)?,
+                    output_tokens: g(1)?,
+                    cache_read_input_tokens: g(2)?,
+                    cache_creation_input_tokens: g(3)?,
+                };
+                let last = crate::events::TokenUsage {
+                    input_tokens: g(4)?,
+                    output_tokens: g(5)?,
+                    cache_read_input_tokens: g(6)?,
+                    cache_creation_input_tokens: g(7)?,
+                };
+                let ctx = if last == crate::events::TokenUsage::default() {
+                    None
+                } else {
+                    Some(last)
+                };
+                Ok((ctx, Some(cost)))
+            },
+        )
+        .unwrap_or((None, None))
+    }
+}
+
+fn default_path() -> PathBuf {
+    crate::paths::state_dir().join("hyperhive-turn-stats.sqlite")
+}
diff --git a/hive-ag3nt/src/web_ui.rs b/hive-ag3nt/src/web_ui.rs
new file mode 100644
index 00000000..d53c5637
--- /dev/null
+++ b/hive-ag3nt/src/web_ui.rs
@@ -0,0 +1,912 @@
+//! Per-container HTTP UI. SPA shape: `GET /` returns a static shell;
+//! `GET /static/*` serves CSS + JS; `GET /api/state` returns the page
+//! state as JSON; the JS app renders. Live events stream on
+//! `/events/stream`. Action POSTs (`/send`, `/login/*`) return either a
+//! 303 Redirect (for browsers that submit the form normally) or just
+//! 200 OK — the JS app re-fetches `/api/state` afterwards.
+
+use std::convert::Infallible;
+use std::net::SocketAddr;
+use std::path::PathBuf;
+use std::sync::{Arc, Mutex};
+
+use anyhow::{Context, Result};
+use axum::{
+    Form, Router,
+    extract::State,
+    http::StatusCode,
+    response::{
+        IntoResponse, Response,
+        sse::{Event, KeepAlive, Sse},
+    },
+    routing::{get, post},
+};
+use serde::{Deserialize, Serialize};
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio_stream::{Stream, StreamExt, wrappers::BroadcastStream};
+use tower_http::services::ServeDir;
+
+use crate::client;
+use crate::events::Bus;
+use crate::login::LoginState;
+use crate::login_session::{LoginSession, drop_if_finished};
+use crate::mcp;
+use crate::turn::TurnFiles;
+
+/// Live login state for the web UI. The harness updates this in place as it
+/// transitions between `NeedsLogin` and `Online`; the UI reads on each
+/// render.
+pub type LoginStateCell = Arc<Mutex<LoginState>>;
+
+/// Shared turn lock. The serve loop acquires this (as an async mutex) for the
+/// duration of every `drive_turn` call. The `/api/compact` handler tries
+/// `try_lock()` and rejects immediately if a turn is in flight, preventing
+/// concurrent access to the claude session.
+pub type TurnLock = Arc<tokio::sync::Mutex<()>>;
+
+#[derive(Clone)]
+struct AppState {
+    label: String,
+    login: LoginStateCell,
+    session: Arc<Mutex<Option<Arc<LoginSession>>>>,
+    bus: Bus,
+    socket: PathBuf,
+    /// Same `TurnFiles` the harness's turn loop uses. Shared so
+    /// `/api/compact` re-uses the exact MCP config / system prompt /
+    /// settings claude saw on the last regular turn — keeps the
+    /// session shape identical across compact + normal turns.
+    files: TurnFiles,
+    /// Prevents `/api/compact` from racing with an in-flight normal turn.
+    turn_lock: TurnLock,
+    /// VNC port read from `/etc/hyperhive/gui.json` at startup.
+    /// `None` when the file is absent (gui not enabled for this agent).
+    gui_vnc_port: Option<u16>,
+}
+
+impl AppState {
+    fn flavor(&self) -> Flavor {
+        self.files.flavor
+    }
+}
+
+/// Which wire protocol the per-agent UI's `/send` handler should speak.
+/// Sub-agent → `AgentRequest::OperatorMsg`; manager →
+/// `ManagerRequest::OperatorMsg`. Reuses the MCP-side enum so a
+/// single value drives both the send protocol and (in
+/// `post_compact`) the allowed-tools surface claude sees.
+pub type Flavor = mcp::Flavor;
+
+/// # Errors
+///
+/// Returns an error if the TCP listener cannot bind to the given port.
+pub async fn serve(
+    label: String,
+    port: u16,
+    login: LoginStateCell,
+    bus: Bus,
+    socket: PathBuf,
+    files: TurnFiles,
+    turn_lock: TurnLock,
+) -> Result<()> {
+    let gui_vnc_port = read_gui_json();
+    let static_dir: PathBuf = std::env::var_os("HIVE_STATIC_DIR")
+        .map(PathBuf::from)
+        .context(
+            "HIVE_STATIC_DIR env var not set — point it at the merged \
+             per-agent dist (see hyperhive.frontend.mergedDist in nix)",
+        )?;
+    if !static_dir.is_dir() {
+        anyhow::bail!(
+            "HIVE_STATIC_DIR ({}) is not a directory",
+            static_dir.display()
+        );
+    }
+    tracing::info!(static_dir = %static_dir.display(), "web UI static dir resolved");
+    let state = AppState {
+        label,
+        login,
+        session: Arc::new(Mutex::new(None)),
+        bus,
+        socket,
+        files,
+        turn_lock,
+        gui_vnc_port,
+    };
+    let app = Router::new()
+        .route("/api/state", get(api_state))
+        .route("/events/stream", get(events_stream))
+        .route("/events/history", get(events_history))
+        .route("/send", post(post_send))
+        .route("/login/start", post(post_login_start))
+        .route("/login/code", post(post_login_code))
+        .route("/login/cancel", post(post_login_cancel))
+        .route("/api/cancel", post(post_cancel_turn))
+        .route("/api/compact", post(post_compact))
+        .route("/api/model", post(post_set_model))
+        .route("/api/new-session", post(post_new_session))
+        .route("/api/loose-ends", get(api_loose_ends))
+        .route("/api/stats", get(api_stats))
+        .route("/screen/ws", get(screen_ws))
+        .route("/icon", get(serve_icon))
+        // Anything else (`/`, `/stats`, `/screen`, `/static/*`)
+        // falls through to the merged dist. ServeDir auto-appends
+        // `.html` when the URL is a bare path that matches a file
+        // (so `/stats` → `dist/stats.html`, `/screen` → `dist/
+        // screen.html`). Per-agent `extraFiles` additions are
+        // already layered into this same directory (see
+        // hyperhive.frontend.mergedDist in nix).
+        .fallback_service(ServeDir::new(&static_dir))
+        .with_state(state);
+    let addr = SocketAddr::from(([0, 0, 0, 0], port));
+    let listener = bind_with_retry(addr, "web UI").await?;
+    tracing::info!(%port, "web UI listening");
+    axum::serve(listener, app).await?;
+    Ok(())
+}
+
+// ---------------------------------------------------------------------------
+// Static assets + state snapshot
+// ---------------------------------------------------------------------------
+
+/// Bind a TCP listener with `SO_REUSEADDR` set, retrying on
+/// `AddrInUse` indefinitely with exponential backoff capped at 2s.
+/// nspawn restarts can race the previous harness's socket release;
+/// `SO_REUSEADDR` lets us reclaim a port still in `TIME_WAIT` from a
+/// clean previous exit, and the retry covers the case where the
+/// previous process is genuinely still alive (systemd restart-delay
+/// overlap).
+///
+/// The retry has no attempt cap: capping was the proximate cause of
+/// issue #324 — two back-to-back restarts left the previous socket
+/// holding the port for longer than the ~20s the old 12-attempt
+/// budget allowed, and the harness silently lost its web UI for the
+/// rest of the process lifetime. Genuine port collisions are
+/// preflighted host-side (`lifecycle::{spawn,rebuild}`) and surfaced
+/// on the dashboard as a banner, so at this layer a persistent
+/// `AddrInUse` always reflects a recoverable stale socket — retrying
+/// forever is the safe choice. The first attempts log at WARN; once
+/// we cross attempt 12 the level drops to INFO so a long stale
+/// socket doesn't flood the journal.
+async fn bind_with_retry(addr: SocketAddr, label: &str) -> Result<tokio::net::TcpListener> {
+    let mut delay_ms = 250u64;
+    let mut attempts = 0u32;
+    loop {
+        match try_bind(addr) {
+            Ok(l) => {
+                if attempts > 0 {
+                    tracing::info!(
+                        %addr, attempts,
+                        "{label}: bind succeeded after retry"
+                    );
+                }
+                return Ok(l);
+            }
+            Err(e) if e.kind() == std::io::ErrorKind::AddrInUse => {
+                let attempt = attempts + 1;
+                if attempt <= 12 {
+                    tracing::warn!(
+                        %addr, attempt,
+                        "{label}: AddrInUse, retrying in {delay_ms}ms"
+                    );
+                } else {
+                    tracing::info!(
+                        %addr, attempt,
+                        "{label}: AddrInUse still holding, retrying in {delay_ms}ms"
+                    );
+                }
+                tokio::time::sleep(std::time::Duration::from_millis(delay_ms)).await;
+                attempts += 1;
+                delay_ms = (delay_ms * 2).min(2000);
+            }
+            Err(e) => {
+                return Err(e).with_context(|| format!("bind {label} on {addr}"));
+            }
+        }
+    }
+}
+
+fn try_bind(addr: SocketAddr) -> std::io::Result<tokio::net::TcpListener> {
+    let sock = match addr {
+        SocketAddr::V4(_) => tokio::net::TcpSocket::new_v4()?,
+        SocketAddr::V6(_) => tokio::net::TcpSocket::new_v6()?,
+    };
+    sock.set_reuseaddr(true)?;
+    sock.bind(addr)?;
+    sock.listen(1024)
+}
+
+/// This agent's icon. Serves the operator-configured SVG from
+/// `/etc/hyperhive/icon.svg` (set via the `hyperhive.icon` agent.nix
+/// option) when present, otherwise the bundled default hyperhive logo.
+/// Always returns an image, so consumers (dashboard, favicon) can hit
+/// `/icon` unconditionally without probing whether one is configured.
+async fn serve_icon() -> impl IntoResponse {
+    const DEFAULT_ICON: &str = include_str!("../../branding/hyperhive.svg");
+    let body = std::fs::read_to_string("/etc/hyperhive/icon.svg")
+        .unwrap_or_else(|_| DEFAULT_ICON.to_string());
+    ([("content-type", "image/svg+xml")], body)
+}
+
+/// Read `/etc/hyperhive/gui.json` and extract the `vnc_port` field.
+/// Returns `None` if the file is absent or unparseable — GUI not enabled.
+fn read_gui_json() -> Option<u16> {
+    let text = std::fs::read_to_string("/etc/hyperhive/gui.json").ok()?;
+    let val: serde_json::Value = serde_json::from_str(&text).ok()?;
+    val["vnc_port"].as_u64().and_then(|p| u16::try_from(p).ok())
+}
+
+/// WebSocket handler: upgrade then pump bytes between the WS client and
+/// the VNC server on `127.0.0.1:<vnc_port>`. Returns 404 when gui is not
+/// enabled for this agent.
+async fn screen_ws(
+    ws: axum::extract::ws::WebSocketUpgrade,
+    State(state): State<AppState>,
+) -> Response {
+    let Some(vnc_port) = state.gui_vnc_port else {
+        return (StatusCode::NOT_FOUND, "gui not enabled for this agent").into_response();
+    };
+    ws.on_upgrade(move |socket| relay_ws_vnc(socket, vnc_port))
+}
+
+/// Pure byte pump: forwards raw bytes between the WebSocket client and
+/// the VNC TCP stream. Transparent to any RFB variant (plain, `VeNCrypt`).
+async fn relay_ws_vnc(socket: axum::extract::ws::WebSocket, vnc_port: u16) {
+    // Import futures traits locally so they don't conflict with
+    // tokio_stream::StreamExt used at module scope.
+    use axum::extract::ws::Message;
+    use futures_util::{SinkExt, StreamExt as _};
+
+    let addr = format!("127.0.0.1:{vnc_port}");
+    let Ok(tcp) = tokio::net::TcpStream::connect(&addr).await else {
+        tracing::warn!(%addr, "screen/ws: could not connect to VNC server");
+        return;
+    };
+    let (mut tcp_rx, mut tcp_tx) = tcp.into_split();
+    let (mut ws_tx, mut ws_rx) = socket.split();
+
+    // WS → TCP
+    let ws_to_tcp = tokio::spawn(async move {
+        while let Some(Ok(msg)) = futures_util::StreamExt::next(&mut ws_rx).await {
+            match msg {
+                Message::Binary(data) => {
+                    if tcp_tx.write_all(&data).await.is_err() {
+                        break;
+                    }
+                }
+                Message::Close(_) => break,
+                _ => {} // ping/pong/text: ignore
+            }
+        }
+    });
+
+    // TCP → WS
+    let tcp_to_ws = tokio::spawn(async move {
+        let mut buf = vec![0u8; 8192];
+        loop {
+            match tcp_rx.read(&mut buf).await {
+                Ok(0) | Err(_) => break,
+                Ok(n) => {
+                    if ws_tx
+                        .send(Message::Binary(buf[..n].to_vec().into()))
+                        .await
+                        .is_err()
+                    {
+                        break;
+                    }
+                }
+            }
+        }
+    });
+
+    // Wait for either direction to close, then let both tasks drop.
+    tokio::select! {
+        _ = ws_to_tcp => {}
+        _ = tcp_to_ws => {}
+    }
+}
+
+#[derive(Deserialize)]
+struct StatsQuery {
+    window: Option<String>,
+}
+
+async fn api_stats(
+    State(state): State<AppState>,
+    axum::extract::Query(q): axum::extract::Query<StatsQuery>,
+) -> axum::Json<crate::stats::Snapshot> {
+    let window = crate::stats::Window::parse(q.window.as_deref().unwrap_or("24h"));
+    let mut snapshot = crate::stats::snapshot_default(window);
+    // Pass the window span to the reminder-stats RPC so the broker
+    // filters its counts to the same time range as the chart data.
+    let window_secs = window.span_secs();
+    let window_secs_u = u64::try_from(window_secs).unwrap_or(0);
+    snapshot.reminder_stats = fetch_reminder_stats(&state.socket, state.flavor(), window_secs_u).await;
+    axum::Json(snapshot)
+}
+
+#[derive(Serialize)]
+struct StateSnapshot {
+    /// Bus seq at the moment this snapshot was assembled. Clients dedupe
+    /// their buffered SSE traffic against this value: events with
+    /// `seq <= snapshot.seq` are already reflected (or pre-date the
+    /// snapshot); `seq > snapshot.seq` is post-snapshot. Reset to 0 on
+    /// harness restart — clients treat reconnect as a fresh world.
+    seq: u64,
+    label: String,
+    dashboard_port: u16,
+    /// `"online"` | `"rate_limited"` | `"needs_login_idle"` | `"needs_login_in_progress"`.
+    status: &'static str,
+    /// Present when `status == "needs_login_in_progress"`.
+    session: Option<SessionView>,
+    /// Last N messages addressed to this agent, newest-first. Pulled
+    /// from the broker via the per-agent socket on each render.
+    /// Empty on transport failure.
+    inbox: Vec<hive_sh4re::InboxRow>,
+    /// Authoritative turn-loop state from the harness and the unix
+    /// timestamp the state was entered. The JS computes the age
+    /// client-side off this rather than tracking it from SSE events.
+    turn_state: crate::events::TurnState,
+    turn_state_since: i64,
+    /// Currently-active claude model name. Reflected on the page so
+    /// the operator can see what they just switched to (and what's
+    /// in flight). Mutable at runtime via `POST /api/model`.
+    model: String,
+    /// Effective context-window token budget for the current model.
+    /// Primary source: API-reported `modelUsage.*.contextWindow` from
+    /// the last result event (authoritative per-inference active window).
+    /// Falls back to `HIVE_CONTEXT_WINDOW_TOKENS_*` env vars, then 200 000.
+    /// Consumers (e.g. dashboard badge) use this to render ctx-usage %.
+    context_window_tokens: u64,
+    /// Last-inference token usage from the most recent completed
+    /// turn — represents the current context-window size at turn-end.
+    /// `null` until the first turn finishes.
+    ctx_usage: Option<crate::events::TokenUsage>,
+    /// Cumulative token usage across the most recent turn's inferences
+    /// (cost signal). `null` until the first turn finishes.
+    cost_usage: Option<crate::events::TokenUsage>,
+    /// Navigation links for this agent page (issue #262). Stats is
+    /// always present; screen when the VNC compositor is enabled; the
+    /// forge profile + the agent-configs mirror repo when the agent
+    /// has a forge account; followed by any agent-declared
+    /// `hyperhive.dashboardLinks` extras (read from
+    /// `{state_dir}/hyperhive-dashboard-links.json`). Each URL is
+    /// already absolute — built server-side from the request `Host`
+    /// header — so the frontend just renders.
+    ///
+    /// This same list is the **source of truth** for the per-agent
+    /// page *and* the dashboard card's icon-only nav strip: hive-c0re
+    /// proxies it via `GET /api/agent/{name}/links` (same-origin from
+    /// the dashboard JS), avoiding CORS and centralising the link
+    /// definitions in the agent backend.
+    links: Vec<AgentLink>,
+}
+
+/// One navigation link in the agent page header row. Same JSON
+/// shape feeds the dashboard's icon-only nav strip via the host's
+/// `GET /api/agent/{name}/links` passthrough proxy, so the agent
+/// backend is the single source of truth for what links an agent
+/// exposes (issue #262).
+#[derive(Serialize)]
+struct AgentLink {
+    /// `kind = Container | Forge` → path; `kind = External` → full URL.
+    /// The frontend prepends the right base before rendering.
+    url: String,
+    icon: String,
+    label: String,
+    kind: AgentLinkKind,
+}
+
+/// Resolution hint for `AgentLink.url`. The agent backend can't know
+/// which hostname the browser sees (especially when the dashboard
+/// proxies the call from a different origin), so it labels each link
+/// and lets the frontend prepend the right base.
+#[derive(Serialize, Clone, Copy)]
+#[serde(rename_all = "snake_case")]
+enum AgentLinkKind {
+    /// `url` is a path on the agent's container web UI (`/stats`,
+    /// `/screen`). Agent page: same-origin path. Dashboard:
+    /// `http://<host>:<container.port><url>`.
+    Container,
+    /// `url` is a path on the local Forgejo (`/<label>`,
+    /// `/agent-configs/<label>`). Both surfaces:
+    /// `http://<host>:3000<url>`.
+    Forge,
+    /// `url` is already a fully-qualified absolute URL — use as-is.
+    /// Agent-declared `hyperhive.dashboardLinks` extras arrive here.
+    External,
+}
+
+#[derive(Serialize)]
+struct SessionView {
+    /// First `https://…` claude emitted on stdout, if any.
+    url: Option<String>,
+    /// Accumulated stdout + stderr.
+    output: String,
+    finished: bool,
+    exit_note: Option<String>,
+}
+
+/// Proxy this agent's loose-ends list via the per-agent socket. The
+/// web UI surfaces the result as a collapsible section in the page
+/// so the operator can see at a glance what's pending against the
+/// agent (questions asked by it, peer questions targeting it,
+/// reminders it scheduled, approvals for the manager). Same data
+/// the `mcp__hyperhive__get_loose_ends` tool sees from inside the
+/// container.
+async fn api_loose_ends(State(state): State<AppState>) -> Response {
+    let loose_ends: Vec<hive_sh4re::LooseEnd> = match state.flavor() {
+        Flavor::Agent => {
+            match client::request::<_, hive_sh4re::AgentResponse>(
+                &state.socket,
+                &hive_sh4re::AgentRequest::GetLooseEnds,
+            )
+            .await
+            {
+                Ok(hive_sh4re::AgentResponse::LooseEnds { loose_ends }) => loose_ends,
+                Ok(hive_sh4re::AgentResponse::Err { message }) => {
+                    return error_response(&format!("get_loose_ends: {message}"));
+                }
+                Ok(other) => return error_response(&format!("unexpected response: {other:?}")),
+                Err(e) => return error_response(&format!("transport: {e:#}")),
+            }
+        }
+        Flavor::Manager => {
+            match client::request::<_, hive_sh4re::ManagerResponse>(
+                &state.socket,
+                // Manager's own loose ends — the web page is the
+                // manager's page, not a hive-wide console.
+                &hive_sh4re::ManagerRequest::GetLooseEnds { agent: None },
+            )
+            .await
+            {
+                Ok(hive_sh4re::ManagerResponse::LooseEnds { loose_ends }) => loose_ends,
+                Ok(hive_sh4re::ManagerResponse::Err { message }) => {
+                    return error_response(&format!("get_loose_ends: {message}"));
+                }
+                Ok(other) => return error_response(&format!("unexpected response: {other:?}")),
+                Err(e) => return error_response(&format!("transport: {e:#}")),
+            }
+        }
+    };
+    axum::Json(serde_json::json!({ "loose_ends": loose_ends })).into_response()
+}
+
+async fn api_state(State(state): State<AppState>) -> axum::Json<StateSnapshot> {
+    // Capture seq *before* any reads so the dedupe contract is
+    // "events with seq > snapshot.seq are post-snapshot, never missed."
+    let seq = state.bus.current_seq();
+    drop_if_finished(&state.session);
+    let login = *state.login.lock().unwrap();
+    let session_snapshot = state.session.lock().unwrap().clone();
+    let (status, session_view) = match (login, session_snapshot) {
+        (LoginState::Online, _) if state.bus.is_rate_limited() => ("rate_limited", None),
+        (LoginState::Online, _) => ("online", None),
+        (LoginState::NeedsLogin, None) => ("needs_login_idle", None),
+        (LoginState::NeedsLogin, Some(s)) => (
+            "needs_login_in_progress",
+            Some(SessionView {
+                url: s.url(),
+                output: s.output(),
+                finished: s.finished(),
+                exit_note: s.exit_note(),
+            }),
+        ),
+    };
+    let dashboard_port = std::env::var("HIVE_DASHBOARD_PORT")
+        .ok()
+        .and_then(|s| s.parse::<u16>().ok())
+        .unwrap_or(7000);
+    let inbox = recent_inbox(&state.socket, state.flavor()).await;
+    let (turn_state, turn_state_since) = state.bus.state_snapshot();
+    let model = state.bus.model();
+    let context_window_tokens = state
+        .bus
+        .api_context_window()
+        .unwrap_or_else(|| crate::events::context_window_tokens(&model));
+    let ctx_usage = state.bus.last_ctx_usage();
+    let cost_usage = state.bus.last_cost_usage();
+    axum::Json(StateSnapshot {
+        seq,
+        label: state.label.clone(),
+        dashboard_port,
+        status,
+        session: session_view,
+        inbox,
+        turn_state,
+        turn_state_since,
+        model,
+        context_window_tokens,
+        ctx_usage,
+        cost_usage,
+        links: agent_links(&state.label, state.gui_vnc_port.is_some()),
+    })
+}
+
+/// Build the navigation link list for the agent page header
+/// (issue #262). Single source of truth: the dashboard's icon-only
+/// nav strip consumes the same list via the host's
+/// `GET /api/agent/{name}/links` proxy. URLs are paths (relative)
+/// for Container/Forge targets and absolute for External; the
+/// frontend resolves each against its `kind` so the backend never
+/// has to guess the operator's browser host.
+///
+/// The agent harness doesn't know its own deployed sha (the meta
+/// flake lock lives on the host), so the `config` link points at
+/// the repo root; the dashboard renders a `deployed:<sha>` chip
+/// alongside the strip so the operator still sees what's live.
+fn agent_links(label: &str, gui_enabled: bool) -> Vec<AgentLink> {
+    let mut links = Vec::new();
+
+    // Note: the URLs are the actual HTML files served out of the
+    // frontend dist (`stats.html` / `screen.html`); after the #273
+    // backend/frontend split the harness serves these as static
+    // files via ServeDir rather than via Rust routes, so the URL
+    // has to be the on-disk filename.
+    links.push(AgentLink {
+        url: "/stats.html".to_owned(),
+        icon: "📊".to_owned(),
+        label: "stats".to_owned(),
+        kind: AgentLinkKind::Container,
+    });
+
+    if gui_enabled {
+        links.push(AgentLink {
+            url: "/screen.html".to_owned(),
+            icon: "🖥".to_owned(),
+            label: "screen".to_owned(),
+            kind: AgentLinkKind::Container,
+        });
+    }
+
+    if crate::paths::state_dir().join("forge-token").is_file() {
+        links.push(AgentLink {
+            url: format!("/{label}"),
+            icon: "⬡".to_owned(),
+            label: "forge".to_owned(),
+            kind: AgentLinkKind::Forge,
+        });
+        links.push(AgentLink {
+            url: format!("/agent-configs/{label}"),
+            icon: "↳".to_owned(),
+            label: "config".to_owned(),
+            kind: AgentLinkKind::Forge,
+        });
+    }
+
+    // Agent-declared extras (`hyperhive.dashboardLinks` → the
+    // `hive-dashboard-links` NixOS oneshot writes them to
+    // `{state_dir}/hyperhive-dashboard-links.json`). Shape on disk
+    // is `{label, icon, url}` with absolute URLs — those become
+    // `kind = External` links, passed through verbatim.
+    let extras_path =
+        crate::paths::state_dir().join("hyperhive-dashboard-links.json");
+    if let Ok(text) = std::fs::read_to_string(&extras_path)
+        && !text.trim().is_empty()
+        && let Ok(extras) = serde_json::from_str::<Vec<ExtraLink>>(&text)
+    {
+        for e in extras {
+            links.push(AgentLink {
+                url: e.url,
+                icon: e.icon,
+                label: e.label,
+                kind: AgentLinkKind::External,
+            });
+        }
+    }
+
+    links
+}
+
+/// On-disk shape of `hyperhive-dashboard-links.json` (the
+/// `hive-dashboard-links` NixOS oneshot's output). Mapped to
+/// `AgentLink { kind: External }` inside `agent_links`.
+#[derive(serde::Deserialize)]
+struct ExtraLink {
+    label: String,
+    #[serde(default)]
+    icon: String,
+    url: String,
+}
+
+/// Best-effort: pull the last 30 messages addressed to us via the
+/// per-agent / manager socket. Empty list on any transport / decode
+/// failure — the inbox section is decorative, not authoritative.
+async fn recent_inbox(socket: &std::path::Path, flavor: Flavor) -> Vec<hive_sh4re::InboxRow> {
+    const LIMIT: u64 = 30;
+    match flavor {
+        Flavor::Agent => {
+            match client::request::<_, hive_sh4re::AgentResponse>(
+                socket,
+                &hive_sh4re::AgentRequest::Recent { limit: LIMIT },
+            )
+            .await
+            {
+                Ok(hive_sh4re::AgentResponse::Recent { rows }) => rows,
+                _ => Vec::new(),
+            }
+        }
+        Flavor::Manager => {
+            match client::request::<_, hive_sh4re::ManagerResponse>(
+                socket,
+                &hive_sh4re::ManagerRequest::Recent { limit: LIMIT },
+            )
+            .await
+            {
+                Ok(hive_sh4re::ManagerResponse::Recent { rows }) => rows,
+                _ => Vec::new(),
+            }
+        }
+    }
+}
+
+/// Fetch reminder activity stats from the broker via the per-agent /
+/// manager socket. Returns None on any transport / decode failure — the
+/// stats are decorative, not authoritative.
+async fn fetch_reminder_stats(socket: &std::path::Path, flavor: Flavor, window_secs: u64) -> Option<hive_sh4re::ReminderStats> {
+    match flavor {
+        Flavor::Agent => {
+            match client::request::<_, hive_sh4re::AgentResponse>(
+                socket,
+                &hive_sh4re::AgentRequest::ReminderRollup {
+                    since_secs: window_secs,
+                },
+            )
+            .await
+            {
+                Ok(hive_sh4re::AgentResponse::ReminderRollup(stats)) => Some(stats),
+                _ => None,
+            }
+        }
+        Flavor::Manager => {
+            match client::request::<_, hive_sh4re::ManagerResponse>(
+                socket,
+                &hive_sh4re::ManagerRequest::ReminderRollup {
+                    since_secs: window_secs,
+                    // Manager's own stats page — its own reminders.
+                    agent: None,
+                },
+            )
+            .await
+            {
+                Ok(hive_sh4re::ManagerResponse::ReminderRollup(stats)) => Some(stats),
+                _ => None,
+            }
+        }
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Action handlers
+// ---------------------------------------------------------------------------
+
+#[derive(Deserialize)]
+struct SendForm {
+    body: String,
+}
+
+async fn post_send(State(state): State<AppState>, Form(form): Form<SendForm>) -> Response {
+    let body = form.body.trim().to_owned();
+    if body.is_empty() {
+        return error_response("send: `body` required");
+    }
+    let result = match state.flavor() {
+        Flavor::Agent => match client::request::<_, hive_sh4re::AgentResponse>(
+            &state.socket,
+            &hive_sh4re::AgentRequest::OperatorMsg { body },
+        )
+        .await
+        {
+            Ok(hive_sh4re::AgentResponse::Ok) => Ok(()),
+            Ok(hive_sh4re::AgentResponse::Err { message }) => Err(message),
+            Ok(other) => Err(format!("unexpected response: {other:?}")),
+            Err(e) => Err(format!("transport: {e:#}")),
+        },
+        Flavor::Manager => match client::request::<_, hive_sh4re::ManagerResponse>(
+            &state.socket,
+            &hive_sh4re::ManagerRequest::OperatorMsg { body },
+        )
+        .await
+        {
+            Ok(hive_sh4re::ManagerResponse::Ok) => Ok(()),
+            Ok(hive_sh4re::ManagerResponse::Err { message }) => Err(message),
+            Ok(other) => Err(format!("unexpected response: {other:?}")),
+            Err(e) => Err(format!("transport: {e:#}")),
+        },
+    };
+    match result {
+        // 200 instead of 303 → the client doesn't refetch /api/state.
+        // The operator message becomes a broker `Sent` (already shown
+        // server-side in the dashboard); on the agent side, the
+        // resulting `TurnStart` SSE event drives the terminal + the
+        // inbox row gets consumed by the time `TurnEnd` fires the
+        // existing turn-end refresh.
+        Ok(()) => (axum::http::StatusCode::OK, "ok").into_response(),
+        Err(e) => error_response(&format!("send failed: {e}")),
+    }
+}
+
+async fn events_history(State(state): State<AppState>) -> axum::Json<serde_json::Value> {
+    // Capture seq *before* the read so dedupe is "drop buffered events
+    // you've already seen in history", never "lose an event that fired
+    // between the read and the timestamp." Historical rows have no
+    // per-row seq; only the high-water mark matters for the dedupe
+    // window.
+    let seq = state.bus.current_seq();
+    let events = state.bus.history();
+    axum::Json(serde_json::json!({ "seq": seq, "events": events }))
+}
+
+async fn events_stream(
+    State(state): State<AppState>,
+) -> Sse<impl Stream<Item = Result<Event, Infallible>>> {
+    tracing::info!("sse: client subscribed");
+    let rx = state.bus.subscribe();
+    // Drop a "hello" note into the bus so every new subscriber sees at
+    // least one event immediately and can clear the connecting placeholder.
+    state.bus.emit(crate::events::LiveEvent::Note {
+        text: "live stream attached".into(),
+    });
+    let stream = BroadcastStream::new(rx).filter_map(|res| {
+        let ev = res.ok()?;
+        let json = serde_json::to_string(&ev).ok()?;
+        Some(Ok(Event::default().data(json)))
+    });
+    Sse::new(stream).keep_alive(KeepAlive::default())
+}
+
+async fn post_login_start(State(state): State<AppState>) -> Response {
+    drop_if_finished(&state.session);
+    {
+        let guard = state.session.lock().unwrap();
+        if guard.is_some() {
+            return (axum::http::StatusCode::OK, "ok").into_response();
+        }
+    }
+    match LoginSession::start() {
+        Ok(session) => {
+            *state.session.lock().unwrap() = Some(Arc::new(session));
+            // Flip status from needs_login_idle → needs_login_in_progress
+            // so the web UI's badge + polling kick in (polling is still
+            // the right tool for the streaming session output during
+            // the login flow itself; events drop the poll for
+            // *everything else*).
+            state.bus.emit_status("needs_login_in_progress");
+            (axum::http::StatusCode::OK, "ok").into_response()
+        }
+        Err(e) => error_response(&format!("login start failed: {e:#}")),
+    }
+}
+
+#[derive(Deserialize)]
+struct CodeForm {
+    code: String,
+}
+
+async fn post_login_code(State(state): State<AppState>, Form(form): Form<CodeForm>) -> Response {
+    let session = state.session.lock().unwrap().clone();
+    let Some(session) = session else {
+        return error_response("no login session running");
+    };
+    if let Err(e) = session.submit_code(&form.code).await {
+        return error_response(&format!("submit code failed: {e:#}"));
+    }
+    (axum::http::StatusCode::OK, "ok").into_response()
+}
+
+async fn post_login_cancel(State(state): State<AppState>) -> Response {
+    let session = state.session.lock().unwrap().take();
+    if let Some(session) = session {
+        session.close_stdin().await;
+        session.kill();
+    }
+    // Back to needs_login_idle (LoginState unchanged, session gone).
+    state.bus.emit_status("needs_login_idle");
+    (axum::http::StatusCode::OK, "ok").into_response()
+}
+
+/// Operator-initiated session compaction. Spawns `turn::compact_session`
+/// in the background — the HTTP handler returns immediately so the
+/// async-form spinner can clear. Output (claude's compaction stream,
+/// the "/compact done" note) lands in the live event panel like any
+/// other turn. If a regular turn is in flight, claude's own session
+/// lock will reject this one and we surface the error as a Note.
+#[derive(Deserialize)]
+struct ModelForm {
+    model: String,
+}
+
+/// Switch the model for future turns. The current turn (if any)
+/// keeps its model; `/model <name>` applies starting with the next
+/// `recv` cycle. Empty / whitespace-only inputs are rejected. No
+/// claude-side validation — we just hand the string through to
+/// `claude --model <name>`; an unknown model surfaces as a turn
+/// failure in the live panel and the operator can revert.
+async fn post_set_model(State(state): State<AppState>, Form(form): Form<ModelForm>) -> Response {
+    let name = form.model.trim();
+    if name.is_empty() {
+        return error_response("model: name required");
+    }
+    state.bus.set_model(name);
+    state.bus.emit(crate::events::LiveEvent::Note {
+        text: format!("operator: /model — claude model set to '{name}' for future turns"),
+    });
+    tracing::info!(%name, "operator set model");
+    (axum::http::StatusCode::OK, "ok").into_response()
+}
+
+async fn post_compact(State(state): State<AppState>) -> Response {
+    // Clone the Arc before locking so the guard's lifetime is tied to the
+    // clone (which we can move into the spawn) rather than to `state`.
+    let lock = state.turn_lock.clone();
+    // Reject immediately if a normal turn is in flight — concurrent access
+    // to the claude session is unsafe and produces garbled output.
+    let Ok(guard) = lock.try_lock_owned() else {
+        return error_response("turn in flight — wait for it to finish before compacting");
+    };
+    let bus = state.bus.clone();
+    let files = state.files.clone();
+    tokio::spawn(async move {
+        let _guard = guard; // keep lock alive for the duration of compaction
+        bus.emit(crate::events::LiveEvent::Note {
+            text: "operator: /compact — running on persistent session".into(),
+        });
+        bus.set_state(crate::events::TurnState::Compacting);
+        let outcome = crate::turn::compact_session(&files, &bus).await;
+        bus.set_state(crate::events::TurnState::Idle);
+        // Best-effort manual /compact from the operator: compact_session
+        // already emits a Note per outcome, so we don't need to re-emit
+        // here — just record any underlying error to the harness log.
+        if let crate::turn::TurnOutcome::Failed(e) = outcome {
+            tracing::warn!(error = %format!("{e:#}"), "operator /compact failed");
+        }
+    });
+    (axum::http::StatusCode::OK, "ok").into_response()
+}
+
+/// Cancel the in-flight claude turn. Coarse-grained: shells out
+/// `pkill -INT claude` since there's at most one claude per container.
+/// SIGINT (not SIGTERM) so claude flushes anything in-flight and emits a
+/// final result row. Emits a Note so the operator sees the cancel
+/// landed; the actual state transition back to `idle` happens when
+/// `run_claude` wakes up and the harness emits `TurnEnd`.
+/// Arm a one-shot: the next claude turn drops `--continue`, starting a
+/// fresh session. Subsequent turns resume normal `--continue`
+/// behavior. Idempotent before the next turn fires — calling twice
+/// still results in a single fresh start. Useful when the
+/// session-resume context is poisoned (claude went off the rails,
+/// hit an unrecoverable refusal, etc.) and a full reset is cheaper
+/// than asking claude to forget mid-stream.
+async fn post_new_session(State(state): State<AppState>) -> Response {
+    state.bus.request_new_session();
+    state.bus.emit(crate::events::LiveEvent::Note {
+        text: "operator: new session armed — next turn runs without --continue".into(),
+    });
+    (axum::http::StatusCode::OK, "ok").into_response()
+}
+
+async fn post_cancel_turn(State(state): State<AppState>) -> Response {
+    let out = tokio::process::Command::new("pkill")
+        .args(["-INT", "claude"])
+        .output()
+        .await;
+    let note = match out {
+        Ok(o) if o.status.success() => "operator: /cancel — sent SIGINT to claude".to_owned(),
+        Ok(o) if o.status.code() == Some(1) => {
+            "operator: /cancel — no claude process to interrupt".to_owned()
+        }
+        Ok(o) => format!(
+            "operator: /cancel — pkill exited {} stderr={}",
+            o.status,
+            String::from_utf8_lossy(&o.stderr).trim()
+        ),
+        Err(e) => format!("operator: /cancel — pkill failed: {e}"),
+    };
+    state.bus.emit(crate::events::LiveEvent::Note { text: note });
+    (axum::http::StatusCode::OK, "ok").into_response()
+}
+
+fn error_response(message: &str) -> Response {
+    // Plain text — JS app surfaces in `alert()`, HTML wrapping would just
+    // be noise.
+    (StatusCode::INTERNAL_SERVER_ERROR, message.to_owned()).into_response()
+}
diff --git a/hive-c0re/Cargo.toml b/hive-c0re/Cargo.toml
new file mode 100644
index 00000000..73749066
--- /dev/null
+++ b/hive-c0re/Cargo.toml
@@ -0,0 +1,33 @@
+[package]
+name = "hive-c0re"
+edition.workspace = true
+version.workspace = true
+# Render branding/agent-configs.svg → $OUT_DIR/agent-configs.png at
+# compile time (#424). build.rs shells out to `rsvg-convert`
+# (librsvg, pulled in via flake.nix' naersk nativeBuildInputs); the
+# baked PNG is included via include_bytes! from forge.rs so no
+# raster gets checked into git.
+build = "build.rs"
+
+[lints]
+workspace = true
+
+[dependencies]
+anyhow.workspace = true
+axum.workspace = true
+base64.workspace = true
+reqwest.workspace = true
+clap.workspace = true
+hive-sh4re.workspace = true
+libc = "0.2"
+rusqlite.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+tokio.workspace = true
+tokio-stream.workspace = true
+tower-http.workspace = true
+tracing.workspace = true
+tracing-subscriber.workspace = true
+
+[dev-dependencies]
+tempfile = "3"
diff --git a/hive-c0re/build.rs b/hive-c0re/build.rs
new file mode 100644
index 00000000..5e475c36
--- /dev/null
+++ b/hive-c0re/build.rs
@@ -0,0 +1,49 @@
+//! Render `branding/agent-configs.svg` → `$OUT_DIR/agent-configs.png`
+//! at compile time so the daemon can `include_bytes!` the PNG without
+//! checking the raster into git (#424 mara: "generate png on the fly
+//! or in build"). The SVG is the source of truth; the PNG is a build
+//! artifact.
+//!
+//! Uses `rsvg-convert` from PATH (librsvg, already available in
+//! nixpkgs and added to the naersk derivation's `nativeBuildInputs`
+//! in `flake.nix`). For dev builds outside Nix, install librsvg via
+//! your system package manager (Debian/Ubuntu: `librsvg2-bin`,
+//! macOS: `brew install librsvg`).
+
+use std::env;
+use std::path::PathBuf;
+use std::process::Command;
+
+const SVG_PATH: &str = "../branding/agent-configs.svg";
+const PNG_NAME: &str = "agent-configs.png";
+// 300×300 to match the existing branding/hyperhive.png, which the
+// Forgejo avatar endpoint accepts without resizing on upload.
+const PX: &str = "300";
+
+fn main() {
+    // Re-run the build script when either the SVG itself or this
+    // script change. We deliberately don't watch every file in
+    // `branding/` — only the one PNG we generate.
+    println!("cargo:rerun-if-changed=build.rs");
+    println!("cargo:rerun-if-changed={SVG_PATH}");
+
+    let out_dir = PathBuf::from(env::var("OUT_DIR").expect("OUT_DIR set by cargo"));
+    let png_path = out_dir.join(PNG_NAME);
+
+    let status = Command::new("rsvg-convert")
+        .args(["--width", PX, "--height", PX, "-o"])
+        .arg(&png_path)
+        .arg(SVG_PATH)
+        .status();
+
+    match status {
+        Ok(s) if s.success() => {}
+        Ok(s) => panic!("rsvg-convert exited with {s} rendering {SVG_PATH}"),
+        Err(e) => panic!(
+            "failed to invoke rsvg-convert: {e}\n\
+             install librsvg (Debian/Ubuntu: librsvg2-bin, macOS: brew install librsvg, \
+             NixOS: pkgs.librsvg). The Nix derivation already pulls it in via \
+             flake.nix → naersk-lib.buildPackage.nativeBuildInputs.",
+        ),
+    }
+}
diff --git a/hive-c0re/src/actions.rs b/hive-c0re/src/actions.rs
new file mode 100644
index 00000000..76998cf1
--- /dev/null
+++ b/hive-c0re/src/actions.rs
@@ -0,0 +1,778 @@
+//! Operations that are exposed through more than one surface (the host admin
+//! socket *and* the dashboard's POST endpoints). Each function takes a
+//! `&Coordinator` and the request parameters; callers stitch the response
+//! shape they want (HTTP redirect vs JSON).
+
+use std::sync::Arc;
+
+use anyhow::{Context as _, Result, bail};
+use hive_sh4re::{ApprovalKind, ApprovalStatus, HelperEvent, MANAGER_AGENT};
+
+use crate::coordinator::{Coordinator, TransientKind};
+use crate::lifecycle::{self, MANAGER_NAME};
+
+/// Approve a pending request. Marks the approval row durably, then
+/// either runs the work inline (`InitConfig`, sub-second git ops) or
+/// enqueues it into `rebuild_queue` so the dashboard POST returns
+/// immediately while the long-running pipeline runs off-thread
+/// (closes #436 — operator no longer eats a 30-90s spinner on
+/// `ApplyCommit`).
+///
+/// Dispatch:
+/// - `ApplyCommit`  → `QueueKind::Rebuild`     (~30-90s wall time)
+/// - `UpdateMetaInputs` → `QueueKind::MetaUpdate` (~3-15s)
+/// - `Spawn`       → `QueueKind::Spawn`        (~30-90s)
+/// - `InitConfig`  → inline (<1s; queue card would be noise)
+///
+/// The queue worker re-fetches the approval row on dispatch, runs
+/// the kind-specific pipeline, and fires `ApprovalResolved` /
+/// `Spawned` / `Rebuilt` / `ConfigReady` via `finish_approval`.
+pub async fn approve(coord: Arc<Coordinator>, id: i64) -> Result<()> {
+    let approval = coord.approvals.mark_approved(id)?;
+    tracing::info!(
+        %approval.id,
+        %approval.agent,
+        kind = ?approval.kind,
+        %approval.commit_ref,
+        "approval: dispatching",
+    );
+    match approval.kind {
+        ApprovalKind::InitConfig => {
+            // Sub-second git seed + forge-remote wire. Routing through
+            // the queue would surface a queue card that's gone before
+            // the operator's eyes refocus. Run inline.
+            let proposed_dir = Coordinator::agent_proposed_dir(&approval.agent);
+            let claude_dir = Coordinator::agent_claude_dir(&approval.agent);
+            let notes_dir = Coordinator::agent_notes_dir(&approval.agent);
+            run_approval_init_config(&coord, approval, proposed_dir, claude_dir, notes_dir).await
+        }
+        ApprovalKind::ApplyCommit => {
+            coord.rebuild_queue.enqueue_full(
+                crate::rebuild_queue::QueueKind::Rebuild,
+                approval.agent.clone(),
+                crate::rebuild_queue::QueueSource::Approval,
+                format!("approval #{id} apply commit"),
+                None,
+                Vec::new(),
+                Some(id),
+            );
+            coord.emit_rebuild_queue_snapshot();
+            Ok(())
+        }
+        ApprovalKind::UpdateMetaInputs => {
+            // Inputs JSON-encoded into commit_ref by the manager's
+            // submit path — surface them on the queue entry so the
+            // dashboard can show *which* inputs are about to bump.
+            let inputs: Vec<String> =
+                serde_json::from_str(&approval.commit_ref).unwrap_or_default();
+            coord.rebuild_queue.enqueue_full(
+                crate::rebuild_queue::QueueKind::MetaUpdate,
+                approval.agent.clone(),
+                crate::rebuild_queue::QueueSource::Approval,
+                format!("approval #{id} meta input update"),
+                None,
+                inputs,
+                Some(id),
+            );
+            coord.emit_rebuild_queue_snapshot();
+            Ok(())
+        }
+        ApprovalKind::Spawn => {
+            coord.rebuild_queue.enqueue_full(
+                crate::rebuild_queue::QueueKind::Spawn,
+                approval.agent.clone(),
+                crate::rebuild_queue::QueueSource::Approval,
+                format!("approval #{id} spawn"),
+                None,
+                Vec::new(),
+                Some(id),
+            );
+            coord.emit_rebuild_queue_snapshot();
+            Ok(())
+        }
+        ApprovalKind::SchedulePrompt => {
+            // No queue card for SchedulePrompt — the work is a single
+            // sqlite insert, the actual "running" lifetime lives on
+            // the scheduled-prompts surface itself (worker fires it
+            // at the scheduled time). Run inline + fire
+            // `ApprovalResolved` so the approval row leaves Pending
+            // immediately.
+            run_approval_schedule_prompt(&coord, approval).await
+        }
+    }
+}
+
+/// Worker entry point for `ApprovalKind::ApplyCommit` queue entries.
+/// Re-fetches the approval row, runs the commit pipeline (same
+/// shape as the pre-#436 inline path), and fires `ApprovalResolved`
+/// + the lifecycle event (`Rebuilt` / `Spawned` for first-spawn).
+pub async fn run_approval_apply_commit(
+    coord: &Arc<Coordinator>,
+    queue_entry_id: Option<u64>,
+    approval_id: i64,
+) -> Result<()> {
+    let approval = fetch_approval_for_worker(coord, approval_id, ApprovalKind::ApplyCommit)?;
+    let agent_dir = coord.ensure_runtime(&approval.agent)?;
+    let applied_dir = Coordinator::agent_applied_dir(&approval.agent);
+    let claude_dir = Coordinator::agent_claude_dir(&approval.agent);
+    let notes_dir = Coordinator::agent_notes_dir(&approval.agent);
+    coord.set_queue_step(queue_entry_id, "apply commit");
+    let (result, terminal_tag, is_first_spawn) = run_apply_commit(
+        coord,
+        &approval,
+        &agent_dir,
+        &applied_dir,
+        &claude_dir,
+        &notes_dir,
+        queue_entry_id,
+    )
+    .await;
+    coord.set_queue_step(queue_entry_id, "forge push");
+    if let Err(e) = crate::forge::push_config(&approval.agent).await {
+        tracing::warn!(agent = %approval.agent, error = ?e, "forge: push_config after apply failed");
+    }
+    if is_first_spawn && result.is_ok() {
+        coord.set_queue_step(queue_entry_id, "first-spawn forge bootstrap");
+        forge_after_first_spawn(coord, &approval.agent).await;
+    }
+    // `finish_approval` returns the original `result` so the queue
+    // worker sees Ok/Err and marks the queue entry accordingly. The
+    // approval row + helper events have already been fanned out.
+    finish_approval(coord, &approval, result, terminal_tag, is_first_spawn)
+}
+
+/// Inline (non-queued) handler for `ApprovalKind::SchedulePrompt`.
+/// On approve, decode the `SchedulePromptPayload` JSON from the
+/// approval's `commit_ref`, insert a row into `scheduled_prompts`
+/// (with `source = Approval { id }`), and fire `ApprovalResolved`.
+/// The worker takes over from here — fan-out at fire time.
+async fn run_approval_schedule_prompt(
+    coord: &Coordinator,
+    approval: hive_sh4re::Approval,
+) -> Result<()> {
+    let result: Result<()> = async {
+        let payload: hive_sh4re::SchedulePromptPayload =
+            serde_json::from_str(&approval.commit_ref)
+                .context("decode SchedulePromptPayload from approval.commit_ref")?;
+        coord
+            .scheduled_prompts
+            .submit(crate::scheduled_prompts::NewSchedule {
+                owner: approval.agent.clone(),
+                targets: payload.targets,
+                body: payload.body,
+                first_fire_at_unix: payload.first_fire_at_unix,
+                interval_seconds: payload.interval_seconds,
+                description: payload.description,
+                source: crate::scheduled_prompts::ScheduleSource::Approval {
+                    id: approval.id,
+                },
+            })
+            .map(|_| ())
+            .context("insert scheduled prompt")
+    }
+    .await;
+    finish_approval(coord, &approval, result, None, false)
+}
+
+/// Worker entry point for `ApprovalKind::UpdateMetaInputs` queue
+/// entries. Inputs come from the approval row's `commit_ref` field
+/// (JSON-encoded by the manager submit path), not the queue entry's
+/// `inputs` — the queue copy is for dashboard display only.
+pub async fn run_approval_update_meta_inputs(
+    coord: &Arc<Coordinator>,
+    queue_entry_id: Option<u64>,
+    approval_id: i64,
+) -> Result<()> {
+    let approval = fetch_approval_for_worker(coord, approval_id, ApprovalKind::UpdateMetaInputs)?;
+    let inputs: Vec<String> = serde_json::from_str(&approval.commit_ref).unwrap_or_default();
+    coord.set_queue_step(queue_entry_id, "nix flake update");
+    let result = crate::meta::lock_update(&inputs).await;
+    finish_approval(coord, &approval, result, None, false)
+}
+
+/// Worker entry point for `ApprovalKind::Spawn` queue entries.
+/// Differs from `run_approval_apply_commit` only in routing through
+/// `lifecycle::spawn` (the deprecated direct-spawn path). Synchronous
+/// in the queue worker — the previous `tokio::spawn` wrapper is gone
+/// (the queue worker itself is the async task).
+pub async fn run_approval_spawn(
+    coord: &Arc<Coordinator>,
+    queue_entry_id: Option<u64>,
+    approval_id: i64,
+) -> Result<()> {
+    let approval = fetch_approval_for_worker(coord, approval_id, ApprovalKind::Spawn)?;
+    let agent_dir = coord.ensure_runtime(&approval.agent)?;
+    let proposed_dir = Coordinator::agent_proposed_dir(&approval.agent);
+    let applied_dir = Coordinator::agent_applied_dir(&approval.agent);
+    let claude_dir = Coordinator::agent_claude_dir(&approval.agent);
+    let notes_dir = Coordinator::agent_notes_dir(&approval.agent);
+    // Transient guard keeps the per-container "Spawning" pill lit while
+    // the worker is doing the actual nixos-container create. Auto-clears
+    // on the function's scope exit (success or panic).
+    let _guard = coord.transient_guard(&approval.agent, TransientKind::Spawning);
+    coord.set_queue_step(queue_entry_id, "lifecycle::spawn");
+    let result = lifecycle::spawn(
+        &approval.agent,
+        &coord.hyperhive_flake,
+        &agent_dir,
+        &proposed_dir,
+        &applied_dir,
+        &claude_dir,
+        &notes_dir,
+        coord.dashboard_port,
+        &coord.operator_pronouns,
+        &coord.context_window_tokens,
+    )
+    .await;
+    if result.is_ok() {
+        coord.set_queue_step(queue_entry_id, "forge user");
+        if let Err(e) = crate::forge::ensure_user_for(&approval.agent).await {
+            tracing::warn!(agent = %approval.agent, error = ?e, "forge: ensure_user after spawn failed");
+        }
+        coord.set_queue_step(queue_entry_id, "forge config repo");
+        if let Err(e) = crate::forge::ensure_config_repo(&approval.agent).await {
+            tracing::warn!(agent = %approval.agent, error = ?e, "forge: ensure_config_repo after spawn failed");
+        }
+        coord.set_queue_step(queue_entry_id, "forge push");
+        if let Err(e) = crate::forge::push_config(&approval.agent).await {
+            tracing::warn!(agent = %approval.agent, error = ?e, "forge: push_config after spawn failed");
+        }
+        coord.set_queue_step(queue_entry_id, "forge meta access");
+        if let Some(core_token) = crate::forge::core_token()
+            && let Err(e) = crate::forge::meta_read_access(&approval.agent, &core_token).await
+        {
+            tracing::warn!(agent = %approval.agent, error = ?e, "forge: meta_read_access after spawn failed");
+        }
+        if let Err(e) = crate::forge::ensure_meta_remote(&approval.agent).await {
+            tracing::warn!(agent = %approval.agent, error = ?e, "forge: ensure_meta_remote after spawn failed");
+        }
+    }
+    let final_result = finish_approval(coord, &approval, result, None, false);
+    coord.rescan_containers_and_emit().await;
+    crate::dashboard::emit_tombstones_snapshot(coord).await;
+    final_result
+}
+
+/// Re-fetch an approval row from sqlite for a queue-worker dispatch.
+/// Bails if the row is gone (deny race), if its kind doesn't match,
+/// or if the lookup itself fails. The kind check is defensive — the
+/// queue's `dispatch` already routes by `QueueKind`, but the approval
+/// kind is the authoritative source of truth and a mismatch points
+/// at a deeper bug we'd want to surface.
+fn fetch_approval_for_worker(
+    coord: &Coordinator,
+    approval_id: i64,
+    expected_kind: ApprovalKind,
+) -> Result<hive_sh4re::Approval> {
+    let approval = coord
+        .approvals
+        .get(approval_id)
+        .map_err(|e| anyhow::anyhow!("read approval {approval_id}: {e:#}"))?
+        .ok_or_else(|| anyhow::anyhow!("approval {approval_id} no longer exists"))?;
+    if approval.kind != expected_kind {
+        bail!(
+            "approval {approval_id} kind mismatch: queue expected {expected_kind:?}, row is {actual:?}",
+            actual = approval.kind
+        );
+    }
+    Ok(approval)
+}
+
+/// Forge bookkeeping run once after the very first container spawn:
+/// create the per-agent forge user, mirror the applied repo, and grant
+/// read access to core/meta. Also rescans containers so the dashboard
+/// reflects the post-spawn state.
+async fn forge_after_first_spawn(coord: &Arc<Coordinator>, agent: &str) {
+    if let Err(e) = crate::forge::ensure_user_for(agent).await {
+        tracing::warn!(%agent, error = ?e, "forge: ensure_user after first spawn failed");
+    }
+    if let Err(e) = crate::forge::ensure_config_repo(agent).await {
+        tracing::warn!(%agent, error = ?e, "forge: ensure_config_repo after first spawn failed");
+    }
+    if let Some(core_token) = crate::forge::core_token()
+        && let Err(e) = crate::forge::meta_read_access(agent, &core_token).await {
+            tracing::warn!(%agent, error = ?e, "forge: meta_read_access after first spawn failed");
+        }
+    if let Err(e) = crate::forge::ensure_meta_remote(agent).await {
+        tracing::warn!(%agent, error = ?e, "forge: ensure_meta_remote after first spawn failed");
+    }
+    coord.rescan_containers_and_emit().await;
+    crate::dashboard::emit_tombstones_snapshot(coord).await;
+}
+
+/// Inline (non-queued) handler for `ApprovalKind::InitConfig`. Just
+/// seeds the proposed git repo + the per-agent dirs — sub-second
+/// work that doesn't justify a queue card.
+async fn run_approval_init_config(
+    coord: &Coordinator,
+    approval: hive_sh4re::Approval,
+    proposed_dir: std::path::PathBuf,
+    claude_dir: std::path::PathBuf,
+    notes_dir: std::path::PathBuf,
+) -> Result<()> {
+    let result: Result<()> = async {
+        lifecycle::setup_proposed(&proposed_dir, &approval.agent).await?;
+        lifecycle::ensure_claude_dir(&claude_dir)?;
+        lifecycle::ensure_state_dir(&notes_dir)?;
+        Ok(())
+    }
+    .await;
+    if result.is_ok()
+        && let Err(e) = crate::forge::ensure_meta_remote(&approval.agent).await
+    {
+        tracing::warn!(agent = %approval.agent, error = ?e, "forge: ensure_meta_remote after init_config failed");
+    }
+    finish_approval(coord, &approval, result, None, false)
+}
+
+fn finish_approval(
+    coord: &Coordinator,
+    approval: &hive_sh4re::Approval,
+    result: Result<()>,
+    terminal_tag: Option<String>,
+    is_first_spawn: bool,
+) -> Result<()> {
+    let (status, note, ok) = match &result {
+        Ok(()) => (ApprovalStatus::Approved, None, true),
+        Err(e) => {
+            let note = format!("{e:#}");
+            let _ = coord.approvals.mark_failed(approval.id, &note);
+            (ApprovalStatus::Failed, Some(note), false)
+        }
+    };
+    coord.notify_manager(&HelperEvent::ApprovalResolved {
+        id: approval.id,
+        agent: approval.agent.clone(),
+        commit_ref: approval.commit_ref.clone(),
+        status,
+        note: note.clone(),
+        sha: approval.fetched_sha.clone(),
+        tag: terminal_tag.clone(),
+    });
+    // Phase 5b: also fire on the dashboard event channel so the
+    // browser moves the row out of pending into history without a
+    // snapshot refetch. `approved` rows that succeed get the
+    // approval's logged resolved_at indirectly via `now_unix()`;
+    // failures already wrote it via mark_failed above.
+    let approval_kind = match approval.kind {
+        ApprovalKind::Spawn => "spawn",
+        ApprovalKind::ApplyCommit => "apply_commit",
+        ApprovalKind::InitConfig => "init_config",
+        ApprovalKind::UpdateMetaInputs => "update_meta_inputs",
+        ApprovalKind::SchedulePrompt => "schedule_prompt",
+    };
+    let sha_short = approval
+        .fetched_sha
+        .as_deref()
+        .map(|s| s[..s.len().min(12)].to_owned());
+    let status_str = if ok { "approved" } else { "failed" };
+    coord.emit_approval_resolved(
+        approval.id,
+        &approval.agent,
+        approval_kind,
+        sha_short,
+        status_str,
+        note.clone(),
+        approval.description.clone(),
+    );
+    // For spawn/rebuild/init_config approvals, also surface the underlying
+    // action so the manager knows whether the lifecycle step succeeded.
+    // The ApprovalResolved event already carries the same `ok` signal but
+    // separating it lets the manager react to the lifecycle change
+    // without having to special-case approvals.
+    match approval.kind {
+        ApprovalKind::InitConfig => {
+            if ok {
+                coord.notify_manager(&HelperEvent::ConfigReady {
+                    agent: approval.agent.clone(),
+                });
+            }
+        }
+        ApprovalKind::Spawn => coord.notify_manager(&HelperEvent::Spawned {
+            agent: approval.agent.clone(),
+            ok,
+            note,
+            sha: approval.fetched_sha.clone(),
+        }),
+        ApprovalKind::ApplyCommit if is_first_spawn => {
+            coord.notify_manager(&HelperEvent::Spawned {
+                agent: approval.agent.clone(),
+                ok,
+                note,
+                sha: approval.fetched_sha.clone(),
+            });
+        }
+        ApprovalKind::ApplyCommit => coord.notify_manager(&HelperEvent::Rebuilt {
+            agent: approval.agent.clone(),
+            ok,
+            note,
+            sha: approval.fetched_sha.clone(),
+            tag: terminal_tag,
+        }),
+        // UpdateMetaInputs / SchedulePrompt: ApprovalResolved already
+        // carries the result. No separate lifecycle event needed.
+        ApprovalKind::UpdateMetaInputs | ApprovalKind::SchedulePrompt => {}
+    }
+    result
+}
+
+/// Tag-driven `ApplyCommit` handler. Walks the approval through the tag
+/// state machine documented in `docs/approvals.md`: stamp
+/// `approved/<id>` and `building/<id>` first so the audit trail
+/// captures intent, then drop the candidate tree into the working dir
+/// without moving HEAD, run the rebuild, and either fast-forward
+/// `applied/main` to the proposal commit on success
+/// (`deployed/<id>`) or annotate `failed/<id>` with the build error
+/// and reset the working tree back to the last known-good main. main
+/// never advances on a failed build, so a crash-and-recover doesn't
+/// leave the agent pointing at a tree it can't evaluate.
+#[allow(clippy::too_many_lines)] // sequential build/tag/notify pipeline; splitting would obscure the flow
+async fn run_apply_commit(
+    coord: &Arc<Coordinator>,
+    approval: &hive_sh4re::Approval,
+    agent_dir: &std::path::Path,
+    applied_dir: &std::path::Path,
+    claude_dir: &std::path::Path,
+    notes_dir: &std::path::Path,
+    queue_entry_id: Option<u64>,
+) -> (Result<()>, Option<String>, bool) {
+    let id = approval.id;
+    let proposal_ref = format!("refs/tags/proposal/{id}");
+
+    // Detect first spawn before we touch anything so we can branch on it
+    // throughout this function.
+    let is_first_spawn = !lifecycle::container_exists(&approval.agent).await;
+
+    // Defensive: submit-time should have planted proposal/<id>, but if
+    // the row was migrated from an older schema or the tag got pruned
+    // we fail early with a clear note rather than building a stale
+    // tree.
+    if let Err(e) = lifecycle::git_rev_parse(applied_dir, &proposal_ref).await {
+        return (
+            Err(anyhow::anyhow!(
+                "missing proposal tag {proposal_ref}: {e:#}"
+            )),
+            None,
+            is_first_spawn,
+        );
+    }
+
+    // Capture the currently-deployed sha so we can roll applied/main
+    // (and the meta lock indirectly) back if the build fails.
+    let prev_main_sha = match lifecycle::git_rev_parse(applied_dir, "refs/heads/main").await {
+        Ok(s) => s,
+        Err(e) => {
+            return (
+                Err(anyhow::anyhow!("read applied/main: {e:#}")),
+                None,
+                is_first_spawn,
+            )
+        }
+    };
+
+    coord.set_queue_step(queue_entry_id, "plant tags");
+    if let Err(e) = lifecycle::git_tag(applied_dir, &format!("approved/{id}"), &proposal_ref).await
+    {
+        return (
+            Err(anyhow::anyhow!("plant approved/{id}: {e:#}")),
+            None,
+            is_first_spawn,
+        );
+    }
+    if let Err(e) = lifecycle::git_tag(applied_dir, &format!("building/{id}"), &proposal_ref).await
+    {
+        return (
+            Err(anyhow::anyhow!("plant building/{id}: {e:#}")),
+            None,
+            is_first_spawn,
+        );
+    }
+
+    coord.set_queue_step(queue_entry_id, "fast-forward applied/main");
+    // Fast-forward applied/main to proposal/<id> + sync the working
+    // tree. Meta input pins `?ref=main`, so this is what makes nix
+    // re-lock to the proposal commit on the prepare_deploy step
+    // below. On build failure we roll main back to prev_main_sha so
+    // a crash leaves the agent on its last-good tree.
+    if let Err(e) = lifecycle::git_update_ref(applied_dir, "refs/heads/main", &proposal_ref).await {
+        return (
+            Err(anyhow::anyhow!("ff main to {proposal_ref}: {e:#}")),
+            None,
+            is_first_spawn,
+        );
+    }
+    if let Err(e) = lifecycle::git_read_tree_reset(applied_dir, "refs/heads/main").await {
+        // main is ahead; working tree didn't sync. Roll main back to
+        // keep the two consistent before bailing.
+        let _ = lifecycle::git_update_ref(applied_dir, "refs/heads/main", &prev_main_sha).await;
+        return (
+            Err(anyhow::anyhow!("read-tree to main: {e:#}")),
+            None,
+            is_first_spawn,
+        );
+    }
+
+    // First spawn: sync_agents must add this agent to the meta flake
+    // before prepare_deploy can update its input lock (which won't
+    // exist yet if this is the agent's first deploy).
+    if is_first_spawn {
+        coord.set_queue_step(queue_entry_id, "meta sync_agents (first spawn)");
+        let agents = match lifecycle::agents_for_meta_listing_with(&approval.agent).await {
+            Ok(a) => a,
+            Err(e) => {
+                let _ =
+                    lifecycle::git_update_ref(applied_dir, "refs/heads/main", &prev_main_sha)
+                        .await;
+                let _ = lifecycle::git_read_tree_reset(applied_dir, "refs/heads/main").await;
+                return (
+                    Err(anyhow::anyhow!("agents_for_meta_listing_with: {e:#}")),
+                    None,
+                    is_first_spawn,
+                );
+            }
+        };
+        if let Err(e) = crate::meta::sync_agents(
+            &coord.hyperhive_flake,
+            coord.dashboard_port,
+            &coord.operator_pronouns,
+            &coord.context_window_tokens,
+            &agents,
+        )
+        .await
+        {
+            let _ =
+                lifecycle::git_update_ref(applied_dir, "refs/heads/main", &prev_main_sha).await;
+            let _ = lifecycle::git_read_tree_reset(applied_dir, "refs/heads/main").await;
+            return (
+                Err(anyhow::anyhow!("meta sync_agents for first spawn: {e:#}")),
+                None,
+                is_first_spawn,
+            );
+        }
+    }
+
+    coord.set_queue_step(queue_entry_id, "meta prepare_deploy");
+    // Phase 1 of the meta two-phase deploy: relock without committing.
+    if let Err(e) = crate::meta::prepare_deploy(&approval.agent).await {
+        let _ = lifecycle::git_update_ref(applied_dir, "refs/heads/main", &prev_main_sha).await;
+        let _ = lifecycle::git_read_tree_reset(applied_dir, "refs/heads/main").await;
+        return (
+            Err(anyhow::anyhow!("meta prepare_deploy: {e:#}")),
+            None,
+            is_first_spawn,
+        );
+    }
+
+    coord.set_queue_step(queue_entry_id, "nixos-container update");
+    // Container-level rebuild (or first-time create) against meta#<name>.
+    let build_result = lifecycle::rebuild_no_meta(
+        &approval.agent,
+        agent_dir,
+        applied_dir,
+        claude_dir,
+        notes_dir,
+    )
+    .await;
+
+    match build_result {
+        Ok(()) => {
+            coord.set_queue_step(queue_entry_id, "finalize deploy");
+            let tag = format!("deployed/{id}");
+            if let Err(e) = lifecycle::git_tag(applied_dir, &tag, &proposal_ref).await {
+                tracing::warn!(agent = %approval.agent, %id, error = ?e, "plant deployed tag failed");
+            }
+            if let Err(e) = crate::meta::finalize_deploy(
+                &approval.agent,
+                approval.fetched_sha.as_deref().unwrap_or(&proposal_ref),
+                &tag,
+            )
+            .await
+            {
+                // The build itself succeeded — meta lock landed but
+                // couldn't be committed. Surface as a soft warn so the
+                // operator can git-commit by hand if they care.
+                tracing::warn!(agent = %approval.agent, %id, error = ?e, "meta finalize_deploy failed");
+            }
+            // Wake the agent on its next turn so claude sees the
+            // config change took effect. Same hint pattern as
+            // auto_update::rebuild_agent — manager approved a
+            // proposal, agent picks up where it left off with the
+            // new env / packages.
+            coord.kick_agent(&approval.agent, "config update applied");
+            (Ok(()), Some(tag), is_first_spawn)
+        }
+        Err(e) => {
+            let tag = format!("failed/{id}");
+            let body = format!("{e:#}");
+            if let Err(te) =
+                lifecycle::git_tag_annotated(applied_dir, &tag, &proposal_ref, &body).await
+            {
+                tracing::warn!(agent = %approval.agent, %id, error = ?te, "annotate failed tag failed");
+            }
+            // Roll main back to last known-good so the on-disk state
+            // matches what nixos-container last successfully built.
+            if let Err(re) =
+                lifecycle::git_update_ref(applied_dir, "refs/heads/main", &prev_main_sha).await
+            {
+                tracing::warn!(agent = %approval.agent, %id, error = ?re, "main rollback failed");
+            }
+            if let Err(re) = lifecycle::git_read_tree_reset(applied_dir, "refs/heads/main").await {
+                tracing::warn!(agent = %approval.agent, %id, error = ?re, "rollback read-tree failed");
+            }
+            // Drop the staged meta lock change so the deploy log
+            // only ever shows successes.
+            if let Err(ae) = crate::meta::abort_deploy().await {
+                tracing::warn!(agent = %approval.agent, %id, error = ?ae, "meta abort_deploy failed");
+            }
+            let _ = coord;
+            (Err(e), Some(tag), is_first_spawn)
+        }
+    }
+}
+
+/// Tear down a sub-agent container. By default this is non-destructive to
+/// persistent state: the proposed/applied config repos and the Claude
+/// credentials dir under `/var/lib/hyperhive/{agents,applied}/<name>/` are
+/// kept, so recreating an agent of the same name reuses prior config + creds
+/// (no re-login). The ephemeral runtime dir under `/run/hyperhive/agents/`
+/// is cleared because its contents (the mcp socket) don't survive restarts
+/// anyway. With `purge=true` the persistent trees are also wiped — config
+/// history, claude creds, notes — there is no undo.
+/// Refuses the manager (declarative; would fight with the host's nixos config).
+pub async fn destroy(coord: &Arc<Coordinator>, name: &str, purge: bool) -> Result<()> {
+    if name == MANAGER_NAME || name == MANAGER_AGENT {
+        bail!("refusing to destroy the manager ({name})");
+    }
+    tracing::info!(%name, purge, "destroy");
+    // Guard auto-clears on the success path's final scope exit and on
+    // every early-return / cancellation along the way.
+    let guard = coord.transient_guard(name, TransientKind::Destroying);
+    lifecycle::destroy(name).await?;
+    coord.unregister_agent(name);
+    let runtime = Coordinator::agent_dir(name);
+    if runtime.exists() {
+        let _ = std::fs::remove_dir_all(&runtime);
+    }
+    if purge {
+        for dir in [
+            Coordinator::agent_state_root(name),
+            Coordinator::agent_applied_dir(name),
+        ] {
+            if dir.exists()
+                && let Err(e) = std::fs::remove_dir_all(&dir)
+            {
+                tracing::warn!(error = ?e, dir = %dir.display(), "purge: remove failed");
+            }
+        }
+    }
+    // Meta flake: drop the agent's input + nixosConfiguration so a
+    // future spawn under the same name re-seeds cleanly, and so the
+    // meta lock doesn't reference a vanished applied repo. Log + keep
+    // going on failure — destroy already succeeded at the
+    // nixos-container level, the meta repo is just bookkeeping.
+    if let Err(e) = sync_meta_after_lifecycle(coord).await {
+        tracing::warn!(error = ?e, %name, "meta sync after destroy failed");
+    }
+    let _ = coord.approvals.fail_pending_for_agent(
+        name,
+        if purge {
+            "agent purged"
+        } else {
+            "agent destroyed"
+        },
+    );
+    drop(guard);
+    coord.notify_manager(&HelperEvent::Destroyed {
+        agent: name.to_owned(),
+    });
+    // Container row disappeared — rescan so the dashboard fires
+    // `ContainerRemoved` for the gone row, then emit the
+    // tombstones snapshot (gained one on destroy, lost one on
+    // purge — recompute either way).
+    coord.rescan_containers_and_emit().await;
+    crate::dashboard::emit_tombstones_snapshot(coord).await;
+    Ok(())
+}
+
+/// Rerender the meta flake from whatever containers still exist on
+/// disk. Called after lifecycle ops that change the agent set (today:
+/// destroy). Idempotent — a no-op when nothing changed.
+async fn sync_meta_after_lifecycle(coord: &Coordinator) -> Result<()> {
+    let agents = lifecycle::agents_for_meta_listing().await?;
+    crate::meta::sync_agents(
+        &coord.hyperhive_flake,
+        coord.dashboard_port,
+        &coord.operator_pronouns,
+        &coord.context_window_tokens,
+        &agents,
+    )
+    .await
+}
+
+pub async fn deny(coord: &Coordinator, id: i64, note: Option<&str>) -> Result<()> {
+    let approval = coord.approvals.get(id)?;
+    coord.approvals.mark_denied(id, note)?;
+    tracing::info!(%id, note, "approval denied");
+    let mut tag = None;
+    if let Some(a) = approval {
+        let sha = a.fetched_sha.clone();
+        // ApplyCommit approvals leave a `denied/<id>` tag on the
+        // proposal commit so rejected configs are first-class git
+        // objects — `git show denied/<id>` in the manager's applied
+        // mount yields both the tree the operator rejected and (in
+        // the annotated body) the reason. Spawn approvals have no
+        // commit to tag, so they fall through unannotated.
+        if matches!(a.kind, ApprovalKind::ApplyCommit) {
+            let applied_dir = Coordinator::agent_applied_dir(&a.agent);
+            let proposal_ref = format!("refs/tags/proposal/{id}");
+            if lifecycle::git_rev_parse(&applied_dir, &proposal_ref)
+                .await
+                .is_ok()
+            {
+                let tag_name = format!("denied/{id}");
+                let body = note.unwrap_or("").to_owned();
+                if let Err(e) =
+                    lifecycle::git_tag_annotated(&applied_dir, &tag_name, &proposal_ref, &body)
+                        .await
+                {
+                    tracing::warn!(%id, error = ?e, "plant denied tag failed");
+                } else {
+                    tag = Some(tag_name);
+                }
+            }
+            // Mirror the denied/<id> tag to the forge.
+            if let Err(e) = crate::forge::push_config(&a.agent).await {
+                tracing::warn!(%id, agent = %a.agent, error = ?e, "forge: push_config after deny failed");
+            }
+        }
+        let approval_kind = match a.kind {
+            ApprovalKind::Spawn => "spawn",
+            ApprovalKind::ApplyCommit => "apply_commit",
+            ApprovalKind::InitConfig => "init_config",
+            ApprovalKind::UpdateMetaInputs => "update_meta_inputs",
+            ApprovalKind::SchedulePrompt => "schedule_prompt",
+        };
+        let sha_short = sha.as_deref().map(|s| s[..s.len().min(12)].to_owned());
+        let description = a.description.clone();
+        let agent_owned = a.agent.clone();
+        coord.notify_manager(&HelperEvent::ApprovalResolved {
+            id: a.id,
+            agent: a.agent,
+            commit_ref: a.commit_ref,
+            status: ApprovalStatus::Denied,
+            note: note.map(String::from),
+            sha,
+            tag,
+        });
+        coord.emit_approval_resolved(
+            id,
+            &agent_owned,
+            approval_kind,
+            sha_short,
+            "denied",
+            note.map(String::from),
+            description,
+        );
+    }
+    Ok(())
+}
diff --git a/hive-c0re/src/agent_server.rs b/hive-c0re/src/agent_server.rs
new file mode 100644
index 00000000..cbf763ad
--- /dev/null
+++ b/hive-c0re/src/agent_server.rs
@@ -0,0 +1,507 @@
+//! Per-agent socket listener. Each socket file's existence on disk
+//! authenticates the caller: connecting to `<.../agents/foo/mcp.sock>` means
+//! you are `foo`.
+
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+
+use anyhow::{Context, Result};
+use hive_sh4re::{AgentRequest, AgentResponse, Message};
+use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
+use tokio::net::{UnixListener, UnixStream};
+use tokio::task::JoinHandle;
+
+use crate::coordinator::Coordinator;
+
+pub struct AgentSocket {
+    pub path: PathBuf,
+    pub handle: JoinHandle<()>,
+}
+
+pub fn start(agent: &str, socket_path: &Path, coord: Arc<Coordinator>) -> Result<AgentSocket> {
+    let agent = agent.to_owned();
+    if let Some(parent) = socket_path.parent() {
+        std::fs::create_dir_all(parent)
+            .with_context(|| format!("create agent socket dir {}", parent.display()))?;
+    }
+    if socket_path.exists() {
+        std::fs::remove_file(socket_path).context("remove stale agent socket")?;
+    }
+    let listener = UnixListener::bind(socket_path)
+        .with_context(|| format!("bind agent socket {}", socket_path.display()))?;
+    tracing::info!(%agent, socket = %socket_path.display(), "agent socket listening");
+
+    let path = socket_path.to_path_buf();
+    let handle = tokio::spawn(async move {
+        loop {
+            match listener.accept().await {
+                Ok((stream, _)) => {
+                    let agent = agent.clone();
+                    let coord = coord.clone();
+                    tokio::spawn(async move {
+                        if let Err(e) = serve(stream, agent, coord).await {
+                            tracing::warn!(error = ?e, "agent connection failed");
+                        }
+                    });
+                }
+                Err(e) => {
+                    tracing::warn!(error = ?e, "agent listener accept failed; exiting");
+                    return;
+                }
+            }
+        }
+    });
+    Ok(AgentSocket { path, handle })
+}
+
+async fn serve(stream: UnixStream, agent: String, coord: Arc<Coordinator>) -> Result<()> {
+    let (read, mut write) = stream.into_split();
+    let mut reader = BufReader::new(read);
+    let mut line = String::new();
+    loop {
+        line.clear();
+        let n = reader.read_line(&mut line).await?;
+        if n == 0 {
+            return Ok(());
+        }
+        let resp = match serde_json::from_str::<AgentRequest>(line.trim()) {
+            Ok(req) => dispatch(&req, &agent, &coord).await,
+            Err(e) => AgentResponse::Err {
+                message: format!("parse error: {e}"),
+            },
+        };
+        let mut payload = serde_json::to_string(&resp)?;
+        payload.push('\n');
+        write.write_all(payload.as_bytes()).await?;
+        write.flush().await?;
+    }
+}
+
+/// Max long-poll window the caller can ask for; values above the
+/// cap are clamped. 180s keeps us under typical TCP/proxy idle
+/// limits while still letting agents park their turn until a
+/// message arrives. Omitting `wait_seconds` (or passing `0`) means
+/// "peek, don't wait" — claude can call recv whenever it wants a
+/// cheap "is there anything pending?" check without blocking the
+/// turn for 30 seconds. To actually park, the caller passes a
+/// positive `wait_seconds`.
+const RECV_LONG_POLL_MAX: std::time::Duration = std::time::Duration::from_secs(180);
+
+/// Server-side hard cap on `Recv.max`. Bounds the size of a single
+/// round-trip so a confused caller can't drain the entire inbox in
+/// one go and blow past wire-buffer sizes; everything above the cap
+/// silently clamps. 32 is comfortably above the burst sizes we've
+/// seen in practice (post-rebuild rescue, multi-agent reply storms)
+/// and well under the per-message `MESSAGE_MAX_BYTES` * N envelope
+/// budget.
+const RECV_BATCH_MAX: u32 = 32;
+
+fn recv_timeout(wait_seconds: Option<u64>) -> std::time::Duration {
+    match wait_seconds {
+        Some(s) => std::time::Duration::from_secs(s).min(RECV_LONG_POLL_MAX),
+        None => std::time::Duration::ZERO,
+    }
+}
+
+#[allow(clippy::too_many_lines)]
+async fn dispatch(req: &AgentRequest, agent: &str, coord: &Arc<Coordinator>) -> AgentResponse {
+    let broker = &coord.broker;
+    match req {
+        AgentRequest::Send { to, body, in_reply_to } => {
+            handle_send(coord, agent, to, body, *in_reply_to)
+        }
+        AgentRequest::Recv { wait_seconds, max } => {
+            let cap = max.unwrap_or(1).min(RECV_BATCH_MAX) as usize;
+            match broker
+                .recv_blocking_batch(agent, recv_timeout(*wait_seconds), cap)
+                .await
+            {
+                Ok(deliveries) => AgentResponse::Messages {
+                    messages: deliveries
+                        .into_iter()
+                        .map(|d| hive_sh4re::DeliveredMessage {
+                            from: d.message.from,
+                            body: d.message.body,
+                            id: d.id,
+                            redelivered: d.redelivered,
+                            in_reply_to: d.message.in_reply_to,
+                        })
+                        .collect(),
+                },
+                Err(e) => AgentResponse::Err {
+                    message: format!("{e:#}"),
+                },
+            }
+        }
+        AgentRequest::Status => match broker.count_pending(agent) {
+            Ok(unread) => AgentResponse::Status { unread },
+            Err(e) => AgentResponse::Err {
+                message: format!("{e:#}"),
+            },
+        },
+        AgentRequest::OperatorMsg { body } => match broker.send(&Message {
+            from: hive_sh4re::OPERATOR_RECIPIENT.to_owned(),
+            to: agent.to_owned(),
+            body: body.clone(),
+            in_reply_to: None,
+        }) {
+            Ok(()) => AgentResponse::Ok,
+            Err(e) => AgentResponse::Err {
+                message: format!("{e:#}"),
+            },
+        },
+        AgentRequest::Wake { from, body } => match broker.send(&Message {
+            from: from.clone(),
+            to: agent.to_owned(),
+            body: body.clone(),
+            in_reply_to: None,
+        }) {
+            Ok(()) => AgentResponse::Ok,
+            Err(e) => AgentResponse::Err {
+                message: format!("{e:#}"),
+            },
+        },
+        AgentRequest::Recent { limit } => match broker.recent_for(agent, *limit) {
+            Ok(rows) => AgentResponse::Recent { rows },
+            Err(e) => AgentResponse::Err {
+                message: format!("{e:#}"),
+            },
+        },
+        AgentRequest::Ask {
+            question,
+            options,
+            multi,
+            ttl_seconds,
+            to,
+        } => crate::questions::handle_ask(
+            coord,
+            agent,
+            question,
+            options,
+            *multi,
+            *ttl_seconds,
+            to.as_deref(),
+        )
+        .map_or_else(
+            |message| AgentResponse::Err { message },
+            |id| AgentResponse::QuestionQueued { id },
+        ),
+        AgentRequest::Answer { id, answer } => crate::questions::handle_answer(
+            coord, agent, *id, answer,
+        )
+        .map_or_else(
+            |message| AgentResponse::Err { message },
+            |()| AgentResponse::Ok,
+        ),
+        AgentRequest::Remind {
+            message,
+            timing,
+            file_path,
+        } => handle_remind(coord, agent, message, timing, file_path.as_deref()),
+        AgentRequest::GetLooseEnds => match crate::loose_ends::for_agent(coord, agent) {
+            Ok(loose_ends) => AgentResponse::LooseEnds { loose_ends },
+            Err(e) => AgentResponse::Err {
+                message: format!("{e:#}"),
+            },
+        },
+        AgentRequest::CountPendingReminders => {
+            match coord.broker.count_pending_reminders_for(agent) {
+                Ok(count) => AgentResponse::PendingRemindersCount { count },
+                Err(e) => AgentResponse::Err {
+                    message: format!("{e:#}"),
+                },
+            }
+        }
+        AgentRequest::ReminderRollup { since_secs } => {
+            match coord.broker.reminder_rollup_for(agent, *since_secs) {
+                Ok(stats) => AgentResponse::ReminderRollup(stats),
+                Err(e) => AgentResponse::Err {
+                    message: format!("{e:#}"),
+                },
+            }
+        }
+        AgentRequest::SetStatus { text } => {
+            let path = crate::coordinator::Coordinator::agent_notes_dir(agent)
+                .join("hyperhive-status");
+            let result = if text.trim().is_empty() {
+                // Empty = clear: remove the file (ignore missing).
+                std::fs::remove_file(&path)
+                    .or_else(|e| if e.kind() == std::io::ErrorKind::NotFound {
+                        Ok(())
+                    } else {
+                        Err(e)
+                    })
+            } else {
+                std::fs::write(&path, format!("{}\n", text.trim()))
+            };
+            match result {
+                Ok(()) => {
+                    // Kick a container rescan so the dashboard updates live.
+                    let coord2 = Arc::clone(coord);
+                    tokio::spawn(async move { coord2.rescan_containers_and_emit().await });
+                    AgentResponse::Ok
+                }
+                Err(e) => AgentResponse::Err { message: format!("set_status write failed: {e}") },
+            }
+        }
+        AgentRequest::GetAgentMeta { name } => {
+            let target = name.as_deref().unwrap_or(agent);
+            // #432: gate status on the target's running state so a
+            // stopped container's stale on-disk status doesn't leak
+            // through. Also surface `running` itself so callers can
+            // tell (e.g. "iris is down" vs "iris has no status set").
+            let (status_text, status_set_at, running) =
+                crate::container_view::read_agent_status_live(target).await;
+            let role = if target == hive_sh4re::MANAGER_AGENT {
+                "manager"
+            } else {
+                "agent"
+            }
+            .to_owned();
+            AgentResponse::AgentMeta {
+                name: target.to_owned(),
+                role,
+                running,
+                hyperhive_rev: crate::auto_update::current_flake_rev(&coord.hyperhive_flake),
+                status_text,
+                status_set_at,
+            }
+        }
+        AgentRequest::CancelLooseEnd { kind, id } => crate::questions::handle_cancel_loose_end(
+            coord, agent, *kind, *id,
+        )
+        .map_or_else(
+            |message| AgentResponse::Err { message },
+            |()| AgentResponse::Ok,
+        ),
+        AgentRequest::AckTurn => match broker.ack_turn(agent) {
+            Ok(_n) => AgentResponse::Ok,
+            Err(e) => AgentResponse::Err {
+                message: format!("{e:#}"),
+            },
+        },
+        AgentRequest::RequeueInflight => match broker.requeue_inflight(agent) {
+            Ok(n) => {
+                if n > 0 {
+                    tracing::info!(%agent, requeued = %n, "requeued in-flight messages");
+                }
+                AgentResponse::Ok
+            }
+            Err(e) => AgentResponse::Err {
+                message: format!("{e:#}"),
+            },
+        },
+    }
+}
+
+/// Common Send handler shared between dispatch arms. Applies the
+/// 4 KiB body cap, then routes broadcast (`to == "*"`) vs unicast
+/// through their respective broker calls. Pulled out of `dispatch`
+/// to keep that function under the clippy too-many-lines limit; the
+/// behaviour is identical to inlining.
+fn handle_send(
+    coord: &Arc<Coordinator>,
+    agent: &str,
+    to: &str,
+    body: &str,
+    in_reply_to: Option<i64>,
+) -> AgentResponse {
+    if let Err(message) = crate::limits::check_size("send", body) {
+        return AgentResponse::Err { message };
+    }
+    if to == "*" {
+        let errors = coord.broadcast_send(agent, body);
+        return if errors.is_empty() {
+            AgentResponse::Ok
+        } else {
+            AgentResponse::Err {
+                message: format!("broadcast failed for agents: {}", errors.join(", ")),
+            }
+        };
+    }
+    match coord.broker.send(&Message {
+        from: agent.to_owned(),
+        to: to.to_owned(),
+        body: body.to_owned(),
+        in_reply_to,
+    }) {
+        Ok(()) => AgentResponse::Ok,
+        Err(e) => AgentResponse::Err {
+            message: format!("{e:#}"),
+        },
+    }
+}
+
+fn handle_remind(
+    coord: &Arc<Coordinator>,
+    agent: &str,
+    message: &str,
+    timing: &hive_sh4re::ReminderTiming,
+    file_path: Option<&str>,
+) -> AgentResponse {
+    match store_remind(coord, agent, message, timing, file_path) {
+        Ok(()) => AgentResponse::Ok,
+        Err(message) => AgentResponse::Err { message },
+    }
+}
+
+/// Shared remind-storage path used by both the agent and the manager
+/// dispatchers. Validates timing, applies the auto-file overflow
+/// dance (see [`prepare_remind_storage`]), and writes the reminder
+/// row. Returns `Ok(())` on success, or a caller-ready error string
+/// the dispatcher wraps in `*Response::Err`.
+/// Maximum pending (un-delivered) reminders per agent. Exceeding this
+/// causes `store_remind` to return an error so the agent knows to back
+/// off instead of silently dropping. Override via
+/// `HIVE_REMIND_MAX_PENDING_PER_AGENT`; set to `0` to disable the cap
+/// (not recommended — a runaway agent can still flood the scheduler).
+const DEFAULT_REMIND_MAX_PENDING: u64 = 50;
+
+fn remind_max_pending() -> u64 {
+    std::env::var("HIVE_REMIND_MAX_PENDING_PER_AGENT")
+        .ok()
+        .and_then(|s| s.trim().parse::<u64>().ok())
+        .unwrap_or(DEFAULT_REMIND_MAX_PENDING)
+}
+
+pub(crate) fn store_remind(
+    coord: &Arc<Coordinator>,
+    agent: &str,
+    message: &str,
+    timing: &hive_sh4re::ReminderTiming,
+    file_path: Option<&str>,
+) -> Result<(), String> {
+    let max = remind_max_pending();
+    if max > 0 {
+        let pending = coord
+            .broker
+            .count_pending_reminders_for(agent)
+            .unwrap_or(0);
+        if pending >= max {
+            return Err(format!(
+                "reminder rejected: agent `{agent}` already has {pending} pending \
+                 reminders (cap {max}). Cancel some via `cancel_loose_end` or wait \
+                 for them to fire before scheduling more. Override the cap with \
+                 `HIVE_REMIND_MAX_PENDING_PER_AGENT`."
+            ));
+        }
+    }
+    let due_at = resolve_due_at(timing).map_err(|e| format!("invalid reminder timing: {e:#}"))?;
+    let (stored_message, stored_path) = prepare_remind_storage(agent, message, file_path)?;
+    let id = coord
+        .broker
+        .store_reminder(agent, &stored_message, stored_path.as_deref(), due_at)
+        .map_err(|e| format!("failed to store reminder: {e:#}"))?;
+    tracing::info!(%id, %agent, %due_at, "reminder scheduled");
+    Ok(())
+}
+
+/// Decide what we actually store in the reminders row, applying the
+/// same byte cap as the rest of the wire protocol
+/// ([`crate::limits::MESSAGE_MAX_BYTES`]). Three outcomes:
+///
+/// 1. Body within the cap → stored verbatim, with whatever `file_path`
+///    the caller passed (None or Some). The scheduler honours
+///    `file_path` at delivery time as before.
+/// 2. Body over the cap, no caller `file_path` → auto-generate a path
+///    under `/agents/<agent>/state/reminders/auto-<ts>.md`, write the
+///    body to disk now, store a short pointer hint as the message and
+///    clear `file_path` (so the scheduler doesn't re-write at
+///    delivery and overwrite the body with the hint).
+/// 3. Body over the cap, caller provided `file_path` → honour the
+///    caller's path: write the body to it now, store the same hint
+///    and clear `file_path` for the same reason as (2).
+///
+/// Returns `(stored_message, stored_file_path)` on success, or a
+/// caller-ready error string on auto-save failure (which is the only
+/// way a Remind request can be refused for size — the agent never has
+/// to think about the cap).
+fn prepare_remind_storage(
+    agent: &str,
+    message: &str,
+    file_path: Option<&str>,
+) -> Result<(String, Option<String>), String> {
+    if message.len() <= crate::limits::MESSAGE_MAX_BYTES {
+        return Ok((message.to_owned(), file_path.map(str::to_owned)));
+    }
+    let req_path = match file_path {
+        Some(p) => p.to_owned(),
+        None => auto_reminder_path(agent),
+    };
+    let host_path = crate::reminder_scheduler::resolve_host_path(agent, &req_path)
+        .map_err(|reason| format!("auto-save path `{req_path}` rejected: {reason}"))?;
+    crate::reminder_scheduler::write_payload(agent, &host_path, message)
+        .map_err(|reason| format!("auto-save of large reminder body to `{req_path}` failed: {reason}"))?;
+    let hint = format!(
+        "[reminder body of {} bytes auto-saved to `{req_path}`; read with your filesystem tools]",
+        message.len()
+    );
+    Ok((hint, None))
+}
+
+/// Generate a per-agent path for an auto-saved reminder body. Uses
+/// `unix_nanos` plus the agent name to keep collisions infinitesimal
+/// across the agent's own state subtree (we're not stamping a hostname
+/// since hive-c0re is single-host).
+fn auto_reminder_path(agent: &str) -> String {
+    let ts_ns = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.as_nanos())
+        .unwrap_or(0);
+    format!("/agents/{agent}/state/reminders/auto-{ts_ns}.md")
+}
+
+/// Resolve the `due_at` unix timestamp for a Remind request. Returns
+/// distinct error messages for each failure mode (overflow on
+/// `InSeconds`, pre-epoch clock, `i64` cast wrap) so the caller can tell
+/// what went wrong without inspecting the chain.
+fn resolve_due_at(timing: &hive_sh4re::ReminderTiming) -> anyhow::Result<i64> {
+    use hive_sh4re::ReminderTiming;
+    match timing {
+        ReminderTiming::InSeconds { seconds } => {
+            let now = std::time::SystemTime::now();
+            let future = now
+                .checked_add(std::time::Duration::from_secs(*seconds))
+                .ok_or_else(|| {
+                    anyhow::anyhow!("InSeconds overflow: {seconds}s exceeds system time range")
+                })?;
+            let duration = future
+                .duration_since(std::time::UNIX_EPOCH)
+                .map_err(|e| anyhow::anyhow!("system time before UNIX_EPOCH: {e}"))?;
+            i64::try_from(duration.as_secs())
+                .map_err(|e| anyhow::anyhow!("unix timestamp exceeds i64 range: {e}"))
+        }
+        ReminderTiming::At { unix_timestamp } => Ok(*unix_timestamp),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn auto_reminder_path_format() {
+        let p = auto_reminder_path("damocles");
+        assert!(p.starts_with("/agents/damocles/state/reminders/auto-"));
+        assert!(
+            std::path::Path::new(&p)
+                .extension()
+                .is_some_and(|ext| ext.eq_ignore_ascii_case("md"))
+        );
+    }
+
+    #[test]
+    fn prepare_remind_storage_passthrough_under_cap() {
+        let (msg, fp) = prepare_remind_storage("foo", "small body", None).unwrap();
+        assert_eq!(msg, "small body");
+        assert_eq!(fp, None);
+    }
+
+    #[test]
+    fn prepare_remind_storage_passthrough_with_caller_file_path() {
+        let (msg, fp) =
+            prepare_remind_storage("foo", "small", Some("/agents/foo/state/x.md")).unwrap();
+        assert_eq!(msg, "small");
+        assert_eq!(fp.as_deref(), Some("/agents/foo/state/x.md"));
+    }
+}
diff --git a/hive-c0re/src/approvals.rs b/hive-c0re/src/approvals.rs
new file mode 100644
index 00000000..957fff1f
--- /dev/null
+++ b/hive-c0re/src/approvals.rs
@@ -0,0 +1,519 @@
+//! Approval queue. Manager submits via `RequestApplyCommit`; the user
+//! approves/denies via the host admin CLI; on approval the host runs the
+//! corresponding action (Phase 5a: `lifecycle::rebuild(agent)`).
+
+use std::path::Path;
+use std::sync::Mutex;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use anyhow::{Context, Result, bail};
+use hive_sh4re::{Approval, ApprovalKind, ApprovalStatus};
+use rusqlite::{Connection, OptionalExtension, params};
+
+const SCHEMA: &str = r"
+CREATE TABLE IF NOT EXISTS approvals (
+    id           INTEGER PRIMARY KEY AUTOINCREMENT,
+    agent        TEXT    NOT NULL,
+    commit_ref   TEXT    NOT NULL,
+    requested_at INTEGER NOT NULL,
+    status       TEXT    NOT NULL,
+    resolved_at  INTEGER,
+    note         TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_approvals_pending
+    ON approvals (id) WHERE status = 'pending';
+";
+
+/// Add the `description` column to pre-description databases. Manager-supplied
+/// note shown on the dashboard approval card at submission time (distinct from
+/// `note` which is set on denial/failure).
+fn ensure_description_column(conn: &Connection) -> Result<()> {
+    let has: bool = conn
+        .prepare("SELECT 1 FROM pragma_table_info('approvals') WHERE name = 'description'")?
+        .exists([])?;
+    if !has {
+        conn.execute_batch("ALTER TABLE approvals ADD COLUMN description TEXT;")
+            .context("add approvals.description column")?;
+    }
+    Ok(())
+}
+
+/// Add the `kind` column to pre-Phase-8 databases. ALTER TABLE ADD COLUMN is
+/// idempotent here only via a column-existence check (sqlite doesn't support
+/// IF NOT EXISTS on ADD COLUMN). Defaults legacy rows to `apply_commit`,
+/// which matches their actual semantics.
+fn ensure_kind_column(conn: &Connection) -> Result<()> {
+    let has_kind: bool = conn
+        .prepare("SELECT 1 FROM pragma_table_info('approvals') WHERE name = 'kind'")?
+        .exists([])?;
+    if !has_kind {
+        conn.execute_batch(
+            "ALTER TABLE approvals ADD COLUMN kind TEXT NOT NULL DEFAULT 'apply_commit';",
+        )
+        .context("add approvals.kind column")?;
+    }
+    Ok(())
+}
+
+/// Same shape as `ensure_kind_column` but for `fetched_sha` — the
+/// canonical sha hive-c0re vouched for at `request_apply_commit` time.
+/// Distinct from `commit_ref` (manager-supplied, may not even resolve
+/// in proposed by the time we approve).
+fn ensure_fetched_sha_column(conn: &Connection) -> Result<()> {
+    let has: bool = conn
+        .prepare("SELECT 1 FROM pragma_table_info('approvals') WHERE name = 'fetched_sha'")?
+        .exists([])?;
+    if !has {
+        conn.execute_batch("ALTER TABLE approvals ADD COLUMN fetched_sha TEXT;")
+            .context("add approvals.fetched_sha column")?;
+    }
+    Ok(())
+}
+
+pub struct Approvals {
+    conn: Mutex<Connection>,
+}
+
+impl Approvals {
+    pub fn open(path: &Path) -> Result<Self> {
+        if let Some(parent) = path.parent() {
+            std::fs::create_dir_all(parent)
+                .with_context(|| format!("create approvals db parent {}", parent.display()))?;
+        }
+        let conn = Connection::open(path)
+            .with_context(|| format!("open approvals db {}", path.display()))?;
+        conn.execute_batch(SCHEMA)
+            .context("apply approvals schema")?;
+        ensure_kind_column(&conn).context("migrate approvals.kind")?;
+        ensure_fetched_sha_column(&conn).context("migrate approvals.fetched_sha")?;
+        ensure_description_column(&conn).context("migrate approvals.description")?;
+        Ok(Self {
+            conn: Mutex::new(conn),
+        })
+    }
+
+    pub fn submit_kind(
+        &self,
+        agent: &str,
+        kind: ApprovalKind,
+        commit_ref: &str,
+        description: Option<&str>,
+    ) -> Result<i64> {
+        let conn = self.conn.lock().unwrap();
+        conn.execute(
+            "INSERT INTO approvals (agent, kind, commit_ref, requested_at, status, description)
+             VALUES (?1, ?2, ?3, ?4, 'pending', ?5)",
+            params![
+                agent,
+                kind_to_str(kind),
+                commit_ref,
+                now_unix(),
+                description
+            ],
+        )?;
+        Ok(conn.last_insert_rowid())
+    }
+
+    /// Record the canonical sha hive-c0re fetched from the proposed repo
+    /// into applied at submission time. Idempotent on identical values.
+    pub fn set_fetched_sha(&self, id: i64, sha: &str) -> Result<()> {
+        let conn = self.conn.lock().unwrap();
+        conn.execute(
+            "UPDATE approvals SET fetched_sha = ?1 WHERE id = ?2",
+            params![sha, id],
+        )?;
+        Ok(())
+    }
+
+    /// Last `limit` resolved approvals (approved / denied / failed),
+    /// newest-first. Drives the history tab on the dashboard.
+    pub fn recent_resolved(&self, limit: u64) -> Result<Vec<Approval>> {
+        let conn = self.conn.lock().unwrap();
+        let mut stmt = conn.prepare(
+            "SELECT id, agent, kind, commit_ref, requested_at, status, resolved_at, note, fetched_sha, description
+               FROM approvals
+              WHERE status IN ('approved', 'denied', 'failed', 'cancelled')
+              ORDER BY resolved_at DESC, id DESC
+              LIMIT ?1",
+        )?;
+        let rows = stmt.query_map([limit], row_to_approval)?;
+        Ok(collect_lenient(rows))
+    }
+
+    pub fn pending(&self) -> Result<Vec<Approval>> {
+        let conn = self.conn.lock().unwrap();
+        let mut stmt = conn.prepare(
+            "SELECT id, agent, kind, commit_ref, requested_at, status, resolved_at, note, fetched_sha, description
+               FROM approvals
+              WHERE status = 'pending'
+              ORDER BY id ASC",
+        )?;
+        let rows = stmt.query_map([], row_to_approval)?;
+        Ok(collect_lenient(rows))
+    }
+
+    pub fn get(&self, id: i64) -> Result<Option<Approval>> {
+        let conn = self.conn.lock().unwrap();
+        conn.query_row(
+            "SELECT id, agent, kind, commit_ref, requested_at, status, resolved_at, note, fetched_sha, description
+               FROM approvals WHERE id = ?1",
+            params![id],
+            row_to_approval,
+        )
+        .optional()
+        .map_err(Into::into)
+    }
+
+    /// Mark pending -> approved (or fail if not pending). Returns the (now-updated)
+    /// approval so the caller can run the action and pass the agent name.
+    #[allow(clippy::type_complexity)]
+    pub fn mark_approved(&self, id: i64) -> Result<Approval> {
+        let conn = self.conn.lock().unwrap();
+        // Row shape: (agent, kind, commit_ref, requested_at, status,
+        // fetched_sha, description).
+        let current: Option<(
+            String,
+            String,
+            String,
+            i64,
+            String,
+            Option<String>,
+            Option<String>,
+        )> = conn
+            .query_row(
+                "SELECT agent, kind, commit_ref, requested_at, status, fetched_sha, description
+                   FROM approvals WHERE id = ?1",
+                params![id],
+                |row| {
+                    Ok((
+                        row.get(0)?,
+                        row.get(1)?,
+                        row.get(2)?,
+                        row.get(3)?,
+                        row.get(4)?,
+                        row.get(5)?,
+                        row.get(6)?,
+                    ))
+                },
+            )
+            .optional()?;
+        let Some((agent, kind, commit_ref, requested_at, status, fetched_sha, description)) =
+            current
+        else {
+            bail!("approval {id} not found");
+        };
+        if status != "pending" {
+            bail!("approval {id} is {status}, not pending");
+        }
+        let resolved_at = now_unix();
+        conn.execute(
+            "UPDATE approvals SET status = 'approved', resolved_at = ?1 WHERE id = ?2",
+            params![resolved_at, id],
+        )?;
+        Ok(Approval {
+            id,
+            agent,
+            kind: kind_from_str(&kind)?,
+            commit_ref,
+            requested_at,
+            status: ApprovalStatus::Approved,
+            resolved_at: Some(resolved_at),
+            note: None,
+            fetched_sha,
+            description,
+        })
+    }
+
+    pub fn mark_denied(&self, id: i64, note: Option<&str>) -> Result<()> {
+        let conn = self.conn.lock().unwrap();
+        let affected = conn.execute(
+            "UPDATE approvals SET status = 'denied', resolved_at = ?1, note = ?2
+               WHERE id = ?3 AND status = 'pending'",
+            params![now_unix(), note, id],
+        )?;
+        if affected == 0 {
+            bail!("approval {id} not pending");
+        }
+        Ok(())
+    }
+
+    pub fn mark_failed(&self, id: i64, note: &str) -> Result<()> {
+        let conn = self.conn.lock().unwrap();
+        conn.execute(
+            "UPDATE approvals SET status = 'failed', resolved_at = ?1, note = ?2 WHERE id = ?3",
+            params![now_unix(), note, id],
+        )?;
+        Ok(())
+    }
+
+    /// Withdraw a pending approval (closes #250). Returns the now-updated
+    /// row so the caller can emit `ApprovalResolved` with the right
+    /// kind / agent / sha. Errors if the approval isn't pending — once
+    /// it's approved/denied/failed/cancelled, the resolution is final.
+    pub fn mark_cancelled(&self, id: i64, canceller: &str) -> Result<Approval> {
+        let mut conn = self.conn.lock().unwrap();
+        let tx = conn.transaction()?;
+        let row: Option<(
+            String,
+            String,
+            String,
+            i64,
+            String,
+            Option<String>,
+            Option<String>,
+        )> = tx
+            .query_row(
+                "SELECT agent, kind, commit_ref, requested_at, status, fetched_sha, description
+                   FROM approvals WHERE id = ?1",
+                params![id],
+                |row| {
+                    Ok((
+                        row.get(0)?,
+                        row.get(1)?,
+                        row.get(2)?,
+                        row.get(3)?,
+                        row.get(4)?,
+                        row.get(5)?,
+                        row.get(6)?,
+                    ))
+                },
+            )
+            .optional()?;
+        let Some((agent, kind, commit_ref, requested_at, status, fetched_sha, description)) = row
+        else {
+            bail!("approval {id} not found");
+        };
+        if status != "pending" {
+            bail!("approval {id} is {status}, not pending");
+        }
+        let resolved_at = now_unix();
+        let note = format!("cancelled by {canceller}");
+        tx.execute(
+            "UPDATE approvals SET status = 'cancelled', resolved_at = ?1, note = ?2 WHERE id = ?3",
+            params![resolved_at, note, id],
+        )?;
+        tx.commit()?;
+        Ok(Approval {
+            id,
+            agent,
+            kind: kind_from_str(&kind)?,
+            commit_ref,
+            requested_at,
+            status: ApprovalStatus::Cancelled,
+            resolved_at: Some(resolved_at),
+            note: Some(note),
+            fetched_sha,
+            description,
+        })
+    }
+
+    /// Mark every pending approval for `agent` as failed (returns rows affected).
+    /// Used by `destroy` to clear the queue of an agent that no longer exists.
+    pub fn fail_pending_for_agent(&self, agent: &str, note: &str) -> Result<usize> {
+        let conn = self.conn.lock().unwrap();
+        let n = conn.execute(
+            "UPDATE approvals SET status = 'failed', resolved_at = ?1, note = ?2
+               WHERE agent = ?3 AND status = 'pending'",
+            params![now_unix(), note, agent],
+        )?;
+        Ok(n)
+    }
+}
+
+/// Collect approval rows, dropping (and logging) any that fail to
+/// deserialize. A single malformed / unknown-kind row must never blank
+/// the whole list: `collect::<Result<Vec>>()` is all-or-nothing, so one
+/// bad row used to make `pending()` / `recent_resolved()` error out
+/// wholesale — the dashboard then rendered an empty approvals queue
+/// (issue #160, an unhandled `init_config` kind poisoning every read).
+fn collect_lenient(
+    rows: impl Iterator<Item = rusqlite::Result<Approval>>,
+) -> Vec<Approval> {
+    rows.filter_map(|r| match r {
+        Ok(a) => Some(a),
+        Err(e) => {
+            tracing::warn!(error = ?e, "skipping unparseable approval row");
+            None
+        }
+    })
+    .collect()
+}
+
+fn row_to_approval(row: &rusqlite::Row<'_>) -> rusqlite::Result<Approval> {
+    // Column order: id, agent, kind, commit_ref, requested_at, status, resolved_at, note, fetched_sha, description.
+    let kind: String = row.get(2)?;
+    let kind = match kind.as_str() {
+        "apply_commit" => ApprovalKind::ApplyCommit,
+        "spawn" => ApprovalKind::Spawn,
+        "init_config" => ApprovalKind::InitConfig,
+        "update_meta_inputs" => ApprovalKind::UpdateMetaInputs,
+        "schedule_prompt" => ApprovalKind::SchedulePrompt,
+        other => {
+            return Err(rusqlite::Error::FromSqlConversionFailure(
+                2,
+                rusqlite::types::Type::Text,
+                format!("unknown approval kind '{other}'").into(),
+            ));
+        }
+    };
+    let status: String = row.get(5)?;
+    let status = match status.as_str() {
+        "pending" => ApprovalStatus::Pending,
+        "approved" => ApprovalStatus::Approved,
+        "denied" => ApprovalStatus::Denied,
+        "failed" => ApprovalStatus::Failed,
+        "cancelled" => ApprovalStatus::Cancelled,
+        other => {
+            return Err(rusqlite::Error::FromSqlConversionFailure(
+                5,
+                rusqlite::types::Type::Text,
+                format!("unknown approval status '{other}'").into(),
+            ));
+        }
+    };
+    Ok(Approval {
+        id: row.get(0)?,
+        agent: row.get(1)?,
+        kind,
+        commit_ref: row.get(3)?,
+        requested_at: row.get(4)?,
+        status,
+        resolved_at: row.get(6)?,
+        note: row.get(7)?,
+        fetched_sha: row.get(8)?,
+        description: row.get(9)?,
+    })
+}
+
+/// Stable kind→str mapping used wherever we emit `ApprovalResolved`
+/// or persist a kind to sqlite. `pub(crate)` so callers like
+/// `questions::handle_cancel_loose_end` don't have to duplicate the
+/// match; bumping a kind here is the single source of truth.
+pub(crate) fn kind_to_str(kind: ApprovalKind) -> &'static str {
+    match kind {
+        ApprovalKind::ApplyCommit => "apply_commit",
+        ApprovalKind::Spawn => "spawn",
+        ApprovalKind::InitConfig => "init_config",
+        ApprovalKind::UpdateMetaInputs => "update_meta_inputs",
+        ApprovalKind::SchedulePrompt => "schedule_prompt",
+    }
+}
+
+fn kind_from_str(s: &str) -> Result<ApprovalKind> {
+    Ok(match s {
+        "apply_commit" => ApprovalKind::ApplyCommit,
+        "spawn" => ApprovalKind::Spawn,
+        "init_config" => ApprovalKind::InitConfig,
+        "update_meta_inputs" => ApprovalKind::UpdateMetaInputs,
+        "schedule_prompt" => ApprovalKind::SchedulePrompt,
+        other => bail!("unknown approval kind '{other}'"),
+    })
+}
+
+fn now_unix() -> i64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .ok()
+        .and_then(|d| i64::try_from(d.as_secs()).ok())
+        .unwrap_or(0)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use hive_sh4re::ApprovalKind;
+
+    fn open_temp() -> (tempfile::TempDir, std::path::PathBuf, Approvals) {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join("approvals.sqlite");
+        let db = Approvals::open(&path).expect("open approvals db");
+        (dir, path, db)
+    }
+
+    #[test]
+    fn init_config_approval_round_trips() {
+        // Regression for #160: an `init_config` row used to fail
+        // deserialization (row_to_approval matched only apply_commit +
+        // spawn), erroring out the whole `pending()` query — every
+        // approval then vanished from the dashboard.
+        let (_dir, _path, db) = open_temp();
+        let id = db
+            .submit_kind("bitburner", ApprovalKind::InitConfig, "", Some("scaffold"))
+            .expect("submit init_config");
+        let pending = db
+            .pending()
+            .expect("pending() must not error on an init_config row");
+        assert_eq!(pending.len(), 1);
+        assert_eq!(pending[0].id, id);
+        assert!(matches!(pending[0].kind, ApprovalKind::InitConfig));
+    }
+
+    #[test]
+    fn mixed_kinds_all_listed() {
+        let (_dir, _path, db) = open_temp();
+        db.submit_kind("a", ApprovalKind::ApplyCommit, "deadbeef", None)
+            .unwrap();
+        db.submit_kind("b", ApprovalKind::Spawn, "", None).unwrap();
+        db.submit_kind("c", ApprovalKind::InitConfig, "", None)
+            .unwrap();
+        let pending = db.pending().expect("pending");
+        assert_eq!(pending.len(), 3, "all three kinds must be visible");
+    }
+
+    #[test]
+    fn mark_cancelled_transitions_pending_row() {
+        // #250: manager withdraws a pending approval. Row leaves
+        // pending(), shows up in recent_resolved() with the cancelled
+        // status + a "cancelled by <who>" note.
+        let (_dir, _path, db) = open_temp();
+        let id = db
+            .submit_kind("bitburner", ApprovalKind::ApplyCommit, "cafef00d", Some("test"))
+            .unwrap();
+        let row = db.mark_cancelled(id, "manager").expect("cancel");
+        assert_eq!(row.id, id);
+        assert!(matches!(row.status, ApprovalStatus::Cancelled));
+        assert_eq!(row.note.as_deref(), Some("cancelled by manager"));
+        assert!(row.resolved_at.is_some());
+        assert!(db.pending().unwrap().is_empty(), "row leaves pending");
+        let resolved = db.recent_resolved(10).unwrap();
+        assert_eq!(resolved.len(), 1);
+        assert!(matches!(resolved[0].status, ApprovalStatus::Cancelled));
+    }
+
+    #[test]
+    fn mark_cancelled_refuses_already_resolved_row() {
+        // Once approved/denied/failed/cancelled the resolution is
+        // final — re-cancelling errors instead of silently overwriting.
+        let (_dir, _path, db) = open_temp();
+        let id = db
+            .submit_kind("a", ApprovalKind::Spawn, "deadbeef", None)
+            .unwrap();
+        db.mark_cancelled(id, "manager").expect("first cancel");
+        let err = db
+            .mark_cancelled(id, "manager")
+            .expect_err("second cancel must fail");
+        assert!(err.to_string().contains("not pending"), "{err}");
+    }
+
+    #[test]
+    fn unknown_kind_row_is_skipped_not_fatal() {
+        // A single malformed / future-kind row must not blank the
+        // whole list — collect_lenient skips it instead of failing.
+        let (_dir, path, db) = open_temp();
+        let good = db
+            .submit_kind("good", ApprovalKind::ApplyCommit, "cafe", None)
+            .unwrap();
+        let raw = Connection::open(&path).unwrap();
+        raw.execute(
+            "INSERT INTO approvals (agent, kind, commit_ref, requested_at, status)
+             VALUES ('weird', 'from_the_future', '', 0, 'pending')",
+            [],
+        )
+        .unwrap();
+        let pending = db
+            .pending()
+            .expect("pending() must survive an unparseable row");
+        assert_eq!(pending.len(), 1);
+        assert_eq!(pending[0].id, good);
+    }
+}
diff --git a/hive-c0re/src/auto_update.rs b/hive-c0re/src/auto_update.rs
new file mode 100644
index 00000000..31799898
--- /dev/null
+++ b/hive-c0re/src/auto_update.rs
@@ -0,0 +1,241 @@
+//! Startup auto-update: on `hive-c0re serve` boot, rebuild every known
+//! container unconditionally. `nixos-container update` is a no-op at the
+//! nix level when nothing changed (same store path), so the cost of always
+//! running it on startup is low and avoids the complexity of rev-marker
+//! staleness (issue #179: all agents always needed update when any meta
+//! commit landed).
+
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+
+use anyhow::{Context, Result};
+
+use crate::coordinator::Coordinator;
+use crate::lifecycle::{self, AGENT_PREFIX, MANAGER_NAME};
+
+/// Marker file recording the hyperhive rev a sub-agent's container was last
+/// built against. Sibling of `applied/<name>/` (rather than inside it) to
+/// keep it out of the applied repo's git history. Uses a leading dot so a
+/// glob over `applied/*` doesn't include it.
+pub fn rev_marker_path(name: &str) -> PathBuf {
+    PathBuf::from(format!("/var/lib/hyperhive/applied/.{name}.hyperhive-rev"))
+}
+
+/// Resolve the current rev of `hyperhive_flake`. For a path on disk we
+/// canonicalize (following symlinks) so a /etc/hyperhive → /nix/store/...
+/// update yields a different string. For anything else we return None.
+#[must_use]
+pub fn current_flake_rev(hyperhive_flake: &str) -> Option<String> {
+    let path = Path::new(hyperhive_flake);
+    if !path.exists() {
+        return None;
+    }
+    std::fs::canonicalize(path)
+        .ok()
+        .map(|p| p.display().to_string())
+}
+
+/// Returns true when the applied repo has commits that have not yet been
+/// deployed (i.e. the applied HEAD differs from the sha currently locked in
+/// meta's flake.lock). This is the semantic the dashboard `needs_update` chip
+/// conveys: "there is a config change ready to apply via rebuild."
+#[must_use]
+pub fn agent_config_pending(name: &str, deployed_sha: Option<&str>) -> bool {
+    let applied_head = std::process::Command::new("git")
+        .args([
+            "-C",
+            &format!("/var/lib/hyperhive/applied/{name}"),
+            "rev-parse",
+            "HEAD",
+        ])
+        .output()
+        .ok()
+        .filter(|o| o.status.success())
+        .and_then(|o| String::from_utf8(o.stdout).ok())
+        .map(|s| s.trim().to_owned());
+
+    match (applied_head.as_deref(), deployed_sha) {
+        (Some(head), Some(sha)) => !head.starts_with(sha) && !sha.starts_with(head),
+        _ => false,
+    }
+}
+
+/// Rebuild one sub-agent and refresh its marker. Used by both the startup
+/// scanner and the dashboard's manual "update" button so the two paths
+/// can't diverge.
+///
+/// `queue_entry_id` is `Some(id)` when the rebuild was dispatched from
+/// the rebuild_queue worker (lets the function annotate its phase via
+/// `coord.set_queue_step`) and `None` when called directly (e.g. the
+/// manager-migration nudge in `ensure_manager`).
+pub async fn rebuild_agent(
+    coord: &Arc<Coordinator>,
+    name: &str,
+    current_rev: &str,
+    queue_entry_id: Option<u64>,
+) -> Result<()> {
+    tracing::info!(%name, rev = %current_rev, "rebuild agent");
+    let agent_dir = coord
+        .ensure_runtime(name)
+        .with_context(|| format!("ensure_runtime {name}"))?;
+    let applied_dir = Coordinator::agent_applied_dir(name);
+    let claude_dir = Coordinator::agent_claude_dir(name);
+    let notes_dir = Coordinator::agent_notes_dir(name);
+    // Suppress crash_watch during the stop+start window inside
+    // lifecycle::rebuild. Dashboard rebuilds already do this via
+    // lifecycle_action; this catches the auto-update scan + any
+    // other direct caller.
+    let guard = coord.transient_guard(name, crate::coordinator::TransientKind::Rebuilding);
+    coord.set_queue_step(queue_entry_id, "nixos-container update");
+    let result = lifecycle::rebuild(
+        name,
+        &coord.hyperhive_flake,
+        &agent_dir,
+        &applied_dir,
+        &claude_dir,
+        &notes_dir,
+        coord.dashboard_port,
+        &coord.operator_pronouns,
+        &coord.context_window_tokens,
+    )
+    .await;
+    drop(guard);
+    match &result {
+        Ok(()) => {
+            if let Err(e) = std::fs::write(rev_marker_path(name), current_rev) {
+                tracing::warn!(%name, error = ?e, "write rev marker failed");
+            }
+            coord.notify_manager(&hive_sh4re::HelperEvent::Rebuilt {
+                agent: name.to_owned(),
+                ok: true,
+                note: None,
+                sha: None,
+                tag: None,
+            });
+            coord.set_queue_step(queue_entry_id, "forge sync");
+            // Run the full forge sync on every successful rebuild so
+            // the rebuild path is equivalent to the hive-c0re startup
+            // sweep: token, config-repo mirror, meta read access, and
+            // meta remote are all kept in sync. Recovers missing tokens
+            // (e.g. first-spawn seeding failed transiently) without
+            // requiring a full hive-c0re restart.
+            crate::forge::sync_agent(name, crate::forge::core_token().as_deref()).await;
+            // Wake the agent on its next turn so claude sees a
+            // "you were rebuilt — check /state/ for notes, --continue
+            // session intact" hint. Covers dashboard rebuild, admin
+            // CLI rebuild, auto-update startup scan, and the
+            // dashboard's meta-input update path — all of which
+            // route through rebuild_agent.
+            coord.kick_agent(name, "container rebuilt");
+            // Container state (needs_update, deployed_sha) may have
+            // shifted — rescan so dashboards drop the "needs update"
+            // chip without waiting for the next /api/state poll.
+            coord.rescan_containers_and_emit().await;
+            // Lock bump → meta-inputs panel needs to re-render.
+            crate::dashboard::emit_meta_inputs_snapshot(coord);
+        }
+        Err(e) => {
+            coord.notify_manager(&hive_sh4re::HelperEvent::Rebuilt {
+                agent: name.to_owned(),
+                ok: false,
+                note: Some(format!("{e:#}")),
+                sha: None,
+                tag: None,
+            });
+            coord.rescan_containers_and_emit().await;
+        }
+    }
+    result
+}
+
+/// Auto-create the manager container on startup if it isn't already there.
+/// hive-c0re manages hm1nd end-to-end (Phase 8 follow-up): operators no
+/// longer declare `containers.hm1nd` in their host NixOS config. Bypasses
+/// the approval queue — manager is required infrastructure. Idempotent.
+pub async fn ensure_manager(coord: &Arc<Coordinator>) -> Result<()> {
+    let existing = lifecycle::list().await.unwrap_or_default();
+    let current_rev = current_flake_rev(&coord.hyperhive_flake);
+    if existing.iter().any(|c| c == MANAGER_NAME) {
+        // Container exists already. If it predates the unified lifecycle
+        // (no applied flake on disk) we must rebuild — otherwise it's
+        // running whatever the host-declarative config was at create
+        // time, with a wrong systemd unit and port.
+        let applied_flake = Coordinator::agent_applied_dir(MANAGER_NAME).join("flake.nix");
+        if !applied_flake.exists()
+            && let Some(rev) = current_rev.as_ref()
+        {
+            tracing::warn!(
+                "manager container exists but no applied flake — forcing rebuild to migrate"
+            );
+            let coord_clone = coord.clone();
+            if let Err(e) = rebuild_agent(&coord_clone, MANAGER_NAME, rev.as_str(), None).await {
+                tracing::warn!(error = ?e, "manager migration rebuild failed");
+            }
+        } else {
+            tracing::debug!("manager container already present");
+        }
+        return Ok(());
+    }
+    tracing::info!("manager container missing — spawning");
+    let runtime = coord.ensure_runtime(MANAGER_NAME)?;
+    let proposed = Coordinator::agent_proposed_dir(MANAGER_NAME);
+    let applied = Coordinator::agent_applied_dir(MANAGER_NAME);
+    let claude_dir = Coordinator::agent_claude_dir(MANAGER_NAME);
+    let notes_dir = Coordinator::agent_notes_dir(MANAGER_NAME);
+    lifecycle::spawn(
+        MANAGER_NAME,
+        &coord.hyperhive_flake,
+        &runtime,
+        &proposed,
+        &applied,
+        &claude_dir,
+        &notes_dir,
+        coord.dashboard_port,
+        &coord.operator_pronouns,
+        &coord.context_window_tokens,
+    )
+    .await?;
+    if let Some(rev) = current_rev {
+        let _ = std::fs::write(rev_marker_path(MANAGER_NAME), &rev);
+    }
+    Ok(())
+}
+
+/// Rebuild every container on startup. Sequential to avoid nix-store sqlite
+/// races and keep logs readable. Returns Ok even if some rebuilds failed.
+pub async fn run(coord: Arc<Coordinator>) -> Result<()> {
+    // Bump meta's hyperhive input up-front so per-agent rebuilds build
+    // against the latest base. Non-fatal on failure.
+    if let Err(e) = crate::meta::lock_update_hyperhive().await {
+        tracing::warn!(error = ?e, "auto-update: meta lock_update_hyperhive failed");
+    }
+
+    let containers = match lifecycle::list().await {
+        Ok(c) => c,
+        Err(e) => {
+            tracing::warn!(error = ?e, "auto-update: nixos-container list failed");
+            return Ok(());
+        }
+    };
+
+    let _current_rev = current_flake_rev(&coord.hyperhive_flake).unwrap_or_default();
+
+    tracing::info!(agents = containers.len(), "auto-update: queueing all on startup");
+    for container in containers {
+        let logical = if container == MANAGER_NAME {
+            Some(MANAGER_NAME.to_owned())
+        } else {
+            container.strip_prefix(AGENT_PREFIX).map(str::to_owned)
+        };
+        let Some(name) = logical else { continue };
+        coord.rebuild_queue.enqueue(
+            crate::rebuild_queue::QueueKind::Rebuild,
+            name,
+            crate::rebuild_queue::QueueSource::AutoUpdate,
+            "startup sweep".to_owned(),
+            None,
+        );
+    }
+    coord.emit_rebuild_queue_snapshot();
+    Ok(())
+}
diff --git a/hive-c0re/src/broker.rs b/hive-c0re/src/broker.rs
new file mode 100644
index 00000000..aa414ea8
--- /dev/null
+++ b/hive-c0re/src/broker.rs
@@ -0,0 +1,1133 @@
+//! Sqlite-backed message broker. Survives `hive-c0re` restart, and taps every
+//! send/recv onto a broadcast channel so the dashboard can stream it.
+
+use std::collections::{HashMap, HashSet};
+use std::path::Path;
+use std::sync::Mutex;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use anyhow::{Context, Result};
+use hive_sh4re::{InboxRow, Message};
+use rusqlite::{Connection, OptionalExtension, params};
+use serde::Serialize;
+use tokio::sync::broadcast;
+
+const SCHEMA: &str = r"
+CREATE TABLE IF NOT EXISTS messages (
+    id           INTEGER PRIMARY KEY AUTOINCREMENT,
+    sender       TEXT    NOT NULL,
+    recipient    TEXT    NOT NULL,
+    body         TEXT    NOT NULL,
+    sent_at      INTEGER NOT NULL,
+    delivered_at INTEGER,
+    in_reply_to  INTEGER
+);
+CREATE INDEX IF NOT EXISTS idx_messages_undelivered
+    ON messages (recipient, id) WHERE delivered_at IS NULL;
+
+CREATE TABLE IF NOT EXISTS reminders (
+    id        INTEGER PRIMARY KEY AUTOINCREMENT,
+    agent     TEXT    NOT NULL,
+    message   TEXT    NOT NULL,
+    file_path TEXT,
+    due_at    INTEGER NOT NULL,
+    created_at INTEGER NOT NULL,
+    sent_at   INTEGER
+);
+CREATE INDEX IF NOT EXISTS idx_reminders_due
+    ON reminders (agent, due_at) WHERE sent_at IS NULL;
+";
+
+/// Capacity of the live event channel. Slow subscribers (e.g. an idle browser)
+/// may drop events past this; we send a `lagged` notice in their stream.
+const EVENT_CHANNEL: usize = 256;
+
+/// Row shape returned by [`Broker::get_due_reminders`]:
+/// `(agent, reminder_id, message, file_path)`. Type alias keeps
+/// `clippy::type_complexity` quiet and makes the scheduler call site
+/// self-documenting.
+pub type DueReminder = (String, i64, String, Option<String>);
+
+/// A single message hand-off from broker to recipient. Carries the
+/// broker's row id (so the harness can drive `ack_turn` later) and
+/// the redelivery flag (so the harness can prepend the
+/// "may already be handled" hint to the wake prompt). The
+/// `Message` itself is identical to a pristine `Send` payload.
+#[derive(Debug, Clone)]
+pub struct Delivery {
+    pub id: i64,
+    pub redelivered: bool,
+    pub message: Message,
+}
+
+/// Row shape for [`Broker::list_pending_reminders`], shipped on the
+/// dashboard `/api/reminders` response.
+#[derive(Debug, Clone, Serialize)]
+pub struct PendingReminder {
+    pub id: i64,
+    pub agent: String,
+    pub message: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub file_path: Option<String>,
+    pub due_at: i64,
+    pub created_at: i64,
+    /// Most recent delivery failure for this row, if any. Cleared
+    /// to NULL on operator retry. Surfaced inline in the dashboard
+    /// so a stuck reminder doesn't just silently retry forever.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub last_error: Option<String>,
+    /// Number of failed delivery attempts since the row was
+    /// created or last retried. After `MAX_REMINDER_ATTEMPTS` the
+    /// scheduler stops trying (the row stays in `pending` with the
+    /// error so the operator can decide between retry + cancel).
+    #[serde(default)]
+    pub attempt_count: u32,
+}
+
+/// Stop retrying a row after this many consecutive failures. The
+/// scheduler quits scheduling it until an operator explicitly
+/// retries (which resets the counter) or cancels (which deletes
+/// the row). Below the cap the existing 5s tick re-attempts each
+/// time the row is due.
+pub const MAX_REMINDER_ATTEMPTS: u32 = 5;
+
+/// Intra-process broker event. `recv_blocking_batch` listens on the
+/// same channel as the dashboard forwarder; the forwarder re-emits
+/// each event as a `DashboardEvent` with a freshly-stamped seq from
+/// the Coordinator. The broker itself doesn't stamp seqs — that's a
+/// wire concern, not a storage concern.
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "snake_case", tag = "kind")]
+pub enum MessageEvent {
+    Sent {
+        /// Broker row id — used by the dashboard to track thread parents.
+        id: i64,
+        from: String,
+        to: String,
+        body: String,
+        at: i64,
+        in_reply_to: Option<i64>,
+    },
+    Delivered {
+        /// Broker row id — used by the dashboard to track thread parents.
+        id: i64,
+        from: String,
+        to: String,
+        body: String,
+        at: i64,
+        in_reply_to: Option<i64>,
+    },
+}
+
+/// Per-recipient in-memory bookkeeping for the deliver-then-ack
+/// flow. Source of truth is the DB columns `delivered_at` +
+/// `acked_at`; the in-memory state here is purely an optimisation
+/// (avoids scanning the messages table on `AckTurn`) plus the
+/// redelivery-hint marker.
+#[derive(Default)]
+struct RecipientInflight {
+    /// Message ids the broker has handed to this recipient since the
+    /// last `AckTurn`. Drained on `ack_turn`, which then runs a
+    /// single `UPDATE … WHERE id IN (…)` to set `acked_at`.
+    unacked_ids: Vec<i64>,
+    /// Message ids resurfaced by the most recent `requeue_inflight`
+    /// call. The next `recv_batch` pop of any id in this set tags
+    /// the response with `redelivered: true` so the harness can
+    /// prepend the "may already be handled" hint to the wake prompt;
+    /// successful pops drain the id from the set.
+    requeued_ids: HashSet<i64>,
+}
+
+pub struct Broker {
+    conn: Mutex<Connection>,
+    events: broadcast::Sender<MessageEvent>,
+    /// Per-recipient deliver/ack tracking. Lost on hive-c0re restart
+    /// (harmless — the harness fires `RequeueInflight` on its own
+    /// boot, which rebuilds the `requeued_ids` set from the DB and
+    /// clears any stale `unacked_ids`).
+    inflight: Mutex<HashMap<String, RecipientInflight>>,
+}
+
+impl Broker {
+    pub fn open(path: &Path) -> Result<Self> {
+        if let Some(parent) = path.parent() {
+            std::fs::create_dir_all(parent)
+                .with_context(|| format!("create db parent {}", parent.display()))?;
+        }
+        let conn =
+            Connection::open(path).with_context(|| format!("open broker db {}", path.display()))?;
+        conn.execute_batch(SCHEMA).context("apply broker schema")?;
+        ensure_message_columns(&conn).context("migrate messages columns")?;
+        ensure_reminder_columns(&conn).context("migrate reminders columns")?;
+        let (events, _) = broadcast::channel(EVENT_CHANNEL);
+        Ok(Self {
+            conn: Mutex::new(conn),
+            events,
+            inflight: Mutex::new(HashMap::new()),
+        })
+    }
+
+    pub fn subscribe(&self) -> broadcast::Receiver<MessageEvent> {
+        self.events.subscribe()
+    }
+
+    pub fn send(&self, message: &Message) -> Result<()> {
+        let conn = self.conn.lock().unwrap();
+        let now = now_unix();
+        conn.execute(
+            "INSERT INTO messages (sender, recipient, body, sent_at, in_reply_to) VALUES (?1, ?2, ?3, ?4, ?5)",
+            params![message.from, message.to, message.body, now, message.in_reply_to],
+        )?;
+        let row_id = conn.last_insert_rowid();
+        drop(conn);
+        let _ = self.events.send(MessageEvent::Sent {
+            id: row_id,
+            from: message.from.clone(),
+            to: message.to.clone(),
+            body: message.body.clone(),
+            at: now,
+            in_reply_to: message.in_reply_to,
+        });
+        Ok(())
+    }
+
+    /// Latest `limit` messages addressed to `recipient`, newest-first.
+    /// Includes delivered + undelivered alike — used for the operator
+    /// inbox view on the dashboard. Caller decides what to show.
+    pub fn recent_for(&self, recipient: &str, limit: u64) -> Result<Vec<InboxRow>> {
+        let conn = self.conn.lock().unwrap();
+        let limit_i = i64::try_from(limit.min(i64::MAX as u64)).unwrap_or(i64::MAX);
+        let mut stmt = conn.prepare(
+            "SELECT id, sender, body, sent_at, in_reply_to
+               FROM messages
+              WHERE recipient = ?1
+              ORDER BY id DESC
+              LIMIT ?2",
+        )?;
+        let rows = stmt.query_map(params![recipient, limit_i], |row| {
+            Ok(InboxRow {
+                id: row.get(0)?,
+                from: row.get(1)?,
+                body: row.get(2)?,
+                at: row.get(3)?,
+                in_reply_to: row.get(4)?,
+            })
+        })?;
+        rows.collect::<rusqlite::Result<Vec<_>>>()
+            .map_err(Into::into)
+    }
+
+    /// Latest `limit` messages across every recipient, newest-first.
+    /// Backs the dashboard's message-flow backfill so a reload doesn't
+    /// blank the operator's view of recent traffic. Returns each row as
+    /// a [`MessageEvent::Sent`] so the dashboard's live renderer (which
+    /// already speaks `MessageEvent`) can replay history through the
+    /// same code path. We don't synthesise `Delivered` events here —
+    /// the recv-side acks live in a different table column and would
+    /// double-render on backfill; the live stream picks them up
+    /// immediately on the first new `recv`.
+    pub fn recent_all(&self, limit: u64) -> Result<Vec<MessageEvent>> {
+        let conn = self.conn.lock().unwrap();
+        let limit_i = i64::try_from(limit.min(i64::MAX as u64)).unwrap_or(i64::MAX);
+        let mut stmt = conn.prepare(
+            "SELECT id, sender, recipient, body, sent_at, in_reply_to
+               FROM messages
+              ORDER BY id DESC
+              LIMIT ?1",
+        )?;
+        let rows = stmt.query_map(params![limit_i], |row| {
+            Ok(MessageEvent::Sent {
+                id: row.get(0)?,
+                from: row.get(1)?,
+                to: row.get(2)?,
+                body: row.get(3)?,
+                at: row.get(4)?,
+                in_reply_to: row.get(5)?,
+            })
+        })?;
+        rows.collect::<rusqlite::Result<Vec<_>>>()
+            .map_err(Into::into)
+    }
+
+    /// Number of undelivered messages addressed to `recipient`. Non-mutating
+    /// — used by the harness to surface "N unread" in tool-result status
+    /// lines without popping the queue.
+    pub fn count_pending(&self, recipient: &str) -> Result<u64> {
+        let conn = self.conn.lock().unwrap();
+        let n: i64 = conn.query_row(
+            "SELECT COUNT(*) FROM messages
+              WHERE recipient = ?1 AND delivered_at IS NULL",
+            params![recipient],
+            |row| row.get(0),
+        )?;
+        Ok(u64::try_from(n.max(0)).unwrap_or(0))
+    }
+
+    /// Long-poll variant of `recv_batch`: returns immediately if any
+    /// row is pending (popping up to `max`); otherwise waits up to
+    /// `timeout` for the broker to emit a `Sent { to: recipient }`
+    /// event and re-tries the pop. Lets agents react to new mail
+    /// without polling their socket on a fixed interval AND lets a
+    /// single round-trip drain a burst of messages.
+    ///
+    /// **Subscribe-before-check order matters.** If we polled the
+    /// sqlite row first and only then called `subscribe()`, a
+    /// concurrent `send` landing in that window would commit +
+    /// broadcast its event *before* our receiver existed — and we'd
+    /// then sit on the long-poll until the timeout (or another,
+    /// unrelated send) fired. That looked externally like "the agent
+    /// processed one wake then went deaf until the operator poked it
+    /// again". Subscribing first guarantees any post-subscribe send
+    /// notifies us; the redundant `recv_batch()` catches the message
+    /// either way.
+    ///
+    /// `max == 0` returns an empty vec without subscribing or waiting.
+    pub async fn recv_blocking_batch(
+        &self,
+        recipient: &str,
+        timeout: std::time::Duration,
+        max: usize,
+    ) -> Result<Vec<Delivery>> {
+        if max == 0 {
+            return Ok(Vec::new());
+        }
+        let mut rx = self.subscribe();
+        let batch = self.recv_batch(recipient, max)?;
+        if !batch.is_empty() {
+            return Ok(batch);
+        }
+        let deadline = tokio::time::Instant::now() + timeout;
+        loop {
+            let Some(remaining) = deadline.checked_duration_since(tokio::time::Instant::now())
+            else {
+                return Ok(Vec::new());
+            };
+            match tokio::time::timeout(remaining, rx.recv()).await {
+                Err(_) => return Ok(Vec::new()),
+                // Channel lagged or closed — fall back to a single direct
+                // pop (in case we missed our notification while behind).
+                Ok(Err(_)) => return self.recv_batch(recipient, max),
+                Ok(Ok(MessageEvent::Sent { to, .. })) if to == recipient => {
+                    let batch = self.recv_batch(recipient, max)?;
+                    if !batch.is_empty() {
+                        return Ok(batch);
+                    }
+                    // Lost a race (concurrent recv elsewhere). Keep waiting.
+                }
+                Ok(Ok(_)) => {}
+            }
+        }
+    }
+
+    /// Delete fully-acked messages older than `older_than_secs`.
+    /// Unacked rows (delivered but not yet acknowledged by a clean
+    /// turn-end, plus undelivered rows) are always kept regardless of
+    /// age — the former because they're recoverable via
+    /// `requeue_inflight`, the latter because they're still in flight
+    /// from the broker's POV. Returns the number of rows removed.
+    pub fn vacuum_delivered(&self, older_than_secs: i64) -> Result<u64> {
+        let cutoff = now_unix() - older_than_secs;
+        let conn = self.conn.lock().unwrap();
+        let n = conn.execute(
+            "DELETE FROM messages
+              WHERE acked_at IS NOT NULL
+                AND acked_at < ?1",
+            params![cutoff],
+        )?;
+        Ok(u64::try_from(n).unwrap_or(0))
+    }
+
+    /// Pop up to `max` pending messages for `recipient` in one
+    /// round-trip. Every popped row is marked `delivered_at = NOW`,
+    /// pushed onto the per-recipient `unacked_ids` list (so the next
+    /// `ack_turn` closes them out), and tagged with
+    /// `redelivered = true` if it was resurfaced by the most recent
+    /// `requeue_inflight`. Emits one `MessageEvent::Delivered` per
+    /// popped row so the dashboard forwarder stream sees one event
+    /// per message regardless of batch size.
+    ///
+    /// `max == 0` short-circuits to an empty vec (no DB hit); any
+    /// positive value caps the batch at `max`. FIFO ordering.
+    ///
+    /// Lock order: `inflight` FIRST, then `conn`. `requeue_inflight`
+    /// and `ack_turn` follow the same order so a concurrent pop can't
+    /// race the requeue's DB update vs in-memory populate and miss
+    /// the redelivered tag.
+    pub fn recv_batch(&self, recipient: &str, max: usize) -> Result<Vec<Delivery>> {
+        if max == 0 {
+            return Ok(Vec::new());
+        }
+        // Same lock order as `recv` / `ack_turn` / `requeue_inflight`.
+        let mut inflight = self.inflight.lock().unwrap();
+        let conn = self.conn.lock().unwrap();
+        let max_i = i64::try_from(max).unwrap_or(i64::MAX);
+        let mut stmt = conn.prepare(
+            "SELECT id, sender, recipient, body, in_reply_to
+               FROM messages
+              WHERE recipient = ?1 AND delivered_at IS NULL
+              ORDER BY id ASC
+              LIMIT ?2",
+        )?;
+        let rows: Vec<(i64, String, String, String, Option<i64>)> = stmt
+            .query_map(params![recipient, max_i], |row| {
+                Ok((row.get(0)?, row.get(1)?, row.get(2)?, row.get(3)?, row.get(4)?))
+            })?
+            .collect::<rusqlite::Result<_>>()?;
+        drop(stmt);
+        if rows.is_empty() {
+            return Ok(Vec::new());
+        }
+        // Stamp all popped rows in a single UPDATE — under the broker
+        // mutex, well within sqlite's 999-param default.
+        let now = now_unix();
+        let ids: Vec<i64> = rows.iter().map(|(id, _, _, _, _)| *id).collect();
+        let placeholders = std::iter::repeat_n("?", ids.len())
+            .collect::<Vec<_>>()
+            .join(",");
+        let sql = format!("UPDATE messages SET delivered_at = ? WHERE id IN ({placeholders})");
+        let mut params_vec: Vec<&dyn rusqlite::ToSql> = Vec::with_capacity(ids.len() + 1);
+        params_vec.push(&now);
+        for id in &ids {
+            params_vec.push(id);
+        }
+        conn.execute(&sql, params_vec.as_slice())?;
+        drop(conn);
+        // Bookkeeping + assemble the Delivery list. Per-row
+        // `requeued_ids` lookup runs once per pop, same as `recv`.
+        let slot = inflight.entry(recipient.to_owned()).or_default();
+        let mut deliveries = Vec::with_capacity(rows.len());
+        for (id, from, to, body, in_reply_to) in rows {
+            slot.unacked_ids.push(id);
+            let redelivered = slot.requeued_ids.remove(&id);
+            deliveries.push(Delivery {
+                id,
+                redelivered,
+                message: Message {
+                    from,
+                    to,
+                    body,
+                    in_reply_to,
+                },
+            });
+        }
+        drop(inflight);
+        // Mirror the per-row Delivered emit `recv` does so the
+        // dashboard forwarder sees one event per message regardless of
+        // which surface the harness used.
+        for d in &deliveries {
+            let _ = self.events.send(MessageEvent::Delivered {
+                id: d.id,
+                from: d.message.from.clone(),
+                to: d.message.to.clone(),
+                body: d.message.body.clone(),
+                at: now,
+                in_reply_to: d.message.in_reply_to,
+            });
+        }
+        Ok(deliveries)
+    }
+
+    /// Drain the per-recipient unacked-id list and mark every row
+    /// `acked_at = NOW`. Fired by the harness after `TurnOutcome::Ok`.
+    /// Returns the number of rows acked (zero is normal — claude
+    /// may have not called recv during the turn). Tolerant of ids
+    /// that no longer exist in the DB (vacuumed, manually deleted)
+    /// — `UPDATE … WHERE id IN (…)` simply matches zero rows.
+    pub fn ack_turn(&self, recipient: &str) -> Result<u64> {
+        // Same lock order as `recv` and `requeue_inflight`.
+        let mut inflight = self.inflight.lock().unwrap();
+        let ids: Vec<i64> = inflight
+            .get_mut(recipient)
+            .map(|s| std::mem::take(&mut s.unacked_ids))
+            .unwrap_or_default();
+        if ids.is_empty() {
+            return Ok(0);
+        }
+        let now = now_unix();
+        let conn = self.conn.lock().unwrap();
+        // Bind every id explicitly. Caps in the hundreds in the worst
+        // case (a single very chatty turn); well under sqlite's 999
+        // default param limit and we're already serialising on the
+        // broker mutex.
+        let placeholders = std::iter::repeat_n("?", ids.len())
+            .collect::<Vec<_>>()
+            .join(",");
+        let sql = format!("UPDATE messages SET acked_at = ? WHERE id IN ({placeholders})");
+        let mut params_vec: Vec<&dyn rusqlite::ToSql> = Vec::with_capacity(ids.len() + 1);
+        params_vec.push(&now);
+        for id in &ids {
+            params_vec.push(id);
+        }
+        let n = conn.execute(&sql, params_vec.as_slice())?;
+        Ok(u64::try_from(n).unwrap_or(0))
+    }
+
+    /// Resurface every message the broker previously handed to this
+    /// recipient that never got `acked_at` set. Used by the harness at
+    /// boot to recover from the crashed-mid-turn / OOM-killed /
+    /// container-restarted cases. Three steps:
+    ///
+    /// 1. Clear any stale in-memory state for this recipient (the
+    ///    previous harness session's `unacked_ids` are irrelevant —
+    ///    the new session will repopulate from fresh pops).
+    /// 2. Find every row where `recipient = me`, `delivered_at IS NOT
+    ///    NULL`, `acked_at IS NULL`. Reset `delivered_at = NULL` so
+    ///    the next `Recv` pops them again.
+    /// 3. Remember each id in the per-recipient `requeued_ids` set so
+    ///    the next pop tags the response with `redelivered: true`.
+    ///
+    /// Returns the number of rows requeued. Safe to call when there's
+    /// nothing in flight (returns 0). Safe to call multiple times
+    /// (idempotent — the second call finds nothing because the rows
+    /// are now back in the pending state).
+    pub fn requeue_inflight(&self, recipient: &str) -> Result<u64> {
+        // Hold inflight + conn together so a concurrent `recv` can't
+        // pop a just-requeued row between our DB update and our
+        // in-memory populate and miss the redelivered tag.
+        let mut inflight = self.inflight.lock().unwrap();
+        let conn = self.conn.lock().unwrap();
+        let mut stmt = conn.prepare(
+            "SELECT id FROM messages
+              WHERE recipient = ?1
+                AND delivered_at IS NOT NULL
+                AND acked_at IS NULL",
+        )?;
+        let ids: Vec<i64> = stmt
+            .query_map(params![recipient], |row| row.get(0))?
+            .collect::<rusqlite::Result<_>>()?;
+        drop(stmt);
+        if !ids.is_empty() {
+            let placeholders = std::iter::repeat_n("?", ids.len())
+                .collect::<Vec<_>>()
+                .join(",");
+            let sql =
+                format!("UPDATE messages SET delivered_at = NULL WHERE id IN ({placeholders})");
+            let params_vec: Vec<&dyn rusqlite::ToSql> =
+                ids.iter().map(|id| id as &dyn rusqlite::ToSql).collect();
+            conn.execute(&sql, params_vec.as_slice())?;
+        }
+        let slot = inflight.entry(recipient.to_owned()).or_default();
+        slot.unacked_ids.clear();
+        slot.requeued_ids.clear();
+        slot.requeued_ids.extend(ids.iter().copied());
+        Ok(u64::try_from(ids.len()).unwrap_or(0))
+    }
+
+    /// Store a new reminder. Returns the reminder id.
+    pub fn store_reminder(
+        &self,
+        agent: &str,
+        message: &str,
+        file_path: Option<&str>,
+        due_at: i64,
+    ) -> Result<i64> {
+        let conn = self.conn.lock().unwrap();
+        conn.execute(
+            "INSERT INTO reminders (agent, message, file_path, due_at, created_at) VALUES (?1, ?2, ?3, ?4, ?5)",
+            params![agent, message, file_path, due_at, now_unix()],
+        )?;
+        let id = conn.last_insert_rowid();
+        Ok(id)
+    }
+
+    /// Every reminder still pending delivery, newest-first. Used by the
+    /// dashboard's reminders pane so the operator can see what's queued
+    /// + cancel rows that are no longer wanted.
+    pub fn list_pending_reminders(&self) -> Result<Vec<PendingReminder>> {
+        let conn = self.conn.lock().unwrap();
+        let mut stmt = conn.prepare(
+            "SELECT id, agent, message, file_path, due_at, created_at, \
+                    last_error, attempt_count \
+               FROM reminders \
+              WHERE sent_at IS NULL \
+              ORDER BY due_at ASC",
+        )?;
+        let rows = stmt.query_map([], |row| {
+            let attempts: i64 = row.get(7)?;
+            Ok(PendingReminder {
+                id: row.get(0)?,
+                agent: row.get(1)?,
+                message: row.get(2)?,
+                file_path: row.get(3)?,
+                due_at: row.get(4)?,
+                created_at: row.get(5)?,
+                last_error: row.get(6)?,
+                attempt_count: u32::try_from(attempts).unwrap_or(0),
+            })
+        })?;
+        rows.collect::<rusqlite::Result<Vec<_>>>()
+            .context("list pending reminders")
+    }
+
+    /// Mark a delivery attempt as failed: bump `attempt_count` and
+    /// stash the error string. Called by `reminder_scheduler::tick`
+    /// when `deliver_reminder` returns Err. Soft-cap behaviour
+    /// lives in `get_due_reminders` (rows over the cap drop out
+    /// of the due-list and stop being attempted until retry).
+    pub fn record_reminder_failure(&self, id: i64, reason: &str) -> Result<()> {
+        let conn = self.conn.lock().unwrap();
+        conn.execute(
+            "UPDATE reminders \
+                SET attempt_count = attempt_count + 1, last_error = ?1 \
+              WHERE id = ?2 AND sent_at IS NULL",
+            params![reason, id],
+        )?;
+        Ok(())
+    }
+
+    /// Clear the failure state on a pending reminder so the
+    /// scheduler picks it up again. No-op when the row is already
+    /// fresh (`attempt_count == 0`). Returns the number of rows
+    /// affected so callers can distinguish "retried" from "no
+    /// such pending reminder" (already delivered, or wrong id).
+    pub fn reset_reminder_failure(&self, id: i64) -> Result<usize> {
+        let conn = self.conn.lock().unwrap();
+        let n = conn.execute(
+            "UPDATE reminders \
+                SET attempt_count = 0, last_error = NULL \
+              WHERE id = ?1 AND sent_at IS NULL",
+            params![id],
+        )?;
+        Ok(n)
+    }
+
+    /// Count this agent's still-pending (un-delivered) reminders.
+    /// Used by the per-turn stats sink for a cheap "what was queued
+    /// at turn-end" snapshot.
+    pub fn count_pending_reminders_for(&self, agent: &str) -> Result<u64> {
+        let conn = self.conn.lock().unwrap();
+        let n: i64 = conn.query_row(
+            "SELECT COUNT(*) FROM reminders WHERE agent = ?1 AND sent_at IS NULL",
+            params![agent],
+            |row| row.get(0),
+        )?;
+        Ok(u64::try_from(n).unwrap_or(0))
+    }
+
+    /// Reminder rollup stats for an agent over a time window. Returns
+    /// counts of scheduled, delivered, and pending reminders created
+    /// in the last `since_secs` seconds (0 = all reminders).
+    pub fn reminder_rollup_for(&self, agent: &str, since_secs: u64) -> Result<hive_sh4re::ReminderStats> {
+        let conn = self.conn.lock().unwrap();
+        let cutoff_time = if since_secs > 0 {
+            let now = std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .ok()
+                .and_then(|d| i64::try_from(d.as_secs()).ok())
+                .unwrap_or(0);
+            now.saturating_sub(i64::try_from(since_secs).unwrap_or(i64::MAX))
+        } else {
+            i64::MIN
+        };
+        let scheduled: i64 = conn.query_row(
+            "SELECT COUNT(*) FROM reminders WHERE agent = ?1 AND created_at >= ?2",
+            params![agent, cutoff_time],
+            |row| row.get(0),
+        )?;
+        let delivered: i64 = conn.query_row(
+            "SELECT COUNT(*) FROM reminders WHERE agent = ?1 AND created_at >= ?2 AND sent_at IS NOT NULL",
+            params![agent, cutoff_time],
+            |row| row.get(0),
+        )?;
+        let pending: i64 = conn.query_row(
+            "SELECT COUNT(*) FROM reminders WHERE agent = ?1 AND created_at >= ?2 AND sent_at IS NULL",
+            params![agent, cutoff_time],
+            |row| row.get(0),
+        )?;
+        Ok(hive_sh4re::ReminderStats {
+            scheduled: u64::try_from(scheduled).unwrap_or(0),
+            delivered: u64::try_from(delivered).unwrap_or(0),
+            pending: u64::try_from(pending).unwrap_or(0),
+        })
+    }
+
+    /// Delete a reminder by id. Returns the number of rows removed (0
+    /// when the id never existed or was already delivered). Hard
+    /// delete rather than soft so the row doesn't linger and confuse a
+    /// re-creation under the same id.
+    pub fn cancel_reminder(&self, id: i64) -> Result<usize> {
+        let conn = self.conn.lock().unwrap();
+        let n = conn.execute(
+            "DELETE FROM reminders WHERE id = ?1 AND sent_at IS NULL",
+            params![id],
+        )?;
+        Ok(n)
+    }
+
+    /// Cancel a pending reminder on behalf of `canceller`. Returns
+    /// the owner agent name on success (handy for logging). Auth
+    /// rules mirror `OperatorQuestions::cancel`: owner, operator, or
+    /// manager.
+    pub fn cancel_reminder_as(&self, id: i64, canceller: &str) -> Result<String> {
+        let conn = self.conn.lock().unwrap();
+        let owner: Option<String> = conn
+            .query_row(
+                "SELECT agent FROM reminders WHERE id = ?1 AND sent_at IS NULL",
+                params![id],
+                |row| row.get(0),
+            )
+            .optional()?;
+        let Some(owner) = owner else {
+            anyhow::bail!("reminder {id} not pending (already delivered or unknown)");
+        };
+        let authorised = canceller == owner
+            || canceller == hive_sh4re::OPERATOR_RECIPIENT
+            || canceller == hive_sh4re::MANAGER_AGENT;
+        if !authorised {
+            anyhow::bail!(
+                "reminder {id}: '{canceller}' not allowed to cancel (owner = '{owner}')"
+            );
+        }
+        let n = conn.execute(
+            "DELETE FROM reminders WHERE id = ?1 AND sent_at IS NULL",
+            params![id],
+        )?;
+        if n == 0 {
+            anyhow::bail!("reminder {id} vanished between auth check and delete");
+        }
+        Ok(owner)
+    }
+
+    /// Get up to `limit` due reminders across all agents in a single query.
+    /// Returns `(agent, id, message, file_path)` tuples. Pass a small limit
+    /// (e.g. 100) so a burst of overdue reminders doesn't flood the broker
+    /// in one cycle — leftovers stay due and get picked up on the next tick.
+    pub fn get_due_reminders(&self, limit: u64) -> Result<Vec<DueReminder>> {
+        let conn = self.conn.lock().unwrap();
+        let limit_i = i64::try_from(limit.min(i64::MAX as u64)).unwrap_or(i64::MAX);
+        let max_attempts = i64::from(MAX_REMINDER_ATTEMPTS);
+        // attempt_count >= cap = give up; row stays pending so the
+        // operator sees + can retry/cancel via the dashboard.
+        let mut stmt = conn.prepare(
+            "SELECT agent, id, message, file_path FROM reminders \
+             WHERE due_at <= ?1 AND sent_at IS NULL AND attempt_count < ?3 \
+             ORDER BY agent, due_at ASC \
+             LIMIT ?2",
+        )?;
+        let rows = stmt.query_map(params![now_unix(), limit_i, max_attempts], |row| {
+            Ok((
+                row.get::<_, String>(0)?,
+                row.get::<_, i64>(1)?,
+                row.get::<_, String>(2)?,
+                row.get::<_, Option<String>>(3)?,
+            ))
+        })?;
+        rows.collect::<rusqlite::Result<Vec<_>>>()
+            .context("query due reminders")
+    }
+
+    /// Atomic reminder delivery: insert the inbox message AND mark the
+    /// reminder as sent in a single sqlite transaction. Prevents the
+    /// orphan-reminder duplicate-delivery class of bugs that two separate
+    /// calls (send + `mark_reminder_sent`) could produce if the second one
+    /// failed transiently — the next scheduler tick would see the reminder
+    /// still due and redeliver. Either both writes commit or neither does;
+    /// re-running on failure is safe.
+    ///
+    /// Emits a `Sent` event on the broadcast channel after the transaction
+    /// commits (so subscribers see the inbox message but never see a
+    /// "phantom" send for a transaction that rolled back).
+    /// Deliver a batch of reminders in a single transaction, reducing
+    /// lock contention on the shared sqlite connection under high
+    /// reminder volume. Returns per-item results so the scheduler can
+    /// record individual failures without aborting successful ones.
+    ///
+    /// Items where the INSERT+UPDATE succeeds get a `MessageEvent::Sent`
+    /// emitted after the transaction commits. Items that fail are
+    /// returned as `Err` in the output vec (index-aligned with input).
+    pub fn deliver_reminders_batch(
+        &self,
+        items: &[(i64, String, String)], // (reminder_id, agent, body)
+    ) -> Vec<Result<()>> {
+        if items.is_empty() {
+            return Vec::new();
+        }
+        let now = now_unix();
+        let mut conn = self.conn.lock().unwrap();
+        // Build one transaction for all deliveries so we hold the lock
+        // once rather than N times. On a batch-level error (e.g. DB
+        // corruption), fall back to returning per-item errors so the
+        // scheduler records the failure cleanly.
+        let tx = match conn.transaction() {
+            Ok(t) => t,
+            Err(e) => {
+                let err_str = format!("{e:#}");
+                return items
+                    .iter()
+                    .map(|_| Err(anyhow::anyhow!("{}", err_str.clone())))
+                    .collect();
+            }
+        };
+        let mut results: Vec<Result<()>> = Vec::with_capacity(items.len());
+        // Per-item broker row ids — collected inside the transaction so
+        // we can emit Sent events with the correct id after commit.
+        let mut msg_ids: Vec<i64> = Vec::with_capacity(items.len());
+        for (id, agent, body) in items {
+            let r = (|| -> Result<i64> {
+                tx.execute(
+                    "INSERT INTO messages (sender, recipient, body, sent_at) \
+                     VALUES (?1, ?2, ?3, ?4)",
+                    params!["reminder", agent, body, now],
+                )?;
+                let msg_id = tx.last_insert_rowid();
+                tx.execute(
+                    "UPDATE reminders SET sent_at = ?1 WHERE id = ?2",
+                    params![now, id],
+                )?;
+                Ok(msg_id)
+            })();
+            match r {
+                Ok(msg_id) => {
+                    msg_ids.push(msg_id);
+                    results.push(Ok(()));
+                }
+                Err(e) => {
+                    msg_ids.push(-1);
+                    results.push(Err(e));
+                }
+            }
+        }
+        if let Err(e) = tx.commit() {
+            let err_str = format!("{e:#}");
+            return items
+                .iter()
+                .map(|_| Err(anyhow::anyhow!("{}", err_str.clone())))
+                .collect();
+        }
+        drop(conn);
+        // Emit per-row Sent events (only for rows that succeeded).
+        for (((id, agent, body), result), msg_id) in items.iter().zip(results.iter()).zip(msg_ids.iter()) {
+            if result.is_ok() {
+                let _ = self.events.send(MessageEvent::Sent {
+                    id: *msg_id,
+                    from: "reminder".to_owned(),
+                    to: agent.clone(),
+                    body: body.clone(),
+                    at: now,
+                    in_reply_to: None,
+                });
+                tracing::debug!(reminder_id = id, %agent, "reminder delivered");
+            }
+        }
+        results
+    }
+}
+
+/// Idempotent messages-table migrations. Adds `acked_at` and
+/// back-fills it for every already-delivered row, so the
+/// pre-migration sessions count as "fully handled" and won't be
+/// resurfaced by the first `requeue_inflight` after upgrade.
+fn ensure_message_columns(conn: &Connection) -> Result<()> {
+    let has_acked: bool = conn
+        .prepare("SELECT 1 FROM pragma_table_info('messages') WHERE name = 'acked_at'")?
+        .exists([])?;
+    if !has_acked {
+        conn.execute_batch("ALTER TABLE messages ADD COLUMN acked_at INTEGER;")
+            .context("add messages.acked_at column")?;
+        // Backfill: treat every existing delivered row as acked. The
+        // session it was delivered to is gone, so requeue would just
+        // surface phantom traffic to whatever harness reads next.
+        conn.execute(
+            "UPDATE messages SET acked_at = delivered_at \
+              WHERE delivered_at IS NOT NULL AND acked_at IS NULL",
+            [],
+        )
+        .context("backfill messages.acked_at from delivered_at")?;
+    }
+    let has_reply: bool = conn
+        .prepare("SELECT 1 FROM pragma_table_info('messages') WHERE name = 'in_reply_to'")?
+        .exists([])?;
+    if !has_reply {
+        conn.execute_batch("ALTER TABLE messages ADD COLUMN in_reply_to INTEGER;")
+            .context("add messages.in_reply_to column")?;
+        // No backfill needed — existing messages simply have NULL here,
+        // meaning "root of a new thread", which is correct.
+    }
+    Ok(())
+}
+
+/// Idempotent reminder-table migrations. `ALTER TABLE ADD COLUMN`
+/// has no `IF NOT EXISTS` form in sqlite, so we probe
+/// `pragma_table_info` per column. New deploys (table created by
+/// SCHEMA in this commit cycle) skip the ALTER; pre-existing
+/// broker.sqlite files get the columns added on next boot.
+fn ensure_reminder_columns(conn: &Connection) -> Result<()> {
+    for (name, sql) in [
+        (
+            "attempt_count",
+            "ALTER TABLE reminders ADD COLUMN attempt_count INTEGER NOT NULL DEFAULT 0;",
+        ),
+        (
+            "last_error",
+            "ALTER TABLE reminders ADD COLUMN last_error TEXT;",
+        ),
+    ] {
+        let has: bool = conn
+            .prepare(&format!(
+                "SELECT 1 FROM pragma_table_info('reminders') WHERE name = '{name}'"
+            ))?
+            .exists([])?;
+        if !has {
+            conn.execute_batch(sql)
+                .with_context(|| format!("add reminders.{name} column"))?;
+        }
+    }
+    Ok(())
+}
+
+fn now_unix() -> i64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .ok()
+        .and_then(|d| i64::try_from(d.as_secs()).ok())
+        .unwrap_or(0)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::atomic::{AtomicU64, Ordering};
+
+    /// Per-process counter so each test gets a unique sqlite path even
+    /// when threads run concurrently. Avoids pulling in a `tempfile`
+    /// dep just for this one module.
+    static TEST_COUNTER: AtomicU64 = AtomicU64::new(0);
+
+    struct TmpBroker {
+        path: std::path::PathBuf,
+        pub broker: Broker,
+    }
+
+    impl Drop for TmpBroker {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_file(&self.path);
+        }
+    }
+
+    fn open_broker() -> TmpBroker {
+        let n = TEST_COUNTER.fetch_add(1, Ordering::Relaxed);
+        let pid = std::process::id();
+        let path = std::env::temp_dir().join(format!("hive-broker-test-{pid}-{n}.sqlite"));
+        let _ = std::fs::remove_file(&path);
+        let broker = Broker::open(&path).expect("open broker");
+        TmpBroker { path, broker }
+    }
+
+    fn msg(from: &str, to: &str, body: &str) -> Message {
+        Message {
+            from: from.to_owned(),
+            to: to.to_owned(),
+            body: body.to_owned(),
+            in_reply_to: None,
+        }
+    }
+
+    /// Convenience wrapper for tests that want single-pop semantics
+    /// — the broker only exposes `recv_batch` publicly now, so
+    /// every test that used to call `recv` goes through here.
+    fn pop_one(broker: &Broker, recipient: &str) -> Option<Delivery> {
+        let mut batch = broker.recv_batch(recipient, 1).unwrap();
+        batch.pop()
+    }
+
+    /// Happy path: send → recv → `ack_turn` drains the in-memory list
+    /// and marks the row `acked_at IS NOT NULL`. A second recv finds
+    /// nothing pending (the row stays in the table for vacuum).
+    #[test]
+    fn ack_turn_marks_delivered_rows_acked() {
+        let h = open_broker();
+        let broker = &h.broker;
+        broker.send(&msg("a", "b", "hi")).unwrap();
+        let d = pop_one(broker, "b").expect("popped");
+        assert_eq!(d.message.body, "hi");
+        assert!(!d.redelivered);
+        assert_eq!(broker.ack_turn("b").unwrap(), 1);
+        // ack_turn drained the unacked list; calling again is a no-op.
+        assert_eq!(broker.ack_turn("b").unwrap(), 0);
+        // Recv finds nothing — the row is now delivered + acked.
+        assert!(pop_one(broker, "b").is_none());
+    }
+
+    /// Crash-recovery: send → recv → (no ack) → `requeue_inflight`
+    /// resets `delivered_at` + tags the next pop as redelivered. After
+    /// that `ack_turn` closes it out cleanly.
+    #[test]
+    fn requeue_inflight_resurfaces_unacked_with_redelivered_flag() {
+        let h = open_broker();
+        let broker = &h.broker;
+        broker.send(&msg("a", "b", "hi")).unwrap();
+        let d1 = pop_one(broker, "b").expect("popped");
+        assert!(!d1.redelivered);
+        // Simulate harness crash: never call ack_turn. Now boot the
+        // new harness — requeue_inflight resurfaces the row.
+        assert_eq!(broker.requeue_inflight("b").unwrap(), 1);
+        let d2 = pop_one(broker, "b").expect("popped again");
+        assert_eq!(d2.message.body, "hi");
+        assert!(
+            d2.redelivered,
+            "second pop should be tagged redelivered"
+        );
+        assert_eq!(broker.ack_turn("b").unwrap(), 1);
+    }
+
+    /// Idempotency: a second `requeue_inflight` on the same recipient
+    /// finds nothing because the prior call already reset
+    /// `delivered_at` (the row is back in the pending state, not
+    /// inflight).
+    #[test]
+    fn requeue_inflight_is_idempotent() {
+        let h = open_broker();
+        let broker = &h.broker;
+        broker.send(&msg("a", "b", "hi")).unwrap();
+        pop_one(broker, "b").expect("popped");
+        assert_eq!(broker.requeue_inflight("b").unwrap(), 1);
+        // Second call: the row is pending (delivered_at IS NULL) so
+        // nothing matches the inflight filter.
+        assert_eq!(broker.requeue_inflight("b").unwrap(), 0);
+    }
+
+    /// Multiple messages, partial drain: pop two, `ack_turn` covers
+    /// both even though one was popped before the other.
+    #[test]
+    fn ack_turn_handles_batch() {
+        let h = open_broker();
+        let broker = &h.broker;
+        broker.send(&msg("a", "b", "one")).unwrap();
+        broker.send(&msg("a", "b", "two")).unwrap();
+        broker.send(&msg("a", "b", "three")).unwrap();
+        pop_one(broker, "b").expect("popped 1");
+        pop_one(broker, "b").expect("popped 2");
+        pop_one(broker, "b").expect("popped 3");
+        assert_eq!(broker.ack_turn("b").unwrap(), 3);
+        assert!(pop_one(broker, "b").is_none());
+    }
+
+    /// Vacuum filter respects the new `acked_at` semantics — a
+    /// delivered-but-not-acked row is NOT vacuumed regardless of
+    /// age (the requeue path needs it).
+    #[test]
+    fn vacuum_preserves_unacked_inflight_rows() {
+        let h = open_broker();
+        let broker = &h.broker;
+        broker.send(&msg("a", "b", "stuck")).unwrap();
+        pop_one(broker, "b").expect("popped");
+        // Wide window — should still skip unacked rows.
+        let removed = broker.vacuum_delivered(-i64::from(u8::MAX)).unwrap();
+        assert_eq!(removed, 0, "unacked inflight row must survive vacuum");
+        // After ack_turn the row is fair game.
+        broker.ack_turn("b").unwrap();
+        let removed = broker.vacuum_delivered(-i64::from(u8::MAX)).unwrap();
+        assert_eq!(removed, 1, "acked row is now vacuumable");
+    }
+
+    /// Recv ordering: requeued rows go back into FIFO position
+    /// (they keep their original id). New sends added after the
+    /// requeue arrive after them.
+    #[test]
+    fn requeued_rows_come_back_in_original_order() {
+        let h = open_broker();
+        let broker = &h.broker;
+        broker.send(&msg("a", "b", "first")).unwrap();
+        broker.send(&msg("a", "b", "second")).unwrap();
+        // Pop both, ack neither.
+        pop_one(broker, "b").expect("popped 1");
+        pop_one(broker, "b").expect("popped 2");
+        broker.requeue_inflight("b").unwrap();
+        // Now add a brand new message AFTER the requeue.
+        broker.send(&msg("a", "b", "third")).unwrap();
+        let d1 = pop_one(broker, "b").expect("re-pop 1");
+        assert_eq!(d1.message.body, "first");
+        assert!(d1.redelivered);
+        let d2 = pop_one(broker, "b").expect("re-pop 2");
+        assert_eq!(d2.message.body, "second");
+        assert!(d2.redelivered);
+        let d3 = pop_one(broker, "b").expect("re-pop 3");
+        assert_eq!(d3.message.body, "third");
+        assert!(
+            !d3.redelivered,
+            "fresh-send-after-requeue must NOT be tagged redelivered"
+        );
+    }
+
+    /// Happy path for `recv_batch`: pops in FIFO order, respects
+    /// `max`, leaves the rest pending for the next call.
+    #[test]
+    fn recv_batch_pops_fifo_capped_at_max() {
+        let h = open_broker();
+        let broker = &h.broker;
+        for i in 0..5 {
+            broker.send(&msg("a", "b", &format!("m{i}"))).unwrap();
+        }
+        let batch = broker.recv_batch("b", 3).unwrap();
+        let bodies: Vec<_> = batch.iter().map(|d| d.message.body.as_str()).collect();
+        assert_eq!(bodies, vec!["m0", "m1", "m2"]);
+        // Remaining two stay pending; a second batch drains them.
+        let next = broker.recv_batch("b", 10).unwrap();
+        let bodies: Vec<_> = next.iter().map(|d| d.message.body.as_str()).collect();
+        assert_eq!(bodies, vec!["m3", "m4"]);
+        // ack_turn closes out all five popped rows in one go.
+        assert_eq!(broker.ack_turn("b").unwrap(), 5);
+    }
+
+    /// `recv_batch` with no pending traffic returns an empty vec
+    /// (the "(empty)" path), not an error.
+    #[test]
+    fn recv_batch_returns_empty_when_idle() {
+        let h = open_broker();
+        let batch = h.broker.recv_batch("ghost", 5).unwrap();
+        assert!(batch.is_empty());
+    }
+
+    /// `max = 0` short-circuits without touching the DB (covered by
+    /// asserting we don't accidentally pop a pending row).
+    #[test]
+    fn recv_batch_zero_max_pops_nothing() {
+        let h = open_broker();
+        let broker = &h.broker;
+        broker.send(&msg("a", "b", "stay")).unwrap();
+        assert!(broker.recv_batch("b", 0).unwrap().is_empty());
+        // The pending row is still in flight for the next real recv.
+        let d = pop_one(broker, "b").expect("still pending");
+        assert_eq!(d.message.body, "stay");
+    }
+
+    /// `recv_batch` tags requeued rows with `redelivered: true` and
+    /// drains them from the per-recipient `requeued_ids` set so a
+    /// fresh follow-up recv after the batch doesn't double-tag.
+    #[test]
+    fn recv_batch_propagates_redelivered_flag() {
+        let h = open_broker();
+        let broker = &h.broker;
+        broker.send(&msg("a", "b", "one")).unwrap();
+        broker.send(&msg("a", "b", "two")).unwrap();
+        pop_one(broker, "b").expect("popped 1");
+        pop_one(broker, "b").expect("popped 2");
+        broker.requeue_inflight("b").unwrap();
+        let batch = broker.recv_batch("b", 5).unwrap();
+        assert_eq!(batch.len(), 2);
+        assert!(batch.iter().all(|d| d.redelivered));
+        // Fresh send after the batch is NOT tagged redelivered.
+        broker.send(&msg("a", "b", "three")).unwrap();
+        let d = pop_one(broker, "b").expect("re-pop 3");
+        assert_eq!(d.message.body, "three");
+        assert!(!d.redelivered);
+    }
+
+    /// Per-recipient isolation: `requeue_inflight("a")` doesn't touch
+    /// b's inflight rows.
+    #[test]
+    fn requeue_inflight_is_per_recipient() {
+        let h = open_broker();
+        let broker = &h.broker;
+        broker.send(&msg("x", "alice", "for alice")).unwrap();
+        broker.send(&msg("x", "bob", "for bob")).unwrap();
+        pop_one(broker, "alice").expect("popped alice");
+        pop_one(broker, "bob").expect("popped bob");
+        // Requeue only alice. Bob's row stays inflight.
+        assert_eq!(broker.requeue_inflight("alice").unwrap(), 1);
+        let d = pop_one(broker, "alice").expect("re-pop alice");
+        assert!(d.redelivered);
+        // Bob has nothing pending (his row is still delivered, not requeued).
+        assert!(pop_one(broker, "bob").is_none());
+    }
+}
diff --git a/hive-c0re/src/client.rs b/hive-c0re/src/client.rs
new file mode 100644
index 00000000..14866369
--- /dev/null
+++ b/hive-c0re/src/client.rs
@@ -0,0 +1,27 @@
+use std::path::Path;
+
+use anyhow::{Context, Result, bail};
+use hive_sh4re::{HostRequest, HostResponse};
+use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
+use tokio::net::UnixStream;
+
+pub async fn request(socket: &Path, req: HostRequest) -> Result<HostResponse> {
+    let stream = UnixStream::connect(socket)
+        .await
+        .with_context(|| format!("connect to {}", socket.display()))?;
+    let (read, mut write) = stream.into_split();
+
+    let mut payload = serde_json::to_string(&req)?;
+    payload.push('\n');
+    write.write_all(payload.as_bytes()).await?;
+    write.flush().await?;
+
+    let mut reader = BufReader::new(read);
+    let mut line = String::new();
+    reader.read_line(&mut line).await?;
+    if line.is_empty() {
+        bail!("server closed connection without responding");
+    }
+    let resp: HostResponse = serde_json::from_str(line.trim())?;
+    Ok(resp)
+}
diff --git a/hive-c0re/src/container_view.rs b/hive-c0re/src/container_view.rs
new file mode 100644
index 00000000..68c0458f
--- /dev/null
+++ b/hive-c0re/src/container_view.rs
@@ -0,0 +1,412 @@
+//! `ContainerView` + the snapshot builder that turns
+//! `nixos-container list` (plus per-agent state on disk) into the row
+//! shape the dashboard renders. Extracted from `dashboard.rs` so the
+//! coordinator's rescan-and-emit helper can build the same view and
+//! diff against the last snapshot to fire
+//! `ContainerStateChanged` / `ContainerRemoved` events.
+
+use std::collections::HashMap;
+use std::path::Path;
+
+use rusqlite::Connection;
+use serde::{Deserialize, Serialize};
+
+use crate::coordinator::Coordinator;
+use crate::lifecycle::{self, AGENT_PREFIX, MANAGER_NAME};
+
+/// An agent-declared extra navigation link surfaced on the dashboard card.
+/// Written by the `hive-dashboard-links` NixOS oneshot into
+/// `{state_dir}/hyperhive-dashboard-links.json` and read by `build_all`.
+#[derive(Serialize, Deserialize, Clone, PartialEq, Eq, Debug, Default)]
+pub struct DashboardLink {
+    pub label: String,
+    #[serde(default)]
+    pub icon: String,
+    pub url: String,
+}
+
+#[derive(Serialize, Clone, PartialEq, Eq, Debug)]
+#[allow(clippy::struct_excessive_bools)]
+pub struct ContainerView {
+    /// Logical agent name (no `h-` prefix). Used in action URLs.
+    pub name: String,
+    /// Container name as nixos-container sees it (`h-foo`, `hm1nd`).
+    pub container: String,
+    pub is_manager: bool,
+    pub port: u16,
+    pub running: bool,
+    pub needs_update: bool,
+    pub needs_login: bool,
+    /// First 12 chars of the sha the meta flake currently has locked
+    /// for this agent's input.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub deployed_sha: Option<String>,
+    /// Count of this agent's pending reminders. Computed during
+    /// `build_all` via `Broker::count_pending_reminders_for`; the
+    /// dashboard renders a small chip when > 0. Updates with the
+    /// 10s `crash_watch` rescan + every container mutation site;
+    /// not real-time on remind/cancel-reminder but close enough.
+    #[serde(default)]
+    pub pending_reminders: u64,
+    /// Context-window size (prompt tokens) from the agent's most recent
+    /// completed turn, read directly from the turn-stats `SQLite`.
+    /// `None` when the file is absent or the agent has no turns yet.
+    /// Stale by up to one crash-watch cycle (~10s); good enough for
+    /// the "which agent is close to the window?" dashboard glance.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub ctx_tokens: Option<u64>,
+    /// Context-window size (tokens) for the model this agent ran on its
+    /// most recent turn — the model name from the last turn-stats row
+    /// resolved against the host's per-model `contextWindowTokens`
+    /// config. Lets the dashboard derive the ctx badge thresholds
+    /// (75% / 50% of the window, matching the harness compaction
+    /// watermarks) instead of hardcoding them. `None` when the agent
+    /// has no turns yet or no config key matches the model. (issue #66)
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub context_window_tokens: Option<u64>,
+    /// True while the harness is parked after an API rate-limit response.
+    /// Detected via the sentinel file `{state_dir}/hyperhive-rate-limited`
+    /// that the harness writes in `Bus::emit_status("rate_limited")` and
+    /// removes when it resumes. Stale by up to one crash-watch cycle.
+    #[serde(default)]
+    pub rate_limited: bool,
+    /// Extra navigation links declared by the agent via
+    /// `hyperhive.dashboardLinks` in `agent.nix`. Written to
+    /// `{state_dir}/hyperhive-dashboard-links.json` by the
+    /// `hive-dashboard-links` oneshot at container boot. Empty when
+    /// the file is absent or the agent declares no links.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub extra_links: Vec<DashboardLink>,
+    /// Free-text status set by the agent via `mcp__hyperhive__set_status`.
+    /// Persisted to `{state_dir}/hyperhive-status`. `None` when the file
+    /// is absent or empty — the agent hasn't set one yet.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub status_text: Option<String>,
+    /// Unix timestamp (seconds since epoch) when the status was last written.
+    /// Derived from the `hyperhive-status` file's mtime. `None` when no
+    /// status is set.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub status_set_at: Option<i64>,
+    /// Name of this agent's parent in the agent hierarchy (#361). `None`
+    /// marks the agent as root-level; the dashboard renders it without
+    /// indentation. Sourced from `meta/topology.json` (single source of
+    /// truth, hive-c0re-owned) — NOT from per-agent agent.nix, because
+    /// an agent shouldn't be able to unilaterally declare its own place
+    /// in the tree.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub parent: Option<String>,
+}
+
+/// Build the full container list. Wraps `lifecycle::list()` and
+/// resolves every per-agent attribute the dashboard surfaces.
+pub async fn build_all(coord: &Coordinator) -> Vec<ContainerView> {
+    let raw = lifecycle::list().await.unwrap_or_default();
+    let locked = read_meta_locked_revs();
+    // Pull the topology map once and look up each agent's parent below.
+    // Empty / absent topology.json → every agent root-level (matches
+    // the pre-#361 status quo for fresh installs).
+    let topology = crate::topology::read();
+    let mut out = Vec::new();
+    for c in &raw {
+        let (logical, is_manager) = if c == MANAGER_NAME {
+            (MANAGER_NAME.to_owned(), true)
+        } else if let Some(n) = c.strip_prefix(AGENT_PREFIX) {
+            (n.to_owned(), false)
+        } else {
+            continue;
+        };
+        let deployed_full = locked.get(&format!("agent-{logical}")).map(std::string::String::as_str);
+        let needs_update = crate::auto_update::agent_config_pending(&logical, deployed_full);
+        let deployed_sha = deployed_full.map(|s| s[..s.len().min(12)].to_owned());
+        // Recipient name the broker uses for this agent — sub-agents
+        // are addressed by logical name, the manager by the
+        // MANAGER_AGENT constant. Mirrors the rest of the broker
+        // surface so the count matches what `mcp__hyperhive__remind`
+        // queued.
+        let reminder_recipient = if is_manager {
+            hive_sh4re::MANAGER_AGENT
+        } else {
+            logical.as_str()
+        };
+        let pending_reminders = coord
+            .broker
+            .count_pending_reminders_for(reminder_recipient)
+            .unwrap_or(0);
+        let extra_links = read_dashboard_links(&logical);
+        let parent = topology.get(&logical).cloned().flatten();
+        let running = lifecycle::is_running(&logical).await;
+        // Live-only fields (#432) — only meaningful while the harness
+        // is up. When the container is stopped, sentinel files +
+        // turn-stats rows + the on-disk status blob are all stale
+        // snapshots from before the stop, so we clear them here
+        // rather than letting the dashboard / `get_agent_meta` surface
+        // misleading values. Static / declared fields (extra_links,
+        // deployed_sha, pending_reminders, needs_update, parent) stay
+        // populated regardless of run state.
+        let (needs_login, ctx_tokens, context_window_tokens, rate_limited, status_text, status_set_at) =
+            if running {
+                // needs_login fires when EITHER the claude session dir is
+                // missing (boot-time / fresh container) OR the harness wrote
+                // the auth-failed sentinel because a turn hit 401 (#419). The
+                // manager has its own session lifecycle and never participates
+                // in needs_login.
+                let needs_login = !is_manager
+                    && (!claude_has_session(&Coordinator::agent_claude_dir(&logical))
+                        || auth_failed_sentinel(&logical));
+                let last_turn = read_last_turn(&logical);
+                let ctx_tokens = last_turn.as_ref().map(|(toks, _)| *toks);
+                let context_window_tokens = last_turn
+                    .as_ref()
+                    .and_then(|(_, model)| resolve_ctx_window(model, &coord.context_window_tokens));
+                let rate_limited = is_rate_limited(&logical);
+                let (status_text, status_set_at) = read_status(&logical);
+                (needs_login, ctx_tokens, context_window_tokens, rate_limited, status_text, status_set_at)
+            } else {
+                (false, None, None, false, None, None)
+            };
+        out.push(ContainerView {
+            port: lifecycle::agent_web_port(&logical),
+            running,
+            container: c.clone(),
+            name: logical,
+            is_manager,
+            needs_update,
+            needs_login,
+            deployed_sha,
+            pending_reminders,
+            ctx_tokens,
+            context_window_tokens,
+            rate_limited,
+            extra_links,
+            status_text,
+            status_set_at,
+            parent,
+        });
+    }
+    out
+}
+
+/// Host-side mirror of `hive_ag3nt::login::has_session`. Returns true
+/// if the agent's bound `~/.claude/` dir on disk contains any regular
+/// file. Reads each `build_all()` so a login driven from the agent's
+/// own web UI reflects on the next snapshot.
+pub fn claude_has_session(dir: &Path) -> bool {
+    let Ok(entries) = std::fs::read_dir(dir) else {
+        return false;
+    };
+    entries
+        .flatten()
+        .any(|e| e.file_type().is_ok_and(|t| t.is_file()))
+}
+
+/// Read agent-declared extra dashboard links from
+/// `{state_dir}/hyperhive-dashboard-links.json`. Returns an empty vec when
+/// the file is absent, empty, or unparseable — best-effort, never panics.
+fn read_dashboard_links(name: &str) -> Vec<DashboardLink> {
+    let path = Coordinator::agent_notes_dir(name).join("hyperhive-dashboard-links.json");
+    let text = match std::fs::read_to_string(&path) {
+        Ok(t) if !t.trim().is_empty() => t,
+        _ => return Vec::new(),
+    };
+    serde_json::from_str::<Vec<DashboardLink>>(&text).unwrap_or_default()
+}
+
+/// Returns true if the agent's harness is currently parked after an API
+/// rate-limit response. Detected via the sentinel file written by
+/// `hive_ag3nt::events::Bus::emit_status("rate_limited")`.
+fn is_rate_limited(name: &str) -> bool {
+    Coordinator::agent_notes_dir(name)
+        .join("hyperhive-rate-limited")
+        .exists()
+}
+
+/// True when the harness wrote `{state_dir}/hyperhive-needs-login`
+/// after a 401 mid-turn. Lets the dashboard surface `needs_login` for
+/// agents whose `/root/.claude/` dir still exists (so
+/// `claude_has_session` returns true) but whose OAuth credentials
+/// inside it have actually expired (#419).
+fn auth_failed_sentinel(name: &str) -> bool {
+    Coordinator::agent_notes_dir(name)
+        .join("hyperhive-needs-login")
+        .exists()
+}
+
+/// Read the agent's free-text status and the Unix timestamp when it was last set
+/// (derived from the file's mtime). Returns `(None, None)` when the file is absent
+/// or empty. `pub` so `agent_server` and `manager_server` can populate `AgentMeta`.
+///
+/// NB: callers building `AgentMeta` for a *stopped* container should
+/// clear the result — the on-disk status is a stale snapshot from
+/// before the stop (#432). Use `read_agent_status_live` for that.
+pub fn read_agent_status(name: &str) -> (Option<String>, Option<i64>) {
+    let path = Coordinator::agent_notes_dir(name).join("hyperhive-status");
+    let meta = std::fs::metadata(&path).ok();
+    let s = std::fs::read_to_string(&path).ok();
+    let text = s.as_deref().map(str::trim).filter(|t| !t.is_empty()).map(str::to_owned);
+    let mtime = meta.and_then(|m| {
+        m.modified().ok().and_then(|t| {
+            t.duration_since(std::time::UNIX_EPOCH).ok()
+                .and_then(|d| i64::try_from(d.as_secs()).ok())
+        })
+    });
+    if text.is_none() { (None, None) } else { (text, mtime) }
+}
+
+fn read_status(name: &str) -> (Option<String>, Option<i64>) {
+    read_agent_status(name)
+}
+
+/// Wraps `read_agent_status` with the same "stopped containers have
+/// stale state" gate `build_all` uses (#432). Returns
+/// `(None, None, false)` when the container isn't running so callers
+/// don't have to know about the sentinel rules — they just hand back
+/// what we give them.
+///
+/// Returned tuple is `(status_text, status_set_at, running)`. The
+/// `name` argument is the broker-side recipient — `MANAGER_AGENT` for
+/// the manager, the logical agent name otherwise — so callers can
+/// reuse the same string they used to look the agent up.
+pub async fn read_agent_status_live(name: &str) -> (Option<String>, Option<i64>, bool) {
+    // The lifecycle helper wants the on-disk name (`hm1nd` for the
+    // manager, the bare logical name for sub-agents) and internally
+    // adds the `h-` prefix. Map the broker-side `MANAGER_AGENT`
+    // sentinel back to the lifecycle name here so callers don't have
+    // to bother.
+    let lifecycle_name = if name == hive_sh4re::MANAGER_AGENT {
+        lifecycle::MANAGER_NAME
+    } else {
+        name
+    };
+    if !lifecycle::is_running(lifecycle_name).await {
+        return (None, None, false);
+    }
+    let (text, set_at) = read_agent_status(name);
+    (text, set_at, true)
+}
+
+/// Read the agent's most recent completed turn from its turn-stats
+/// `SQLite`: the context-window size (prompt tokens) and the model name.
+/// Returns `None` when the file is absent or has no rows. Best-effort
+/// — any database error silently yields `None` so a missing or
+/// corrupt file never blocks `build_all`.
+///
+/// Context tokens sum the prompt-side fields (`last_input_tokens`,
+/// `last_cache_read_input_tokens`, `last_cache_creation_input_tokens`),
+/// mirroring `hive_ag3nt::events::TokenUsage::context_tokens`.
+fn read_last_turn(name: &str) -> Option<(u64, String)> {
+    let path = Coordinator::agent_notes_dir(name).join("hyperhive-turn-stats.sqlite");
+    let conn = Connection::open_with_flags(
+        &path,
+        rusqlite::OpenFlags::SQLITE_OPEN_READ_ONLY,
+    )
+    .ok()?;
+    conn.query_row(
+        "SELECT last_input_tokens + last_cache_read_input_tokens + last_cache_creation_input_tokens, model \
+         FROM turn_stats ORDER BY started_at DESC LIMIT 1",
+        [],
+        |row| Ok((row.get::<_, i64>(0)?, row.get::<_, String>(1)?)),
+    )
+    .ok()
+    .and_then(|(toks, model)| Some((u64::try_from(toks).ok()?, model)))
+}
+
+/// Resolve a model name to its context-window size using the host's
+/// per-model `contextWindowTokens` config. Mirrors the harness's
+/// `events::context_window_tokens` substring match: the first config
+/// key (lowercased, non-empty) that is a substring of the lowercased
+/// model name wins. `None` when nothing matches.
+fn resolve_ctx_window(model: &str, per_model: &HashMap<String, u64>) -> Option<u64> {
+    let m = model.to_ascii_lowercase();
+    per_model
+        .iter()
+        .find(|(key, _)| {
+            let k = key.to_ascii_lowercase();
+            !k.is_empty() && m.contains(&k)
+        })
+        .map(|(_, &tokens)| tokens)
+}
+
+/// Map of `agent-<n>` → locked sha from meta's flake.lock. Used to
+/// render the `deployed:<sha12>` chip per container row.
+fn read_meta_locked_revs() -> HashMap<String, String> {
+    let mut out = HashMap::new();
+    let Ok(raw) = std::fs::read_to_string("/var/lib/hyperhive/meta/flake.lock") else {
+        return out;
+    };
+    let Ok(json) = serde_json::from_str::<serde_json::Value>(&raw) else {
+        return out;
+    };
+    let Some(nodes) = json.get("nodes").and_then(|v| v.as_object()) else {
+        return out;
+    };
+    let Some(root_name) = json.get("root").and_then(|v| v.as_str()) else {
+        return out;
+    };
+    let Some(root_inputs) = nodes
+        .get(root_name)
+        .and_then(|n| n.get("inputs"))
+        .and_then(|v| v.as_object())
+    else {
+        return out;
+    };
+    for alias in root_inputs.keys() {
+        let target_name = match root_inputs.get(alias) {
+            Some(serde_json::Value::String(s)) => s.clone(),
+            _ => continue,
+        };
+        if let Some(rev) = nodes
+            .get(&target_name)
+            .and_then(|n| n.get("locked"))
+            .and_then(|v| v.get("rev"))
+            .and_then(|v| v.as_str())
+        {
+            out.insert(alias.clone(), rev.to_owned());
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::resolve_ctx_window;
+    use std::collections::HashMap;
+
+    fn cfg() -> HashMap<String, u64> {
+        [
+            ("haiku".to_owned(), 200_000),
+            ("sonnet".to_owned(), 1_000_000),
+            ("opus".to_owned(), 1_000_000),
+        ]
+        .into_iter()
+        .collect()
+    }
+
+    #[test]
+    fn resolves_family_substring() {
+        assert_eq!(resolve_ctx_window("claude-3-5-haiku-20241022", &cfg()), Some(200_000));
+        assert_eq!(resolve_ctx_window("claude-sonnet-4-5", &cfg()), Some(1_000_000));
+        assert_eq!(resolve_ctx_window("claude-opus-4-1", &cfg()), Some(1_000_000));
+    }
+
+    #[test]
+    fn resolution_is_case_insensitive() {
+        assert_eq!(resolve_ctx_window("Claude-Sonnet-4", &cfg()), Some(1_000_000));
+    }
+
+    #[test]
+    fn unknown_model_yields_none() {
+        assert_eq!(resolve_ctx_window("some-other-llm", &cfg()), None);
+    }
+
+    #[test]
+    fn empty_config_yields_none() {
+        assert_eq!(resolve_ctx_window("claude-3-5-haiku", &HashMap::new()), None);
+    }
+
+    #[test]
+    fn empty_key_is_skipped() {
+        let mut m = HashMap::new();
+        m.insert(String::new(), 999);
+        assert_eq!(resolve_ctx_window("claude-3-5-haiku", &m), None);
+    }
+}
diff --git a/hive-c0re/src/coordinator.rs b/hive-c0re/src/coordinator.rs
new file mode 100644
index 00000000..13340fca
--- /dev/null
+++ b/hive-c0re/src/coordinator.rs
@@ -0,0 +1,803 @@
+//! Runtime state + config shared between the host admin socket, the manager
+//! socket, and the per-agent sockets: the broker, configured `agent_flake`,
+//! and the map of registered agent sockets.
+
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::{Arc, Mutex};
+
+use anyhow::{Context, Result};
+use tokio::sync::{broadcast, watch};
+
+use crate::agent_server::{self, AgentSocket};
+use crate::approvals::Approvals;
+use crate::broker::Broker;
+use crate::container_view::{self, ContainerView};
+use crate::dashboard_events::DashboardEvent;
+use crate::operator_questions::OperatorQuestions;
+
+/// Capacity of the dashboard event channel. Slow browser subscribers
+/// (idle tab, throttled connection) drop frames past this — that's
+/// fine, the seq dedupe makes a reconnect resync safe.
+const DASHBOARD_CHANNEL: usize = 256;
+
+const AGENT_RUNTIME_ROOT: &str = "/run/hyperhive/agents";
+const MANAGER_RUNTIME_ROOT: &str = "/run/hyperhive/manager";
+/// Manager-editable per-agent config repos. Bind-mounted RW into the manager
+/// container as `/agents/<name>/`. Hive-c0re only writes to these on first
+/// spawn (initial commit); after that it's manager-only.
+const AGENT_STATE_ROOT: &str = "/var/lib/hyperhive/agents";
+/// Hive-c0re-only authoritative per-agent config repos. Containers build from
+/// these. Manager has no filesystem access; the only way to update is via
+/// `request_apply_commit` + user approval.
+const APPLIED_STATE_ROOT: &str = "/var/lib/hyperhive/applied";
+
+pub struct Coordinator {
+    pub broker: Arc<Broker>,
+    pub approvals: Arc<Approvals>,
+    pub questions: Arc<OperatorQuestions>,
+    /// Scheduled-prompts queue (#444). One sqlite connection,
+    /// internal mutex; the worker drains due rows and the manager
+    /// handlers insert / cancel through the same handle.
+    pub scheduled_prompts: Arc<crate::scheduled_prompts::ScheduledPrompts>,
+    /// URL of the hyperhive flake (no fragment). Inlined into per-agent
+    /// `flake.nix` files as `inputs.hyperhive.url`.
+    pub hyperhive_flake: String,
+    /// TCP port the host's hive-c0re dashboard listens on. Inlined into
+    /// each per-agent flake so the agent's web UI can build the right
+    /// rebuild-button URL pointing back at the dashboard.
+    pub dashboard_port: u16,
+    /// Operator pronouns (free text) — `she/her` by default, set via
+    /// the NixOS module option `services.hive-c0re.operatorPronouns`.
+    /// Reaches each container as the `HIVE_OPERATOR_PRONOUNS` env var
+    /// (injected into systemd.services.<harness>.environment by the
+    /// meta flake); the harness substitutes it into the agent /
+    /// manager system prompt at boot.
+    pub operator_pronouns: String,
+    /// Per-model context-window sizes in tokens. Set via the host-level
+    /// `services.hive-c0re.contextWindowTokens` NixOS option; injected
+    /// into each container as `HIVE_CONTEXT_WINDOW_TOKENS_<KEY_UPPER>`
+    /// by the meta flake renderer. The harness uses these to derive
+    /// compaction / auto-reset watermarks and exposes the active value
+    /// on `/api/state` as `context_window_tokens`.
+    pub context_window_tokens: std::collections::HashMap<String, u64>,
+    agents: Mutex<HashMap<String, AgentSocket>>,
+    /// Agents whose lifecycle action (currently just spawn) is in flight.
+    /// Read by the dashboard to render a spinner; cleared when the action
+    /// resolves (success or failure).
+    transient: Mutex<HashMap<String, TransientState>>,
+    /// Tombstone for transients that have JUST been cleared. The
+    /// crash watcher polls every 10s and would race the
+    /// drop-clears-immediately path of `TransientGuard`: an operator
+    /// kill / restart sets `Stopping` → runs `nixos-container stop` →
+    /// drop clears the transient → poll fires next tick and sees the
+    /// container missing-from-running with no active transient →
+    /// spurious "container stopped without an operator action"
+    /// message (closes #425).
+    ///
+    /// `clear_transient` stamps the cleared kind here with an
+    /// `Instant`; `recent_transient_within(grace)` returns the set of
+    /// agents whose tombstone is still inside the grace window. Crash
+    /// watcher consults both this and the active map before declaring
+    /// a stop deliberate.
+    recent_transient: Mutex<HashMap<String, (TransientKind, std::time::Instant)>>,
+    /// Unified wire-facing event channel feeding the dashboard SSE
+    /// stream. Carries broker messages (mirrored from `broker.subscribe`
+    /// by the forwarder task in `main.rs`) and dashboard-only mutation
+    /// events (approval added/resolved, question added/answered, etc.).
+    /// Snapshot endpoints capture `event_seq` before reading state so
+    /// the client can dedupe its buffered live traffic against the
+    /// snapshot.
+    dashboard_events: broadcast::Sender<DashboardEvent>,
+    event_seq: AtomicU64,
+    /// Count of dashboard-triggered `meta-update` runs currently in
+    /// flight. `post_meta_update` returns 200 immediately and does the
+    /// multi-minute `nix flake update` + agent-rebuild ripple in a
+    /// background task, so without this the META INPUTS panel showed no
+    /// sign anything was happening (issue #259). Held via
+    /// `MetaUpdateGuard`; a count > 0 surfaces on `/api/state` as
+    /// `meta_update_running` and via the `MetaUpdateRunning` event.
+    meta_updates_active: AtomicU64,
+    /// Last container snapshot seen by `rescan_containers_and_emit`,
+    /// keyed by `ContainerView.name`. The rescan diffs a fresh
+    /// `container_view::build_all` against this map and emits one
+    /// `ContainerStateChanged` per added/changed row and one
+    /// `ContainerRemoved` per disappeared row. Async — guarded by a
+    /// tokio mutex so the rescan can `await` `lifecycle::list` /
+    /// `is_running` without blocking other coordinator paths.
+    last_containers: tokio::sync::Mutex<HashMap<String, ContainerView>>,
+    /// Global rebuild queue. Every long-running container/meta op
+    /// (rebuild, meta-update, first-spawn) goes through this queue so
+    /// hive-c0re runs at most one at a time and the dashboard can
+    /// render a single ordered view of pending + running work. See
+    /// `rebuild_queue.rs` for the dedup rules + history retention.
+    pub rebuild_queue: Arc<crate::rebuild_queue::RebuildQueue>,
+    /// Shutdown signal broadcast to all background tasks. Sending
+    /// `true` asks every loop to exit after its current work item.
+    /// Use `shutdown_rx()` to subscribe; `request_shutdown()` to fire.
+    shutdown_tx: watch::Sender<bool>,
+}
+
+/// Per-agent in-progress state that the dashboard surfaces between approve
+/// click and container ready.
+#[derive(Debug, Clone)]
+pub struct TransientState {
+    pub kind: TransientKind,
+    pub since: std::time::Instant,
+}
+
+/// RAII handle returned by `Coordinator::transient_guard`. Cleared on
+/// drop — including drop-via-cancellation, the path that bare
+/// `set_transient` / `clear_transient` pairs leaked through. Holds an
+/// `Arc<Coordinator>` so the guard is freely returnable / movable.
+pub struct TransientGuard {
+    coord: Arc<Coordinator>,
+    name: String,
+}
+
+impl Drop for TransientGuard {
+    fn drop(&mut self) {
+        self.coord.clear_transient(&self.name);
+    }
+}
+
+/// RAII guard for the `meta-update` in-progress flag, held for the
+/// duration of a `run_meta_update` background task. Created by
+/// `Coordinator::meta_update_guard`. Drop decrements the active-run
+/// count; the count crossing back to 0 emits
+/// `MetaUpdateRunning { running: false }`, so a concurrent pair of
+/// updates only flips the dashboard flag once.
+pub struct MetaUpdateGuard {
+    coord: Arc<Coordinator>,
+}
+
+impl Drop for MetaUpdateGuard {
+    fn drop(&mut self) {
+        if self
+            .coord
+            .meta_updates_active
+            .fetch_sub(1, Ordering::SeqCst)
+            == 1
+        {
+            self.coord
+                .emit_dashboard_event(DashboardEvent::MetaUpdateRunning {
+                    seq: self.coord.next_seq(),
+                    running: false,
+                });
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy)]
+pub enum TransientKind {
+    /// `lifecycle::spawn` is running (nixos-container create + update + start).
+    Spawning,
+    /// `lifecycle::start` is running.
+    Starting,
+    /// `lifecycle::kill` is running.
+    Stopping,
+    /// `lifecycle::restart` is running.
+    Restarting,
+    /// `lifecycle::rebuild` is running (nixos-container update).
+    Rebuilding,
+    /// `actions::destroy` is running.
+    Destroying,
+}
+
+impl TransientKind {
+    /// Wire/UI label. Matches the strings the dashboard already
+    /// renders in the transient spinner.
+    pub fn as_str(self) -> &'static str {
+        match self {
+            TransientKind::Spawning => "spawning",
+            TransientKind::Starting => "starting",
+            TransientKind::Stopping => "stopping",
+            TransientKind::Restarting => "restarting",
+            TransientKind::Rebuilding => "rebuilding",
+            TransientKind::Destroying => "destroying",
+        }
+    }
+}
+
+impl Coordinator {
+    pub fn open(
+        db_path: &Path,
+        hyperhive_flake: String,
+        dashboard_port: u16,
+        operator_pronouns: String,
+        context_window_tokens: std::collections::HashMap<String, u64>,
+    ) -> Result<Self> {
+        let broker = Broker::open(db_path).context("open broker")?;
+        let approvals = Approvals::open(db_path).context("open approvals")?;
+        let questions = OperatorQuestions::open(db_path).context("open operator_questions")?;
+        let scheduled_prompts = crate::scheduled_prompts::ScheduledPrompts::open(db_path)
+            .context("open scheduled_prompts")?;
+        let (dashboard_events, _) = broadcast::channel(DASHBOARD_CHANNEL);
+        let (shutdown_tx, _) = watch::channel(false);
+        Ok(Self {
+            broker: Arc::new(broker),
+            approvals: Arc::new(approvals),
+            questions: Arc::new(questions),
+            scheduled_prompts: Arc::new(scheduled_prompts),
+            hyperhive_flake,
+            dashboard_port,
+            operator_pronouns,
+            context_window_tokens,
+            agents: Mutex::new(HashMap::new()),
+            transient: Mutex::new(HashMap::new()),
+            recent_transient: Mutex::new(HashMap::new()),
+            dashboard_events,
+            event_seq: AtomicU64::new(0),
+            meta_updates_active: AtomicU64::new(0),
+            last_containers: tokio::sync::Mutex::new(HashMap::new()),
+            rebuild_queue: Arc::new(crate::rebuild_queue::RebuildQueue::new()),
+            shutdown_tx,
+        })
+    }
+
+    /// Emit a `RebuildQueueChanged` snapshot event. Called from the
+    /// queue mutation helpers (`enqueue` / `finish` / `cancel`-adjacent
+    /// wrappers below) and the worker so every state transition
+    /// surfaces on the dashboard without extra plumbing.
+    pub fn emit_rebuild_queue_snapshot(self: &Arc<Self>) {
+        let queue = self.rebuild_queue.snapshot();
+        self.emit_dashboard_event(DashboardEvent::RebuildQueueChanged {
+            seq: self.next_seq(),
+            queue,
+        });
+    }
+
+    /// Update the `step` label on a running queue entry and (if it
+    /// actually changed) re-emit the queue snapshot so the dashboard
+    /// renders the new phase. Returns `true` when the label was new
+    /// and an emit fired, mostly for tracing/logging callers; safe to
+    /// ignore. No-op when `id` is `None` (e.g. callers that aren't
+    /// running from the queue worker) or when the row isn't `Running`.
+    pub fn set_queue_step(self: &Arc<Self>, id: Option<u64>, step: &str) {
+        let Some(id) = id else { return };
+        if self.rebuild_queue.set_step(id, step) {
+            self.emit_rebuild_queue_snapshot();
+        }
+    }
+
+    /// Subscribe to the shutdown watch channel. Background tasks call
+    /// this at spawn time and break their loop when the receiver
+    /// transitions to `true` (via `Coordinator::request_shutdown`).
+    /// A closed channel (i.e. the Coordinator was dropped) also
+    /// signals tasks to exit.
+    pub fn shutdown_rx(&self) -> watch::Receiver<bool> {
+        self.shutdown_tx.subscribe()
+    }
+
+    /// Signal all background tasks to exit cleanly. The tasks break
+    /// out of their poll loop after completing their current work item.
+    /// Best-effort — does nothing if all receivers have already been
+    /// dropped (e.g. process is already mid-shutdown).
+    pub fn request_shutdown(&self) {
+        let _ = self.shutdown_tx.send(true);
+    }
+
+    /// Subscribe to the unified dashboard event channel. Used by the
+    /// `/dashboard/stream` SSE handler and by the broker-to-dashboard
+    /// forwarder task.
+    pub fn dashboard_subscribe(&self) -> broadcast::Receiver<DashboardEvent> {
+        self.dashboard_events.subscribe()
+    }
+
+    /// Stamp the next sequence number. Each emission of a
+    /// `DashboardEvent` should fill its `seq` with `next_seq()` so the
+    /// frame the wire carries is the one the client uses to dedupe.
+    pub fn next_seq(&self) -> u64 {
+        self.event_seq.fetch_add(1, Ordering::SeqCst) + 1
+    }
+
+    /// Current high-water seq. Snapshot endpoints read this *before*
+    /// gathering state so the (snapshot.seq, snapshot) pair satisfies:
+    /// any frame with `seq > snapshot.seq` is post-snapshot. The seq
+    /// captured here may grow during snapshot construction — clients
+    /// may double-apply such events, which renderers must tolerate.
+    pub fn current_seq(&self) -> u64 {
+        self.event_seq.load(Ordering::SeqCst)
+    }
+
+    /// Broadcast a freshly-built `DashboardEvent` (caller fills `seq`
+    /// via `next_seq()`). Returns silently when there are no
+    /// subscribers — the dashboard channel is best-effort presentation
+    /// plumbing, not a delivery guarantee.
+    pub fn emit_dashboard_event(&self, event: DashboardEvent) {
+        let _ = self.dashboard_events.send(event);
+    }
+
+    /// Mark a `meta-update` as in flight and return an RAII guard that
+    /// clears it on drop (including drop-via-panic). The first
+    /// concurrent run emits `MetaUpdateRunning { running: true }`; the
+    /// last one to finish emits `running: false`. The dashboard's META
+    /// INPUTS panel reads the flag to show a disabled "updating…"
+    /// state while the lock bump + rebuild ripple runs (issue #259).
+    pub fn meta_update_guard(self: &Arc<Self>) -> MetaUpdateGuard {
+        if self.meta_updates_active.fetch_add(1, Ordering::SeqCst) == 0 {
+            self.emit_dashboard_event(DashboardEvent::MetaUpdateRunning {
+                seq: self.next_seq(),
+                running: true,
+            });
+        }
+        MetaUpdateGuard {
+            coord: Arc::clone(self),
+        }
+    }
+
+    /// True while at least one dashboard-triggered `meta-update` is
+    /// running. Surfaced on `/api/state` as `meta_update_running` so a
+    /// client that cold-loads mid-update sees the in-progress state.
+    pub fn meta_update_in_progress(&self) -> bool {
+        self.meta_updates_active.load(Ordering::SeqCst) > 0
+    }
+
+    /// Emit `ApprovalAdded` immediately after the row is inserted in
+    /// sqlite. Caller passes the diff text it already computed (or
+    /// `None` for spawn approvals which carry no diff).
+    pub fn emit_approval_added(
+        &self,
+        id: i64,
+        agent: &str,
+        approval_kind: &'static str,
+        sha_short: Option<String>,
+        diff: Option<String>,
+        description: Option<String>,
+    ) {
+        self.emit_dashboard_event(DashboardEvent::ApprovalAdded {
+            seq: self.next_seq(),
+            id,
+            agent: agent.to_owned(),
+            approval_kind,
+            sha_short,
+            diff,
+            description,
+        });
+    }
+
+    /// Emit `ApprovalResolved` after `mark_approved` / `mark_denied` /
+    /// `mark_failed` lands. `resolved_at` is stamped from the system
+    /// clock here so call sites don't repeat the conversion; if you
+    /// already have an authoritative timestamp from the db update,
+    /// the tiny skew between "row updated" and "event emitted" is
+    /// presentation-only and doesn't matter to clients.
+    #[allow(clippy::too_many_arguments)]
+    pub fn emit_approval_resolved(
+        &self,
+        id: i64,
+        agent: &str,
+        approval_kind: &'static str,
+        sha_short: Option<String>,
+        status: &'static str,
+        note: Option<String>,
+        description: Option<String>,
+    ) {
+        let resolved_at = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .ok()
+            .and_then(|d| i64::try_from(d.as_secs()).ok())
+            .unwrap_or(0);
+        self.emit_dashboard_event(DashboardEvent::ApprovalResolved {
+            seq: self.next_seq(),
+            id,
+            agent: agent.to_owned(),
+            approval_kind,
+            sha_short,
+            status,
+            resolved_at,
+            note,
+            description,
+        });
+    }
+
+    /// Emit `QuestionAdded` after a question is inserted. Fires for
+    /// both operator-targeted (`target = None`) and peer-to-peer
+    /// (`target = Some(agent)`) threads — the dashboard surfaces
+    /// both, distinguishing visually + offering operator override.
+    #[allow(clippy::too_many_arguments)]
+    pub fn emit_question_added(
+        &self,
+        id: i64,
+        asker: &str,
+        question: &str,
+        options: &[String],
+        multi: bool,
+        deadline_at: Option<i64>,
+        target: Option<&str>,
+    ) {
+        let asked_at = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .ok()
+            .and_then(|d| i64::try_from(d.as_secs()).ok())
+            .unwrap_or(0);
+        let question_refs = crate::dashboard::scan_validated_paths(question);
+        self.emit_dashboard_event(DashboardEvent::QuestionAdded {
+            seq: self.next_seq(),
+            id,
+            asker: asker.to_owned(),
+            question: question.to_owned(),
+            options: options.to_vec(),
+            multi,
+            asked_at,
+            deadline_at,
+            target: target.map(str::to_owned),
+            question_refs,
+        });
+    }
+
+    /// Emit `QuestionResolved` when a question transitions to
+    /// answered (operator answer, peer answer, operator override on
+    /// a peer thread, operator cancel, or ttl watchdog). Both
+    /// operator-targeted and peer threads fire so the dashboard's
+    /// derived store can move the row from pending to history.
+    pub fn emit_question_resolved(
+        &self,
+        id: i64,
+        answer: &str,
+        answerer: &str,
+        cancelled: bool,
+        target: Option<&str>,
+    ) {
+        let answered_at = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .ok()
+            .and_then(|d| i64::try_from(d.as_secs()).ok())
+            .unwrap_or(0);
+        let answer_refs = crate::dashboard::scan_validated_paths(answer);
+        self.emit_dashboard_event(DashboardEvent::QuestionResolved {
+            seq: self.next_seq(),
+            id,
+            answer: answer.to_owned(),
+            answerer: answerer.to_owned(),
+            answered_at,
+            cancelled,
+            target: target.map(str::to_owned),
+            answer_refs,
+        });
+    }
+
+    /// Rebuild the per-container snapshot, diff it against the last
+    /// one cached on `self`, and emit one
+    /// `DashboardEvent::ContainerStateChanged` per added/changed row
+    /// and one `DashboardEvent::ContainerRemoved` per disappeared row.
+    /// Call after any mutation that could affect what
+    /// `nixos-container list` returns or what a row's
+    /// `running` / `needs_update` / `needs_login` / `deployed_sha`
+    /// resolves to — lifecycle ops, destroy, approve (post-spawn),
+    /// rebuild, meta-update, and the crash-watcher's periodic poll.
+    /// Cheap when nothing changed (one `nixos-container list` + a
+    /// `HashMap` diff + zero emits).
+    pub async fn rescan_containers_and_emit(self: &Arc<Self>) {
+        let fresh = container_view::build_all(self).await;
+        let mut last = self.last_containers.lock().await;
+        let mut changed_or_new = Vec::new();
+        let mut removed = Vec::new();
+        // Diff into change vs. add.
+        for view in &fresh {
+            match last.get(&view.name) {
+                Some(prev) if prev == view => {} // unchanged
+                _ => changed_or_new.push(view.clone()),
+            }
+        }
+        // Anything in `last` but not in `fresh` is gone.
+        let fresh_names: std::collections::HashSet<&str> =
+            fresh.iter().map(|c| c.name.as_str()).collect();
+        for name in last.keys() {
+            if !fresh_names.contains(name.as_str()) {
+                removed.push(name.clone());
+            }
+        }
+        // Rebuild the cache from the fresh snapshot.
+        last.clear();
+        for c in fresh {
+            last.insert(c.name.clone(), c);
+        }
+        drop(last);
+        for c in changed_or_new {
+            self.emit_dashboard_event(DashboardEvent::ContainerStateChanged {
+                seq: self.next_seq(),
+                container: c,
+            });
+        }
+        for name in removed {
+            self.emit_dashboard_event(DashboardEvent::ContainerRemoved {
+                seq: self.next_seq(),
+                name,
+            });
+        }
+    }
+
+    /// Read-only snapshot of the last cached container view. Used by
+    /// `/api/state` to cold-load page-open clients without re-running
+    /// `nixos-container list` themselves; the
+    /// `rescan_containers_and_emit` calls keep this fresh.
+    pub async fn containers_snapshot(&self) -> Vec<ContainerView> {
+        let last = self.last_containers.lock().await;
+        let mut out: Vec<ContainerView> = last.values().cloned().collect();
+        out.sort_by(|a, b| a.name.cmp(&b.name));
+        out
+    }
+
+    pub fn register_agent(self: &Arc<Self>, name: &str) -> Result<PathBuf> {
+        // Idempotent: drop any existing listener so re-registration (e.g. on rebuild,
+        // or after a hive-c0re restart cleared /run/hyperhive) gets a fresh socket.
+        self.unregister_agent(name);
+        let agent_dir = Self::agent_dir(name);
+        std::fs::create_dir_all(&agent_dir)
+            .with_context(|| format!("create agent dir {}", agent_dir.display()))?;
+        let socket_path = Self::socket_path(name);
+        // Hand the full Coordinator to the per-agent socket — it
+        // needs broker + operator_questions to handle the agent-side
+        // `ask` / `answer` tools, not just the broker.
+        let socket = agent_server::start(name, &socket_path, self.clone())?;
+        self.agents.lock().unwrap().insert(name.to_owned(), socket);
+        Ok(agent_dir)
+    }
+
+    pub fn unregister_agent(&self, name: &str) {
+        if let Some(socket) = self.agents.lock().unwrap().remove(name) {
+            socket.handle.abort();
+            let _ = std::fs::remove_file(&socket.path);
+        }
+    }
+    pub fn list_agents(&self) -> Vec<String> {
+        self.agents.lock().unwrap().keys().cloned().collect()
+    }
+
+    /// Mark an agent as in-progress (only one state per agent for now).
+    ///
+    /// Prefer `transient_guard` when possible — it auto-clears on drop
+    /// even if the surrounding future is cancelled (HTTP request
+    /// aborted, runtime shutdown mid-rebuild, panic between set and
+    /// clear). The bare `set_transient` / `clear_transient` pair leaks
+    /// the transient on any of those paths and the dashboard then
+    /// shows the agent stuck in "rebuilding…" forever.
+    pub fn set_transient(&self, name: &str, kind: TransientKind) {
+        self.transient.lock().unwrap().insert(
+            name.to_owned(),
+            TransientState {
+                kind,
+                since: std::time::Instant::now(),
+            },
+        );
+        // Live-update dashboards. `since_unix` is wall-clock so the
+        // browser can tick "Ns spawning…" without polling. The
+        // intra-process map keeps using `Instant` for monotonicity.
+        let since_unix = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .ok()
+            .and_then(|d| i64::try_from(d.as_secs()).ok())
+            .unwrap_or(0);
+        self.emit_dashboard_event(DashboardEvent::TransientSet {
+            seq: self.next_seq(),
+            name: name.to_owned(),
+            transient_kind: kind.as_str(),
+            since_unix,
+        });
+    }
+
+    pub fn clear_transient(&self, name: &str) {
+        let removed = self.transient.lock().unwrap().remove(name);
+        if let Some(state) = removed {
+            // Stamp the tombstone so the crash watcher can still see
+            // "operator kicked this off recently" on its next 10s poll
+            // — without this, the clear-then-poll race produced a
+            // spurious ContainerCrash on every operator stop/restart
+            // (#425). Old entries get reaped lazily on read so the map
+            // doesn't grow unbounded.
+            self.recent_transient
+                .lock()
+                .unwrap()
+                .insert(name.to_owned(), (state.kind, std::time::Instant::now()));
+            self.emit_dashboard_event(DashboardEvent::TransientCleared {
+                seq: self.next_seq(),
+                name: name.to_owned(),
+            });
+        }
+    }
+
+    /// Set of agents whose transient was cleared within the last
+    /// `grace` seconds — i.e. agents the operator just acted on,
+    /// whose stop the crash watcher should NOT classify as a crash.
+    /// Lazily reaps entries older than `grace` so the map stays
+    /// bounded by the active agent count.
+    pub fn recent_transient_within(&self, grace: std::time::Duration) -> HashMap<String, TransientKind> {
+        let now = std::time::Instant::now();
+        let mut map = self.recent_transient.lock().unwrap();
+        map.retain(|_, (_, ts)| now.duration_since(*ts) <= grace);
+        map.iter().map(|(k, (kind, _))| (k.clone(), *kind)).collect()
+    }
+
+    /// Set a transient state and return a guard that clears it on drop.
+    /// Use this from any path where the surrounding future could be
+    /// cancelled or panic between set and clear (HTTP handlers, spawned
+    /// tasks). The guard's `Drop` runs even on task cancellation, so
+    /// the dashboard's spinner can't get pinned forever.
+    pub fn transient_guard(self: &Arc<Self>, name: &str, kind: TransientKind) -> TransientGuard {
+        self.set_transient(name, kind);
+        TransientGuard {
+            coord: self.clone(),
+            name: name.to_owned(),
+        }
+    }
+
+    pub fn transient_snapshot(&self) -> HashMap<String, TransientState> {
+        self.transient.lock().unwrap().clone()
+    }
+
+    /// Drop a system message into the given agent's inbox. Wakes the
+    /// turn loop with a "you were just (re)started" hint — operator
+    /// caused the transition, agent picks up where it left off
+    /// (notes are in the bind-mounted state dir, last turn is in
+    /// --continue's session). Best-effort; broker errors are logged
+    /// but don't propagate.
+    pub fn kick_agent(&self, name: &str, reason: &str) {
+        // Sub-agents bind their state at /agents/<name>/state. The
+        // manager has both /state (legacy mount) and /agents
+        // bind-mounted, so /agents/<name>/state resolves there too —
+        // use that uniformly so the wake message has one canonical
+        // path that works everywhere.
+        let body = format!(
+            "{reason}\n\nYou were just (re)started by the operator. \
+             If you were mid-task, check `/agents/{name}/state/` for \
+             your notes and pick up where you left off. claude's \
+             `--continue` session is intact, so prior context is \
+             still in your window."
+        );
+        if let Err(e) = self.broker.send(&hive_sh4re::Message {
+            from: hive_sh4re::SYSTEM_SENDER.to_owned(),
+            to: name.to_owned(),
+            body,
+            in_reply_to: None,
+        }) {
+            tracing::warn!(error = ?e, %name, "kick_agent: broker.send failed");
+        }
+    }
+
+    /// Push a `HelperEvent` into the manager's inbox. Encoded as JSON in
+    /// `Message::body`; sender = `SYSTEM_SENDER`. The manager harness
+    /// recognises the sender and parses the body. Best-effort: a serde or
+    /// broker error is logged but does not propagate.
+    pub fn notify_manager(&self, event: &hive_sh4re::HelperEvent) {
+        self.notify_agent(hive_sh4re::MANAGER_AGENT, event);
+    }
+
+    /// Push a `HelperEvent` into an arbitrary agent's inbox. Encoded
+    /// the same way as `notify_manager` (sender = `SYSTEM_SENDER`,
+    /// body = JSON-encoded event). Used to route `QuestionAnswered`
+    /// events back to the agent that called `ask`, `QuestionAsked`
+    /// events to the target of a peer question, etc.
+    pub fn notify_agent(&self, agent: &str, event: &hive_sh4re::HelperEvent) {
+        self.notify_agent_from(hive_sh4re::SYSTEM_SENDER, agent, event);
+    }
+
+    /// Same as `notify_agent` but with an explicit sender. Use this
+    /// when the event originates from a known agent or the operator
+    /// (e.g. `QuestionAnswered` — the answerer should be the `from`,
+    /// not `system`) so the recipient's terminal shows the right name.
+    pub fn notify_agent_from(&self, from: &str, agent: &str, event: &hive_sh4re::HelperEvent) {
+        let body = match serde_json::to_string(event) {
+            Ok(s) => s,
+            Err(e) => {
+                tracing::warn!(error = ?e, "failed to encode helper event");
+                return;
+            }
+        };
+        if let Err(e) = self.broker.send(&hive_sh4re::Message {
+            from: from.to_owned(),
+            to: agent.to_owned(),
+            body,
+            in_reply_to: None,
+        }) {
+            tracing::warn!(error = ?e, target = %agent, "failed to push helper event");
+        }
+    }
+
+    /// Deliver `body` to every currently-registered agent except the sender,
+    /// appending the standard broadcast hint. Returns a list of per-agent
+    /// error strings for any that failed (empty = all ok).
+    pub fn broadcast_send(&self, from: &str, body: &str) -> Vec<String> {
+        const HINT: &str =
+            "\n\n⚠️ _hint: this was a broadcast and may not need any action from you_";
+        let broadcast_body = format!("{body}{HINT}");
+        let mut errors = Vec::new();
+        for agent_name in self.list_agents() {
+            if agent_name == from {
+                continue;
+            }
+            if let Err(e) = self.broker.send(&hive_sh4re::Message {
+                from: from.to_owned(),
+                to: agent_name.clone(),
+                body: broadcast_body.clone(),
+                in_reply_to: None,
+            }) {
+                errors.push(format!("{agent_name}: {e}"));
+            }
+        }
+        errors
+    }
+
+    pub fn agent_dir(name: &str) -> PathBuf {
+        PathBuf::from(format!("{AGENT_RUNTIME_ROOT}/{name}"))
+    }
+
+    pub fn socket_path(name: &str) -> PathBuf {
+        Self::agent_dir(name).join("mcp.sock")
+    }
+
+    pub fn manager_dir() -> PathBuf {
+        PathBuf::from(MANAGER_RUNTIME_ROOT)
+    }
+
+    pub fn manager_socket_path() -> PathBuf {
+        Self::manager_dir().join("mcp.sock")
+    }
+
+    /// Ensure a runtime dir + (for sub-agents) per-agent socket exists. For
+    /// the manager, `manager_server::start` owns the socket — just return
+    /// the dir. For sub-agents this is `register_agent` (creates a fresh
+    /// listener bound to `socket_path(name)`). Source directory of the
+    /// `/run/hive/mcp.sock` bind that ends up in `set_nspawn_flags`.
+    pub fn ensure_runtime(self: &Arc<Self>, name: &str) -> Result<PathBuf> {
+        if name == crate::lifecycle::MANAGER_NAME {
+            let dir = Self::manager_dir();
+            std::fs::create_dir_all(&dir)
+                .with_context(|| format!("create manager dir {}", dir.display()))?;
+            return Ok(dir);
+        }
+        self.register_agent(name)
+    }
+
+    /// Per-agent state root (parent of `config/`, future `prompts/`, etc.).
+    pub fn agent_state_root(name: &str) -> PathBuf {
+        PathBuf::from(format!("{AGENT_STATE_ROOT}/{name}"))
+    }
+
+    /// Manager-editable proposed config repo. Bind-mounted into the manager
+    /// container as `/agents/<name>/config/`.
+    pub fn agent_proposed_dir(name: &str) -> PathBuf {
+        Self::agent_state_root(name).join("config")
+    }
+
+    /// Per-agent Claude credentials dir. Bind-mounted RW into the agent
+    /// container at `/root/.claude` so OAuth state survives container
+    /// destroy/recreate. Each agent owns its own token lineage — sharing
+    /// would break on the first refresh-token rotation.
+    pub fn agent_claude_dir(name: &str) -> PathBuf {
+        Self::agent_state_root(name).join("claude")
+    }
+
+    /// Per-agent durable knowledge dir. Bind-mounted RW into the agent
+    /// container at `/state`. Survives destroy/recreate alongside the
+    /// claude dir. Agents are told (via the system prompt) to write
+    /// long-lived notes / scratch state here.
+    pub fn agent_notes_dir(name: &str) -> PathBuf {
+        Self::agent_state_root(name).join("state")
+    }
+
+    /// Authoritative applied config repo. Hive-c0re-only.
+    pub fn agent_applied_dir(name: &str) -> PathBuf {
+        PathBuf::from(format!("{APPLIED_STATE_ROOT}/{name}"))
+    }
+
+    /// Enumerate names that have a persistent state dir under
+    /// `/var/lib/hyperhive/agents/` (i.e. config / claude creds /
+    /// notes survive). Includes both currently-existing containers and
+    /// destroyed-but-kept tombstones; callers filter the latter by
+    /// subtracting `lifecycle::list()`.
+    #[must_use]
+    pub fn kept_state_names() -> Vec<String> {
+        let Ok(rd) = std::fs::read_dir(AGENT_STATE_ROOT) else {
+            return Vec::new();
+        };
+        let mut out: Vec<String> = rd
+            .flatten()
+            .filter(|e| e.file_type().is_ok_and(|t| t.is_dir()))
+            .filter_map(|e| e.file_name().into_string().ok())
+            .collect();
+        out.sort();
+        out
+    }
+}
diff --git a/hive-c0re/src/crash_watch.rs b/hive-c0re/src/crash_watch.rs
new file mode 100644
index 00000000..fb7fd755
--- /dev/null
+++ b/hive-c0re/src/crash_watch.rs
@@ -0,0 +1,229 @@
+//! Per-container state watcher. Polls every managed container on a
+//! fixed interval, tracks two orthogonal state-sets across ticks,
+//! and emits a `HelperEvent` to the manager on each transition:
+//!
+//! - **running**: container is up. running → stopped without an
+//!   operator-initiated transient (`Stopping` / `Restarting` /
+//!   `Destroying` / `Rebuilding`) → `ContainerCrash`.
+//! - **logged-in**: claude session dir is populated. ! → ✓ →
+//!   `LoggedIn`; ✓ → ! → `NeedsLogin` (rare — usually only fires
+//!   on a fresh spawn / purge).
+//!
+//! `NeedsUpdate` events are now fired from the apply-commit path
+//! directly rather than via rev-marker polling (issue #179 cleanup).
+//!
+//! D-Bus subscription would be lower-latency for the first axis,
+//! but polling is simpler and a 10s detection delay is fine.
+
+use std::collections::HashSet;
+use std::sync::Arc;
+use std::time::Duration;
+
+use crate::container_view::claude_has_session;
+use crate::coordinator::{Coordinator, TransientKind};
+use crate::lifecycle::{self, AGENT_PREFIX, MANAGER_NAME};
+
+const POLL_INTERVAL: Duration = Duration::from_secs(10);
+
+/// How long an operator-initiated transient stays "recently cleared"
+/// for the purpose of suppressing crash events. Three full
+/// `POLL_INTERVAL`s gives the post-lifecycle path comfortable
+/// breathing room — the watcher will have polled at least twice
+/// inside the window even with worst-case timer skew (#425).
+const RECENT_TRANSIENT_GRACE: Duration = Duration::from_secs(30);
+
+pub fn spawn(coord: Arc<Coordinator>) {
+    let mut shutdown = coord.shutdown_rx();
+    tokio::spawn(async move {
+        let mut prev_running: HashSet<String> = HashSet::new();
+        let mut prev_logged_in: HashSet<String> = HashSet::new();
+        let mut prev_sub_agents: HashSet<String> = HashSet::new();
+        let mut seeded = false;
+        loop {
+            let raw = lifecycle::list().await.unwrap_or_default();
+            let mut current_running = HashSet::new();
+            let mut current_logged_in = HashSet::new();
+            let mut sub_agents: Vec<String> = Vec::new();
+            for c in &raw {
+                let logical = if c == MANAGER_NAME {
+                    MANAGER_NAME.to_owned()
+                } else if let Some(n) = c.strip_prefix(AGENT_PREFIX) {
+                    n.to_owned()
+                } else {
+                    continue;
+                };
+                if logical != MANAGER_NAME {
+                    sub_agents.push(logical.clone());
+                }
+                if lifecycle::is_running(&logical).await {
+                    current_running.insert(logical.clone());
+                }
+                if logical != MANAGER_NAME
+                    && claude_has_session(&Coordinator::agent_claude_dir(&logical))
+                {
+                    current_logged_in.insert(logical.clone());
+                }
+            }
+
+            if seeded {
+                emit_crash_transitions(&coord, &prev_running, &current_running);
+                emit_login_transitions(
+                    &coord,
+                    &prev_logged_in,
+                    &current_logged_in,
+                    &sub_agents,
+                    &prev_sub_agents,
+                );
+            }
+            // Periodic container rescan — catches state flips that
+            // happen outside our mutation surface (operator runs
+            // `nixos-container stop` over ssh, agent logs in via its
+            // own web UI, etc.) so the dashboard converges within one
+            // POLL_INTERVAL. Idempotent + cheap when nothing changed.
+            coord.rescan_containers_and_emit().await;
+            prev_running = current_running;
+            prev_logged_in = current_logged_in;
+            prev_sub_agents = sub_agents.into_iter().collect();
+            seeded = true;
+
+            tokio::select! {
+                () = tokio::time::sleep(POLL_INTERVAL) => {}
+                _ = shutdown.changed() => {
+                    tracing::info!("crash watcher: shutdown signal received");
+                    break;
+                }
+            }
+        }
+    });
+}
+
+fn emit_crash_transitions(coord: &Coordinator, prev: &HashSet<String>, current: &HashSet<String>) {
+    let transients = coord.transient_snapshot();
+    // Operator actions whose RAII guard already cleared but only just;
+    // suppresses the race where `lifecycle::kill` returns + drops the
+    // guard between two crash-watch polls (closes #425).
+    let recent = coord.recent_transient_within(RECENT_TRANSIENT_GRACE);
+    for stopped in prev.difference(current) {
+        let active = transients.get(stopped).map(|st| st.kind);
+        let recently_cleared = recent.get(stopped).copied();
+        if is_deliberate_stop(active, recently_cleared) {
+            continue;
+        }
+        tracing::warn!(agent = %stopped, "container crash detected");
+        coord.notify_manager(&hive_sh4re::HelperEvent::ContainerCrash {
+            agent: stopped.clone(),
+            note: Some("container stopped without an operator action".into()),
+        });
+    }
+}
+
+/// Pure classifier: did the operator stop / restart / destroy /
+/// rebuild this container, or did it crash? Splits the matcher out so
+/// it has a focused unit test (#425) without needing a Coordinator
+/// fixture. `active` is the currently-set transient (if any),
+/// `recently_cleared` is one whose RAII guard dropped within the
+/// grace window.
+fn is_deliberate_stop(
+    active: Option<TransientKind>,
+    recently_cleared: Option<TransientKind>,
+) -> bool {
+    let is_op_kind = |kind: TransientKind| {
+        matches!(
+            kind,
+            TransientKind::Stopping
+                | TransientKind::Restarting
+                | TransientKind::Destroying
+                | TransientKind::Rebuilding
+        )
+    };
+    active.is_some_and(is_op_kind) || recently_cleared.is_some_and(is_op_kind)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn deliberate_when_active_transient_is_operator_kind() {
+        for kind in [
+            TransientKind::Stopping,
+            TransientKind::Restarting,
+            TransientKind::Destroying,
+            TransientKind::Rebuilding,
+        ] {
+            assert!(is_deliberate_stop(Some(kind), None), "{kind:?}");
+        }
+    }
+
+    #[test]
+    fn deliberate_when_recent_transient_is_operator_kind() {
+        // Race the #425 bug repros: lifecycle action completes + drops
+        // the guard between two polls. recent_transient catches it.
+        for kind in [
+            TransientKind::Stopping,
+            TransientKind::Restarting,
+            TransientKind::Destroying,
+            TransientKind::Rebuilding,
+        ] {
+            assert!(is_deliberate_stop(None, Some(kind)), "{kind:?}");
+        }
+    }
+
+    #[test]
+    fn not_deliberate_with_no_transient_at_all() {
+        // The real-crash case — fires the ContainerCrash event.
+        assert!(!is_deliberate_stop(None, None));
+    }
+
+    #[test]
+    fn not_deliberate_when_only_spawning_starting() {
+        // Spawning/Starting are never paired with a "stopped" transition
+        // — they're starts. If we see one alongside a stop, it's
+        // unrelated (e.g. just-started container died), still a crash.
+        for kind in [TransientKind::Spawning, TransientKind::Starting] {
+            assert!(!is_deliberate_stop(Some(kind), None), "{kind:?} active");
+            assert!(!is_deliberate_stop(None, Some(kind)), "{kind:?} recent");
+        }
+    }
+}
+
+fn emit_login_transitions(
+    coord: &Coordinator,
+    prev: &HashSet<String>,
+    current: &HashSet<String>,
+    sub_agents: &[String],
+    prev_sub_agents: &HashSet<String>,
+) {
+    for agent in current.difference(prev) {
+        tracing::info!(%agent, "agent logged in");
+        coord.notify_manager(&hive_sh4re::HelperEvent::LoggedIn {
+            agent: agent.clone(),
+        });
+    }
+    // Detect transitions into "needs login": an agent that was previously
+    // logged-in goes unsigned (credentials deleted), OR a brand-new agent
+    // appears without a session.
+    //
+    // prev_needs uses prev_sub_agents (the agent set from the last tick) so
+    // that a newly-spawned agent — which does not appear in prev_sub_agents —
+    // is absent from prev_needs even though it's not in prev_logged_in.
+    // Without this, new agents land in both prev_needs and current_needs and
+    // the set difference is empty, silently dropping the event.
+    let prev_needs: HashSet<&str> = prev_sub_agents
+        .iter()
+        .map(String::as_str)
+        .filter(|n| !prev.contains(*n))
+        .collect();
+    let current_needs: HashSet<&str> = sub_agents
+        .iter()
+        .map(String::as_str)
+        .filter(|n| !current.contains(*n))
+        .collect();
+    for agent in current_needs.difference(&prev_needs) {
+        tracing::info!(%agent, "agent needs login");
+        coord.notify_manager(&hive_sh4re::HelperEvent::NeedsLogin {
+            agent: (*agent).to_owned(),
+        });
+    }
+}
+
diff --git a/hive-c0re/src/dashboard.rs b/hive-c0re/src/dashboard.rs
new file mode 100644
index 00000000..0a79bf11
--- /dev/null
+++ b/hive-c0re/src/dashboard.rs
@@ -0,0 +1,2285 @@
+//! Hyperhive dashboard. Lists managed containers (with deep-links to each
+//! container's web UI), pending approvals (with unified diff vs the applied
+//! repo, plus approve/deny buttons), and the manager.
+
+use std::convert::Infallible;
+use std::net::SocketAddr;
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+
+use anyhow::{Context, Result};
+use axum::extract::Form;
+use axum::{
+    Router,
+    extract::{Path as AxumPath, State},
+    http::{HeaderMap, StatusCode},
+    response::{
+        IntoResponse, Response,
+        sse::{Event, KeepAlive, Sse},
+    },
+    routing::{get, post},
+};
+use hive_sh4re::Approval;
+use serde::{Deserialize, Serialize};
+use tokio_stream::wrappers::BroadcastStream;
+use tokio_stream::{Stream, StreamExt};
+use tower_http::services::ServeDir;
+
+use crate::actions;
+use crate::container_view::{ContainerView, claude_has_session};
+use crate::coordinator::Coordinator;
+use crate::lifecycle::{self, MANAGER_NAME};
+
+const MANAGER_PORT: u16 = 8000;
+
+#[derive(Clone)]
+struct AppState {
+    coord: Arc<Coordinator>,
+}
+
+pub async fn serve(port: u16, coord: Arc<Coordinator>) -> Result<()> {
+    let static_dir: PathBuf = std::env::var_os("HIVE_STATIC_DIR")
+        .map(PathBuf::from)
+        .context(
+            "HIVE_STATIC_DIR env var not set — point it at the bundled \
+             dashboard dist (see services.hive-c0re.frontend in nix)",
+        )?;
+    if !static_dir.is_dir() {
+        anyhow::bail!(
+            "HIVE_STATIC_DIR ({}) is not a directory",
+            static_dir.display()
+        );
+    }
+    tracing::info!(static_dir = %static_dir.display(), "dashboard static dir resolved");
+    let app = Router::new()
+        .route("/api/state", get(api_state))
+        .route("/approve/{id}", post(post_approve))
+        .route("/deny/{id}", post(post_deny))
+        .route("/destroy/{name}", post(post_destroy))
+        .route("/kill/{name}", post(post_kill))
+        .route("/restart/{name}", post(post_restart))
+        .route("/start/{name}", post(post_start))
+        .route("/rebuild/{name}", post(post_rebuild))
+        .route("/update-all", post(post_update_all))
+        .route("/answer-question/{id}", post(post_answer_question))
+        .route("/cancel-question/{id}", post(post_cancel_question))
+        .route("/purge-tombstone/{name}", post(post_purge_tombstone))
+        .route("/api/journal/{name}", get(get_journal))
+        .route("/api/approval-diff/{id}", get(get_approval_diff))
+        .route("/api/state-file", get(get_state_file))
+        .route("/api/reminders", get(api_reminders))
+        .route("/api/agent/{name}/links", get(get_agent_links))
+        .route("/cancel-reminder/{id}", post(post_cancel_reminder))
+        .route("/retry-reminder/{id}", post(post_retry_reminder))
+        .route("/request-spawn", post(post_request_spawn))
+        .route("/api/topology/set-parent", post(post_set_parent))
+        .route("/op-send", post(post_op_send))
+        .route("/meta-update", post(post_meta_update))
+        .route("/api/schedules", get(api_schedules).post(post_schedule_new))
+        .route(
+            "/api/schedules/{id}",
+            axum::routing::patch(patch_schedule),
+        )
+        .route("/api/schedules/{id}/cancel", post(post_schedule_cancel))
+        .route("/api/schedules/{id}/fire-now", post(post_schedule_fire_now))
+        .route("/api/rebuild-queue/{id}/cancel", post(post_rebuild_queue_cancel))
+        .route("/dashboard/stream", get(dashboard_stream))
+        .route("/dashboard/history", get(dashboard_history))
+        // Anything not matched by the dynamic routes above falls
+        // through to the bundled dashboard dist (GET / →
+        // dist/index.html, /favicon.svg → dist/favicon.svg,
+        // /static/dashboard.css → dist/static/dashboard.css, etc.).
+        .fallback_service(ServeDir::new(&static_dir))
+        .with_state(AppState { coord });
+    let addr = SocketAddr::from(([0, 0, 0, 0], port));
+    let listener = bind_with_retry(addr).await?;
+    tracing::info!(%port, "dashboard listening");
+    axum::serve(listener, app).await?;
+    Ok(())
+}
+
+// ---------------------------------------------------------------------------
+// The dashboard is an SPA. Its HTML shell + bundled JS / CSS / favicon
+// live in the directory pointed at by `HIVE_STATIC_DIR` (set by the
+// hive-c0re NixOS module to `${frontend}/dashboard`), served by the
+// `tower_http::ServeDir` fallback declared in `serve()`. The dynamic
+// surface — `/api/state` and the action endpoints — is owned here.
+// The JS app fetches state on load, re-fetches after every async-form
+// submit, and listens on `/dashboard/stream` for the unified live event
+// channel.
+// ---------------------------------------------------------------------------
+
+/// `SO_REUSEADDR` bind with retry. Mirrors the per-agent variant in
+/// `hive-ag3nt::web_ui::bind_with_retry`: hive-c0re restarts also
+/// race the previous process's socket release, and the retry has no
+/// attempt cap — capping was the proximate cause of issue #324
+/// (silent give-up on a long stale socket). Genuine port collisions
+/// don't reach this layer (dashboard is bound to a fixed configured
+/// port, no per-agent hashing), so any persistent `AddrInUse` always
+/// reflects a recoverable stale socket. WARN for the first dozen
+/// attempts; INFO after that to avoid spamming the journal during a
+/// long hold; INFO on eventual success when we did have to retry.
+async fn bind_with_retry(addr: SocketAddr) -> Result<tokio::net::TcpListener> {
+    let mut delay_ms = 250u64;
+    let mut attempts = 0u32;
+    loop {
+        match try_bind(addr) {
+            Ok(l) => {
+                if attempts > 0 {
+                    tracing::info!(
+                        %addr, attempts,
+                        "dashboard: bind succeeded after retry"
+                    );
+                }
+                return Ok(l);
+            }
+            Err(e) if e.kind() == std::io::ErrorKind::AddrInUse => {
+                let attempt = attempts + 1;
+                if attempt <= 12 {
+                    tracing::warn!(
+                        %addr, attempt,
+                        "dashboard: AddrInUse, retrying in {delay_ms}ms"
+                    );
+                } else {
+                    tracing::info!(
+                        %addr, attempt,
+                        "dashboard: AddrInUse still holding, retrying in {delay_ms}ms"
+                    );
+                }
+                tokio::time::sleep(std::time::Duration::from_millis(delay_ms)).await;
+                attempts += 1;
+                delay_ms = (delay_ms * 2).min(2000);
+            }
+            Err(e) => {
+                return Err(e).with_context(|| format!("bind dashboard on {addr}"));
+            }
+        }
+    }
+}
+
+fn try_bind(addr: SocketAddr) -> std::io::Result<tokio::net::TcpListener> {
+    let sock = match addr {
+        SocketAddr::V4(_) => tokio::net::TcpSocket::new_v4()?,
+        SocketAddr::V6(_) => tokio::net::TcpSocket::new_v6()?,
+    };
+    sock.set_reuseaddr(true)?;
+    sock.bind(addr)?;
+    sock.listen(1024)
+}
+
+#[derive(Serialize)]
+struct StateSnapshot {
+    /// Broker seq at the moment this snapshot was assembled. Clients
+    /// dedupe their buffered SSE traffic against this value: any
+    /// `MessageEvent` with `seq <= snapshot.seq` is already reflected in
+    /// the snapshot (or pre-dates it); anything with `seq > snapshot.seq`
+    /// is post-snapshot and should be applied. Set to 0 in the
+    /// pre-emit case (no events ever fired) — clients treat that as
+    /// "apply everything you've buffered".
+    seq: u64,
+    hostname: String,
+    manager_port: u16,
+    any_stale: bool,
+    containers: Vec<ContainerView>,
+    transients: Vec<TransientView>,
+    approvals: Vec<ApprovalView>,
+    /// Last 30 resolved approvals (approved / denied / failed), newest-
+    /// first. Drives the "history" tab on the approvals section.
+    approval_history: Vec<ApprovalHistoryView>,
+    /// Pending operator-targeted questions (`target IS NULL`). Any
+    /// agent can `ask` the operator and `ask` returns immediately with
+    /// the id; on `/answer-question` we mark the row answered and
+    /// fire `HelperEvent::QuestionAnswered` back into the asker's
+    /// inbox. Peer-to-peer questions live in the same table but never
+    /// surface here (see `OperatorQuestions::pending`).
+    questions: Vec<QuestionView>,
+    /// Last 20 answered questions, newest-first.
+    question_history: Vec<QuestionView>,
+    /// State dirs (config history + claude creds + /state/ notes) that
+    /// survive after a destroy-without-purge. The operator can re-spawn
+    /// with the same name to resume, or PURG3 to wipe them.
+    tombstones: Vec<TombstoneView>,
+    /// Sub-agents whose FNV-1a hashed web UI port collides with at
+    /// least one other agent. Operator resolves by renaming. The
+    /// dashboard renders a banner at the top listing each cluster.
+    port_conflicts: Vec<PortConflict>,
+    /// Inputs in `meta/flake.lock` the operator can selectively
+    /// `nix flake update`. Hyperhive first, then `agent-<n>` rows.
+    meta_inputs: Vec<MetaInputView>,
+    /// True while a dashboard-triggered `meta-update` (flake lock bump +
+    /// agent rebuild ripple) is running in the background. Lets a
+    /// client that cold-loads mid-update render the META INPUTS panel's
+    /// disabled "updating…" state; live transitions arrive via the
+    /// `MetaUpdateRunning` event (issue #259).
+    meta_update_running: bool,
+    /// Current state of the global rebuild queue — pending + running
+    /// long-lived ops (rebuild / meta-update / spawn) plus the most
+    /// recent few terminal entries the queue retains for history.
+    /// Live transitions arrive via the `RebuildQueueChanged` event.
+    /// See `rebuild_queue.rs`.
+    rebuild_queue: Vec<crate::rebuild_queue::QueueEntry>,
+    /// Whether the hive-forge container is up. When true the dashboard
+    /// links each container's config + each approval's commit into the
+    /// forge's `agent-configs` repos.
+    forge_present: bool,
+}
+
+/// `OpQuestion` + computed `question_refs` / `answer_refs`. Built
+/// from the snapshot read; the live channel attaches the same
+/// fields directly on `QuestionAdded` / `QuestionResolved`.
+#[derive(Serialize)]
+struct QuestionView {
+    #[serde(flatten)]
+    inner: crate::operator_questions::OpQuestion,
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    question_refs: Vec<String>,
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    answer_refs: Vec<String>,
+}
+
+impl QuestionView {
+    fn from_question(q: crate::operator_questions::OpQuestion) -> Self {
+        let question_refs = scan_validated_paths(&q.question);
+        let answer_refs = q
+            .answer
+            .as_deref()
+            .map(scan_validated_paths)
+            .unwrap_or_default();
+        Self {
+            inner: q,
+            question_refs,
+            answer_refs,
+        }
+    }
+}
+
+#[derive(Serialize)]
+struct PortConflict {
+    port: u16,
+    /// All agent names sharing this port (sorted, ≥2 entries).
+    agents: Vec<String>,
+}
+
+#[derive(Serialize, Clone, Debug)]
+pub(crate) struct TombstoneView {
+    pub name: String,
+    /// Bytes used by the state dir tree. Cheap-ish to compute; let the
+    /// operator know how much they're holding onto.
+    pub state_bytes: u64,
+    /// Mtime (unix seconds) of the state dir; rough "last seen".
+    pub last_seen: i64,
+    pub has_creds: bool,
+}
+
+#[derive(Serialize)]
+struct TransientView {
+    name: String,
+    kind: &'static str,
+    secs: u64,
+}
+
+#[derive(Serialize)]
+struct ApprovalHistoryView {
+    id: i64,
+    agent: String,
+    kind: &'static str,
+    /// First 12 chars of the canonical sha (preferred) or
+    /// manager-supplied ref. None for resolved spawn approvals.
+    sha_short: Option<String>,
+    /// `approved` / `denied` / `failed`.
+    status: &'static str,
+    /// Unix seconds. Renders as a relative time on the dashboard.
+    resolved_at: i64,
+    /// Operator-supplied deny reason (for `denied`) or build error
+    /// (for `failed`). None on `approved`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    note: Option<String>,
+}
+
+#[derive(Serialize)]
+struct ApprovalView {
+    id: i64,
+    agent: String,
+    kind: &'static str,
+    /// First 12 chars of the `commit_ref`, for `ApplyCommit` only.
+    sha_short: Option<String>,
+    /// Raw unified diff text, for `ApplyCommit` only. The client splits
+    /// on `\n` and per-line classifies (`+` / `-` / `@@` / `--- ` / `+++ `
+    /// → diff-add / diff-del / diff-hunk / diff-file). Shipping raw
+    /// instead of pre-rendered HTML saves bytes on the wire (no
+    /// per-line `<span>` markup) and removes the only HTML-escape
+    /// surface from the snapshot.
+    diff: Option<String>,
+    /// Manager-supplied description shown on the approval card.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    description: Option<String>,
+    /// Unix seconds the approval was queued. Rendered as a relative
+    /// time on the card so the operator can spot a stale request. (#272)
+    requested_at: i64,
+}
+
+/// Replace silent `.unwrap_or_default()` on the data sources behind
+/// `/api/state` so that whichever query degrades surfaces in journald
+/// instead of leaving the operator staring at an empty list. The
+/// dashboard still degrades to a sensible default value; the warn
+/// is just the diagnostic breadcrumb the old code swallowed.
+fn log_default<T, E>(what: &str, result: std::result::Result<T, E>) -> T
+where
+    T: Default,
+    E: std::fmt::Debug,
+{
+    match result {
+        Ok(v) => v,
+        Err(e) => {
+            tracing::warn!(target: "api_state", source = %what, error = ?e, "snapshot source failed; using default");
+            T::default()
+        }
+    }
+}
+
+async fn api_state(headers: HeaderMap, State(state): State<AppState>) -> axum::Json<StateSnapshot> {
+    let host = headers
+        .get("host")
+        .and_then(|h| h.to_str().ok())
+        .unwrap_or("localhost");
+    let hostname = host.split(':').next().unwrap_or(host).to_owned();
+
+    // Capture the unified dashboard-channel seq *before* any read so the
+    // dedupe contract is "events with seq > snapshot.seq are
+    // post-snapshot, never missed." An event landing during snapshot
+    // construction may be doubly applied (snapshot caught the write +
+    // client also applies the SSE frame) — that's a renderer's problem
+    // to make idempotent, not ours to avoid here.
+    let seq = state.coord.current_seq();
+
+    // Refresh the coordinator's cached container snapshot before
+    // reading. Cold-load clients then see whatever the latest rescan
+    // produced; live clients converge via the matching
+    // `ContainerStateChanged` / `ContainerRemoved` events the rescan
+    // emits.
+    state.coord.rescan_containers_and_emit().await;
+    let containers = state.coord.containers_snapshot().await;
+    let any_stale = containers.iter().any(|c| c.needs_update);
+    let transient_snapshot = state.coord.transient_snapshot();
+    let pending_approvals = gc_orphans(
+        &state.coord,
+        log_default("approvals.pending", state.coord.approvals.pending()),
+    );
+    let transients = build_transient_views(&containers, &transient_snapshot);
+    let approvals = build_approval_views(pending_approvals).await;
+    let approval_history = log_default(
+        "approvals.recent_resolved",
+        state.coord.approvals.recent_resolved(30),
+    )
+    .into_iter()
+    .map(history_view)
+    .collect();
+    let tombstones = build_tombstone_views(&state.coord, &containers, &transient_snapshot);
+    let port_conflicts = build_port_conflicts(&containers);
+
+    // operator_inbox used to be served here as a 50-row array; the
+    // dashboard now derives it client-side from the message stream
+    // (terminal backfill + live SSE), so the snapshot stops shipping it.
+    // Both operator-targeted and peer threads now surface on the
+    // dashboard. Client filters by target client-side. Each row is
+    // wrapped in QuestionView so the snapshot carries the same
+    // file_refs the live event variants attach.
+    let questions: Vec<QuestionView> =
+        log_default("questions.pending_all", state.coord.questions.pending_all())
+            .into_iter()
+            .map(QuestionView::from_question)
+            .collect();
+    let question_history: Vec<QuestionView> = log_default(
+        "questions.recent_answered_all",
+        state.coord.questions.recent_answered_all(20),
+    )
+    .into_iter()
+    .map(QuestionView::from_question)
+    .collect();
+
+    axum::Json(StateSnapshot {
+        seq,
+        hostname,
+        manager_port: MANAGER_PORT,
+        any_stale,
+        containers,
+        transients,
+        approvals,
+        approval_history,
+        meta_inputs: read_meta_inputs(),
+        meta_update_running: state.coord.meta_update_in_progress(),
+        questions,
+        question_history,
+        tombstones,
+        port_conflicts,
+        rebuild_queue: state.coord.rebuild_queue.snapshot(),
+        forge_present: crate::forge::is_present().await,
+    })
+}
+
+/// Group live containers by their assigned web UI port; clusters with
+/// more than one member are port-hash collisions the operator needs
+/// to resolve by renaming. Manager (fixed at 8000) and sub-agents
+/// (8100..8999) can't collide with each other — collisions are
+/// strictly between sub-agents.
+fn build_port_conflicts(containers: &[ContainerView]) -> Vec<PortConflict> {
+    let mut by_port: std::collections::BTreeMap<u16, Vec<String>> =
+        std::collections::BTreeMap::new();
+    for c in containers {
+        by_port.entry(c.port).or_default().push(c.name.clone());
+    }
+    by_port
+        .into_iter()
+        .filter(|(_, agents)| agents.len() > 1)
+        .map(|(port, mut agents)| {
+            agents.sort();
+            PortConflict { port, agents }
+        })
+        .collect()
+}
+
+#[derive(Serialize, Clone, Debug)]
+pub(crate) struct MetaInputView {
+    /// Input key in meta's `flake.nix` — `hyperhive`, `agent-<n>`, etc.
+    pub name: String,
+    /// Full locked sha. Not displayed verbatim; the dashboard
+    /// truncates to the first 12 chars for the chip.
+    pub rev: String,
+    /// Unix seconds — `locked.lastModified`. Drives the relative
+    /// "2h ago" timestamp on each input row.
+    pub last_modified: i64,
+    /// `original.url` if available, for the tooltip / row meta text.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub url: Option<String>,
+}
+
+/// Walk `flake.lock`'s `nodes` graph from `root` and emit one
+/// `MetaInputView` per fetched input, at **every** depth. That
+/// surfaces the direct meta inputs (`hyperhive`, `agent-<n>`), the
+/// agent flakes' own inputs (`agent-dmatrix/mcp-matrix`,
+/// `hyperhive/nixpkgs`), and any deeper transitive inputs — so the
+/// operator can bump any of them individually. Names are
+/// slash-separated paths from root, the syntax `nix flake update`
+/// accepts for transitive inputs.
+///
+/// Filtering (see issue #275):
+/// - Inputs that resolve via a `follows` chain (lock value is an
+///   array) are skipped — they alias another node, not their own
+///   fetched derivation, so updating them does nothing.
+/// - A node is emitted only when it carries a `locked.rev`.
+/// - Each fetched node is walked exactly once (a `visited` set):
+///   the lock graph shares nodes (many flakes reference one
+///   nixpkgs), so without this a shared subtree re-walks per parent
+///   and a cycle would recurse forever. The result is a spanning
+///   tree — every input shown once, at its shallowest path.
+fn read_meta_inputs() -> Vec<MetaInputView> {
+    let mut out = Vec::new();
+    let Ok(raw) = std::fs::read_to_string("/var/lib/hyperhive/meta/flake.lock") else {
+        return out;
+    };
+    let Ok(json) = serde_json::from_str::<serde_json::Value>(&raw) else {
+        return out;
+    };
+    let Some(nodes) = json.get("nodes").and_then(|v| v.as_object()) else {
+        return out;
+    };
+    let Some(root_name) = json.get("root").and_then(|v| v.as_str()) else {
+        return out;
+    };
+    let mut visited = std::collections::HashSet::new();
+    visited.insert(root_name.to_owned());
+    walk_meta_inputs(nodes, root_name, "", &mut visited, &mut out);
+    // hyperhive first, then alphabetical. String-sorting the
+    // slash-paths puts every node directly above its own children
+    // (`agent-foo`, `agent-foo/bar`, `agent-foo/bar/baz`), so the
+    // result is a pre-order traversal the tree renderer can consume.
+    out.sort_by(|a, b| match (a.name.as_str(), b.name.as_str()) {
+        ("hyperhive", _) => std::cmp::Ordering::Less,
+        (_, "hyperhive") => std::cmp::Ordering::Greater,
+        _ => a.name.cmp(&b.name),
+    });
+    out
+}
+
+fn walk_meta_inputs(
+    nodes: &serde_json::Map<String, serde_json::Value>,
+    node_name: &str,
+    prefix: &str,
+    visited: &mut std::collections::HashSet<String>,
+    out: &mut Vec<MetaInputView>,
+) {
+    let Some(node) = nodes.get(node_name) else {
+        return;
+    };
+    let Some(inputs_map) = node.get("inputs").and_then(|v| v.as_object()) else {
+        return;
+    };
+    // Two passes: claim (and emit) every direct input of this node
+    // before descending into any of them. A shallow input that a
+    // deeper flake also references then keeps its shallow path
+    // rather than being captured first by the deep walk.
+    let mut to_recurse: Vec<(String, String)> = Vec::new();
+    for (alias, target) in inputs_map {
+        // Inputs map value is either a string (node name) or an
+        // array (a `follows` chain). The latter just aliases another
+        // node — we can't `nix flake update` it directly, so skip.
+        let serde_json::Value::String(target_name) = target else {
+            continue;
+        };
+        // Walk each fetched node once — guards shared subtrees and
+        // cycles, and keeps the panel free of duplicate rows.
+        if !visited.insert(target_name.clone()) {
+            continue;
+        }
+        let Some(target_node) = nodes.get(target_name) else {
+            continue;
+        };
+        let path = if prefix.is_empty() {
+            alias.clone()
+        } else {
+            format!("{prefix}/{alias}")
+        };
+        if let Some(rev) = target_node
+            .get("locked")
+            .and_then(|v| v.get("rev"))
+            .and_then(|v| v.as_str())
+        {
+            let last_modified = target_node
+                .get("locked")
+                .and_then(|v| v.get("lastModified"))
+                .and_then(serde_json::Value::as_i64)
+                .unwrap_or(0);
+            let url = target_node
+                .get("original")
+                .and_then(|v| v.get("url"))
+                .and_then(|v| v.as_str())
+                .map(str::to_owned);
+            out.push(MetaInputView {
+                name: path.clone(),
+                rev: rev.to_owned(),
+                last_modified,
+                url,
+            });
+        }
+        to_recurse.push((target_name.clone(), path));
+    }
+    for (target_name, path) in to_recurse {
+        walk_meta_inputs(nodes, &target_name, &path, visited, out);
+    }
+}
+
+/// Transient state for agents whose container does NOT yet exist
+/// (`Spawning`). Lifecycle ops on existing containers surface as
+/// `ContainerView.pending` inline; this list only catches pre-creation.
+fn build_transient_views(
+    containers: &[ContainerView],
+    transient_snapshot: &std::collections::HashMap<String, crate::coordinator::TransientState>,
+) -> Vec<TransientView> {
+    transient_snapshot
+        .iter()
+        .filter(|(name, _)| !containers.iter().any(|c| &c.name == *name))
+        .map(|(name, st)| TransientView {
+            name: name.clone(),
+            kind: transient_label(st.kind),
+            secs: st.since.elapsed().as_secs(),
+        })
+        .collect()
+}
+
+/// Render each pending approval into its dashboard view (short sha +
+/// unified diff for `ApplyCommit`, just the name for `Spawn`).
+/// Project a resolved sqlite row into the lean shape the dashboard
+/// history tab consumes — no `diff_html` (rendering 30 of them
+/// per /api/state poll would mean 30 git diffs per refresh).
+fn history_view(a: Approval) -> ApprovalHistoryView {
+    let displayed = a.fetched_sha.as_deref().unwrap_or(&a.commit_ref);
+    let sha_short = if displayed.is_empty() {
+        None
+    } else {
+        Some(displayed[..displayed.len().min(12)].to_owned())
+    };
+    let status = match a.status {
+        hive_sh4re::ApprovalStatus::Approved => "approved",
+        hive_sh4re::ApprovalStatus::Denied => "denied",
+        hive_sh4re::ApprovalStatus::Failed => "failed",
+        hive_sh4re::ApprovalStatus::Cancelled => "cancelled",
+        // Pending shouldn't appear in recent_resolved, but be defensive.
+        hive_sh4re::ApprovalStatus::Pending => "pending",
+    };
+    let kind = match a.kind {
+        hive_sh4re::ApprovalKind::ApplyCommit => "apply_commit",
+        hive_sh4re::ApprovalKind::Spawn => "spawn",
+        hive_sh4re::ApprovalKind::InitConfig => "init_config",
+        hive_sh4re::ApprovalKind::UpdateMetaInputs => "update_meta_inputs",
+        hive_sh4re::ApprovalKind::SchedulePrompt => "schedule_prompt",
+    };
+    ApprovalHistoryView {
+        id: a.id,
+        agent: a.agent,
+        kind,
+        sha_short,
+        status,
+        resolved_at: a.resolved_at.unwrap_or(0),
+        note: a.note,
+    }
+}
+
+async fn build_approval_views(approvals: Vec<Approval>) -> Vec<ApprovalView> {
+    let mut out = Vec::with_capacity(approvals.len());
+    for a in approvals {
+        out.push(match a.kind {
+            hive_sh4re::ApprovalKind::ApplyCommit => {
+                // Prefer the canonical fetched sha from applied;
+                // commit_ref is only the manager's claim and may be
+                // amended out from under us.
+                let displayed = a.fetched_sha.as_deref().unwrap_or(&a.commit_ref);
+                let sha = displayed[..displayed.len().min(12)].to_owned();
+                let diff = approval_diff(&a.agent, a.id).await;
+                ApprovalView {
+                    id: a.id,
+                    agent: a.agent.clone(),
+                    kind: "apply_commit",
+                    sha_short: Some(sha),
+                    diff: Some(diff),
+                    description: a.description,
+                    requested_at: a.requested_at,
+                }
+            }
+            hive_sh4re::ApprovalKind::Spawn => ApprovalView {
+                id: a.id,
+                agent: a.agent,
+                kind: "spawn",
+                sha_short: None,
+                diff: None,
+                description: a.description,
+                requested_at: a.requested_at,
+            },
+            hive_sh4re::ApprovalKind::InitConfig => ApprovalView {
+                id: a.id,
+                agent: a.agent,
+                kind: "init_config",
+                sha_short: None,
+                diff: None,
+                description: a.description,
+                requested_at: a.requested_at,
+            },
+            hive_sh4re::ApprovalKind::UpdateMetaInputs => ApprovalView {
+                id: a.id,
+                agent: a.agent,
+                kind: "update_meta_inputs",
+                sha_short: None,
+                diff: None,
+                description: a.description,
+                requested_at: a.requested_at,
+            },
+            hive_sh4re::ApprovalKind::SchedulePrompt => ApprovalView {
+                id: a.id,
+                agent: a.agent,
+                kind: "schedule_prompt",
+                sha_short: None,
+                diff: None,
+                description: a.description,
+                requested_at: a.requested_at,
+            },
+        });
+    }
+    out
+}
+
+/// State-dir names that don't appear in the live container list (and
+/// aren't the manager). Each one surfaces in the dashboard as a row
+/// with R3V1V3 + PURG3 actions.
+fn build_tombstone_views(
+    coord: &Coordinator,
+    containers: &[ContainerView],
+    transient_snapshot: &std::collections::HashMap<String, crate::coordinator::TransientState>,
+) -> Vec<TombstoneView> {
+    let _ = coord; // kept_state_names is a free fn but takes &self by future plan
+    let live: std::collections::HashSet<&str> = containers
+        .iter()
+        .map(|c| c.name.as_str())
+        .chain(transient_snapshot.keys().map(String::as_str))
+        .collect();
+    Coordinator::kept_state_names()
+        .into_iter()
+        .filter(|name| name != MANAGER_NAME && !live.contains(name.as_str()))
+        .map(|name| {
+            let root = Coordinator::agent_state_root(&name);
+            let state_bytes = dir_size_bytes(&root);
+            let last_seen = std::fs::metadata(&root)
+                .and_then(|m| m.modified())
+                .ok()
+                .and_then(|t| t.duration_since(std::time::UNIX_EPOCH).ok())
+                .and_then(|d| i64::try_from(d.as_secs()).ok())
+                .unwrap_or(0);
+            let has_creds = claude_has_session(&Coordinator::agent_claude_dir(&name));
+            TombstoneView {
+                name,
+                state_bytes,
+                last_seen,
+                has_creds,
+            }
+        })
+        .collect()
+}
+
+/// Sum the byte size of every regular file under `root`. Cheap to compute
+/// for typical agent state (config repo + claude creds + notes file —
+/// usually a few MB); fine to do inline on each /api/state. Returns 0 on
+/// any error.
+fn dir_size_bytes(root: &Path) -> u64 {
+    fn walk(p: &Path, acc: &mut u64) {
+        let Ok(rd) = std::fs::read_dir(p) else { return };
+        for entry in rd.flatten() {
+            let Ok(ft) = entry.file_type() else { continue };
+            if ft.is_dir() {
+                walk(&entry.path(), acc);
+            } else if ft.is_file()
+                && let Ok(meta) = entry.metadata()
+            {
+                *acc += meta.len();
+            }
+        }
+    }
+    let mut total = 0u64;
+    walk(root, &mut total);
+    total
+}
+
+async fn dashboard_history(State(state): State<AppState>) -> Response {
+    // Backfill source for the dashboard terminal. Returns up to ~200
+    // historical broker messages (no other event kinds are persisted)
+    // converted to `DashboardEvent::Sent` JSON so the client can replay
+    // through the same dispatch path as live frames. Wrapped in
+    // `{ seq, events }`: the seq is the dashboard channel's high-water
+    // mark at fetch time. Clients use it to dedupe their buffered live
+    // SSE traffic (drop anything with `seq <= history_seq`) so a frame
+    // that lands between SSE-subscribe and history-fetch isn't shown
+    // twice and isn't lost. Historical rows carry `seq = 0`; the
+    // boundary seq is what closes the dedupe window.
+    const HISTORY_LIMIT: u64 = 200;
+    let seq = state.coord.current_seq();
+    match state.coord.broker.recent_all(HISTORY_LIMIT) {
+        Ok(mut messages) => {
+            messages.reverse();
+            let events: Vec<crate::dashboard_events::DashboardEvent> = messages
+                .into_iter()
+                .map(|m| match m {
+                    crate::broker::MessageEvent::Sent { id, from, to, body, at, in_reply_to } => {
+                        let file_refs = scan_validated_paths(&body);
+                        crate::dashboard_events::DashboardEvent::Sent {
+                            seq: 0,
+                            id,
+                            from,
+                            to,
+                            body,
+                            at,
+                            in_reply_to,
+                            file_refs,
+                        }
+                    }
+                    crate::broker::MessageEvent::Delivered { id, from, to, body, at, in_reply_to } => {
+                        let file_refs = scan_validated_paths(&body);
+                        crate::dashboard_events::DashboardEvent::Delivered {
+                            seq: 0,
+                            id,
+                            from,
+                            to,
+                            body,
+                            at,
+                            in_reply_to,
+                            file_refs,
+                        }
+                    }
+                })
+                .collect();
+            axum::Json(serde_json::json!({ "seq": seq, "events": events })).into_response()
+        }
+        Err(e) => error_response(&format!("dashboard/history failed: {e:#}")),
+    }
+}
+
+/// `/dashboard/stream` query string. Today's only field is `kinds`
+/// (#408): a comma-separated allow-list of event-`kind` strings.
+/// Empty / absent ⇒ no filter (current behaviour, all variants
+/// forwarded). Set ⇒ only the named kinds reach the subscriber,
+/// non-matches are skipped before the JSON serialise cost.
+///
+/// Useful for narrow pages (e.g. `flow.js` only cares about `sent`
+/// / `delivered` / `container_state_changed` / `container_removed`)
+/// that want to drop the dispatch overhead on every unrelated mutation.
+#[derive(Deserialize, Default)]
+struct DashboardStreamQuery {
+    /// Comma-separated event kinds to forward. Each token is
+    /// trimmed; unknown kinds are silently ignored on lookup
+    /// (subscriber sees nothing instead of an error).
+    kinds: Option<String>,
+}
+
+async fn dashboard_stream(
+    State(state): State<AppState>,
+    axum::extract::Query(q): axum::extract::Query<DashboardStreamQuery>,
+) -> Sse<impl Stream<Item = Result<Event, Infallible>>> {
+    let rx = state.coord.dashboard_subscribe();
+    // Pre-parse the allow-list once at subscription time, so the
+    // per-event hot path is just a `HashSet::contains` on a
+    // `&'static str` — no string churn per frame.
+    let kind_filter: Option<std::collections::HashSet<String>> = q.kinds.and_then(|raw| {
+        let set: std::collections::HashSet<String> = raw
+            .split(',')
+            .map(str::trim)
+            .filter(|s| !s.is_empty())
+            .map(str::to_owned)
+            .collect();
+        if set.is_empty() { None } else { Some(set) }
+    });
+    let stream = BroadcastStream::new(rx).filter_map(move |res| {
+        // Drop lagged frames. Browsers reconnect; the seq dedupe on
+        // reconnect skips any frame already reflected in the snapshot.
+        let event = res.ok()?;
+        if let Some(filter) = kind_filter.as_ref()
+            && !filter.contains(event.kind_tag())
+        {
+            return None;
+        }
+        let json = serde_json::to_string(&event).ok()?;
+        Some(Ok(Event::default().data(json)))
+    });
+    Sse::new(stream).keep_alive(KeepAlive::default())
+}
+
+async fn post_approve(State(state): State<AppState>, AxumPath(id): AxumPath<i64>) -> Response {
+    match actions::approve(state.coord.clone(), id).await {
+        // 200 instead of 303 — `actions::approve` fires
+        // `ApprovalResolved` (success path) or the eventual failure
+        // event, both of which the dashboard's derived store applies
+        // live. The matching form carries `data-no-refresh`.
+        Ok(()) => (StatusCode::OK, "ok").into_response(),
+        Err(e) => error_response(&format!("approve {id} failed: {e:#}")),
+    }
+}
+
+#[derive(Deserialize, Default)]
+struct DenyForm {
+    #[serde(default)]
+    note: Option<String>,
+}
+
+async fn post_deny(
+    State(state): State<AppState>,
+    AxumPath(id): AxumPath<i64>,
+    Form(form): Form<DenyForm>,
+) -> Response {
+    let note = form
+        .note
+        .as_deref()
+        .map(str::trim)
+        .filter(|s| !s.is_empty());
+    match actions::deny(&state.coord, id, note).await {
+        Ok(()) => (StatusCode::OK, "ok").into_response(),
+        Err(e) => error_response(&format!("deny {id} failed: {e:#}")),
+    }
+}
+
+#[derive(Deserialize)]
+struct RequestSpawnForm {
+    name: String,
+}
+
+/// `POST /api/topology/set-parent` body. `child` is required.
+/// `new_parent` may be:
+/// - absent or empty / whitespace-only → promote to root,
+/// - non-empty → new parent's logical name.
+///
+/// (The CLI surface gates "no parent specified" behind an explicit
+/// `--root` flag for safety; the HTTP surface is permissive
+/// because the dashboard form encodes "no value" as the empty
+/// string for the optional radio-group input.)
+#[derive(Deserialize)]
+struct SetParentForm {
+    child: String,
+    new_parent: Option<String>,
+}
+
+#[derive(Deserialize)]
+struct AnswerForm {
+    answer: String,
+}
+
+/// Attach a permissive CORS header so the per-agent web UI — served on
+/// a different port — can POST an operator answer here and read the
+/// result. The dashboard has no auth, so `*` exposes nothing a plain
+/// cross-origin form-POST couldn't already reach. This shim disappears
+/// once the unifying gateway makes the agent page same-origin; see
+/// `docs/boundary.md`.
+fn with_cors(mut resp: Response) -> Response {
+    resp.headers_mut().insert(
+        axum::http::header::ACCESS_CONTROL_ALLOW_ORIGIN,
+        axum::http::HeaderValue::from_static("*"),
+    );
+    resp
+}
+
+async fn post_answer_question(
+    State(state): State<AppState>,
+    AxumPath(id): AxumPath<i64>,
+    Form(form): Form<AnswerForm>,
+) -> Response {
+    let answer = form.answer.trim();
+    if answer.is_empty() {
+        return with_cors(error_response("answer: required"));
+    }
+    let resp = match state
+        .coord
+        .questions
+        .answer(id, answer, hive_sh4re::OPERATOR_RECIPIENT)
+    {
+        Ok((question, asker, target)) => {
+            tracing::info!(%id, %asker, "operator answered question");
+            state.coord.notify_agent(
+                &asker,
+                &hive_sh4re::HelperEvent::QuestionAnswered {
+                    id,
+                    question,
+                    answer: answer.to_owned(),
+                    answerer: hive_sh4re::OPERATOR_RECIPIENT.to_owned(),
+                },
+            );
+            state.coord.emit_question_resolved(
+                id,
+                answer,
+                hive_sh4re::OPERATOR_RECIPIENT,
+                false,
+                target.as_deref(),
+            );
+            (StatusCode::OK, "ok").into_response()
+        }
+        Err(e) => error_response(&format!("answer {id} failed: {e:#}")),
+    };
+    with_cors(resp)
+}
+
+/// Resolve a pending operator question with a sentinel answer when
+/// the operator decides not to / can't answer. The asker harness
+/// receives a `QuestionAnswered` event with `answer = "[cancelled]"`
+/// so it can fall back on whatever default it had. Same code path as
+/// a real answer — just lets the operator close the loop instead of
+/// letting the question dangle forever.
+async fn post_cancel_question(
+    State(state): State<AppState>,
+    AxumPath(id): AxumPath<i64>,
+) -> Response {
+    const SENTINEL: &str = "[cancelled]";
+    match state
+        .coord
+        .questions
+        .answer(id, SENTINEL, hive_sh4re::OPERATOR_RECIPIENT)
+    {
+        Ok((question, asker, target)) => {
+            tracing::info!(%id, %asker, "operator cancelled question");
+            state.coord.emit_question_resolved(
+                id,
+                SENTINEL,
+                hive_sh4re::OPERATOR_RECIPIENT,
+                true,
+                target.as_deref(),
+            );
+            state.coord.notify_agent_from(
+                hive_sh4re::OPERATOR_RECIPIENT,
+                &asker,
+                &hive_sh4re::HelperEvent::QuestionAnswered {
+                    id,
+                    question,
+                    answer: SENTINEL.to_owned(),
+                    answerer: hive_sh4re::OPERATOR_RECIPIENT.to_owned(),
+                },
+            );
+            (StatusCode::OK, "ok").into_response()
+        }
+        Err(e) => error_response(&format!("cancel-question {id} failed: {e:#}")),
+    }
+}
+
+#[derive(Deserialize)]
+struct JournalQuery {
+    /// Optional systemd unit filter — e.g. `hive-ag3nt.service`. When
+    /// omitted, returns the full machine journal.
+    #[serde(default)]
+    unit: Option<String>,
+    /// Number of trailing lines to return. Capped at 5000.
+    #[serde(default)]
+    lines: Option<u32>,
+}
+
+/// Shell out to `journalctl -M <container> -b` and return its text
+/// output. Operator-only by virtue of the dashboard being host-bound;
+/// hive-c0re already runs as root in its systemd unit so journalctl
+/// has the access it needs.
+async fn get_journal(
+    AxumPath(name): AxumPath<String>,
+    axum::extract::Query(q): axum::extract::Query<JournalQuery>,
+) -> Response {
+    // Validate the container name against the list of managed
+    // containers so we don't shell out with arbitrary input.
+    let container = strip_container_prefix(&name);
+    let prefixed = if container == lifecycle::MANAGER_NAME {
+        container.clone()
+    } else {
+        format!("{}{container}", lifecycle::AGENT_PREFIX)
+    };
+    let live = lifecycle::list().await.unwrap_or_default();
+    if !live.iter().any(|c| c == &prefixed) {
+        return error_response(&format!("journal: no managed container {prefixed:?}"));
+    }
+    let lines = q.lines.unwrap_or(500).min(5000);
+    let mut cmd = tokio::process::Command::new("journalctl");
+    cmd.args([
+        "-M",
+        &prefixed,
+        "-b",
+        "--no-pager",
+        "--output=short-iso",
+        "--lines",
+    ])
+    .arg(lines.to_string());
+    if let Some(u) = q.unit.as_deref().filter(|s| !s.is_empty()) {
+        // accept hive-ag3nt[.service] / hive-m1nd[.service] — anything
+        // else we refuse, again to keep the shell-out tight.
+        let allowed = ["hive-ag3nt.service", "hive-m1nd.service"];
+        let unit = if u.ends_with(".service") {
+            u.to_owned()
+        } else {
+            format!("{u}.service")
+        };
+        if !allowed.contains(&unit.as_str()) {
+            return error_response(&format!("journal: unknown unit {unit:?}"));
+        }
+        cmd.args(["-u", &unit]);
+    }
+    match cmd.output().await {
+        Ok(out) => {
+            // Combine stdout + stderr — journalctl emits to both on errors.
+            let mut body = String::from_utf8_lossy(&out.stdout).into_owned();
+            if !out.status.success() {
+                body.push_str("\n--- stderr ---\n");
+                body.push_str(&String::from_utf8_lossy(&out.stderr));
+            }
+            ([("content-type", "text/plain; charset=utf-8")], body).into_response()
+        }
+        Err(e) => error_response(&format!("journalctl spawn: {e}")),
+    }
+}
+
+#[derive(Deserialize)]
+struct StateFileQuery {
+    path: String,
+}
+
+/// Bounded-size read of a file under one of two allow-listed
+/// roots: `/var/lib/hyperhive/agents/<n>/state/` (per-agent durable
+/// notes — the only writable path agents have outside their
+/// container) and `/var/lib/hyperhive/shared/` (shared docs). Both
+/// path forms are accepted:
+///   - canonical host:  `/var/lib/hyperhive/agents/alice/state/foo.md`
+///   - container view:  `/agents/alice/state/foo.md`
+///   - shared:          `/shared/foo.md`
+///
+/// `/state/...` on its own is *not* accepted — the in-container
+/// mount is ambiguous from the host's perspective (we don't know
+/// which agent's `/state` it refers to) and using it would silently
+/// resolve to the wrong file.
+///
+/// Path is canonicalised before the allow-list check so `..`
+/// traversal and symlink games can't escape the roots. Files larger
+/// than `MAX_BYTES` are truncated with a banner so a runaway log
+/// can't OOM the browser.
+/// Resolve a caller-supplied path string to a canonical host path
+/// that has been verified against the allow-list. Returns `Err`
+/// with a human-readable reason for every failure mode (path
+/// outside roots, canonicalize failure, escape via symlink,
+/// per-agent subdir not `state`, symlink anywhere below the root,
+/// file not world-readable). Shared by `get_state_file` (read) and
+/// `scan_validated_paths` (linkify candidates in message bodies)
+/// so both apply identical security rules and the linkifier
+/// doesn't render a path the reader will refuse to serve.
+///
+/// Defense-in-depth layers (in order):
+/// 1. Caller-supplied prefix has to match the allow-list (agents/
+///    or shared/), else reject without touching the fs.
+/// 2. No symlinks below the matched root. Walked pre-canonicalize
+///    via `symlink_metadata` on each component so a sub-agent that
+///    plants `ln -s /var/lib/hyperhive/agents/other/state/secret
+///    /agents/me/state/peek` can't proxy a different agent's file
+///    through this endpoint (canonicalize would happily resolve
+///    the symlink to a path inside the allow-list).
+/// 3. Canonicalize is run anyway as a belt-and-braces check —
+///    resolves `..`/`.` traversal and rejects if the result
+///    escapes the roots.
+/// 4. Under `AGENTS_ROOT`, the second path component must be
+///    `state/` — agents' applied/proposed git repos and config dirs
+///    are off-limits.
+/// 5. The target's metadata is fetched once and returned to the
+///    caller so they don't restat. If the target is a regular
+///    file it must be world-readable (mode & 0o004); a 0600 file
+///    inside `state/` could leak through this endpoint to anyone
+///    holding the dashboard URL otherwise.
+fn resolve_state_path(
+    raw: &str,
+) -> std::result::Result<(std::path::PathBuf, std::fs::Metadata), String> {
+    use std::os::unix::fs::PermissionsExt as _;
+    const AGENTS_ROOT: &str = "/var/lib/hyperhive/agents";
+    const SHARED_ROOT: &str = "/var/lib/hyperhive/shared";
+    let raw = raw.trim();
+    let (mapped, root): (std::path::PathBuf, &str) =
+        if let Some(rest) = raw.strip_prefix("/agents/") {
+            (
+                std::path::PathBuf::from(format!("{AGENTS_ROOT}/{rest}")),
+                AGENTS_ROOT,
+            )
+        } else if let Some(rest) = raw.strip_prefix("/shared/") {
+            (
+                std::path::PathBuf::from(format!("{SHARED_ROOT}/{rest}")),
+                SHARED_ROOT,
+            )
+        } else if let Some(rest) = raw.strip_prefix(&format!("{AGENTS_ROOT}/")) {
+            (
+                std::path::PathBuf::from(format!("{AGENTS_ROOT}/{rest}")),
+                AGENTS_ROOT,
+            )
+        } else if let Some(rest) = raw.strip_prefix(&format!("{SHARED_ROOT}/")) {
+            (
+                std::path::PathBuf::from(format!("{SHARED_ROOT}/{rest}")),
+                SHARED_ROOT,
+            )
+        } else {
+            return Err(format!("path not in allow-list: {raw}"));
+        };
+    reject_symlinks_below(std::path::Path::new(root), &mapped)?;
+    let canonical = std::fs::canonicalize(&mapped)
+        .map_err(|e| format!("{}: {e}", mapped.display()))?;
+    if !(canonical.starts_with(AGENTS_ROOT) || canonical.starts_with(SHARED_ROOT)) {
+        return Err(format!(
+            "resolved path escapes allow-list: {}",
+            canonical.display()
+        ));
+    }
+    if let Ok(rel) = canonical.strip_prefix(AGENTS_ROOT) {
+        let mut components = rel.components();
+        let _agent = components.next();
+        let dir = components.next().and_then(|c| c.as_os_str().to_str());
+        if dir != Some("state") {
+            return Err(format!(
+                "only per-agent state/ is readable here ({} dir not allowed)",
+                dir.unwrap_or("(root)")
+            ));
+        }
+    }
+    let meta = std::fs::metadata(&canonical)
+        .map_err(|e| format!("stat {}: {e}", canonical.display()))?;
+    if meta.is_file() {
+        let mode = meta.permissions().mode();
+        if mode & 0o004 == 0 {
+            return Err(format!(
+                "{} not world-readable (mode 0{:o}); refusing to proxy non-public file",
+                canonical.display(),
+                mode & 0o777,
+            ));
+        }
+    }
+    Ok((canonical, meta))
+}
+
+/// Walk every path component under `root` and refuse if any of
+/// them is a symlink. The roots themselves (`AGENTS_ROOT`,
+/// `SHARED_ROOT`) are hive-c0re-owned and assumed trusted; only
+/// the parts the agent / operator can plant matter. Components
+/// that don't exist yet are skipped — `canonicalize` reports
+/// non-existence separately, and missing-component checks would
+/// just race the filesystem.
+fn reject_symlinks_below(
+    root: &std::path::Path,
+    mapped: &std::path::Path,
+) -> std::result::Result<(), String> {
+    let Ok(rel) = mapped.strip_prefix(root) else {
+        return Ok(());
+    };
+    let mut cumulative = root.to_path_buf();
+    for component in rel.components() {
+        match component {
+            std::path::Component::Normal(name) => {
+                cumulative.push(name);
+                match std::fs::symlink_metadata(&cumulative) {
+                    Ok(m) if m.file_type().is_symlink() => {
+                        return Err(format!(
+                            "symlink at {} not allowed (canonicalize would resolve it past the \
+                             allow-list check; refuse outright)",
+                            cumulative.display()
+                        ));
+                    }
+                    Ok(_) | Err(_) => {}
+                }
+            }
+            std::path::Component::ParentDir => {
+                return Err(format!(
+                    "path contains `..` traversal below {}; refuse outright",
+                    root.display()
+                ));
+            }
+            _ => {}
+        }
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::os::unix::fs::symlink;
+
+    /// Make a unique tmp subdir for the calling test. Caller is responsible
+    /// for cleanup (we leak on panic, fine for ephemeral CI runs).
+    fn tmproot(tag: &str) -> std::path::PathBuf {
+        let ts = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .map(|d| d.as_nanos())
+            .unwrap_or(0);
+        let p = std::env::temp_dir().join(format!("hyperhive-test-{tag}-{ts}"));
+        std::fs::create_dir_all(&p).unwrap();
+        p
+    }
+
+    #[test]
+    fn reject_symlinks_below_accepts_plain_dirs_and_files() {
+        let root = tmproot("symlink-ok");
+        std::fs::create_dir_all(root.join("alice/state")).unwrap();
+        std::fs::write(root.join("alice/state/notes.md"), b"hi").unwrap();
+        assert!(reject_symlinks_below(&root, &root.join("alice/state/notes.md")).is_ok());
+    }
+
+    #[test]
+    fn reject_symlinks_below_rejects_leaf_symlink() {
+        let root = tmproot("symlink-leaf");
+        std::fs::create_dir_all(root.join("alice/state")).unwrap();
+        // Plant a symlink that points anywhere; resolve_state_path's
+        // canonicalize would happily resolve it past the allow-list
+        // check, so we have to refuse at the un-canonical layer.
+        symlink("/etc/shadow", root.join("alice/state/peek")).unwrap();
+        let err = reject_symlinks_below(&root, &root.join("alice/state/peek")).unwrap_err();
+        assert!(err.contains("symlink at"), "msg = {err}");
+        assert!(err.contains("peek"), "msg = {err}");
+    }
+
+    #[test]
+    fn reject_symlinks_below_rejects_directory_symlink_in_middle() {
+        let root = tmproot("symlink-mid");
+        std::fs::create_dir_all(root.join("real/state")).unwrap();
+        std::fs::write(root.join("real/state/secret.md"), b"hi").unwrap();
+        // alice's "state" dir is actually a symlink to real/state — a
+        // sub-agent shouldn't be able to plant this and proxy real's
+        // private files via the dashboard.
+        std::fs::create_dir_all(root.join("alice")).unwrap();
+        symlink(root.join("real/state"), root.join("alice/state")).unwrap();
+        let err = reject_symlinks_below(&root, &root.join("alice/state/secret.md")).unwrap_err();
+        assert!(err.contains("symlink at"), "msg = {err}");
+    }
+
+    #[test]
+    fn reject_symlinks_below_rejects_parent_dir_traversal() {
+        let root = tmproot("symlink-dotdot");
+        // `..` doesn't survive canonicalize anyway, but we want a
+        // friendlier error than "path escapes allow-list" — refusing
+        // upfront also avoids walking ancestors with `symlink_metadata`.
+        let p = root.join("alice/state/../escape");
+        let err = reject_symlinks_below(&root, &p).unwrap_err();
+        assert!(err.contains("`..`"), "msg = {err}");
+    }
+
+    #[test]
+    fn reject_symlinks_below_passes_through_when_path_not_under_root() {
+        // resolve_state_path's earlier allow-list check would reject
+        // this; reject_symlinks_below stays a no-op so the caller
+        // surfaces the better-fit error.
+        let root = std::path::Path::new("/var/lib/hyperhive/agents");
+        assert!(reject_symlinks_below(root, std::path::Path::new("/etc/shadow")).is_ok());
+    }
+}
+
+/// Snapshot the current tombstone list and emit a
+/// `TombstonesChanged` event. Call after any mutation that could
+/// add or remove a tombstone (`actions::destroy`,
+/// `post_purge_tombstone`, spawn finalisation). Cheap — the list
+/// is tiny.
+pub(crate) async fn emit_tombstones_snapshot(coord: &Arc<Coordinator>) {
+    let containers = coord.containers_snapshot().await;
+    let transient_snapshot = coord.transient_snapshot();
+    let tombstones = build_tombstone_views(coord, &containers, &transient_snapshot);
+    coord.emit_dashboard_event(
+        crate::dashboard_events::DashboardEvent::TombstonesChanged {
+            seq: coord.next_seq(),
+            tombstones,
+        },
+    );
+}
+
+/// Snapshot meta/flake.lock's root inputs + emit
+/// `MetaInputsChanged`. Call after any mutation that bumps a lock
+/// (`run_meta_update`, `auto_update::rebuild_agent`).
+pub(crate) fn emit_meta_inputs_snapshot(coord: &Coordinator) {
+    let inputs = read_meta_inputs();
+    coord.emit_dashboard_event(
+        crate::dashboard_events::DashboardEvent::MetaInputsChanged {
+            seq: coord.next_seq(),
+            inputs,
+        },
+    );
+}
+
+/// Scan `body` for path-shaped tokens, validate each against the
+/// allow-list, return the unique set of tokens that resolve to a
+/// regular file. Called at broker-message ingest time so the
+/// dashboard event already carries the verified set — no client-
+/// side probe endpoint required, and historical messages get the
+/// same treatment on `/dashboard/history` backfill.
+///
+/// Tokenisation: split on whitespace + a handful of trailing
+/// punctuation chars (`,;:)]}`) that commonly follow paths in
+/// natural-language text but aren't part of the path itself. Any
+/// token starting with `/agents/`, `/shared/`, or
+/// `/var/lib/hyperhive/{agents,shared}/` is a candidate. The
+/// allow-list + `is_file` check happens via the same
+/// `resolve_state_path` helper the read endpoint uses, so the
+/// security rules can't drift.
+pub(crate) fn scan_validated_paths(body: &str) -> Vec<String> {
+    const PREFIXES: [&str; 4] = [
+        "/agents/",
+        "/shared/",
+        "/var/lib/hyperhive/agents/",
+        "/var/lib/hyperhive/shared/",
+    ];
+    let mut out = Vec::<String>::new();
+    for raw in body.split(|c: char| c.is_whitespace()) {
+        // Trim trailing natural-language punctuation that wouldn't
+        // be part of any real path. Inline rather than via a regex
+        // dep — the set is small and the call is hot.
+        let token = raw.trim_end_matches([',', ';', ':', ')', ']', '}', '.', '\'', '"']);
+        if token.is_empty() {
+            continue;
+        }
+        if !PREFIXES.iter().any(|p| token.starts_with(p)) {
+            continue;
+        }
+        // Cheap dedupe — typical message has 0-3 refs.
+        if out.iter().any(|s| s == token) {
+            continue;
+        }
+        if let Ok((_canonical, meta)) = resolve_state_path(token)
+            && meta.is_file()
+        {
+            out.push(token.to_owned());
+        }
+    }
+    out
+}
+
+async fn get_state_file(
+    axum::extract::Query(q): axum::extract::Query<StateFileQuery>,
+) -> Response {
+    const MAX_BYTES: usize = 1 << 20; // 1 MiB
+    let (canonical, meta) = match resolve_state_path(&q.path) {
+        Ok(pair) => pair,
+        Err(e) => return error_response(&format!("state-file: {e}")),
+    };
+    if !meta.is_file() {
+        return error_response(&format!(
+            "state-file: {} is not a regular file",
+            canonical.display()
+        ));
+    }
+    let size = meta.len();
+    let bytes = match std::fs::read(&canonical) {
+        Ok(b) => b,
+        Err(e) => return error_response(&format!("state-file: read {}: {e}", canonical.display())),
+    };
+    // Raster images: serve the raw bytes with their real content-type
+    // so the dashboard can render them in an <img>. Not truncated —
+    // a clipped binary is corrupt, so over-cap images are rejected
+    // instead. (SVG stays on the text path: it's text, and the client
+    // renders it via a data: URI.)
+    if let Some(ct) = image_content_type(&canonical) {
+        if bytes.len() > MAX_BYTES {
+            return error_response(&format!(
+                "state-file: image {} is {size} bytes, over the {MAX_BYTES}-byte preview cap",
+                canonical.display()
+            ));
+        }
+        return ([("content-type", ct)], bytes).into_response();
+    }
+    let truncated = bytes.len() > MAX_BYTES;
+    let body_bytes = if truncated { &bytes[..MAX_BYTES] } else { &bytes[..] };
+    let mut body = String::from_utf8_lossy(body_bytes).into_owned();
+    if truncated {
+        use std::fmt::Write as _;
+        let _ = write!(body, "\n\n--- truncated at {MAX_BYTES} of {size} bytes ---\n");
+    }
+    ([("content-type", "text/plain; charset=utf-8")], body).into_response()
+}
+
+/// Content-type for a raster image the dashboard can preview in an
+/// `<img>`, keyed off the file extension. `None` for non-image, SVG,
+/// and text files (SVG is served on the text path and rendered
+/// client-side via a `data:` URI).
+fn image_content_type(path: &Path) -> Option<&'static str> {
+    let ext = path.extension()?.to_str()?.to_ascii_lowercase();
+    Some(match ext.as_str() {
+        "png" => "image/png",
+        "jpg" | "jpeg" => "image/jpeg",
+        "gif" => "image/gif",
+        "webp" => "image/webp",
+        "bmp" => "image/bmp",
+        "ico" => "image/x-icon",
+        "avif" => "image/avif",
+        _ => return None,
+    })
+}
+
+async fn api_reminders(State(state): State<AppState>) -> Response {
+    match state.coord.broker.list_pending_reminders() {
+        Ok(rows) => axum::Json(rows).into_response(),
+        Err(e) => error_response(&format!("reminders: {e:#}")),
+    }
+}
+
+/// `GET /api/schedules` — snapshot of every schedule for the
+/// scheduled-prompts tab (#444). Returns the wire shape directly
+/// so the frontend can render without an extra translation layer.
+async fn api_schedules(State(state): State<AppState>) -> Response {
+    match state.coord.scheduled_prompts.list() {
+        Ok(rows) => axum::Json(
+            rows.into_iter()
+                .map(crate::manager_server::schedule_to_wire_public)
+                .collect::<Vec<_>>(),
+        )
+        .into_response(),
+        Err(e) => error_response(&format!("scheduled_prompts list: {e:#}")),
+    }
+}
+
+/// `POST /api/schedules` — operator-direct schedule creation
+/// (mara: "user can add them manually"). Accepts the same
+/// `SchedulePromptPayload` shape as the manager request flow but
+/// skips the approval gate — the operator click *is* the
+/// approval. The schedule lands directly with
+/// `source = Operator` and the worker picks it up at fire time.
+async fn post_schedule_new(
+    State(state): State<AppState>,
+    axum::Json(payload): axum::Json<hive_sh4re::SchedulePromptPayload>,
+) -> Response {
+    if payload.targets.is_empty() {
+        return error_response("schedule must have at least one target");
+    }
+    if payload.body.trim().is_empty() {
+        return error_response("schedule body must be non-empty");
+    }
+    if let Some(0) = payload.interval_seconds {
+        return error_response("interval_seconds must be > 0 (use None for one-shot)");
+    }
+    let new = crate::scheduled_prompts::NewSchedule {
+        owner: hive_sh4re::OPERATOR_RECIPIENT.to_owned(),
+        targets: payload.targets,
+        body: payload.body,
+        first_fire_at_unix: payload.first_fire_at_unix,
+        interval_seconds: payload.interval_seconds,
+        description: payload.description,
+        source: crate::scheduled_prompts::ScheduleSource::Operator,
+    };
+    match state.coord.scheduled_prompts.submit(new) {
+        Ok(id) => axum::Json(serde_json::json!({"id": id})).into_response(),
+        Err(e) => error_response(&format!("schedule submit: {e:#}")),
+    }
+}
+
+/// `POST /api/schedules/{id}/fire-now` — operator-initiated
+/// out-of-band fire of a scheduled prompt (#467). Runs the
+/// per-target fan-out once immediately and reports per-target
+/// outcome counts. Does NOT touch `next_fire_at_unix` on
+/// recurring schedules (their cadence stays intact); one-shot
+/// schedules are consumed (cancelled) by a manual fire — the
+/// operator's intent is "send this now, the scheduled time was
+/// wrong."
+async fn post_schedule_fire_now(
+    State(state): State<AppState>,
+    AxumPath(id): AxumPath<i64>,
+) -> Response {
+    match crate::scheduled_prompts_worker::fire_now(&state.coord, id).await {
+        Ok(report) => axum::Json(report).into_response(),
+        Err(e) => error_response(&format!("fire schedule {id} now: {e:#}")),
+    }
+}
+
+/// `POST /api/rebuild-queue/{id}/cancel` — drop a `Queued` entry
+/// from the rebuild queue (#447). Refuses `Running` / terminal
+/// entries: an in-flight rebuild owns the agent's nix store +
+/// nixos-container update lock and can't be safely interrupted
+/// from the queue side. Always returns 200; the body is
+/// `{"cancelled": true}` on a successful flip from Queued →
+/// Cancelled, `{"cancelled": false}` when the row was Running /
+/// terminal / gone. On success a fresh `RebuildQueueChanged`
+/// snapshot fires so the row's state flip surfaces live.
+async fn post_rebuild_queue_cancel(
+    State(state): State<AppState>,
+    AxumPath(id): AxumPath<u64>,
+) -> Response {
+    let cancelled = state.coord.rebuild_queue.cancel(id);
+    if cancelled {
+        state.coord.emit_rebuild_queue_snapshot();
+        axum::Json(serde_json::json!({"cancelled": true})).into_response()
+    } else {
+        axum::Json(serde_json::json!({"cancelled": false})).into_response()
+    }
+}
+
+#[derive(serde::Deserialize, Default)]
+struct CancelScheduleForm {
+    /// `None` / absent / empty array → cancel whole schedule.
+    #[serde(default)]
+    targets: Option<Vec<String>>,
+}
+
+#[derive(serde::Deserialize, Default)]
+struct EditScheduleForm {
+    #[serde(default)]
+    body: Option<String>,
+    /// Double-`Option` semantics on the wire: missing key = leave
+    /// alone, explicit `null` = clear, value = set. serde's
+    /// `deserialize_with` trick to distinguish missing from null:
+    /// we wrap each editable field in its own helper. Simpler
+    /// here — keep them plain `Option<Option<_>>` and document
+    /// that the dashboard caller passes JSON `null` to clear.
+    #[serde(default, deserialize_with = "deserialize_some")]
+    description: Option<Option<String>>,
+    #[serde(default, deserialize_with = "deserialize_some")]
+    interval_seconds: Option<Option<u64>>,
+    #[serde(default)]
+    next_fire_at_unix: Option<i64>,
+    /// New targets to add. Replace-on-conflict: re-adding a
+    /// previously-cancelled target drops the tombstone and the
+    /// target starts fresh (operator intent on re-add = "this
+    /// target is active again, fresh start").
+    #[serde(default)]
+    targets_add: Option<Vec<String>>,
+    /// Targets to cancel. Same path as `cancel_targets`:
+    /// tombstones preserve audit and the parent schedule
+    /// auto-cancels when no active targets remain.
+    #[serde(default)]
+    targets_remove: Option<Vec<String>>,
+}
+
+/// serde adaptor: turns missing-key into `None`, explicit-null
+/// into `Some(None)`, value into `Some(Some(v))`. Standard trick
+/// for distinguishing "field absent" from "field set to null" in
+/// JSON PATCH bodies.
+fn deserialize_some<'de, T, D>(deserializer: D) -> Result<Option<T>, D::Error>
+where
+    T: serde::Deserialize<'de>,
+    D: serde::Deserializer<'de>,
+{
+    T::deserialize(deserializer).map(Some)
+}
+
+/// `PATCH /api/schedules/{id}` — partial update of an existing
+/// schedule (#474). Mutable fields: `body`, `description`,
+/// `interval_seconds`, `next_fire_at_unix`, plus the target set
+/// via `targets_add` / `targets_remove` (#478). Both target lists
+/// are applied in the same transaction as the scalar fields with
+/// removes-before-adds; re-adding a previously-removed target
+/// resets per-target history (fresh start); draining all targets
+/// auto-cancels the parent schedule. JSON body uses missing-key
+/// = "leave alone", explicit null = "clear" for `description` +
+/// `interval_seconds`. Cancelled schedules are refused — submit
+/// a new one instead. Returns the updated `WireSchedule` so the
+/// caller's post-edit refresh has the new state inline.
+async fn patch_schedule(
+    State(state): State<AppState>,
+    AxumPath(id): AxumPath<i64>,
+    axum::Json(form): axum::Json<EditScheduleForm>,
+) -> Response {
+    let patch = crate::scheduled_prompts::UpdateSchedule {
+        body: form.body,
+        description: form.description,
+        interval_seconds: form.interval_seconds,
+        next_fire_at_unix: form.next_fire_at_unix,
+        targets_add: form.targets_add,
+        targets_remove: form.targets_remove,
+    };
+    if let Err(e) = state.coord.scheduled_prompts.update(id, patch) {
+        return error_response(&format!("edit schedule {id}: {e:#}"));
+    }
+    match state.coord.scheduled_prompts.get(id) {
+        Ok(Some(s)) => {
+            axum::Json(crate::manager_server::schedule_to_wire_public(s)).into_response()
+        }
+        Ok(None) => error_response(&format!("edit schedule {id}: row vanished post-update")),
+        Err(e) => error_response(&format!("re-read schedule {id}: {e:#}")),
+    }
+}
+
+/// `POST /api/schedules/{id}/cancel` — operator-side cancel
+/// (whole schedule when no `targets` field, partial when one is
+/// provided). Operator bypasses the topology check; the manager
+/// surface enforces it for agent callers.
+async fn post_schedule_cancel(
+    State(state): State<AppState>,
+    AxumPath(id): AxumPath<i64>,
+    body: Option<axum::Json<CancelScheduleForm>>,
+) -> Response {
+    let targets = body
+        .and_then(|axum::Json(b)| b.targets)
+        .filter(|t| !t.is_empty());
+    let result = match targets.as_deref() {
+        Some(list) => state.coord.scheduled_prompts.cancel_targets(id, list),
+        None => state.coord.scheduled_prompts.cancel_all(id),
+    };
+    match result {
+        Ok(()) => (StatusCode::OK, "ok").into_response(),
+        Err(e) => error_response(&format!("cancel schedule {id}: {e:#}")),
+    }
+}
+
+/// Same-origin proxy that fetches the named agent's
+/// `GET /api/state` and forwards only the `links` field to the
+/// dashboard JS (issue #262). Lets the agent backend stay the
+/// single source of truth for its own nav links: the dashboard
+/// card's icon-only strip and the per-agent page's labelled row
+/// render the same list, no shared Rust wire type required, no
+/// CORS surface on the agent side.
+///
+/// Failure modes (agent down, slow response, malformed JSON) all
+/// degrade to an empty list so the dashboard still renders.
+async fn get_agent_links(AxumPath(name): AxumPath<String>) -> Response {
+    let port = lifecycle::agent_web_port(&name);
+    let url = format!("http://127.0.0.1:{port}/api/state");
+    let client = match reqwest::Client::builder()
+        .timeout(std::time::Duration::from_secs(2))
+        .build()
+    {
+        Ok(c) => c,
+        Err(e) => {
+            tracing::warn!(%name, error = %e, "agent-links proxy: client build failed");
+            return axum::Json(serde_json::json!([])).into_response();
+        }
+    };
+    match client.get(&url).send().await {
+        Ok(resp) if resp.status().is_success() => match resp.json::<serde_json::Value>().await {
+            Ok(body) => {
+                let links = body.get("links").cloned().unwrap_or_else(|| serde_json::json!([]));
+                axum::Json(links).into_response()
+            }
+            Err(e) => {
+                tracing::debug!(%name, error = %e, "agent-links proxy: response parse failed");
+                axum::Json(serde_json::json!([])).into_response()
+            }
+        },
+        Ok(resp) => {
+            tracing::debug!(%name, status = %resp.status(), "agent-links proxy: non-2xx");
+            axum::Json(serde_json::json!([])).into_response()
+        }
+        Err(e) => {
+            tracing::debug!(%name, error = %e, "agent-links proxy: fetch failed");
+            axum::Json(serde_json::json!([])).into_response()
+        }
+    }
+}
+
+async fn post_cancel_reminder(
+    State(state): State<AppState>,
+    AxumPath(id): AxumPath<i64>,
+) -> Response {
+    match state.coord.broker.cancel_reminder(id) {
+        Ok(0) => error_response(&format!("reminder {id} not pending (already delivered?)")),
+        Ok(_) => {
+            tracing::info!(%id, "operator cancelled reminder");
+            (StatusCode::OK, "ok").into_response()
+        }
+        Err(e) => error_response(&format!("cancel reminder {id} failed: {e:#}")),
+    }
+}
+
+/// Reset a pending reminder's failure state so the scheduler
+/// retries it on the next tick. Useful when the failure was
+/// transient (sqlite lock contention, disk full → freed up) and
+/// the operator wants delivery to resume immediately instead of
+/// the row sitting in attempt-count-capped purgatory.
+async fn post_retry_reminder(
+    State(state): State<AppState>,
+    AxumPath(id): AxumPath<i64>,
+) -> Response {
+    match state.coord.broker.reset_reminder_failure(id) {
+        Ok(0) => error_response(&format!("reminder {id} not pending (already delivered?)")),
+        Ok(_) => {
+            tracing::info!(%id, "operator reset reminder failure for retry");
+            (StatusCode::OK, "ok").into_response()
+        }
+        Err(e) => error_response(&format!("retry reminder {id} failed: {e:#}")),
+    }
+}
+
+async fn post_purge_tombstone(
+    State(state): State<AppState>,
+    AxumPath(name): AxumPath<String>,
+) -> Response {
+    if name == lifecycle::MANAGER_NAME {
+        return error_response("refusing to purge the manager's state");
+    }
+    // Sanity: refuse to purge if a live container still exists with this
+    // name. The dashboard already filters tombstones to non-live names,
+    // but the operator could send a stale POST.
+    let live = lifecycle::list().await.unwrap_or_default();
+    if live
+        .iter()
+        .any(|c| c == &format!("{}{name}", lifecycle::AGENT_PREFIX) || c == &name)
+    {
+        return error_response(&format!(
+            "refusing to purge {name}: container still exists — use DESTR0Y first"
+        ));
+    }
+    let mut errors = Vec::new();
+    for dir in [
+        Coordinator::agent_state_root(&name),
+        Coordinator::agent_applied_dir(&name),
+    ] {
+        if dir.exists()
+            && let Err(e) = std::fs::remove_dir_all(&dir)
+        {
+            errors.push(format!("{}: {e}", dir.display()));
+        }
+    }
+    let _ = state
+        .coord
+        .approvals
+        .fail_pending_for_agent(&name, "agent state purged");
+    if errors.is_empty() {
+        tracing::info!(%name, "tombstone purged");
+        // Fire the post-purge tombstones snapshot so dashboards
+        // drop the row live; matching form carries
+        // `data-no-refresh`.
+        emit_tombstones_snapshot(&state.coord).await;
+        (StatusCode::OK, "ok").into_response()
+    } else {
+        error_response(&format!("purge {name} partial: {}", errors.join(", ")))
+    }
+}
+
+/// Operator-side compose form on the dashboard terminal. Drops a
+/// message into the broker as `{from: "operator", to, body}`. Same
+/// shape that per-agent web UIs use via `OperatorMsg`, but here the
+/// operator picks the recipient explicitly with `@name`. No
+/// validation that `to` resolves to a known agent — broker accepts
+/// arbitrary recipients (and the agent's inbox grows whether or not
+/// they exist, which is fine for spawn-then-greet flows).
+#[derive(Deserialize)]
+struct OpSendForm {
+    to: String,
+    body: String,
+}
+
+/// Form for `POST /meta-update`. Inputs ride in as a comma-separated
+/// list under the `inputs` field — the JS submitter joins the
+/// checked boxes since axum's `Form` extractor doesn't natively
+/// decode repeated keys without a helper.
+#[derive(Deserialize)]
+struct MetaUpdateForm {
+    inputs: String,
+}
+
+/// Bulk-update selected meta flake inputs, then rebuild the affected
+/// agents in the background. Idempotent w.r.t. selection — choosing
+/// an input that's already at the latest sha is a no-op (no commit,
+/// no rebuild ripple). Returns immediately after queueing the work;
+/// dashboard polls for progress via container `pending` spinners +
+/// the meta-inputs row sha update.
+async fn post_meta_update(
+    State(state): State<AppState>,
+    Form(form): Form<MetaUpdateForm>,
+) -> Response {
+    let inputs: Vec<String> = form
+        .inputs
+        .split(',')
+        .map(|s| s.trim().to_owned())
+        .filter(|s| !s.is_empty())
+        .collect();
+    if inputs.is_empty() {
+        return error_response("meta-update: no inputs selected");
+    }
+    let inputs_label = inputs.join(", ");
+    let parent_id = state.coord.rebuild_queue.enqueue_with_inputs(
+        crate::rebuild_queue::QueueKind::MetaUpdate,
+        "hyperhive".to_owned(),
+        crate::rebuild_queue::QueueSource::Manual,
+        format!("meta-update via dashboard ({inputs_label})"),
+        None,
+        inputs.clone(),
+    );
+    // Pre-enqueue cascade rebuilds NOW so they're visible in the queue
+    // alongside the parent (issue #347). The worker's MetaUpdate arm
+    // no longer enqueues children — it just runs the lock bump and
+    // (on failure) cancels these pre-queued children.
+    let cascade_agents = crate::rebuild_queue::meta_update_cascade_agents(&inputs).await;
+    let cascade_reason = format!("meta-update cascade ({inputs_label})");
+    for name in cascade_agents {
+        state.coord.rebuild_queue.enqueue(
+            crate::rebuild_queue::QueueKind::Rebuild,
+            name,
+            crate::rebuild_queue::QueueSource::MetaUpdate,
+            cascade_reason.clone(),
+            Some(parent_id),
+        );
+    }
+    state.coord.emit_rebuild_queue_snapshot();
+    (StatusCode::OK, "ok").into_response()
+}
+
+async fn post_op_send(State(state): State<AppState>, Form(form): Form<OpSendForm>) -> Response {
+    let to = form.to.trim().to_owned();
+    let body = form.body.trim().to_owned();
+    if to.is_empty() {
+        return error_response("op-send: `to` required");
+    }
+    if body.is_empty() {
+        return error_response("op-send: `body` required");
+    }
+    if to == "*" {
+        let errors = state
+            .coord
+            .broadcast_send(hive_sh4re::OPERATOR_RECIPIENT, &body);
+        if !errors.is_empty() {
+            return error_response(&format!("op-send broadcast partial fail: {}", errors.join("; ")));
+        }
+    } else if let Err(e) = state.coord.broker.send(&hive_sh4re::Message {
+        from: hive_sh4re::OPERATOR_RECIPIENT.to_owned(),
+        to: to.clone(),
+        body,
+        in_reply_to: None,
+    }) {
+        return error_response(&format!("op-send to {to} failed: {e:#}"));
+    }
+    // 200 instead of 303 → the client doesn't refetch /api/state. The
+    // broker `send` already emitted a `MessageEvent` which the
+    // dashboard channel forwarder mirrors as `DashboardEvent::Sent`,
+    // and the page's terminal + inbox derive from that stream — so the
+    // operator's send shows up the same way an agent's send does, with
+    // no full-state refresh in between.
+    (axum::http::StatusCode::OK, "ok").into_response()
+}
+
+async fn post_request_spawn(
+    State(state): State<AppState>,
+    Form(form): Form<RequestSpawnForm>,
+) -> Response {
+    let name = form.name.trim().to_owned();
+    if name.is_empty() {
+        return error_response("spawn: `name` required");
+    }
+    match state
+        .coord
+        .approvals
+        .submit_kind(&name, hive_sh4re::ApprovalKind::Spawn, "", None)
+    {
+        Ok(id) => {
+            tracing::info!(%id, %name, "operator: spawn approval queued via dashboard");
+            // Phase 5b: notify the dashboard event channel so live
+            // subscribers can append the row without a snapshot
+            // refetch. Spawn approvals carry no diff/sha.
+            state
+                .coord
+                .emit_approval_added(id, &name, "spawn", None, None, None);
+            (StatusCode::OK, "ok").into_response()
+        }
+        Err(e) => error_response(&format!("request-spawn {name} failed: {e:#}")),
+    }
+}
+
+/// `POST /api/topology/set-parent` — operator-driven parent move
+/// (#486). Form fields: `child` (required, agent name), `new_parent`
+/// (optional — empty / absent string ⇒ promote to root). Refuses
+/// cycles, unknown agents, and reparenting the manager. On success
+/// re-emits container snapshots so the dashboard tree repaints
+/// without a refresh.
+async fn post_set_parent(
+    State(state): State<AppState>,
+    Form(form): Form<SetParentForm>,
+) -> Response {
+    let child = form.child.trim().to_owned();
+    if child.is_empty() {
+        return error_response("set-parent: `child` required");
+    }
+    // Empty / whitespace-only `new_parent` ⇒ promote to root. Web
+    // forms submit the empty string for a "no value" radio button,
+    // so this is the ergonomic encoding.
+    let new_parent = form
+        .new_parent
+        .as_deref()
+        .map(str::trim)
+        .filter(|s| !s.is_empty())
+        .map(str::to_owned);
+    match crate::topology::set_parent(&child, new_parent.as_deref()) {
+        Ok(()) => {
+            tracing::info!(
+                child = %child,
+                new_parent = ?new_parent,
+                "operator: set-parent via dashboard"
+            );
+            // Topology drives ContainerView.parent; refresh the
+            // snapshot so connected viewers see the new tree.
+            state.coord.rescan_containers_and_emit().await;
+            (StatusCode::OK, "ok").into_response()
+        }
+        Err(e) => error_response(&format!("set-parent {child} failed: {e}")),
+    }
+}
+
+async fn post_rebuild(State(state): State<AppState>, AxumPath(name): AxumPath<String>) -> Response {
+    let logical = strip_container_prefix(&name);
+    state.coord.rebuild_queue.enqueue(
+        crate::rebuild_queue::QueueKind::Rebuild,
+        logical,
+        crate::rebuild_queue::QueueSource::Manual,
+        "manual via dashboard ↻ R3BU1LD button".to_owned(),
+        None,
+    );
+    state.coord.emit_rebuild_queue_snapshot();
+    (StatusCode::OK, "ok").into_response()
+}
+
+/// Common shape for the simple lifecycle action handlers (start /
+/// stop / restart / rebuild): strip the container prefix, mark
+/// transient for the duration so the dashboard can spinner, run the
+/// lifecycle op, clear transient, redirect on success or surface the
+/// error. `verb` only appears in the error message; `extra` runs on
+/// success after `clear_transient` for handlers that need follow-up
+/// (e.g. `kill` also unregisters the agent + fires `HelperEvent`).
+async fn lifecycle_action<F, Fut>(
+    state: &AppState,
+    name: &str,
+    kind: crate::coordinator::TransientKind,
+    verb: &str,
+    body: F,
+    extra: impl FnOnce(&AppState, &str),
+) -> Response
+where
+    F: FnOnce(String) -> Fut,
+    Fut: std::future::Future<Output = anyhow::Result<()>>,
+{
+    let logical = strip_container_prefix(name);
+    let guard = state.coord.transient_guard(&logical, kind);
+    let result = body(logical.clone()).await;
+    drop(guard);
+    match result {
+        Ok(()) => {
+            extra(state, &logical);
+            // Rescan so the running/needs_login/needs_update flip on
+            // the affected row lands on every dashboard's SSE channel
+            // without waiting for a snapshot poll. 200 + matching
+            // `data-no-refresh` on the form skip the post-submit
+            // /api/state refetch.
+            state.coord.rescan_containers_and_emit().await;
+            (StatusCode::OK, "ok").into_response()
+        }
+        Err(e) => error_response(&format!("{verb} {logical} failed: {e:#}")),
+    }
+}
+
+async fn post_kill(State(state): State<AppState>, AxumPath(name): AxumPath<String>) -> Response {
+    // #443: manager is stoppable from the dashboard like any other
+    // agent. The host's dashboard server keeps running (it's
+    // hive-c0re, not the manager container), per-agent approvals
+    // submitted by other sub-agents still process through the
+    // host-side approval queue without the manager up, and
+    // operator-driven meta-input updates work from the dashboard
+    // either way. The MCP-surface self-kill guard in
+    // `manager_server.rs::ManagerRequest::Kill` stays in place: a
+    // manager calling Kill on its own container is self-suicide
+    // mid-call, not a legitimate operator action.
+    lifecycle_action(
+        &state,
+        &name,
+        crate::coordinator::TransientKind::Stopping,
+        "kill",
+        |n| async move { lifecycle::kill(&n).await },
+        |s, n| {
+            s.coord.unregister_agent(n);
+            s.coord.notify_manager(&hive_sh4re::HelperEvent::Killed {
+                agent: n.to_owned(),
+            });
+        },
+    )
+    .await
+}
+
+async fn post_restart(State(state): State<AppState>, AxumPath(name): AxumPath<String>) -> Response {
+    lifecycle_action(
+        &state,
+        &name,
+        crate::coordinator::TransientKind::Restarting,
+        "restart",
+        |n| async move { lifecycle::restart(&n).await },
+        |s, n| s.coord.kick_agent(n, "container restarted"),
+    )
+    .await
+}
+
+async fn post_start(State(state): State<AppState>, AxumPath(name): AxumPath<String>) -> Response {
+    lifecycle_action(
+        &state,
+        &name,
+        crate::coordinator::TransientKind::Starting,
+        "start",
+        |n| async move { lifecycle::start(&n).await },
+        |s, n| s.coord.kick_agent(n, "container started"),
+    )
+    .await
+}
+
+async fn post_update_all(State(state): State<AppState>) -> Response {
+    let containers = lifecycle::list().await.unwrap_or_default();
+    for container in containers {
+        let logical = if container == lifecycle::MANAGER_NAME {
+            lifecycle::MANAGER_NAME.to_owned()
+        } else if let Some(n) = container.strip_prefix(lifecycle::AGENT_PREFIX) {
+            n.to_owned()
+        } else {
+            continue;
+        };
+        state.coord.rebuild_queue.enqueue(
+            crate::rebuild_queue::QueueKind::Rebuild,
+            logical,
+            crate::rebuild_queue::QueueSource::Manual,
+            "manual via dashboard 🌀 UPDATE ALL".to_owned(),
+            None,
+        );
+    }
+    state.coord.emit_rebuild_queue_snapshot();
+    (StatusCode::OK, "ok").into_response()
+}
+
+fn transient_label(k: crate::coordinator::TransientKind) -> &'static str {
+    use crate::coordinator::TransientKind::{
+        Destroying, Rebuilding, Restarting, Spawning, Starting, Stopping,
+    };
+    match k {
+        Spawning => "spawning",
+        Starting => "starting",
+        Stopping => "stopping",
+        Restarting => "restarting",
+        Rebuilding => "rebuilding",
+        Destroying => "destroying",
+    }
+}
+
+/// Convert either a logical name or a container name back to the logical
+/// name. Sub-agents are `h-foo` → `foo`; manager stays `hm1nd`.
+fn strip_container_prefix(name: &str) -> String {
+    name.strip_prefix(lifecycle::AGENT_PREFIX)
+        .unwrap_or(name)
+        .to_owned()
+}
+
+#[derive(Deserialize, Default)]
+struct DestroyForm {
+    #[serde(default)]
+    purge: Option<String>,
+}
+
+async fn post_destroy(
+    State(state): State<AppState>,
+    AxumPath(name): AxumPath<String>,
+    Form(form): Form<DestroyForm>,
+) -> Response {
+    // Checkbox semantics: any non-empty value (axum sends "on") = purge.
+    let purge = form.purge.as_deref().is_some_and(|v| !v.is_empty());
+    // `actions::destroy` rescans the container list on success, so the
+    // `ContainerRemoved` event lands before we return 200. The matching
+    // form carries `data-no-refresh`.
+    match actions::destroy(&state.coord, &name, purge).await {
+        Ok(()) => (StatusCode::OK, "ok").into_response(),
+        Err(e) => error_response(&format!("destroy {name} failed: {e:#}")),
+    }
+}
+
+fn error_response(message: &str) -> Response {
+    // Plain text — the JS app surfaces this in an alert(), so HTML
+    // wrapping would just clutter the message.
+    (StatusCode::INTERNAL_SERVER_ERROR, message.to_owned()).into_response()
+}
+
+/// Filter out approvals whose agent state dir was wiped out from under us
+/// (e.g. by a test script's cleanup). Marks them failed so they fall out of
+/// `pending` on next render.
+fn gc_orphans(coord: &Coordinator, approvals: Vec<Approval>) -> Vec<Approval> {
+    approvals
+        .into_iter()
+        .filter(|a| {
+            // Spawn and InitConfig approvals are for not-yet-existent agents;
+            // the proposed dir is supposed to be missing.
+            if matches!(
+                a.kind,
+                hive_sh4re::ApprovalKind::Spawn | hive_sh4re::ApprovalKind::InitConfig
+            ) {
+                return true;
+            }
+            if Coordinator::agent_proposed_dir(&a.agent).exists() {
+                true
+            } else {
+                let note = "agent state dir missing";
+                let _ = coord.approvals.mark_failed(a.id, note);
+                tracing::info!(id = a.id, agent = %a.agent, "auto-failed orphan approval");
+                let sha_short = a
+                    .fetched_sha
+                    .as_deref()
+                    .map(|s| s[..s.len().min(12)].to_owned());
+                coord.emit_approval_resolved(
+                    a.id,
+                    &a.agent,
+                    "apply_commit",
+                    sha_short,
+                    "failed",
+                    Some(note.to_owned()),
+                    a.description.clone(),
+                );
+                false
+            }
+        })
+        .collect()
+}
+
+
+/// Multi-file unified diff between the currently-deployed tree and
+/// the proposal for this approval. Runs against the applied repo
+/// since the canonical proposal commit lives there (manager-side
+/// amendments don't move it). Empty output means proposal == main —
+/// a no-op approval.
+///
+/// `pub(crate)` so the manager-socket handler can pre-compute the
+/// diff once at submission time and embed it in the `ApprovalAdded`
+/// dashboard event (instead of forcing the dashboard to wait a
+/// `/api/state` cycle to see the diff for newly-queued approvals).
+pub(crate) async fn approval_diff(agent: &str, approval_id: i64) -> String {
+    let applied = Coordinator::agent_applied_dir(agent);
+    if !applied.join(".git").exists() {
+        return format!("(no applied git repo at {})", applied.display());
+    }
+    let proposal_ref = format!("refs/tags/proposal/{approval_id}");
+    match git_diff_refs(&applied, "refs/heads/main", &proposal_ref).await {
+        Ok(s) if s.is_empty() => "(proposal matches currently-deployed tree)".to_owned(),
+        Ok(s) => s,
+        Err(e) => format!("(error: {e:#})"),
+    }
+}
+
+async fn git_diff_refs(applied_dir: &Path, base_ref: &str, target_ref: &str) -> Result<String> {
+    let out = lifecycle::git_command()
+        .current_dir(applied_dir)
+        .args(["diff", &format!("{base_ref}..{target_ref}")])
+        .output()
+        .await
+        .with_context(|| format!("spawn `git diff` in {}", applied_dir.display()))?;
+    if !out.status.success() {
+        anyhow::bail!(
+            "git diff {base_ref}..{target_ref} failed: {}",
+            String::from_utf8_lossy(&out.stderr).trim()
+        );
+    }
+    Ok(String::from_utf8_lossy(&out.stdout).into_owned())
+}
+
+/// Numeric ids of `<prefix>/<n>` tags in the applied repo (e.g.
+/// `proposal/3` → `3`). Unparseable suffixes are skipped. Used to
+/// resolve the `approved` / `previous` diff bases for an approval.
+async fn tag_ids(applied_dir: &Path, prefix: &str) -> Vec<i64> {
+    let Ok(out) = lifecycle::git_command()
+        .current_dir(applied_dir)
+        .args(["tag", "-l", &format!("{prefix}/*")])
+        .output()
+        .await
+    else {
+        return Vec::new();
+    };
+    if !out.status.success() {
+        return Vec::new();
+    }
+    let strip = format!("{prefix}/");
+    String::from_utf8_lossy(&out.stdout)
+        .lines()
+        .filter_map(|l| l.trim().strip_prefix(&strip))
+        .filter_map(|s| s.parse::<i64>().ok())
+        .collect()
+}
+
+#[derive(Deserialize)]
+struct DiffBaseQuery {
+    /// `applied` (running tree — default), `approved` (most recent
+    /// earlier approved proposal), or `previous` (the prior queued
+    /// proposal for this agent).
+    base: Option<String>,
+}
+
+/// On-demand unified diff for one `ApplyCommit` approval against a
+/// chosen base. `applied` = `applied/main` (what's running);
+/// `approved` = the most recent earlier `approved/<n>` tag (the last
+/// proposal the operator OK'd, even if its build then failed);
+/// `previous` = the prior queued `proposal/<n>` (the incremental
+/// delta when the manager chains proposals). Returns the raw diff
+/// text — the dashboard classifies lines client-side.
+async fn get_approval_diff(
+    State(state): State<AppState>,
+    AxumPath(id): AxumPath<i64>,
+    axum::extract::Query(q): axum::extract::Query<DiffBaseQuery>,
+) -> Response {
+    let base = q.base.as_deref().unwrap_or("applied");
+    let approval = match state.coord.approvals.get(id) {
+        Ok(Some(a)) => a,
+        Ok(None) => return error_response(&format!("approval {id} not found")),
+        Err(e) => return error_response(&format!("approval {id}: {e:#}")),
+    };
+    if !matches!(approval.kind, hive_sh4re::ApprovalKind::ApplyCommit) {
+        return error_response("spawn approvals carry no commit to diff");
+    }
+    let applied = Coordinator::agent_applied_dir(&approval.agent);
+    if !applied.join(".git").exists() {
+        return plain_text(format!("(no applied git repo at {})", applied.display()));
+    }
+    let target = format!("refs/tags/proposal/{id}");
+    let base_ref = match base {
+        "applied" => Some("refs/heads/main".to_owned()),
+        "approved" => {
+            let ids = tag_ids(&applied, "approved").await;
+            ids.into_iter()
+                .filter(|&n| n != id)
+                .max()
+                .map(|n| format!("refs/tags/approved/{n}"))
+        }
+        "previous" => {
+            let ids = tag_ids(&applied, "proposal").await;
+            ids.into_iter()
+                .filter(|&n| n < id)
+                .max()
+                .map(|n| format!("refs/tags/proposal/{n}"))
+        }
+        other => return error_response(&format!("unknown diff base {other:?}")),
+    };
+    let Some(base_ref) = base_ref else {
+        return plain_text(match base {
+            "approved" => "(no earlier approved proposal to diff against)".to_owned(),
+            _ => "(no previous proposal to diff against)".to_owned(),
+        });
+    };
+    match git_diff_refs(&applied, &base_ref, &target).await {
+        Ok(s) if s.is_empty() => plain_text("(identical — no changes vs this base)".to_owned()),
+        Ok(s) => plain_text(s),
+        Err(e) => error_response(&format!("git diff: {e:#}")),
+    }
+}
+
+fn plain_text(body: String) -> Response {
+    (StatusCode::OK, body).into_response()
+}
+
diff --git a/hive-c0re/src/dashboard_events.rs b/hive-c0re/src/dashboard_events.rs
new file mode 100644
index 00000000..0ae794a8
--- /dev/null
+++ b/hive-c0re/src/dashboard_events.rs
@@ -0,0 +1,377 @@
+//! Unified dashboard event channel.
+//!
+//! Anything the browser wants to react to in near-real-time flows through
+//! `Coordinator.dashboard_events`. Each event is stamped with a monotonic
+//! per-process `seq` so the client can dedupe its buffered live traffic
+//! against snapshot/history responses (drop frames with
+//! `seq <= snapshot.seq`).
+//!
+//! Why one channel instead of one-per-domain: browsers cap concurrent
+//! SSE connections per origin (~6 in chrome) and dispatch-by-kind on the
+//! client is a one-liner. Splits get reserved for high-volume sub-streams
+//! that most consumers don't care about (none yet).
+//!
+//! Message-broker traffic (`Sent` / `Delivered`) lives on this channel
+//! too. A background forwarder task in `main.rs` subscribes to the broker
+//! and re-emits each `MessageEvent` as a `DashboardEvent::Sent` /
+//! `DashboardEvent::Delivered` with a freshly-stamped seq. Keeping the
+//! broker's intra-process channel separate avoids coupling the broker
+//! (used by `recv_blocking_batch` inside the harness loop) to dashboard
+//! presentation concerns.
+//!
+//! New mutation kinds (approval added/resolved, question added/answered,
+//! transient changed, etc.) land here as additional variants. The client
+//! dispatches by `kind` and updates the relevant section.
+
+use serde::Serialize;
+
+use crate::container_view::ContainerView;
+use crate::dashboard::{MetaInputView, TombstoneView};
+use crate::rebuild_queue::QueueEntry;
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "snake_case", tag = "kind")]
+pub enum DashboardEvent {
+    /// Broker `Sent` event mirrored onto the dashboard channel.
+    /// `file_refs` carries every path-shaped token in `body` that
+    /// hive-c0re verified is a regular file under the allow-listed
+    /// roots (per-agent `state/` + `shared/`). The forwarder
+    /// pre-validates so the dashboard doesn't need a probe
+    /// endpoint — the client renders anchors only for tokens that
+    /// appear in this list, everything else stays plain text.
+    Sent {
+        seq: u64,
+        /// Broker row id. Allows the dashboard to track reply threads.
+        id: i64,
+        from: String,
+        to: String,
+        body: String,
+        at: i64,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        in_reply_to: Option<i64>,
+        #[serde(default, skip_serializing_if = "Vec::is_empty")]
+        file_refs: Vec<String>,
+    },
+    /// Broker `Delivered` event mirrored onto the dashboard channel.
+    /// `file_refs` is the same shape as `Sent`.
+    Delivered {
+        seq: u64,
+        /// Broker row id. Allows the dashboard to track reply threads.
+        id: i64,
+        from: String,
+        to: String,
+        body: String,
+        at: i64,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        in_reply_to: Option<i64>,
+        #[serde(default, skip_serializing_if = "Vec::is_empty")]
+        file_refs: Vec<String>,
+    },
+    /// A new approval landed in the pending queue. Payload carries
+    /// enough to render the dashboard row without a `/api/state`
+    /// refetch (`diff` is the raw unified diff text, same shape the
+    /// snapshot ships).
+    ///
+    /// The approval's own kind (`"apply_commit"` / `"spawn"`) lives on
+    /// `approval_kind` rather than `kind` because the latter is taken
+    /// by the serde tag identifying which `DashboardEvent` variant
+    /// this is.
+    ApprovalAdded {
+        seq: u64,
+        id: i64,
+        agent: String,
+        approval_kind: &'static str,
+        sha_short: Option<String>,
+        diff: Option<String>,
+        description: Option<String>,
+    },
+    /// A pending approval transitioned to a terminal state
+    /// (approved / denied / failed). Clients move the row out of the
+    /// pending list and into history.
+    ApprovalResolved {
+        seq: u64,
+        id: i64,
+        agent: String,
+        approval_kind: &'static str,
+        sha_short: Option<String>,
+        /// `"approved"` / `"denied"` / `"failed"`.
+        status: &'static str,
+        resolved_at: i64,
+        note: Option<String>,
+        description: Option<String>,
+    },
+    /// A question landed in the queue. `target = None` means
+    /// operator-targeted (`Ask { to: None | Some("operator") }`);
+    /// `target = Some(<agent>)` means a peer-to-peer question. Both
+    /// are surfaced on the dashboard so the operator can monitor /
+    /// override-answer stuck threads.
+    QuestionAdded {
+        seq: u64,
+        id: i64,
+        asker: String,
+        question: String,
+        options: Vec<String>,
+        multi: bool,
+        asked_at: i64,
+        deadline_at: Option<i64>,
+        target: Option<String>,
+        /// Verified file-path tokens that appear in `question`.
+        /// Same shape as broker `Sent`/`Delivered` events; the
+        /// client linkifies only what hive-c0re vouched for.
+        #[serde(default, skip_serializing_if = "Vec::is_empty")]
+        question_refs: Vec<String>,
+    },
+    /// A question was answered (operator answer, peer answer,
+    /// operator override on a peer thread, or ttl watchdog
+    /// `[expired]`). Clients move the row from pending to history.
+    /// `cancelled = true` when the operator dismissed via the cancel
+    /// button.
+    QuestionResolved {
+        seq: u64,
+        id: i64,
+        answer: String,
+        answerer: String,
+        answered_at: i64,
+        cancelled: bool,
+        target: Option<String>,
+        /// Verified file-path tokens that appear in `answer`.
+        #[serde(default, skip_serializing_if = "Vec::is_empty")]
+        answer_refs: Vec<String>,
+    },
+    /// A lifecycle action started for an agent (spawn / start / stop
+    /// / restart / rebuild / destroy). Clients render a spinner next
+    /// to the row; the client computes "seconds in this state"
+    /// locally from `since_unix` so a slow rebuild's elapsed time
+    /// ticks without polling.
+    TransientSet {
+        seq: u64,
+        name: String,
+        /// Lifecycle kind: `"spawning"` / `"starting"` / `"stopping"` /
+        /// `"restarting"` / `"rebuilding"` / `"destroying"`.
+        transient_kind: &'static str,
+        since_unix: i64,
+    },
+    /// The matching lifecycle action resolved (success or failure).
+    /// Clients drop the spinner row.
+    TransientCleared { seq: u64, name: String },
+    /// One container row changed — new container appeared (post-spawn
+    /// finalise), an existing one flipped `running` / `needs_update` /
+    /// `sha`, etc. Clients upsert by `container.name`. Payload carries
+    /// the full row so cold-loaded clients and event-driven clients
+    /// converge on the same render.
+    ///
+    /// Fired by `Coordinator::rescan_containers_and_emit`, which diffs
+    /// a fresh `nixos-container list`–derived snapshot against the
+    /// last one cached on the coordinator. Mutation sites (lifecycle
+    /// endpoints, `actions::destroy` / approve, `crash_watch`'s poll loop)
+    /// call the rescan after their work lands.
+    ContainerStateChanged {
+        seq: u64,
+        container: ContainerView,
+    },
+    /// A container that was in the previous snapshot is gone. Clients
+    /// drop the row by name. Fired alongside any
+    /// `nixos-container destroy` (operator-driven or otherwise) on the
+    /// next rescan.
+    ContainerRemoved { seq: u64, name: String },
+    /// Full snapshot of the tombstones list. Emitted on every
+    /// mutation that could add / remove a tombstone: destroy
+    /// (with or without purge), purge-tombstone, spawn approval
+    /// (which can consume a tombstone of the same name). Snapshot
+    /// shape (not diff) because the list is tiny (single-digit
+    /// typical) and recomputing avoids the add/remove races a
+    /// per-row event would have.
+    TombstonesChanged {
+        seq: u64,
+        tombstones: Vec<TombstoneView>,
+    },
+    /// Full snapshot of `meta/flake.lock`'s root inputs. Emitted
+    /// after every operation that bumps a lock: `meta-update`,
+    /// `rebuild_agent` (lock bumps via two-phase staging),
+    /// `update-all`. Same snapshot-shape rationale as
+    /// `TombstonesChanged` — the list is small (one row per agent
+    /// plus their fetched inputs).
+    MetaInputsChanged {
+        seq: u64,
+        inputs: Vec<MetaInputView>,
+    },
+    /// A dashboard-triggered `meta-update` started (`running: true`) or
+    /// finished (`running: false`). `post_meta_update` returns 200
+    /// immediately and runs the `nix flake update` + agent-rebuild
+    /// ripple in a background task — this event lets the META INPUTS
+    /// panel show a disabled "updating…" state for that whole window
+    /// instead of looking idle (issue #259). Emitted by
+    /// `Coordinator::meta_update_guard` / `MetaUpdateGuard::drop` only
+    /// when the active-run count crosses 0, so concurrent updates flip
+    /// the flag exactly once.
+    MetaUpdateRunning { seq: u64, running: bool },
+    /// Full snapshot of the rebuild queue (`hive-c0re::rebuild_queue`)
+    /// — every entry, in enqueue order, including the few most-recent
+    /// terminal entries the queue retains for history. Same
+    /// snapshot-shape rationale as `TombstonesChanged` /
+    /// `MetaInputsChanged`: the list is small, snapshot semantics avoid
+    /// the add/remove races a per-row event would have, and the
+    /// dashboard's grouping (parent_id) is most naturally re-derived
+    /// from the full list.
+    RebuildQueueChanged {
+        seq: u64,
+        queue: Vec<QueueEntry>,
+    },
+}
+
+impl DashboardEvent {
+    /// Snake-case identifier matching this variant's serde `tag`
+    /// (e.g. `Sent` → `"sent"`, `ContainerStateChanged` →
+    /// `"container_state_changed"`). Lets `/dashboard/stream`'s
+    /// `?kinds=` filter (#408) decide whether to forward a frame
+    /// without paying the JSON-serialise cost first.
+    ///
+    /// Keep in sync with `#[serde(rename_all = "snake_case", tag =
+    /// "kind")]` on `DashboardEvent` — if a new variant lands above,
+    /// add it here too. `cargo test` covers this via the
+    /// `kind_tag_matches_serde_kind_field` round-trip test.
+    #[must_use]
+    pub fn kind_tag(&self) -> &'static str {
+        match self {
+            DashboardEvent::Sent { .. } => "sent",
+            DashboardEvent::Delivered { .. } => "delivered",
+            DashboardEvent::ApprovalAdded { .. } => "approval_added",
+            DashboardEvent::ApprovalResolved { .. } => "approval_resolved",
+            DashboardEvent::QuestionAdded { .. } => "question_added",
+            DashboardEvent::QuestionResolved { .. } => "question_resolved",
+            DashboardEvent::TransientSet { .. } => "transient_set",
+            DashboardEvent::TransientCleared { .. } => "transient_cleared",
+            DashboardEvent::ContainerStateChanged { .. } => "container_state_changed",
+            DashboardEvent::ContainerRemoved { .. } => "container_removed",
+            DashboardEvent::TombstonesChanged { .. } => "tombstones_changed",
+            DashboardEvent::MetaInputsChanged { .. } => "meta_inputs_changed",
+            DashboardEvent::MetaUpdateRunning { .. } => "meta_update_running",
+            DashboardEvent::RebuildQueueChanged { .. } => "rebuild_queue_changed",
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Round-trip representative variants through serde and confirm
+    /// the `kind` JSON field matches `kind_tag()`. The exhaustive
+    /// `match` in `kind_tag` already provides compile-time variant
+    /// coverage — this test is the value-side guard against
+    /// typos in the snake_case strings vs serde's `rename_all`
+    /// output. `ContainerStateChanged` is omitted from the sample
+    /// list only because `ContainerView` has no `Default` impl and
+    /// constructing one inline here is more boilerplate than the
+    /// test is worth; the variant is still covered by the
+    /// `kind_tag` match arm.
+    #[test]
+    fn kind_tag_matches_serde_kind_field() {
+        let samples: Vec<DashboardEvent> = vec![
+            DashboardEvent::Sent {
+                seq: 1,
+                id: 1,
+                from: "a".into(),
+                to: "b".into(),
+                body: String::new(),
+                at: 0,
+                in_reply_to: None,
+                file_refs: Vec::new(),
+            },
+            DashboardEvent::Delivered {
+                seq: 1,
+                id: 1,
+                from: "a".into(),
+                to: "b".into(),
+                body: String::new(),
+                at: 0,
+                in_reply_to: None,
+                file_refs: Vec::new(),
+            },
+            DashboardEvent::ApprovalAdded {
+                seq: 1,
+                id: 1,
+                agent: "x".into(),
+                approval_kind: "apply_commit",
+                sha_short: None,
+                diff: None,
+                description: None,
+            },
+            DashboardEvent::ApprovalResolved {
+                seq: 1,
+                id: 1,
+                agent: "x".into(),
+                approval_kind: "apply_commit",
+                sha_short: None,
+                status: "approved",
+                resolved_at: 0,
+                note: None,
+                description: None,
+            },
+            DashboardEvent::QuestionAdded {
+                seq: 1,
+                id: 1,
+                asker: "a".into(),
+                question: String::new(),
+                options: Vec::new(),
+                multi: false,
+                asked_at: 0,
+                deadline_at: None,
+                target: None,
+                question_refs: Vec::new(),
+            },
+            DashboardEvent::QuestionResolved {
+                seq: 1,
+                id: 1,
+                answer: String::new(),
+                answerer: "a".into(),
+                answered_at: 0,
+                cancelled: false,
+                target: None,
+                answer_refs: Vec::new(),
+            },
+            DashboardEvent::TransientSet {
+                seq: 1,
+                name: "x".into(),
+                transient_kind: "rebuilding",
+                since_unix: 0,
+            },
+            DashboardEvent::TransientCleared {
+                seq: 1,
+                name: "x".into(),
+            },
+            DashboardEvent::ContainerRemoved {
+                seq: 1,
+                name: "x".into(),
+            },
+            DashboardEvent::TombstonesChanged {
+                seq: 1,
+                tombstones: Vec::new(),
+            },
+            DashboardEvent::MetaInputsChanged {
+                seq: 1,
+                inputs: Vec::new(),
+            },
+            DashboardEvent::MetaUpdateRunning {
+                seq: 1,
+                running: false,
+            },
+            DashboardEvent::RebuildQueueChanged {
+                seq: 1,
+                queue: Vec::new(),
+            },
+        ];
+        for ev in samples {
+            let v: serde_json::Value = serde_json::to_value(&ev).expect("serialise");
+            let serde_kind = v
+                .get("kind")
+                .and_then(|k| k.as_str())
+                .expect("kind field present");
+            assert_eq!(
+                ev.kind_tag(),
+                serde_kind,
+                "kind_tag() drift on {ev:?}",
+            );
+        }
+    }
+}
diff --git a/hive-c0re/src/events_vacuum.rs b/hive-c0re/src/events_vacuum.rs
new file mode 100644
index 00000000..8a487cce
--- /dev/null
+++ b/hive-c0re/src/events_vacuum.rs
@@ -0,0 +1,66 @@
+//! Host-side vacuum of every per-agent events.sqlite. The harness
+//! writes to `/state/hyperhive-events.sqlite` (bind-mounted from
+//! `/var/lib/hyperhive/agents/<name>/state/`); we open the same file
+//! from the host every hour and delete rows older than `KEEP_SECS`.
+//! Age-only — no row cap — so a chatty turn doesn't lose history
+//! sooner than a quiet one; disk pressure on a sustained burst is
+//! a cheaper problem than a missing event when the operator is
+//! debugging a regression. Keeping retention on the host means
+//! agents don't need any cleanup wiring of their own, and a
+//! misbehaving harness can't disable its own vacuum.
+
+use std::path::Path;
+use std::sync::Arc;
+use std::time::{Duration, SystemTime, UNIX_EPOCH};
+
+use rusqlite::{Connection, Result, params};
+
+use crate::coordinator::Coordinator;
+
+const VACUUM_INTERVAL: Duration = Duration::from_secs(3600);
+const KEEP_SECS: i64 = 7 * 24 * 3600;
+
+/// Background loop: sweep every existing agent state dir hourly, run
+/// the vacuum SQL against its events.sqlite if present. Errors are
+/// logged but don't tear the loop down.
+pub fn spawn(coord: &Arc<Coordinator>) {
+    let mut shutdown = coord.shutdown_rx();
+    tokio::spawn(async move {
+        loop {
+            sweep_once();
+            tokio::select! {
+                () = tokio::time::sleep(VACUUM_INTERVAL) => {}
+                _ = shutdown.changed() => {
+                    tracing::info!("events vacuum: shutdown signal received");
+                    break;
+                }
+            }
+        }
+    });
+}
+
+fn sweep_once() {
+    for name in Coordinator::kept_state_names() {
+        let path = Coordinator::agent_notes_dir(&name).join("hyperhive-events.sqlite");
+        if !path.exists() {
+            continue;
+        }
+        match vacuum_file(&path) {
+            Ok(0) => {}
+            Ok(n) => tracing::info!(agent = %name, removed = n, "events vacuum"),
+            Err(e) => tracing::warn!(agent = %name, error = ?e, "events vacuum failed"),
+        }
+    }
+}
+
+fn vacuum_file(path: &Path) -> Result<u64> {
+    let conn = Connection::open(path)?;
+    let now = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .ok()
+        .and_then(|d| i64::try_from(d.as_secs()).ok())
+        .unwrap_or(0);
+    let cutoff = now - KEEP_SECS;
+    let removed = conn.execute("DELETE FROM events WHERE ts < ?1", params![cutoff])?;
+    Ok(u64::try_from(removed).unwrap_or(0))
+}
diff --git a/hive-c0re/src/flake_check.rs b/hive-c0re/src/flake_check.rs
new file mode 100644
index 00000000..71550270
--- /dev/null
+++ b/hive-c0re/src/flake_check.rs
@@ -0,0 +1,431 @@
+//! Pre-apply validation for agent `flake.lock` files (closes part of #317).
+//!
+//! Every `request_apply_commit` lands a `proposal/<id>` tag in the
+//! agent's applied repo before the operator sees the approval. We
+//! parse `flake.lock` from that tag's tree and reject the request if
+//! two or more nodes share an identical `original` field — that
+//! signals a missing `inputs.<X>.inputs.nixpkgs.follows = "nixpkgs"`
+//! directive in `flake.nix` and would inflate meta's lock with
+//! duplicates after deploy.
+//!
+//! Per mara's scope note on #317 (comment 4189): the check runs on
+//! the agent repo, not meta, and catches *new* violations only.
+//! Existing agents whose lock already has duplicates are out of
+//! scope here and get a coordinated config-change pass via the
+//! manager instead.
+
+use std::collections::BTreeMap;
+use std::fmt::Write as _;
+use std::path::Path;
+
+use anyhow::{Context, Result};
+use serde_json::Value;
+use tokio::process::Command;
+
+use crate::lifecycle::git_command;
+
+/// One group of `flake.lock` nodes that all share the same canonical
+/// `original` reference. Surfaced in the rejection message so the
+/// operator (and the manager that submitted the apply) can see
+/// exactly which input pair needs a `follows` directive.
+#[derive(Debug, Clone)]
+pub struct DuplicateGroup {
+    /// One of the original `Value`s from the lock — used for
+    /// pretty-printing in the error message. Canonical equivalence
+    /// is enforced by the `BTreeMap` key in `duplicate_groups`, so
+    /// we don't need to keep the canonicalised form on the struct.
+    pub original: Value,
+    /// Names of the flake.lock nodes that share this `original`,
+    /// sorted for stable error output.
+    pub keys: Vec<String>,
+}
+
+/// Read `flake.lock` from `<tag>:flake.lock` in `repo`. Returns
+/// `Ok(None)` when the file isn't tracked in that tag (no inputs ⇒
+/// nothing to dedup); `Err` only on real git plumbing failures.
+async fn read_lock_at_tag(repo: &Path, tag: &str) -> Result<Option<String>> {
+    let spec = format!("{tag}:flake.lock");
+    let out = git_command()
+        .current_dir(repo)
+        .args(["show", &spec])
+        .output()
+        .await
+        .with_context(|| format!("git show {spec} in {}", repo.display()))?;
+    if !out.status.success() {
+        let stderr = String::from_utf8_lossy(&out.stderr);
+        // git uses two different messages for "path not in tree"
+        // depending on whether the path also collides with an on-disk
+        // file. Both translate to "no flake.lock in this commit" —
+        // a legitimate, dedup-clean state for an agent with empty
+        // `inputs = { }`. Any other git failure (permission denied,
+        // ref-not-found, etc.) propagates as a hard error rather than
+        // being silently swallowed.
+        if stderr.contains("does not exist")
+            || stderr.contains("exists on disk, but not in")
+        {
+            return Ok(None);
+        }
+        anyhow::bail!("git show {spec} failed: {}", stderr.trim());
+    }
+    Ok(Some(String::from_utf8_lossy(&out.stdout).into_owned()))
+}
+
+/// Recursively serialise `v` with object keys sorted, so two
+/// JSON values that differ only in key insertion order produce the
+/// same string. `serde_json::Value` preserves `IndexMap` order by
+/// default, which is fine for parsing but breaks our group-by-key
+/// idea — hence this hand-rolled canonicaliser.
+fn canonical_json(v: &Value) -> String {
+    match v {
+        Value::Object(map) => {
+            let mut keys: Vec<&String> = map.keys().collect();
+            keys.sort();
+            let mut s = String::from("{");
+            for (i, k) in keys.iter().enumerate() {
+                if i > 0 {
+                    s.push(',');
+                }
+                s.push_str(&serde_json::to_string(k).unwrap_or_default());
+                s.push(':');
+                s.push_str(&canonical_json(&map[*k]));
+            }
+            s.push('}');
+            s
+        }
+        Value::Array(arr) => {
+            let mut s = String::from("[");
+            for (i, x) in arr.iter().enumerate() {
+                if i > 0 {
+                    s.push(',');
+                }
+                s.push_str(&canonical_json(x));
+            }
+            s.push(']');
+            s
+        }
+        _ => serde_json::to_string(v).unwrap_or_default(),
+    }
+}
+
+/// Parse `raw` (a `flake.lock` JSON document) and return every group
+/// of nodes whose `original` field is identical. Nodes without an
+/// `original` (the synthetic `root`, or anomalous entries) are
+/// skipped. Groups with only one member are filtered out — only true
+/// duplicates surface.
+///
+/// Pure function, no I/O — covered by the unit tests below.
+pub fn duplicate_groups(raw: &str) -> Result<Vec<DuplicateGroup>> {
+    let json: Value = serde_json::from_str(raw).context("parse flake.lock")?;
+    let Some(nodes) = json.get("nodes").and_then(|v| v.as_object()) else {
+        return Ok(Vec::new());
+    };
+    let mut groups: BTreeMap<String, DuplicateGroup> = BTreeMap::new();
+    for (name, node) in nodes {
+        let Some(original) = node.get("original") else {
+            continue;
+        };
+        let key = canonical_json(original);
+        let entry = groups.entry(key).or_insert_with(|| DuplicateGroup {
+            original: original.clone(),
+            keys: Vec::new(),
+        });
+        entry.keys.push(name.clone());
+    }
+    let mut dups: Vec<DuplicateGroup> = groups
+        .into_values()
+        .filter(|g| g.keys.len() > 1)
+        .collect();
+    for g in &mut dups {
+        g.keys.sort();
+    }
+    Ok(dups)
+}
+
+/// Re-derive the agent's `flake.lock` from its `flake.nix` (in a
+/// throw-away worktree at the proposal tag) and reject the apply when
+/// the result differs from what's committed — that means the manager
+/// edited `flake.nix` but didn't commit the regenerated lock, so the
+/// shipped state lies about what nix will actually fetch.
+///
+/// Plain `nix flake lock` (no `--update-input` flags) only fills in
+/// MISSING entries; it never refreshes existing ones. So a lock that
+/// matches its `flake.nix` round-trips to a no-op, and any diff is a
+/// real "stale lock" signal.
+///
+/// Materialises the proposal tag into a temp worktree under
+/// `std::env::temp_dir()` to avoid touching `applied/<n>/main` while
+/// the check runs. Cleanup is unconditional via the inner-fn pattern.
+///
+/// Returns `Ok(())` when in sync (or there's no `flake.nix` at all);
+/// `Err` with a human-readable message on stale lock or nix tooling
+/// failure.
+pub async fn check_lock_in_sync(repo: &Path, tag: &str, approval_id: i64) -> Result<()> {
+    let suffix = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.as_nanos())
+        .unwrap_or(0);
+    let tmp_dir = std::env::temp_dir().join(format!("hive-flake-check-{approval_id}-{suffix}"));
+
+    // Detached worktree at the proposal tag — gives us a clean, mutable
+    // copy of the agent's tree without disturbing whatever's currently
+    // checked out on `applied/<n>/main`.
+    let out = git_command()
+        .current_dir(repo)
+        .args([
+            "worktree",
+            "add",
+            "--detach",
+            &tmp_dir.to_string_lossy(),
+            tag,
+        ])
+        .output()
+        .await
+        .with_context(|| format!("git worktree add {} {tag}", tmp_dir.display()))?;
+    if !out.status.success() {
+        anyhow::bail!(
+            "git worktree add failed: {}",
+            String::from_utf8_lossy(&out.stderr).trim()
+        );
+    }
+
+    let result = lock_in_sync_inner(&tmp_dir).await;
+
+    // Best-effort cleanup. `git worktree remove --force` handles the
+    // common case; `remove_dir_all` mops up if git decided the worktree
+    // is half-gone (or if the inner work bailed before nix touched the
+    // tree). Failures here are logged, not propagated — the check's
+    // result is what matters.
+    if let Err(e) = remove_worktree(repo, &tmp_dir).await {
+        tracing::warn!(
+            worktree = %tmp_dir.display(),
+            error = %format!("{e:#}"),
+            "flake_check: temp worktree cleanup failed"
+        );
+    }
+
+    result
+}
+
+async fn lock_in_sync_inner(worktree: &Path) -> Result<()> {
+    // No `flake.nix` means there's nothing for nix to lock — skip the
+    // check cleanly (the dedup check will likewise no-op).
+    if !worktree.join("flake.nix").exists() {
+        return Ok(());
+    }
+
+    let committed = tokio::fs::read_to_string(worktree.join("flake.lock"))
+        .await
+        .ok();
+
+    // `--extra-experimental-features` mirrors `meta::nix` for hosts
+    // that haven't already enabled flakes in `nix.conf`. Plain
+    // `nix flake lock` (no `--update-input`) fills missing entries but
+    // never refreshes existing ones — exactly the semantics we want.
+    let out = Command::new("nix")
+        .current_dir(worktree)
+        .args([
+            "--extra-experimental-features",
+            "nix-command flakes",
+            "flake",
+            "lock",
+        ])
+        .output()
+        .await
+        .with_context(|| format!("nix flake lock in {}", worktree.display()))?;
+    if !out.status.success() {
+        anyhow::bail!(
+            "nix flake lock failed: {}",
+            String::from_utf8_lossy(&out.stderr).trim()
+        );
+    }
+
+    let regenerated = tokio::fs::read_to_string(worktree.join("flake.lock"))
+        .await
+        .ok();
+
+    // An agent that declares inputs in flake.nix but ships no
+    // flake.lock at all hits this branch (committed = None,
+    // regenerated = Some(...)). That's a deliberate reject: every
+    // agent with inputs MUST commit its lock, otherwise meta's
+    // dedup pass has nothing to introspect and the broken state
+    // leaks downstream. Treated identically to a stale lock.
+    if committed.as_deref() != regenerated.as_deref() {
+        anyhow::bail!(
+            "flake.lock is out of sync with flake.nix — `nix flake lock` produces a different lock. \
+             Run `nix flake lock` in your agent config, commit the result, and re-submit request_apply_commit."
+        );
+    }
+    Ok(())
+}
+
+async fn remove_worktree(repo: &Path, worktree: &Path) -> Result<()> {
+    let out = git_command()
+        .current_dir(repo)
+        .args([
+            "worktree",
+            "remove",
+            "--force",
+            &worktree.to_string_lossy(),
+        ])
+        .output()
+        .await
+        .with_context(|| format!("git worktree remove {}", worktree.display()))?;
+    if !out.status.success() {
+        // `git worktree remove` already errored — still try the raw
+        // rmdir so we don't leak the dir on disk. Surface the original
+        // git stderr for context.
+        let _ = tokio::fs::remove_dir_all(worktree).await;
+        anyhow::bail!(
+            "git worktree remove failed: {}",
+            String::from_utf8_lossy(&out.stderr).trim()
+        );
+    }
+    // git removed the worktree's metadata but the dir itself may
+    // linger on stripped-down git versions — best-effort clean.
+    let _ = tokio::fs::remove_dir_all(worktree).await;
+    Ok(())
+}
+
+/// Run the dedup check against the agent's freshly-applied tree.
+///
+/// `Ok(())` means either the commit doesn't carry a `flake.lock` (no
+/// inputs declared) or every node has a unique `original`. `Err`
+/// carries a multi-line message listing every duplicate group with
+/// the offending node names, suitable for surfacing on the failed
+/// approval row.
+pub async fn check_no_duplicate_inputs(repo: &Path, tag: &str) -> Result<()> {
+    let Some(raw) = read_lock_at_tag(repo, tag).await? else {
+        return Ok(());
+    };
+    let dups = duplicate_groups(&raw)?;
+    if dups.is_empty() {
+        return Ok(());
+    }
+    let mut msg = String::from(
+        "flake.lock has duplicate flake inputs — add a `follows` directive in flake.nix to collapse them:\n",
+    );
+    for g in &dups {
+        let original = serde_json::to_string(&g.original).unwrap_or_else(|_| "?".into());
+        let _ = writeln!(msg, "  - {original} → nodes [{}]", g.keys.join(", "));
+    }
+    anyhow::bail!("{}", msg.trim_end());
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const CLEAN_LOCK: &str = r#"{
+        "nodes": {
+            "nixpkgs": {
+                "locked": {"rev": "aaa"},
+                "original": {"owner": "NixOS", "repo": "nixpkgs", "ref": "nixos-25.11", "type": "github"}
+            },
+            "nixpkgs-unstable": {
+                "locked": {"rev": "bbb"},
+                "original": {"owner": "NixOS", "repo": "nixpkgs", "ref": "nixpkgs-unstable", "type": "github"}
+            },
+            "root": {"inputs": {"nixpkgs": "nixpkgs"}}
+        },
+        "root": "root",
+        "version": 7
+    }"#;
+
+    const DUPLICATE_LOCK: &str = r#"{
+        "nodes": {
+            "nixpkgs": {
+                "locked": {"rev": "aaa"},
+                "original": {"owner": "NixOS", "repo": "nixpkgs", "ref": "nixos-25.11", "type": "github"}
+            },
+            "nixpkgs_2": {
+                "locked": {"rev": "ccc"},
+                "original": {"owner": "NixOS", "repo": "nixpkgs", "ref": "nixos-25.11", "type": "github"}
+            },
+            "nixpkgs_3": {
+                "locked": {"rev": "ddd"},
+                "original": {"owner": "NixOS", "repo": "nixpkgs", "ref": "nixos-25.11", "type": "github"}
+            },
+            "treefmt-nix": {
+                "locked": {"rev": "eee"},
+                "original": {"owner": "numtide", "repo": "treefmt-nix", "type": "github"}
+            },
+            "treefmt-nix_2": {
+                "locked": {"rev": "fff"},
+                "original": {"type": "github", "owner": "numtide", "repo": "treefmt-nix"}
+            },
+            "root": {"inputs": {"nixpkgs": "nixpkgs"}}
+        },
+        "root": "root",
+        "version": 7
+    }"#;
+
+    #[test]
+    fn clean_lock_has_no_duplicates() {
+        let dups = duplicate_groups(CLEAN_LOCK).expect("parse");
+        assert!(dups.is_empty(), "expected no dups, got {dups:#?}");
+    }
+
+    #[test]
+    fn duplicate_lock_reports_groups() {
+        let dups = duplicate_groups(DUPLICATE_LOCK).expect("parse");
+        assert_eq!(dups.len(), 2, "expected nixpkgs + treefmt-nix groups");
+
+        // Order is BTreeMap-stable: sorted by canonical_json key. The
+        // numtide treefmt-nix key sorts before the NixOS nixpkgs one
+        // because `numtide` < `NixOS` lexicographically (case-sensitive,
+        // capitals come first... wait — capital N is 0x4e, lowercase n
+        // is 0x6e, so capitals come first). So nixpkgs group sorts
+        // first. Verify by content instead of position to avoid coupling
+        // to that subtlety.
+        let nixpkgs_group = dups
+            .iter()
+            .find(|g| g.original.get("ref").is_some())
+            .expect("nixpkgs group present");
+        assert_eq!(
+            nixpkgs_group.keys,
+            vec!["nixpkgs", "nixpkgs_2", "nixpkgs_3"]
+        );
+
+        let treefmt_group = dups
+            .iter()
+            .find(|g| g.original.get("ref").is_none())
+            .expect("treefmt-nix group present");
+        assert_eq!(treefmt_group.keys, vec!["treefmt-nix", "treefmt-nix_2"]);
+    }
+
+    #[test]
+    fn key_order_in_original_does_not_matter() {
+        // The treefmt-nix and treefmt-nix_2 entries above use different
+        // key orderings for `original` ({owner,repo,type} vs
+        // {type,owner,repo}); duplicate_groups should still merge them.
+        let dups = duplicate_groups(DUPLICATE_LOCK).expect("parse");
+        let treefmt = dups
+            .iter()
+            .find(|g| g.keys.iter().any(|k| k == "treefmt-nix"))
+            .expect("treefmt-nix group");
+        assert!(treefmt.keys.contains(&"treefmt-nix_2".to_owned()));
+    }
+
+    #[test]
+    fn nodes_without_original_are_ignored() {
+        // The synthetic `root` node has no `original` and must not be
+        // grouped against anything.
+        let dups = duplicate_groups(CLEAN_LOCK).expect("parse");
+        assert!(dups.iter().all(|g| !g.keys.iter().any(|k| k == "root")));
+    }
+
+    #[test]
+    fn missing_nodes_object_is_not_an_error() {
+        // A lock file that's syntactically JSON but lacks `nodes` (e.g.
+        // a partial test fixture) should fail open — no dups reported.
+        let raw = r#"{"root": "root", "version": 7}"#;
+        let dups = duplicate_groups(raw).expect("parse");
+        assert!(dups.is_empty());
+    }
+
+    #[test]
+    fn invalid_json_is_a_hard_error() {
+        let err = duplicate_groups("not-json-at-all").unwrap_err();
+        assert!(format!("{err:#}").contains("parse flake.lock"));
+    }
+}
diff --git a/hive-c0re/src/forge.rs b/hive-c0re/src/forge.rs
new file mode 100644
index 00000000..7eb33c10
--- /dev/null
+++ b/hive-c0re/src/forge.rs
@@ -0,0 +1,691 @@
+//! Optional Forgejo wiring. When the `hive-forge` nixos-container is
+//! present and running, hive-c0re ensures every agent (and the
+//! manager) has a corresponding forgejo user with an API token
+//! written to `<agent-state>/forge-token` — visible inside the
+//! container as `/state/forge-token`. Idempotent: skips creation
+//! when the user already exists, skips token issuance when the file
+//! is already there.
+//!
+//! It also mirrors each agent's hive-c0re-owned *applied* config repo
+//! into the private `agent-configs` org (`push_config`), so every
+//! deploy / approval tag core plants is visible on the forge. Each
+//! agent is a read-only collaborator on `core/meta` (the meta flake)
+//! so they can fetch their deployment context; the `agent-configs`
+//! repos remain core-only.
+//!
+//! No-op when `hive-forge` isn't enabled (detected via
+//! `nixos-container list`), so operators who don't run the bundled
+//! forge pay nothing.
+
+use std::path::{Path, PathBuf};
+
+use anyhow::{Context, Result};
+use base64::Engine;
+use reqwest::StatusCode;
+use tokio::process::Command;
+
+use crate::coordinator::Coordinator;
+
+const FORGE_CONTAINER: &str = "hive-forge";
+const FORGE_HTTP: &str = "http://localhost:3000";
+const TOKEN_NAME_PREFIX: &str = "hyperhive";
+/// Where the host-side `core` admin token lives. Used by hive-c0re
+/// itself to push the meta repo + drive admin API calls (org
+/// creation, future webhook setup, etc.). Root-only.
+const CORE_TOKEN_PATH: &str = "/var/lib/hyperhive/forge-core-token";
+/// Marker that records whether `ensure_core_avatar` has successfully
+/// uploaded the hyperhive logo as `core`'s avatar (issue #320). One-shot:
+/// the upload runs once, the marker is written, subsequent startups skip
+/// the call. Delete to force re-upload.
+const CORE_AVATAR_MARKER: &str = "/var/lib/hyperhive/forge-core-avatar-set";
+/// Sibling marker for the `agent-configs` org avatar (#424). Same one-
+/// shot semantics — delete to force the upload to re-run.
+const CONFIG_ORG_AVATAR_MARKER: &str = "/var/lib/hyperhive/forge-agent-configs-avatar-set";
+/// Hyperhive logo bytes, baked into the daemon. Uploaded once via the
+/// admin avatar API so the `core` Forgejo user shows the project mark
+/// next to commits in `agent-configs/*`, `core/meta`, etc. instead of
+/// the default hash identicon.
+const CORE_AVATAR_PNG: &[u8] = include_bytes!("../../branding/hyperhive.png");
+/// `agent-configs` org logo bytes (#424). Sibling visual to the main
+/// hyperhive mark — same dark base + outer ring + corner brackets,
+/// with a stacked-config-files glyph in the centre so the operator
+/// can distinguish the agent-configs namespace from the main
+/// `hyperhive` org at a glance. Source-of-truth is
+/// `branding/agent-configs.svg`; `hive-c0re/build.rs` renders it
+/// into `$OUT_DIR/agent-configs.png` at compile time via
+/// `rsvg-convert` so the raster never gets checked into git.
+const CONFIG_ORG_AVATAR_PNG: &[u8] = include_bytes!(concat!(env!("OUT_DIR"), "/agent-configs.png"));
+/// Forgejo org grouping every agent's applied config repo. Core is a
+/// site admin and reads + writes every repo here; agents are NOT
+/// members and the repos are private, so no agent — not even the one
+/// a repo describes — can reach a config repo through the forge. The
+/// applied repos stay hive-c0re-owned on disk; this org is just a
+/// mirror target core pushes to.
+const CONFIG_ORG: &str = "agent-configs";
+/// Forgejo orgs hive-c0re ensures on startup. The meta repo lives at
+/// `core/meta` (the `core` user's own namespace — no org needed).
+const SEEDED_ORGS: &[&str] = &[CONFIG_ORG];
+/// Forgejo scopes the agent's token gets. Broad-but-not-admin: every
+/// repo / PR / issue thing an agent needs day-to-day, no admin
+/// surface.
+/// - `write:repository` — create, clone, push, delete repos in the
+///   user's own namespace; merge PRs.
+/// - `write:issue` — open / comment / review issues *and* pull
+///   requests (forgejo namespaces PR conversation under issues).
+/// - `write:user` — edit own profile, create repos under own user.
+/// - `write:organization` — create + manage orgs (lets agents share
+///   a forge namespace).
+/// - `read:user` — token-owner endpoint clients call to introspect.
+/// - `write:misc` — hooks, attachments, the rest of the long tail.
+/// - `read:notification` — required by `forge_notify` to poll
+///   `GET /notifications` for unread PR/review events.
+/// - `write:notification` — required by `forge_notify` to mark
+///   notifications as read via `PATCH /notifications/threads/{id}`.
+const TOKEN_SCOPES: &str =
+    "read:user,write:user,read:notification,write:notification,write:repository,write:issue,write:organization,write:misc";
+
+/// Token file inside the agent's bind-mounted state dir (visible as
+/// `/state/forge-token` from inside the container).
+fn token_path(name: &str) -> PathBuf {
+    Coordinator::agent_notes_dir(name).join("forge-token")
+}
+
+/// Probe whether `hive-forge` exists as a nixos-container. Cheap —
+/// `nixos-container list` is just a directory scan in /etc.
+pub async fn is_present() -> bool {
+    let Ok(out) = Command::new("nixos-container").arg("list").output().await else {
+        return false;
+    };
+    if !out.status.success() {
+        return false;
+    }
+    String::from_utf8_lossy(&out.stdout)
+        .lines()
+        .any(|l| l.trim() == FORGE_CONTAINER)
+}
+
+/// Run `forgejo admin <args>` inside the hive-forge container as the
+/// forgejo user (the only uid with write access to the state dir).
+/// Returns stdout on success; bails with stderr context on failure.
+async fn forge_admin(args: &[&str]) -> Result<String> {
+    let mut cmd = Command::new("nixos-container");
+    // `runuser` (util-linux, always present in a NixOS container)
+    // beats `sudo` here — sudo isn't installed unless `security.sudo`
+    // is enabled, and we don't want to depend on that.
+    //
+    // `--work-path` is mandatory: without it, the admin CLI defaults
+    // WorkPath to `dirname(executable)` (a RO nix-store path), then
+    // looks for `<WorkPath>/custom/conf/app.ini` which doesn't
+    // exist, falls back to defaults, and F3 init tries to mkdir
+    // under the nix store and fatals. The systemd unit sets
+    // WORK_PATH for the daemon; we mirror it here for the CLI.
+    cmd.args([
+        "run",
+        FORGE_CONTAINER,
+        "--",
+        "runuser",
+        "-u",
+        "forgejo",
+        "--",
+        "forgejo",
+        "--work-path",
+        "/var/lib/forgejo",
+        "admin",
+    ]);
+    cmd.args(args);
+    let out = cmd
+        .output()
+        .await
+        .context("invoke nixos-container run hive-forge -- forgejo admin")?;
+    if !out.status.success() {
+        anyhow::bail!(
+            "forgejo admin {} failed ({}): {}",
+            args.join(" "),
+            out.status,
+            String::from_utf8_lossy(&out.stderr).trim(),
+        );
+    }
+    Ok(String::from_utf8_lossy(&out.stdout).into_owned())
+}
+
+/// Pull the access token out of forgejo's success message. Format
+/// has shifted across versions (table form vs. "Access token was
+/// successfully created: <hex>"), so just hunt the output for the
+/// first long hex-looking word.
+fn extract_token(output: &str) -> Option<String> {
+    output
+        .split(|c: char| c.is_whitespace() || c == ',' || c == ':')
+        .find(|w| w.len() >= 32 && w.chars().all(|c| c.is_ascii_hexdigit()))
+        .map(str::to_owned)
+}
+
+/// Canonical email address for a hive agent's Forgejo account.
+/// Must match the `user.email` set by `meta::render_flake` so commits
+/// by the agent link back to their Forgejo profile page.
+fn agent_email(name: &str) -> String {
+    format!("{name}@hyperhive")
+}
+
+/// Thin Forgejo REST helper. Sends `method` to `url` with a JSON body
+/// and `Authorization: token <token>`, returns the HTTP status code.
+/// All Forgejo API calls that don't shell out to `forgejo admin` go
+/// through here — one place for auth header, content-type, error
+/// propagation, and the shared reqwest Client.
+async fn forge_http(
+    method: reqwest::Method,
+    url: &str,
+    token: &str,
+    body: &str,
+) -> Result<StatusCode> {
+    let client = reqwest::Client::new();
+    let resp = client
+        .request(method, url)
+        .header("Authorization", format!("token {token}"))
+        .header("Content-Type", "application/json")
+        .body(body.to_owned())
+        .send()
+        .await
+        .with_context(|| format!("forge HTTP request to {url}"))?;
+    Ok(resp.status())
+}
+
+/// Ensure a forgejo user named `name` exists. Idempotent: forgejo
+/// returns a "user already exists" error which we treat as success.
+/// `admin` adds `--admin` (site admin) — used for the bootstrap
+/// `core` user that drives the API.
+async fn ensure_user_exists(name: &str, admin: bool) -> Result<()> {
+    let mut args = vec![
+        "user",
+        "create",
+        "--username",
+        name,
+        "--email",
+    ];
+    let email = agent_email(name);
+    args.push(&email);
+    args.extend(["--random-password", "--must-change-password=false"]);
+    if admin {
+        args.push("--admin");
+    }
+    let result = forge_admin(&args).await;
+    match result {
+        Ok(_) => {
+            tracing::info!(%name, "forge: created user");
+            Ok(())
+        }
+        Err(e) => {
+            // Forgejo's "already exists" error wording varies; just
+            // try the next step and let token issuance surface a
+            // real failure if the user truly isn't there.
+            let msg = format!("{e:#}");
+            if msg.contains("already exists") || msg.contains("user already") {
+                tracing::debug!(%name, "forge: user already exists");
+                Ok(())
+            } else {
+                tracing::warn!(%name, error = %msg, "forge: user create unclear; trying token anyway");
+                Ok(())
+            }
+        }
+    }
+}
+
+/// Idempotently align the Forgejo account email to `agent_email(name)`.
+/// Existing agents were created with `{name}@hive.local`; this corrects
+/// that so git commits (which use `{name}@hyperhive`) link to profiles.
+/// Best-effort: failures are warned, not propagated.
+async fn ensure_user_email(name: &str) {
+    let email = agent_email(name);
+    match forge_admin(&["user", "edit", "--username", name, "--email", &email]).await {
+        Ok(_) => tracing::debug!(%name, %email, "forge: user email aligned"),
+        Err(e) => tracing::warn!(%name, error = %e, "forge: could not align user email"),
+    }
+}
+
+/// Mint a fresh access token for `name` and persist it to
+/// `<state>/forge-token` (0600). Token name is suffixed with a
+/// monotonic clock so re-issuing doesn't collide with an existing
+/// token of the same name in the DB.
+async fn mint_and_persist_token(name: &str, path: &Path) -> Result<()> {
+    use std::os::unix::fs::PermissionsExt;
+    let token_name = format!(
+        "{TOKEN_NAME_PREFIX}-{}",
+        std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .map(|d| d.as_secs())
+            .unwrap_or(0)
+    );
+    let stdout = forge_admin(&[
+        "user",
+        "generate-access-token",
+        "--username",
+        name,
+        "--token-name",
+        &token_name,
+        "--scopes",
+        TOKEN_SCOPES,
+    ])
+    .await?;
+    let token = extract_token(&stdout)
+        .with_context(|| format!("parse token from forgejo output: {stdout:?}"))?;
+    if let Some(parent) = path.parent() {
+        std::fs::create_dir_all(parent).ok();
+    }
+    std::fs::write(path, format!("{token}\n"))
+        .with_context(|| format!("write token to {}", path.display()))?;
+    let _ = std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o600));
+    tracing::info!(%name, path = %path.display(), %token_name, "forge: persisted access token");
+    Ok(())
+}
+
+/// Ensure `name` has a forgejo user + token file. Always re-mints the
+/// token so the on-disk file always reflects the current `TOKEN_SCOPES`.
+/// Safe to call on every spawn and on every hive-c0re startup.
+pub async fn ensure_user_for(name: &str) -> Result<()> {
+    if !is_present().await {
+        return Ok(());
+    }
+    ensure_user_exists(name, false).await?;
+    ensure_user_email(name).await;
+    mint_and_persist_token(name, &token_path(name)).await
+}
+
+/// Set `core`'s Forgejo avatar to the hyperhive logo once, then
+/// remember it so subsequent startups don't re-upload (issue #320).
+/// Best-effort — any non-2xx is logged at the caller; the project
+/// runs fine with the default hash identicon.
+async fn ensure_core_avatar(token: &str) -> Result<()> {
+    let marker = std::path::Path::new(CORE_AVATAR_MARKER);
+    if marker.exists() {
+        return Ok(());
+    }
+    let body = format!(
+        r#"{{"image":"{}"}}"#,
+        base64::engine::general_purpose::STANDARD.encode(CORE_AVATAR_PNG),
+    );
+    let url = format!("{FORGE_HTTP}/api/v1/admin/users/core/avatar");
+    let status = forge_http(reqwest::Method::POST, &url, token, &body).await?;
+    if !status.is_success() {
+        anyhow::bail!("set core avatar: HTTP {status}");
+    }
+    if let Some(parent) = marker.parent() {
+        std::fs::create_dir_all(parent).ok();
+    }
+    std::fs::write(marker, "").ok();
+    tracing::info!("forge: set core user avatar to hyperhive logo");
+    Ok(())
+}
+
+/// Set the `agent-configs` org's Forgejo avatar to the
+/// configs-stack glyph once (#424). Sibling to `ensure_core_avatar`:
+/// one-shot, marker-guarded, best-effort. Forgejo's per-org avatar
+/// endpoint is `POST /api/v1/orgs/{org}/avatar` with a base64-PNG
+/// JSON body — same shape as the admin user endpoint above.
+async fn ensure_config_org_avatar(token: &str) -> Result<()> {
+    let marker = std::path::Path::new(CONFIG_ORG_AVATAR_MARKER);
+    if marker.exists() {
+        return Ok(());
+    }
+    let body = format!(
+        r#"{{"image":"{}"}}"#,
+        base64::engine::general_purpose::STANDARD.encode(CONFIG_ORG_AVATAR_PNG),
+    );
+    let url = format!("{FORGE_HTTP}/api/v1/orgs/{CONFIG_ORG}/avatar");
+    let status = forge_http(reqwest::Method::POST, &url, token, &body).await?;
+    if !status.is_success() {
+        anyhow::bail!("set {CONFIG_ORG} avatar: HTTP {status}");
+    }
+    if let Some(parent) = marker.parent() {
+        std::fs::create_dir_all(parent).ok();
+    }
+    std::fs::write(marker, "").ok();
+    tracing::info!(org = CONFIG_ORG, "forge: set org avatar to configs-stack logo");
+    Ok(())
+}
+
+/// Ensure the bootstrap `core` admin user + a token at
+/// `CORE_TOKEN_PATH`. The token is what hive-c0re uses for forgejo
+/// API calls (org creation now, meta-repo push later). Returns the
+/// token. Idempotent: skips creation when user exists, skips token
+/// when the file is present.
+async fn ensure_core_user_and_token() -> Result<String> {
+    let path = std::path::Path::new(CORE_TOKEN_PATH);
+    if let Ok(existing) = std::fs::read_to_string(path) {
+        let trimmed = existing.trim().to_owned();
+        if !trimmed.is_empty() {
+            return Ok(trimmed);
+        }
+    }
+    ensure_user_exists("core", true).await?;
+    mint_and_persist_token("core", path).await?;
+    let raw = std::fs::read_to_string(path)
+        .with_context(|| format!("read {CORE_TOKEN_PATH} after mint"))?;
+    Ok(raw.trim().to_owned())
+}
+
+/// JSON body for a private, empty repo defaulting to `main`.
+fn repo_body(name: &str) -> String {
+    format!(r#"{{"name":"{name}","auto_init":false,"private":true,"default_branch":"main"}}"#)
+}
+
+/// POST a repo-creation request to `url` and fold "already exists"
+/// (HTTP 409 / 422) into success. `label` is `<owner>/<name>` — purely
+/// for log + error context.
+async fn create_repo(url: &str, body: &str, token: &str, label: &str) -> Result<()> {
+    let status = forge_http(reqwest::Method::POST, url, token, body).await?;
+    match status.as_u16() {
+        201 => {
+            tracing::info!(%label, "forge: created repo");
+            Ok(())
+        }
+        409 | 422 => {
+            tracing::debug!(%label, "forge: repo already exists");
+            Ok(())
+        }
+        other => anyhow::bail!("POST {url} ({label}) returned HTTP {other}"),
+    }
+}
+
+/// Create a repo in the token-owner's own namespace. `token` belongs
+/// to the user we want the repo owned by (we use `core`'s token for
+/// `core/meta`). Idempotent.
+pub async fn ensure_repo(name: &str, token: &str) -> Result<()> {
+    create_repo(
+        &format!("{FORGE_HTTP}/api/v1/user/repos"),
+        &repo_body(name),
+        token,
+        &format!("core/{name}"),
+    )
+    .await
+}
+
+/// Create `name` inside org `org` (used for `agent-configs/<agent>`).
+/// Idempotent.
+async fn ensure_org_repo(org: &str, name: &str, token: &str) -> Result<()> {
+    create_repo(
+        &format!("{FORGE_HTTP}/api/v1/orgs/{org}/repos"),
+        &repo_body(name),
+        token,
+        &format!("{org}/{name}"),
+    )
+    .await
+}
+
+/// Read the persisted core token, or None when the forge isn't
+/// seeded yet. Cheap — just a file read.
+pub fn core_token() -> Option<String> {
+    std::fs::read_to_string(CORE_TOKEN_PATH)
+        .ok()
+        .map(|s| s.trim().to_owned())
+        .filter(|s| !s.is_empty())
+}
+
+/// Push `dir` (the meta repo) to `core/meta` on the local forge.
+/// Best-effort: returns Err which callers log + ignore. No-op when
+/// the core token isn't present (forge not enabled).
+pub async fn push_meta(dir: &Path) -> Result<()> {
+    let Some(token) = core_token() else {
+        return Ok(());
+    };
+    // Token-in-URL push. Forgejo accepts `oauth2:<token>` or just
+    // any-username:<token>; using `core` matches the owner so the
+    // remote name is self-describing.
+    let url = format!("http://core:{token}@localhost:3000/core/meta.git");
+    let out = Command::new("git")
+        .current_dir(dir)
+        .args(["push", "--force", &url, "HEAD:main"])
+        .output()
+        .await
+        .context("invoke git push core/meta")?;
+    if !out.status.success() {
+        anyhow::bail!(
+            "git push core/meta failed ({}): {}",
+            out.status,
+            String::from_utf8_lossy(&out.stderr).trim()
+        );
+    }
+    tracing::info!("forge: pushed meta to core/meta");
+    Ok(())
+}
+
+/// Ensure the `agent-configs/<name>` repo exists so the first
+/// `push_config` doesn't 404. No-op when the forge isn't running or
+/// the core token isn't minted yet. Safe to call on every spawn and
+/// on every startup.
+pub async fn ensure_config_repo(name: &str) -> Result<()> {
+    if !is_present().await {
+        return Ok(());
+    }
+    let Some(token) = core_token() else {
+        return Ok(());
+    };
+    ensure_org_repo(CONFIG_ORG, name, &token).await
+}
+
+/// Grant agent `name` read-only collaborator access to `core/meta` on
+/// the forge so the agent can clone/fetch the meta flake. Idempotent:
+/// HTTP 204 (already a collaborator) is treated as success.
+pub async fn meta_read_access(name: &str, core_token: &str) -> Result<()> {
+    let url = format!("{FORGE_HTTP}/api/v1/repos/core/meta/collaborators/{name}");
+    let body = r#"{"permission":"read"}"#;
+    let out = Command::new("curl")
+        .args([
+            "-sS",
+            "-o",
+            "/dev/null",
+            "-w",
+            "%{http_code}",
+            "-X",
+            "PUT",
+            "-H",
+            "Content-Type: application/json",
+            "-H",
+            &format!("Authorization: token {core_token}"),
+            "-d",
+            body,
+            &url,
+        ])
+        .output()
+        .await
+        .context("invoke curl PUT core/meta/collaborators")?;
+    let code = String::from_utf8_lossy(&out.stdout).trim().to_owned();
+    match code.as_str() {
+        "204" => {
+            tracing::info!(%name, "forge: granted meta read access");
+            Ok(())
+        }
+        other => anyhow::bail!(
+            "PUT core/meta/collaborators/{name} returned HTTP {other}"
+        ),
+    }
+}
+
+/// Add `http://localhost:3000/core/meta.git` as the `meta` remote in
+/// the agent's proposed config repo so the agent (and the manager) can
+/// fetch the meta flake from the forge. Idempotent: no-op when the
+/// remote already points at the right URL, or when the proposed repo
+/// does not exist yet. No-op when the forge is not running.
+pub async fn ensure_meta_remote(name: &str) -> Result<()> {
+    if !is_present().await {
+        return Ok(());
+    }
+    let proposed_dir = Coordinator::agent_proposed_dir(name);
+    if !proposed_dir.join(".git").exists() {
+        return Ok(());
+    }
+    let want = format!("{FORGE_HTTP}/core/meta.git");
+    let existing = crate::lifecycle::git_command()
+        .current_dir(&proposed_dir)
+        .args(["remote", "get-url", "meta"])
+        .output()
+        .await
+        .context("git remote get-url meta")?;
+    if existing.status.success() {
+        let current = String::from_utf8_lossy(&existing.stdout).trim().to_owned();
+        if current == want {
+            return Ok(());
+        }
+        crate::lifecycle::git(&proposed_dir, &["remote", "set-url", "meta", &want]).await
+    } else {
+        crate::lifecycle::git(&proposed_dir, &["remote", "add", "meta", &want]).await
+    }
+}
+
+/// Mirror agent `name`'s applied config repo — `main` plus every tag
+/// (`proposal` / `approved` / `building` / `deployed` / `failed` /
+/// `denied`) — to `agent-configs/<name>` on the local forge.
+/// Best-effort: returns Err which callers log + ignore. No-op when the
+/// forge isn't seeded or the applied repo doesn't exist yet.
+///
+/// Call this after every hive-c0re mutation of an applied repo's refs
+/// so the forge copy always reflects what core actually did. `--force`
+/// because a failed build rolls `main` backwards to the last-good sha.
+///
+/// The tokenised URL is passed straight to `git push` and deliberately
+/// never stored as a named remote: the applied repo is bind-mounted
+/// READ-ONLY into the manager container (`/applied`), so a token in
+/// `.git/config` would leak core's admin credential to an agent.
+pub async fn push_config(name: &str) -> Result<()> {
+    let Some(token) = core_token() else {
+        return Ok(());
+    };
+    let dir = Coordinator::agent_applied_dir(name);
+    if !dir.join(".git").exists() {
+        return Ok(());
+    }
+    let url = format!("http://core:{token}@localhost:3000/{CONFIG_ORG}/{name}.git");
+    let out = crate::lifecycle::git_command()
+        .current_dir(&dir)
+        .args([
+            "push",
+            "--force",
+            &url,
+            "refs/heads/main:refs/heads/main",
+            "refs/tags/*:refs/tags/*",
+        ])
+        .output()
+        .await
+        .context("invoke git push agent-configs")?;
+    if !out.status.success() {
+        anyhow::bail!(
+            "git push {CONFIG_ORG}/{name} failed ({}): {}",
+            out.status,
+            String::from_utf8_lossy(&out.stderr).trim()
+        );
+    }
+    tracing::info!(%name, "forge: mirrored applied config to agent-configs");
+    Ok(())
+}
+
+/// POST `/api/v1/orgs` to create an org named `name`. Idempotent:
+/// HTTP 422 ("user already exists") is treated as success.
+async fn ensure_org(name: &str, admin_token: &str) -> Result<()> {
+    let body = format!(r#"{{"username":"{name}"}}"#);
+    let url = format!("{FORGE_HTTP}/api/v1/orgs");
+    let status = forge_http(reqwest::Method::POST, &url, admin_token, &body).await?;
+    match status.as_u16() {
+        201 => {
+            tracing::info!(%name, "forge: created org");
+            Ok(())
+        }
+        422 | 409 => {
+            tracing::debug!(%name, "forge: org already exists");
+            Ok(())
+        }
+        other => anyhow::bail!("POST /api/v1/orgs name={name} returned HTTP {other}"),
+    }
+}
+
+/// Per-agent forge sync: ensure the agent has a forgejo user + token,
+/// a mirrored config repo, read access to `core/meta`, and the `meta`
+/// remote in its proposed repo. All operations are idempotent; failures
+/// are logged as warnings but don't abort the caller.
+///
+/// `core_token` is `core_token()` — passed in so callers that already
+/// fetched it don't re-read the file. Pass `None` to skip the
+/// `meta_read_access` step (safe: the access grant is best-effort).
+///
+/// Called by both `ensure_all()` (startup sweep) and `rebuild_agent`
+/// (per-rebuild) so the two paths stay equivalent.
+pub async fn sync_agent(name: &str, core_token: Option<&str>) {
+    if let Err(e) = ensure_user_for(name).await {
+        tracing::warn!(%name, error = ?e, "forge: ensure_user failed");
+    }
+    // Align email to match the git user.email set by meta::render_flake
+    // so commits link to the agent's Forgejo profile. Best-effort;
+    // also patches up agents created before this fix (old @hive.local).
+    ensure_user_email(name).await;
+    // Mirror the agent's applied config repo into agent-configs.
+    // ensure_config_repo is idempotent; push_config catches any
+    // drift since the last run — e.g. the startup migration just
+    // relocated `deployed/0`, or a deploy landed while the forge
+    // was down.
+    if let Err(e) = ensure_config_repo(name).await {
+        tracing::warn!(%name, error = ?e, "forge: ensure_config_repo failed");
+    }
+    if let Err(e) = push_config(name).await {
+        tracing::warn!(%name, error = ?e, "forge: push_config failed");
+    }
+    // Grant read-only access to core/meta and wire the `meta` remote
+    // into the proposed repo so agents can fetch their deployment context.
+    if let Some(token) = core_token
+        && let Err(e) = meta_read_access(name, token).await {
+            tracing::warn!(%name, error = ?e, "forge: ensure_meta_read_access failed");
+        }
+    if let Err(e) = ensure_meta_remote(name).await {
+        tracing::warn!(%name, error = ?e, "forge: ensure_meta_remote failed");
+    }
+}
+
+/// Sweep every existing container (manager + sub-agents) and ensure
+/// each has a forgejo user + token, plus an `agent-configs/<name>`
+/// repo mirroring its applied config. Also seeds the `core` admin
+/// user (hive-c0re's own identity for pushing the meta repo + driving
+/// the API), the `agent-configs` org, and the `core/meta` repo.
+/// Called once at hive-c0re startup. Per-step failures are logged
+/// but don't abort the sweep.
+pub async fn ensure_all() {
+    if !is_present().await {
+        tracing::debug!("forge: hive-forge container absent, skipping user sweep");
+        return;
+    }
+    let core_token = match ensure_core_user_and_token().await {
+        Ok(t) => Some(t),
+        Err(e) => {
+            tracing::warn!(error = ?e, "forge: ensure_core_user_and_token failed");
+            None
+        }
+    };
+    if let Some(token) = core_token.as_deref() {
+        for org in SEEDED_ORGS {
+            if let Err(e) = ensure_org(org, token).await {
+                tracing::warn!(%org, error = ?e, "forge: ensure_org failed");
+            }
+        }
+        // Meta repo lives at core/meta — pushed from git_commit in
+        // meta.rs on every deploy/lock-update. Make sure it exists
+        // before the first push hits a 404.
+        if let Err(e) = ensure_repo("meta", token).await {
+            tracing::warn!(error = ?e, "forge: ensure_repo core/meta failed");
+        }
+        if let Err(e) = ensure_core_avatar(token).await {
+            tracing::warn!(error = ?e, "forge: ensure_core_avatar failed");
+        }
+        if let Err(e) = ensure_config_org_avatar(token).await {
+            tracing::warn!(error = ?e, "forge: ensure_config_org_avatar failed");
+        }
+    }
+    let Ok(containers) = crate::lifecycle::list().await else {
+        tracing::warn!("forge: nixos-container list failed; skipping user sweep");
+        return;
+    };
+    for c in containers {
+        let name = if c == crate::lifecycle::MANAGER_NAME {
+            c
+        } else if let Some(n) = c.strip_prefix(crate::lifecycle::AGENT_PREFIX) {
+            n.to_owned()
+        } else {
+            continue;
+        };
+        sync_agent(&name, core_token.as_deref()).await;
+    }
+}
diff --git a/hive-c0re/src/lifecycle.rs b/hive-c0re/src/lifecycle.rs
new file mode 100644
index 00000000..cb12cb55
--- /dev/null
+++ b/hive-c0re/src/lifecycle.rs
@@ -0,0 +1,1144 @@
+//! `nixos-container` lifecycle + per-agent config flake generation.
+
+use std::path::Path;
+
+use anyhow::{Context, Result, bail};
+use tokio::process::Command;
+
+/// Sub-agent container prefix. `nixos-container` caps the total container name
+/// at 11 chars (it gets encoded into network interface names), so the agent
+/// name itself can be at most `MAX_AGENT_NAME` chars.
+pub const AGENT_PREFIX: &str = "h-";
+pub const MAX_AGENT_NAME: usize = 9;
+/// Container name of the manager. Lives in the same path scheme as sub-agents
+/// (`/var/lib/hyperhive/agents/hm1nd/`, `/var/lib/hyperhive/applied/hm1nd/`),
+/// but its container has no `h-` prefix and extends a different
+/// nixosConfiguration (`manager`, not `agent-base`).
+pub const MANAGER_NAME: &str = "hm1nd";
+
+/// Web UI port reserved for the manager (sub-agents hash into 8100..8999).
+pub const MANAGER_PORT: u16 = 8000;
+
+/// Mount point of the per-agent runtime directory inside the container.
+pub const CONTAINER_RUNTIME_MOUNT: &str = "/run/hive";
+
+/// Mount point of the per-agent Claude credentials dir inside the container.
+/// Persistent across destroy/recreate so OAuth login survives.
+pub const CONTAINER_CLAUDE_MOUNT: &str = "/root/.claude";
+
+/// Mount point of the per-agent durable knowledge dir inside the container.
+/// Agents are told (system prompt) to keep `notes.md` and any other scratch
+/// state here; persists across destroy/recreate.
+pub const CONTAINER_NOTES_MOUNT: &str = "/state";
+
+/// Mount point of the shared directory accessible to all agents.
+/// All agents can read/write here; agents should only put things they're
+/// willing to lose (other agents may delete them).
+pub const CONTAINER_SHARED_MOUNT: &str = "/shared";
+
+const GIT_NAME: &str = "c0re";
+const GIT_EMAIL: &str = "c0re@hyperhive";
+
+/// Sub-agent web UI port range. Deterministic from the agent's name (FNV-1a
+/// hash mod range size), so the dashboard can compute the same port without
+/// asking hive-c0re.
+const WEB_PORT_BASE: u16 = 8100;
+const WEB_PORT_RANGE: u16 = 900;
+
+/// Default resource caps applied to every managed container via a systemd
+/// drop-in under `/run/systemd/system/container@<NAME>.service.d/`.
+const DEFAULT_MEMORY_MAX: &str = "2G";
+const DEFAULT_CPU_QUOTA: &str = "50%";
+
+/// Per-agent web UI port. Manager is fixed at `MANAGER_PORT`; every
+/// sub-agent is `WEB_PORT_BASE + FNV-1a(name) % WEB_PORT_RANGE`,
+/// pure and reproducible from just the name. Collisions are
+/// possible (birthday paradox at ~30 agents); the operator resolves
+/// them by renaming an agent (different hash → different port).
+/// Stable across hosts, restarts, and dashboard renders — no
+/// state-file dance.
+#[must_use]
+pub fn agent_web_port(name: &str) -> u16 {
+    if name == MANAGER_NAME {
+        return MANAGER_PORT;
+    }
+    let mut hash: u32 = 2_166_136_261;
+    for b in name.bytes() {
+        hash ^= u32::from(b);
+        hash = hash.wrapping_mul(16_777_619);
+    }
+    // Modulo of a u32 by a u16's value is guaranteed < u16::MAX, so try_from never fails.
+    WEB_PORT_BASE + u16::try_from(hash % u32::from(WEB_PORT_RANGE)).unwrap_or(0)
+}
+
+#[must_use]
+pub fn container_name(name: &str) -> String {
+    if name == MANAGER_NAME {
+        MANAGER_NAME.to_owned()
+    } else {
+        format!("{AGENT_PREFIX}{name}")
+    }
+}
+
+#[must_use]
+pub fn is_manager(name: &str) -> bool {
+    name == MANAGER_NAME
+}
+
+fn validate(name: &str) -> Result<()> {
+    if name.is_empty() {
+        bail!("agent name must not be empty");
+    }
+    if is_manager(name) {
+        return Ok(());
+    }
+    if name.len() > MAX_AGENT_NAME {
+        bail!(
+            "agent name '{name}' is too long ({} chars); max {MAX_AGENT_NAME}",
+            name.len()
+        );
+    }
+    Ok(())
+}
+
+/// First name (≠ `self_name`) currently running whose hashed port
+/// matches this agent's. The harness inside the colliding container
+/// would otherwise loop on `AddrInUse` forever; we surface the
+/// conflict here so spawn / rebuild fails loudly with an actionable
+/// message instead.
+async fn port_collision(self_name: &str) -> Option<String> {
+    let port = agent_web_port(self_name);
+    let raw = list().await.unwrap_or_default();
+    for c in raw {
+        let other = if c == MANAGER_NAME {
+            MANAGER_NAME.to_owned()
+        } else if let Some(n) = c.strip_prefix(AGENT_PREFIX) {
+            n.to_owned()
+        } else {
+            continue;
+        };
+        if other == self_name {
+            continue;
+        }
+        if agent_web_port(&other) == port && is_running(&other).await {
+            return Some(other);
+        }
+    }
+    None
+}
+
+#[allow(clippy::too_many_arguments)]
+pub async fn spawn(
+    name: &str,
+    hyperhive_flake: &str,
+    agent_dir: &Path,
+    proposed_dir: &Path,
+    applied_dir: &Path,
+    claude_dir: &Path,
+    notes_dir: &Path,
+    dashboard_port: u16,
+    operator_pronouns: &str,
+    context_window_tokens: &std::collections::HashMap<String, u64>,
+) -> Result<()> {
+    validate(name)?;
+    if let Some(other) = port_collision(name).await {
+        bail!(
+            "port {} is already taken by '{other}' — rename one of them and retry",
+            agent_web_port(name)
+        );
+    }
+    setup_proposed(proposed_dir, name).await?;
+    setup_applied(applied_dir, Some(proposed_dir), name).await?;
+    ensure_claude_dir(claude_dir)?;
+    ensure_state_dir(notes_dir)?;
+    // Meta flake gets the new agent's input + nixosConfiguration
+    // before `nixos-container create` so the `--flake meta#<name>`
+    // ref resolves.
+    let agents = agents_after_spawn(name).await?;
+    crate::meta::sync_agents(hyperhive_flake, dashboard_port, operator_pronouns, context_window_tokens, &agents).await?;
+    let container = container_name(name);
+    let flake_ref = format!("{}#{name}", crate::meta::meta_dir().display());
+    run(&["create", &container, "--flake", &flake_ref]).await?;
+    set_nspawn_flags(&container, agent_dir, claude_dir, notes_dir)?;
+    set_resource_limits(&container)?;
+    systemd_daemon_reload().await?;
+    run(&["start", &container]).await
+}
+
+/// Build the `AgentSpec` list for the meta flake from `nixos-container
+/// list` + a hypothetical extra name not yet in the list (for spawn
+/// where the new agent's container doesn't exist yet). Pass empty
+/// `name_to_add` from rebuild paths where the agent is already in the
+/// container list.
+async fn agents_for_meta(name_to_add: Option<&str>) -> Result<Vec<crate::meta::AgentSpec>> {
+    let containers = list().await.unwrap_or_default();
+    let mut out: Vec<crate::meta::AgentSpec> = containers
+        .into_iter()
+        .filter_map(|c| {
+            let (name, is_manager) = if c == MANAGER_NAME {
+                (MANAGER_NAME.to_owned(), true)
+            } else if let Some(n) = c.strip_prefix(AGENT_PREFIX) {
+                (n.to_owned(), false)
+            } else {
+                return None;
+            };
+            Some(crate::meta::AgentSpec {
+                port: agent_web_port(&name),
+                name,
+                is_manager,
+            })
+        })
+        .collect();
+    if let Some(extra) = name_to_add
+        && !out.iter().any(|a| a.name == extra)
+    {
+        out.push(crate::meta::AgentSpec {
+            name: extra.to_owned(),
+            is_manager: is_manager(extra),
+            port: agent_web_port(extra),
+        });
+    }
+    out.sort_by(|a, b| a.name.cmp(&b.name));
+    Ok(out)
+}
+
+async fn agents_after_spawn(name: &str) -> Result<Vec<crate::meta::AgentSpec>> {
+    agents_for_meta(Some(name)).await
+}
+
+/// Like `agents_for_meta_listing` but with an extra agent added (for a
+/// container that doesn't exist yet). Used by the first-spawn path in
+/// `actions::run_apply_commit` to register the new agent in meta before
+/// `prepare_deploy` tries to update its input lock.
+pub async fn agents_for_meta_listing_with(extra: &str) -> Result<Vec<crate::meta::AgentSpec>> {
+    agents_for_meta(Some(extra)).await
+}
+
+/// Public enumeration of currently-existing agents (whatever
+/// `nixos-container list` says), sorted, no extras. For callers
+/// outside this module that need to reseed meta after lifecycle
+/// changes — destroy, startup reconciliation, etc.
+pub async fn agents_for_meta_listing() -> Result<Vec<crate::meta::AgentSpec>> {
+    agents_for_meta(None).await
+}
+
+/// True when the named container already exists (appears in
+/// `nixos-container list`). Used by the apply-commit path to decide
+/// between first-spawn (`nixos-container create`) and normal rebuild
+/// (`nixos-container update`).
+pub async fn container_exists(name: &str) -> bool {
+    let container = container_name(name);
+    list()
+        .await
+        .unwrap_or_default()
+        .iter()
+        .any(|c| c == &container)
+}
+
+pub async fn kill(name: &str) -> Result<()> {
+    validate(name)?;
+    let container = container_name(name);
+    run(&["stop", &container]).await
+}
+
+pub async fn start(name: &str) -> Result<()> {
+    validate(name)?;
+    let container = container_name(name);
+    run(&["start", &container]).await
+}
+
+/// Stop + start without regenerating any config. For "kick the container"
+/// without touching the flake or nspawn flags.
+pub async fn restart(name: &str) -> Result<()> {
+    kill(name).await?;
+    start(name).await
+}
+
+/// True when the container's systemd unit is active. Used by the dashboard
+/// to gate stop/restart buttons.
+pub async fn is_running(name: &str) -> bool {
+    let container = container_name(name);
+    let unit = format!("container@{container}.service");
+    Command::new("systemctl")
+        .args(["is-active", "--quiet", &unit])
+        .status()
+        .await
+        .map(|s| s.success())
+        .unwrap_or(false)
+}
+
+/// Fully tear down a sub-agent's container: stop + remove via `nixos-container
+/// destroy`, then clean our own systemd drop-in. Leaves it to the caller to
+/// wipe `/var/lib/hyperhive/...` state and the per-agent runtime dir.
+pub async fn destroy(name: &str) -> Result<()> {
+    validate(name)?;
+    let container = container_name(name);
+    // nixos-container destroy handles stop + removal of /var/lib/nixos-containers/<C>
+    // and /etc/nixos-containers/<C>.conf. Tolerate "no such container".
+    if let Err(e) = run(&["destroy", &container]).await {
+        tracing::warn!(error = ?e, "nixos-container destroy returned an error; continuing cleanup");
+    }
+    let dropin_dir = format!("/run/systemd/system/container@{container}.service.d");
+    if std::path::Path::new(&dropin_dir).exists() {
+        std::fs::remove_dir_all(&dropin_dir).with_context(|| format!("remove {dropin_dir}"))?;
+    }
+    Ok(())
+}
+
+#[allow(clippy::too_many_arguments)]
+pub async fn rebuild(
+    name: &str,
+    hyperhive_flake: &str,
+    agent_dir: &Path,
+    applied_dir: &Path,
+    claude_dir: &Path,
+    notes_dir: &Path,
+    dashboard_port: u16,
+    operator_pronouns: &str,
+    context_window_tokens: &std::collections::HashMap<String, u64>,
+) -> Result<()> {
+    // Sync the meta flake (idempotent — no-op when the rendered
+    // flake matches disk) so a manual rebuild from the dashboard
+    // can also recover from a divergent meta repo (e.g. an agent
+    // got added directly via `nixos-container create` outside
+    // hive-c0re).
+    let agents = agents_for_meta(None).await?;
+    crate::meta::sync_agents(hyperhive_flake, dashboard_port, operator_pronouns, context_window_tokens, &agents).await?;
+    // Then bump just this agent's input — picks up whatever
+    // `applied/<n>/main` currently points at (deployed/<latest>).
+    // Commits the lock if it changed.
+    crate::meta::lock_update_for_rebuild(name).await?;
+    rebuild_no_meta(name, agent_dir, applied_dir, claude_dir, notes_dir).await
+}
+
+/// Container-level rebuild without touching the meta repo. Callers
+/// that own the meta side themselves (`actions::run_apply_commit`
+/// drives meta through the two-phase prepare/finalize/abort flow)
+/// use this directly. Public `rebuild` wraps it with idempotent meta
+/// sync + lock-bump-and-commit.
+pub async fn rebuild_no_meta(
+    name: &str,
+    agent_dir: &Path,
+    applied_dir: &Path,
+    claude_dir: &Path,
+    notes_dir: &Path,
+) -> Result<()> {
+    validate(name)?;
+    if let Some(other) = port_collision(name).await {
+        bail!(
+            "port {} is already taken by '{other}' — rename one of them and retry",
+            agent_web_port(name)
+        );
+    }
+    setup_applied(applied_dir, None, name).await?;
+    ensure_claude_dir(claude_dir)?;
+    ensure_state_dir(notes_dir)?;
+    let container = container_name(name);
+    let flake_ref = format!("{}#{name}", crate::meta::meta_dir().display());
+    if container_exists(name).await {
+        // Existing container: preserve the prior running state across
+        // rebuild (closes #371) and apply both the new system profile
+        // AND any `/etc/nixos-containers/<c>.conf` / drop-in changes
+        // in a single start rather than `update`'s reload-then-outer-
+        // restart double-bounce.
+        //
+        // `nixos-container update` only runs `systemctl reload
+        // container@<c>` when the container is up (per the
+        // `isContainerRunning` check in nixos-container.pl), so
+        // stopping first makes `update` boot-style: build + nix-env
+        // --set the new profile, skip the in-container
+        // switch-to-configuration, let the next `start` apply both
+        // the new profile and the new EXTRA_NSPAWN_FLAGS in one go.
+        // If the container was already stopped, `update` builds + sets
+        // the profile and we leave it stopped.
+        let was_running = is_running(name).await;
+        set_nspawn_flags(&container, agent_dir, claude_dir, notes_dir)?;
+        set_resource_limits(&container)?;
+        systemd_daemon_reload().await?;
+        if was_running {
+            run(&["stop", &container]).await?;
+        }
+        run(&["update", &container, "--flake", &flake_ref]).await?;
+        if was_running {
+            run(&["start", &container]).await
+        } else {
+            Ok(())
+        }
+    } else {
+        // First spawn: create the container first (which writes the nspawn
+        // conf file), then overwrite with our flags and start.
+        run(&["create", &container, "--flake", &flake_ref]).await?;
+        set_nspawn_flags(&container, agent_dir, claude_dir, notes_dir)?;
+        set_resource_limits(&container)?;
+        systemd_daemon_reload().await?;
+        run(&["start", &container]).await
+    }
+}
+
+pub async fn list() -> Result<Vec<String>> {
+    let out = Command::new("nixos-container")
+        .arg("list")
+        .output()
+        .await
+        .context("invoke nixos-container list")?;
+    if !out.status.success() {
+        bail!(
+            "nixos-container list exited with status {}: {}",
+            out.status,
+            String::from_utf8_lossy(&out.stderr).trim()
+        );
+    }
+    Ok(String::from_utf8_lossy(&out.stdout)
+        .lines()
+        .map(str::trim)
+        .filter(|line| line.starts_with(AGENT_PREFIX) || *line == MANAGER_NAME)
+        .map(str::to_owned)
+        .collect())
+}
+
+/// Initialize the manager-editable proposed repo. Seeds two tracked
+/// files: `agent.nix` (the module the manager edits) and `flake.nix`
+/// (the boilerplate that lets the meta flake import this repo as an
+/// input — meta locks at a specific sha and reads
+/// `nixosModules.default`, so `flake.nix` must be in the commit). The
+/// manager shouldn't edit `flake.nix` (the prompt says so) but it's
+/// visible so they can introspect.
+///
+/// Touched by hive-c0re only on first spawn — never again — so the
+/// manager can't be surprised by hive-c0re commits or working-tree
+/// resets.
+pub async fn setup_proposed(proposed_dir: &Path, name: &str) -> Result<()> {
+    let fresh = !proposed_dir.join(".git").exists();
+    if fresh {
+        std::fs::create_dir_all(proposed_dir)
+            .with_context(|| format!("create {}", proposed_dir.display()))?;
+        let agent_path = proposed_dir.join("agent.nix");
+        if !agent_path.exists() {
+            std::fs::write(&agent_path, initial_agent_nix(name))
+                .with_context(|| format!("write {}", agent_path.display()))?;
+        }
+        let flake_path = proposed_dir.join("flake.nix");
+        if !flake_path.exists() {
+            std::fs::write(&flake_path, initial_flake_nix())
+                .with_context(|| format!("write {}", flake_path.display()))?;
+        }
+        git(proposed_dir, &["init", "--initial-branch=main"]).await?;
+        git(proposed_dir, &["add", "agent.nix", "flake.nix"]).await?;
+        git_commit(proposed_dir, "hive-c0re init").await?;
+    }
+    // Idempotently wire the `applied` remote — purely for the
+    // manager's ergonomics. The URL is the path inside the manager
+    // container (`/applied/<n>/.git`), where the RO bind in
+    // `set_nspawn_flags` makes it real. hive-c0re itself never
+    // dereferences this remote; the host-side fetch in
+    // `request_apply_commit` uses absolute host paths.
+    ensure_applied_remote(proposed_dir, name).await
+}
+
+async fn ensure_applied_remote(proposed_dir: &Path, name: &str) -> Result<()> {
+    let want = format!("/applied/{name}/.git");
+    let existing = git_command()
+        .current_dir(proposed_dir)
+        .args(["remote", "get-url", "applied"])
+        .output()
+        .await
+        .with_context(|| format!("git remote get-url applied in {}", proposed_dir.display()))?;
+    if existing.status.success() {
+        let current = String::from_utf8_lossy(&existing.stdout).trim().to_owned();
+        if current == want {
+            return Ok(());
+        }
+        // URL drifted (path scheme changed, etc.) — re-point it.
+        return git(proposed_dir, &["remote", "set-url", "applied", &want]).await;
+    }
+    git(proposed_dir, &["remote", "add", "applied", &want]).await
+}
+
+/// Set up the applied repo. First-spawn only: init the repo, pull
+/// proposed's initial commit in via `git fetch`, tag it `deployed/0`.
+/// This is the *only* time hive-c0re reads from `proposed` for an
+/// agent — subsequent proposals are fetched at `request_apply_commit`
+/// time and tagged `proposal/<id>` (see `actions::approve` for the
+/// tag state machine).
+///
+/// `proposed_dir` is `None` on rebuild paths where the repo already
+/// exists — we just verify it's the right shape and bail otherwise.
+/// Unlike the pre-overhaul code path, `flake.nix` is no longer
+/// regenerated at the host level: it's tracked in proposed (seeded by
+/// `setup_proposed`) and rides along on every fetch.
+pub async fn setup_applied(
+    applied_dir: &Path,
+    proposed_dir: Option<&Path>,
+    name: &str,
+) -> Result<()> {
+    std::fs::create_dir_all(applied_dir)
+        .with_context(|| format!("create {}", applied_dir.display()))?;
+
+    if !applied_dir.join(".git").exists() {
+        let Some(proposed) = proposed_dir else {
+            bail!(
+                "applied repo at {} is missing its .git directory; \
+                 cannot rebuild without a proposed source to seed from. \
+                 destroy --purge and re-spawn this agent.",
+                applied_dir.display()
+            );
+        };
+        git(applied_dir, &["init", "--initial-branch=main"]).await?;
+        let proposed_str = proposed.display().to_string();
+        // Seed the applied repo at the root (template) commit of proposed,
+        // not at `main`. This ensures `deployed/0` is the template baseline
+        // so the first ApplyCommit diff shows the manager's real changes
+        // rather than an empty diff (which happens when the manager has
+        // already committed their config and proposed/main == proposal/<id>).
+        let root_sha = git_root_commit(proposed).await?;
+        git(
+            applied_dir,
+            // --update-head-ok lets us fetch into refs/heads/main while
+            // HEAD still points there. git's default safeguard refuses
+            // to avoid index/working-tree desync, but the working tree
+            // is empty (we just `init`'d) and we read-tree-reset right
+            // after, so the safeguard is moot here.
+            &[
+                "fetch",
+                "--no-tags",
+                "--update-head-ok",
+                &proposed_str,
+                &format!("{root_sha}:refs/heads/main"),
+            ],
+        )
+        .await?;
+        git_read_tree_reset(applied_dir, "refs/heads/main").await?;
+        git_tag(applied_dir, "deployed/0", "refs/heads/main").await?;
+    } else if git_rev_parse(applied_dir, "refs/tags/deployed/0")
+        .await
+        .is_err()
+    {
+        // Pre-overhaul applied repo — no deployed/* tag scheme,
+        // flake.nix may be untracked, agent.nix possibly authored by
+        // hive-c0re directly. The startup auto-migration fixes this
+        // in place; if it didn't run (or got skipped), surface a
+        // clear error.
+        bail!(
+            "applied repo at {} predates the meta-flake layout. \
+             Restart hive-c0re to let the auto-migration run, or \
+             destroy --purge {name} and re-spawn.",
+            applied_dir.display()
+        );
+    }
+    Ok(())
+}
+
+/// Create the per-agent Claude credentials dir if missing. Mode 0700 — only
+/// root inside the container reads/writes it. Idempotent: existing dirs are
+/// left untouched (an agent's OAuth tokens survive `destroy`/recreate).
+/// Public for the `InitConfig` approval path in `actions.rs` which seeds
+/// dirs without calling the full `spawn`.
+pub fn ensure_claude_dir(claude_dir: &Path) -> Result<()> {
+    if !claude_dir.exists() {
+        std::fs::create_dir_all(claude_dir)
+            .with_context(|| format!("create {}", claude_dir.display()))?;
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            std::fs::set_permissions(claude_dir, std::fs::Permissions::from_mode(0o700))
+                .with_context(|| format!("chmod {}", claude_dir.display()))?;
+        }
+    }
+    Ok(())
+}
+
+/// Public for the `InitConfig` approval path in `actions.rs` which seeds
+/// dirs without calling the full `spawn`.
+pub fn ensure_state_dir(notes_dir: &Path) -> Result<()> {
+    if !notes_dir.exists() {
+        std::fs::create_dir_all(notes_dir)
+            .with_context(|| format!("create {}", notes_dir.display()))?;
+    }
+    Ok(())
+}
+
+fn initial_agent_nix(name: &str) -> String {
+    format!(
+        "{{ config, pkgs, lib, ... }}:\n{{\n  # Per-agent overrides for {name}. This is a regular NixOS module\n  # — add packages, services, modules, imports as needed.\n  #\n  # imports = [ ./extra-module.nix ];\n  # environment.systemPackages = with pkgs; [ ];\n}}\n",
+    )
+}
+
+/// Module-only flake exposed by every agent's repo. Consumed by the
+/// hive-c0re-owned meta flake at `/var/lib/hyperhive/meta/` as a flake
+/// input. The wrapper is intentionally permissive:
+///
+/// - Manager edits `inputs.* = …` to add other flakes (e.g. an MCP
+///   server's own flake) — the lock for those lands in the agent's
+///   own `flake.lock` and rolls up into meta's lock transitively.
+/// - The outputs block forwards every input (minus `self`) into
+///   `agent.nix` as the `flakeInputs` module argument, so the
+///   manager just references `flakeInputs.<name>.packages.${pkgs.system}.default`
+///   without further plumbing.
+///
+/// Identity injection (`HIVE_PORT` / `HIVE_LABEL` / dashboard port /
+/// git committer) still lives in the meta flake's wrapper.
+pub fn initial_flake_nix() -> &'static str {
+    "{\n  description = \"hyperhive agent\";\n  inputs = { };\n  outputs =\n    { self, ... }@inputs:\n    {\n      nixosModules.default = {\n        imports = [ ./agent.nix ];\n        _module.args.flakeInputs = builtins.removeAttrs inputs [ \"self\" ];\n      };\n    };\n}\n"
+}
+
+/// Return the SHA of the root (oldest, no-parent) commit in a repo.
+/// Used to seed the applied repo at the template baseline rather than at
+/// `main`, so the first `ApplyCommit` diff shows the manager's real changes.
+async fn git_root_commit(dir: &Path) -> Result<String> {
+    let out = git_command()
+        .current_dir(dir)
+        .args(["rev-list", "--max-parents=0", "HEAD"])
+        .output()
+        .await
+        .with_context(|| format!("git rev-list --max-parents=0 HEAD in {}", dir.display()))?;
+    if !out.status.success() {
+        anyhow::bail!(
+            "git rev-list --max-parents=0 failed: {}",
+            String::from_utf8_lossy(&out.stderr).trim()
+        );
+    }
+    Ok(String::from_utf8_lossy(&out.stdout).trim().to_owned())
+}
+
+async fn git_commit(dir: &Path, message: &str) -> Result<()> {
+    git(
+        dir,
+        &[
+            "-c",
+            &format!("user.name={GIT_NAME}"),
+            "-c",
+            &format!("user.email={GIT_EMAIL}"),
+            "commit",
+            "-m",
+            message,
+        ],
+    )
+    .await
+}
+
+/// Spawn `git` honoring the `HYPERHIVE_GIT` env var (absolute path baked in
+/// by the NixOS module), falling back to bare `git` (PATH lookup) otherwise.
+#[must_use]
+pub fn git_command() -> Command {
+    let exe = std::env::var("HYPERHIVE_GIT").unwrap_or_else(|_| "git".into());
+    Command::new(exe)
+}
+
+pub async fn git(dir: &Path, args: &[&str]) -> Result<()> {
+    let out = git_command()
+        .current_dir(dir)
+        .args(args)
+        .output()
+        .await
+        .with_context(|| format!("git {} in {}", args.join(" "), dir.display()))?;
+    if !out.status.success() {
+        bail!(
+            "git {} failed ({}): {}",
+            args.join(" "),
+            out.status,
+            String::from_utf8_lossy(&out.stderr).trim()
+        );
+    }
+    Ok(())
+}
+
+/// Fetch the commit `sha` from the `src` git repo into `dst` and pin
+/// it as `refs/tags/<tag>`. Used at `request_apply_commit` time so
+/// hive-c0re captures an immutable handle on the manager's commit;
+/// subsequent amendments / force-pushes in `src` no longer affect
+/// what gets built. Returns the resolved full sha.
+///
+/// `sha` must be a commit sha (short or full) — the caller
+/// (`submit_apply_commit`) shape-checks it first. We resolve it
+/// LOCALLY against `src` rather than asking the remote to resolve
+/// it: `git fetch <remote> <sha>:<dst>` treats the left side as a
+/// remote *ref name*, and a bare sha is not one ("couldn't find
+/// remote ref ..."). Fetching by sha would need a full 40-hex sha
+/// plus `uploadpack.allow*SHA1InWant` on the remote, which the
+/// proposed repos don't set. hive-c0re has direct read access to
+/// `src`, so a local `rev-parse` + a branch-glob fetch sidesteps
+/// the whole sha-want negotiation.
+pub async fn git_fetch_to_tag(dst: &Path, src: &Path, sha: &str, tag: &str) -> Result<String> {
+    let src_str = src.display().to_string();
+    // Resolve the (short-or-full) sha to a full sha against the
+    // source repo. The `^{commit}` peel + non-zero exit on a missing
+    // object means a typo'd / stale sha fails loudly right here.
+    let full = git_rev_parse(src, &format!("{sha}^{{commit}}"))
+        .await
+        .with_context(|| format!("commit '{sha}' not found in proposed repo {src_str}"))?;
+    // Bring src's objects into dst. Fetching every head pulls the
+    // wanted commit's history (always reachable from a branch in the
+    // manager's flow) into dst's object db without sha-want.
+    git(
+        dst,
+        &[
+            "fetch",
+            "--no-tags",
+            &src_str,
+            "+refs/heads/*:refs/remotes/proposal-src/*",
+        ],
+    )
+    .await?;
+    // Pin the exact commit as the proposal tag. The objects are now
+    // local so this resolves without touching the remote.
+    git(dst, &["tag", tag, &full]).await.with_context(|| {
+        format!("tag {tag} at {full}: commit not reachable from any branch in proposed repo")
+    })?;
+    Ok(full)
+}
+
+/// Resolve `refname` (a tag, branch, or sha) in `dir` to its full sha.
+pub async fn git_rev_parse(dir: &Path, refname: &str) -> Result<String> {
+    let out = git_command()
+        .current_dir(dir)
+        .args(["rev-parse", refname])
+        .output()
+        .await
+        .with_context(|| format!("git rev-parse {refname} in {}", dir.display()))?;
+    if !out.status.success() {
+        bail!(
+            "git rev-parse {refname} failed ({}): {}",
+            out.status,
+            String::from_utf8_lossy(&out.stderr).trim()
+        );
+    }
+    Ok(String::from_utf8_lossy(&out.stdout).trim().to_owned())
+}
+
+/// Plant a lightweight tag at `target`. Errors if the tag already
+/// exists — we want loud failures on id reuse, not silent
+/// overwrites.
+pub async fn git_tag(dir: &Path, name: &str, target: &str) -> Result<()> {
+    git(dir, &["tag", name, target]).await
+}
+
+/// Plant an annotated tag with `body` as the message. Used for
+/// `failed/<id>` (body = build error) and `denied/<id>` (body =
+/// operator note). Multi-line bodies handled via stdin so we don't
+/// have to escape anything.
+pub async fn git_tag_annotated(dir: &Path, name: &str, target: &str, body: &str) -> Result<()> {
+    use tokio::io::AsyncWriteExt;
+    // Annotated tags are git objects, so they need a tagger identity
+    // (same constraint as a commit). Pass the hive-c0re identity
+    // inline rather than relying on a global git config — applied
+    // repos are hive-c0re-owned and the host's user might not have
+    // user.email set.
+    let mut child = git_command()
+        .current_dir(dir)
+        .args([
+            "-c",
+            &format!("user.name={GIT_NAME}"),
+            "-c",
+            &format!("user.email={GIT_EMAIL}"),
+            "tag",
+            "-a",
+            name,
+            target,
+            "-F",
+            "-",
+        ])
+        .stdin(std::process::Stdio::piped())
+        .stdout(std::process::Stdio::piped())
+        .stderr(std::process::Stdio::piped())
+        .spawn()
+        .with_context(|| format!("spawn git tag -a {name} in {}", dir.display()))?;
+    if let Some(mut stdin) = child.stdin.take() {
+        stdin
+            .write_all(body.as_bytes())
+            .await
+            .context("write tag body to git stdin")?;
+        // Drop closes stdin so git can finish reading.
+        drop(stdin);
+    }
+    let out = child.wait_with_output().await.context("wait git tag -a")?;
+    if !out.status.success() {
+        bail!(
+            "git tag -a {name} failed ({}): {}",
+            out.status,
+            String::from_utf8_lossy(&out.stderr).trim()
+        );
+    }
+    Ok(())
+}
+
+/// Replace working tree + index with the tree at `target` without
+/// moving HEAD. `applied/main` stays pointing at the last known-good
+/// `deployed/*` while we let `nixos-container update` evaluate the
+/// candidate. On build failure callers reset back to HEAD; on
+/// success they fast-forward main to `target`.
+pub async fn git_read_tree_reset(dir: &Path, target: &str) -> Result<()> {
+    git(dir, &["read-tree", "--reset", "-u", target]).await
+}
+
+/// Hard-set a ref to `target`. Used to fast-forward `refs/heads/main`
+/// to the just-deployed proposal commit. Uses `update-ref`, not
+/// `branch -f`, so it works regardless of where HEAD currently sits.
+pub async fn git_update_ref(dir: &Path, refname: &str, target: &str) -> Result<()> {
+    git(dir, &["update-ref", refname, target]).await
+}
+
+/// Write a systemd drop-in for `container@<container>.service` that applies
+/// our default resource caps. Goes under `/run/systemd/system/...` so it's
+/// ephemeral (regenerated on every spawn / rebuild).
+fn set_resource_limits(container: &str) -> Result<()> {
+    let dir = format!("/run/systemd/system/container@{container}.service.d");
+    std::fs::create_dir_all(&dir).with_context(|| format!("create {dir}"))?;
+    let path = format!("{dir}/hyperhive-limits.conf");
+    let content =
+        format!("[Service]\nMemoryMax={DEFAULT_MEMORY_MAX}\nCPUQuota={DEFAULT_CPU_QUOTA}\n",);
+    std::fs::write(&path, content).with_context(|| format!("write {path}"))?;
+    tracing::info!(
+        %path,
+        memory_max = DEFAULT_MEMORY_MAX,
+        cpu_quota = DEFAULT_CPU_QUOTA,
+        "wrote resource limits drop-in"
+    );
+    Ok(())
+}
+
+async fn systemd_daemon_reload() -> Result<()> {
+    let out = Command::new("systemctl")
+        .arg("daemon-reload")
+        .output()
+        .await
+        .context("invoke systemctl daemon-reload")?;
+    if !out.status.success() {
+        bail!(
+            "systemctl daemon-reload failed ({}): {}",
+            out.status,
+            String::from_utf8_lossy(&out.stderr).trim()
+        );
+    }
+    Ok(())
+}
+
+/// Idempotently rewrite the lines in `/etc/nixos-containers/<container>.conf`
+/// that hive-c0re owns: `PRIVATE_NETWORK` (forced 0 so the agent's web UI port
+/// is reachable on the host) and `EXTRA_NSPAWN_FLAGS` (the runtime-dir bind).
+/// The start script expands `$EXTRA_NSPAWN_FLAGS` unquoted into the
+/// `systemd-nspawn` command.
+/// Where in the container's filesystem the manager sees its agents tree.
+/// Matches the `/agents` path that pre-Phase-8 hosts declared via
+/// `containers.hm1nd.bindMounts."/agents"`.
+pub const CONTAINER_MANAGER_AGENTS_MOUNT: &str = "/agents";
+
+/// Where the manager sees the applied trees of every agent, read-only.
+/// Manager runs `git fetch /applied/<n>/.git refs/tags/*:refs/tags/applied/*`
+/// to learn what hive-c0re deployed (or rejected, or failed to
+/// build); the RO bind makes accidental writes impossible from
+/// inside the container.
+pub const CONTAINER_MANAGER_APPLIED_MOUNT: &str = "/applied";
+
+/// The on-host root that gets bind-mounted to `/agents` inside the manager.
+/// Hard-coded to match `AGENT_STATE_ROOT` in coordinator.rs (kept duplicated
+/// here so lifecycle stays usable as a leaf module).
+const HOST_AGENTS_ROOT: &str = "/var/lib/hyperhive/agents";
+
+/// On-host applied repo root, mirrored RO into the manager. Matches
+/// `APPLIED_STATE_ROOT` in coordinator.rs.
+const HOST_APPLIED_ROOT: &str = "/var/lib/hyperhive/applied";
+
+/// On-host meta repo root, mirrored RO into the manager. Matches
+/// `meta::meta_dir()` but duplicated here so lifecycle stays a leaf.
+const HOST_META_ROOT: &str = "/var/lib/hyperhive/meta";
+
+/// Shared directory accessible to all agents. All agents bind-mount this RW.
+const HOST_SHARED_ROOT: &str = "/var/lib/hyperhive/shared";
+
+fn set_nspawn_flags(
+    container: &str,
+    runtime_dir: &Path,
+    claude_dir: &Path,
+    notes_dir: &Path,
+) -> Result<()> {
+    use std::fmt::Write as _;
+
+    // Ensure /shared directory exists before binding. systemd-nspawn requires the bind source to exist.
+    std::fs::create_dir_all(HOST_SHARED_ROOT)
+        .with_context(|| format!("create {HOST_SHARED_ROOT}"))?;
+
+    let path = format!("/etc/nixos-containers/{container}.conf");
+    let original = std::fs::read_to_string(&path).with_context(|| format!("read {path}"))?;
+
+    // Logical agent name (container name minus the sub-agent prefix).
+    // For the manager the strip is a no-op — harmless, manager paths
+    // below are gated on `container == MANAGER_NAME` anyway.
+    let agent_name = container.strip_prefix(AGENT_PREFIX).unwrap_or(container);
+
+    // Compute the in-container state mount point. Sub-agents get
+    // /agents/<name>/state; the manager keeps the legacy /state path.
+    // Claude credentials always land at /root/.claude for all agents so
+    // the `claude` CLI (which reads $HOME/.claude) finds them without any
+    // HOME override.
+    let notes_mount = if container == MANAGER_NAME {
+        CONTAINER_NOTES_MOUNT.to_owned()
+    } else {
+        format!("/agents/{agent_name}/state")
+    };
+    let claude_mount = CONTAINER_CLAUDE_MOUNT;
+
+    let mut binds = format!(
+        "--bind={runtime}:{CONTAINER_RUNTIME_MOUNT} --bind={claude}:{claude_mount} --bind={notes}:{notes_mount} --bind={shared}:{CONTAINER_SHARED_MOUNT}",
+        runtime = runtime_dir.display(),
+        claude = claude_dir.display(),
+        notes = notes_dir.display(),
+        shared = HOST_SHARED_ROOT,
+    );
+    if container == MANAGER_NAME {
+        // systemd-nspawn refuses to start a container whose bind
+        // source doesn't exist. The meta repo is created by the
+        // startup migration, but make sure the directory is there
+        // before the manager comes up in case set_nspawn_flags fires
+        // first (e.g. cold start with no agents).
+        std::fs::create_dir_all(HOST_META_ROOT)
+            .with_context(|| format!("create {HOST_META_ROOT}"))?;
+        // Manager edits sub-agent proposed/ repos and its own. RW so it can
+        // git-commit. Sub-agents see only their own /run/hive socket and
+        // /root/.claude (no /agents or /applied).
+        //
+        // /applied is a separate RO mount of the hive-c0re-only applied
+        // repos so the manager can `git fetch /applied/<n>/.git
+        // refs/tags/*:refs/tags/applied/*` to mirror deployed/failed/
+        // denied tags into its proposed clones and diff against
+        // what's actually deployed. RO bind makes destructive git
+        // plumbing inside the container unable to corrupt applied.
+        //
+        // /meta is a third RO mount exposing the system-wide deploy
+        // flake (`git log /meta --oneline` shows every deploy across
+        // every agent; `cat /meta/flake.lock` resolves which sha each
+        // agent is pinned at right now).
+        let _ = write!(
+            binds,
+            " --bind={HOST_AGENTS_ROOT}:{CONTAINER_MANAGER_AGENTS_MOUNT}",
+        );
+        let _ = write!(
+            binds,
+            " --bind-ro={HOST_APPLIED_ROOT}:{CONTAINER_MANAGER_APPLIED_MOUNT}",
+        );
+        let _ = write!(
+            binds,
+            " --bind-ro={HOST_META_ROOT}:{mount}",
+            mount = crate::meta::CONTAINER_MANAGER_META_MOUNT,
+        );
+    } else {
+        // Sub-agents get a READ-ONLY view of their own proposed
+        // config repo at /agents/<name>/config — agent.nix plus
+        // whatever extra files the manager split the config into.
+        // Lets an agent inspect exactly what defines it and request
+        // precise changes from the manager. RO is load-bearing: the
+        // agent must NOT edit its own config — changes only ever flow
+        // through the manager's RW proposed repo + the approval
+        // queue. The manager already has this dir RW via the /agents
+        // tree bind above.
+        let config_dir = format!("{HOST_AGENTS_ROOT}/{agent_name}/config");
+        // nspawn refuses to start when a bind source is missing.
+        // `setup_proposed` seeds this dir before spawn reaches here,
+        // but create defensively so a missing repo degrades to an
+        // empty RO dir instead of a container that won't boot.
+        std::fs::create_dir_all(&config_dir)
+            .with_context(|| format!("create {config_dir}"))?;
+        let _ = write!(binds, " --bind-ro={config_dir}:/agents/{agent_name}/config");
+    }
+    let bind_flag = format!("EXTRA_NSPAWN_FLAGS=\"{binds}\"");
+    let mut lines: Vec<String> = original
+        .lines()
+        .filter(|line| {
+            let trimmed = line.trim_start();
+            // Strip any network-namespace knobs nixos-container's create
+            // might have populated. The start script adds `--network-veth`
+            // whenever HOST_ADDRESS / LOCAL_ADDRESS (or their IPv6 cousins)
+            // are non-empty — and veth implies a private netns, hiding our
+            // web-UI port from the host. Force host netns.
+            !trimmed.starts_with("EXTRA_NSPAWN_FLAGS=")
+                && !trimmed.starts_with("PRIVATE_NETWORK=")
+                && !trimmed.starts_with("HOST_ADDRESS=")
+                && !trimmed.starts_with("LOCAL_ADDRESS=")
+                && !trimmed.starts_with("HOST_ADDRESS6=")
+                && !trimmed.starts_with("LOCAL_ADDRESS6=")
+                && !trimmed.starts_with("HOST_BRIDGE=")
+        })
+        .map(str::to_owned)
+        .collect();
+    lines.push("PRIVATE_NETWORK=0".to_owned());
+    lines.push("HOST_ADDRESS=".to_owned());
+    lines.push("LOCAL_ADDRESS=".to_owned());
+    lines.push("HOST_ADDRESS6=".to_owned());
+    lines.push("LOCAL_ADDRESS6=".to_owned());
+    lines.push("HOST_BRIDGE=".to_owned());
+    lines.push(bind_flag);
+    let mut content = lines.join("\n");
+    content.push('\n');
+    std::fs::write(&path, content).with_context(|| format!("write {path}"))?;
+    tracing::info!(%path, "set PRIVATE_NETWORK=0 + EXTRA_NSPAWN_FLAGS");
+    Ok(())
+}
+
+/// Spawn `nixos-container <args>` and pipe its stdout + stderr into
+/// `tracing` one line at a time so a long-running command (most
+/// notably `update`, which kicks off a full nix build that can run
+/// for minutes on a stale flake) shows progress in journald as it
+/// happens. The buffered `.output()` we used before only flushed the
+/// summary at exit, which made "slow" and "stuck" look identical to
+/// the operator watching `journalctl -u hive-c0re -f`.
+///
+/// stdout lines log at INFO, stderr at WARN. Stderr lines are also
+/// collected into a single string so the bailout message at the end
+/// can include the actual failure reason (nix dumps eval errors to
+/// stderr).
+async fn run(args: &[&str]) -> Result<()> {
+    use tokio::io::{AsyncBufReadExt, BufReader};
+    let cmdline = args.join(" ");
+    let mut child = Command::new("nixos-container")
+        .args(args)
+        .stdout(std::process::Stdio::piped())
+        .stderr(std::process::Stdio::piped())
+        .spawn()
+        .with_context(|| format!("invoke nixos-container {cmdline}"))?;
+
+    let stdout = child.stdout.take().expect("piped stdout");
+    let stderr = child.stderr.take().expect("piped stderr");
+
+    let stdout_cmdline = cmdline.clone();
+    let pump_stdout = tokio::spawn(async move {
+        let mut lines = BufReader::new(stdout).lines();
+        while let Ok(Some(line)) = lines.next_line().await {
+            tracing::info!(target: "nixos-container", cmdline = %stdout_cmdline, "{line}");
+        }
+    });
+
+    // Tail of stderr lines (last 32) for the bailout message. Newer
+    // lines push older ones out; nix's actual error usually lands
+    // in the last few lines.
+    let stderr_cmdline = cmdline.clone();
+    let stderr_tail: std::sync::Arc<std::sync::Mutex<std::collections::VecDeque<String>>> =
+        std::sync::Arc::new(std::sync::Mutex::new(
+            std::collections::VecDeque::with_capacity(32),
+        ));
+    let stderr_tail_pump = stderr_tail.clone();
+    let pump_stderr = tokio::spawn(async move {
+        let mut lines = BufReader::new(stderr).lines();
+        while let Ok(Some(line)) = lines.next_line().await {
+            tracing::warn!(target: "nixos-container", cmdline = %stderr_cmdline, "{line}");
+            let mut tail = stderr_tail_pump.lock().unwrap();
+            if tail.len() == 32 {
+                tail.pop_front();
+            }
+            tail.push_back(line);
+        }
+    });
+
+    let status = child
+        .wait()
+        .await
+        .with_context(|| format!("wait nixos-container {cmdline}"))?;
+    let _ = pump_stdout.await;
+    let _ = pump_stderr.await;
+
+    if !status.success() {
+        let tail = stderr_tail
+            .lock()
+            .unwrap()
+            .iter()
+            .cloned()
+            .collect::<Vec<_>>()
+            .join("\n");
+        let journal = container_journal_tail(args).await;
+        bail!("nixos-container {cmdline} failed ({status}): {tail}{journal}");
+    }
+    Ok(())
+}
+
+/// On a failed `nixos-container update`, the stderr nixos-container
+/// itself prints is often terse ("failed to reload container") — the
+/// real reason (which unit failed `switch-to-configuration` during
+/// the reload phase) lands in the *container's* own journal, not on
+/// the host. Fetch the tail of it so a failed rebuild self-documents
+/// the failing unit in the error string, no second round-trip.
+///
+/// Scoped to `update`: that's the reload-phase case, and the
+/// container is still up (running the old generation) so
+/// `journalctl -M` works. Best-effort — returns "" for other verbs
+/// or when the journal can't be read (machine gone, journalctl
+/// missing); it never produces an error of its own.
+async fn container_journal_tail(args: &[&str]) -> String {
+    if args.first().copied() != Some("update") {
+        return String::new();
+    }
+    let Some(container) = args.get(1) else {
+        return String::new();
+    };
+    let out = Command::new("journalctl")
+        .args(["-M", container, "-n", "40", "--no-pager", "--output=short"])
+        .output()
+        .await;
+    match out {
+        Ok(o) if !o.stdout.is_empty() => format!(
+            "\n--- last 40 journal lines from container '{container}' ---\n{}",
+            String::from_utf8_lossy(&o.stdout).trim_end()
+        ),
+        _ => String::new(),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Regression test: `setup_proposed` must seed both agent.nix and flake.nix
+    /// in the initial commit. Before commit 5b5a93e flake.nix was missing from
+    /// the scaffold, requiring manual creation (seen with the damocles agent).
+    #[tokio::test]
+    async fn setup_proposed_seeds_flake_nix() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let proposed = dir.path().join("proposed");
+        setup_proposed(&proposed, "test-agent")
+            .await
+            .expect("setup_proposed");
+
+        // Both files must exist on disk.
+        assert!(proposed.join("agent.nix").exists(), "agent.nix missing");
+        assert!(proposed.join("flake.nix").exists(), "flake.nix missing");
+
+        // flake.nix must export nixosModules.default (the meta-flake contract).
+        let flake = std::fs::read_to_string(proposed.join("flake.nix")).unwrap();
+        assert!(
+            flake.contains("nixosModules.default"),
+            "flake.nix does not export nixosModules.default"
+        );
+
+        // Both files must be tracked in the initial git commit.
+        let out = git_command()
+            .current_dir(&proposed)
+            .args(["show", "--name-only", "--format=", "HEAD"])
+            .output()
+            .await
+            .expect("git show");
+        let tracked = String::from_utf8_lossy(&out.stdout);
+        assert!(tracked.contains("agent.nix"), "agent.nix not committed");
+        assert!(tracked.contains("flake.nix"), "flake.nix not committed");
+    }
+
+    /// `setup_proposed` is idempotent: calling it on an existing repo is a
+    /// no-op (the fresh guard skips all writes).
+    #[tokio::test]
+    async fn setup_proposed_idempotent() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let proposed = dir.path().join("proposed");
+        setup_proposed(&proposed, "test-agent")
+            .await
+            .expect("first call");
+        // Second call must not error even though .git already exists.
+        setup_proposed(&proposed, "test-agent")
+            .await
+            .expect("second call");
+        // Still one commit.
+        let out = git_command()
+            .current_dir(&proposed)
+            .args(["rev-list", "--count", "HEAD"])
+            .output()
+            .await
+            .expect("git rev-list");
+        let count = String::from_utf8_lossy(&out.stdout).trim().to_owned();
+        assert_eq!(count, "1", "expected exactly one commit after idempotent call");
+    }
+}
diff --git a/hive-c0re/src/limits.rs b/hive-c0re/src/limits.rs
new file mode 100644
index 00000000..a1e3a173
--- /dev/null
+++ b/hive-c0re/src/limits.rs
@@ -0,0 +1,66 @@
+//! Wire-protocol size limits shared across the agent + manager
+//! sockets. Caps on inline message bodies stop a single chatty agent
+//! (or a misbehaving extra-MCP server) from flooding the broker
+//! sqlite with megabyte-sized rows that then bloat every recipient's
+//! wake-prompt context. Anything genuinely larger should be written
+//! to a state file and the path sent as the body.
+//!
+//! Reminders get a separate auto-file escape hatch (see
+//! `agent_server::handle_remind`) so callers don't have to think
+//! about it — oversized reminder bodies get persisted to disk
+//! transparently and the inbox sees a pointer.
+
+/// Per-message body cap. Applies to `send`, `ask` question text,
+/// `answer` body, and the stored inline form of a reminder. 4 KiB
+/// catches the bulk of conversational overflow (status reports,
+/// bullet-list summaries, short proposals) while staying small
+/// enough that a backed-up inbox of ~10 unread messages only adds
+/// ~40 KiB to the recipient's wake-prompt context. Genuinely
+/// long-form artifacts (audit reports, full diffs, transcripts)
+/// still belong in a state file — the error message on overflow
+/// points callers at that escape hatch.
+pub const MESSAGE_MAX_BYTES: usize = 4096;
+
+/// Validate that `body` fits under [`MESSAGE_MAX_BYTES`]. Returns a
+/// caller-ready error string (caller wraps in
+/// `AgentResponse::Err`/`ManagerResponse::Err`) on failure.
+///
+/// `label` shows up in the error message verbatim — pass a short
+/// noun like `"send"`, `"question"`, `"broadcast"` so the model can
+/// tell which call got rejected.
+pub fn check_size(label: &str, body: &str) -> Result<(), String> {
+    if body.len() > MESSAGE_MAX_BYTES {
+        Err(format!(
+            "{label} body too long ({} bytes, max {MESSAGE_MAX_BYTES}); write the \
+             payload to a file under your `/agents/<you>/state/` dir and send the \
+             path as the body instead",
+            body.len()
+        ))
+    } else {
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn accepts_short_body() {
+        assert!(check_size("send", "hello").is_ok());
+        assert!(check_size("send", &"x".repeat(MESSAGE_MAX_BYTES)).is_ok());
+    }
+
+    #[test]
+    fn rejects_oversize_body() {
+        let err = check_size("send", &"x".repeat(MESSAGE_MAX_BYTES + 1)).unwrap_err();
+        assert!(err.contains("send body too long"));
+        assert!(err.contains(&format!("max {MESSAGE_MAX_BYTES}")));
+    }
+
+    #[test]
+    fn label_threads_through() {
+        let err = check_size("question", &"x".repeat(MESSAGE_MAX_BYTES + 1)).unwrap_err();
+        assert!(err.starts_with("question body too long"));
+    }
+}
diff --git a/hive-c0re/src/loose_ends.rs b/hive-c0re/src/loose_ends.rs
new file mode 100644
index 00000000..6cd903de
--- /dev/null
+++ b/hive-c0re/src/loose_ends.rs
@@ -0,0 +1,153 @@
+//! Loose-ends aggregator. Walks the `approvals` + `operator_questions`
+//! tables once per call and assembles a `Vec<LooseEnd>` for either
+//! a single agent (`for_agent`) or the whole hive (`hive_wide`). Both
+//! `AgentRequest::GetLooseEnds` and `ManagerRequest::GetLooseEnds`
+//! land here so the routing logic + age-seconds derivation stay in
+//! one place.
+//!
+//! Call frequency is low (an agent doing self-introspection between
+//! turns), so the sweep happens fresh every time — no caching, no
+//! mutation events. If the sweep ever shows up in a profile, the
+//! sqlite queries already filter on the same indexes
+//! (`idx_approvals_pending` + `idx_operator_questions_pending`) that
+//! the dashboard uses, so the bottleneck would be json
+//! (de)serialisation, not the read.
+
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use anyhow::Result;
+use hive_sh4re::{MANAGER_AGENT, LooseEnd};
+
+use crate::coordinator::Coordinator;
+
+/// Open threads pending against `agent`:
+/// - pending approvals where this agent is the submitter (only ever
+///   true for the manager — sub-agents don't submit approvals — but
+///   we keep the rule per-agent so the manager's MCP surface gets
+///   the same shape via a different code path);
+/// - unanswered questions where `agent` is the asker (waiting on
+///   someone) OR the target (owes a reply);
+/// - pending reminders this agent scheduled (`owner == self`).
+///
+/// Ordered approvals → questions → reminders within the returned
+/// vector. Within each kind, source-of-truth ordering (sqlite's
+/// `pending()` queries return newest-first within their indexes).
+pub fn for_agent(coord: &Coordinator, agent: &str) -> Result<Vec<LooseEnd>> {
+    let now = now_unix();
+    let mut out = Vec::new();
+    // Approvals are only submitted by the manager today. When that
+    // expands (e.g. sub-agents propose changes to their own configs),
+    // teach the approvals table to track the submitter and filter
+    // here on that column — for now MANAGER_AGENT == sole submitter.
+    if agent == MANAGER_AGENT {
+        for a in coord.approvals.pending()? {
+            out.push(LooseEnd::Approval {
+                id: a.id,
+                agent: a.agent,
+                commit_ref: a.commit_ref,
+                description: a.description,
+                age_seconds: saturating_age(now, a.requested_at),
+            });
+        }
+    }
+    for q in coord.questions.pending_all()? {
+        let role_match = q.asker == agent || q.target.as_deref() == Some(agent);
+        if !role_match {
+            continue;
+        }
+        out.push(LooseEnd::Question {
+            id: q.id,
+            asker: q.asker,
+            target: q.target,
+            question: q.question,
+            age_seconds: saturating_age(now, q.asked_at),
+        });
+    }
+    for r in coord.broker.list_pending_reminders()? {
+        if r.agent != agent {
+            continue;
+        }
+        out.push(LooseEnd::Reminder {
+            id: r.id,
+            owner: r.agent,
+            message: r.message,
+            due_at: r.due_at,
+            age_seconds: saturating_age(now, r.created_at),
+        });
+    }
+    Ok(out)
+}
+
+/// Hive-wide loose-ends view: EVERY pending approval + EVERY
+/// unanswered question + EVERY pending reminder. Manager surface
+/// only; sub-agents can't see each other's threads via the agent
+/// surface (`for_agent` filters by name).
+pub fn hive_wide(coord: &Coordinator) -> Result<Vec<LooseEnd>> {
+    let now = now_unix();
+    let mut out = Vec::new();
+    for a in coord.approvals.pending()? {
+        out.push(LooseEnd::Approval {
+            id: a.id,
+            agent: a.agent,
+            commit_ref: a.commit_ref,
+            description: a.description,
+            age_seconds: saturating_age(now, a.requested_at),
+        });
+    }
+    for q in coord.questions.pending_all()? {
+        out.push(LooseEnd::Question {
+            id: q.id,
+            asker: q.asker,
+            target: q.target,
+            question: q.question,
+            age_seconds: saturating_age(now, q.asked_at),
+        });
+    }
+    for r in coord.broker.list_pending_reminders()? {
+        out.push(LooseEnd::Reminder {
+            id: r.id,
+            owner: r.agent,
+            message: r.message,
+            due_at: r.due_at,
+            age_seconds: saturating_age(now, r.created_at),
+        });
+    }
+    Ok(out)
+}
+
+fn saturating_age(now: i64, then: i64) -> u64 {
+    let delta = now.saturating_sub(then);
+    u64::try_from(delta).unwrap_or(0)
+}
+
+fn now_unix() -> i64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .ok()
+        .and_then(|d| i64::try_from(d.as_secs()).ok())
+        .unwrap_or(0)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn saturating_age_handles_clock_back_step() {
+        // `now` < `then`: caller's clock went backwards between rows.
+        // We saturate to 0 rather than returning a negative or
+        // wrapping around to ~u64::MAX (which would render as "27
+        // billion years ago" in the wake prompt).
+        assert_eq!(saturating_age(100, 200), 0);
+    }
+
+    #[test]
+    fn saturating_age_normal_case() {
+        assert_eq!(saturating_age(1_000_000, 999_990), 10);
+    }
+
+    #[test]
+    fn saturating_age_zero_when_equal() {
+        assert_eq!(saturating_age(42, 42), 0);
+    }
+}
diff --git a/hive-c0re/src/main.rs b/hive-c0re/src/main.rs
new file mode 100644
index 00000000..9b00cc91
--- /dev/null
+++ b/hive-c0re/src/main.rs
@@ -0,0 +1,376 @@
+use std::path::PathBuf;
+use std::sync::Arc;
+
+use anyhow::{Context as _, Result, bail};
+use clap::{Parser, Subcommand};
+use hive_sh4re::{HostRequest, HostResponse};
+
+mod actions;
+mod agent_server;
+mod approvals;
+mod auto_update;
+mod broker;
+mod client;
+mod container_view;
+mod coordinator;
+mod crash_watch;
+mod dashboard;
+mod dashboard_events;
+mod events_vacuum;
+mod stats_vacuum;
+mod flake_check;
+mod forge;
+mod lifecycle;
+mod scheduled_prompts;
+mod scheduled_prompts_worker;
+mod limits;
+mod loose_ends;
+mod manager_server;
+mod meta;
+mod migrate;
+mod operator_questions;
+mod questions;
+mod rebuild_queue;
+mod topology;
+mod reminder_scheduler;
+mod server;
+
+use coordinator::Coordinator;
+
+#[derive(Parser)]
+#[command(name = "hive-c0re", about = "hyperhive coordinator daemon and CLI")]
+struct Cli {
+    /// Path to the host admin socket.
+    #[arg(long, global = true, default_value = "/run/hyperhive/host.sock")]
+    socket: PathBuf,
+
+    #[command(subcommand)]
+    cmd: Cmd,
+}
+
+#[derive(Subcommand)]
+enum Cmd {
+    /// Run the coordinator daemon.
+    Serve {
+        /// URL of the hyperhive flake. Inlined into each per-agent
+        /// `flake.nix` as the `hyperhive` input.
+        #[arg(long, default_value = "/etc/hyperhive")]
+        hyperhive_flake: String,
+        /// Path to the sqlite message store.
+        #[arg(long, default_value = "/var/lib/hyperhive/broker.sqlite")]
+        db: PathBuf,
+        /// Dashboard HTTP port.
+        #[arg(long, default_value_t = 7000)]
+        dashboard_port: u16,
+        /// Operator pronouns (free text). Threaded into each
+        /// container's harness via `HIVE_OPERATOR_PRONOUNS` so the
+        /// system prompt can mention them. Default: `she/her`.
+        #[arg(long, default_value = "she/her")]
+        operator_pronouns: String,
+        /// Per-model context-window sizes, as JSON object mapping model-family
+        /// short name to token count. Threaded into each container as
+        /// `HIVE_CONTEXT_WINDOW_TOKENS_<KEY_UPPER>` env vars. Set via the
+        /// `services.hive-c0re.contextWindowTokens` NixOS option.
+        #[arg(long, default_value = r#"{"haiku":200000,"sonnet":1000000,"opus":1000000}"#)]
+        context_window_tokens: String,
+    },
+    /// Spawn a new agent container directly (`hive-agent-<name>`). Bypasses
+    /// the approval queue — use only as an operator on the host. For
+    /// approval-gated spawns, use `request-spawn` instead.
+    Spawn { name: String },
+    /// Queue a spawn request as an approval. The container is created on
+    /// `approve <id>` (CLI) or the dashboard's APPR0VE button.
+    RequestSpawn { name: String },
+    /// Stop a managed container (graceful).
+    Kill { name: String },
+    /// Tear down a sub-agent container. Container is removed; persistent
+    /// state (config repos + Claude credentials) is kept by default. Pass
+    /// `--purge` to also wipe the agent's state dirs (config + creds +
+    /// notes). No undo.
+    Destroy {
+        name: String,
+        #[arg(long)]
+        purge: bool,
+    },
+    /// Apply pending config to a managed container.
+    Rebuild { name: String },
+    /// List managed containers.
+    List,
+    /// List pending approval requests submitted by the manager.
+    Pending,
+    /// Approve a pending request by id; the action runs immediately.
+    Approve { id: i64 },
+    /// Deny a pending request by id.
+    Deny { id: i64 },
+    /// Move an agent in the topology tree (#486). Set `--parent` to
+    /// a new parent agent name; pass `--root` to promote the agent
+    /// to root (no parent). Refuses cycles, unknown agents, and
+    /// any attempt to reparent the manager.
+    SetParent {
+        child: String,
+        /// New parent agent name. Mutually exclusive with `--root`.
+        /// Exactly one of `--parent` / `--root` is required — clap
+        /// rejects both-absent calls so a fat-fingered
+        /// `hive-c0re set-parent alice` doesn't silently promote
+        /// alice to root (argus flag on PR #492).
+        #[arg(long, conflicts_with = "root", required_unless_present = "root")]
+        parent: Option<String>,
+        /// Promote `child` to root (no parent).
+        #[arg(long)]
+        root: bool,
+    },
+}
+
+#[tokio::main]
+async fn main() -> Result<()> {
+    tracing_subscriber::fmt()
+        .with_env_filter(
+            tracing_subscriber::EnvFilter::try_from_default_env()
+                .unwrap_or_else(|_| tracing_subscriber::EnvFilter::new("info")),
+        )
+        .init();
+
+    let cli = Cli::parse();
+    match cli.cmd {
+        Cmd::Serve {
+            hyperhive_flake,
+            db,
+            dashboard_port,
+            operator_pronouns,
+            context_window_tokens,
+        } => cmd_serve(hyperhive_flake, db, dashboard_port, operator_pronouns, context_window_tokens, &cli.socket).await,
+        Cmd::Spawn { name } => {
+            render(client::request(&cli.socket, HostRequest::Spawn { name }).await?)
+        }
+        Cmd::RequestSpawn { name } => {
+            render(client::request(&cli.socket, HostRequest::RequestSpawn { name }).await?)
+        }
+        Cmd::Kill { name } => {
+            render(client::request(&cli.socket, HostRequest::Kill { name }).await?)
+        }
+        Cmd::Destroy { name, purge } => {
+            render(client::request(&cli.socket, HostRequest::Destroy { name, purge }).await?)
+        }
+        Cmd::Rebuild { name } => {
+            render(client::request(&cli.socket, HostRequest::Rebuild { name }).await?)
+        }
+        Cmd::List => render(client::request(&cli.socket, HostRequest::List).await?),
+        Cmd::Pending => render(client::request(&cli.socket, HostRequest::Pending).await?),
+        Cmd::Approve { id } => {
+            render(client::request(&cli.socket, HostRequest::Approve { id }).await?)
+        }
+        Cmd::Deny { id } => render(client::request(&cli.socket, HostRequest::Deny { id }).await?),
+        Cmd::SetParent {
+            child,
+            parent,
+            root,
+        } => {
+            let new_parent = if root { None } else { parent };
+            render(
+                client::request(
+                    &cli.socket,
+                    HostRequest::SetParent { child, new_parent },
+                )
+                .await?,
+            )
+        }
+    }
+}
+
+/// Start the coordinator daemon: open the broker, run migrations, spawn
+/// background tasks (auto-update, vacuums, crash-watcher, reminder-scheduler,
+/// dashboard), then serve the admin socket until a signal arrives.
+async fn cmd_serve(
+    hyperhive_flake: String,
+    db: std::path::PathBuf,
+    dashboard_port: u16,
+    operator_pronouns: String,
+    context_window_tokens: String,
+    socket: &std::path::Path,
+) -> Result<()> {
+    let cwt: std::collections::HashMap<String, u64> =
+        serde_json::from_str(&context_window_tokens)
+            .context("--context-window-tokens: invalid JSON")?;
+    let coord = Arc::new(Coordinator::open(
+        &db,
+        hyperhive_flake,
+        dashboard_port,
+        operator_pronouns,
+        cwt,
+    )?);
+    manager_server::start(coord.clone())?;
+    // Idempotent pre-flight: rewrite pre-meta-layout applied
+    // repos, ensure proposed repos carry the `applied`
+    // remote, bootstrap the meta repo, repoint containers at
+    // `meta#<name>` (one-shot, guarded by a marker file).
+    // Runs before manager auto-spawn so the new manager is
+    // built against meta from the first attempt.
+    if let Err(e) = migrate::run(&coord).await {
+        tracing::warn!(error = ?e, "startup migration failed");
+    }
+    // Auto-create the manager container if it isn't there yet. Block
+    // on this — without hm1nd the system has no manager harness.
+    // Failures are logged but allowed: a broken auto-spawn shouldn't
+    // make the dashboard unreachable for debugging.
+    if let Err(e) = auto_update::ensure_manager(&coord).await {
+        tracing::warn!(error = ?e, "auto-spawn manager failed");
+    }
+    // Auto-update in the background — don't block service start.
+    // Sub-agent rebuilds can take tens of seconds; we want the admin
+    // socket up immediately.
+    let update_coord = coord.clone();
+    tokio::spawn(async move {
+        if let Err(e) = auto_update::run(update_coord).await {
+            tracing::warn!(error = ?e, "auto-update task failed");
+        }
+    });
+    // Forge user sweep: ensure every existing container has a
+    // forgejo user + access token. No-op when the hive-forge
+    // container isn't running. Backgrounded — touches the
+    // forge state dir via `nixos-container run` which is slow.
+    tokio::spawn(async move {
+        forge::ensure_all().await;
+    });
+    // Periodic broker vacuum: drop fully-acked messages older
+    // than 30 days. Delivered-but-unacked rows (recoverable via
+    // requeue_inflight) and undelivered rows are always kept.
+    // Runs hourly; first sweep happens immediately.
+    let vacuum_coord = coord.clone();
+    let mut vacuum_shutdown = coord.shutdown_rx();
+    tokio::spawn(async move {
+        let interval = std::time::Duration::from_secs(3600);
+        let keep_secs: i64 = 30 * 24 * 3600;
+        loop {
+            match vacuum_coord.broker.vacuum_delivered(keep_secs) {
+                Ok(0) => {}
+                Ok(n) => tracing::info!(removed = n, "broker vacuum"),
+                Err(e) => tracing::warn!(error = ?e, "broker vacuum failed"),
+            }
+            tokio::select! {
+                () = tokio::time::sleep(interval) => {}
+                _ = vacuum_shutdown.changed() => {
+                    tracing::info!("broker vacuum: shutdown signal received");
+                    break;
+                }
+            }
+        }
+    });
+    // Per-agent events.sqlite vacuum: host-side so the harness
+    // doesn't need any retention wiring of its own.
+    events_vacuum::spawn(&coord);
+    // Per-agent turn-stats.sqlite vacuum: same pattern, 90-day
+    // retention so trend analysis has enough history.
+    stats_vacuum::spawn(&coord);
+    // Container crash watcher: emits HelperEvent::ContainerCrash
+    // when a previously-running container goes away without an
+    // operator-initiated transient state.
+    crash_watch::spawn(coord.clone());
+    // Reminder scheduler: drains due reminders + handles
+    // file_path payload persistence. See reminder_scheduler.rs.
+    reminder_scheduler::spawn(coord.clone());
+    // Scheduled-prompts worker: drains due scheduled_prompts rows
+    // and fans the body out to each active target's inbox. See
+    // scheduled_prompts_worker.rs (#444).
+    scheduled_prompts_worker::spawn(coord.clone());
+    // Rebuild-queue worker: drains the global rebuild/meta-update/
+    // spawn queue FIFO so hive-c0re never runs two heavyweight
+    // container ops concurrently. Existing rebuild call sites
+    // (auto_update, dashboard, manager, approval handler) enqueue
+    // here instead of awaiting `rebuild_agent` inline. See
+    // `rebuild_queue.rs`.
+    {
+        let q_coord = coord.clone();
+        tokio::spawn(async move {
+            rebuild_queue::run_worker(q_coord).await;
+        });
+    }
+    // Forward every broker event onto the unified dashboard
+    // channel with a freshly-stamped seq, so the dashboard SSE
+    // sees broker messages + future mutation events on one
+    // stream with one monotonic seq. The broker's intra-process
+    // channel (used by `recv_blocking_batch`) stays untouched.
+    spawn_broker_to_dashboard_forwarder(coord.clone());
+    let dash_coord = coord.clone();
+    tokio::spawn(async move {
+        if let Err(e) = dashboard::serve(dashboard_port, dash_coord).await {
+            tracing::error!(error = ?e, "dashboard failed");
+        }
+    });
+    // Run the admin socket until a signal arrives; then signal
+    // all background tasks so they exit cleanly before the
+    // process terminates.
+    let coord_sig = coord.clone();
+    tokio::select! {
+        res = server::serve(socket, coord) => { res? }
+        _ = tokio::signal::ctrl_c() => {
+            tracing::info!("SIGINT received — requesting shutdown");
+            coord_sig.request_shutdown();
+        }
+        () = async {
+            let mut sig = tokio::signal::unix::signal(
+                tokio::signal::unix::SignalKind::terminate()
+            ).expect("failed to install SIGTERM handler");
+            sig.recv().await;
+        } => {
+            tracing::info!("SIGTERM received — requesting shutdown");
+            coord_sig.request_shutdown();
+        }
+    }
+    Ok(())
+}
+
+/// Re-emit every broker `MessageEvent` onto the dashboard channel as
+/// a `DashboardEvent::Sent` / `Delivered` with a freshly-stamped seq.
+/// Background task; runs for the life of the process. On a lagged
+/// broker subscription we just keep going — the dashboard channel is
+/// best-effort presentation plumbing, the broker keeps its own sqlite
+/// log for replay.
+fn spawn_broker_to_dashboard_forwarder(coord: Arc<Coordinator>) {
+    use broker::MessageEvent;
+    use dashboard_events::DashboardEvent;
+    let mut rx = coord.broker.subscribe();
+    tokio::spawn(async move {
+        loop {
+            match rx.recv().await {
+                Ok(MessageEvent::Sent { id, from, to, body, at, in_reply_to }) => {
+                    let file_refs = dashboard::scan_validated_paths(&body);
+                    coord.emit_dashboard_event(DashboardEvent::Sent {
+                        seq: coord.next_seq(),
+                        id,
+                        from,
+                        to,
+                        body,
+                        at,
+                        in_reply_to,
+                        file_refs,
+                    });
+                }
+                Ok(MessageEvent::Delivered { id, from, to, body, at, in_reply_to }) => {
+                    let file_refs = dashboard::scan_validated_paths(&body);
+                    coord.emit_dashboard_event(DashboardEvent::Delivered {
+                        seq: coord.next_seq(),
+                        id,
+                        from,
+                        to,
+                        body,
+                        at,
+                        in_reply_to,
+                        file_refs,
+                    });
+                }
+                Err(tokio::sync::broadcast::error::RecvError::Lagged(n)) => {
+                    tracing::warn!(skipped = n, "broker-to-dashboard forwarder lagged");
+                }
+                Err(tokio::sync::broadcast::error::RecvError::Closed) => break,
+            }
+        }
+    });
+}
+
+fn render(resp: HostResponse) -> Result<()> {
+    println!("{}", serde_json::to_string_pretty(&resp)?);
+    if !resp.ok {
+        bail!(resp.error.unwrap_or_else(|| "request failed".to_owned()));
+    }
+    Ok(())
+}
diff --git a/hive-c0re/src/manager_server.rs b/hive-c0re/src/manager_server.rs
new file mode 100644
index 00000000..b23cbf40
--- /dev/null
+++ b/hive-c0re/src/manager_server.rs
@@ -0,0 +1,1043 @@
+//! Manager socket listener. Privileged tool surface: agent-style send/recv
+//! plus lifecycle verbs (Phase 4). Phase 5 will gate Spawn/Kill behind the
+//! commit-approval flow; for now they hit the same code path the host admin
+//! socket uses.
+
+use std::sync::Arc;
+
+use anyhow::{Context, Result};
+use hive_sh4re::{MANAGER_AGENT, ManagerRequest, ManagerResponse, Message};
+use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
+use tokio::net::{UnixListener, UnixStream};
+
+use crate::coordinator::Coordinator;
+use crate::lifecycle;
+
+pub fn start(coord: Arc<Coordinator>) -> Result<()> {
+    let dir = Coordinator::manager_dir();
+    std::fs::create_dir_all(&dir)
+        .with_context(|| format!("create manager dir {}", dir.display()))?;
+    let socket = Coordinator::manager_socket_path();
+    if socket.exists() {
+        std::fs::remove_file(&socket).context("remove stale manager socket")?;
+    }
+    let listener = UnixListener::bind(&socket)
+        .with_context(|| format!("bind manager socket {}", socket.display()))?;
+    tracing::info!(socket = %socket.display(), "manager socket listening");
+
+    tokio::spawn(async move {
+        loop {
+            match listener.accept().await {
+                Ok((stream, _)) => {
+                    let coord = coord.clone();
+                    tokio::spawn(async move {
+                        if let Err(e) = serve(stream, coord).await {
+                            tracing::warn!(error = ?e, "manager connection failed");
+                        }
+                    });
+                }
+                Err(e) => {
+                    tracing::warn!(error = ?e, "manager listener accept failed");
+                    return;
+                }
+            }
+        }
+    });
+    Ok(())
+}
+
+async fn serve(stream: UnixStream, coord: Arc<Coordinator>) -> Result<()> {
+    let (read, mut write) = stream.into_split();
+    let mut reader = BufReader::new(read);
+    let mut line = String::new();
+    loop {
+        line.clear();
+        let n = reader.read_line(&mut line).await?;
+        if n == 0 {
+            return Ok(());
+        }
+        let resp = match serde_json::from_str::<ManagerRequest>(line.trim()) {
+            Ok(req) => dispatch(&req, &coord).await,
+            Err(e) => ManagerResponse::Err {
+                message: format!("parse error: {e}"),
+            },
+        };
+        let mut payload = serde_json::to_string(&resp)?;
+        payload.push('\n');
+        write.write_all(payload.as_bytes()).await?;
+        write.flush().await?;
+    }
+}
+
+/// Max long-poll window for manager `Recv`. Same semantics as the
+/// sub-agent socket: omitted `wait_seconds` (or `0`) = peek and
+/// return immediately, positive value = park up to that many
+/// seconds (clamped at MAX).
+const MANAGER_RECV_LONG_POLL_MAX: std::time::Duration = std::time::Duration::from_secs(180);
+
+/// Same shape + rationale as `agent_server::RECV_BATCH_MAX`. Kept
+/// numerically aligned across surfaces so a tool description that
+/// quotes the cap stays accurate either way.
+const MANAGER_RECV_BATCH_MAX: u32 = 32;
+
+fn manager_recv_timeout(wait_seconds: Option<u64>) -> std::time::Duration {
+    match wait_seconds {
+        Some(s) => std::time::Duration::from_secs(s).min(MANAGER_RECV_LONG_POLL_MAX),
+        None => std::time::Duration::ZERO,
+    }
+}
+
+#[allow(clippy::too_many_lines)]
+async fn dispatch(req: &ManagerRequest, coord: &Arc<Coordinator>) -> ManagerResponse {
+    match req {
+        ManagerRequest::Send { to, body, in_reply_to } => {
+            if let Err(message) = crate::limits::check_size("send", body) {
+                return ManagerResponse::Err { message };
+            }
+            if to == "*" {
+                let errors = coord.broadcast_send(MANAGER_AGENT, body);
+                if errors.is_empty() {
+                    ManagerResponse::Ok
+                } else {
+                    ManagerResponse::Err {
+                        message: format!("broadcast failed for agents: {}", errors.join(", ")),
+                    }
+                }
+            } else {
+                match coord.broker.send(&Message {
+                    from: MANAGER_AGENT.to_owned(),
+                    to: to.clone(),
+                    body: body.clone(),
+                    in_reply_to: *in_reply_to,
+                }) {
+                    Ok(()) => ManagerResponse::Ok,
+                    Err(e) => ManagerResponse::Err {
+                        message: format!("{e:#}"),
+                    },
+                }
+            }
+        }
+        ManagerRequest::Wake { from, body } => match coord.broker.send(&Message {
+            from: from.clone(),
+            to: MANAGER_AGENT.to_owned(),
+            body: body.clone(),
+            in_reply_to: None,
+        }) {
+            Ok(()) => ManagerResponse::Ok,
+            Err(e) => ManagerResponse::Err {
+                message: format!("{e:#}"),
+            },
+        },
+        ManagerRequest::OperatorMsg { body } => match coord.broker.send(&Message {
+            from: hive_sh4re::OPERATOR_RECIPIENT.to_owned(),
+            to: MANAGER_AGENT.to_owned(),
+            body: body.clone(),
+            in_reply_to: None,
+        }) {
+            Ok(()) => ManagerResponse::Ok,
+            Err(e) => ManagerResponse::Err {
+                message: format!("{e:#}"),
+            },
+        },
+        ManagerRequest::Status => match coord.broker.count_pending(MANAGER_AGENT) {
+            Ok(unread) => ManagerResponse::Status { unread },
+            Err(e) => ManagerResponse::Err {
+                message: format!("{e:#}"),
+            },
+        },
+        ManagerRequest::Recent { limit } => match coord.broker.recent_for(MANAGER_AGENT, *limit) {
+            Ok(rows) => ManagerResponse::Recent { rows },
+            Err(e) => ManagerResponse::Err {
+                message: format!("{e:#}"),
+            },
+        },
+        ManagerRequest::Recv { wait_seconds, max } => {
+            let cap = max.unwrap_or(1).min(MANAGER_RECV_BATCH_MAX) as usize;
+            match coord
+                .broker
+                .recv_blocking_batch(MANAGER_AGENT, manager_recv_timeout(*wait_seconds), cap)
+                .await
+            {
+                Ok(deliveries) => ManagerResponse::Messages {
+                    messages: deliveries
+                        .into_iter()
+                        .map(|d| hive_sh4re::DeliveredMessage {
+                            from: d.message.from,
+                            body: d.message.body,
+                            id: d.id,
+                            redelivered: d.redelivered,
+                            in_reply_to: d.message.in_reply_to,
+                        })
+                        .collect(),
+                },
+                Err(e) => ManagerResponse::Err {
+                    message: format!("{e:#}"),
+                },
+            }
+        }
+        ManagerRequest::RequestInitConfig { name, description } => {
+            tracing::info!(%name, "manager: request_init_config");
+            let proposed_dir = crate::coordinator::Coordinator::agent_proposed_dir(name);
+            if proposed_dir.join(".git").exists() {
+                return ManagerResponse::Err {
+                    message: format!(
+                        "proposed config repo for '{name}' already exists at {} - \
+                         use request_apply_commit to update an existing agent's config",
+                        proposed_dir.display()
+                    ),
+                };
+            }
+            match coord.approvals.submit_kind(
+                name,
+                hive_sh4re::ApprovalKind::InitConfig,
+                "",
+                description.as_deref(),
+            ) {
+                Ok(id) => {
+                    tracing::info!(%id, %name, "init_config approval queued");
+                    coord.emit_approval_added(id, name, "init_config", None, None, description.clone());
+                    ManagerResponse::Ok
+                }
+                Err(e) => ManagerResponse::Err {
+                    message: format!("{e:#}"),
+                },
+            }
+        }
+        ManagerRequest::Kill { name } => {
+            tracing::info!(%name, "manager: kill");
+            if name == crate::lifecycle::MANAGER_NAME {
+                return ManagerResponse::Err {
+                    message: "refusing to kill the manager".into(),
+                };
+            }
+            let result: Result<()> = async {
+                lifecycle::kill(name).await?;
+                coord.unregister_agent(name);
+                Ok(())
+            }
+            .await;
+            match result {
+                Ok(()) => {
+                    coord.notify_manager(&hive_sh4re::HelperEvent::Killed {
+                        agent: name.clone(),
+                    });
+                    ManagerResponse::Ok
+                }
+                Err(e) => ManagerResponse::Err {
+                    message: format!("{e:#}"),
+                },
+            }
+        }
+        ManagerRequest::Start { name } => {
+            tracing::info!(%name, "manager: start");
+            if name == crate::lifecycle::MANAGER_NAME {
+                return ManagerResponse::Err {
+                    message: "refusing to start the manager from itself".into(),
+                };
+            }
+            match lifecycle::start(name).await {
+                Ok(()) => {
+                    coord.kick_agent(name, "container started");
+                    ManagerResponse::Ok
+                }
+                Err(e) => ManagerResponse::Err {
+                    message: format!("{e:#}"),
+                },
+            }
+        }
+        ManagerRequest::Restart { name } => {
+            tracing::info!(%name, "manager: restart");
+            if name == crate::lifecycle::MANAGER_NAME {
+                return ManagerResponse::Err {
+                    message: "refusing to restart the manager from itself".into(),
+                };
+            }
+            match lifecycle::restart(name).await {
+                Ok(()) => {
+                    coord.kick_agent(name, "container restarted");
+                    ManagerResponse::Ok
+                }
+                Err(e) => ManagerResponse::Err {
+                    message: format!("{e:#}"),
+                },
+            }
+        }
+        ManagerRequest::Update { name } => {
+            tracing::info!(%name, "manager: enqueue update");
+            coord.rebuild_queue.enqueue(
+                crate::rebuild_queue::QueueKind::Rebuild,
+                name.to_owned(),
+                crate::rebuild_queue::QueueSource::Manual,
+                "manager `update` tool".to_owned(),
+                None,
+            );
+            coord.emit_rebuild_queue_snapshot();
+            ManagerResponse::Ok
+        }
+        ManagerRequest::RequestUpdateMetaInputs {
+            inputs,
+            description,
+        } => {
+            let label = if inputs.is_empty() {
+                "all inputs".to_string()
+            } else {
+                inputs.join(", ")
+            };
+            tracing::info!(%label, "manager: request_update_meta_inputs");
+            // Encode the inputs list as JSON and store it in commit_ref
+            // (there's no git commit involved; the field carries the
+            // payload for the approval handler to decode at run time).
+            let commit_ref = serde_json::to_string(inputs).unwrap_or_default();
+            let id = match coord
+                .approvals
+                .submit_kind(
+                    hive_sh4re::MANAGER_AGENT,
+                    hive_sh4re::ApprovalKind::UpdateMetaInputs,
+                    &commit_ref,
+                    description.as_deref(),
+                )
+                .map_err(|e| anyhow::anyhow!("{e:#}"))
+            {
+                Ok(id) => id,
+                Err(e) => {
+                    return ManagerResponse::Err {
+                        message: format!("queue update_meta_inputs approval: {e:#}"),
+                    }
+                }
+            };
+            tracing::info!(%id, %label, "update_meta_inputs approval queued");
+            coord.emit_approval_added(
+                id,
+                hive_sh4re::MANAGER_AGENT,
+                "update_meta_inputs",
+                None,
+                None,
+                description.clone(),
+            );
+            ManagerResponse::Ok
+        }
+        ManagerRequest::RequestSchedulePrompt(payload) => {
+            handle_request_schedule_prompt(coord, hive_sh4re::MANAGER_AGENT, payload).await
+        }
+        ManagerRequest::CancelSchedule { id, targets } => {
+            handle_cancel_schedule(coord, hive_sh4re::MANAGER_AGENT, *id, targets.as_deref())
+        }
+        ManagerRequest::EditSchedule {
+            id,
+            body,
+            description,
+            interval_seconds,
+            next_fire_at_unix,
+            targets_add,
+            targets_remove,
+        } => handle_edit_schedule(
+            coord,
+            hive_sh4re::MANAGER_AGENT,
+            *id,
+            body.clone(),
+            description.clone(),
+            *interval_seconds,
+            *next_fire_at_unix,
+            targets_add.clone(),
+            targets_remove.clone(),
+        ),
+        ManagerRequest::ListSchedules => match coord.scheduled_prompts.list() {
+            Ok(schedules) => ManagerResponse::Schedules {
+                schedules: schedules.into_iter().map(schedule_to_wire).collect(),
+            },
+            Err(e) => ManagerResponse::Err {
+                message: format!("list scheduled prompts: {e:#}"),
+            },
+        },
+        ManagerRequest::FireScheduleNow { id } => {
+            handle_fire_schedule_now(coord, hive_sh4re::MANAGER_AGENT, *id).await
+        }
+        ManagerRequest::Ask {
+            question,
+            options,
+            multi,
+            ttl_seconds,
+            to,
+        } => crate::questions::handle_ask(
+            coord,
+            MANAGER_AGENT,
+            question,
+            options,
+            *multi,
+            *ttl_seconds,
+            to.as_deref(),
+        )
+        .map_or_else(
+            |message| ManagerResponse::Err { message },
+            |id| ManagerResponse::QuestionQueued { id },
+        ),
+        ManagerRequest::Answer { id, answer } => {
+            crate::questions::handle_answer(coord, MANAGER_AGENT, *id, answer).map_or_else(
+                |message| ManagerResponse::Err { message },
+                |()| ManagerResponse::Ok,
+            )
+        }
+        ManagerRequest::GetLogs { agent, lines } => {
+            let n = lines.unwrap_or(50);
+            // `journalctl -M` wants the *machine* name, not the
+            // logical agent name: `gui` → `h-gui`. `container_name`
+            // does that and passes `hm1nd` through unprefixed — but
+            // it doesn't know the broker-logical manager name
+            // `"manager"` (it'd wrongly produce `h-manager`), so
+            // handle that alias explicitly. Either manager spelling
+            // resolves to the unprefixed `hm1nd` machine.
+            let machine = if agent == MANAGER_AGENT {
+                crate::lifecycle::MANAGER_NAME.to_owned()
+            } else {
+                crate::lifecycle::container_name(agent)
+            };
+            tracing::info!(%agent, %machine, %n, "manager: get_logs");
+            match tokio::process::Command::new("journalctl")
+                .args([
+                    "-M",
+                    &machine,
+                    "-n",
+                    &n.to_string(),
+                    "--no-pager",
+                    "--output=short",
+                ])
+                .output()
+                .await
+            {
+                Ok(out) => {
+                    let content = if out.status.success() || !out.stdout.is_empty() {
+                        String::from_utf8_lossy(&out.stdout).into_owned()
+                    } else {
+                        let stderr = String::from_utf8_lossy(&out.stderr);
+                        format!("journalctl exited {}: {stderr}", out.status)
+                    };
+                    ManagerResponse::Logs { content }
+                }
+                Err(e) => ManagerResponse::Err {
+                    message: format!("journalctl spawn failed: {e:#}"),
+                },
+            }
+        }
+        ManagerRequest::Remind {
+            message,
+            timing,
+            file_path,
+        } => match crate::agent_server::store_remind(
+            coord,
+            MANAGER_AGENT,
+            message,
+            timing,
+            file_path.as_deref(),
+        ) {
+            Ok(()) => ManagerResponse::Ok,
+            Err(message) => ManagerResponse::Err { message },
+        },
+        ManagerRequest::RequestApplyCommit {
+            agent,
+            commit_ref,
+            description,
+        } => {
+            tracing::info!(%agent, %commit_ref, "manager: request_apply_commit");
+            match submit_apply_commit(coord, agent, commit_ref, description.as_deref()).await {
+                Ok((id, sha)) => {
+                    tracing::info!(%id, %agent, manager_ref = %commit_ref, %sha, "approval queued + proposal tag planted");
+                    ManagerResponse::Ok
+                }
+                Err(e) => ManagerResponse::Err {
+                    message: format!("{e:#}"),
+                },
+            }
+        }
+        ManagerRequest::GetLooseEnds { agent } => {
+            let result = match agent.as_deref() {
+                Some("*") => crate::loose_ends::hive_wide(coord),
+                Some(name) => crate::loose_ends::for_agent(coord, name),
+                None => crate::loose_ends::for_agent(coord, MANAGER_AGENT),
+            };
+            match result {
+                Ok(loose_ends) => ManagerResponse::LooseEnds { loose_ends },
+                Err(e) => ManagerResponse::Err {
+                    message: format!("{e:#}"),
+                },
+            }
+        }
+        ManagerRequest::CountPendingReminders { agent } => {
+            let target = agent.as_deref().unwrap_or(MANAGER_AGENT);
+            match coord.broker.count_pending_reminders_for(target) {
+                Ok(count) => ManagerResponse::PendingRemindersCount { count },
+                Err(e) => ManagerResponse::Err {
+                    message: format!("{e:#}"),
+                },
+            }
+        }
+        ManagerRequest::ReminderRollup { since_secs, agent } => {
+            let target = agent.as_deref().unwrap_or(MANAGER_AGENT);
+            match coord.broker.reminder_rollup_for(target, *since_secs) {
+                Ok(stats) => ManagerResponse::ReminderRollup(stats),
+                Err(e) => ManagerResponse::Err {
+                    message: format!("{e:#}"),
+                },
+            }
+        }
+        ManagerRequest::SetStatus { text } => {
+            let path = Coordinator::agent_notes_dir(MANAGER_AGENT).join("hyperhive-status");
+            let result = if text.trim().is_empty() {
+                std::fs::remove_file(&path)
+                    .or_else(|e| if e.kind() == std::io::ErrorKind::NotFound {
+                        Ok(())
+                    } else {
+                        Err(e)
+                    })
+            } else {
+                std::fs::write(&path, format!("{}\n", text.trim()))
+            };
+            match result {
+                Ok(()) => {
+                    let coord2 = Arc::clone(coord);
+                    tokio::spawn(async move { coord2.rescan_containers_and_emit().await });
+                    ManagerResponse::Ok
+                }
+                Err(e) => ManagerResponse::Err { message: format!("set_status write failed: {e}") },
+            }
+        }
+        ManagerRequest::GetAgentMeta { name } => {
+            let target = name.as_deref().unwrap_or(MANAGER_AGENT);
+            // #432: gate status on the target's running state so a
+            // stopped container's stale on-disk status doesn't leak
+            // through. Also surface `running` itself so callers can
+            // tell (e.g. "iris is down" vs "iris has no status set").
+            let (status_text, status_set_at, running) =
+                crate::container_view::read_agent_status_live(target).await;
+            let role = if target == MANAGER_AGENT { "manager" } else { "agent" }.to_owned();
+            ManagerResponse::AgentMeta {
+                name: target.to_owned(),
+                role,
+                running,
+                hyperhive_rev: crate::auto_update::current_flake_rev(&coord.hyperhive_flake),
+                status_text,
+                status_set_at,
+            }
+        }
+        ManagerRequest::CancelLooseEnd { kind, id } => crate::questions::handle_cancel_loose_end(
+            coord,
+            MANAGER_AGENT,
+            *kind,
+            *id,
+        )
+        .map_or_else(
+            |message| ManagerResponse::Err { message },
+            |()| ManagerResponse::Ok,
+        ),
+        ManagerRequest::AckTurn => match coord.broker.ack_turn(MANAGER_AGENT) {
+            Ok(_n) => ManagerResponse::Ok,
+            Err(e) => ManagerResponse::Err {
+                message: format!("{e:#}"),
+            },
+        },
+        ManagerRequest::RequeueInflight => match coord.broker.requeue_inflight(MANAGER_AGENT) {
+            Ok(n) => {
+                if n > 0 {
+                    tracing::info!(agent = %MANAGER_AGENT, requeued = %n, "requeued in-flight messages");
+                }
+                ManagerResponse::Ok
+            }
+            Err(e) => ManagerResponse::Err {
+                message: format!("{e:#}"),
+            },
+        },
+    }
+}
+
+/// `request_apply_commit` takes a commit SHA only — not a branch or
+/// tag name. A branch is mutable; pinning the proposal to a concrete
+/// sha keeps "what the manager asked to deploy" unambiguous and means
+/// the `proposal/<id>` tag is a faithful record of the request.
+/// Accepts a 7..=40 char hex string (short or full sha); the exact
+/// commit is resolved + existence-checked against the proposed repo
+/// later in `lifecycle::git_fetch_to_tag`.
+fn validate_commit_ref(commit_ref: &str) -> Result<()> {
+    let n = commit_ref.len();
+    let hex = commit_ref.chars().all(|c| c.is_ascii_hexdigit());
+    if !(7..=40).contains(&n) || !hex {
+        anyhow::bail!(
+            "commit_ref '{commit_ref}' is not a commit sha — request_apply_commit \
+             takes a 7-40 char hex sha, not a branch or tag name"
+        );
+    }
+    Ok(())
+}
+
+/// Submit-time half of the apply flow: queue the approval row, then
+/// fetch the manager's commit from the proposed repo into applied and
+/// pin it as `refs/tags/proposal/<id>`. From this point on the manager
+/// repo is irrelevant for this approval — even if the manager amends
+/// or force-pushes, the canonical sha hive-c0re will eventually
+/// approve/deny lives in applied's object DB.
+///
+/// If anything fails after the row is inserted (sha missing in
+/// proposed, fs error, git plumbing crash) we mark the row failed and
+/// surface the error to the manager. We don't try to roll the row
+/// back — the failure is part of the audit trail.
+async fn submit_apply_commit(
+    coord: &Arc<Coordinator>,
+    agent: &str,
+    commit_ref: &str,
+    description: Option<&str>,
+) -> anyhow::Result<(i64, String)> {
+    validate_commit_ref(commit_ref)?;
+    let proposed_dir = crate::coordinator::Coordinator::agent_proposed_dir(agent);
+    let applied_dir = crate::coordinator::Coordinator::agent_applied_dir(agent);
+    if !proposed_dir.exists() {
+        anyhow::bail!(
+            "proposed repo missing for agent '{agent}' (expected at {})",
+            proposed_dir.display()
+        );
+    }
+    if !applied_dir.join(".git").exists() {
+        // First deploy: seed the applied repo from proposed so we can plant
+        // the proposal/<id> tag below. setup_applied seeds at the root
+        // (template) commit of proposed, not at main, so deployed/0 is the
+        // template baseline. This makes the diff mara sees on approval
+        // show the manager's actual changes rather than an empty diff.
+        lifecycle::setup_applied(&applied_dir, Some(&proposed_dir), agent)
+            .await
+            .context("seed applied repo for first spawn")?;
+    }
+    let id = coord
+        .approvals
+        .submit_kind(
+            agent,
+            hive_sh4re::ApprovalKind::ApplyCommit,
+            commit_ref,
+            description,
+        )
+        .map_err(|e| anyhow::anyhow!("queue approval row: {e:#}"))?;
+    let tag = format!("proposal/{id}");
+    let sha =
+        match crate::lifecycle::git_fetch_to_tag(&applied_dir, &proposed_dir, commit_ref, &tag)
+            .await
+        {
+            Ok(s) => s,
+            Err(e) => {
+                // Surface the failure on the approval row so the
+                // dashboard reflects it instead of leaving a phantom
+                // pending entry. The note doubles as the operator-visible
+                // explanation of why the approval can't be approved.
+                let note = format!("{e:#}");
+                let _ = coord.approvals.mark_failed(id, &note);
+                coord.emit_approval_resolved(
+                    id,
+                    agent,
+                    "apply_commit",
+                    None,
+                    "failed",
+                    Some(note),
+                    description.map(str::to_owned),
+                );
+                return Err(anyhow::anyhow!("git_fetch_to_tag: {e:#}"));
+            }
+        };
+    coord
+        .approvals
+        .set_fetched_sha(id, &sha)
+        .map_err(|e| anyhow::anyhow!("persist fetched_sha: {e:#}"))?;
+    // #317 pre-flight gates: both reject the apply before approval if
+    // the agent's flake state would inflate meta's lock with duplicates
+    // or lie about what nix will fetch. Both checks independently read
+    // `<tag>:flake.lock` via git — they don't share state. Order matters
+    // only for early-exit + messaging: sync first means a stale lock
+    // bails with the actionable "run `nix flake lock`" hint rather than
+    // a dedup pass on a lock nix would never produce.
+    //
+    // Runs after `set_fetched_sha` so the failed row carries the sha
+    // that broke. Both failure paths mark + emit, then bail.
+    let sha_short = sha[..sha.len().min(12)].to_owned();
+    if let Err(e) = crate::flake_check::check_lock_in_sync(&applied_dir, &tag, id).await {
+        let note = format!("{e:#}");
+        let _ = coord.approvals.mark_failed(id, &note);
+        coord.emit_approval_resolved(
+            id,
+            agent,
+            "apply_commit",
+            Some(sha_short.clone()),
+            "failed",
+            Some(note),
+            description.map(str::to_owned),
+        );
+        return Err(anyhow::anyhow!("flake lock-sync check: {e:#}"));
+    }
+    if let Err(e) = crate::flake_check::check_no_duplicate_inputs(&applied_dir, &tag).await {
+        let note = format!("{e:#}");
+        let _ = coord.approvals.mark_failed(id, &note);
+        coord.emit_approval_resolved(
+            id,
+            agent,
+            "apply_commit",
+            Some(sha_short.clone()),
+            "failed",
+            Some(note),
+            description.map(str::to_owned),
+        );
+        return Err(anyhow::anyhow!("flake dedup check: {e:#}"));
+    }
+    // Mirror the freshly-planted proposal/<id> tag to the forge.
+    if let Err(e) = crate::forge::push_config(agent).await {
+        tracing::warn!(%agent, %id, error = ?e, "forge: push_config after submit failed");
+    }
+    // Phase 5b: surface the new pending approval on the dashboard
+    // event channel. Compute the diff once here so live subscribers
+    // get a fully-formed row without a snapshot refetch. `sha_short`
+    // is reused from the dedup gate above.
+    let diff = crate::dashboard::approval_diff(agent, id).await;
+    coord.emit_approval_added(
+        id,
+        agent,
+        "apply_commit",
+        Some(sha_short),
+        Some(diff),
+        description.map(str::to_owned),
+    );
+    Ok((id, sha))
+}
+
+/// Submit a `RequestSchedulePrompt` payload as an `ApprovalKind::SchedulePrompt`
+/// row. Encodes the payload into the approval's `commit_ref` so the
+/// approve handler can re-parse it without a side table. Validates
+/// inputs (non-empty targets, non-empty body, sane interval) at
+/// submit time — the operator should never see a malformed schedule
+/// pending approval.
+async fn handle_request_schedule_prompt(
+    coord: &Arc<Coordinator>,
+    requester: &str,
+    payload: &hive_sh4re::SchedulePromptPayload,
+) -> ManagerResponse {
+    if payload.targets.is_empty() {
+        return ManagerResponse::Err {
+            message: "schedule must have at least one target".into(),
+        };
+    }
+    if payload.body.trim().is_empty() {
+        return ManagerResponse::Err {
+            message: "schedule body must be non-empty".into(),
+        };
+    }
+    if let Some(0) = payload.interval_seconds {
+        return ManagerResponse::Err {
+            message: "interval_seconds must be > 0 (use None for one-shot)".into(),
+        };
+    }
+    let commit_ref = match serde_json::to_string(payload) {
+        Ok(s) => s,
+        Err(e) => {
+            return ManagerResponse::Err {
+                message: format!("encode SchedulePromptPayload: {e:#}"),
+            }
+        }
+    };
+    let id = match coord.approvals.submit_kind(
+        requester,
+        hive_sh4re::ApprovalKind::SchedulePrompt,
+        &commit_ref,
+        payload.description.as_deref(),
+    ) {
+        Ok(id) => id,
+        Err(e) => {
+            return ManagerResponse::Err {
+                message: format!("queue schedule_prompt approval: {e:#}"),
+            }
+        }
+    };
+    tracing::info!(
+        %id,
+        requester,
+        targets = ?payload.targets,
+        first_fire_at = payload.first_fire_at_unix,
+        interval = ?payload.interval_seconds,
+        "schedule_prompt approval queued"
+    );
+    coord.emit_approval_added(
+        id,
+        requester,
+        "schedule_prompt",
+        None,
+        None,
+        payload.description.clone(),
+    );
+    ManagerResponse::Ok
+}
+
+/// Cancel a schedule (whole or per-target). Manager-surface
+/// authorization: a manager can cancel its own schedules + any
+/// schedule whose owner is one of its sub-agents (topology-walked).
+/// The operator surface bypasses this and can cancel anything;
+/// agents reaching this path through the manager get the
+/// topology-scoped check.
+fn handle_cancel_schedule(
+    coord: &Arc<Coordinator>,
+    requester: &str,
+    schedule_id: i64,
+    targets: Option<&[String]>,
+) -> ManagerResponse {
+    let schedule = match coord.scheduled_prompts.get(schedule_id) {
+        Ok(Some(s)) => s,
+        Ok(None) => {
+            return ManagerResponse::Err {
+                message: format!("schedule {schedule_id} not found"),
+            }
+        }
+        Err(e) => {
+            return ManagerResponse::Err {
+                message: format!("read schedule {schedule_id}: {e:#}"),
+            }
+        }
+    };
+    if !cancel_authorized(requester, &schedule.owner) {
+        return ManagerResponse::Err {
+            message: format!(
+                "not authorized: {requester} cannot cancel schedule owned by {owner}",
+                owner = schedule.owner
+            ),
+        };
+    }
+    let result = match targets {
+        Some(list) if !list.is_empty() => coord
+            .scheduled_prompts
+            .cancel_targets(schedule_id, list)
+            .map_err(|e| format!("cancel targets: {e:#}")),
+        _ => coord
+            .scheduled_prompts
+            .cancel_all(schedule_id)
+            .map_err(|e| format!("cancel all: {e:#}")),
+    };
+    match result {
+        Ok(()) => ManagerResponse::Ok,
+        Err(message) => ManagerResponse::Err { message },
+    }
+}
+
+/// Authorize + dispatch a `FireScheduleNow` request from the
+/// manager surface. Same ownership rules as `CancelSchedule`:
+/// requester can fire its own schedules + any owned by an agent
+/// in its subtree. The actual fan-out lives in
+/// `scheduled_prompts_worker::fire_now`.
+async fn handle_fire_schedule_now(
+    coord: &Arc<Coordinator>,
+    requester: &str,
+    schedule_id: i64,
+) -> ManagerResponse {
+    let schedule = match coord.scheduled_prompts.get(schedule_id) {
+        Ok(Some(s)) => s,
+        Ok(None) => {
+            return ManagerResponse::Err {
+                message: format!("schedule {schedule_id} not found"),
+            }
+        }
+        Err(e) => {
+            return ManagerResponse::Err {
+                message: format!("read schedule {schedule_id}: {e:#}"),
+            }
+        }
+    };
+    if !cancel_authorized(requester, &schedule.owner) {
+        return ManagerResponse::Err {
+            message: format!(
+                "not authorized: {requester} cannot fire schedule owned by {owner}",
+                owner = schedule.owner
+            ),
+        };
+    }
+    match crate::scheduled_prompts_worker::fire_now(coord, schedule_id).await {
+        Ok(_report) => ManagerResponse::Ok,
+        Err(e) => ManagerResponse::Err {
+            message: format!("fire schedule {schedule_id} now: {e:#}"),
+        },
+    }
+}
+
+/// Authorize + dispatch a `EditSchedule` patch (#474). Same
+/// ownership rules as `CancelSchedule` — the manager can edit
+/// schedules it owns + any owned by an agent in its subtree.
+/// Forwards the partial payload to
+/// `ScheduledPrompts::update` which enforces the cancelled-row
+/// + zero-interval validation. Returns `Ok` on a clean update;
+/// `Err` with the underlying message on any auth / validation
+/// failure so the dashboard can surface it verbatim.
+#[allow(clippy::too_many_arguments)]
+fn handle_edit_schedule(
+    coord: &Arc<Coordinator>,
+    requester: &str,
+    schedule_id: i64,
+    body: Option<String>,
+    description: Option<Option<String>>,
+    interval_seconds: Option<Option<u64>>,
+    next_fire_at_unix: Option<i64>,
+    targets_add: Option<Vec<String>>,
+    targets_remove: Option<Vec<String>>,
+) -> ManagerResponse {
+    let schedule = match coord.scheduled_prompts.get(schedule_id) {
+        Ok(Some(s)) => s,
+        Ok(None) => {
+            return ManagerResponse::Err {
+                message: format!("schedule {schedule_id} not found"),
+            }
+        }
+        Err(e) => {
+            return ManagerResponse::Err {
+                message: format!("read schedule {schedule_id}: {e:#}"),
+            }
+        }
+    };
+    if !cancel_authorized(requester, &schedule.owner) {
+        return ManagerResponse::Err {
+            message: format!(
+                "not authorized: {requester} cannot edit schedule owned by {owner}",
+                owner = schedule.owner
+            ),
+        };
+    }
+    let patch = crate::scheduled_prompts::UpdateSchedule {
+        body,
+        description,
+        interval_seconds,
+        next_fire_at_unix,
+        targets_add,
+        targets_remove,
+    };
+    match coord.scheduled_prompts.update(schedule_id, patch) {
+        Ok(()) => ManagerResponse::Ok,
+        Err(e) => ManagerResponse::Err {
+            message: format!("edit schedule {schedule_id}: {e:#}"),
+        },
+    }
+}
+
+/// Permission check for `CancelSchedule` on the manager surface.
+/// `requester` (always `hm1nd` here) can cancel its own schedules.
+/// Sub-agent ownership is delegated to topology — see
+/// `crate::topology::is_descendant_of`. Also reused by
+/// `handle_fire_schedule_now` — fire-auth follows the same shape.
+fn cancel_authorized(requester: &str, owner: &str) -> bool {
+    if requester == owner {
+        return true;
+    }
+    if requester == hive_sh4re::OPERATOR_RECIPIENT {
+        return true;
+    }
+    // Manager can cancel anything owned by an agent in its subtree.
+    // For the current single-manager topology that covers everything,
+    // but the check stays correct as the tree grows.
+    crate::topology::is_descendant_of(owner, requester)
+}
+
+/// Map a `scheduled_prompts::Schedule` to its public wire shape.
+/// Field-by-field copy — the two types are intentionally identical;
+/// the separation keeps hive-sh4re free of hive-c0re-internal types.
+/// Public alias `schedule_to_wire_public` re-exports for
+/// `dashboard.rs::api_schedules` without crossing the module
+/// boundary into the manager-server file.
+pub fn schedule_to_wire_public(s: crate::scheduled_prompts::Schedule) -> hive_sh4re::WireSchedule {
+    schedule_to_wire(s)
+}
+
+fn schedule_to_wire(s: crate::scheduled_prompts::Schedule) -> hive_sh4re::WireSchedule {
+    hive_sh4re::WireSchedule {
+        id: s.id,
+        owner: s.owner,
+        body: s.body,
+        interval_seconds: s.interval_seconds,
+        next_fire_at_unix: s.next_fire_at_unix,
+        created_at_unix: s.created_at_unix,
+        source: match s.source {
+            crate::scheduled_prompts::ScheduleSource::Operator => {
+                hive_sh4re::WireScheduleSource::Operator
+            }
+            crate::scheduled_prompts::ScheduleSource::Approval { id } => {
+                hive_sh4re::WireScheduleSource::Approval { id }
+            }
+        },
+        cancelled_at_unix: s.cancelled_at_unix,
+        description: s.description,
+        targets: s
+            .targets
+            .into_iter()
+            .map(|t| hive_sh4re::WireScheduleTarget {
+                target: t.target,
+                cancelled_at_unix: t.cancelled_at_unix,
+                last_fired_at_unix: t.last_fired_at_unix,
+                last_result: t.last_result,
+            })
+            .collect(),
+    }
+}
+
+/// On `Ask { ttl_seconds: Some(n) }`, sleep n seconds and then try to
+/// resolve the question with `[expired]`. If the operator (or any
+/// other path) already answered it, `answer()` returns Err and we
+/// no-op silently. Otherwise fire a `QuestionAnswered` helper event
+/// with `answerer = "ttl-watchdog"` so the asker can distinguish a
+/// real answer from a deadline trip without parsing the answer text.
+const TTL_SENTINEL: &str = "[expired]";
+/// Synthetic `answerer` label used when the ttl watchdog resolves a
+/// question instead of a real human / agent. Lives in a distinct
+/// namespace from agent names + the operator so the asker can pattern
+/// match `event.answerer == "ttl-watchdog"`.
+const TTL_ANSWERER: &str = "ttl-watchdog";
+
+pub fn spawn_question_watchdog(coord: &Arc<Coordinator>, id: i64, ttl_secs: u64) {
+    let coord = coord.clone();
+    tokio::spawn(async move {
+        tokio::time::sleep(std::time::Duration::from_secs(ttl_secs)).await;
+        // Watchdog has its own answerer label so the authorisation
+        // check in `answer()` permits it for any target. We bypass
+        // the public `answer()` path by calling it with the operator
+        // identity, since the operator is always permitted; the
+        // event we fire carries the real watchdog label for observers.
+        if let Ok((question, asker, target)) =
+            coord
+                .questions
+                .answer(id, TTL_SENTINEL, hive_sh4re::OPERATOR_RECIPIENT)
+        {
+            tracing::info!(%id, %asker, "question expired (ttl)");
+            coord.notify_agent(
+                &asker,
+                &hive_sh4re::HelperEvent::QuestionAnswered {
+                    id,
+                    question,
+                    answer: TTL_SENTINEL.to_owned(),
+                    answerer: TTL_ANSWERER.to_owned(),
+                },
+            );
+            coord.emit_question_resolved(id, TTL_SENTINEL, TTL_ANSWERER, false, target.as_deref());
+        }
+    });
+}
+
+#[cfg(test)]
+mod tests {
+    use super::validate_commit_ref;
+
+    #[test]
+    fn accepts_short_and_full_sha() {
+        assert!(validate_commit_ref("e194f78").is_ok());
+        assert!(validate_commit_ref("e194f7812ab").is_ok());
+        assert!(validate_commit_ref(&"a".repeat(40)).is_ok());
+        // Uppercase hex resolves fine through `git rev-parse`.
+        assert!(validate_commit_ref("E194F78").is_ok());
+    }
+
+    #[test]
+    fn rejects_branch_and_tag_names() {
+        // The exact bug class this guard exists for.
+        assert!(validate_commit_ref("main").is_err());
+        assert!(validate_commit_ref("HEAD").is_err());
+        assert!(validate_commit_ref("deployed/0").is_err());
+        assert!(validate_commit_ref("feature-branch").is_err());
+    }
+
+    #[test]
+    fn rejects_too_short_too_long_and_empty() {
+        assert!(validate_commit_ref("").is_err());
+        assert!(validate_commit_ref("abc123").is_err()); // 6 chars
+        assert!(validate_commit_ref(&"a".repeat(41)).is_err());
+    }
+}
diff --git a/hive-c0re/src/meta.rs b/hive-c0re/src/meta.rs
new file mode 100644
index 00000000..dc3cd2f0
--- /dev/null
+++ b/hive-c0re/src/meta.rs
@@ -0,0 +1,635 @@
+//! Single hive-c0re-owned flake at `/var/lib/hyperhive/meta/` that
+//! consumes every agent's applied repo as a flake input and exports one
+//! `nixosConfiguration` per agent. Containers run against
+//! `--flake /var/lib/hyperhive/meta#<name>`; lifecycle ops here drive the
+//! lock file so meta's git log is the system-wide deploy audit trail.
+//!
+//! Flow:
+//!   - `sync_agents` (idempotent) — render `flake.nix` for the current
+//!     agent set, init the repo on first call, relock if the rendered
+//!     contents changed, commit. Used by spawn / destroy / startup
+//!     migration.
+//!   - `prepare_deploy` + `finalize_deploy` / `abort_deploy` — two-phase
+//!     for the `request_apply_commit` path so a failed
+//!     `nixos-container update` leaves no orphan commit in meta. Prepare
+//!     writes the new lock without committing; finalize commits with the
+//!     deploy message; abort `git restore`s the lock back.
+//!   - `lock_update_hyperhive` — one-shot for the auto-update path.
+
+use std::path::{Path, PathBuf};
+
+use anyhow::{Context, Result, bail};
+use tokio::process::Command;
+use tokio::sync::Mutex;
+
+use crate::lifecycle;
+
+const META_ROOT: &str = "/var/lib/hyperhive/meta";
+const APPLIED_ROOT: &str = "/var/lib/hyperhive/applied";
+const GIT_NAME: &str = "c0re";
+const GIT_EMAIL: &str = "c0re@hyperhive";
+
+/// Single-writer lock around every meta-repo operation. Git isn't
+/// safe to drive from concurrent processes against the same `.git/`
+/// — two simultaneous `git add` / `commit` invocations race on
+/// `.git/index.lock`; if either dies before releasing, the lock
+/// sticks and the next operation hits "another git process seems to
+/// be running" until somebody `rm`s it manually. Holding this mutex
+/// across each public function's git+nix calls makes parallel
+/// rebuilds (`auto_update` + dashboard-triggered + apply-commit)
+/// take turns instead of colliding.
+static META_LOCK: Mutex<()> = Mutex::const_new(());
+
+/// Where the manager sees this directory inside its container (RO bind).
+#[allow(dead_code)] // wired up by set_nspawn_flags in a follow-up commit
+pub const CONTAINER_MANAGER_META_MOUNT: &str = "/meta";
+
+#[derive(Debug, Clone)]
+pub struct AgentSpec {
+    pub name: String,
+    pub is_manager: bool,
+    pub port: u16,
+}
+
+#[must_use]
+pub fn meta_dir() -> PathBuf {
+    PathBuf::from(META_ROOT)
+}
+
+/// Idempotently reconcile the meta repo with the current agent set.
+/// First call inits the git repo, runs `nix flake lock`, and lands a
+/// seed commit. Subsequent calls only touch `flake.nix` when the
+/// rendered contents differ from disk; an unchanged `flake.nix` is a
+/// no-op.
+#[allow(dead_code)] // first caller lands in a later commit
+pub async fn sync_agents(
+    hyperhive_flake: &str,
+    dashboard_port: u16,
+    operator_pronouns: &str,
+    context_window_tokens: &std::collections::HashMap<String, u64>,
+    agents: &[AgentSpec],
+) -> Result<()> {
+    let _guard = META_LOCK.lock().await;
+    let dir = meta_dir();
+    std::fs::create_dir_all(&dir).with_context(|| format!("create {}", dir.display()))?;
+
+    let new_flake = render_flake(hyperhive_flake, dashboard_port, operator_pronouns, context_window_tokens, agents);
+    let flake_path = dir.join("flake.nix");
+    let on_disk = std::fs::read_to_string(&flake_path).unwrap_or_default();
+    let initial = !dir.join(".git").exists();
+
+    if !initial && on_disk == new_flake {
+        return Ok(());
+    }
+
+    std::fs::write(&flake_path, &new_flake)
+        .with_context(|| format!("write {}", flake_path.display()))?;
+
+    // Reconcile topology.json against the live agent set — adds
+    // entries for newly-spawned agents (default: manager as parent,
+    // manager itself as root) and drops removed agents. Operator
+    // overrides via the write API (#361 follow-up) are preserved
+    // because reconcile only fills in missing entries. Idempotent;
+    // when nothing changed the file isn't touched.
+    let agent_names: Vec<String> = agents.iter().map(|a| a.name.clone()).collect();
+    let topology_changed = crate::topology::reconcile(&agent_names)
+        .with_context(|| format!("reconcile {}", crate::topology::topology_path().display()))?;
+
+    if initial {
+        git(&dir, &["init", "--initial-branch=main"]).await?;
+    }
+    // Stage flake.nix *before* running nix flake lock. When meta is
+    // a git repo, nix treats it as a `git+file://` self-reference;
+    // its dirty-tree fetcher includes index entries (tracked +
+    // staged) but skips untracked files, so without the stage step
+    // an untracked flake.nix surfaces as "source tree does not
+    // contain '/flake.nix'". Lock then commit once with both
+    // flake.nix and flake.lock — single commit per change.
+    git(&dir, &["add", "flake.nix"]).await?;
+    // Stage topology.json on every sync (regenerated by reconcile
+    // above when the agent set changed). git add is a no-op when the
+    // file content is unchanged.
+    if crate::topology::topology_path().exists() {
+        git(&dir, &["add", "topology.json"]).await?;
+    }
+    nix(&dir, &["flake", "lock"]).await?;
+    if std::path::Path::new(&dir).join("flake.lock").exists() {
+        git(&dir, &["add", "flake.lock"]).await?;
+    }
+    let msg = if initial {
+        format!("seed meta from {} agent(s)", agents.len())
+    } else if topology_changed {
+        "regenerate meta flake + topology".to_owned()
+    } else {
+        "regenerate meta flake".to_owned()
+    };
+    git_commit(&dir, &msg).await?;
+    Ok(())
+}
+
+/// Phase 1 of an apply-commit deploy. Updates the locked rev of
+/// `agent-<name>` to whatever `applied/<name>/main` currently points
+/// at and **stages** the lock so `nixos-container update --flake
+/// meta#<n>` (which reads via `git+file://`) sees the new rev via
+/// the index. Doesn't commit — `finalize_deploy` commits on build
+/// success, `abort_deploy` drops the staged change on failure so
+/// meta history only carries successful deploys.
+#[allow(dead_code)] // wired up by actions::run_apply_commit in a later commit
+pub async fn prepare_deploy(name: &str) -> Result<()> {
+    let _guard = META_LOCK.lock().await;
+    let dir = meta_dir();
+    let input = format!("agent-{name}");
+    nix(&dir, &["flake", "update", &input]).await?;
+    // Stage the new lock — git+file://'s dirty-tree fetcher reads
+    // index entries, so the upcoming nixos-container update sees the
+    // bumped rev without a commit yet.
+    git(&dir, &["add", "flake.lock"]).await
+}
+
+/// Phase 2-success. Commit the staged lock with the deployed tag +
+/// sha as the message. No-op when the rev was already at the right
+/// place (nothing staged → nothing to commit).
+#[allow(dead_code)]
+pub async fn finalize_deploy(name: &str, sha: &str, tag: &str) -> Result<()> {
+    let _guard = META_LOCK.lock().await;
+    let dir = meta_dir();
+    if !has_staged_changes(&dir).await? {
+        return Ok(());
+    }
+    let short = &sha[..sha.len().min(12)];
+    git_commit(&dir, &format!("deploy {name} {tag} {short}")).await
+}
+
+/// Phase 2-failure. Unstage + restore the lock so meta returns to
+/// the previously-committed shas. The failed proposal is still
+/// captured in `applied/<n>`'s annotated `failed/<id>` tag.
+#[allow(dead_code)]
+pub async fn abort_deploy() -> Result<()> {
+    let _guard = META_LOCK.lock().await;
+    let dir = meta_dir();
+    git(&dir, &["restore", "--staged", "flake.lock"]).await?;
+    git(&dir, &["restore", "flake.lock"]).await
+}
+
+async fn has_staged_changes(dir: &Path) -> Result<bool> {
+    let st = lifecycle::git_command()
+        .current_dir(dir)
+        .args(["diff", "--cached", "--quiet"])
+        .status()
+        .await
+        .with_context(|| format!("git diff --cached in {}", dir.display()))?;
+    // exit 1 = differences present, 0 = no diff, other = error
+    match st.code() {
+        Some(0) => Ok(false),
+        Some(1) => Ok(true),
+        _ => bail!("git diff --cached exited unexpectedly"),
+    }
+}
+
+/// One-shot used by the manual-rebuild path: relock just one
+/// agent's input and commit the lock change if any. Single-phase
+/// (no separate finalize) because rebuild has no failure-revert
+/// semantics — it always wants the latest main.
+#[allow(dead_code)] // wired up by lifecycle::rebuild in this commit
+pub async fn lock_update_for_rebuild(name: &str) -> Result<()> {
+    let _guard = META_LOCK.lock().await;
+    let dir = meta_dir();
+    let input = format!("agent-{name}");
+    nix(&dir, &["flake", "update", &input]).await?;
+    if git_is_clean(&dir).await? {
+        return Ok(());
+    }
+    git(&dir, &["add", "flake.lock"]).await?;
+    git_commit(&dir, &format!("rebuild {name}: lock update")).await
+}
+
+/// Update one or more named inputs in the meta flake and commit
+/// the resulting lock change with a single combined message.
+/// Used by the dashboard's "update meta inputs" form so the
+/// operator can bulk-bump `hyperhive` + selected agents in one
+/// shot. Each input name is passed verbatim to
+/// Run `nix flake update [inputs...]` on the meta flake and commit the
+/// resulting lock changes. When `inputs` is empty, updates ALL inputs
+/// (bare `nix flake update`). The caller is responsible for picking
+/// real input keys (e.g. via `inputs_view()` snapshotted from the lock
+/// file) when targeting specific inputs.
+pub async fn lock_update(inputs: &[String]) -> Result<()> {
+    let _guard = META_LOCK.lock().await;
+    let dir = meta_dir();
+    let mut args: Vec<&str> = vec!["flake", "update"];
+    for i in inputs {
+        args.push(i.as_str());
+    }
+    nix(&dir, &args).await?;
+    if git_is_clean(&dir).await? {
+        return Ok(());
+    }
+    git(&dir, &["add", "flake.lock"]).await?;
+    let msg = if inputs.is_empty() {
+        "lock update: all inputs".to_string()
+    } else if inputs.len() == 1 {
+        format!("lock update: {}", inputs[0])
+    } else {
+        format!("lock update: {}", inputs.join(", "))
+    };
+    git_commit(&dir, &msg).await
+}
+
+/// One-shot used by the auto-update path: pin the latest hyperhive
+/// rev, commit if the lock changed. Cheaper than `sync_agents`
+/// because the per-agent inputs aren't touched.
+#[allow(dead_code)]
+pub async fn lock_update_hyperhive() -> Result<()> {
+    let _guard = META_LOCK.lock().await;
+    let dir = meta_dir();
+    nix(&dir, &["flake", "update", "hyperhive"]).await?;
+    if git_is_clean(&dir).await? {
+        return Ok(());
+    }
+    git(&dir, &["add", "flake.lock"]).await?;
+    git_commit(&dir, "bump hyperhive").await
+}
+
+fn render_flake(
+    hyperhive_flake: &str,
+    dashboard_port: u16,
+    operator_pronouns: &str,
+    context_window_tokens: &std::collections::HashMap<String, u64>,
+    agents: &[AgentSpec],
+) -> String {
+    render_flake_with_lookup(
+        hyperhive_flake,
+        dashboard_port,
+        operator_pronouns,
+        context_window_tokens,
+        agents,
+        agent_canonical_inputs,
+    )
+}
+
+/// Canonical inputs meta knows how to dedup. An agent that declares one
+/// of these as a top-level input in its own `flake.nix` will get a
+/// `follows = "<name>"` line emitted in meta — collapsing the
+/// otherwise-separate-but-identical `nixpkgs_N` nodes into a single
+/// meta-level reference (#355).
+const CANONICAL_INPUTS: &[&str] = &["nixpkgs", "nixpkgs-unstable"];
+
+/// Read an agent's applied `flake.lock` and return the subset of
+/// `CANONICAL_INPUTS` it declares as direct (root-level) inputs.
+/// Returns an empty vec when the lock is missing or unparsable —
+/// safe degradation, the worst case is no dedup for that agent.
+fn agent_canonical_inputs(name: &str) -> Vec<&'static str> {
+    let path = std::path::PathBuf::from(format!("{APPLIED_ROOT}/{name}/flake.lock"));
+    let Ok(raw) = std::fs::read_to_string(&path) else {
+        return Vec::new();
+    };
+    let Ok(json) = serde_json::from_str::<serde_json::Value>(&raw) else {
+        return Vec::new();
+    };
+    let Some(nodes) = json.get("nodes").and_then(|v| v.as_object()) else {
+        return Vec::new();
+    };
+    let Some(root_name) = json.get("root").and_then(|v| v.as_str()) else {
+        return Vec::new();
+    };
+    let Some(root_inputs) = nodes
+        .get(root_name)
+        .and_then(|n| n.get("inputs"))
+        .and_then(|v| v.as_object())
+    else {
+        return Vec::new();
+    };
+    CANONICAL_INPUTS
+        .iter()
+        .copied()
+        .filter(|canon| root_inputs.contains_key(*canon))
+        .collect()
+}
+
+/// Inner render helper accepting a lookup fn so tests can stub the
+/// agent flake-lock introspection.
+fn render_flake_with_lookup<F>(
+    hyperhive_flake: &str,
+    dashboard_port: u16,
+    operator_pronouns: &str,
+    context_window_tokens: &std::collections::HashMap<String, u64>,
+    agents: &[AgentSpec],
+    lookup: F,
+) -> String
+where
+    F: Fn(&str) -> Vec<&'static str>,
+{
+    use std::fmt::Write as _;
+    let mut out = String::new();
+    out.push_str("{\n  description = \"hyperhive deployed agents\";\n  inputs = {\n");
+    // Pin canonical nixpkgs revisions at the meta level so every input
+    // that pulls a nixpkgs sub-input can `follows = "nixpkgs"` and
+    // collapse to one shared node (closes #317). hyperhive's own
+    // flake.nix picks `nixos-25.11`; we mirror that here so meta and
+    // hyperhive don't diverge into two stable channels by default.
+    // Operator can override these at the meta layer to slide every
+    // dependent agent onto a different channel in one move.
+    out.push_str("    nixpkgs.url = \"github:NixOS/nixpkgs/nixos-25.11\";\n");
+    out.push_str("    nixpkgs-unstable.url = \"github:NixOS/nixpkgs/nixpkgs-unstable\";\n");
+    let _ = writeln!(out, "    hyperhive.url = \"{hyperhive_flake}\";");
+    // Collapse hyperhive's own `nixpkgs` + `nixpkgs-unstable` inputs
+    // into meta's. Without this, hyperhive's flake.nix declarations
+    // become independent `nixpkgs_N` nodes in meta/flake.lock.
+    out.push_str("    hyperhive.inputs.nixpkgs.follows = \"nixpkgs\";\n");
+    out.push_str("    hyperhive.inputs.nixpkgs-unstable.follows = \"nixpkgs-unstable\";\n");
+    for spec in agents {
+        let _ = writeln!(
+            out,
+            "    agent-{}.url = \"git+file://{APPLIED_ROOT}/{}\";",
+            spec.name, spec.name,
+        );
+        // For each canonical input the agent declares in its own
+        // `flake.nix` (detected by reading its applied `flake.lock`),
+        // emit `inputs.agent-<name>.inputs.<canon>.follows = "<canon>"`.
+        // Collapses three otherwise-separate-but-identical nixpkgs
+        // nodes (root + agent-bitburner's + agent-dmatrix's) into one
+        // (closes #355). Skipped silently for agents that don't
+        // declare the input — emitting follows on a non-existent
+        // input would error at `nix flake lock` time.
+        for canon in lookup(&spec.name) {
+            let _ = writeln!(
+                out,
+                "    agent-{}.inputs.{canon}.follows = \"{canon}\";",
+                spec.name,
+            );
+        }
+    }
+    out.push_str("  };\n  outputs =\n    { self, hyperhive, ... }@inputs:\n    let\n");
+    // Free-text operator string — escape backslash + double-quote so a
+    // pronouns value like `he/him \ "rare"` round-trips into a valid
+    // nix string literal without breaking the flake.
+    let pronouns_escaped = operator_pronouns.replace('\\', "\\\\").replace('"', "\\\"");
+    let _ = writeln!(
+        out,
+        "      dashboardPort = {dashboard_port};\n      operatorPronouns = \"{pronouns_escaped}\";\n      mkAgent = {{ name, isManager, port, parent ? null }}:"
+    );
+    out.push_str(
+        r#"        let
+          base = if isManager
+                 then hyperhive.nixosConfigurations.manager
+                 else hyperhive.nixosConfigurations.agent-base;
+          input = inputs."agent-${name}";
+          service = if isManager then "hive-m1nd" else "hive-ag3nt";
+          parentEnv = if parent == null then {} else { HIVE_PARENT = parent; };
+        in
+        base.extendModules {
+          modules = [
+            input.nixosModules.default
+            {
+              programs.git.config.user = {
+                name = name;
+                email = "${name}@hyperhive";
+              };
+              # Container-wide env: every service + co-process daemon can
+              # resolve the agent's durable state dir without hard-coding it.
+              environment.variables = {
+                HIVE_LABEL = name;
+                HYPERHIVE_STATE_DIR = "/agents/${name}/state";
+              };
+              systemd.services.${service}.environment = parentEnv // {
+                HIVE_PORT = toString port;
+                HIVE_LABEL = name;
+                HIVE_DASHBOARD_PORT = toString dashboardPort;
+                HIVE_OPERATOR_PRONOUNS = operatorPronouns;"#,
+    );
+    // Per-model context-window env vars declared in the host-level
+    // `services.hive-c0re.contextWindowTokens` option. Use a sorted
+    // iterator for deterministic flake output (no spurious git diffs).
+    let mut sorted_tokens: Vec<(&String, &u64)> = context_window_tokens.iter().collect();
+    sorted_tokens.sort_by_key(|(k, _)| k.as_str());
+    for (key, val) in &sorted_tokens {
+        let upper_key = key.to_ascii_uppercase();
+        let _ = writeln!(out, "                HIVE_CONTEXT_WINDOW_TOKENS_{upper_key} = \"{val}\";");
+    }
+    // Forge URL — injected when hive-c0re itself has HIVE_FORGE_URL set
+    // (the NixOS module derives it from hyperhive.forge.{domain,httpPort}).
+    // Agents use it in forge_notify to poll Forgejo for PR/review events.
+    if let Ok(forge_url) = std::env::var("HIVE_FORGE_URL")
+        && !forge_url.is_empty() {
+            let escaped = forge_url.replace('\\', "\\\\").replace('"', "\\\"");
+            let _ = writeln!(out, "                HIVE_FORGE_URL = \"{escaped}\";");
+        }
+    out.push_str(
+        r#"                HYPERHIVE_STATE_DIR = "/agents/${name}/state";
+              };
+            }
+          ];
+        };
+    in
+    {
+      nixosConfigurations = {
+"#,
+    );
+    // Pull the topology map once and look up each agent's parent. An
+    // empty / absent topology.json yields `parent = null` for everyone
+    // — equivalent to the pre-#361 status quo (every container at root).
+    // `meta::sync_agents` seeds the file on first run with manager as
+    // root + everyone else under manager.
+    let topology = crate::topology::read();
+    for spec in agents {
+        let parent_attr = topology
+            .get(&spec.name)
+            .and_then(|p| p.as_ref())
+            .map_or_else(|| "null".to_owned(), |p| format!("\"{p}\""));
+        let _ = writeln!(
+            out,
+            "        {} = mkAgent {{ name = \"{}\"; isManager = {}; port = {}; parent = {}; }};",
+            spec.name,
+            spec.name,
+            if spec.is_manager { "true" } else { "false" },
+            spec.port,
+            parent_attr,
+        );
+    }
+    out.push_str("      };\n    };\n}\n");
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn sample_spec(name: &str, is_manager: bool, port: u16) -> AgentSpec {
+        AgentSpec {
+            name: name.to_owned(),
+            is_manager,
+            port,
+        }
+    }
+
+    #[test]
+    fn render_flake_declares_canonical_nixpkgs() {
+        let out = render_flake(
+            "github:example/hyperhive",
+            8000,
+            "she/her",
+            &std::collections::HashMap::new(),
+            &[sample_spec("alice", false, 9001)],
+        );
+        // Top-level nixpkgs inputs pinned by meta — every nested
+        // nixpkgs input can follow these instead of resolving its own
+        // (closes #317).
+        assert!(out.contains("nixpkgs.url = \"github:NixOS/nixpkgs/nixos-25.11\""));
+        assert!(out.contains("nixpkgs-unstable.url = \"github:NixOS/nixpkgs/nixpkgs-unstable\""));
+    }
+
+    #[test]
+    fn render_flake_collapses_hyperhive_nixpkgs_via_follows() {
+        let out = render_flake(
+            "github:example/hyperhive",
+            8000,
+            "she/her",
+            &std::collections::HashMap::new(),
+            &[],
+        );
+        // hyperhive's own `nixpkgs` + `nixpkgs-unstable` declarations
+        // get redirected at meta's. Without these, meta/flake.lock
+        // ends up with separate `nixpkgs_N` nodes for hyperhive's
+        // copy (the pre-#317 status quo).
+        assert!(out.contains("hyperhive.inputs.nixpkgs.follows = \"nixpkgs\""));
+        assert!(out.contains("hyperhive.inputs.nixpkgs-unstable.follows = \"nixpkgs-unstable\""));
+    }
+
+    #[test]
+    fn render_flake_emits_follows_for_agents_declaring_nixpkgs() {
+        // Stub lookup: pretend `bitburner` declares `nixpkgs` at its
+        // root, while `argus` has no canonical inputs at all.
+        let lookup = |name: &str| -> Vec<&'static str> {
+            match name {
+                "bitburner" => vec!["nixpkgs"],
+                "dmatrix" => vec!["nixpkgs", "nixpkgs-unstable"],
+                _ => vec![],
+            }
+        };
+        let out = render_flake_with_lookup(
+            "github:example/hyperhive",
+            8000,
+            "she/her",
+            &std::collections::HashMap::new(),
+            &[
+                sample_spec("argus", false, 9001),
+                sample_spec("bitburner", false, 9002),
+                sample_spec("dmatrix", false, 9003),
+            ],
+            lookup,
+        );
+        // bitburner declares nixpkgs → follows emitted.
+        assert!(
+            out.contains("agent-bitburner.inputs.nixpkgs.follows = \"nixpkgs\""),
+            "missing bitburner nixpkgs follows:\n{out}"
+        );
+        // dmatrix declares both → both follows emitted.
+        assert!(out.contains("agent-dmatrix.inputs.nixpkgs.follows = \"nixpkgs\""));
+        assert!(
+            out.contains("agent-dmatrix.inputs.nixpkgs-unstable.follows = \"nixpkgs-unstable\"")
+        );
+        // argus declares neither → no follows emitted for it. Asserting
+        // ABSENCE is the important bit: emitting a follows on a
+        // non-existent input errors at `nix flake lock` time.
+        assert!(
+            !out.contains("agent-argus.inputs.nixpkgs"),
+            "argus shouldn't have nixpkgs follows:\n{out}"
+        );
+    }
+
+    #[test]
+    fn render_flake_skips_canonical_follows_when_lookup_returns_empty() {
+        let out = render_flake_with_lookup(
+            "github:example/hyperhive",
+            8000,
+            "she/her",
+            &std::collections::HashMap::new(),
+            &[sample_spec("alice", false, 9001)],
+            |_| Vec::new(),
+        );
+        // No agent-side follows when the lookup reports nothing
+        // declared — protects agents whose flake.lock can't be read
+        // (missing / unparsable) from being broken by a follows on a
+        // non-existent input.
+        assert!(
+            !out.contains("agent-alice.inputs."),
+            "alice shouldn't have any inputs follows:\n{out}"
+        );
+    }
+}
+
+async fn git_is_clean(dir: &Path) -> Result<bool> {
+    let out = lifecycle::git_command()
+        .current_dir(dir)
+        .args(["status", "--porcelain"])
+        .output()
+        .await
+        .with_context(|| format!("git status in {}", dir.display()))?;
+    Ok(out.stdout.iter().all(u8::is_ascii_whitespace))
+}
+
+async fn git(dir: &Path, args: &[&str]) -> Result<()> {
+    let out = lifecycle::git_command()
+        .current_dir(dir)
+        .args(args)
+        .output()
+        .await
+        .with_context(|| format!("git {} in {}", args.join(" "), dir.display()))?;
+    if !out.status.success() {
+        bail!(
+            "git {} failed ({}): {}",
+            args.join(" "),
+            out.status,
+            String::from_utf8_lossy(&out.stderr).trim()
+        );
+    }
+    Ok(())
+}
+
+async fn git_commit(dir: &Path, message: &str) -> Result<()> {
+    git(
+        dir,
+        &[
+            "-c",
+            &format!("user.name={GIT_NAME}"),
+            "-c",
+            &format!("user.email={GIT_EMAIL}"),
+            "commit",
+            "-m",
+            message,
+        ],
+    )
+    .await?;
+    // Best-effort mirror to the bundled forge. No-op when the forge
+    // isn't seeded (no core token on disk); push failures log a warn
+    // but don't bubble up — a missing mirror shouldn't fail an
+    // otherwise successful deploy.
+    if let Err(e) = crate::forge::push_meta(dir).await {
+        tracing::warn!(error = ?e, "forge: meta push after commit failed (non-fatal)");
+    }
+    Ok(())
+}
+
+async fn nix(dir: &Path, args: &[&str]) -> Result<()> {
+    // `--extra-experimental-features` belt-and-suspenders for hosts
+    // that haven't set this in nix.conf. The hyperhive module's
+    // deploy guide assumes flakes are already enabled, but the cost
+    // of being defensive is one extra argv each call.
+    let mut all = vec!["--extra-experimental-features", "nix-command flakes"];
+    all.extend(args);
+    let out = Command::new("nix")
+        .current_dir(dir)
+        .args(&all)
+        .output()
+        .await
+        .with_context(|| format!("nix {} in {}", args.join(" "), dir.display()))?;
+    if !out.status.success() {
+        bail!(
+            "nix {} failed ({}): {}",
+            args.join(" "),
+            out.status,
+            String::from_utf8_lossy(&out.stderr).trim()
+        );
+    }
+    Ok(())
+}
diff --git a/hive-c0re/src/migrate.rs b/hive-c0re/src/migrate.rs
new file mode 100644
index 00000000..5e1ae421
--- /dev/null
+++ b/hive-c0re/src/migrate.rs
@@ -0,0 +1,215 @@
+//! Startup auto-migration from the pre-meta layout. Runs before
+//! `auto_update::run` and consists of four phases, each idempotent:
+//!
+//! 1. Per-agent applied repo: rewrite `flake.nix` to the module-only
+//!    boilerplate if it isn't already, commit, relocate `deployed/0`
+//!    to HEAD so `setup_applied`'s existence check passes.
+//! 2. Per-agent proposed repo: ensure the `applied` git remote
+//!    points at `/applied/<n>/.git` (re-runs `setup_proposed`'s
+//!    `ensure_applied_remote` indirectly via a host-side git call).
+//! 3. Meta repo: `meta::sync_agents` over the current agent list —
+//!    init the repo on first call, rerender + relock if anything
+//!    drifted.
+//! 4. Container repoint: for every existing container, run
+//!    `nixos-container update <c> --flake meta#<name>` so it
+//!    activates against the meta flake. Guarded by a marker file
+//!    so the (expensive) phase 4 only runs once across hive-c0re
+//!    restarts.
+//!
+//! Env kill-switch: `HIVE_SKIP_META_MIGRATION=1` skips the whole
+//! migration. Use when smoke-testing one agent at a time by hand.
+
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+
+use anyhow::{Context, Result};
+use tokio::process::Command;
+
+use crate::coordinator::Coordinator;
+use crate::lifecycle::{self, AGENT_PREFIX, MANAGER_NAME};
+use crate::meta;
+
+const KILL_SWITCH: &str = "HIVE_SKIP_META_MIGRATION";
+
+/// Marker for phase 4. Once present, container repoint is skipped on
+/// future restarts.
+fn repoint_marker() -> PathBuf {
+    PathBuf::from("/var/lib/hyperhive/.meta-migration-done")
+}
+
+/// Substring that identifies the *current* agent flake boilerplate.
+/// Bumped whenever the template changes so the startup migration
+/// re-renders existing agents onto the new shape. Today the marker
+/// is the `flakeInputs` module-arg forwarding line — older templates
+/// (raw `import ./agent.nix`) get rewritten on next hive-c0re start.
+const MODULE_FLAKE_MARKER: &str = "_module.args.flakeInputs";
+
+pub async fn run(coord: &Arc<Coordinator>) -> Result<()> {
+    if std::env::var(KILL_SWITCH).is_ok() {
+        tracing::info!("migration: {KILL_SWITCH} set — skipping");
+        return Ok(());
+    }
+    // Stale meta index lock: a previous hive-c0re crash mid-`git add`
+    // can leave `.git/index.lock` behind, which blocks every
+    // subsequent meta op until somebody `rm`s it manually. We just
+    // booted so nothing of ours is holding it; safe to clear.
+    let meta_lock = std::path::PathBuf::from("/var/lib/hyperhive/meta/.git/index.lock");
+    if meta_lock.exists() {
+        match std::fs::remove_file(&meta_lock) {
+            Ok(()) => tracing::warn!("cleared stale meta/.git/index.lock"),
+            Err(e) => tracing::warn!(error = ?e, "clear stale meta lock failed"),
+        }
+    }
+    let names = enumerate_agents().await;
+    tracing::info!(count = names.len(), "migration: scanning");
+
+    // Phase 1 + 2: per-agent applied + proposed.
+    for name in &names {
+        if let Err(e) = migrate_applied_repo(name).await {
+            tracing::warn!(%name, error = ?e, "migration: applied repo rewrite failed");
+        }
+        if let Err(e) =
+            lifecycle::setup_proposed(&Coordinator::agent_proposed_dir(name), name).await
+        {
+            tracing::warn!(%name, error = ?e, "migration: setup_proposed failed");
+        }
+    }
+
+    // Phase 3: meta repo.
+    let agents = lifecycle::agents_for_meta_listing()
+        .await
+        .unwrap_or_default();
+    if let Err(e) = meta::sync_agents(
+        &coord.hyperhive_flake,
+        coord.dashboard_port,
+        &coord.operator_pronouns,
+        &coord.context_window_tokens,
+        &agents,
+    )
+    .await
+    {
+        tracing::warn!(error = ?e, "migration: meta sync_agents failed");
+    }
+
+    // Phase 4: container repoint, guarded by marker.
+    if repoint_marker().exists() {
+        tracing::debug!("migration: phase 4 marker present, skipping repoint");
+        return Ok(());
+    }
+    let mut all_ok = true;
+    for name in &names {
+        // Mark Rebuilding so the crash watcher skips this container
+        // during the brief stop+start window the nixos-container
+        // update activation triggers. Without this, crash_watch
+        // would fire ContainerCrash for every agent here and the
+        // manager would spuriously try to recover them.
+        let guard = coord.transient_guard(name, crate::coordinator::TransientKind::Rebuilding);
+        let result = repoint_container(name).await;
+        drop(guard);
+        if let Err(e) = result {
+            tracing::warn!(%name, error = ?e, "migration: container repoint failed");
+            all_ok = false;
+        }
+    }
+    if all_ok
+        && !names.is_empty()
+        && let Err(e) = std::fs::write(repoint_marker(), b"done\n")
+    {
+        tracing::warn!(error = ?e, "migration: write repoint marker failed");
+    }
+    Ok(())
+}
+
+async fn enumerate_agents() -> Vec<String> {
+    let containers = lifecycle::list().await.unwrap_or_default();
+    containers
+        .into_iter()
+        .filter_map(|c| {
+            if c == MANAGER_NAME {
+                Some(MANAGER_NAME.to_owned())
+            } else {
+                c.strip_prefix(AGENT_PREFIX).map(str::to_owned)
+            }
+        })
+        .collect()
+}
+
+async fn migrate_applied_repo(name: &str) -> Result<()> {
+    let dir = Coordinator::agent_applied_dir(name);
+    if !dir.join(".git").exists() {
+        return Ok(());
+    }
+    let flake_path = dir.join("flake.nix");
+    let cur = std::fs::read_to_string(&flake_path).unwrap_or_default();
+    if cur.contains(MODULE_FLAKE_MARKER) {
+        return Ok(());
+    }
+    let want = lifecycle::initial_flake_nix();
+    std::fs::write(&flake_path, want).with_context(|| format!("write {}", flake_path.display()))?;
+    raw_git(
+        &dir,
+        &[
+            "-c",
+            "user.name=c0re",
+            "-c",
+            "user.email=c0re@hyperhive",
+            "add",
+            "flake.nix",
+        ],
+    )
+    .await?;
+    raw_git(
+        &dir,
+        &[
+            "-c",
+            "user.name=c0re",
+            "-c",
+            "user.email=c0re@hyperhive",
+            "commit",
+            "-m",
+            "migration: module-only flake",
+        ],
+    )
+    .await?;
+    // Relocate deployed/0 to the migration commit so
+    // setup_applied's existence check passes.
+    raw_git(&dir, &["tag", "-f", "deployed/0", "HEAD"]).await?;
+    tracing::info!(%name, "migration: applied repo migrated to module-only flake");
+    Ok(())
+}
+
+async fn repoint_container(name: &str) -> Result<()> {
+    let container = lifecycle::container_name(name);
+    let flake_ref = format!("{}#{name}", meta::meta_dir().display());
+    let out = Command::new("nixos-container")
+        .args(["update", &container, "--flake", &flake_ref])
+        .output()
+        .await
+        .with_context(|| format!("nixos-container update {container}"))?;
+    if !out.status.success() {
+        anyhow::bail!(
+            "nixos-container update {container} exited {}: {}",
+            out.status,
+            String::from_utf8_lossy(&out.stderr).trim()
+        );
+    }
+    tracing::info!(%name, %container, "migration: container repointed at meta");
+    Ok(())
+}
+
+async fn raw_git(dir: &Path, args: &[&str]) -> Result<()> {
+    let out = lifecycle::git_command()
+        .current_dir(dir)
+        .args(args)
+        .output()
+        .await
+        .with_context(|| format!("git {} in {}", args.join(" "), dir.display()))?;
+    if !out.status.success() {
+        anyhow::bail!(
+            "git {} failed: {}",
+            args.join(" "),
+            String::from_utf8_lossy(&out.stderr).trim()
+        );
+    }
+    Ok(())
+}
diff --git a/hive-c0re/src/operator_questions.rs b/hive-c0re/src/operator_questions.rs
new file mode 100644
index 00000000..5440c115
--- /dev/null
+++ b/hive-c0re/src/operator_questions.rs
@@ -0,0 +1,319 @@
+//! Question queue. Agents submit via `Ask`; the answer comes from
+//! either the operator (via the dashboard, for `target IS NULL`) or
+//! a peer agent (via `Answer`, for agent-to-agent questions).
+//!
+//! Despite the file name (kept for git history sanity), this table
+//! now stores *all* asynchronous questions in the hive — both the
+//! operator-targeted ones and the peer-to-peer ones. `target IS
+//! NULL` is the operator path (back-compat with rows written before
+//! the column existed); `target = '<agent-name>'` is the
+//! agent-to-agent path.
+
+use std::path::Path;
+use std::sync::Mutex;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use anyhow::{Context, Result, bail};
+use rusqlite::{Connection, OptionalExtension, params};
+use serde::Serialize;
+
+const SCHEMA: &str = r"
+CREATE TABLE IF NOT EXISTS operator_questions (
+    id           INTEGER PRIMARY KEY AUTOINCREMENT,
+    asker        TEXT    NOT NULL,
+    question     TEXT    NOT NULL,
+    options_json TEXT    NOT NULL,
+    asked_at     INTEGER NOT NULL,
+    answered_at  INTEGER,
+    answer       TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_operator_questions_pending
+    ON operator_questions (id) WHERE answered_at IS NULL;
+";
+
+/// Add late-added columns to pre-existing databases. `ALTER TABLE
+/// ADD COLUMN` has no `IF NOT EXISTS` form in sqlite, so we check
+/// `pragma_table_info` first per column.
+fn ensure_columns(conn: &Connection) -> Result<()> {
+    for (name, sql) in [
+        (
+            "multi",
+            "ALTER TABLE operator_questions ADD COLUMN multi INTEGER NOT NULL DEFAULT 0;",
+        ),
+        (
+            "deadline_at",
+            "ALTER TABLE operator_questions ADD COLUMN deadline_at INTEGER;",
+        ),
+        // `target` = recipient of the question. NULL = operator
+        // (back-compat default for rows written before agent-to-agent
+        // questions existed); a non-null agent name = peer-to-peer
+        // question. Dashboard's `pending()` filters on `target IS NULL`
+        // so peer questions never leak into the operator's queue.
+        (
+            "target",
+            "ALTER TABLE operator_questions ADD COLUMN target TEXT;",
+        ),
+    ] {
+        let has: bool = conn
+            .prepare(&format!(
+                "SELECT 1 FROM pragma_table_info('operator_questions') WHERE name = '{name}'"
+            ))?
+            .exists([])?;
+        if !has {
+            conn.execute_batch(sql)
+                .with_context(|| format!("add operator_questions.{name} column"))?;
+        }
+    }
+    Ok(())
+}
+
+#[derive(Debug, Clone, Serialize)]
+#[allow(clippy::doc_markdown)]
+pub struct OpQuestion {
+    pub id: i64,
+    pub asker: String,
+    pub question: String,
+    pub options: Vec<String>,
+    pub multi: bool,
+    pub asked_at: i64,
+    /// Absolute unix-seconds deadline after which a watchdog auto-
+    /// resolves the question with answer `[expired]`. `None` = no
+    /// expiry. Surfaced on the dashboard as a remaining-time chip.
+    pub deadline_at: Option<i64>,
+    pub answered_at: Option<i64>,
+    pub answer: Option<String>,
+    /// Recipient of the question. `None` = the operator (dashboard
+    /// path); `Some(<agent>)` = a peer agent asked via
+    /// `Ask { to: Some(<agent>), ... }`. Agent-to-agent questions
+    /// never appear in `pending()` so the operator's queue stays clean.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub target: Option<String>,
+}
+
+pub struct OperatorQuestions {
+    conn: Mutex<Connection>,
+}
+
+impl OperatorQuestions {
+    pub fn open(path: &Path) -> Result<Self> {
+        if let Some(parent) = path.parent() {
+            std::fs::create_dir_all(parent).with_context(|| {
+                format!("create operator_questions db parent {}", parent.display())
+            })?;
+        }
+        let conn = Connection::open(path)
+            .with_context(|| format!("open operator_questions db {}", path.display()))?;
+        conn.execute_batch(SCHEMA)
+            .context("apply operator_questions schema")?;
+        ensure_columns(&conn).context("migrate operator_questions columns")?;
+        Ok(Self {
+            conn: Mutex::new(conn),
+        })
+    }
+
+    pub fn submit(
+        &self,
+        asker: &str,
+        question: &str,
+        options: &[String],
+        multi: bool,
+        deadline_at: Option<i64>,
+        target: Option<&str>,
+    ) -> Result<i64> {
+        let conn = self.conn.lock().unwrap();
+        let options_json = serde_json::to_string(options).unwrap_or_else(|_| "[]".into());
+        conn.execute(
+            "INSERT INTO operator_questions
+               (asker, question, options_json, multi, deadline_at, target, asked_at)
+             VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)",
+            params![
+                asker,
+                question,
+                options_json,
+                i64::from(multi),
+                deadline_at,
+                target,
+                now_unix(),
+            ],
+        )?;
+        Ok(conn.last_insert_rowid())
+    }
+
+    /// Mark a pending question answered. `answerer` is who's actually
+    /// answering: `"operator"` for the dashboard path, or an agent's
+    /// own name when responding via `Answer`. Authorisation:
+    ///
+    /// - Operator-targeted questions (`target IS NULL`) can only be
+    ///   answered by `"operator"`. (Agents must not be able to spoof
+    ///   answers to operator questions — the dashboard is the
+    ///   privileged path.)
+    /// - Agent-targeted questions can only be answered by the
+    ///   declared target agent, OR by `"operator"` (operator override
+    ///   for stuck threads — useful when an agent is offline/down
+    ///   and someone has to close the loop).
+    ///
+    /// Returns `(question, asker, target)` so the caller can fire the
+    /// `QuestionAnswered` event with the right answerer label and route
+    /// it back to the original asker.
+    pub fn answer(
+        &self,
+        id: i64,
+        answer: &str,
+        answerer: &str,
+    ) -> Result<(String, String, Option<String>)> {
+        let conn = self.conn.lock().unwrap();
+        let row: Option<(String, String, Option<String>, Option<i64>)> = conn
+            .query_row(
+                "SELECT question, asker, target, answered_at FROM operator_questions WHERE id = ?1",
+                params![id],
+                |row| Ok((row.get(0)?, row.get(1)?, row.get(2)?, row.get(3)?)),
+            )
+            .optional()?;
+        let Some((question, asker, target, answered_at)) = row else {
+            bail!("question {id} not found");
+        };
+        if answered_at.is_some() {
+            bail!("question {id} already answered");
+        }
+        // Authorisation check: must match the target, or be the operator
+        // (operator-targeted questions are operator-only; the operator
+        // can additionally override agent-to-agent questions to close
+        // stuck threads).
+        let authorised = match target.as_deref() {
+            None => answerer == hive_sh4re::OPERATOR_RECIPIENT,
+            Some(t) => answerer == t || answerer == hive_sh4re::OPERATOR_RECIPIENT,
+        };
+        if !authorised {
+            bail!(
+                "question {id} not addressed to '{answerer}' (target = {:?})",
+                target.as_deref().unwrap_or(hive_sh4re::OPERATOR_RECIPIENT)
+            );
+        }
+        conn.execute(
+            "UPDATE operator_questions SET answer = ?1, answered_at = ?2 WHERE id = ?3",
+            params![answer, now_unix(), id],
+        )?;
+        Ok((question, asker, target))
+    }
+
+    /// Cancel a pending question on behalf of `canceller`. Returns
+    /// `(question, asker, target)` so the caller can fire the usual
+    /// `QuestionAnswered` event to the asker with a `[cancelled by
+    /// <canceller>]` sentinel.
+    ///
+    /// Auth: the canceller must be one of:
+    /// - the original asker (an agent withdrawing their own ask),
+    /// - the operator (already covered by the existing `answer` path
+    ///   but allowed here too for symmetry / dashboard cancel),
+    /// - the manager (privileged hive-wide cleanup).
+    ///
+    /// Not the target — that's covered by `answer` (responding with
+    /// an actual reply, sentinel or otherwise).
+    pub fn cancel(
+        &self,
+        id: i64,
+        canceller: &str,
+    ) -> Result<(String, String, Option<String>)> {
+        let conn = self.conn.lock().unwrap();
+        let row: Option<(String, String, Option<String>, Option<i64>)> = conn
+            .query_row(
+                "SELECT question, asker, target, answered_at FROM operator_questions WHERE id = ?1",
+                params![id],
+                |row| Ok((row.get(0)?, row.get(1)?, row.get(2)?, row.get(3)?)),
+            )
+            .optional()?;
+        let Some((question, asker, target, answered_at)) = row else {
+            bail!("question {id} not found");
+        };
+        if answered_at.is_some() {
+            bail!("question {id} already answered/cancelled");
+        }
+        let authorised = canceller == asker
+            || canceller == hive_sh4re::OPERATOR_RECIPIENT
+            || canceller == hive_sh4re::MANAGER_AGENT;
+        if !authorised {
+            bail!(
+                "question {id}: '{canceller}' not allowed to cancel (asker = '{asker}')"
+            );
+        }
+        let sentinel = format!("[cancelled by {canceller}]");
+        conn.execute(
+            "UPDATE operator_questions SET answer = ?1, answered_at = ?2 WHERE id = ?3",
+            params![sentinel, now_unix(), id],
+        )?;
+        Ok((question, asker, target))
+    }
+
+    #[allow(dead_code)]
+    pub fn get(&self, id: i64) -> Result<Option<OpQuestion>> {
+        let conn = self.conn.lock().unwrap();
+        conn.query_row(
+            "SELECT id, asker, question, options_json, multi, asked_at, answered_at, answer, deadline_at, target
+               FROM operator_questions WHERE id = ?1",
+            params![id],
+            row_to_question,
+        )
+        .optional()
+        .map_err(Into::into)
+    }
+
+    /// Every pending question, operator-targeted or peer-to-peer.
+    /// Drives the dashboard's questions pane now that peer threads
+    /// are surfaced for visibility + operator override-answer.
+    pub fn pending_all(&self) -> Result<Vec<OpQuestion>> {
+        let conn = self.conn.lock().unwrap();
+        let mut stmt = conn.prepare(
+            "SELECT id, asker, question, options_json, multi, asked_at, answered_at, answer, deadline_at, target
+               FROM operator_questions
+              WHERE answered_at IS NULL
+              ORDER BY id ASC",
+        )?;
+        let rows = stmt.query_map([], row_to_question)?;
+        rows.collect::<rusqlite::Result<Vec<_>>>()
+            .map_err(Into::into)
+    }
+
+    /// Last `limit` answered questions across both target kinds,
+    /// newest-first. Companion to `pending_all`.
+    pub fn recent_answered_all(&self, limit: u64) -> Result<Vec<OpQuestion>> {
+        let conn = self.conn.lock().unwrap();
+        let mut stmt = conn.prepare(
+            "SELECT id, asker, question, options_json, multi, asked_at, answered_at, answer, deadline_at, target
+               FROM operator_questions
+              WHERE answered_at IS NOT NULL
+              ORDER BY answered_at DESC
+              LIMIT ?1",
+        )?;
+        let limit_i = i64::try_from(limit).unwrap_or(i64::MAX);
+        let rows = stmt.query_map(params![limit_i], row_to_question)?;
+        rows.collect::<rusqlite::Result<Vec<_>>>()
+            .map_err(Into::into)
+    }
+
+}
+
+fn row_to_question(row: &rusqlite::Row<'_>) -> rusqlite::Result<OpQuestion> {
+    let options_json: String = row.get(3)?;
+    let options: Vec<String> = serde_json::from_str(&options_json).unwrap_or_default();
+    let multi: i64 = row.get(4)?;
+    Ok(OpQuestion {
+        id: row.get(0)?,
+        asker: row.get(1)?,
+        question: row.get(2)?,
+        options,
+        multi: multi != 0,
+        asked_at: row.get(5)?,
+        answered_at: row.get(6)?,
+        answer: row.get(7)?,
+        deadline_at: row.get(8)?,
+        target: row.get(9)?,
+    })
+}
+
+fn now_unix() -> i64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .ok()
+        .and_then(|d| i64::try_from(d.as_secs()).ok())
+        .unwrap_or(0)
+}
diff --git a/hive-c0re/src/questions.rs b/hive-c0re/src/questions.rs
new file mode 100644
index 00000000..339d377c
--- /dev/null
+++ b/hive-c0re/src/questions.rs
@@ -0,0 +1,257 @@
+//! Shared dispatch helpers for the `Ask` / `Answer` flow. Both the
+//! agent socket and the manager socket call into here so the routing
+//! semantics — recipient = operator vs. peer agent, answerer
+//! authorisation, asker-notification — only live in one place.
+//!
+//! Routing rules at a glance:
+//!
+//! - `Ask { to: None | Some("operator") }` → stored with `target = NULL`;
+//!   the dashboard's `pending()` query surfaces it; operator answers
+//!   via the dashboard.
+//! - `Ask { to: Some(<agent>) }` → stored with `target = <agent>`;
+//!   a `HelperEvent::QuestionAsked` is pushed into `<agent>`'s
+//!   inbox so they can `Answer { id, answer }` on their own socket.
+//! - `Answer { id, answer }` → permission-checked in
+//!   `OperatorQuestions::answer` (only the target agent or the
+//!   operator can answer; both paths fire the same
+//!   `QuestionAnswered` event to the asker).
+
+use std::sync::Arc;
+
+use crate::approvals::kind_to_str;
+use crate::coordinator::Coordinator;
+use crate::limits;
+use crate::manager_server::spawn_question_watchdog;
+
+/// Cap on how long an asker can demand an answer before the watchdog
+/// auto-resolves with `[expired]`. Six hours mirrors typical agent
+/// session lifetimes — beyond that an unanswered question is
+/// effectively a dead thread and should be re-asked, not blocked on.
+const MAX_TTL_SECONDS: u64 = 6 * 60 * 60;
+
+/// Handle either surface's `Ask` request. Returns the queued
+/// question id on success or a caller-ready error string. Caller is
+/// responsible for wrapping in the matching `*Response::Err` /
+/// `QuestionQueued` variant.
+pub fn handle_ask(
+    coord: &Arc<Coordinator>,
+    asker: &str,
+    question: &str,
+    options: &[String],
+    multi: bool,
+    ttl_seconds: Option<u64>,
+    to: Option<&str>,
+) -> Result<i64, String> {
+    limits::check_size("question", question)?;
+    // Normalise `Some("operator")` → None so the storage layer
+    // only has to think about NULL vs. non-NULL targets, not
+    // "is this string the operator?".
+    let target = match to {
+        None => None,
+        Some(t) if t == hive_sh4re::OPERATOR_RECIPIENT => None,
+        Some("") => {
+            return Err("ask: `to` cannot be empty (omit it for the operator path)".to_owned());
+        }
+        Some(t) if t == asker => {
+            return Err("ask: cannot ask yourself a question (would loop forever)".to_owned());
+        }
+        Some(t) => Some(t),
+    };
+    let ttl = ttl_seconds.map(|s| s.min(MAX_TTL_SECONDS));
+    let deadline_at = ttl.and_then(|s| {
+        let now = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .ok()
+            .and_then(|d| i64::try_from(d.as_secs()).ok())
+            .unwrap_or(0);
+        i64::try_from(s).ok().map(|s| now + s)
+    });
+    let id = coord
+        .questions
+        .submit(asker, question, options, multi, deadline_at, target)
+        .map_err(|e| format!("{e:#}"))?;
+    tracing::info!(%id, %asker, ?target, ?deadline_at, "question queued");
+    // Agent-targeted questions need to wake the recipient — drop a
+    // QuestionAsked event into their inbox so the answerer doesn't
+    // have to poll. Operator-targeted questions show up on the
+    // dashboard's pending pane via `pending()` instead, plus a
+    // `QuestionAdded` dashboard event so the browser updates live.
+    if let Some(target_agent) = target {
+        coord.notify_agent(
+            target_agent,
+            &hive_sh4re::HelperEvent::QuestionAsked {
+                id,
+                asker: asker.to_owned(),
+                question: question.to_owned(),
+                options: options.to_vec(),
+                multi,
+            },
+        );
+    }
+    // Always fire on the dashboard channel — both operator-targeted
+    // and peer threads now surface in the dashboard's questions pane.
+    coord.emit_question_added(id, asker, question, options, multi, deadline_at, target);
+    if let Some(t) = ttl {
+        spawn_question_watchdog(coord, id, t);
+    }
+    Ok(id)
+}
+
+/// Handle either surface's `Answer` request. Returns `Ok(())` on
+/// success or a caller-ready error string. Authorisation lives in
+/// `OperatorQuestions::answer` — we only have to wire the result
+/// back to the asker as a `QuestionAnswered` event.
+pub fn handle_answer(
+    coord: &Arc<Coordinator>,
+    answerer: &str,
+    id: i64,
+    answer: &str,
+) -> Result<(), String> {
+    limits::check_size("answer", answer)?;
+    let (question, asker, target) = coord
+        .questions
+        .answer(id, answer, answerer)
+        .map_err(|e| format!("{e:#}"))?;
+    tracing::info!(%id, %answerer, %asker, "question answered");
+    // Use answerer as the broker `from` so the asker's terminal shows
+    // the real name (agent or "operator") instead of "system".
+    coord.notify_agent_from(
+        answerer,
+        &asker,
+        &hive_sh4re::HelperEvent::QuestionAnswered {
+            id,
+            question,
+            answer: answer.to_owned(),
+            answerer: answerer.to_owned(),
+        },
+    );
+    // Dashboard surfaces both operator-targeted and peer threads;
+    // emit unconditionally so the derived store moves the row.
+    // `cancelled = false` because this path is a real answer (the
+    // operator-cancel button goes through `post_cancel_question`).
+    coord.emit_question_resolved(id, answer, answerer, false, target.as_deref());
+    Ok(())
+}
+
+/// Handle `CancelLooseEnd` from either surface. Dispatches by kind to
+/// either `OperatorQuestions::cancel` or `Broker::cancel_reminder_as`,
+/// both of which do their own auth check (canceller == owner /
+/// asker, or `operator`, or `manager`). On question cancel, fires
+/// the `QuestionAnswered` event back to the asker so the harness
+/// loop can react (mirrors the operator-cancel dashboard path).
+pub fn handle_cancel_loose_end(
+    coord: &Arc<Coordinator>,
+    canceller: &str,
+    kind: hive_sh4re::CancelLooseEndKind,
+    id: i64,
+) -> Result<(), String> {
+    match kind {
+        hive_sh4re::CancelLooseEndKind::Question => {
+            let (question, asker, target) = coord
+                .questions
+                .cancel(id, canceller)
+                .map_err(|e| format!("{e:#}"))?;
+            let sentinel = format!("[cancelled by {canceller}]");
+            tracing::info!(%id, %canceller, %asker, "question cancelled");
+            // Only notify the asker if they didn't cancel it themselves.
+            // Self-cancels are already known to the canceller — sending
+            // a QuestionAnswered back would cause the harness to process
+            // its own cancel as an incoming answer.
+            if asker != canceller {
+                coord.notify_agent_from(
+                    canceller,
+                    &asker,
+                    &hive_sh4re::HelperEvent::QuestionAnswered {
+                        id,
+                        question,
+                        answer: sentinel.clone(),
+                        answerer: canceller.to_owned(),
+                    },
+                );
+            }
+            coord.emit_question_resolved(id, &sentinel, canceller, true, target.as_deref());
+            Ok(())
+        }
+        hive_sh4re::CancelLooseEndKind::Reminder => {
+            let owner = coord
+                .broker
+                .cancel_reminder_as(id, canceller)
+                .map_err(|e| format!("{e:#}"))?;
+            tracing::info!(%id, %canceller, %owner, "reminder cancelled");
+            Ok(())
+        }
+        hive_sh4re::CancelLooseEndKind::Approval => {
+            // Manager-only: only the agent that can submit approvals
+            // is allowed to withdraw them. Sub-agents would have no
+            // pending approvals of their own to cancel anyway.
+            check_approval_canceller_is_manager(canceller)?;
+            let approval = coord
+                .approvals
+                .mark_cancelled(id, canceller)
+                .map_err(|e| format!("{e:#}"))?;
+            tracing::info!(%id, %canceller, agent = %approval.agent, "approval cancelled");
+            let sha_short = approval
+                .fetched_sha
+                .as_deref()
+                .map(|s| s[..s.len().min(12)].to_owned());
+            coord.emit_approval_resolved(
+                approval.id,
+                &approval.agent,
+                kind_to_str(approval.kind),
+                sha_short,
+                "cancelled",
+                approval.note,
+                approval.description,
+            );
+            Ok(())
+        }
+    }
+}
+
+/// Manager-only guard on the `Approval` cancel arm. Pulled out so
+/// the auth check has its own focused unit test (argus nit on #508)
+/// — testing the full `handle_cancel_loose_end` flow would need a
+/// `Coordinator` fixture (broker + sqlite + in-memory questions),
+/// which we don't have today. The check is a single string compare,
+/// so a function-level test gives the same coverage with no harness.
+fn check_approval_canceller_is_manager(canceller: &str) -> Result<(), String> {
+    if canceller != hive_sh4re::MANAGER_AGENT {
+        return Err("cancel_loose_end: only the manager can cancel approval rows".to_owned());
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn approval_cancel_rejects_sub_agent_callers() {
+        // Argus nit on #508: sub-agents must not be able to cancel
+        // approval rows even if they invent an id. The guard is
+        // server-side so client cooperation is irrelevant.
+        let err = check_approval_canceller_is_manager("bitburner").unwrap_err();
+        assert!(err.contains("only the manager"), "{err}");
+        // Bonus: empty / operator strings also rejected (only the
+        // exact MANAGER_AGENT constant passes).
+        assert!(check_approval_canceller_is_manager("").is_err());
+        assert!(
+            check_approval_canceller_is_manager(hive_sh4re::OPERATOR_RECIPIENT)
+                .is_err(),
+            "operator surface uses the dashboard cancel path, not this dispatcher",
+        );
+    }
+
+    #[test]
+    fn approval_cancel_allows_manager() {
+        check_approval_canceller_is_manager(hive_sh4re::MANAGER_AGENT)
+            .expect("MANAGER_AGENT must pass the guard");
+    }
+}
+
+// Real coverage needs a `Coordinator` fixture (broker + sqlite +
+// in-memory questions). Skipped for now — the normalisation branches
+// in `handle_ask` are short enough to read line-by-line; once we add
+// a coord test harness, drop integration tests here for: self-target
+// rejection, operator-string passthrough, agent-to-agent QuestionAsked
+// emission, and `Answer` authorisation.
diff --git a/hive-c0re/src/rebuild_queue.rs b/hive-c0re/src/rebuild_queue.rs
new file mode 100644
index 00000000..35a35f72
--- /dev/null
+++ b/hive-c0re/src/rebuild_queue.rs
@@ -0,0 +1,1164 @@
+//! Global rebuild queue.
+//!
+//! Every long-running container/meta operation (rebuild, meta-update,
+//! first-spawn) goes through this queue. A single background worker
+//! drains it in FIFO order so we never overlap two `nixos-container
+//! update` runs on the same agent and never start a fresh agent rebuild
+//! while a meta-update's lock bump is mid-flight.
+//!
+//! ## Why one queue
+//!
+//! Before this module landed, four independent call paths could fire
+//! `auto_update::rebuild_agent` concurrently:
+//! - dashboard manual rebuild button
+//! - `update-all` / `meta-update` cascade
+//! - approval handler (apply-commit / spawn)
+//! - startup auto-update sweep
+//!
+//! Nothing serialised them. nix-daemon serialises the actual store
+//! ops, but the rest of `rebuild_agent` (token sync, kick, rescan,
+//! lock-bump emit) interleaved unpredictably. The single-worker queue
+//! gives operators a visible, ordered runway and lets the UI render
+//! "what's about to happen" instead of "something might be happening
+//! somewhere."
+//!
+//! ## Scope
+//!
+//! In-queue kinds:
+//! - `Rebuild` — a single-agent rebuild (covers manual / approval-driven /
+//!   auto-update / meta-update cascade variants — they all funnel here).
+//! - `MetaUpdate` — `nix flake update` on the meta flake. The worker
+//!   runs the lock bump itself, then enqueues a cascade of `Rebuild`
+//!   entries with `parent_id` set to the meta-update's id.
+//! - `Spawn` — first-deploy of an agent (approval-driven). Same
+//!   serialisation as `Rebuild` from the operator's POV.
+//! - `Destroy` — for future use (`destroy --purge` does real I/O); not
+//!   currently routed through the queue.
+//!
+//! Out of scope (intentionally not queued — these are sub-second ops
+//! and adding them adds visual noise without serving the "one at a
+//! time" goal):
+//! - `start` / `stop` / `restart`
+//! - `kill`
+//!
+//! ## Dedup
+//!
+//! Enqueueing `(kind, agent)` that already has a `Queued` entry returns
+//! the existing entry's id and appends the new reason as an
+//! "also requested by …" line. Running entries do not dedup — a
+//! re-queue during a run is legitimate (something changed since the
+//! current run started).
+
+use std::collections::VecDeque;
+use std::sync::Mutex;
+
+use serde::Serialize;
+use tokio::sync::Notify;
+
+/// What the queue can run. Each variant maps to a specific worker
+/// execution path; `agent` (in `QueueEntry`) names the target where
+/// relevant.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum QueueKind {
+    /// Rebuild a single agent's container (`auto_update::rebuild_agent`).
+    Rebuild,
+    /// Run `nix flake update` on the meta flake. Triggers cascade
+    /// `Rebuild` entries (with `parent_id`) once the lock bump lands.
+    MetaUpdate,
+    /// First-deploy spawn of a new agent (approval-driven).
+    Spawn,
+    /// Destroy with `--purge` (real fs work). Not yet routed here; the
+    /// variant exists so the wire shape doesn't need to change later.
+    Destroy,
+}
+
+impl QueueKind {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            QueueKind::Rebuild => "rebuild",
+            QueueKind::MetaUpdate => "meta_update",
+            QueueKind::Spawn => "spawn",
+            QueueKind::Destroy => "destroy",
+        }
+    }
+}
+
+/// Where the enqueue request originated. Drives the "why" chip on the
+/// dashboard and lets the UI group cascade entries under their parent
+/// without parsing the reason text.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum QueueSource {
+    /// Operator clicked rebuild / update-all / meta-update on the
+    /// dashboard, or any other direct human action (CLI, manager tool).
+    Manual,
+    /// Spawned as a cascade from a `MetaUpdate` entry's lock-bump
+    /// fan-out. The `parent_id` on the `QueueEntry` points back at
+    /// the originating meta-update.
+    MetaUpdate,
+    /// `auto_update::run` startup sweep — rebuild every container on
+    /// hive-c0re boot.
+    AutoUpdate,
+    /// Crash recovery path (future use — currently no auto-rebuild on
+    /// crash, but the variant exists for the imminent feature).
+    CrashRecover,
+    /// Operator approved a pending `Approval` row on the dashboard.
+    /// `QueueEntry.approval_id` points back at the source row so the
+    /// worker can fetch the kind-specific payload (commit_ref, inputs,
+    /// description) before dispatching.
+    Approval,
+}
+
+impl QueueSource {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            QueueSource::Manual => "manual",
+            QueueSource::MetaUpdate => "meta_update",
+            QueueSource::AutoUpdate => "auto_update",
+            QueueSource::CrashRecover => "crash_recover",
+            QueueSource::Approval => "approval",
+        }
+    }
+}
+
+/// Lifecycle state of an entry. `Done` / `Failed` / `Cancelled` are
+/// retained in the queue snapshot for a short tail (`MAX_HISTORY_PER_KIND`)
+/// so the dashboard can show "last few" runs alongside live state.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum QueueState {
+    Queued,
+    Running,
+    Done,
+    Failed,
+    Cancelled,
+}
+
+impl QueueState {
+    pub fn is_terminal(self) -> bool {
+        matches!(self, QueueState::Done | QueueState::Failed | QueueState::Cancelled)
+    }
+}
+
+/// A single queue entry — what's pending, running, or recently finished.
+/// Serialised verbatim onto the dashboard event channel and the
+/// `/api/state` snapshot.
+#[derive(Debug, Clone, Serialize)]
+pub struct QueueEntry {
+    /// Monotonic per-process id. Stable for the lifetime of the entry
+    /// so SSE upserts land in place rather than churning the list.
+    pub id: u64,
+    /// Target agent name, or the literal `"hyperhive"` for entries
+    /// (MetaUpdate) that affect the meta flake rather than a single
+    /// agent.
+    pub agent: String,
+    pub kind: QueueKind,
+    pub state: QueueState,
+    pub source: QueueSource,
+    /// Groups cascade entries under their originating parent. For a
+    /// `MetaUpdate` entry this is `None`; for the per-agent rebuilds
+    /// the worker enqueues after the lock bump it's `Some(meta_id)`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub parent_id: Option<u64>,
+    /// Human-readable "why" — populated by the enqueuer (`"manual via
+    /// dashboard"`, `"meta-update cascade (hyperhive bumped)"`,
+    /// `"startup sweep"`). Free-form; dedup appends `(also requested
+    /// by …)` lines on repeated enqueues.
+    pub reason: String,
+    pub enqueued_at: i64,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub started_at: Option<i64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub finished_at: Option<i64>,
+    /// Populated when `state == Failed`. Carries the worker's error
+    /// string (already truncated to a reasonable length by the caller).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// `MetaUpdate`-only payload: the list of meta flake inputs to run
+    /// through `nix flake update`. Empty / absent on `Rebuild` /
+    /// `Spawn` / `Destroy` entries; absent on the wire (never
+    /// serialised) when the entry kind doesn't have meaningful inputs.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub inputs: Vec<String>,
+    /// Source approval row id when this entry was created by an
+    /// operator-approve POST (`source == Approval`). The worker uses
+    /// it to re-fetch the kind-specific payload (commit_ref / inputs /
+    /// description / fetched_sha) and to fire `ApprovalResolved` on
+    /// completion. `None` for non-approval entries — preserved on
+    /// the wire that way too.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub approval_id: Option<i64>,
+    /// Current sub-step inside the running entry (#437, option A from
+    /// the issue). Worker mutates this as the kind-specific pipeline
+    /// advances through phases (e.g. `"plant tags"` →
+    /// `"nixos-container update"` → `"finalize deploy"`). `None` while
+    /// `Queued` and after terminal — only meaningful with
+    /// `state == Running`. Each transition fires a fresh
+    /// `RebuildQueueChanged` snapshot so the dashboard can render
+    /// the label as a sub-line on the queue card. Free-form per
+    /// pipeline; the kind-specific worker is the source of truth.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub step: Option<String>,
+}
+
+/// How many terminal-state entries (`Done` / `Failed` / `Cancelled`)
+/// to retain per kind in the snapshot. Older entries get evicted to
+/// keep `/api/state` tight; the live event channel is unaffected.
+const MAX_HISTORY_PER_KIND: usize = 5;
+
+/// Inner state guarded by a single mutex. Held briefly — every
+/// operation is constant-time relative to the queue's depth, and
+/// the depths in practice are tiny (single-digit).
+#[derive(Debug, Default)]
+struct Inner {
+    entries: VecDeque<QueueEntry>,
+    next_id: u64,
+}
+
+/// Global rebuild queue. Lives on `Coordinator` (one per hive-c0re
+/// process). The associated `Notify` wakes the worker when something
+/// new arrives.
+#[derive(Debug)]
+pub struct RebuildQueue {
+    inner: Mutex<Inner>,
+    /// Worker wakes on this signal. The worker checks the queue and
+    /// loops back to `notified().await` when there's nothing to run.
+    pub(crate) notify: Notify,
+}
+
+impl Default for RebuildQueue {
+    fn default() -> Self {
+        Self {
+            inner: Mutex::new(Inner::default()),
+            notify: Notify::new(),
+        }
+    }
+}
+
+impl RebuildQueue {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Add an entry to the queue. Returns the entry's id (newly-allocated
+    /// or — on dedup — the existing entry's id with the new reason
+    /// appended).
+    ///
+    /// Dedup rule:
+    /// - `Rebuild` / `Spawn` / `Destroy`: a `Queued` entry with the same
+    ///   `(kind, agent)` swallows the new request.
+    /// - `MetaUpdate`: dedup ALSO requires the `inputs` field to match —
+    ///   two meta-updates with different input lists are distinct work
+    ///   and must queue separately (closes #365: previously the second
+    ///   meta-update collapsed into the first whenever it was still
+    ///   `Queued`, losing the second's input set).
+    ///
+    /// Running and terminal entries never dedup — operators are free
+    /// to re-queue a rebuild that's currently running (something
+    /// changed since it started) or re-run one that just finished.
+    pub fn enqueue(
+        &self,
+        kind: QueueKind,
+        agent: String,
+        source: QueueSource,
+        reason: String,
+        parent_id: Option<u64>,
+    ) -> u64 {
+        self.enqueue_full(kind, agent, source, reason, parent_id, Vec::new(), None)
+    }
+
+    /// Same as `enqueue` but carries an `inputs` payload — used by
+    /// `MetaUpdate` enqueues to tell the worker which meta-flake
+    /// inputs to bump. For `MetaUpdate` the `inputs` value is part of
+    /// the dedup key (two meta-updates with different inputs are
+    /// distinct operations, see #365).
+    pub fn enqueue_with_inputs(
+        &self,
+        kind: QueueKind,
+        agent: String,
+        source: QueueSource,
+        reason: String,
+        parent_id: Option<u64>,
+        inputs: Vec<String>,
+    ) -> u64 {
+        self.enqueue_full(kind, agent, source, reason, parent_id, inputs, None)
+    }
+
+    /// Full-shape enqueue — every `QueueEntry` field that's settable
+    /// at submit time. Existing `enqueue` / `enqueue_with_inputs`
+    /// delegate to this with `approval_id: None`; the approval-driven
+    /// POST handlers (#436) call it directly with the source row's id
+    /// so the worker can re-fetch the kind-specific payload.
+    // 8/7 args: the queue entry has 6 independent submit-time fields plus
+    // the inputs/approval_id pair specific to MetaUpdate and approval
+    // entries. A builder struct would obscure the call sites; the
+    // shorter `enqueue` / `enqueue_with_inputs` wrappers already cover
+    // the common cases.
+    #[allow(clippy::too_many_arguments)]
+    pub fn enqueue_full(
+        &self,
+        kind: QueueKind,
+        agent: String,
+        source: QueueSource,
+        reason: String,
+        parent_id: Option<u64>,
+        inputs: Vec<String>,
+        approval_id: Option<i64>,
+    ) -> u64 {
+        let mut inner = self.inner.lock().expect("rebuild_queue mutex poisoned");
+        // Dedup against a pending entry with the same (kind, agent) —
+        // and, for MetaUpdate, the same `inputs` list (see method
+        // docstring + #365 for why). Approval-driven entries also
+        // require the approval_id to match so two distinct approvals
+        // for the same agent never collapse into one queue slot.
+        for entry in inner.entries.iter_mut() {
+            if entry.state == QueueState::Queued
+                && entry.kind == kind
+                && entry.agent == agent
+                && (kind != QueueKind::MetaUpdate || entry.inputs == inputs)
+                && entry.approval_id == approval_id
+            {
+                if !entry.reason.contains(&reason) {
+                    entry.reason.push_str(&format!("\nalso requested by: {reason}"));
+                }
+                return entry.id;
+            }
+        }
+        inner.next_id += 1;
+        let id = inner.next_id;
+        let entry = QueueEntry {
+            id,
+            agent,
+            kind,
+            state: QueueState::Queued,
+            source,
+            parent_id,
+            reason,
+            enqueued_at: now_unix(),
+            started_at: None,
+            finished_at: None,
+            error: None,
+            inputs,
+            approval_id,
+            step: None,
+        };
+        inner.entries.push_back(entry);
+        // Wake the worker. `notify_one` is a no-op when there's no
+        // waiter; the next `notified().await` returns immediately.
+        self.notify.notify_one();
+        id
+    }
+
+    /// Pop the next `Queued` entry and mark it `Running`. Returns the
+    /// entry (a clone — the original stays in the queue so live state
+    /// reflects "this is currently running"). Returns `None` when there's
+    /// nothing queued.
+    pub fn take_next(&self) -> Option<QueueEntry> {
+        let mut inner = self.inner.lock().expect("rebuild_queue mutex poisoned");
+        let pos = inner
+            .entries
+            .iter()
+            .position(|e| e.state == QueueState::Queued)?;
+        let entry = &mut inner.entries[pos];
+        entry.state = QueueState::Running;
+        entry.started_at = Some(now_unix());
+        Some(entry.clone())
+    }
+
+    /// Mark an entry terminal. `error` is populated for `Failed`;
+    /// `Done` / `Cancelled` ignore it. Trims the history tail.
+    /// Clears `step` — the field is only meaningful while `Running`,
+    /// and leaving a stale "in flight" label after a terminal
+    /// transition would mislead the dashboard render.
+    pub fn finish(&self, id: u64, state: QueueState, error: Option<String>) {
+        debug_assert!(state.is_terminal(), "finish() called with non-terminal {state:?}");
+        let mut inner = self.inner.lock().expect("rebuild_queue mutex poisoned");
+        if let Some(entry) = inner.entries.iter_mut().find(|e| e.id == id) {
+            entry.state = state;
+            entry.finished_at = Some(now_unix());
+            entry.error = error.filter(|_| state == QueueState::Failed);
+            entry.step = None;
+        }
+        Self::trim_history(&mut inner);
+    }
+
+    /// Set the current sub-step label on a `Running` entry (#437).
+    /// Returns `true` when the row was found AND the label changed
+    /// (caller should emit a `RebuildQueueChanged` snapshot only on
+    /// `true` to avoid noisy duplicate frames). No-op for entries not
+    /// in `Running` — the field is conceptually undefined outside
+    /// that state.
+    pub fn set_step(&self, id: u64, step: impl Into<String>) -> bool {
+        let new_step = step.into();
+        let mut inner = self.inner.lock().expect("rebuild_queue mutex poisoned");
+        let Some(entry) = inner.entries.iter_mut().find(|e| e.id == id) else {
+            return false;
+        };
+        if entry.state != QueueState::Running {
+            return false;
+        }
+        if entry.step.as_deref() == Some(new_step.as_str()) {
+            return false;
+        }
+        entry.step = Some(new_step);
+        true
+    }
+
+    /// Snapshot the queue for `/api/state` and `RebuildQueueChanged`.
+    /// Cheap clone — entries are small (~hundreds of bytes each).
+    pub fn snapshot(&self) -> Vec<QueueEntry> {
+        let inner = self.inner.lock().expect("rebuild_queue mutex poisoned");
+        inner.entries.iter().cloned().collect()
+    }
+
+    /// Cancel every `Queued` entry whose `parent_id` matches `parent`.
+    /// Used when a `MetaUpdate` parent fails its lock bump — the
+    /// cascade rebuilds the enqueuer pre-queued no longer apply
+    /// (nothing actually changed, so they'd be wasted work). Running
+    /// children are left alone — they were started under the parent's
+    /// assumption and can't be cleanly aborted from the queue side.
+    /// Returns the count of cancelled entries.
+    pub fn cancel_children(&self, parent: u64) -> usize {
+        let mut inner = self.inner.lock().expect("rebuild_queue mutex poisoned");
+        let mut count = 0;
+        for entry in inner.entries.iter_mut() {
+            if entry.parent_id == Some(parent) && entry.state == QueueState::Queued {
+                entry.state = QueueState::Cancelled;
+                entry.finished_at = Some(now_unix());
+                count += 1;
+            }
+        }
+        if count > 0 {
+            Self::trim_history(&mut inner);
+        }
+        count
+    }
+
+    /// Cancel a `Queued` entry (no-op for `Running` / terminal — the
+    /// in-flight rebuild owns the agent's nix store and can't be
+    /// safely interrupted). Returns true when an entry was cancelled.
+    pub fn cancel(&self, id: u64) -> bool {
+        let mut inner = self.inner.lock().expect("rebuild_queue mutex poisoned");
+        if let Some(entry) = inner.entries.iter_mut().find(|e| e.id == id) {
+            if entry.state == QueueState::Queued {
+                entry.state = QueueState::Cancelled;
+                entry.finished_at = Some(now_unix());
+                Self::trim_history(&mut inner);
+                return true;
+            }
+        }
+        false
+    }
+
+    /// Keep only the most recent `MAX_HISTORY_PER_KIND` terminal entries
+    /// per kind. Pending + running entries are never evicted.
+    fn trim_history(inner: &mut Inner) {
+        let mut counts: std::collections::HashMap<QueueKind, usize> =
+            std::collections::HashMap::new();
+        // Walk newest-first; keep the first MAX_HISTORY_PER_KIND
+        // terminals per kind, evict the rest.
+        let entries: Vec<QueueEntry> = inner
+            .entries
+            .iter()
+            .rev()
+            .filter(|e| {
+                if !e.state.is_terminal() {
+                    return true;
+                }
+                let n = counts.entry(e.kind).or_insert(0);
+                *n += 1;
+                *n <= MAX_HISTORY_PER_KIND
+            })
+            .cloned()
+            .collect();
+        inner.entries = entries.into_iter().rev().collect();
+    }
+}
+
+/// Background worker that drains the queue. Spawned once at hive-c0re
+/// startup from `main.rs`. Loops forever:
+/// 1. Pop the next `Queued` entry (`take_next` marks it `Running` and
+///    fires a `RebuildQueueChanged` snapshot via the caller).
+/// 2. Dispatch by kind — single-agent rebuild, meta-update + cascade,
+///    or first-spawn.
+/// 3. Mark the entry terminal (`finish`) and emit another snapshot.
+/// 4. When the queue is empty, `await` on `notify` until something
+///    new lands.
+///
+/// Shutdown semantics: subscribes to `coord.shutdown_rx()`. On a true
+/// signal the worker exits after its current entry finishes; pending
+/// `Queued` entries are dropped (they'll either be replayed by the
+/// startup sweep on next boot or left for an operator to re-queue).
+pub async fn run_worker(coord: std::sync::Arc<crate::coordinator::Coordinator>) {
+    let mut shutdown = coord.shutdown_rx();
+    loop {
+        // Drain everything available now.
+        while let Some(entry) = coord.rebuild_queue.take_next() {
+            coord.emit_rebuild_queue_snapshot();
+            tracing::info!(
+                id = entry.id,
+                kind = entry.kind.as_str(),
+                agent = %entry.agent,
+                source = entry.source.as_str(),
+                "rebuild_queue: running"
+            );
+            let result = dispatch(&coord, &entry).await;
+            match result {
+                Ok(()) => {
+                    coord.rebuild_queue.finish(entry.id, QueueState::Done, None);
+                    tracing::info!(id = entry.id, "rebuild_queue: done");
+                }
+                Err(e) => {
+                    let msg = format!("{e:#}");
+                    let truncated = if msg.len() > 2_000 {
+                        format!("{}…", &msg[..2_000])
+                    } else {
+                        msg.clone()
+                    };
+                    coord
+                        .rebuild_queue
+                        .finish(entry.id, QueueState::Failed, Some(truncated));
+                    tracing::warn!(id = entry.id, error = %msg, "rebuild_queue: failed");
+                }
+            }
+            coord.emit_rebuild_queue_snapshot();
+        }
+        // Park until something new is enqueued OR shutdown fires.
+        tokio::select! {
+            biased;
+            res = shutdown.changed() => {
+                if res.is_err() || *shutdown.borrow() {
+                    tracing::info!("rebuild_queue: worker exiting on shutdown");
+                    return;
+                }
+            }
+            _ = coord.rebuild_queue.notify.notified() => {
+                // New entry — back to the drain loop.
+            }
+        }
+    }
+}
+
+/// Run a single queue entry to completion. Kind-dispatched; failures
+/// bubble up to the worker which marks the entry `Failed`.
+///
+/// Approval-driven entries (`approval_id.is_some()`) route through
+/// `actions::run_approval_*` which carry the kind-specific commit
+/// pipeline + the `ApprovalResolved` event fan-out. Non-approval
+/// entries hit the original auto/manual rebuild paths.
+async fn dispatch(
+    coord: &std::sync::Arc<crate::coordinator::Coordinator>,
+    entry: &QueueEntry,
+) -> anyhow::Result<()> {
+    match (entry.kind, entry.approval_id) {
+        (QueueKind::Rebuild, Some(approval_id)) => {
+            crate::actions::run_approval_apply_commit(coord, Some(entry.id), approval_id).await
+        }
+        (QueueKind::Rebuild, None) => {
+            let current_rev = crate::auto_update::current_flake_rev(&coord.hyperhive_flake)
+                .unwrap_or_default();
+            crate::auto_update::rebuild_agent(coord, &entry.agent, &current_rev, Some(entry.id)).await
+        }
+        (QueueKind::MetaUpdate, Some(approval_id)) => {
+            crate::actions::run_approval_update_meta_inputs(coord, Some(entry.id), approval_id).await
+        }
+        (QueueKind::MetaUpdate, None) => run_meta_update(coord, entry).await,
+        (QueueKind::Spawn, Some(approval_id)) => {
+            crate::actions::run_approval_spawn(coord, Some(entry.id), approval_id).await
+        }
+        (QueueKind::Spawn, None) => {
+            // Unreachable today: every Spawn entry is born from an
+            // approval (HostRequest::RequestSpawn → submit_kind →
+            // approve → enqueue with approval_id). The manager-side
+            // `RequestSpawn` surface that used to bypass approvals
+            // was removed in #442; if a future direct-spawn admin
+            // path needs to skip the approval ride it should wire
+            // its own action call rather than route through here.
+            anyhow::bail!(
+                "rebuild_queue: Spawn entry id={} agent={} arrived without an approval_id — \
+                 nothing should enqueue this shape today",
+                entry.id,
+                entry.agent,
+            )
+        }
+        (QueueKind::Destroy, _) => {
+            // Reserved for future `destroy --purge` integration.
+            anyhow::bail!("Destroy kind not yet implemented in rebuild_queue worker");
+        }
+    }
+}
+
+/// Run one `MetaUpdate` entry: bump the meta flake's locks for the
+/// requested inputs, then enqueue a cascade of `Rebuild` entries
+/// (with `parent_id` set to this entry's id) for every agent affected
+/// by the bump. Mirrors the previous `dashboard::run_meta_update`
+/// semantics; that path now enqueues into this queue rather than
+/// running the bump + rebuild loop inline.
+async fn run_meta_update(
+    coord: &std::sync::Arc<crate::coordinator::Coordinator>,
+    entry: &QueueEntry,
+) -> anyhow::Result<()> {
+    let _progress = coord.meta_update_guard();
+    let inputs = entry.inputs.clone();
+    tracing::info!(?inputs, parent = entry.id, "rebuild_queue: meta-update starting");
+    coord.set_queue_step(Some(entry.id), "nix flake update");
+    let result = if inputs.is_empty() {
+        crate::meta::lock_update(&[]).await
+    } else {
+        crate::meta::lock_update(&inputs).await
+    };
+    if let Err(e) = result {
+        // Lock bump failed — cancel any pending cascade rebuilds the
+        // enqueuer pre-queued for this MetaUpdate. Their parent_id
+        // matches this entry; the children no longer make sense (we
+        // never bumped the lock that justified them).
+        let cancelled = coord.rebuild_queue.cancel_children(entry.id);
+        if cancelled > 0 {
+            tracing::warn!(
+                cancelled,
+                parent = entry.id,
+                "rebuild_queue: meta-update failed; cancelled cascade rebuilds"
+            );
+            coord.emit_rebuild_queue_snapshot();
+        }
+        return Err(e);
+    }
+    // Lock file changed — meta-inputs panel re-renders. The cascade
+    // rebuilds were already enqueued at MetaUpdate submission time,
+    // so no further enqueue is needed here.
+    crate::dashboard::emit_meta_inputs_snapshot(coord.as_ref());
+    Ok(())
+}
+
+/// Compute which agents a `nix flake update <inputs>` on the meta
+/// flake would affect. Used by callers that pre-enqueue cascade
+/// `Rebuild` entries at MetaUpdate submission time (issue #347) so the
+/// dashboard can render the dependent work alongside its parent before
+/// the lock bump actually runs.
+///
+/// Mirrors `run_meta_update`'s post-bump fan-out logic. Empty `inputs`
+/// or any input under `hyperhive` → every container; otherwise just
+/// the agents named by `agent-<name>` inputs.
+pub async fn meta_update_cascade_agents(inputs: &[String]) -> Vec<String> {
+    let touched_hyperhive = inputs
+        .iter()
+        .any(|i| i == "hyperhive" || i.starts_with("hyperhive/"));
+    let touched_agents: Vec<String> = inputs
+        .iter()
+        .filter_map(|i| i.strip_prefix("agent-"))
+        .map(|rest| rest.split('/').next().unwrap_or(rest).to_owned())
+        .collect();
+    if touched_hyperhive || inputs.is_empty() {
+        crate::lifecycle::list()
+            .await
+            .unwrap_or_default()
+            .into_iter()
+            .filter_map(|c| {
+                if c == crate::lifecycle::MANAGER_NAME {
+                    Some(crate::lifecycle::MANAGER_NAME.to_owned())
+                } else {
+                    c.strip_prefix(crate::lifecycle::AGENT_PREFIX).map(str::to_owned)
+                }
+            })
+            .collect()
+    } else {
+        touched_agents
+    }
+}
+
+/// Current unix timestamp in seconds. `now()` calls are pulled into a
+/// helper so tests can swap them out later.
+fn now_unix() -> i64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .ok()
+        .and_then(|d| i64::try_from(d.as_secs()).ok())
+        .unwrap_or(0)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn enqueue_and_take_in_order() {
+        let q = RebuildQueue::new();
+        let a = q.enqueue(
+            QueueKind::Rebuild,
+            "agent-a".to_owned(),
+            QueueSource::Manual,
+            "first".to_owned(),
+            None,
+        );
+        let b = q.enqueue(
+            QueueKind::Rebuild,
+            "agent-b".to_owned(),
+            QueueSource::Manual,
+            "second".to_owned(),
+            None,
+        );
+        assert_ne!(a, b);
+        let next = q.take_next().expect("queued");
+        assert_eq!(next.id, a);
+        assert_eq!(next.state, QueueState::Running);
+        let next = q.take_next().expect("queued");
+        assert_eq!(next.id, b);
+        assert!(q.take_next().is_none());
+    }
+
+    #[test]
+    fn dedup_pending_same_kind_and_agent() {
+        let q = RebuildQueue::new();
+        let a = q.enqueue(
+            QueueKind::Rebuild,
+            "agent-a".to_owned(),
+            QueueSource::Manual,
+            "first".to_owned(),
+            None,
+        );
+        let b = q.enqueue(
+            QueueKind::Rebuild,
+            "agent-a".to_owned(),
+            QueueSource::AutoUpdate,
+            "auto sweep".to_owned(),
+            None,
+        );
+        assert_eq!(a, b, "dedup should return existing id");
+        let snap = q.snapshot();
+        assert_eq!(snap.len(), 1);
+        assert!(snap[0].reason.contains("first"));
+        assert!(snap[0].reason.contains("auto sweep"));
+    }
+
+    #[test]
+    fn meta_update_dedup_matches_inputs() {
+        // Two MetaUpdate enqueues with identical inputs → dedup (#365).
+        let q = RebuildQueue::new();
+        let a = q.enqueue_with_inputs(
+            QueueKind::MetaUpdate,
+            "hyperhive".to_owned(),
+            QueueSource::Manual,
+            "first".to_owned(),
+            None,
+            vec!["nixpkgs".to_owned()],
+        );
+        let b = q.enqueue_with_inputs(
+            QueueKind::MetaUpdate,
+            "hyperhive".to_owned(),
+            QueueSource::Manual,
+            "duplicate click".to_owned(),
+            None,
+            vec!["nixpkgs".to_owned()],
+        );
+        assert_eq!(a, b, "identical-inputs meta-updates should dedup");
+        assert_eq!(q.snapshot().len(), 1);
+    }
+
+    #[test]
+    fn meta_update_dedup_separates_distinct_inputs() {
+        // Two MetaUpdate enqueues with DIFFERENT inputs → distinct
+        // entries, not deduped (the actual #365 bug).
+        let q = RebuildQueue::new();
+        let a = q.enqueue_with_inputs(
+            QueueKind::MetaUpdate,
+            "hyperhive".to_owned(),
+            QueueSource::Manual,
+            "bump nixpkgs".to_owned(),
+            None,
+            vec!["nixpkgs".to_owned()],
+        );
+        let b = q.enqueue_with_inputs(
+            QueueKind::MetaUpdate,
+            "hyperhive".to_owned(),
+            QueueSource::Manual,
+            "bump bitburner-agent".to_owned(),
+            None,
+            vec!["agent-bitburner/bitburner-agent".to_owned()],
+        );
+        assert_ne!(a, b, "different-inputs meta-updates must NOT dedup");
+        let snap = q.snapshot();
+        assert_eq!(snap.len(), 2);
+        // Both inputs lists are preserved.
+        let inputs: Vec<&[String]> = snap.iter().map(|e| e.inputs.as_slice()).collect();
+        assert!(inputs.iter().any(|i| *i == ["nixpkgs"]));
+        assert!(inputs
+            .iter()
+            .any(|i| *i == ["agent-bitburner/bitburner-agent"]));
+    }
+
+    #[test]
+    fn dedup_does_not_apply_across_kinds_or_agents() {
+        let q = RebuildQueue::new();
+        let a = q.enqueue(
+            QueueKind::Rebuild,
+            "agent-a".to_owned(),
+            QueueSource::Manual,
+            "r".to_owned(),
+            None,
+        );
+        let b = q.enqueue(
+            QueueKind::Rebuild,
+            "agent-b".to_owned(),
+            QueueSource::Manual,
+            "r".to_owned(),
+            None,
+        );
+        let c = q.enqueue(
+            QueueKind::Spawn,
+            "agent-a".to_owned(),
+            QueueSource::Manual,
+            "s".to_owned(),
+            None,
+        );
+        assert_ne!(a, b);
+        assert_ne!(a, c);
+        assert_eq!(q.snapshot().len(), 3);
+    }
+
+    #[test]
+    fn dedup_skips_running_entries() {
+        let q = RebuildQueue::new();
+        q.enqueue(
+            QueueKind::Rebuild,
+            "agent-a".to_owned(),
+            QueueSource::Manual,
+            "first".to_owned(),
+            None,
+        );
+        let running = q.take_next().expect("queued");
+        assert_eq!(running.state, QueueState::Running);
+        // While the original is running, re-enqueue is legitimate.
+        let again = q.enqueue(
+            QueueKind::Rebuild,
+            "agent-a".to_owned(),
+            QueueSource::Manual,
+            "config bumped during build".to_owned(),
+            None,
+        );
+        assert_ne!(running.id, again);
+        let snap = q.snapshot();
+        assert_eq!(snap.len(), 2);
+    }
+
+    #[test]
+    fn finish_marks_state_and_keeps_history() {
+        let q = RebuildQueue::new();
+        let id = q.enqueue(
+            QueueKind::Rebuild,
+            "agent-a".to_owned(),
+            QueueSource::Manual,
+            "r".to_owned(),
+            None,
+        );
+        q.take_next();
+        q.finish(id, QueueState::Done, None);
+        let snap = q.snapshot();
+        assert_eq!(snap.len(), 1);
+        assert_eq!(snap[0].state, QueueState::Done);
+        assert!(snap[0].finished_at.is_some());
+        assert!(snap[0].error.is_none());
+    }
+
+    #[test]
+    fn finish_with_failure_records_error() {
+        let q = RebuildQueue::new();
+        let id = q.enqueue(
+            QueueKind::Rebuild,
+            "agent-a".to_owned(),
+            QueueSource::Manual,
+            "r".to_owned(),
+            None,
+        );
+        q.take_next();
+        q.finish(id, QueueState::Failed, Some("nix build failed".to_owned()));
+        let snap = q.snapshot();
+        assert_eq!(snap[0].state, QueueState::Failed);
+        assert_eq!(snap[0].error.as_deref(), Some("nix build failed"));
+    }
+
+    #[test]
+    fn history_evicts_old_terminals_per_kind() {
+        let q = RebuildQueue::new();
+        for i in 0..(MAX_HISTORY_PER_KIND + 3) {
+            let id = q.enqueue(
+                QueueKind::Rebuild,
+                format!("agent-{i}"),
+                QueueSource::Manual,
+                "r".to_owned(),
+                None,
+            );
+            q.take_next();
+            q.finish(id, QueueState::Done, None);
+        }
+        let snap = q.snapshot();
+        assert_eq!(snap.len(), MAX_HISTORY_PER_KIND);
+    }
+
+    #[test]
+    fn cancel_clears_queued_entry() {
+        let q = RebuildQueue::new();
+        let id = q.enqueue(
+            QueueKind::Rebuild,
+            "agent-a".to_owned(),
+            QueueSource::Manual,
+            "r".to_owned(),
+            None,
+        );
+        assert!(q.cancel(id));
+        let snap = q.snapshot();
+        assert_eq!(snap[0].state, QueueState::Cancelled);
+        assert!(q.take_next().is_none());
+    }
+
+    #[test]
+    fn cancel_refuses_running_entry() {
+        let q = RebuildQueue::new();
+        let id = q.enqueue(
+            QueueKind::Rebuild,
+            "agent-a".to_owned(),
+            QueueSource::Manual,
+            "r".to_owned(),
+            None,
+        );
+        q.take_next();
+        assert!(!q.cancel(id));
+        let snap = q.snapshot();
+        assert_eq!(snap[0].state, QueueState::Running);
+    }
+
+    #[test]
+    fn parent_id_groups_cascade() {
+        let q = RebuildQueue::new();
+        let meta = q.enqueue(
+            QueueKind::MetaUpdate,
+            "hyperhive".to_owned(),
+            QueueSource::Manual,
+            "lock bump".to_owned(),
+            None,
+        );
+        let child = q.enqueue(
+            QueueKind::Rebuild,
+            "agent-a".to_owned(),
+            QueueSource::MetaUpdate,
+            "cascade".to_owned(),
+            Some(meta),
+        );
+        let snap = q.snapshot();
+        let child_entry = snap.iter().find(|e| e.id == child).expect("child queued");
+        assert_eq!(child_entry.parent_id, Some(meta));
+    }
+
+    #[test]
+    fn cancel_children_marks_queued_descendants() {
+        let q = RebuildQueue::new();
+        let meta = q.enqueue(
+            QueueKind::MetaUpdate,
+            "hyperhive".to_owned(),
+            QueueSource::Manual,
+            "lock bump".to_owned(),
+            None,
+        );
+        let a = q.enqueue(
+            QueueKind::Rebuild,
+            "agent-a".to_owned(),
+            QueueSource::MetaUpdate,
+            "cascade".to_owned(),
+            Some(meta),
+        );
+        let b = q.enqueue(
+            QueueKind::Rebuild,
+            "agent-b".to_owned(),
+            QueueSource::MetaUpdate,
+            "cascade".to_owned(),
+            Some(meta),
+        );
+        // An unrelated queued entry must not be cancelled.
+        let c = q.enqueue(
+            QueueKind::Rebuild,
+            "agent-c".to_owned(),
+            QueueSource::Manual,
+            "operator queued".to_owned(),
+            None,
+        );
+        let cancelled = q.cancel_children(meta);
+        assert_eq!(cancelled, 2);
+        let snap = q.snapshot();
+        let find = |id: u64| snap.iter().find(|e| e.id == id).expect("present");
+        assert_eq!(find(a).state, QueueState::Cancelled);
+        assert_eq!(find(b).state, QueueState::Cancelled);
+        assert_eq!(find(c).state, QueueState::Queued);
+    }
+
+    #[test]
+    fn approval_entries_keep_approval_id() {
+        let q = RebuildQueue::new();
+        let id = q.enqueue_full(
+            QueueKind::Rebuild,
+            "agent-a".to_owned(),
+            QueueSource::Approval,
+            "approval #42 apply commit".to_owned(),
+            None,
+            Vec::new(),
+            Some(42),
+        );
+        let snap = q.snapshot();
+        let entry = snap.iter().find(|e| e.id == id).expect("entry present");
+        assert_eq!(entry.approval_id, Some(42));
+        assert_eq!(entry.source, QueueSource::Approval);
+    }
+
+    #[test]
+    fn approval_entries_dedup_only_on_matching_id() {
+        // Two pending approval-driven entries for the same agent but
+        // DIFFERENT approval ids must NOT collapse — each operator
+        // approve click is a separate piece of work even when the
+        // (kind, agent) pair matches.
+        let q = RebuildQueue::new();
+        let a = q.enqueue_full(
+            QueueKind::Rebuild,
+            "agent-a".to_owned(),
+            QueueSource::Approval,
+            "approval #1".to_owned(),
+            None,
+            Vec::new(),
+            Some(1),
+        );
+        let b = q.enqueue_full(
+            QueueKind::Rebuild,
+            "agent-a".to_owned(),
+            QueueSource::Approval,
+            "approval #2".to_owned(),
+            None,
+            Vec::new(),
+            Some(2),
+        );
+        assert_ne!(a, b);
+        assert_eq!(q.snapshot().len(), 2);
+        // Same approval_id submitted twice DOES dedup (rapid double-
+        // click on the dashboard's approve button is a single op).
+        let c = q.enqueue_full(
+            QueueKind::Rebuild,
+            "agent-a".to_owned(),
+            QueueSource::Approval,
+            "approval #1 (duplicate)".to_owned(),
+            None,
+            Vec::new(),
+            Some(1),
+        );
+        assert_eq!(a, c);
+        assert_eq!(q.snapshot().len(), 2);
+    }
+
+    #[test]
+    fn cancel_children_skips_running_and_terminal() {
+        let q = RebuildQueue::new();
+        let meta = q.enqueue(
+            QueueKind::MetaUpdate,
+            "hyperhive".to_owned(),
+            QueueSource::Manual,
+            "lock bump".to_owned(),
+            None,
+        );
+        // Running child — must NOT be cancelled.
+        let running = q.enqueue(
+            QueueKind::Rebuild,
+            "agent-a".to_owned(),
+            QueueSource::MetaUpdate,
+            "cascade".to_owned(),
+            Some(meta),
+        );
+        q.take_next(); // pops meta, marks it Running
+        q.take_next(); // pops `running`, marks it Running
+        // Terminal child — must NOT be re-cancelled (its state stays Done).
+        let done = q.enqueue(
+            QueueKind::Rebuild,
+            "agent-b".to_owned(),
+            QueueSource::MetaUpdate,
+            "cascade".to_owned(),
+            Some(meta),
+        );
+        q.take_next();
+        q.finish(done, QueueState::Done, None);
+        // Queued child that should be cancelled.
+        let queued = q.enqueue(
+            QueueKind::Rebuild,
+            "agent-c".to_owned(),
+            QueueSource::MetaUpdate,
+            "cascade".to_owned(),
+            Some(meta),
+        );
+        let n = q.cancel_children(meta);
+        assert_eq!(n, 1);
+        let snap = q.snapshot();
+        let find = |id: u64| snap.iter().find(|e| e.id == id).expect("present");
+        assert_eq!(find(running).state, QueueState::Running);
+        assert_eq!(find(done).state, QueueState::Done);
+        assert_eq!(find(queued).state, QueueState::Cancelled);
+    }
+
+    #[test]
+    fn set_step_updates_running_entry_and_signals_change() {
+        let q = RebuildQueue::new();
+        let id = q.enqueue(
+            QueueKind::Rebuild,
+            "a".to_owned(),
+            QueueSource::Manual,
+            "test".to_owned(),
+            None,
+        );
+        // Queued — set_step should refuse (returns false).
+        assert!(!q.set_step(id, "plant tags"));
+        // Promote to Running.
+        let entry = q.take_next().expect("queued entry");
+        assert_eq!(entry.id, id);
+        // First label transition — true.
+        assert!(q.set_step(id, "plant tags"));
+        assert_eq!(
+            q.snapshot()
+                .iter()
+                .find(|e| e.id == id)
+                .and_then(|e| e.step.as_deref()),
+            Some("plant tags")
+        );
+        // Same label again — false (caller can skip the snapshot emit).
+        assert!(!q.set_step(id, "plant tags"));
+        // Different label — true.
+        assert!(q.set_step(id, "nixos-container update"));
+        assert_eq!(
+            q.snapshot()
+                .iter()
+                .find(|e| e.id == id)
+                .and_then(|e| e.step.as_deref()),
+            Some("nixos-container update")
+        );
+    }
+
+    #[test]
+    fn set_step_no_op_on_unknown_id() {
+        let q = RebuildQueue::new();
+        assert!(!q.set_step(999, "anything"));
+    }
+
+    #[test]
+    fn finish_clears_step() {
+        let q = RebuildQueue::new();
+        let id = q.enqueue(
+            QueueKind::Rebuild,
+            "a".to_owned(),
+            QueueSource::Manual,
+            "test".to_owned(),
+            None,
+        );
+        q.take_next();
+        assert!(q.set_step(id, "running phase"));
+        q.finish(id, QueueState::Done, None);
+        assert_eq!(
+            q.snapshot()
+                .iter()
+                .find(|e| e.id == id)
+                .and_then(|e| e.step.as_deref()),
+            None
+        );
+    }
+}
diff --git a/hive-c0re/src/reminder_scheduler.rs b/hive-c0re/src/reminder_scheduler.rs
new file mode 100644
index 00000000..92d16e82
--- /dev/null
+++ b/hive-c0re/src/reminder_scheduler.rs
@@ -0,0 +1,304 @@
+//! Background loop that drains due reminders out of the broker and
+//! delivers them as inbox messages. Mirrors the `events_vacuum` /
+//! `crash_watch` shape — a single `spawn(coord)` entry point started
+//! from `main.rs`.
+//!
+//! File-path semantics: a reminder may carry a `file_path` (the
+//! agent-visible path inside its container). On delivery we:
+//!
+//! - Translate the container path (`/agents/<agent>/state/foo.md`) to
+//!   the host path (`/var/lib/hyperhive/agents/<agent>/state/foo.md`)
+//!   so hive-c0re can write to it from outside the container.
+//! - Reject anything that isn't under the agent's own state subtree,
+//!   contains `..` (path traversal), or has an empty relative tail.
+//!   Falling outside the allowed prefix means the file write is
+//!   skipped and the original message is delivered inline (with a
+//!   noted warning) — the reminder still fires, just without the
+//!   payload split.
+//! - Defend against symlink escape: after `create_dir_all`, the
+//!   parent dir is canonicalized and re-verified to live under the
+//!   agent's host state root. Then we open the final file with
+//!   `O_NOFOLLOW | O_CREAT | O_TRUNC` so an existing-symlink basename
+//!   can't redirect the write either. Without this an agent could
+//!   `ln -s /etc /agents/foo/state/escape` and bounce a write to an
+//!   arbitrary host path.
+//! - Write the reminder body to disk and deliver a short pointer
+//!   message in its place, so the agent's inbox/wake-prompt stays
+//!   small and the bulky payload can be read out of band.
+//!
+//! Atomicity of the inbox INSERT + `reminders.sent_at` UPDATE is handled
+//! inside `Broker::deliver_reminders_batch`; this module only computes the
+//! body strings before calling it.
+
+use std::io::Write;
+use std::os::unix::fs::OpenOptionsExt;
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use std::time::Duration;
+
+use crate::coordinator::Coordinator;
+
+/// Per-tick cap on reminders delivered. Anything over this stays due
+/// in the table and gets picked up on the next tick — keeps a
+/// 10k-deep backlog from flooding the broker (or hogging the broker
+/// mutex) in one shot. 100/tick × 5s tick = sustained throughput cap
+/// of ~20 reminders/sec; bump together if the loose-ends tracker
+/// starts firing higher rates.
+const REMINDER_BATCH_LIMIT: u64 = 100;
+
+/// Poll interval. Trade-off between latency on a freshly due reminder
+/// and CPU spent on empty sweeps; 5s matches the original inline
+/// scheduler.
+const POLL_INTERVAL: Duration = Duration::from_secs(5);
+
+pub fn spawn(coord: Arc<Coordinator>) {
+    let mut shutdown = coord.shutdown_rx();
+    tokio::spawn(async move {
+        loop {
+            tick(&coord);
+            tokio::select! {
+                () = tokio::time::sleep(POLL_INTERVAL) => {}
+                _ = shutdown.changed() => {
+                    tracing::info!("reminder scheduler: shutdown signal received");
+                    break;
+                }
+            }
+        }
+    });
+}
+
+fn tick(coord: &Arc<Coordinator>) {
+    let due = match coord.broker.get_due_reminders(REMINDER_BATCH_LIMIT) {
+        Ok(rows) => rows,
+        Err(e) => {
+            tracing::warn!(error = ?e, "failed to query due reminders");
+            return;
+        }
+    };
+    if due.is_empty() {
+        return;
+    }
+    // Resolve body strings (file-path writes / inline) before entering
+    // the batch transaction so the DB lock is held as briefly as possible.
+    let items: Vec<(i64, String, String)> = due
+        .iter()
+        .map(|(agent, id, message, file_path)| {
+            let body = prepare_body(agent, message, file_path.as_deref());
+            (*id, agent.clone(), body)
+        })
+        .collect();
+    // Single-transaction batch: one DB lock acquisition for N reminders
+    // instead of N sequential lock/unlock cycles.
+    let results = coord.broker.deliver_reminders_batch(&items);
+    for ((id, agent, _body), result) in items.iter().zip(results.iter()) {
+        if let Err(e) = result {
+            let reason = format!("{e:#}");
+            tracing::warn!(
+                reminder_id = id,
+                %agent,
+                error = %reason,
+                "failed to deliver reminder"
+            );
+            // Persist the failure so the dashboard can surface it.
+            if let Err(persist_err) = coord.broker.record_reminder_failure(*id, &reason) {
+                tracing::warn!(
+                    reminder_id = id,
+                    error = ?persist_err,
+                    "failed to persist reminder failure"
+                );
+            }
+        }
+    }
+}
+
+/// Build the inbox body for a due reminder. When `file_path` is None
+/// the body is the original message verbatim. When set, we attempt to
+/// persist the message body to the requested file and return a short
+/// pointer string instead. Failures (bad prefix, symlink escape,
+/// write error, missing parent) fall back to inline delivery with a
+/// noted warning so the reminder still fires.
+fn prepare_body(agent: &str, message: &str, file_path: Option<&str>) -> String {
+    let Some(req_path) = file_path else {
+        return message.to_owned();
+    };
+    let host_path = match resolve_host_path(agent, req_path) {
+        Ok(p) => p,
+        Err(reason) => {
+            tracing::warn!(%agent, %req_path, %reason, "reminder file_path rejected; delivering inline");
+            return inline_fallback(req_path, &format!("rejected: {reason}"), message);
+        }
+    };
+    match write_payload(agent, &host_path, message) {
+        Ok(()) => {
+            let bytes = message.len();
+            // debug! not info! — under load this would dominate the log.
+            tracing::debug!(%agent, path = %host_path.display(), bytes, "reminder body written to file");
+            format!(
+                "reminder body persisted to `{req_path}` ({bytes} bytes); read with your filesystem tools"
+            )
+        }
+        Err(reason) => {
+            tracing::warn!(%agent, path = %host_path.display(), %reason, "reminder file_path write failed; delivering inline");
+            inline_fallback(req_path, &reason, message)
+        }
+    }
+}
+
+fn inline_fallback(req_path: &str, reason: &str, message: &str) -> String {
+    format!("[reminder file_path '{req_path}' {reason}; delivering body inline]\n\n{message}")
+}
+
+/// Persist `message` to `host_path` with the symlink-escape defenses
+/// described in the module docs. Returns `Ok(())` on success, or a
+/// human-readable reason string on any failure (caller logs +
+/// inline-falls-back). `pub` because `agent_server::handle_remind`
+/// reuses it for the at-remind-time auto-file path.
+pub fn write_payload(agent: &str, host_path: &Path, message: &str) -> Result<(), String> {
+    let Some(parent) = host_path.parent() else {
+        return Err("internal: host path has no parent".to_owned());
+    };
+    std::fs::create_dir_all(parent)
+        .map_err(|e| format!("parent dir create failed: {e}"))?;
+    // Resolve symlinks in the parent chain, then re-verify the
+    // canonical form still lives under the agent's host state root —
+    // catches `ln -s /etc state/escape` style attacks.
+    let parent_canonical = parent
+        .canonicalize()
+        .map_err(|e| format!("parent canonicalize failed: {e}"))?;
+    let agent_root = Coordinator::agent_notes_dir(agent)
+        .canonicalize()
+        .map_err(|e| format!("agent state root canonicalize failed: {e}"))?;
+    if !parent_canonical.starts_with(&agent_root) {
+        return Err(format!(
+            "symlink escape: canonical parent `{}` outside agent root `{}`",
+            parent_canonical.display(),
+            agent_root.display()
+        ));
+    }
+    let basename = host_path
+        .file_name()
+        .ok_or_else(|| "missing basename".to_owned())?;
+    let target = parent_canonical.join(basename);
+    // O_NOFOLLOW on the final component refuses to open if the
+    // basename is itself an existing symlink. Combined with the
+    // canonicalize-parent check above, no symlink anywhere in the
+    // path can redirect the write.
+    let mut file = std::fs::OpenOptions::new()
+        .write(true)
+        .create(true)
+        .truncate(true)
+        .custom_flags(libc::O_NOFOLLOW)
+        .open(&target)
+        .map_err(|e| format!("open failed: {e}"))?;
+    file.write_all(message.as_bytes())
+        .map_err(|e| format!("write failed: {e}"))?;
+    Ok(())
+}
+
+/// Container-visible state prefix the caller's `file_path` must live
+/// under. Sub-agents see their state at `/agents/<name>/state/`;
+/// the manager keeps the legacy `/state/` mount (see
+/// `lifecycle::set_nspawn_flags`). Auto-file paths use the same
+/// prefix so the round-trip is symmetric.
+#[must_use]
+pub fn container_state_prefix(agent: &str) -> String {
+    if agent == hive_sh4re::MANAGER_AGENT {
+        "/state/".to_owned()
+    } else {
+        format!("/agents/{agent}/state/")
+    }
+}
+
+/// Map an agent-visible container path to the matching host path,
+/// validating that it lives under the agent's own state subtree, has
+/// a non-empty relative tail, and doesn't try to traverse out via
+/// `..`. Returns the host `PathBuf` on success, or a human-readable
+/// reason string on rejection. `pub` so `agent_server::handle_remind`
+/// can reuse it for the at-remind-time auto-file path.
+pub fn resolve_host_path(agent: &str, req_path: &str) -> Result<PathBuf, String> {
+    let prefix = container_state_prefix(agent);
+    let Some(rel) = req_path.strip_prefix(&prefix) else {
+        return Err(format!(
+            "must be absolute and under `{prefix}` (got `{req_path}`)"
+        ));
+    };
+    if rel.is_empty() {
+        return Err("file_path must include a filename, not just the state dir".to_owned());
+    }
+    let rel_path = Path::new(rel);
+    for comp in rel_path.components() {
+        match comp {
+            std::path::Component::Normal(_) => {}
+            other => {
+                return Err(format!(
+                    "path component `{other:?}` not allowed (no traversal / absolute / root)"
+                ));
+            }
+        }
+    }
+    Ok(Coordinator::agent_notes_dir(agent).join(rel_path))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn rejects_paths_outside_agent_state() {
+        assert!(resolve_host_path("foo", "/etc/passwd").is_err());
+        assert!(resolve_host_path("foo", "/agents/bar/state/x.md").is_err());
+        assert!(resolve_host_path("foo", "relative.md").is_err());
+    }
+
+    #[test]
+    fn rejects_traversal() {
+        assert!(resolve_host_path("foo", "/agents/foo/state/../../etc/passwd").is_err());
+        assert!(resolve_host_path("foo", "/agents/foo/state/./x.md").is_err());
+    }
+
+    #[test]
+    fn rejects_empty_relative_tail() {
+        // Trailing slash → empty tail. Used to fall through to
+        // create_dir_all + write-to-dir → confusing inline fallback;
+        // explicit reject gives a cleaner log.
+        let err = resolve_host_path("foo", "/agents/foo/state/").unwrap_err();
+        assert!(err.contains("must include a filename"), "got: {err}");
+    }
+
+    #[test]
+    fn accepts_well_formed_path() {
+        let p = resolve_host_path("foo", "/agents/foo/state/reminders/123.md").unwrap();
+        assert_eq!(
+            p,
+            PathBuf::from("/var/lib/hyperhive/agents/foo/state/reminders/123.md")
+        );
+    }
+
+    #[test]
+    fn manager_uses_legacy_state_prefix() {
+        // The manager container mounts its state at `/state/` (legacy),
+        // not `/agents/manager/state/`. Same host path; different
+        // container-visible path. resolve_host_path needs to know.
+        assert_eq!(container_state_prefix("manager"), "/state/");
+        let p = resolve_host_path("manager", "/state/reminders/x.md").unwrap();
+        assert_eq!(
+            p,
+            PathBuf::from("/var/lib/hyperhive/agents/manager/state/reminders/x.md")
+        );
+        // And the sub-agent prefix must NOT be accepted for the manager.
+        assert!(resolve_host_path("manager", "/agents/manager/state/x.md").is_err());
+    }
+
+    #[test]
+    fn prepare_body_passthrough_when_no_file_path() {
+        let s = prepare_body("foo", "hello world", None);
+        assert_eq!(s, "hello world");
+    }
+
+    #[test]
+    fn prepare_body_falls_back_inline_on_bad_path() {
+        let s = prepare_body("foo", "payload", Some("/etc/passwd"));
+        assert!(s.starts_with("[reminder file_path '/etc/passwd' rejected:"));
+        assert!(s.contains("payload"));
+    }
+}
diff --git a/hive-c0re/src/scheduled_prompts.rs b/hive-c0re/src/scheduled_prompts.rs
new file mode 100644
index 00000000..8b958452
--- /dev/null
+++ b/hive-c0re/src/scheduled_prompts.rs
@@ -0,0 +1,1072 @@
+//! Scheduled prompts (closes #444). Persistent sqlite queue of
+//! `(fire_at, targets, body)` rows that the worker fans out as
+//! broker `Message`s to each target's inbox at fire time. Recurring
+//! schedules carry `interval_seconds` and re-arm `next_fire_at` on
+//! delivery; one-shots are reaped.
+//!
+//! ## Three submit paths
+//!
+//! - **Operator-direct** (`source = Operator`): the operator adds
+//!   a schedule through the dashboard form. Lands in the table
+//!   immediately, no approval gate.
+//! - **Agent-requested** (`source = Approval { id }`): a sub-agent
+//!   (or the manager) submits a `RequestSchedulePrompt` through the
+//!   manager socket. An `ApprovalKind::SchedulePrompt` row is
+//!   queued; on approve, hive-c0re inserts the schedule row with
+//!   `source = Approval { id: approval_id }` so the audit trail
+//!   points back at the operator decision.
+//! - **No self-target shortcut**: even agent-self schedules need
+//!   approval. The existing `remind` MCP tool stays the quick
+//!   self-wake path; this module is the bigger, multi-recipient,
+//!   operator-visible thing.
+//!
+//! ## Catch-up clamp (missed-while-down)
+//!
+//! When hive-c0re comes back from being down, the worker sees rows
+//! whose `next_fire_at` is well in the past. For recurring rows
+//! that would mean firing N delayed pulses in a row — spammy and
+//! useless. Instead the worker fires ONCE per row and bumps
+//! `next_fire_at` to the next interval slot ≥ `now`, recording how
+//! many cycles were skipped in `last_result`. Operators see "fired
+//! late, caught up from 17 skipped" instead of 17 wake-up storms.
+//!
+//! ## Per-target state
+//!
+//! `targets` is its own table so partial cancellation flips a
+//! single row + so the dashboard can show last-fired / last-result
+//! per recipient. Cancelling every target reaps the parent row on
+//! the next worker pass.
+
+use std::path::Path;
+use std::sync::Mutex;
+
+use anyhow::{Context, Result, bail};
+use rusqlite::{Connection, OptionalExtension, params};
+use serde::{Deserialize, Serialize};
+
+const SCHEMA: &str = r"
+CREATE TABLE IF NOT EXISTS scheduled_prompts (
+    id                INTEGER PRIMARY KEY AUTOINCREMENT,
+    owner             TEXT    NOT NULL,
+    body              TEXT    NOT NULL,
+    interval_seconds  INTEGER,
+    next_fire_at_unix INTEGER NOT NULL,
+    created_at_unix   INTEGER NOT NULL,
+    source            TEXT    NOT NULL,
+    cancelled_at_unix INTEGER,
+    description       TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_scheduled_due
+    ON scheduled_prompts (next_fire_at_unix)
+    WHERE cancelled_at_unix IS NULL;
+
+CREATE TABLE IF NOT EXISTS scheduled_prompt_targets (
+    schedule_id        INTEGER NOT NULL,
+    target             TEXT    NOT NULL,
+    cancelled_at_unix  INTEGER,
+    last_fired_at_unix INTEGER,
+    last_result        TEXT,
+    PRIMARY KEY (schedule_id, target),
+    FOREIGN KEY (schedule_id) REFERENCES scheduled_prompts(id) ON DELETE CASCADE
+);
+";
+
+/// One scheduled-prompt row + its current target set. Returned by
+/// `list` / `get`; the per-target last-result blob is suitable for
+/// rendering on the dashboard without a second query.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Schedule {
+    pub id: i64,
+    /// `"operator"` or an agent name — drives cancel-permission
+    /// checks. For approval-sourced rows this is the requesting
+    /// agent (the `Approval.agent` at submit time).
+    pub owner: String,
+    pub body: String,
+    /// `None` = one-shot, deleted after first fire.
+    /// `Some(n)` = recurring every `n` seconds.
+    pub interval_seconds: Option<u64>,
+    pub next_fire_at_unix: i64,
+    pub created_at_unix: i64,
+    pub source: ScheduleSource,
+    /// Set when the *entire* schedule was cancelled (all targets
+    /// flipped, or operator cancel-all). Worker reaps these on the
+    /// next pass.
+    pub cancelled_at_unix: Option<i64>,
+    pub description: Option<String>,
+    pub targets: Vec<ScheduleTarget>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ScheduleTarget {
+    pub target: String,
+    pub cancelled_at_unix: Option<i64>,
+    pub last_fired_at_unix: Option<i64>,
+    pub last_result: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum ScheduleSource {
+    Operator,
+    Approval { id: i64 },
+}
+
+impl ScheduleSource {
+    fn to_db_string(&self) -> String {
+        match self {
+            ScheduleSource::Operator => "operator".to_owned(),
+            ScheduleSource::Approval { id } => format!("approval:{id}"),
+        }
+    }
+
+    fn from_db_string(s: &str) -> Self {
+        if let Some(rest) = s.strip_prefix("approval:")
+            && let Ok(id) = rest.parse::<i64>()
+        {
+            return ScheduleSource::Approval { id };
+        }
+        // Unknown / "operator" / corrupt → operator (best the row
+        // can do without an unparseable-source variant).
+        ScheduleSource::Operator
+    }
+}
+
+/// Submission payload — everything the caller knows at insert time.
+/// Used by both the operator-direct path and the approval-flow
+/// path; the latter sets `source = Approval { id }`.
+#[derive(Debug, Clone)]
+pub struct NewSchedule {
+    pub owner: String,
+    pub targets: Vec<String>,
+    pub body: String,
+    pub first_fire_at_unix: i64,
+    pub interval_seconds: Option<u64>,
+    pub description: Option<String>,
+    pub source: ScheduleSource,
+}
+
+/// Partial-update payload for `ScheduledPrompts::update` (#474).
+/// Every field is `Option<_>`; `None` keeps the existing value.
+/// The doubly-wrapped `Option<Option<u64>>` on `interval_seconds`
+/// is intentional: outer `None` = "don't touch", outer
+/// `Some(None)` = "set to NULL (toggle to one-shot)", outer
+/// `Some(Some(n))` = "set to n seconds." Same encoding as JSON
+/// "missing key" vs "explicit null" — the dashboard surface
+/// preserves the distinction.
+///
+/// Target add/remove (#474 fast-follow): `targets_add` / `targets_remove`
+/// run inside the same transaction as the scalar field updates so
+/// "save my changes" is atomic. Remove delegates to the same
+/// cancel-targets path used by `cancel_targets` (tombstoning, preserves
+/// audit, auto-cancels parent when no active targets remain). Add uses
+/// `INSERT OR REPLACE` so re-adding a previously-cancelled target
+/// drops the tombstone and starts fresh (operator intent on re-add =
+/// "this target is active again"; prior history was already visible
+/// at cancel time).
+#[derive(Debug, Clone, Default)]
+pub struct UpdateSchedule {
+    pub body: Option<String>,
+    pub description: Option<Option<String>>,
+    pub interval_seconds: Option<Option<u64>>,
+    pub next_fire_at_unix: Option<i64>,
+    pub targets_add: Option<Vec<String>>,
+    pub targets_remove: Option<Vec<String>>,
+}
+
+pub struct ScheduledPrompts {
+    conn: Mutex<Connection>,
+}
+
+impl ScheduledPrompts {
+    pub fn open(path: &Path) -> Result<Self> {
+        if let Some(parent) = path.parent() {
+            std::fs::create_dir_all(parent).with_context(|| {
+                format!("create scheduled_prompts db parent {}", parent.display())
+            })?;
+        }
+        let conn = Connection::open(path)
+            .with_context(|| format!("open scheduled_prompts db {}", path.display()))?;
+        // Required for ON DELETE CASCADE to actually fire — sqlite
+        // ships with FKs disabled per connection by default.
+        conn.execute_batch("PRAGMA foreign_keys = ON;")
+            .context("enable foreign keys")?;
+        conn.execute_batch(SCHEMA)
+            .context("apply scheduled_prompts schema")?;
+        Ok(Self {
+            conn: Mutex::new(conn),
+        })
+    }
+
+    /// Insert a new schedule. Returns the new id. Empty `targets` is
+    /// rejected — a schedule with no recipients would silently
+    /// never fan out, masking caller bugs.
+    pub fn submit(&self, new: NewSchedule) -> Result<i64> {
+        if new.targets.is_empty() {
+            bail!("schedule must have at least one target");
+        }
+        let mut conn = self.conn.lock().unwrap();
+        let tx = conn.transaction()?;
+        tx.execute(
+            "INSERT INTO scheduled_prompts
+                (owner, body, interval_seconds, next_fire_at_unix,
+                 created_at_unix, source, description)
+             VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)",
+            params![
+                new.owner,
+                new.body,
+                new.interval_seconds.map(i64::try_from).and_then(Result::ok),
+                new.first_fire_at_unix,
+                now_unix(),
+                new.source.to_db_string(),
+                new.description,
+            ],
+        )?;
+        let id = tx.last_insert_rowid();
+        for target in &new.targets {
+            tx.execute(
+                "INSERT INTO scheduled_prompt_targets (schedule_id, target)
+                 VALUES (?1, ?2)",
+                params![id, target],
+            )?;
+        }
+        tx.commit()?;
+        Ok(id)
+    }
+
+    /// Fetch a single schedule by id (with its target rows).
+    /// `Ok(None)` for a non-existent / already-reaped id.
+    pub fn get(&self, id: i64) -> Result<Option<Schedule>> {
+        let conn = self.conn.lock().unwrap();
+        let row = conn
+            .query_row(
+                "SELECT id, owner, body, interval_seconds, next_fire_at_unix,
+                        created_at_unix, source, cancelled_at_unix, description
+                   FROM scheduled_prompts WHERE id = ?1",
+                params![id],
+                row_to_schedule_header,
+            )
+            .optional()?;
+        let Some(mut s) = row else {
+            return Ok(None);
+        };
+        s.targets = load_targets(&conn, id)?;
+        Ok(Some(s))
+    }
+
+    /// Every active (non-globally-cancelled) schedule in insert
+    /// order. Used by the dashboard list view + the cancel-auth
+    /// check (the latter only needs the header but list() is the
+    /// shared hot path).
+    pub fn list(&self) -> Result<Vec<Schedule>> {
+        let conn = self.conn.lock().unwrap();
+        let mut stmt = conn.prepare(
+            "SELECT id, owner, body, interval_seconds, next_fire_at_unix,
+                    created_at_unix, source, cancelled_at_unix, description
+               FROM scheduled_prompts
+              ORDER BY next_fire_at_unix ASC, id ASC",
+        )?;
+        let rows = stmt.query_map([], row_to_schedule_header)?;
+        let mut out = Vec::new();
+        for row in rows {
+            let mut s = row?;
+            s.targets = load_targets(&conn, s.id)?;
+            out.push(s);
+        }
+        Ok(out)
+    }
+
+    /// Pop the set of active rows that are due (`next_fire_at_unix <= now`)
+    /// up to `limit`. Read-only — the worker calls `mark_fired`
+    /// after each successful fan-out so the rows reappear on the
+    /// next tick when re-armed.
+    pub fn due(&self, now: i64, limit: u64) -> Result<Vec<Schedule>> {
+        let conn = self.conn.lock().unwrap();
+        let mut stmt = conn.prepare(
+            "SELECT id, owner, body, interval_seconds, next_fire_at_unix,
+                    created_at_unix, source, cancelled_at_unix, description
+               FROM scheduled_prompts
+              WHERE cancelled_at_unix IS NULL AND next_fire_at_unix <= ?1
+              ORDER BY next_fire_at_unix ASC, id ASC
+              LIMIT ?2",
+        )?;
+        let rows = stmt.query_map(params![now, limit], row_to_schedule_header)?;
+        let mut out = Vec::new();
+        for row in rows {
+            let mut s = row?;
+            s.targets = load_targets(&conn, s.id)?;
+            out.push(s);
+        }
+        Ok(out)
+    }
+
+    /// Record a per-target fan-out result. `result` is "ok" or a
+    /// short error string; surfaces on the dashboard last-result
+    /// column. No-op for a target row that's already cancelled.
+    pub fn record_target_result(
+        &self,
+        schedule_id: i64,
+        target: &str,
+        fired_at_unix: i64,
+        result: &str,
+    ) -> Result<()> {
+        let conn = self.conn.lock().unwrap();
+        conn.execute(
+            "UPDATE scheduled_prompt_targets
+                SET last_fired_at_unix = ?1, last_result = ?2
+              WHERE schedule_id = ?3 AND target = ?4 AND cancelled_at_unix IS NULL",
+            params![fired_at_unix, result, schedule_id, target],
+        )?;
+        Ok(())
+    }
+
+    /// Advance a recurring schedule's `next_fire_at` to the smallest
+    /// multiple-of-interval > `from`. Returns the count of skipped
+    /// cycles (≥ 0); the worker stamps that into the per-row
+    /// last_result so operators see "caught up from N missed".
+    ///
+    /// For one-shots (`interval_seconds IS NULL`) this is a no-op
+    /// at the SQL level; callers should `delete` them after fan-out
+    /// instead.
+    pub fn rearm(&self, id: i64, from_unix: i64) -> Result<u64> {
+        let conn = self.conn.lock().unwrap();
+        let row: Option<(Option<i64>, i64)> = conn
+            .query_row(
+                "SELECT interval_seconds, next_fire_at_unix
+                   FROM scheduled_prompts WHERE id = ?1",
+                params![id],
+                |row| Ok((row.get(0)?, row.get(1)?)),
+            )
+            .optional()?;
+        let Some((interval, current_next)) = row else {
+            return Ok(0);
+        };
+        let Some(interval) = interval.filter(|&i| i > 0) else {
+            return Ok(0);
+        };
+        // Smallest multiple-of-interval > `from_unix`. Catch-up
+        // semantics: when from_unix > current_next, every step in
+        // between gets counted as a skipped cycle.
+        let mut next = current_next + interval;
+        let mut skipped: u64 = 0;
+        while next <= from_unix {
+            next += interval;
+            skipped += 1;
+        }
+        conn.execute(
+            "UPDATE scheduled_prompts SET next_fire_at_unix = ?1 WHERE id = ?2",
+            params![next, id],
+        )?;
+        Ok(skipped)
+    }
+
+    /// Partial-update an existing schedule's mutable fields (#474).
+    /// Every scalar field is `Option<_>`; `None` means "leave the
+    /// existing value alone", `Some(_)` means "set it to this."
+    /// Refuses cancelled rows (no point editing a tombstone —
+    /// operator can just submit a new schedule). Refuses
+    /// `interval_seconds = Some(0)` — same rule as submit-time
+    /// validation.
+    ///
+    /// Targets are mutable via `targets_remove` + `targets_add`
+    /// (#478 fast-follow). Both are processed in the same
+    /// transaction, with **removes before adds** so a single PATCH
+    /// can swap a target without ever leaving the schedule
+    /// target-less mid-tx. Remove writes a tombstone via
+    /// `COALESCE(cancelled_at_unix, ?1)` so it's idempotent. Add
+    /// uses `INSERT OR REPLACE` so re-adding a previously-removed
+    /// target drops the tombstone and resets per-target history
+    /// (fresh start — option C from the iris design thread). If
+    /// the post-tx active-target count is zero the parent schedule
+    /// is auto-cancelled — the worker would otherwise spin forever
+    /// firing nothing.
+    pub fn update(&self, id: i64, patch: UpdateSchedule) -> Result<()> {
+        // Pre-flight: row must exist and not be cancelled.
+        let mut conn = self.conn.lock().unwrap();
+        let cancelled: Option<i64> = conn
+            .query_row(
+                "SELECT cancelled_at_unix FROM scheduled_prompts WHERE id = ?1",
+                params![id],
+                |row| row.get(0),
+            )
+            .optional()?
+            .ok_or_else(|| anyhow::anyhow!("schedule {id} not found"))?;
+        if cancelled.is_some() {
+            bail!("schedule {id} is cancelled — submit a new one");
+        }
+        if let Some(Some(0)) = patch.interval_seconds {
+            bail!("interval_seconds must be > 0 (use None for one-shot)");
+        }
+        // Single transaction so a partial failure can't leave a
+        // half-updated row.
+        let tx = conn.transaction()?;
+        if let Some(body) = patch.body {
+            tx.execute(
+                "UPDATE scheduled_prompts SET body = ?1 WHERE id = ?2",
+                params![body, id],
+            )?;
+        }
+        if let Some(description) = patch.description {
+            tx.execute(
+                "UPDATE scheduled_prompts SET description = ?1 WHERE id = ?2",
+                params![description, id],
+            )?;
+        }
+        if let Some(interval) = patch.interval_seconds {
+            // `Some(Some(n))` = set to n. `Some(None)` = clear (one-shot).
+            // `None` is filtered out by the outer `if let`.
+            let value: Option<i64> = interval.map(i64::try_from).and_then(Result::ok);
+            tx.execute(
+                "UPDATE scheduled_prompts SET interval_seconds = ?1 WHERE id = ?2",
+                params![value, id],
+            )?;
+        }
+        if let Some(next) = patch.next_fire_at_unix {
+            tx.execute(
+                "UPDATE scheduled_prompts SET next_fire_at_unix = ?1 WHERE id = ?2",
+                params![next, id],
+            )?;
+        }
+        // Target removals first, then adds. Order matters: an
+        // operator who sends `{add: ["alice"], remove: ["alice"]}`
+        // probably typo'd, but treating add-after-remove as the
+        // surviving intent means a clean re-arm rather than an
+        // orphaned tombstone. Plus removing-then-adding is the
+        // natural way to "restart history" on one target without
+        // a separate flow.
+        let now = now_unix();
+        if let Some(remove) = patch.targets_remove.as_deref() {
+            for target in remove {
+                tx.execute(
+                    "UPDATE scheduled_prompt_targets
+                        SET cancelled_at_unix = COALESCE(cancelled_at_unix, ?1)
+                      WHERE schedule_id = ?2 AND target = ?3",
+                    params![now, id, target],
+                )?;
+            }
+        }
+        if let Some(add) = patch.targets_add.as_deref() {
+            for target in add {
+                // INSERT OR REPLACE drops any prior row (cancelled
+                // tombstone or otherwise) and inserts a fresh one
+                // with empty history. Operator intent on re-add =
+                // "this target is active again, fresh start."
+                tx.execute(
+                    "INSERT OR REPLACE INTO scheduled_prompt_targets
+                        (schedule_id, target, cancelled_at_unix,
+                         last_fired_at_unix, last_result)
+                     VALUES (?1, ?2, NULL, NULL, NULL)",
+                    params![id, target],
+                )?;
+            }
+        }
+        // If the remove set drained the last active target (and
+        // the add set didn't bring any back), auto-cancel the
+        // parent so the worker stops scanning it. Mirrors
+        // `cancel_targets`'s behaviour for the same edge case.
+        if patch.targets_remove.is_some() || patch.targets_add.is_some() {
+            let active_targets: i64 = tx.query_row(
+                "SELECT COUNT(*) FROM scheduled_prompt_targets
+                  WHERE schedule_id = ?1 AND cancelled_at_unix IS NULL",
+                params![id],
+                |row| row.get(0),
+            )?;
+            if active_targets == 0 {
+                tx.execute(
+                    "UPDATE scheduled_prompts
+                        SET cancelled_at_unix = COALESCE(cancelled_at_unix, ?1)
+                      WHERE id = ?2",
+                    params![now, id],
+                )?;
+            }
+        }
+        tx.commit()?;
+        Ok(())
+    }
+
+    /// Delete a one-shot row after its single fire. Cascades the
+    /// target rows via the FK constraint. Idempotent on a missing
+    /// id.
+    pub fn delete(&self, id: i64) -> Result<()> {
+        let conn = self.conn.lock().unwrap();
+        conn.execute(
+            "DELETE FROM scheduled_prompts WHERE id = ?1",
+            params![id],
+        )?;
+        Ok(())
+    }
+
+    /// Cancel the entire schedule (all targets flipped + the parent
+    /// row marked cancelled). Idempotent; safe to call on an
+    /// already-cancelled row.
+    pub fn cancel_all(&self, id: i64) -> Result<()> {
+        let mut conn = self.conn.lock().unwrap();
+        let now = now_unix();
+        let tx = conn.transaction()?;
+        tx.execute(
+            "UPDATE scheduled_prompts
+                SET cancelled_at_unix = COALESCE(cancelled_at_unix, ?1)
+              WHERE id = ?2",
+            params![now, id],
+        )?;
+        tx.execute(
+            "UPDATE scheduled_prompt_targets
+                SET cancelled_at_unix = COALESCE(cancelled_at_unix, ?1)
+              WHERE schedule_id = ?2",
+            params![now, id],
+        )?;
+        tx.commit()?;
+        Ok(())
+    }
+
+    /// Cancel a subset of a schedule's targets. When the last
+    /// active target is cancelled, the parent row is auto-cancelled
+    /// too (so the worker reaps it). Unknown targets in the list
+    /// are silently skipped.
+    pub fn cancel_targets(&self, id: i64, targets: &[String]) -> Result<()> {
+        let mut conn = self.conn.lock().unwrap();
+        let now = now_unix();
+        let tx = conn.transaction()?;
+        for target in targets {
+            tx.execute(
+                "UPDATE scheduled_prompt_targets
+                    SET cancelled_at_unix = COALESCE(cancelled_at_unix, ?1)
+                  WHERE schedule_id = ?2 AND target = ?3",
+                params![now, id, target],
+            )?;
+        }
+        // If every target on this schedule is now cancelled, flip
+        // the parent so the worker stops scanning it.
+        let active_targets: i64 = tx.query_row(
+            "SELECT COUNT(*) FROM scheduled_prompt_targets
+              WHERE schedule_id = ?1 AND cancelled_at_unix IS NULL",
+            params![id],
+            |row| row.get(0),
+        )?;
+        if active_targets == 0 {
+            tx.execute(
+                "UPDATE scheduled_prompts
+                    SET cancelled_at_unix = COALESCE(cancelled_at_unix, ?1)
+                  WHERE id = ?2",
+                params![now, id],
+            )?;
+        }
+        tx.commit()?;
+        Ok(())
+    }
+
+    /// Reap cancelled rows older than `older_than_unix`. Returns
+    /// the number of rows deleted. Called from the worker on each
+    /// tick so cancellations clear out of the dashboard without an
+    /// extra periodic vacuum task.
+    pub fn reap_cancelled(&self, older_than_unix: i64) -> Result<usize> {
+        let conn = self.conn.lock().unwrap();
+        let n = conn.execute(
+            "DELETE FROM scheduled_prompts
+              WHERE cancelled_at_unix IS NOT NULL
+                AND cancelled_at_unix <= ?1",
+            params![older_than_unix],
+        )?;
+        Ok(n)
+    }
+}
+
+fn row_to_schedule_header(row: &rusqlite::Row) -> rusqlite::Result<Schedule> {
+    let interval: Option<i64> = row.get(3)?;
+    let source_str: String = row.get(6)?;
+    Ok(Schedule {
+        id: row.get(0)?,
+        owner: row.get(1)?,
+        body: row.get(2)?,
+        interval_seconds: interval.and_then(|i| u64::try_from(i).ok()),
+        next_fire_at_unix: row.get(4)?,
+        created_at_unix: row.get(5)?,
+        source: ScheduleSource::from_db_string(&source_str),
+        cancelled_at_unix: row.get(7)?,
+        description: row.get(8)?,
+        targets: Vec::new(),
+    })
+}
+
+fn load_targets(conn: &Connection, schedule_id: i64) -> Result<Vec<ScheduleTarget>> {
+    let mut stmt = conn.prepare(
+        "SELECT target, cancelled_at_unix, last_fired_at_unix, last_result
+           FROM scheduled_prompt_targets
+          WHERE schedule_id = ?1
+          ORDER BY target ASC",
+    )?;
+    let rows = stmt.query_map(params![schedule_id], |row| {
+        Ok(ScheduleTarget {
+            target: row.get(0)?,
+            cancelled_at_unix: row.get(1)?,
+            last_fired_at_unix: row.get(2)?,
+            last_result: row.get(3)?,
+        })
+    })?;
+    let mut out = Vec::new();
+    for row in rows {
+        out.push(row?);
+    }
+    Ok(out)
+}
+
+fn now_unix() -> i64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .ok()
+        .and_then(|d| i64::try_from(d.as_secs()).ok())
+        .unwrap_or(0)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::TempDir;
+
+    fn open() -> (TempDir, ScheduledPrompts) {
+        let dir = TempDir::new().expect("tempdir");
+        let path = dir.path().join("schedules.sqlite");
+        let db = ScheduledPrompts::open(&path).expect("open");
+        (dir, db)
+    }
+
+    fn submit_one_shot(db: &ScheduledPrompts, fire_at: i64, targets: &[&str]) -> i64 {
+        db.submit(NewSchedule {
+            owner: "operator".into(),
+            targets: targets.iter().map(|t| (*t).to_owned()).collect(),
+            body: "wake".into(),
+            first_fire_at_unix: fire_at,
+            interval_seconds: None,
+            description: None,
+            source: ScheduleSource::Operator,
+        })
+        .expect("submit")
+    }
+
+    #[test]
+    fn submit_and_get_round_trips_targets() {
+        let (_dir, db) = open();
+        let id = submit_one_shot(&db, 100, &["alice", "bob"]);
+        let s = db.get(id).expect("get").expect("present");
+        assert_eq!(s.id, id);
+        assert_eq!(s.targets.len(), 2);
+        assert_eq!(s.targets[0].target, "alice");
+        assert_eq!(s.targets[1].target, "bob");
+        assert!(s.targets.iter().all(|t| t.cancelled_at_unix.is_none()));
+    }
+
+    #[test]
+    fn submit_rejects_empty_targets() {
+        let (_dir, db) = open();
+        let err = db
+            .submit(NewSchedule {
+                owner: "operator".into(),
+                targets: Vec::new(),
+                body: "wake".into(),
+                first_fire_at_unix: 100,
+                interval_seconds: None,
+                description: None,
+                source: ScheduleSource::Operator,
+            })
+            .unwrap_err();
+        assert!(format!("{err:#}").contains("at least one target"));
+    }
+
+    #[test]
+    fn due_returns_only_past_active_rows() {
+        let (_dir, db) = open();
+        let _future = submit_one_shot(&db, 1000, &["alice"]);
+        let past = submit_one_shot(&db, 50, &["alice"]);
+        let cancelled_past = submit_one_shot(&db, 50, &["bob"]);
+        db.cancel_all(cancelled_past).expect("cancel");
+        let due = db.due(100, 10).expect("due");
+        assert_eq!(due.len(), 1);
+        assert_eq!(due[0].id, past);
+    }
+
+    #[test]
+    fn rearm_handles_catch_up() {
+        let (_dir, db) = open();
+        // Recurring every 60s, last fire at t=100.
+        let id = db
+            .submit(NewSchedule {
+                owner: "operator".into(),
+                targets: vec!["alice".into()],
+                body: "wake".into(),
+                first_fire_at_unix: 100,
+                interval_seconds: Some(60),
+                description: None,
+                source: ScheduleSource::Operator,
+            })
+            .expect("submit");
+        // Worker comes back at t=400 — 5 missed cycles (160, 220,
+        // 280, 340, 400) → next should be 460, skipped = 5.
+        let skipped = db.rearm(id, 400).expect("rearm");
+        assert_eq!(skipped, 5);
+        let s = db.get(id).expect("get").expect("present");
+        assert_eq!(s.next_fire_at_unix, 460);
+    }
+
+    #[test]
+    fn rearm_advances_one_step_when_caught_up() {
+        let (_dir, db) = open();
+        let id = db
+            .submit(NewSchedule {
+                owner: "operator".into(),
+                targets: vec!["alice".into()],
+                body: "wake".into(),
+                first_fire_at_unix: 100,
+                interval_seconds: Some(60),
+                description: None,
+                source: ScheduleSource::Operator,
+            })
+            .expect("submit");
+        // Worker fires right at t=100 — single advance to t=160.
+        let skipped = db.rearm(id, 100).expect("rearm");
+        assert_eq!(skipped, 0);
+        let s = db.get(id).expect("get").expect("present");
+        assert_eq!(s.next_fire_at_unix, 160);
+    }
+
+    #[test]
+    fn rearm_is_a_no_op_for_one_shots() {
+        let (_dir, db) = open();
+        let id = submit_one_shot(&db, 100, &["alice"]);
+        let skipped = db.rearm(id, 1000).expect("rearm");
+        assert_eq!(skipped, 0);
+        // next_fire_at unchanged — one-shots are reaped via delete().
+        let s = db.get(id).expect("get").expect("present");
+        assert_eq!(s.next_fire_at_unix, 100);
+    }
+
+    #[test]
+    fn cancel_targets_auto_cancels_parent_when_last_drops() {
+        let (_dir, db) = open();
+        let id = submit_one_shot(&db, 100, &["alice", "bob"]);
+        db.cancel_targets(id, &["alice".to_owned()]).expect("cancel");
+        let s = db.get(id).expect("get").expect("present");
+        // Parent still active (bob remains).
+        assert!(s.cancelled_at_unix.is_none());
+        db.cancel_targets(id, &["bob".to_owned()]).expect("cancel");
+        let s = db.get(id).expect("get").expect("present");
+        // Parent auto-cancels once every target is gone.
+        assert!(s.cancelled_at_unix.is_some());
+        assert!(s.targets.iter().all(|t| t.cancelled_at_unix.is_some()));
+    }
+
+    #[test]
+    fn cancel_all_flips_parent_and_targets() {
+        let (_dir, db) = open();
+        let id = submit_one_shot(&db, 100, &["alice", "bob"]);
+        db.cancel_all(id).expect("cancel");
+        let s = db.get(id).expect("get").expect("present");
+        assert!(s.cancelled_at_unix.is_some());
+        assert!(s.targets.iter().all(|t| t.cancelled_at_unix.is_some()));
+    }
+
+    #[test]
+    fn delete_cascades_targets() {
+        let (_dir, db) = open();
+        let id = submit_one_shot(&db, 100, &["alice", "bob"]);
+        db.delete(id).expect("delete");
+        assert!(db.get(id).expect("get").is_none());
+    }
+
+    #[test]
+    fn record_target_result_skips_cancelled_targets() {
+        let (_dir, db) = open();
+        let id = submit_one_shot(&db, 100, &["alice", "bob"]);
+        db.cancel_targets(id, &["alice".to_owned()]).expect("cancel");
+        db.record_target_result(id, "alice", 200, "ok")
+            .expect("record alice");
+        db.record_target_result(id, "bob", 200, "ok")
+            .expect("record bob");
+        let s = db.get(id).expect("get").expect("present");
+        let alice = s.targets.iter().find(|t| t.target == "alice").unwrap();
+        let bob = s.targets.iter().find(|t| t.target == "bob").unwrap();
+        // Cancelled targets do NOT get last-result writes.
+        assert!(alice.last_fired_at_unix.is_none());
+        assert!(alice.last_result.is_none());
+        assert_eq!(bob.last_fired_at_unix, Some(200));
+        assert_eq!(bob.last_result.as_deref(), Some("ok"));
+    }
+
+    #[test]
+    fn update_partial_only_touches_set_fields() {
+        let (_dir, db) = open();
+        let id = db
+            .submit(NewSchedule {
+                owner: "operator".into(),
+                targets: vec!["alice".into()],
+                body: "old body".into(),
+                first_fire_at_unix: 100,
+                interval_seconds: Some(60),
+                description: Some("old desc".into()),
+                source: ScheduleSource::Operator,
+            })
+            .expect("submit");
+        // Only change body — everything else must stay.
+        db.update(
+            id,
+            UpdateSchedule {
+                body: Some("new body".into()),
+                ..Default::default()
+            },
+        )
+        .expect("update body");
+        let s = db.get(id).expect("get").expect("present");
+        assert_eq!(s.body, "new body");
+        assert_eq!(s.description.as_deref(), Some("old desc"));
+        assert_eq!(s.interval_seconds, Some(60));
+        assert_eq!(s.next_fire_at_unix, 100);
+    }
+
+    #[test]
+    fn update_interval_toggle_recurring_to_one_shot() {
+        let (_dir, db) = open();
+        let id = db
+            .submit(NewSchedule {
+                owner: "operator".into(),
+                targets: vec!["alice".into()],
+                body: "x".into(),
+                first_fire_at_unix: 100,
+                interval_seconds: Some(60),
+                description: None,
+                source: ScheduleSource::Operator,
+            })
+            .expect("submit");
+        db.update(
+            id,
+            UpdateSchedule {
+                interval_seconds: Some(None),
+                ..Default::default()
+            },
+        )
+        .expect("update");
+        let s = db.get(id).expect("get").expect("present");
+        assert_eq!(s.interval_seconds, None);
+    }
+
+    #[test]
+    fn update_interval_toggle_one_shot_to_recurring() {
+        let (_dir, db) = open();
+        let id = submit_one_shot(&db, 100, &["alice"]);
+        db.update(
+            id,
+            UpdateSchedule {
+                interval_seconds: Some(Some(3600)),
+                ..Default::default()
+            },
+        )
+        .expect("update");
+        let s = db.get(id).expect("get").expect("present");
+        assert_eq!(s.interval_seconds, Some(3600));
+    }
+
+    #[test]
+    fn update_rejects_cancelled_row() {
+        let (_dir, db) = open();
+        let id = submit_one_shot(&db, 100, &["alice"]);
+        db.cancel_all(id).expect("cancel");
+        let err = db
+            .update(
+                id,
+                UpdateSchedule {
+                    body: Some("nope".into()),
+                    ..Default::default()
+                },
+            )
+            .unwrap_err();
+        assert!(format!("{err:#}").contains("cancelled"));
+    }
+
+    #[test]
+    fn update_rejects_zero_interval() {
+        let (_dir, db) = open();
+        let id = submit_one_shot(&db, 100, &["alice"]);
+        let err = db
+            .update(
+                id,
+                UpdateSchedule {
+                    interval_seconds: Some(Some(0)),
+                    ..Default::default()
+                },
+            )
+            .unwrap_err();
+        assert!(format!("{err:#}").contains("interval_seconds"));
+    }
+
+    #[test]
+    fn update_clears_description() {
+        let (_dir, db) = open();
+        let id = db
+            .submit(NewSchedule {
+                owner: "operator".into(),
+                targets: vec!["alice".into()],
+                body: "x".into(),
+                first_fire_at_unix: 100,
+                interval_seconds: None,
+                description: Some("first".into()),
+                source: ScheduleSource::Operator,
+            })
+            .expect("submit");
+        db.update(
+            id,
+            UpdateSchedule {
+                description: Some(None),
+                ..Default::default()
+            },
+        )
+        .expect("update");
+        let s = db.get(id).expect("get").expect("present");
+        assert!(s.description.is_none());
+    }
+
+    #[test]
+    fn update_adds_new_targets() {
+        let (_dir, db) = open();
+        let id = submit_one_shot(&db, 100, &["alice"]);
+        db.update(
+            id,
+            UpdateSchedule {
+                targets_add: Some(vec!["bob".into(), "carol".into()]),
+                ..Default::default()
+            },
+        )
+        .expect("update");
+        let s = db.get(id).expect("get").expect("present");
+        let names: Vec<_> = s.targets.iter().map(|t| t.target.as_str()).collect();
+        assert!(names.contains(&"alice"));
+        assert!(names.contains(&"bob"));
+        assert!(names.contains(&"carol"));
+    }
+
+    #[test]
+    fn update_removes_targets_via_cancel_tombstone() {
+        let (_dir, db) = open();
+        let id = submit_one_shot(&db, 100, &["alice", "bob"]);
+        db.update(
+            id,
+            UpdateSchedule {
+                targets_remove: Some(vec!["alice".into()]),
+                ..Default::default()
+            },
+        )
+        .expect("update");
+        let s = db.get(id).expect("get").expect("present");
+        let alice = s.targets.iter().find(|t| t.target == "alice").unwrap();
+        let bob = s.targets.iter().find(|t| t.target == "bob").unwrap();
+        // alice tombstoned, bob still active, parent still active.
+        assert!(alice.cancelled_at_unix.is_some());
+        assert!(bob.cancelled_at_unix.is_none());
+        assert!(s.cancelled_at_unix.is_none());
+    }
+
+    #[test]
+    fn update_removing_last_target_auto_cancels_parent() {
+        let (_dir, db) = open();
+        let id = submit_one_shot(&db, 100, &["alice"]);
+        db.update(
+            id,
+            UpdateSchedule {
+                targets_remove: Some(vec!["alice".into()]),
+                ..Default::default()
+            },
+        )
+        .expect("update");
+        let s = db.get(id).expect("get").expect("present");
+        assert!(s.cancelled_at_unix.is_some());
+    }
+
+    #[test]
+    fn update_re_add_resurrects_cancelled_target_fresh() {
+        let (_dir, db) = open();
+        let id = submit_one_shot(&db, 100, &["alice", "bob"]);
+        // Record some history on alice, then cancel her.
+        db.record_target_result(id, "alice", 50, "ok").expect("record");
+        db.update(
+            id,
+            UpdateSchedule {
+                targets_remove: Some(vec!["alice".into()]),
+                ..Default::default()
+            },
+        )
+        .expect("cancel alice");
+        // Re-add alice — should drop the tombstone + prior history.
+        db.update(
+            id,
+            UpdateSchedule {
+                targets_add: Some(vec!["alice".into()]),
+                ..Default::default()
+            },
+        )
+        .expect("re-add alice");
+        let s = db.get(id).expect("get").expect("present");
+        let alice = s.targets.iter().find(|t| t.target == "alice").unwrap();
+        assert!(alice.cancelled_at_unix.is_none(), "fresh row, no tombstone");
+        assert!(alice.last_fired_at_unix.is_none(), "history reset");
+        assert!(alice.last_result.is_none(), "history reset");
+    }
+
+    #[test]
+    fn update_add_and_remove_in_one_transaction() {
+        let (_dir, db) = open();
+        let id = submit_one_shot(&db, 100, &["alice"]);
+        db.update(
+            id,
+            UpdateSchedule {
+                targets_remove: Some(vec!["alice".into()]),
+                targets_add: Some(vec!["bob".into()]),
+                ..Default::default()
+            },
+        )
+        .expect("update");
+        let s = db.get(id).expect("get").expect("present");
+        let alice = s.targets.iter().find(|t| t.target == "alice").unwrap();
+        let bob = s.targets.iter().find(|t| t.target == "bob").unwrap();
+        assert!(alice.cancelled_at_unix.is_some());
+        assert!(bob.cancelled_at_unix.is_none());
+        // Bob arrived AFTER alice was tombstoned in the same tx —
+        // active-target count > 0, so parent stays alive.
+        assert!(s.cancelled_at_unix.is_none());
+    }
+
+    #[test]
+    fn approval_source_round_trips() {
+        let (_dir, db) = open();
+        let id = db
+            .submit(NewSchedule {
+                owner: "manager".into(),
+                targets: vec!["alice".into()],
+                body: "wake".into(),
+                first_fire_at_unix: 100,
+                interval_seconds: None,
+                description: None,
+                source: ScheduleSource::Approval { id: 42 },
+            })
+            .expect("submit");
+        let s = db.get(id).expect("get").expect("present");
+        assert_eq!(s.source, ScheduleSource::Approval { id: 42 });
+    }
+
+    #[test]
+    fn reap_cancelled_removes_old_rows_only() {
+        let (_dir, db) = open();
+        let stale = submit_one_shot(&db, 100, &["alice"]);
+        let recent = submit_one_shot(&db, 100, &["bob"]);
+        db.cancel_all(stale).expect("cancel stale");
+        // Manually backdate the stale row.
+        {
+            let conn = db.conn.lock().unwrap();
+            conn.execute(
+                "UPDATE scheduled_prompts SET cancelled_at_unix = ?1 WHERE id = ?2",
+                params![10_i64, stale],
+            )
+            .expect("backdate");
+        }
+        db.cancel_all(recent).expect("cancel recent");
+        let n = db.reap_cancelled(100).expect("reap");
+        assert_eq!(n, 1);
+        assert!(db.get(stale).expect("get stale").is_none());
+        assert!(db.get(recent).expect("get recent").is_some());
+    }
+}
diff --git a/hive-c0re/src/scheduled_prompts_worker.rs b/hive-c0re/src/scheduled_prompts_worker.rs
new file mode 100644
index 00000000..2489274d
--- /dev/null
+++ b/hive-c0re/src/scheduled_prompts_worker.rs
@@ -0,0 +1,391 @@
+//! Background loop that drains due `scheduled_prompts` rows
+//! (#444) and fans the body out as inbox `Message`s to each
+//! active target. Mirrors `reminder_scheduler::spawn` shape:
+//! single `spawn(coord)` entry, 5s poll cadence, shutdown-aware.
+//!
+//! ## Catch-up semantics
+//!
+//! When hive-c0re comes back from being down, a recurring row
+//! whose `next_fire_at` is well in the past would otherwise fire
+//! N delayed pulses in a row. Instead we fire ONCE and let
+//! `ScheduledPrompts::rearm` bump `next_fire_at` to the next
+//! interval slot ≥ `now`, recording the skipped-cycle count in
+//! the per-target `last_result` so operators see how many
+//! firings were caught up rather than losing the signal.
+//!
+//! ## Missing-target failure
+//!
+//! When a target name doesn't resolve to a known agent (the
+//! container has been destroyed, the operator typo'd a name,
+//! etc.) the worker:
+//!  1. records `last_result = "no such agent: <name>"` against
+//!     the per-target row,
+//!  2. sends a single advisory `Message` from `system` to
+//!     `operator` describing the schedule + target + reason,
+//!  3. continues fanning out to the other (live) targets.
+//!
+//! Transient broker errors (sqlite lock contention, etc.) get
+//! the per-target `last_result` annotated AND a `tracing::warn`,
+//! but the post-fire bookkeeping treats the row the same way it
+//! does on a clean fire:
+//!  - **recurring** rows re-arm — the next interval slot tries
+//!    the broker send again, so transient errors self-heal.
+//!  - **one-shots** delete unconditionally after their single
+//!    fan-out pass; a broker failure on a one-shot is NOT
+//!    retried (the operator advisory + last_result are the only
+//!    audit trail).
+
+use std::sync::Arc;
+use std::time::Duration;
+
+use hive_sh4re::Message;
+
+use crate::coordinator::Coordinator;
+use crate::scheduled_prompts::Schedule;
+
+/// Per-tick cap. Each schedule fires once per tick at most;
+/// 100/tick × 5s tick = sustained throughput cap of ~20/sec,
+/// matching `reminder_scheduler::REMINDER_BATCH_LIMIT`. Bump
+/// together if real-world rates push past this.
+const SCHEDULE_BATCH_LIMIT: u64 = 100;
+
+/// Poll interval. Same 5s as the reminder scheduler — picking
+/// up freshly-due rows within at most one tick keeps the
+/// dashboard's "next fire in ..." countdown honest without
+/// burning CPU on empty sweeps.
+const POLL_INTERVAL: Duration = Duration::from_secs(5);
+
+/// Reap cancelled schedules older than this from the table so
+/// the dashboard list view doesn't accrue tombstones forever.
+/// Cancelled rows live long enough that the operator can still
+/// see what they cancelled in the recent past.
+const CANCELLED_REAP_AGE: Duration = Duration::from_secs(3600);
+
+pub fn spawn(coord: Arc<Coordinator>) {
+    let mut shutdown = coord.shutdown_rx();
+    tokio::spawn(async move {
+        loop {
+            tick(&coord);
+            tokio::select! {
+                () = tokio::time::sleep(POLL_INTERVAL) => {}
+                _ = shutdown.changed() => {
+                    tracing::info!("scheduled_prompts worker: shutdown signal received");
+                    break;
+                }
+            }
+        }
+    });
+}
+
+fn tick(coord: &Arc<Coordinator>) {
+    let now = now_unix();
+    let due = match coord.scheduled_prompts.due(now, SCHEDULE_BATCH_LIMIT) {
+        Ok(rows) => rows,
+        Err(e) => {
+            tracing::warn!(error = ?e, "scheduled_prompts: query due rows failed");
+            return;
+        }
+    };
+    if due.is_empty() {
+        // Periodic reaper still gets a chance even on empty ticks.
+        let cutoff = now - i64::try_from(CANCELLED_REAP_AGE.as_secs()).unwrap_or(0);
+        if let Err(e) = coord.scheduled_prompts.reap_cancelled(cutoff) {
+            tracing::warn!(error = ?e, "scheduled_prompts: reap cancelled failed");
+        }
+        return;
+    }
+    for schedule in due {
+        fire_schedule(coord, &schedule, now);
+    }
+    let cutoff = now - i64::try_from(CANCELLED_REAP_AGE.as_secs()).unwrap_or(0);
+    if let Err(e) = coord.scheduled_prompts.reap_cancelled(cutoff) {
+        tracing::warn!(error = ?e, "scheduled_prompts: reap cancelled failed");
+    }
+}
+
+/// Fan out one schedule's body to every active target. Records
+/// per-target last_result; advances or reaps the parent row at
+/// the end depending on whether `interval_seconds` is set.
+fn fire_schedule(coord: &Arc<Coordinator>, schedule: &Schedule, now: i64) {
+    let known: std::collections::HashSet<String> = known_agents(coord);
+    for target_row in &schedule.targets {
+        if target_row.cancelled_at_unix.is_some() {
+            continue;
+        }
+        let target = &target_row.target;
+        // `operator` is a valid recipient (mara c4) — operator
+        // delivery uses the regular broker path; the dashboard
+        // mirrors `to == operator` into its own pane.
+        if target != hive_sh4re::OPERATOR_RECIPIENT && !known.contains(target) {
+            let reason = format!("no such agent: {target}");
+            if let Err(e) = coord.scheduled_prompts.record_target_result(
+                schedule.id,
+                target,
+                now,
+                &reason,
+            ) {
+                tracing::warn!(error = ?e, schedule = schedule.id, %target, "record_target_result failed");
+            }
+            notify_operator_missing_target(coord, schedule, target);
+            continue;
+        }
+        let msg = Message {
+            from: "scheduled".to_owned(),
+            to: target.clone(),
+            body: schedule.body.clone(),
+            in_reply_to: None,
+        };
+        let result = coord.broker.send(&msg);
+        let result_str = match &result {
+            Ok(()) => "ok".to_owned(),
+            Err(e) => format!("broker send failed: {e:#}"),
+        };
+        if let Err(e) = result {
+            tracing::warn!(
+                schedule = schedule.id,
+                %target,
+                error = ?e,
+                "scheduled_prompts: broker send failed (will retry on next interval)"
+            );
+        }
+        if let Err(e) =
+            coord
+                .scheduled_prompts
+                .record_target_result(schedule.id, target, now, &result_str)
+        {
+            tracing::warn!(error = ?e, schedule = schedule.id, %target, "record_target_result failed");
+        }
+    }
+    // Advance or reap. One-shots delete; recurring re-arm with
+    // catch-up clamp.
+    if schedule.interval_seconds.is_some() {
+        match coord.scheduled_prompts.rearm(schedule.id, now) {
+            Ok(0) => {}
+            Ok(skipped) => {
+                tracing::info!(
+                    schedule = schedule.id,
+                    skipped,
+                    "scheduled_prompts: caught up missed cycles"
+                );
+            }
+            Err(e) => {
+                tracing::warn!(error = ?e, schedule = schedule.id, "rearm failed");
+            }
+        }
+    } else if let Err(e) = coord.scheduled_prompts.delete(schedule.id) {
+        tracing::warn!(error = ?e, schedule = schedule.id, "delete one-shot failed");
+    }
+}
+
+/// Snapshot of live container names for the missing-target check.
+/// Always seeds the manager name (which is always reachable);
+/// adds every live nspawn container that matches the `h-` prefix.
+/// On `lifecycle::list` failure the set stays at just the manager
+/// — fail-CLOSED, meaning every non-operator/non-manager target
+/// looks missing this tick and gets the same treatment as a
+/// genuinely-destroyed agent: operator advisory + per-target
+/// `last_result` annotation + skipped delivery. Recurring
+/// schedules recover automatically on the next tick (the lifecycle
+/// listing usually works); one-shots that land on this window
+/// lose their single delivery. Logged at `warn`, not propagated.
+fn known_agents(_coord: &Coordinator) -> std::collections::HashSet<String> {
+    // `lifecycle::list` is async; the worker tick is sync. Use the
+    // blocking variant via a small `tokio::runtime::Handle::block_on`
+    // wrapper. The worker runs in its own tokio task so this is
+    // safe (we're not in a `current_thread` runtime).
+    use std::collections::HashSet;
+    let mut out: HashSet<String> = HashSet::new();
+    out.insert(hive_sh4re::MANAGER_AGENT.to_owned());
+    let containers = tokio::task::block_in_place(|| {
+        tokio::runtime::Handle::current().block_on(crate::lifecycle::list())
+    });
+    match containers {
+        Ok(list) => {
+            for raw in list {
+                if let Some(name) = raw.strip_prefix(crate::lifecycle::AGENT_PREFIX) {
+                    out.insert(name.to_owned());
+                } else if raw == crate::lifecycle::MANAGER_NAME {
+                    out.insert(hive_sh4re::MANAGER_AGENT.to_owned());
+                }
+            }
+        }
+        Err(e) => {
+            tracing::warn!(error = ?e, "scheduled_prompts: container listing failed");
+        }
+    }
+    out
+}
+
+/// Send the operator a one-line advisory when a schedule fires
+/// against an agent that no longer exists. Best-effort — failure
+/// to send just gets logged; the schedule continues firing.
+fn notify_operator_missing_target(coord: &Coordinator, schedule: &Schedule, target: &str) {
+    let body = format!(
+        "scheduled prompt #{id} fired but target `{target}` is not a live agent. \
+         body was:\n\n{body}",
+        id = schedule.id,
+        target = target,
+        body = schedule.body
+    );
+    let msg = Message {
+        from: "scheduled".to_owned(),
+        to: hive_sh4re::OPERATOR_RECIPIENT.to_owned(),
+        body,
+        in_reply_to: None,
+    };
+    if let Err(e) = coord.broker.send(&msg) {
+        tracing::warn!(error = ?e, schedule = schedule.id, %target, "operator advisory send failed");
+    }
+}
+
+fn now_unix() -> i64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .ok()
+        .and_then(|d| i64::try_from(d.as_secs()).ok())
+        .unwrap_or(0)
+}
+
+/// Per-target outcome counts for one `fire_now` invocation.
+/// Returned to the operator so the dashboard can render
+/// "fired to N (M failed, K missing)" without a follow-up GET.
+#[derive(Debug, Clone, serde::Serialize)]
+pub struct FireNowReport {
+    /// Targets the broker accepted the message for.
+    pub ok: u32,
+    /// Targets where broker.send returned an error.
+    pub failed: u32,
+    /// Targets that didn't resolve to a known agent (and got the
+    /// operator-advisory treatment).
+    pub missing: u32,
+    /// Whether the one-shot was consumed by this manual fire.
+    /// `true` only when the schedule was a one-shot (recurring
+    /// schedules never auto-cancel on manual fire — they keep
+    /// their cadence).
+    pub one_shot_consumed: bool,
+}
+
+/// Manual / out-of-band fire of a scheduled prompt (#467 "fire
+/// now" button). Mirrors the per-target fan-out of `fire_schedule`
+/// but skips the rearm step entirely — manual fires don't disturb
+/// a recurring schedule's rhythm. For one-shots, a manual fire
+/// **consumes** the schedule (operator intent: "send this now,
+/// the scheduled time was wrong"); recurring schedules keep their
+/// `next_fire_at_unix` unchanged.
+///
+/// `last_result` is annotated with the `manual fire:` prefix so
+/// the dashboard's per-target last-result column can distinguish
+/// scheduled fires from operator-initiated ones at a glance.
+///
+/// Returns Err if the schedule is missing, cancelled, or fully
+/// drained of active targets — the dashboard can surface those
+/// as plain 4xxs instead of pretending to fire a phantom row.
+pub async fn fire_now(
+    coord: &std::sync::Arc<Coordinator>,
+    schedule_id: i64,
+) -> anyhow::Result<FireNowReport> {
+    let now = now_unix();
+    let schedule = coord
+        .scheduled_prompts
+        .get(schedule_id)?
+        .ok_or_else(|| anyhow::anyhow!("schedule {schedule_id} not found"))?;
+    if schedule.cancelled_at_unix.is_some() {
+        anyhow::bail!("schedule {schedule_id} is already cancelled");
+    }
+    if !schedule.targets.iter().any(|t| t.cancelled_at_unix.is_none()) {
+        anyhow::bail!("schedule {schedule_id} has no active targets");
+    }
+    let known = known_agents_async().await;
+    let mut report = FireNowReport {
+        ok: 0,
+        failed: 0,
+        missing: 0,
+        one_shot_consumed: false,
+    };
+    for target_row in &schedule.targets {
+        if target_row.cancelled_at_unix.is_some() {
+            continue;
+        }
+        let target = &target_row.target;
+        if target != hive_sh4re::OPERATOR_RECIPIENT && !known.contains(target) {
+            let reason = format!("manual fire: no such agent: {target}");
+            if let Err(e) = coord.scheduled_prompts.record_target_result(
+                schedule_id,
+                target,
+                now,
+                &reason,
+            ) {
+                tracing::warn!(error = ?e, schedule = schedule_id, %target, "record_target_result failed");
+            }
+            notify_operator_missing_target(coord, &schedule, target);
+            report.missing += 1;
+            continue;
+        }
+        let msg = Message {
+            from: "scheduled".to_owned(),
+            to: target.clone(),
+            body: schedule.body.clone(),
+            in_reply_to: None,
+        };
+        let result = coord.broker.send(&msg);
+        let result_str = match &result {
+            Ok(()) => "manual fire: ok".to_owned(),
+            Err(e) => format!("manual fire: broker send failed: {e:#}"),
+        };
+        if result.is_ok() {
+            report.ok += 1;
+        } else {
+            report.failed += 1;
+            tracing::warn!(
+                schedule = schedule_id,
+                %target,
+                error = ?result.as_ref().err(),
+                "fire_now: broker send failed (no retry — manual fires don't loop)"
+            );
+        }
+        if let Err(e) =
+            coord
+                .scheduled_prompts
+                .record_target_result(schedule_id, target, now, &result_str)
+        {
+            tracing::warn!(error = ?e, schedule = schedule_id, %target, "record_target_result failed");
+        }
+    }
+    if schedule.interval_seconds.is_none() {
+        // One-shot is consumed by the manual fire. Recurring
+        // schedules stay untouched — their cadence is the whole
+        // point and a manual fire is meant to be additive.
+        if let Err(e) = coord.scheduled_prompts.cancel_all(schedule_id) {
+            tracing::warn!(error = ?e, schedule = schedule_id, "cancel_all after one-shot manual fire failed");
+        } else {
+            report.one_shot_consumed = true;
+        }
+    }
+    Ok(report)
+}
+
+/// Async variant of `known_agents` for `fire_now`. Same logic +
+/// same fail-closed degradation; the difference is just that the
+/// dashboard handler is genuinely async so we `await` the
+/// `lifecycle::list` directly instead of going through the
+/// `block_in_place` shim.
+async fn known_agents_async() -> std::collections::HashSet<String> {
+    use std::collections::HashSet;
+    let mut out: HashSet<String> = HashSet::new();
+    out.insert(hive_sh4re::MANAGER_AGENT.to_owned());
+    match crate::lifecycle::list().await {
+        Ok(list) => {
+            for raw in list {
+                if let Some(name) = raw.strip_prefix(crate::lifecycle::AGENT_PREFIX) {
+                    out.insert(name.to_owned());
+                } else if raw == crate::lifecycle::MANAGER_NAME {
+                    out.insert(hive_sh4re::MANAGER_AGENT.to_owned());
+                }
+            }
+        }
+        Err(e) => {
+            tracing::warn!(error = ?e, "fire_now: container listing failed");
+        }
+    }
+    out
+}
diff --git a/hive-c0re/src/server.rs b/hive-c0re/src/server.rs
new file mode 100644
index 00000000..30be0364
--- /dev/null
+++ b/hive-c0re/src/server.rs
@@ -0,0 +1,206 @@
+use std::path::Path;
+use std::sync::Arc;
+
+use anyhow::{Context, Result};
+use hive_sh4re::{HostRequest, HostResponse};
+use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
+use tokio::net::{UnixListener, UnixStream};
+
+use crate::actions;
+use crate::coordinator::Coordinator;
+use crate::lifecycle;
+
+pub async fn serve(socket: &Path, coord: Arc<Coordinator>) -> Result<()> {
+    if let Some(parent) = socket.parent() {
+        std::fs::create_dir_all(parent)
+            .with_context(|| format!("create socket parent {}", parent.display()))?;
+    }
+    if socket.exists() {
+        std::fs::remove_file(socket).context("remove stale socket")?;
+    }
+
+    let listener = UnixListener::bind(socket)
+        .with_context(|| format!("bind admin socket {}", socket.display()))?;
+    tracing::info!(socket = %socket.display(), hyperhive_flake = %coord.hyperhive_flake, "hive-c0re admin listening");
+
+    loop {
+        let (stream, _) = listener.accept().await.context("accept connection")?;
+        let coord = coord.clone();
+        tokio::spawn(async move {
+            if let Err(e) = handle(stream, coord).await {
+                tracing::warn!(error = ?e, "connection failed");
+            }
+        });
+    }
+}
+
+async fn handle(stream: UnixStream, coord: Arc<Coordinator>) -> Result<()> {
+    let (read, mut write) = stream.into_split();
+    let mut reader = BufReader::new(read);
+    let mut line = String::new();
+
+    loop {
+        line.clear();
+        let n = reader.read_line(&mut line).await?;
+        if n == 0 {
+            return Ok(());
+        }
+        let resp = match serde_json::from_str::<HostRequest>(line.trim()) {
+            Ok(req) => dispatch(&req, coord.clone()).await,
+            Err(e) => HostResponse::error(format!("parse error: {e}")),
+        };
+        let mut payload = serde_json::to_string(&resp)?;
+        payload.push('\n');
+        write.write_all(payload.as_bytes()).await?;
+        write.flush().await?;
+    }
+}
+
+#[allow(clippy::too_many_lines)]
+async fn dispatch(req: &HostRequest, coord: Arc<Coordinator>) -> HostResponse {
+    let result: anyhow::Result<HostResponse> = async {
+        Ok(match req {
+            HostRequest::Spawn { name } => {
+                tracing::info!(%name, "spawn");
+                let agent_dir = coord.ensure_runtime(name)?;
+                let proposed_dir = Coordinator::agent_proposed_dir(name);
+                let applied_dir = Coordinator::agent_applied_dir(name);
+                let claude_dir = Coordinator::agent_claude_dir(name);
+                let notes_dir = Coordinator::agent_notes_dir(name);
+                match lifecycle::spawn(
+                    name,
+                    &coord.hyperhive_flake,
+                    &agent_dir,
+                    &proposed_dir,
+                    &applied_dir,
+                    &claude_dir,
+                    &notes_dir,
+                    coord.dashboard_port,
+                    &coord.operator_pronouns,
+                    &coord.context_window_tokens,
+                )
+                .await
+                {
+                    Ok(()) => {
+                        coord.notify_manager(&hive_sh4re::HelperEvent::Spawned {
+                            agent: name.clone(),
+                            ok: true,
+                            note: None,
+                            sha: None,
+                        });
+                    }
+                    Err(e) => {
+                        // Roll back socket registration if container creation failed.
+                        coord.unregister_agent(name);
+                        coord.notify_manager(&hive_sh4re::HelperEvent::Spawned {
+                            agent: name.clone(),
+                            ok: false,
+                            note: Some(format!("{e:#}")),
+                            sha: None,
+                        });
+                        return Err(e);
+                    }
+                }
+                HostResponse::success()
+            }
+            HostRequest::RequestSpawn { name } => {
+                tracing::info!(%name, "request_spawn");
+                let id =
+                    coord
+                        .approvals
+                        .submit_kind(name, hive_sh4re::ApprovalKind::Spawn, "", None)?;
+                tracing::info!(%id, %name, "spawn approval queued");
+                HostResponse::success()
+            }
+            HostRequest::Kill { name } => {
+                tracing::info!(%name, "kill");
+                lifecycle::kill(name).await?;
+                coord.unregister_agent(name);
+                coord.notify_manager(&hive_sh4re::HelperEvent::Killed {
+                    agent: name.clone(),
+                });
+                HostResponse::success()
+            }
+            HostRequest::Destroy { name, purge } => {
+                actions::destroy(&coord, name, *purge).await?;
+                HostResponse::success()
+            }
+            HostRequest::Rebuild { name } => {
+                tracing::info!(%name, "rebuild");
+                let agent_dir = coord.ensure_runtime(name)?;
+                let applied_dir = Coordinator::agent_applied_dir(name);
+                let claude_dir = Coordinator::agent_claude_dir(name);
+                let notes_dir = Coordinator::agent_notes_dir(name);
+                let result = lifecycle::rebuild(
+                    name,
+                    &coord.hyperhive_flake,
+                    &agent_dir,
+                    &applied_dir,
+                    &claude_dir,
+                    &notes_dir,
+                    coord.dashboard_port,
+                    &coord.operator_pronouns,
+                    &coord.context_window_tokens,
+                )
+                .await;
+                // Mirror auto_update::rebuild_agent — the manager wants
+                // to know about every rebuild attempt regardless of
+                // which surface triggered it, especially failures
+                // (build error → manager can adjust the agent's
+                // agent.nix). Without this the admin-socket CLI was
+                // a notify-gap.
+                match &result {
+                    Ok(()) => {
+                        coord.notify_manager(&hive_sh4re::HelperEvent::Rebuilt {
+                            agent: name.clone(),
+                            ok: true,
+                            note: None,
+                            sha: None,
+                            tag: None,
+                        });
+                        // Wake the agent's next turn with the
+                        // "you were rebuilt" hint. Same pattern as
+                        // auto_update::rebuild_agent and the dashboard
+                        // rebuild path — this is the CLI's equivalent.
+                        coord.kick_agent(name, "container rebuilt");
+                    }
+                    Err(e) => coord.notify_manager(&hive_sh4re::HelperEvent::Rebuilt {
+                        agent: name.clone(),
+                        ok: false,
+                        note: Some(format!("{e:#}")),
+                        sha: None,
+                        tag: None,
+                    }),
+                }
+                result?;
+                HostResponse::success()
+            }
+            HostRequest::List => HostResponse::list(lifecycle::list().await?),
+            HostRequest::Pending => HostResponse::pending(coord.approvals.pending()?),
+            HostRequest::Approve { id } => {
+                actions::approve(coord.clone(), *id).await?;
+                HostResponse::success()
+            }
+            HostRequest::Deny { id } => {
+                actions::deny(&coord, *id, None).await?;
+                HostResponse::success()
+            }
+            HostRequest::SetParent { child, new_parent } => {
+                tracing::info!(%child, ?new_parent, "set_parent");
+                crate::topology::set_parent(child, new_parent.as_deref())
+                    .map_err(anyhow::Error::msg)?;
+                // ContainerView.parent is read from topology.json — a
+                // change here means every container row potentially
+                // moves in the dashboard tree. Rescan + diff-emit so
+                // open viewers repaint without polling.
+                coord.rescan_containers_and_emit().await;
+                HostResponse::success()
+            }
+        })
+    }
+    .await;
+    match result {
+        Ok(r) => r,
+        Err(e) => HostResponse::error(format!("{e:#}")),
+    }
+}
diff --git a/hive-c0re/src/stats_vacuum.rs b/hive-c0re/src/stats_vacuum.rs
new file mode 100644
index 00000000..c08be606
--- /dev/null
+++ b/hive-c0re/src/stats_vacuum.rs
@@ -0,0 +1,66 @@
+//! Host-side vacuum of every per-agent turn-stats.sqlite. The harness
+//! writes to `/state/hyperhive-turn-stats.sqlite` (bind-mounted from
+//! `/var/lib/hyperhive/agents/<name>/state/`); we open the same file
+//! from the host every hour and delete rows older than `KEEP_SECS`.
+//! Mirrors `events_vacuum` in structure — host-side so the harness
+//! can't disable it, age-only so a chatty burst doesn't evict old
+//! rows sooner than expected. 90-day retention keeps enough history
+//! for trend analysis without unbounded growth.
+
+use std::path::Path;
+use std::sync::Arc;
+use std::time::{Duration, SystemTime, UNIX_EPOCH};
+
+use rusqlite::{Connection, Result, params};
+
+use crate::coordinator::Coordinator;
+
+const VACUUM_INTERVAL: Duration = Duration::from_secs(3600);
+const KEEP_SECS: i64 = 90 * 24 * 3600;
+
+/// Background loop: sweep every existing agent state dir hourly, run
+/// the vacuum SQL against its turn-stats.sqlite if present. Errors
+/// are logged but don't tear the loop down.
+pub fn spawn(coord: &Arc<Coordinator>) {
+    let mut shutdown = coord.shutdown_rx();
+    tokio::spawn(async move {
+        loop {
+            sweep_once();
+            tokio::select! {
+                () = tokio::time::sleep(VACUUM_INTERVAL) => {}
+                _ = shutdown.changed() => {
+                    tracing::info!("stats vacuum: shutdown signal received");
+                    break;
+                }
+            }
+        }
+    });
+}
+
+fn sweep_once() {
+    for name in Coordinator::kept_state_names() {
+        let path =
+            Coordinator::agent_notes_dir(&name).join("hyperhive-turn-stats.sqlite");
+        if !path.exists() {
+            continue;
+        }
+        match vacuum_file(&path) {
+            Ok(0) => {}
+            Ok(n) => tracing::info!(agent = %name, removed = n, "turn-stats vacuum"),
+            Err(e) => tracing::warn!(agent = %name, error = ?e, "turn-stats vacuum failed"),
+        }
+    }
+}
+
+fn vacuum_file(path: &Path) -> Result<u64> {
+    let conn = Connection::open(path)?;
+    let now = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .ok()
+        .and_then(|d| i64::try_from(d.as_secs()).ok())
+        .unwrap_or(0);
+    let cutoff = now - KEEP_SECS;
+    let removed =
+        conn.execute("DELETE FROM turn_stats WHERE started_at < ?1", params![cutoff])?;
+    Ok(u64::try_from(removed).unwrap_or(0))
+}
diff --git a/hive-c0re/src/topology.rs b/hive-c0re/src/topology.rs
new file mode 100644
index 00000000..7830e9a9
--- /dev/null
+++ b/hive-c0re/src/topology.rs
@@ -0,0 +1,341 @@
+//! Agent topology storage — single source of truth for parent/child
+//! relations in the hive. Lives in the hive-c0re-owned meta repo at
+//! `/var/lib/hyperhive/meta/topology.json`, alongside `flake.nix`, so
+//! topology changes thread through the same git commit log as deploys.
+//!
+//! Why meta, not per-agent: an agent shouldn't be able to claim a
+//! parent without that parent's consent, and an operator-driven
+//! re-parenting shouldn't require touching the moved agent's own
+//! config. Topology IS a system-level concern; meta is where
+//! system-level facts live.
+//!
+//! Format — flat JSON map keyed by agent name, values are the parent
+//! agent's name or `null` for root:
+//!
+//! ```json
+//! {
+//!   "manager": null,
+//!   "alice":  "manager",
+//!   "bob":    "alice"
+//! }
+//! ```
+//!
+//! Agents present in `nixos-container list` but absent from the file
+//! default to root-level (`parent = None`). This file is operator/
+//! manager-managed via approval-gated writes (write API lands in a
+//! follow-up PR on the #361 milestone); for the bootstrap commit
+//! `meta::sync_agents` seeds it with the existing implicit topology
+//! (manager as root, all current sub-agents as direct children).
+
+use std::collections::BTreeMap;
+use std::path::PathBuf;
+
+const TOPOLOGY_FILE: &str = "topology.json";
+
+#[must_use]
+pub fn topology_path() -> PathBuf {
+    crate::meta::meta_dir().join(TOPOLOGY_FILE)
+}
+
+/// Snapshot of the topology map. Read on every `container_view::build_all`
+/// and every `render_flake` call. The file is small (one line per agent),
+/// so we re-read rather than caching — keeps the source of truth on disk.
+///
+/// Returns an empty map when the file is absent or unparsable; callers
+/// treat that as "no recorded parents", which falls back to every agent
+/// being root-level. Safe degradation for fresh installs that haven't
+/// run through `meta::sync_agents` yet.
+#[must_use]
+pub fn read() -> BTreeMap<String, Option<String>> {
+    let path = topology_path();
+    let Ok(raw) = std::fs::read_to_string(&path) else {
+        return BTreeMap::new();
+    };
+    serde_json::from_str(&raw).unwrap_or_default()
+}
+
+/// Look up one agent's parent. Returns `None` when the agent is root
+/// or absent from the file. Cheap convenience over `read()` for
+/// callers that want a single entry.
+#[must_use]
+pub fn parent_of(name: &str) -> Option<String> {
+    read().get(name).cloned().flatten()
+}
+
+/// True when `candidate` is `ancestor` or any descendant of
+/// `ancestor` per the current topology. Walks parents from
+/// `candidate` upward; the walk terminates at root or on a cycle
+/// (cycle defence: bounded to 32 hops, more than any plausible
+/// hive depth). Used by the cancel-authorization check in
+/// `manager_server::handle_cancel_schedule` to enforce
+/// "managers can cancel anything their subtree owns."
+#[must_use]
+pub fn is_descendant_of(candidate: &str, ancestor: &str) -> bool {
+    if candidate == ancestor {
+        return true;
+    }
+    let topo = read();
+    let mut cur = candidate.to_owned();
+    for _ in 0..32 {
+        let Some(parent) = topo.get(&cur).cloned().flatten() else {
+            return false;
+        };
+        if parent == ancestor {
+            return true;
+        }
+        cur = parent;
+    }
+    false
+}
+
+/// Persist the topology map. Sorted JSON output (BTreeMap is sorted by
+/// key) keeps git diffs minimal across re-writes. Best-effort —
+/// returns an `io::Error` so callers can decide whether a failure
+/// should abort their op (sync_agents, RequestSetParent) or just log.
+pub fn write(topology: &BTreeMap<String, Option<String>>) -> std::io::Result<()> {
+    let path = topology_path();
+    if let Some(parent) = path.parent() {
+        std::fs::create_dir_all(parent)?;
+    }
+    let text = serde_json::to_string_pretty(topology)
+        .map_err(|e| std::io::Error::new(std::io::ErrorKind::InvalidData, e))?;
+    std::fs::write(&path, format!("{text}\n"))
+}
+
+/// Compute the default topology for a fresh install: every non-manager
+/// agent has the manager as parent; manager itself is root. Used by
+/// `meta::sync_agents` on first call to seed `topology.json`.
+///
+/// As soon as an explicit write lands (#361 follow-up: dashboard /
+/// `RequestSetParent` API), this seeding stops touching pre-existing
+/// entries — `sync_agents` only adds rows for newly-spawned agents
+/// against whatever the operator has configured.
+#[must_use]
+pub fn default_seed(agent_names: &[String]) -> BTreeMap<String, Option<String>> {
+    let mut out = BTreeMap::new();
+    for name in agent_names {
+        if name == crate::lifecycle::MANAGER_NAME {
+            out.insert(name.clone(), None);
+        } else {
+            out.insert(name.clone(), Some(crate::lifecycle::MANAGER_NAME.to_owned()));
+        }
+    }
+    out
+}
+
+/// Pure validation + apply for [`set_parent`]. Splits off so tests
+/// can exercise the rules (cycle / unknown / manager-protect) on
+/// an in-memory `BTreeMap` without touching the on-disk
+/// `topology.json`. Returns either the post-move map (caller
+/// writes it back) or a user-readable error string.
+pub fn apply_set_parent(
+    topo: &BTreeMap<String, Option<String>>,
+    child: &str,
+    new_parent: Option<&str>,
+) -> Result<BTreeMap<String, Option<String>>, String> {
+    if child == crate::lifecycle::MANAGER_NAME {
+        return Err("cannot reparent the manager — it is structurally root".to_owned());
+    }
+    if !topo.contains_key(child) {
+        return Err(format!("unknown agent: {child}"));
+    }
+    if let Some(p) = new_parent {
+        if !topo.contains_key(p) {
+            return Err(format!("unknown parent: {p}"));
+        }
+        if p == child {
+            return Err("an agent cannot be its own parent".to_owned());
+        }
+        // Cycle check: walk `p`'s ancestors in the EXISTING map. If
+        // we hit `child`, then making `child`'s parent = `p` would
+        // close the loop (child → … → p → child).
+        let mut cur = p.to_owned();
+        for _ in 0..32 {
+            if cur == child {
+                return Err(format!(
+                    "cycle: {p} is in {child}'s subtree (would create a loop)"
+                ));
+            }
+            let Some(next) = topo.get(&cur).cloned().flatten() else {
+                break;
+            };
+            cur = next;
+        }
+    }
+    let mut next = topo.clone();
+    next.insert(child.to_owned(), new_parent.map(str::to_owned));
+    Ok(next)
+}
+
+/// Operator-driven parent move (#486 / #487). Set `child`'s parent
+/// to `new_parent` (or `None` to promote to root). See
+/// [`apply_set_parent`] for the validation rules. The operator-set
+/// parent sticks across `reconcile()` calls (which preserves
+/// existing entries).
+///
+/// No bind-mount / container churn today — the hierarchy is
+/// currently logical-only (see #486 comment 5042). Once
+/// sub-manager bind mounts land alongside #361, the caller adds
+/// an umount-old / mount-new / restart-cascade step on top.
+pub fn set_parent(child: &str, new_parent: Option<&str>) -> Result<(), String> {
+    let current = read();
+    // Idempotent no-op fast path: skip the disk write when nothing
+    // changes. apply_set_parent still runs to surface validation
+    // errors (e.g. unknown child) so the caller gets a real signal.
+    let next = apply_set_parent(&current, child, new_parent)?;
+    if next == current {
+        return Ok(());
+    }
+    write(&next).map_err(|e| format!("write topology.json: {e}"))
+}
+
+/// Reconcile `topology.json` against the current agent set. Adds an
+/// entry (default: parent = manager, manager itself = root) for any
+/// agent missing from the file; removes entries for agents no longer
+/// present. Existing entries are preserved as-is — operator/manager
+/// choices stick across regenerations. Returns true when the file
+/// changed and should be re-committed by the caller.
+pub fn reconcile(agent_names: &[String]) -> std::io::Result<bool> {
+    let mut current = read();
+    let mut changed = false;
+    // Add missing agents at their default position.
+    for name in agent_names {
+        if !current.contains_key(name) {
+            let parent = if name == crate::lifecycle::MANAGER_NAME {
+                None
+            } else {
+                Some(crate::lifecycle::MANAGER_NAME.to_owned())
+            };
+            current.insert(name.clone(), parent);
+            changed = true;
+        }
+    }
+    // Drop entries for agents that no longer exist.
+    let known: std::collections::HashSet<_> = agent_names.iter().collect();
+    current.retain(|name, _| {
+        let keep = known.contains(name);
+        if !keep {
+            changed = true;
+        }
+        keep
+    });
+    if changed {
+        write(&current)?;
+    }
+    Ok(changed)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn default_seed_makes_manager_root_others_children() {
+        let agents = vec![
+            "alice".to_owned(),
+            crate::lifecycle::MANAGER_NAME.to_owned(),
+            "bob".to_owned(),
+        ];
+        let seed = default_seed(&agents);
+        assert_eq!(
+            seed.get(crate::lifecycle::MANAGER_NAME),
+            Some(&None),
+            "manager should be root"
+        );
+        assert_eq!(
+            seed.get("alice"),
+            Some(&Some(crate::lifecycle::MANAGER_NAME.to_owned()))
+        );
+        assert_eq!(
+            seed.get("bob"),
+            Some(&Some(crate::lifecycle::MANAGER_NAME.to_owned()))
+        );
+    }
+
+    #[test]
+    fn default_seed_handles_empty_input() {
+        let seed = default_seed(&[]);
+        assert!(seed.is_empty());
+    }
+
+    fn topo_three_level() -> BTreeMap<String, Option<String>> {
+        let mut m = BTreeMap::new();
+        m.insert(crate::lifecycle::MANAGER_NAME.to_owned(), None);
+        m.insert(
+            "alice".to_owned(),
+            Some(crate::lifecycle::MANAGER_NAME.to_owned()),
+        );
+        m.insert("bob".to_owned(), Some("alice".to_owned()));
+        m.insert("carol".to_owned(), Some("alice".to_owned()));
+        m
+    }
+
+    #[test]
+    fn apply_set_parent_promotes_to_root() {
+        let next = apply_set_parent(&topo_three_level(), "alice", None).unwrap();
+        assert_eq!(next.get("alice"), Some(&None));
+    }
+
+    #[test]
+    fn apply_set_parent_reparents_under_sibling_subtree() {
+        // bob and carol both under alice; move carol under bob.
+        let next = apply_set_parent(&topo_three_level(), "carol", Some("bob")).unwrap();
+        assert_eq!(next.get("carol"), Some(&Some("bob".to_owned())));
+    }
+
+    #[test]
+    fn apply_set_parent_refuses_manager_move() {
+        let err =
+            apply_set_parent(&topo_three_level(), crate::lifecycle::MANAGER_NAME, None).unwrap_err();
+        assert!(err.contains("manager"), "err = {err}");
+    }
+
+    #[test]
+    fn apply_set_parent_refuses_unknown_child() {
+        let err = apply_set_parent(&topo_three_level(), "nobody", Some("alice")).unwrap_err();
+        assert!(err.contains("unknown agent"), "err = {err}");
+    }
+
+    #[test]
+    fn apply_set_parent_refuses_unknown_parent() {
+        let err = apply_set_parent(&topo_three_level(), "bob", Some("nobody")).unwrap_err();
+        assert!(err.contains("unknown parent"), "err = {err}");
+    }
+
+    #[test]
+    fn apply_set_parent_refuses_self() {
+        let err = apply_set_parent(&topo_three_level(), "alice", Some("alice")).unwrap_err();
+        assert!(err.contains("own parent"), "err = {err}");
+    }
+
+    #[test]
+    fn apply_set_parent_refuses_cycle() {
+        // bob's parent is alice; trying to make alice's parent =
+        // bob would close the loop alice → bob → alice.
+        let err = apply_set_parent(&topo_three_level(), "alice", Some("bob")).unwrap_err();
+        assert!(err.contains("cycle"), "err = {err}");
+    }
+
+    #[test]
+    fn apply_set_parent_refuses_deep_cycle() {
+        // Three-deep chain: manager → alice → bob → carol. Moving
+        // alice under carol would create the loop alice → carol → bob → alice.
+        let mut topo = BTreeMap::new();
+        topo.insert(crate::lifecycle::MANAGER_NAME.to_owned(), None);
+        topo.insert(
+            "alice".to_owned(),
+            Some(crate::lifecycle::MANAGER_NAME.to_owned()),
+        );
+        topo.insert("bob".to_owned(), Some("alice".to_owned()));
+        topo.insert("carol".to_owned(), Some("bob".to_owned()));
+        let err = apply_set_parent(&topo, "alice", Some("carol")).unwrap_err();
+        assert!(err.contains("cycle"), "err = {err}");
+    }
+
+    #[test]
+    fn apply_set_parent_is_idempotent_noop() {
+        // bob is already under alice — same value returned.
+        let next = apply_set_parent(&topo_three_level(), "bob", Some("alice")).unwrap();
+        assert_eq!(next, topo_three_level());
+    }
+}
diff --git a/hive-forge/Cargo.toml b/hive-forge/Cargo.toml
new file mode 100644
index 00000000..def1915e
--- /dev/null
+++ b/hive-forge/Cargo.toml
@@ -0,0 +1,18 @@
+[package]
+name = "hive-forge"
+edition.workspace = true
+version.workspace = true
+
+[[bin]]
+name = "hive-forge"
+path = "src/main.rs"
+
+[dependencies]
+anyhow = { workspace = true }
+clap = { workspace = true }
+reqwest = { workspace = true, features = ["json", "rustls-tls", "blocking", "multipart"] }
+serde = { workspace = true }
+serde_json = { workspace = true }
+
+[lints]
+workspace = true
diff --git a/hive-forge/src/body.rs b/hive-forge/src/body.rs
new file mode 100644
index 00000000..39341ade
--- /dev/null
+++ b/hive-forge/src/body.rs
@@ -0,0 +1,56 @@
+//! Body-input resolution shared by every verb that posts a body.
+//! Matches the bash `resolve_body` helper (#382): exactly one source
+//! between `--body`, `--body-file`, and piped stdin. Passing both
+//! `--body` and `--body-file` is a clear error.
+
+use std::io::{IsTerminal, Read};
+
+use anyhow::{Context, Result, bail};
+
+/// Resolve the body to send, given the user's explicit flags and the
+/// current stdin state. Returns `None` when none of the sources are
+/// available (the caller decides whether that's allowed — e.g.
+/// `issue-edit` treats absent body as "leave unchanged", while
+/// `comment` treats absent body as a hard error).
+pub fn resolve(body: Option<&str>, file: Option<&str>) -> Result<Option<String>> {
+    if body.is_some() && file.is_some() {
+        bail!("hive-forge: --body and --body-file are mutually exclusive");
+    }
+    if let Some(b) = body {
+        return Ok(Some(b.to_owned()));
+    }
+    if let Some(path) = file {
+        if path == "-" {
+            return Ok(Some(read_stdin().context("read stdin for --body-file -")?));
+        }
+        let s = std::fs::read_to_string(path)
+            .with_context(|| format!("read --body-file {path}"))?;
+        return Ok(Some(s));
+    }
+    if !std::io::stdin().is_terminal() {
+        return Ok(Some(read_stdin().context("read piped stdin")?));
+    }
+    Ok(None)
+}
+
+/// Resolve, then require a non-empty result (whitespace-trimmed).
+/// Used by `comment` / `comment-edit` which refuse to post empty
+/// bodies.
+pub fn resolve_required(body: Option<&str>, file: Option<&str>, verb: &str) -> Result<String> {
+    let resolved = resolve(body, file)?;
+    let Some(s) = resolved else {
+        bail!(
+            "hive-forge {verb}: no body — pass --body <text>, --body-file <path>, or pipe via stdin"
+        );
+    };
+    if s.trim().is_empty() {
+        bail!("hive-forge {verb}: refusing to post empty body");
+    }
+    Ok(s)
+}
+
+fn read_stdin() -> std::io::Result<String> {
+    let mut s = String::new();
+    std::io::stdin().read_to_string(&mut s)?;
+    Ok(s)
+}
diff --git a/hive-forge/src/client.rs b/hive-forge/src/client.rs
new file mode 100644
index 00000000..6e7d47e4
--- /dev/null
+++ b/hive-forge/src/client.rs
@@ -0,0 +1,223 @@
+//! Blocking HTTP client for the Forgejo REST API. Identity is the
+//! per-agent token under `${HYPERHIVE_STATE_DIR}/forge-token`. All
+//! verbs go through this client so error surfaces, header set, and
+//! 4xx/5xx body unwrapping stay consistent.
+
+use std::path::PathBuf;
+
+use anyhow::{Context, Result, bail};
+use reqwest::blocking::{Client as HttpClient, Response};
+use reqwest::header::{ACCEPT, AUTHORIZATION, CONTENT_TYPE, HeaderMap, HeaderValue};
+use serde::Serialize;
+use serde_json::Value;
+
+/// Default Forgejo URL when `HIVE_FORGE_URL` is unset.
+const DEFAULT_URL: &str = "http://localhost:3000";
+
+/// Default repo when `HIVE_FORGE_REPO` is unset and the verb doesn't
+/// take a repo override.
+const DEFAULT_REPO: &str = "hyperhive/hyperhive";
+
+/// Blocking Forgejo API client. Cheap to clone (wraps an
+/// `Arc<reqwest::Client>` internally).
+pub struct Client {
+    http: HttpClient,
+    base: String,
+    /// Default repo used when a verb doesn't carry an explicit
+    /// `[repo]` override.
+    pub default_repo: String,
+    /// Global `--json` flag — verbs that have a human-readable
+    /// default path branch on `client.json_mode()` to pick the
+    /// JSON output shape instead. Closes #421.
+    json_mode: bool,
+}
+
+impl Client {
+    /// Build a client from the standard environment variables.
+    /// `repo_override` (from the global `-r/--repo` flag) takes
+    /// priority over `HIVE_FORGE_REPO`; the env var is the fallback
+    /// default. `json_mode` comes from the global `--json` flag —
+    /// per-verb output formatters key off it via `Client::json_mode`.
+    pub fn from_env(repo_override: Option<String>, json_mode: bool) -> Result<Self> {
+        let base = std::env::var("HIVE_FORGE_URL").unwrap_or_else(|_| DEFAULT_URL.to_owned());
+        let default_repo = repo_override
+            .or_else(|| std::env::var("HIVE_FORGE_REPO").ok())
+            .unwrap_or_else(|| DEFAULT_REPO.to_owned());
+        let token = read_token().context("read forge-token")?;
+
+        let mut headers = HeaderMap::new();
+        let auth = format!("token {token}");
+        let mut auth_val = HeaderValue::from_str(&auth).context("auth header")?;
+        auth_val.set_sensitive(true);
+        headers.insert(AUTHORIZATION, auth_val);
+        headers.insert(ACCEPT, HeaderValue::from_static("application/json"));
+
+        let http = HttpClient::builder()
+            .default_headers(headers)
+            .build()
+            .context("build reqwest client")?;
+        Ok(Self {
+            http,
+            base,
+            default_repo,
+            json_mode,
+        })
+    }
+
+    /// True when the operator passed the global `--json` flag.
+    /// Verbs that have a human-readable default branch on this to
+    /// emit JSON instead. Verbs whose only output format is JSON
+    /// (e.g. `issue`, `pr`) can ignore it.
+    #[must_use]
+    pub fn json_mode(&self) -> bool {
+        self.json_mode
+    }
+
+    /// Resolve the API base path (`<base>/api/v1`).
+    fn api(&self) -> String {
+        format!("{}/api/v1", self.base)
+    }
+
+    /// Return the active repo. `from_env` already folded the
+    /// `-r/--repo` override into `default_repo`, so verbs just read
+    /// it as-is — no per-verb override plumbing.
+    #[must_use]
+    pub fn repo(&self) -> &str {
+        &self.default_repo
+    }
+
+    /// GET `<api>/<path>` and decode JSON.
+    pub fn get_json(&self, path: &str) -> Result<Value> {
+        let url = format!("{}{}", self.api(), path);
+        let resp = self.http.get(&url).send().context("GET")?;
+        decode_json(resp, &format!("GET {url}"))
+    }
+
+    /// GET a paginated list endpoint and concatenate all pages.
+    /// `path` should NOT include `page=` (we own it); other query
+    /// params (`?limit=N&state=open&...`) are preserved. Pages drain
+    /// while the response carries a `Link: rel="next"` header, up to
+    /// `max_pages` (the runaway-loop safety cap). Returns the merged
+    /// array. Used by `lint` for repo-wide queries (closes #505).
+    pub fn get_json_all(&self, path: &str, max_pages: u32) -> Result<Vec<Value>> {
+        let sep = if path.contains('?') { '&' } else { '?' };
+        let mut merged = Vec::new();
+        for page in 1..=max_pages {
+            let url = format!("{}{}{sep}page={page}", self.api(), path);
+            let resp = self.http.get(&url).send().context("GET")?;
+            let has_next = resp
+                .headers()
+                .get(reqwest::header::LINK)
+                .and_then(|v| v.to_str().ok())
+                .is_some_and(|s| s.contains("rel=\"next\""));
+            let v = decode_json(resp, &format!("GET {url}"))?;
+            let arr = v.as_array().cloned().unwrap_or_default();
+            let empty = arr.is_empty();
+            merged.extend(arr);
+            if empty || !has_next {
+                break;
+            }
+        }
+        Ok(merged)
+    }
+
+    /// GET `<api>/<path>` and return the raw response body as text
+    /// (used by `diff` which fetches a `text/plain` blob).
+    pub fn get_text(&self, path: &str, accept: &str) -> Result<String> {
+        let url = format!("{}{}", self.api(), path);
+        let resp = self
+            .http
+            .get(&url)
+            .header(ACCEPT, accept)
+            .send()
+            .context("GET")?;
+        decode_text(resp, &format!("GET {url}"))
+    }
+
+    /// POST a JSON body to `<api>/<path>` and decode the response.
+    pub fn post_json<B: Serialize>(&self, path: &str, body: &B) -> Result<Value> {
+        let url = format!("{}{}", self.api(), path);
+        let resp = self
+            .http
+            .post(&url)
+            .header(CONTENT_TYPE, "application/json")
+            .json(body)
+            .send()
+            .context("POST")?;
+        decode_json(resp, &format!("POST {url}"))
+    }
+
+    /// PATCH a JSON body to `<api>/<path>` and decode the response.
+    pub fn patch_json<B: Serialize>(&self, path: &str, body: &B) -> Result<Value> {
+        let url = format!("{}{}", self.api(), path);
+        let resp = self
+            .http
+            .patch(&url)
+            .header(CONTENT_TYPE, "application/json")
+            .json(body)
+            .send()
+            .context("PATCH")?;
+        decode_json(resp, &format!("PATCH {url}"))
+    }
+
+    /// DELETE `<api>/<path>`. Optional JSON body for endpoints that
+    /// need it (Forgejo's subscription unwatch uses bodyless DELETE).
+    pub fn delete(&self, path: &str, body: Option<&Value>) -> Result<()> {
+        let url = format!("{}{}", self.api(), path);
+        let mut req = self.http.delete(&url);
+        if let Some(b) = body {
+            req = req.header(CONTENT_TYPE, "application/json").json(b);
+        }
+        let resp = req.send().context("DELETE")?;
+        check_status(resp, &format!("DELETE {url}"))?;
+        Ok(())
+    }
+
+    /// POST a multipart file upload, returning the parsed response.
+    /// Used by `attach-issue` / `attach-comment`.
+    pub fn post_multipart_file(&self, path: &str, file: &std::path::Path) -> Result<Value> {
+        let url = format!("{}{}", self.api(), path);
+        let form = reqwest::blocking::multipart::Form::new()
+            .file("attachment", file)
+            .with_context(|| format!("read {}", file.display()))?;
+        let resp = self.http.post(&url).multipart(form).send().context("POST")?;
+        decode_json(resp, &format!("POST {url}"))
+    }
+}
+
+/// Locate and read the forge token. Falls back to `$PWD/forge-token`
+/// when `HYPERHIVE_STATE_DIR` isn't set, matching the bash helper.
+fn read_token() -> Result<String> {
+    let state_dir = std::env::var("HYPERHIVE_STATE_DIR").unwrap_or_default();
+    let path = if state_dir.is_empty() {
+        PathBuf::from("forge-token")
+    } else {
+        PathBuf::from(state_dir).join("forge-token")
+    };
+    let raw = std::fs::read_to_string(&path)
+        .with_context(|| format!("hive-forge: no forge-token at {}", path.display()))?;
+    Ok(raw.trim().to_owned())
+}
+
+/// Surface non-2xx HTTP responses as anyhow errors with the response
+/// body included (matches `curl --fail-with-body`). Closes #353's
+/// "silent failures with no clue what went wrong" case.
+fn check_status(resp: Response, op: &str) -> Result<Response> {
+    let status = resp.status();
+    if status.is_success() {
+        return Ok(resp);
+    }
+    let body = resp.text().unwrap_or_default();
+    bail!("hive-forge: {op} failed ({status}): {body}");
+}
+
+fn decode_json(resp: Response, op: &str) -> Result<Value> {
+    let resp = check_status(resp, op)?;
+    resp.json::<Value>()
+        .with_context(|| format!("decode JSON for {op}"))
+}
+
+fn decode_text(resp: Response, op: &str) -> Result<String> {
+    let resp = check_status(resp, op)?;
+    resp.text().with_context(|| format!("decode text for {op}"))
+}
diff --git a/hive-forge/src/main.rs b/hive-forge/src/main.rs
new file mode 100644
index 00000000..e26a06f4
--- /dev/null
+++ b/hive-forge/src/main.rs
@@ -0,0 +1,124 @@
+//! `hive-forge` — typed CLI wrapper around the in-cluster Forgejo's
+//! REST API. Reads credentials from the environment:
+//!
+//!   `HIVE_FORGE_URL`      — base URL, e.g. `http://localhost:3000`
+//!   `HIVE_FORGE_REPO`     — default repo, e.g. `hyperhive/hyperhive`
+//!   `HYPERHIVE_STATE_DIR` — state dir; `forge-token` lives here
+//!
+//! Single binary with verb subcommands. Replaces the prior bash
+//! script (`hive-forge-tools.nix`) so that agents and operators get
+//! the same error handling, exit codes, and JSON shapes regardless
+//! of how the bash mood was that day (closes #280).
+
+#![warn(missing_docs)]
+// Clap-derived `Args` structs are intentionally consumed by their
+// per-verb `run` handler so we can move owned String fields out
+// without cloning. The pedantic lint flags every one of them.
+#![allow(clippy::needless_pass_by_value)]
+
+mod body;
+mod client;
+mod verbs;
+
+use anyhow::{Context, Result};
+use clap::{Parser, Subcommand};
+
+#[derive(Parser)]
+#[command(
+    name = "hive-forge",
+    about = "Forgejo CLI wrapper for hyperhive (closes #280)",
+    disable_help_subcommand = true
+)]
+struct Cli {
+    /// Repo override (default from `HIVE_FORGE_REPO`).
+    /// Applies to any verb; replaces the per-verb `[repo]` trailing
+    /// positional the bash helper used.
+    #[arg(short = 'r', long, global = true)]
+    repo: Option<String>,
+    /// Emit JSON output instead of the verb's default human-readable
+    /// shape, for verbs that support both (closes #421). Verbs whose
+    /// only output is already JSON (`issue`, `pr`, etc.) ignore this
+    /// flag — they always print JSON regardless.
+    #[arg(long, global = true)]
+    json: bool,
+    #[command(subcommand)]
+    verb: Verb,
+}
+
+#[derive(Subcommand)]
+enum Verb {
+    /// Dump title + body + all comments for an issue or PR.
+    View(verbs::view::Args),
+    /// Print key fields of an issue as JSON.
+    Issue(verbs::issue::Args),
+    /// Create an issue. Prints the issue URL on success.
+    IssueCreate(verbs::issue_create::Args),
+    /// Edit an issue's title, body, state, or milestone.
+    IssueEdit(verbs::issue_edit::Args),
+    /// Print key fields of a PR as JSON.
+    Pr(verbs::pr::Args),
+    /// Create a pull request. Prints the PR URL on success.
+    PrCreate(verbs::pr_create::Args),
+    /// Post a comment on an issue or PR.
+    Comment(verbs::comment::Args),
+    /// List all comments on an issue or PR.
+    Comments(verbs::comments::Args),
+    /// Print the body (or full JSON) of a single comment by id.
+    CommentShow(verbs::comment_show::Args),
+    /// Edit an existing comment by id.
+    CommentEdit(verbs::comment_edit::Args),
+    /// Assign or unassign a user on an issue or PR.
+    Assign(verbs::assign::Args),
+    /// Close an issue or PR.
+    Close(verbs::close::Args),
+    /// List, add, or remove labels on an issue or PR.
+    Labels(verbs::labels::Args),
+    /// Triage lint queries (unassigned / no-reviewer / stale-branches / assignments).
+    Lint(verbs::lint::Args),
+    /// Manage milestones (list / create / close).
+    Milestone(verbs::milestone::Args),
+    /// List reviews on a PR.
+    PrReviews(verbs::pr_reviews::Args),
+    /// List branches, optionally filtered.
+    Branches(verbs::branches::Args),
+    /// Print the tree SHA at a branch or commit.
+    TreeSha(verbs::tree_sha::Args),
+    /// Print the unified diff for a PR.
+    Diff(verbs::diff::Args),
+    /// Get or set this user's watch subscription on a repo.
+    Subscription(verbs::subscription::Args),
+    /// Upload a file as an attachment to an issue.
+    AttachIssue(verbs::attach::IssueArgs),
+    /// Upload a file as an attachment to a comment.
+    AttachComment(verbs::attach::CommentArgs),
+}
+
+fn main() -> Result<()> {
+    let cli = Cli::parse();
+    let client =
+        client::Client::from_env(cli.repo, cli.json).context("initialize forge client")?;
+    match cli.verb {
+        Verb::View(a) => verbs::view::run(&client, a),
+        Verb::Issue(a) => verbs::issue::run(&client, a),
+        Verb::IssueCreate(a) => verbs::issue_create::run(&client, a),
+        Verb::IssueEdit(a) => verbs::issue_edit::run(&client, a),
+        Verb::Pr(a) => verbs::pr::run(&client, a),
+        Verb::PrCreate(a) => verbs::pr_create::run(&client, a),
+        Verb::Comment(a) => verbs::comment::run(&client, a),
+        Verb::Comments(a) => verbs::comments::run(&client, a),
+        Verb::CommentShow(a) => verbs::comment_show::run(&client, a),
+        Verb::CommentEdit(a) => verbs::comment_edit::run(&client, a),
+        Verb::Assign(a) => verbs::assign::run(&client, a),
+        Verb::Close(a) => verbs::close::run(&client, a),
+        Verb::Labels(a) => verbs::labels::run(&client, a),
+        Verb::Lint(a) => verbs::lint::run(&client, a),
+        Verb::Milestone(a) => verbs::milestone::run(&client, a),
+        Verb::PrReviews(a) => verbs::pr_reviews::run(&client, a),
+        Verb::Branches(a) => verbs::branches::run(&client, a),
+        Verb::TreeSha(a) => verbs::tree_sha::run(&client, a),
+        Verb::Diff(a) => verbs::diff::run(&client, a),
+        Verb::Subscription(a) => verbs::subscription::run(&client, a),
+        Verb::AttachIssue(a) => verbs::attach::run_issue(&client, a),
+        Verb::AttachComment(a) => verbs::attach::run_comment(&client, a),
+    }
+}
diff --git a/hive-forge/src/verbs/assign.rs b/hive-forge/src/verbs/assign.rs
new file mode 100644
index 00000000..5c9ed713
--- /dev/null
+++ b/hive-forge/src/verbs/assign.rs
@@ -0,0 +1,58 @@
+//! `assign <number> <user> [--remove]` — add or remove a user from an
+//! issue/PR's assignee list. Forgejo has no dedicated POST endpoint —
+//! we read the current list, mutate, and PATCH the issue back (closes
+//! #353's "no such endpoint" trap; matches the bash helper's logic).
+
+use anyhow::Result;
+use clap::Args as ClapArgs;
+use serde_json::{Value, json};
+
+use crate::client::Client;
+use crate::verbs::print_json;
+
+#[derive(ClapArgs)]
+pub struct Args {
+    /// Issue or PR number.
+    number: u64,
+    /// User login to assign (or unassign with `--remove`).
+    user: String,
+    /// Remove the user instead of adding.
+    #[arg(long)]
+    remove: bool,
+}
+
+pub fn run(client: &Client, args: Args) -> Result<()> {
+    let repo = client.repo();
+    let current = client.get_json(&format!("/repos/{repo}/issues/{}", args.number))?;
+    let mut assignees: Vec<String> = current
+        .get("assignees")
+        .and_then(Value::as_array)
+        .map(|a| {
+            a.iter()
+                .filter_map(|u| u.get("login").and_then(Value::as_str).map(str::to_owned))
+                .collect()
+        })
+        .unwrap_or_default();
+    if args.remove {
+        assignees.retain(|u| u != &args.user);
+    } else if !assignees.contains(&args.user) {
+        assignees.push(args.user.clone());
+    }
+    let resp = client.patch_json(
+        &format!("/repos/{repo}/issues/{}", args.number),
+        &json!({ "assignees": assignees }),
+    )?;
+    let logins: Vec<&str> = resp
+        .get("assignees")
+        .and_then(Value::as_array)
+        .map(|a| {
+            a.iter()
+                .filter_map(|u| u.get("login").and_then(Value::as_str))
+                .collect()
+        })
+        .unwrap_or_default();
+    print_json(&json!({
+        "number": resp.get("number"),
+        "assignees": logins,
+    }))
+}
diff --git a/hive-forge/src/verbs/attach.rs b/hive-forge/src/verbs/attach.rs
new file mode 100644
index 00000000..91e621ba
--- /dev/null
+++ b/hive-forge/src/verbs/attach.rs
@@ -0,0 +1,65 @@
+//! `attach-issue <number> <file>` and `attach-comment <comment-id>
+//! <file>` — upload a file as an attachment. Prints the browser
+//! download URL.
+
+use std::path::PathBuf;
+
+use anyhow::{Result, bail};
+use clap::Args as ClapArgs;
+use serde_json::Value;
+
+use crate::client::Client;
+
+#[derive(ClapArgs)]
+pub struct IssueArgs {
+    /// Issue number.
+    number: u64,
+    /// File path to upload.
+    file: PathBuf,
+}
+
+#[derive(ClapArgs)]
+pub struct CommentArgs {
+    /// Comment id.
+    id: u64,
+    /// File path to upload.
+    file: PathBuf,
+}
+
+pub fn run_issue(client: &Client, args: IssueArgs) -> Result<()> {
+    if !args.file.is_file() {
+        bail!(
+            "hive-forge attach-issue: file not found: {}",
+            args.file.display()
+        );
+    }
+    let repo = client.repo();
+    let resp = client.post_multipart_file(
+        &format!("/repos/{repo}/issues/{}/assets", args.number),
+        &args.file,
+    )?;
+    print_url(&resp);
+    Ok(())
+}
+
+pub fn run_comment(client: &Client, args: CommentArgs) -> Result<()> {
+    if !args.file.is_file() {
+        bail!(
+            "hive-forge attach-comment: file not found: {}",
+            args.file.display()
+        );
+    }
+    let repo = client.repo();
+    let resp = client.post_multipart_file(
+        &format!("/repos/{repo}/issues/comments/{}/assets", args.id),
+        &args.file,
+    )?;
+    print_url(&resp);
+    Ok(())
+}
+
+fn print_url(v: &Value) {
+    if let Some(url) = v.get("browser_download_url").and_then(Value::as_str) {
+        println!("{url}");
+    }
+}
diff --git a/hive-forge/src/verbs/branches.rs b/hive-forge/src/verbs/branches.rs
new file mode 100644
index 00000000..287f5024
--- /dev/null
+++ b/hive-forge/src/verbs/branches.rs
@@ -0,0 +1,32 @@
+//! `branches [pattern] [repo]` — list branches, optionally filtered.
+
+use anyhow::Result;
+use clap::Args as ClapArgs;
+use serde_json::Value;
+
+use crate::client::Client;
+
+#[derive(ClapArgs)]
+pub struct Args {
+    /// Substring pattern to filter branch names.
+    pattern: Option<String>,
+}
+
+pub fn run(client: &Client, args: Args) -> Result<()> {
+    let repo = client.repo();
+    let v = client.get_json(&format!("/repos/{repo}/branches?limit=100"))?;
+    let names: Vec<&str> = v
+        .as_array()
+        .map(|a| {
+            a.iter()
+                .filter_map(|b| b.get("name").and_then(Value::as_str))
+                .collect()
+        })
+        .unwrap_or_default();
+    for n in names {
+        if args.pattern.as_deref().is_none_or(|p| n.contains(p)) {
+            println!("{n}");
+        }
+    }
+    Ok(())
+}
diff --git a/hive-forge/src/verbs/close.rs b/hive-forge/src/verbs/close.rs
new file mode 100644
index 00000000..0d01ce27
--- /dev/null
+++ b/hive-forge/src/verbs/close.rs
@@ -0,0 +1,26 @@
+//! `close <number>` — close an issue or PR.
+
+use anyhow::Result;
+use clap::Args as ClapArgs;
+use serde_json::json;
+
+use crate::client::Client;
+use crate::verbs::print_json;
+
+#[derive(ClapArgs)]
+pub struct Args {
+    /// Issue or PR number.
+    number: u64,
+}
+
+pub fn run(client: &Client, args: Args) -> Result<()> {
+    let repo = client.repo();
+    let resp = client.patch_json(
+        &format!("/repos/{repo}/issues/{}", args.number),
+        &json!({ "state": "closed" }),
+    )?;
+    print_json(&json!({
+        "number": resp.get("number"),
+        "state": resp.get("state"),
+    }))
+}
diff --git a/hive-forge/src/verbs/comment.rs b/hive-forge/src/verbs/comment.rs
new file mode 100644
index 00000000..e2aece1a
--- /dev/null
+++ b/hive-forge/src/verbs/comment.rs
@@ -0,0 +1,35 @@
+//! `comment <number> [body sources] [repo]` — post a comment on an
+//! issue or PR.
+
+use anyhow::Result;
+use clap::Args as ClapArgs;
+use serde_json::json;
+
+use crate::body;
+use crate::client::Client;
+use crate::verbs::print_json;
+
+#[derive(ClapArgs)]
+pub struct Args {
+    /// Issue or PR number.
+    number: u64,
+    /// Inline body text.
+    #[arg(long, conflicts_with = "body_file")]
+    body: Option<String>,
+    /// Read body from a file. `-` means stdin.
+    #[arg(long = "body-file")]
+    body_file: Option<String>,
+}
+
+pub fn run(client: &Client, args: Args) -> Result<()> {
+    let body = body::resolve_required(args.body.as_deref(), args.body_file.as_deref(), "comment")?;
+    let repo = client.repo();
+    let resp = client.post_json(
+        &format!("/repos/{repo}/issues/{}/comments", args.number),
+        &json!({ "body": body }),
+    )?;
+    print_json(&json!({
+        "id": resp.get("id"),
+        "url": resp.get("html_url"),
+    }))
+}
diff --git a/hive-forge/src/verbs/comment_edit.rs b/hive-forge/src/verbs/comment_edit.rs
new file mode 100644
index 00000000..c271a399
--- /dev/null
+++ b/hive-forge/src/verbs/comment_edit.rs
@@ -0,0 +1,40 @@
+//! `comment-edit <id> [body sources] [repo]` — edit an existing
+//! comment by id.
+
+use anyhow::Result;
+use clap::Args as ClapArgs;
+use serde_json::json;
+
+use crate::body;
+use crate::client::Client;
+use crate::verbs::print_json;
+
+#[derive(ClapArgs)]
+pub struct Args {
+    /// Comment id.
+    id: u64,
+    /// Inline body text.
+    #[arg(long, conflicts_with = "body_file")]
+    body: Option<String>,
+    /// Read body from a file. `-` means stdin.
+    #[arg(long = "body-file")]
+    body_file: Option<String>,
+}
+
+pub fn run(client: &Client, args: Args) -> Result<()> {
+    let body = body::resolve_required(
+        args.body.as_deref(),
+        args.body_file.as_deref(),
+        "comment-edit",
+    )?;
+    let repo = client.repo();
+    let resp = client.patch_json(
+        &format!("/repos/{repo}/issues/comments/{}", args.id),
+        &json!({ "body": body }),
+    )?;
+    print_json(&json!({
+        "id": resp.get("id"),
+        "user": resp.get("user").and_then(|u| u.get("login")),
+        "url": resp.get("html_url"),
+    }))
+}
diff --git a/hive-forge/src/verbs/comment_show.rs b/hive-forge/src/verbs/comment_show.rs
new file mode 100644
index 00000000..65e6e8bb
--- /dev/null
+++ b/hive-forge/src/verbs/comment_show.rs
@@ -0,0 +1,35 @@
+//! `comment-show <id>` — print the body (or full JSON envelope
+//! when `--json` is set globally) of a single comment by id.
+
+use anyhow::Result;
+use clap::Args as ClapArgs;
+use serde_json::{Value, json};
+
+use crate::client::Client;
+use crate::verbs::print_json;
+
+#[derive(ClapArgs)]
+pub struct Args {
+    /// Comment id.
+    id: u64,
+}
+
+pub fn run(client: &Client, args: Args) -> Result<()> {
+    let repo = client.repo();
+    let v = client.get_json(&format!("/repos/{repo}/issues/comments/{}", args.id))?;
+    if client.json_mode() {
+        let trimmed = json!({
+            "id": v.get("id"),
+            "user": v.get("user").and_then(|u| u.get("login")),
+            "created_at": v.get("created_at"),
+            "updated_at": v.get("updated_at"),
+            "body": v.get("body"),
+            "url": v.get("html_url"),
+        });
+        print_json(&trimmed)
+    } else {
+        let body = v.get("body").and_then(Value::as_str).unwrap_or("");
+        println!("{body}");
+        Ok(())
+    }
+}
diff --git a/hive-forge/src/verbs/comments.rs b/hive-forge/src/verbs/comments.rs
new file mode 100644
index 00000000..ad9aecb8
--- /dev/null
+++ b/hive-forge/src/verbs/comments.rs
@@ -0,0 +1,60 @@
+//! `comments <number> [--limit N]` — list all comments on an issue
+//! or PR. Closes the curl-fallback gap (#418). Use the global
+//! `--json` flag for JSON output (#421).
+
+use anyhow::Result;
+use clap::Args as ClapArgs;
+use serde_json::{Value, json};
+
+use crate::client::Client;
+use crate::verbs::print_json;
+
+#[derive(ClapArgs)]
+pub struct Args {
+    /// Issue or PR number.
+    number: u64,
+    /// Page size (Forgejo caps at 50 by default).
+    #[arg(long, default_value_t = 50)]
+    limit: u64,
+}
+
+pub fn run(client: &Client, args: Args) -> Result<()> {
+    let repo = client.repo();
+    let v = client.get_json(&format!(
+        "/repos/{repo}/issues/{}/comments?limit={}",
+        args.number, args.limit
+    ))?;
+    if client.json_mode() {
+        let trimmed: Vec<Value> = v
+            .as_array()
+            .map(|a| {
+                a.iter()
+                    .map(|c| {
+                        json!({
+                            "id": c.get("id"),
+                            "user": c.get("user").and_then(|u| u.get("login")),
+                            "created_at": c.get("created_at"),
+                            "updated_at": c.get("updated_at"),
+                            "body": c.get("body"),
+                            "url": c.get("html_url"),
+                        })
+                    })
+                    .collect()
+            })
+            .unwrap_or_default();
+        print_json(&Value::Array(trimmed))
+    } else {
+        for c in v.as_array().cloned().unwrap_or_default() {
+            let user = c
+                .get("user")
+                .and_then(|u| u.get("login"))
+                .and_then(Value::as_str)
+                .unwrap_or("?");
+            let ts = c.get("created_at").and_then(Value::as_str).unwrap_or("?");
+            let body = c.get("body").and_then(Value::as_str).unwrap_or("");
+            println!("**{user} @ {ts}**: {body}");
+            println!();
+        }
+        Ok(())
+    }
+}
diff --git a/hive-forge/src/verbs/diff.rs b/hive-forge/src/verbs/diff.rs
new file mode 100644
index 00000000..e35793b9
--- /dev/null
+++ b/hive-forge/src/verbs/diff.rs
@@ -0,0 +1,413 @@
+//! `diff <pr> [repo]` — print the unified diff for a PR.
+//!
+//! By default the hunks for known autogenerated lockfiles
+//! (`flake.lock`, `Cargo.lock`, `package-lock.json`, …) are
+//! collapsed to a `[<path>: +N -M (autogenerated; pass --full for
+//! content)]` placeholder so a `flake.lock` rev bump doesn't drown
+//! the human-authored changes in 5 000 lines of lock churn
+//! (#222). The header (`diff --git`, `index`, `---`, `+++`,
+//! rename / mode metadata) is preserved so the reader can still
+//! see WHICH lockfiles changed; the +/- counts give a `diff
+//! --stat`-style magnitude (excluding the `@@` hunk header).
+//! Pass `--full` to dump the unfiltered diff.
+
+use anyhow::Result;
+use clap::Args as ClapArgs;
+
+use crate::client::Client;
+
+#[derive(ClapArgs)]
+pub struct Args {
+    /// PR number.
+    number: u64,
+    /// Print the unfiltered diff including autogenerated-file
+    /// hunks (`flake.lock`, `Cargo.lock`, etc.). Default is to
+    /// collapse those hunks to a placeholder so the human-authored
+    /// changes aren't drowned in lock churn.
+    #[arg(long)]
+    full: bool,
+}
+
+pub fn run(client: &Client, args: Args) -> Result<()> {
+    let repo = client.repo();
+    let diff = client.get_text(&format!("/repos/{repo}/pulls/{}.diff", args.number), "text/plain")?;
+    let out = if args.full {
+        diff
+    } else {
+        collapse_autogenerated(&diff)
+    };
+    print!("{out}");
+    Ok(())
+}
+
+/// Walk a unified diff line-by-line. For each per-file section
+/// whose target path matches a known autogenerated file
+/// (`is_autogenerated`), drop every line from the first hunk
+/// header (`@@`) onward and emit a single `diff --stat`-style
+/// `[file.lock: +N -M (autogenerated, --full for content)]`
+/// placeholder before the next file. Non-autogenerated files
+/// pass through unchanged.
+fn collapse_autogenerated(diff: &str) -> String {
+    let mut out = String::with_capacity(diff.len());
+    let mut state: Option<CollapseState> = None;
+
+    for line in diff.lines() {
+        if let Some(rest) = line.strip_prefix("diff --git ") {
+            // New file section — flush prior collapse counter.
+            if let Some(s) = state.take() {
+                out.push_str(&s.placeholder());
+            }
+            let path = parse_diff_git_path(rest);
+            if let Some(p) = path.as_deref()
+                && is_autogenerated(p)
+            {
+                state = Some(CollapseState::new(p.to_owned()));
+            }
+            out.push_str(line);
+            out.push('\n');
+            continue;
+        }
+        if let Some(s) = state.as_mut() {
+            // First `@@` marks the boundary between file header and
+            // hunk content; everything from this point is
+            // suppressed (and tallied) while `state` is Some.
+            if !s.in_body && line.starts_with("@@") {
+                s.in_body = true;
+            }
+            if s.in_body {
+                // The hunk header `@@` itself counts as a body line
+                // for the +/− tally only via its descendant content
+                // lines; skip it for the counters.
+                if !line.starts_with("@@") {
+                    match line.as_bytes().first() {
+                        Some(b'+') => s.added += 1,
+                        Some(b'-') => s.removed += 1,
+                        _ => {}
+                    }
+                }
+                continue;
+            }
+        }
+        out.push_str(line);
+        out.push('\n');
+    }
+    if let Some(s) = state.take() {
+        out.push_str(&s.placeholder());
+    }
+    out
+}
+
+/// Per-file accumulator for the collapsed-hunk placeholder. Tracks
+/// the file's display name plus `+`/`−` line counts (excluding the
+/// `@@` hunk header), so the placeholder shows operator-meaningful
+/// magnitude instead of "N lines omitted" (which mixed context +
+/// added + removed indistinguishably).
+struct CollapseState {
+    path: String,
+    in_body: bool,
+    added: u32,
+    removed: u32,
+}
+
+impl CollapseState {
+    fn new(path: String) -> Self {
+        Self {
+            path,
+            in_body: false,
+            added: 0,
+            removed: 0,
+        }
+    }
+
+    fn placeholder(&self) -> String {
+        format!(
+            "[{}: +{} -{} (autogenerated; pass --full for content)]\n",
+            self.path, self.added, self.removed
+        )
+    }
+}
+
+/// `rest` is everything after `diff --git `, e.g. `a/foo b/foo`
+/// or `"a/path with space" "b/path with space"`. Return the
+/// post-rename (`b/`-side) path so renames report the new path.
+///
+/// Git uses C-style quoting (`\"`, `\\`, octal escapes) for paths
+/// with spaces or unusual bytes — we don't unescape because we
+/// only need the bytewise file name for the lockfile allowlist
+/// match. We do parse the quoted-vs-unquoted form correctly so a
+/// whitespace-containing path doesn't break `split_whitespace`.
+fn parse_diff_git_path(rest: &str) -> Option<String> {
+    if let Some(after_open) = rest.strip_prefix('"') {
+        // Quoted form: `"a/<path>" "b/<path>"`. Find the closing
+        // quote of the a-side (skipping `\"` escapes so a path
+        // containing `"` doesn't terminate early).
+        let mut iter = after_open.char_indices();
+        let mut a_close = None;
+        loop {
+            let Some((i, c)) = iter.next() else { break };
+            if c == '\\' {
+                // Skip the next char — it's part of the escape.
+                iter.next();
+                continue;
+            }
+            if c == '"' {
+                a_close = Some(i);
+                break;
+            }
+        }
+        let a_close = a_close?;
+        // After the a-side closing quote, we expect `" "b/...`.
+        // `after_open` skipped the leading `"`, so the b-side
+        // starts in `after_open[a_close + 1..]` — strip leading
+        // space + opening quote + `b/`, then strip trailing `"`.
+        let after_a = after_open.get(a_close + 1..)?;
+        let after_a = after_a.strip_prefix(' ')?;
+        let b_inside = after_a.strip_prefix('"')?;
+        // Find b-side's closing quote with the same escape rule.
+        let mut iter = b_inside.char_indices();
+        let mut b_close = None;
+        loop {
+            let Some((i, c)) = iter.next() else { break };
+            if c == '\\' {
+                iter.next();
+                continue;
+            }
+            if c == '"' {
+                b_close = Some(i);
+                break;
+            }
+        }
+        let b_close = b_close?;
+        let b_path = b_inside.get(..b_close)?;
+        Some(b_path.strip_prefix("b/").unwrap_or(b_path).to_owned())
+    } else {
+        // Unquoted: paths have no whitespace, so `split_whitespace`
+        // gives exactly two tokens.
+        let token = rest.split_whitespace().nth(1)?;
+        Some(token.strip_prefix("b/").unwrap_or(token).to_owned())
+    }
+}
+
+/// File-name match against a small whitelist of well-known
+/// machine-generated lockfiles. We deliberately don't pattern-match
+/// extensions like `*.lock` because some real human-authored files
+/// use that suffix (e.g. `keep.lock` config markers); explicit
+/// listing avoids surprising the user.
+fn is_autogenerated(path: &str) -> bool {
+    let name = path.rsplit('/').next().unwrap_or(path);
+    matches!(
+        name,
+        "flake.lock"
+            | "Cargo.lock"
+            | "package-lock.json"
+            | "pnpm-lock.yaml"
+            | "yarn.lock"
+            | "Gemfile.lock"
+            | "poetry.lock"
+            | "Pipfile.lock"
+            | "composer.lock"
+            | "go.sum"
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn detects_known_lockfiles() {
+        assert!(is_autogenerated("flake.lock"));
+        assert!(is_autogenerated("a/flake.lock"));
+        assert!(is_autogenerated("hive-c0re/Cargo.lock"));
+        assert!(is_autogenerated("frontend/packages/dashboard/package-lock.json"));
+        assert!(!is_autogenerated("src/main.rs"));
+        assert!(!is_autogenerated("Cargo.toml"));
+        // Suffix-only files we deliberately don't match — keep
+        // `is_autogenerated` allowlist-driven, not pattern-driven.
+        assert!(!is_autogenerated("config/keep.lock"));
+    }
+
+    #[test]
+    fn collapse_replaces_lockfile_hunks_with_placeholder() {
+        let diff = "\
+diff --git a/Cargo.lock b/Cargo.lock
+index 1111..2222 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -1,3 +1,3 @@
+ [[package]]
+-name = \"old\"
++name = \"new\"
+diff --git a/src/main.rs b/src/main.rs
+index 3333..4444 100644
+--- a/src/main.rs
++++ b/src/main.rs
+@@ -1,2 +1,2 @@
+-fn main() {}
++fn main() { println!(\"hi\"); }
+";
+        let out = collapse_autogenerated(diff);
+        assert!(out.contains("diff --git a/Cargo.lock"));
+        assert!(out.contains("--- a/Cargo.lock"));
+        assert!(out.contains("+++ b/Cargo.lock"));
+        assert!(!out.contains("[[package]]"));
+        // Stat-style placeholder: 1 added (`+name = "new"`), 1
+        // removed (`-name = "old"`); context line and `@@` header
+        // don't count.
+        assert!(
+            out.contains("[Cargo.lock: +1 -1"),
+            "expected stat placeholder, got: {out}"
+        );
+        // Non-lockfile file passes through untouched.
+        assert!(out.contains("fn main() {}"));
+        assert!(out.contains("println!(\"hi\")"));
+    }
+
+    #[test]
+    fn collapse_passes_normal_diff_through() {
+        let diff = "\
+diff --git a/src/lib.rs b/src/lib.rs
+index aaaa..bbbb 100644
+--- a/src/lib.rs
++++ b/src/lib.rs
+@@ -1,1 +1,1 @@
+-fn old() {}
++fn new() {}
+";
+        let out = collapse_autogenerated(diff);
+        assert_eq!(out, diff);
+    }
+
+    #[test]
+    fn collapse_handles_trailing_lockfile() {
+        // Lockfile is the LAST file in the diff — exercises the
+        // post-loop flush path.
+        let diff = "\
+diff --git a/README.md b/README.md
+index aaaa..bbbb 100644
+--- a/README.md
++++ b/README.md
+@@ -1,1 +1,1 @@
+-old
++new
+diff --git a/flake.lock b/flake.lock
+index 1111..2222 100644
+--- a/flake.lock
++++ b/flake.lock
+@@ -1,2 +1,2 @@
+ lock-line-one
+-lock-line-two
++lock-line-two-bumped
+";
+        let out = collapse_autogenerated(diff);
+        assert!(out.contains("-old"));
+        assert!(out.contains("+new"));
+        assert!(out.contains("diff --git a/flake.lock"));
+        assert!(!out.contains("lock-line-one"));
+        assert!(
+            out.contains("[flake.lock: +1 -1"),
+            "expected stat placeholder, got: {out}"
+        );
+    }
+
+    #[test]
+    fn collapse_counts_distinguish_added_and_removed() {
+        // Big asymmetric churn — flake.lock rev bump with several
+        // adds and one removal in the worker fields. Verifies
+        // we don't conflate `+`/`-` totals.
+        let diff = "\
+diff --git a/flake.lock b/flake.lock
+index 1111..2222 100644
+--- a/flake.lock
++++ b/flake.lock
+@@ -1,5 +1,8 @@
+ {
+-  \"old\": 1
++  \"new\": 1,
++  \"another\": 2,
++  \"and\": 3,
++  \"more\": 4
+ }
+";
+        let out = collapse_autogenerated(diff);
+        assert!(
+            out.contains("[flake.lock: +4 -1"),
+            "expected +4 -1, got: {out}"
+        );
+    }
+
+    #[test]
+    fn parse_diff_git_path_picks_b_side() {
+        assert_eq!(
+            parse_diff_git_path("a/foo b/foo"),
+            Some("foo".to_owned())
+        );
+        assert_eq!(
+            parse_diff_git_path("a/old.txt b/new.txt"),
+            Some("new.txt".to_owned())
+        );
+        assert_eq!(
+            parse_diff_git_path("a/dir/Cargo.lock b/dir/Cargo.lock"),
+            Some("dir/Cargo.lock".to_owned())
+        );
+    }
+
+    #[test]
+    fn parse_diff_git_path_handles_quoted_paths_with_spaces() {
+        // Git quotes paths with spaces / unusual chars per
+        // `core.quotePath`. The b-side path must survive intact.
+        assert_eq!(
+            parse_diff_git_path("\"a/foo bar\" \"b/foo bar\""),
+            Some("foo bar".to_owned())
+        );
+        // Rename with quoted sides.
+        assert_eq!(
+            parse_diff_git_path("\"a/old name\" \"b/new name\""),
+            Some("new name".to_owned())
+        );
+        // Lockfile inside a directory whose name has a space.
+        assert_eq!(
+            parse_diff_git_path("\"a/dir with space/Cargo.lock\" \"b/dir with space/Cargo.lock\""),
+            Some("dir with space/Cargo.lock".to_owned())
+        );
+    }
+
+    #[test]
+    fn parse_diff_git_path_handles_escaped_quote_inside_path() {
+        // Git escapes embedded `"` as `\"`. The closing-quote
+        // search must skip these so it doesn't terminate early.
+        // Path is literally `a/has"quote` / `b/has"quote`.
+        let rest = r#""a/has\"quote" "b/has\"quote""#;
+        assert_eq!(
+            parse_diff_git_path(rest),
+            // Bytewise: backslash + quote stay in the result
+            // because we don't unescape (allowlist match is by
+            // file name, never contains escapes).
+            Some(r#"has\"quote"#.to_owned())
+        );
+    }
+
+    #[test]
+    fn collapse_recognises_lockfile_in_quoted_path() {
+        // Path "a/odd dir/Cargo.lock" forces git to use the
+        // quoted form. We must still detect it as a lockfile.
+        let diff = "\
+diff --git \"a/odd dir/Cargo.lock\" \"b/odd dir/Cargo.lock\"
+index 1111..2222 100644
+--- \"a/odd dir/Cargo.lock\"
++++ \"b/odd dir/Cargo.lock\"
+@@ -1,1 +1,1 @@
+-old
++new
+";
+        let out = collapse_autogenerated(diff);
+        // Content must be suppressed (lockfile detected).
+        assert!(!out.contains("old\n"), "lock content leaked: {out}");
+        assert!(!out.contains("+new"), "lock content leaked: {out}");
+        // Placeholder uses the parsed b-side path (without quotes).
+        assert!(
+            out.contains("[odd dir/Cargo.lock: +1 -1"),
+            "expected stat placeholder for quoted-path lockfile, got: {out}"
+        );
+    }
+}
diff --git a/hive-forge/src/verbs/issue.rs b/hive-forge/src/verbs/issue.rs
new file mode 100644
index 00000000..fdca71db
--- /dev/null
+++ b/hive-forge/src/verbs/issue.rs
@@ -0,0 +1,35 @@
+//! `issue <number> [repo]` — print key fields of an issue as JSON.
+
+use anyhow::Result;
+use clap::Args as ClapArgs;
+use serde_json::{Value, json};
+
+use crate::client::Client;
+use crate::verbs::print_json;
+
+#[derive(ClapArgs)]
+pub struct Args {
+    /// Issue number.
+    number: u64,
+}
+
+pub fn run(client: &Client, args: Args) -> Result<()> {
+    let repo = client.repo();
+    let v = client.get_json(&format!("/repos/{repo}/issues/{}", args.number))?;
+    let trimmed = json!({
+        "number": v.get("number"),
+        "title": v.get("title"),
+        "state": v.get("state"),
+        "user": v.get("user").and_then(|u| u.get("login")),
+        "assignees": v.get("assignees")
+            .and_then(Value::as_array)
+            .map(|a| a.iter().filter_map(|x| x.get("login")).cloned().collect::<Vec<_>>())
+            .unwrap_or_default(),
+        "labels": v.get("labels")
+            .and_then(Value::as_array)
+            .map(|a| a.iter().filter_map(|x| x.get("name")).cloned().collect::<Vec<_>>())
+            .unwrap_or_default(),
+        "body": v.get("body"),
+    });
+    print_json(&trimmed)
+}
diff --git a/hive-forge/src/verbs/issue_create.rs b/hive-forge/src/verbs/issue_create.rs
new file mode 100644
index 00000000..b80fc027
--- /dev/null
+++ b/hive-forge/src/verbs/issue_create.rs
@@ -0,0 +1,39 @@
+//! `issue-create --title <t> [body sources] [--assignee <u>] [repo]`
+//! — create an issue. Prints the issue URL.
+
+use anyhow::Result;
+use clap::Args as ClapArgs;
+use serde_json::{Value, json};
+
+use crate::body;
+use crate::client::Client;
+
+#[derive(ClapArgs)]
+pub struct Args {
+    /// Issue title (required).
+    #[arg(long)]
+    title: String,
+    /// Inline body text.
+    #[arg(long, conflicts_with = "body_file")]
+    body: Option<String>,
+    /// Read body from a file. `-` means stdin.
+    #[arg(long = "body-file")]
+    body_file: Option<String>,
+    /// Initial assignee login.
+    #[arg(long)]
+    assignee: Option<String>,
+}
+
+pub fn run(client: &Client, args: Args) -> Result<()> {
+    let body = body::resolve(args.body.as_deref(), args.body_file.as_deref())?.unwrap_or_default();
+    let repo = client.repo();
+    let mut payload = json!({ "title": args.title, "body": body });
+    if let Some(a) = args.assignee {
+        payload["assignees"] = json!([a]);
+    }
+    let resp = client.post_json(&format!("/repos/{repo}/issues"), &payload)?;
+    if let Some(url) = resp.get("html_url").and_then(Value::as_str) {
+        println!("{url}");
+    }
+    Ok(())
+}
diff --git a/hive-forge/src/verbs/issue_edit.rs b/hive-forge/src/verbs/issue_edit.rs
new file mode 100644
index 00000000..ac761624
--- /dev/null
+++ b/hive-forge/src/verbs/issue_edit.rs
@@ -0,0 +1,85 @@
+//! `issue-edit <number> [--title <t>] [body sources] [--state s]
+//! [--milestone id] [repo]` — partial update of an issue. Fields not
+//! provided are left unchanged.
+
+use anyhow::Result;
+use clap::{Args as ClapArgs, ValueEnum};
+use serde_json::{Map, Value, json};
+
+use crate::body;
+use crate::client::Client;
+use crate::verbs::print_json;
+
+#[derive(Copy, Clone, ValueEnum)]
+pub enum StateArg {
+    Open,
+    Closed,
+}
+
+impl StateArg {
+    fn as_str(self) -> &'static str {
+        match self {
+            Self::Open => "open",
+            Self::Closed => "closed",
+        }
+    }
+}
+
+#[derive(ClapArgs)]
+pub struct Args {
+    /// Issue number.
+    number: u64,
+    /// New title (omit to leave unchanged).
+    #[arg(long)]
+    title: Option<String>,
+    /// Inline body text (omit to leave unchanged).
+    #[arg(long, conflicts_with = "body_file")]
+    body: Option<String>,
+    /// Read body from a file. `-` means stdin.
+    #[arg(long = "body-file")]
+    body_file: Option<String>,
+    /// New state.
+    #[arg(long, value_enum)]
+    state: Option<StateArg>,
+    /// Milestone id (0 to unset).
+    #[arg(long)]
+    milestone: Option<u64>,
+}
+
+pub fn run(client: &Client, args: Args) -> Result<()> {
+    // Body is partial: only update the body field if a source was
+    // actually given. Piped stdin without --body/--body-file leaves
+    // body alone (the partial-update contract).
+    let body_explicit = args.body.is_some() || args.body_file.is_some();
+    let body = if body_explicit {
+        body::resolve(args.body.as_deref(), args.body_file.as_deref())?
+    } else {
+        None
+    };
+
+    let mut payload = Map::new();
+    if let Some(t) = args.title {
+        payload.insert("title".into(), Value::String(t));
+    }
+    if let Some(b) = body {
+        payload.insert("body".into(), Value::String(b));
+    }
+    if let Some(s) = args.state {
+        payload.insert("state".into(), Value::String(s.as_str().to_owned()));
+    }
+    if let Some(m) = args.milestone {
+        payload.insert("milestone".into(), Value::Number(m.into()));
+    }
+
+    let repo = client.repo();
+    let resp = client.patch_json(
+        &format!("/repos/{repo}/issues/{}", args.number),
+        &Value::Object(payload),
+    )?;
+    print_json(&json!({
+        "number": resp.get("number"),
+        "title": resp.get("title"),
+        "state": resp.get("state"),
+        "milestone": resp.get("milestone").and_then(|m| m.get("title")),
+    }))
+}
diff --git a/hive-forge/src/verbs/labels.rs b/hive-forge/src/verbs/labels.rs
new file mode 100644
index 00000000..a0346750
--- /dev/null
+++ b/hive-forge/src/verbs/labels.rs
@@ -0,0 +1,115 @@
+//! `labels <number> [list|add|remove] [labels...]` — manage labels on
+//! an issue or PR. Default action: list.
+
+use anyhow::{Result, bail};
+use clap::{Args as ClapArgs, Subcommand};
+use serde_json::{Value, json};
+
+use crate::client::Client;
+use crate::verbs::print_json;
+
+#[derive(ClapArgs)]
+pub struct Args {
+    /// Issue or PR number.
+    number: u64,
+    #[command(subcommand)]
+    action: Option<Action>,
+}
+
+#[derive(Subcommand)]
+enum Action {
+    /// List labels (default when no action is given).
+    List,
+    /// Add labels by name.
+    Add {
+        /// Label names to add.
+        labels: Vec<String>,
+    },
+    /// Remove labels by name.
+    Remove {
+        /// Label names to remove.
+        labels: Vec<String>,
+    },
+}
+
+pub fn run(client: &Client, args: Args) -> Result<()> {
+    let repo = client.repo();
+    match args.action.unwrap_or(Action::List) {
+        Action::List => {
+            let labels = client.get_json(&format!("/repos/{repo}/issues/{}/labels", args.number))?;
+            print_label_names(&labels);
+        }
+        Action::Add { labels } => {
+            if labels.is_empty() {
+                bail!("hive-forge labels add: pass at least one label name");
+            }
+            let all = client.get_json(&format!("/repos/{repo}/labels?limit=100"))?;
+            let ids = resolve_ids(&all, &labels);
+            let resp = client.post_json(
+                &format!("/repos/{repo}/issues/{}/labels", args.number),
+                &json!({ "labels": ids }),
+            )?;
+            print_label_names(&resp);
+        }
+        Action::Remove { labels } => {
+            if labels.is_empty() {
+                bail!("hive-forge labels remove: pass at least one label name");
+            }
+            let all = client.get_json(&format!("/repos/{repo}/labels?limit=100"))?;
+            for name in &labels {
+                if let Some(id) = lookup_id(&all, name) {
+                    let _ = client.delete(
+                        &format!("/repos/{repo}/issues/{}/labels/{id}", args.number),
+                        None,
+                    );
+                }
+            }
+            let labels = client.get_json(&format!("/repos/{repo}/issues/{}/labels", args.number))?;
+            print_label_names(&labels);
+        }
+    }
+    Ok(())
+}
+
+fn resolve_ids(all: &Value, names: &[String]) -> Vec<u64> {
+    let Some(arr) = all.as_array() else {
+        return Vec::new();
+    };
+    names
+        .iter()
+        .filter_map(|n| {
+            arr.iter().find_map(|l| {
+                let lname = l.get("name").and_then(Value::as_str)?;
+                if lname == n {
+                    l.get("id").and_then(Value::as_u64)
+                } else {
+                    None
+                }
+            })
+        })
+        .collect()
+}
+
+fn lookup_id(all: &Value, name: &str) -> Option<u64> {
+    let arr = all.as_array()?;
+    arr.iter().find_map(|l| {
+        let lname = l.get("name").and_then(Value::as_str)?;
+        if lname == name {
+            l.get("id").and_then(Value::as_u64)
+        } else {
+            None
+        }
+    })
+}
+
+fn print_label_names(v: &Value) {
+    let names: Vec<&str> = v
+        .as_array()
+        .map(|a| {
+            a.iter()
+                .filter_map(|l| l.get("name").and_then(Value::as_str))
+                .collect()
+        })
+        .unwrap_or_default();
+    let _ = print_json(&json!(names));
+}
diff --git a/hive-forge/src/verbs/lint.rs b/hive-forge/src/verbs/lint.rs
new file mode 100644
index 00000000..af24ffac
--- /dev/null
+++ b/hive-forge/src/verbs/lint.rs
@@ -0,0 +1,451 @@
+//! `lint <subcommand>` — issue/PR/branch lint queries for triage
+//! workflows (closes #505). Replaces ad-hoc curl + jq filtering with
+//! typed commands that always emit JSON via the global `--json`
+//! (default is a compact one-line-per-item human shape).
+//!
+//! Sub-commands:
+//! - `unassigned [--type issues|pulls|all] [--state open|closed|all]`
+//! - `no-reviewer --reviewer NAME [--state open|closed|all]`
+//! - `stale-branches [--days N]`
+//! - `assignments [--user NAME]`
+
+use std::collections::BTreeMap;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use anyhow::{Context, Result, bail};
+use clap::{Args as ClapArgs, Subcommand, ValueEnum};
+use serde_json::{Value, json};
+
+use crate::client::Client;
+use crate::verbs::print_json;
+
+/// Safety cap on paginated walks: 20 pages × 50 items = 1000.
+/// Plenty for the hyperhive repo today; bump if a future repo trips it.
+const MAX_PAGES: u32 = 20;
+
+/// Page size on list endpoints (Forgejo caps at 50 by default).
+const PAGE_LIMIT: u32 = 50;
+
+#[derive(ClapArgs)]
+pub struct Args {
+    #[command(subcommand)]
+    sub: Sub,
+}
+
+#[derive(Subcommand)]
+enum Sub {
+    /// List issues or PRs without an assignee.
+    Unassigned(UnassignedArgs),
+    /// List PRs with no `@reviewer` mention in any comment.
+    NoReviewer(NoReviewerArgs),
+    /// List remote branches with no commits in N days.
+    /// Skips branches that are heads of open PRs.
+    StaleBranches(StaleBranchesArgs),
+    /// Group open issues + PRs by assignee.
+    Assignments(AssignmentsArgs),
+}
+
+#[derive(Copy, Clone, ValueEnum)]
+enum Kind {
+    Issues,
+    Pulls,
+    All,
+}
+
+impl Kind {
+    fn forgejo_type(self) -> &'static str {
+        match self {
+            Kind::Issues => "issues",
+            Kind::Pulls => "pulls",
+            Kind::All => "all",
+        }
+    }
+}
+
+#[derive(Copy, Clone, ValueEnum)]
+enum State {
+    Open,
+    Closed,
+    All,
+}
+
+impl State {
+    fn as_str(self) -> &'static str {
+        match self {
+            State::Open => "open",
+            State::Closed => "closed",
+            State::All => "all",
+        }
+    }
+}
+
+#[derive(ClapArgs)]
+struct UnassignedArgs {
+    /// Filter by item kind.
+    #[arg(long, value_enum, default_value_t = Kind::All)]
+    r#type: Kind,
+    /// Filter by item state.
+    #[arg(long, value_enum, default_value_t = State::Open)]
+    state: State,
+}
+
+#[derive(ClapArgs)]
+struct NoReviewerArgs {
+    /// Filter by PR state.
+    #[arg(long, value_enum, default_value_t = State::Open)]
+    state: State,
+    /// Reviewer login to look for (matches `@<reviewer>` in PR body or
+    /// any comment). Required — defaulting to a specific name would
+    /// bake one deployment's reviewer convention into the binary
+    /// (mara's nit on #507).
+    #[arg(long)]
+    reviewer: String,
+}
+
+#[derive(ClapArgs)]
+struct StaleBranchesArgs {
+    /// Threshold in days since the last commit.
+    #[arg(long, default_value_t = 14)]
+    days: i64,
+}
+
+#[derive(ClapArgs)]
+struct AssignmentsArgs {
+    /// Restrict to a single user.
+    #[arg(long)]
+    user: Option<String>,
+}
+
+pub fn run(client: &Client, args: Args) -> Result<()> {
+    match args.sub {
+        Sub::Unassigned(a) => run_unassigned(client, a),
+        Sub::NoReviewer(a) => run_no_reviewer(client, a),
+        Sub::StaleBranches(a) => run_stale_branches(client, a),
+        Sub::Assignments(a) => run_assignments(client, a),
+    }
+}
+
+// ───────────────────────── unassigned ─────────────────────────
+
+fn run_unassigned(client: &Client, args: UnassignedArgs) -> Result<()> {
+    let repo = client.repo();
+    let items = client.get_json_all(
+        &format!(
+            "/repos/{repo}/issues?type={}&state={}&limit={PAGE_LIMIT}",
+            args.r#type.forgejo_type(),
+            args.state.as_str()
+        ),
+        MAX_PAGES,
+    )?;
+    let filtered: Vec<Value> = items
+        .into_iter()
+        .filter(|it| {
+            it.get("assignees")
+                .and_then(Value::as_array)
+                .is_none_or(Vec::is_empty)
+        })
+        .map(trim_item)
+        .collect();
+    emit(client, &filtered, |it| {
+        format!("#{} [{}] {}", num(it), kind_label(it), title(it))
+    })
+}
+
+// ───────────────────────── no-reviewer ────────────────────────
+
+fn run_no_reviewer(client: &Client, args: NoReviewerArgs) -> Result<()> {
+    let repo = client.repo();
+    // PR-only: `/repos/{repo}/pulls` doesn't return issues.
+    let pulls = client.get_json_all(
+        &format!(
+            "/repos/{repo}/pulls?state={}&limit={PAGE_LIMIT}",
+            args.state.as_str()
+        ),
+        MAX_PAGES,
+    )?;
+    let needle = format!("@{}", args.reviewer);
+    let mut missing: Vec<Value> = Vec::new();
+    for pr in pulls {
+        let number = pr.get("number").and_then(Value::as_u64).unwrap_or(0);
+        if number == 0 {
+            continue;
+        }
+        // Check PR body itself first — saves a comment-fetch on freshly-opened PRs
+        // that already @reviewer in the description.
+        let body = pr.get("body").and_then(Value::as_str).unwrap_or("");
+        if body.contains(&needle) {
+            continue;
+        }
+        // Paginate so PRs with >50 comments don't yield false positives
+        // (argus nit on #507). Same 1000-comment ceiling as elsewhere.
+        let comments = client.get_json_all(
+            &format!("/repos/{repo}/issues/{number}/comments?limit={PAGE_LIMIT}"),
+            MAX_PAGES,
+        )?;
+        let mentioned = comments.iter().any(|c| {
+            c.get("body")
+                .and_then(Value::as_str)
+                .is_some_and(|body| body.contains(&needle))
+        });
+        if !mentioned {
+            missing.push(trim_item(pr));
+        }
+    }
+    emit(client, &missing, |it| format!("#{} {}", num(it), title(it)))
+}
+
+// ─────────────────────── stale-branches ───────────────────────
+
+fn run_stale_branches(client: &Client, args: StaleBranchesArgs) -> Result<()> {
+    if args.days < 0 {
+        bail!("--days must be non-negative");
+    }
+    let repo = client.repo();
+    let branches = client.get_json_all(
+        &format!("/repos/{repo}/branches?limit={PAGE_LIMIT}"),
+        MAX_PAGES,
+    )?;
+    // Collect active PR head refs to skip — a branch with an open PR
+    // isn't "stale", it's "in review".
+    let open_pulls = client.get_json_all(
+        &format!("/repos/{repo}/pulls?state=open&limit={PAGE_LIMIT}"),
+        MAX_PAGES,
+    )?;
+    let active_heads: std::collections::HashSet<String> = open_pulls
+        .iter()
+        .filter_map(|p| {
+            p.get("head")
+                .and_then(|h| h.get("ref"))
+                .and_then(Value::as_str)
+                .map(str::to_owned)
+        })
+        .collect();
+
+    let cutoff_days = today_days_utc().context("compute today")? - args.days;
+    let mut stale: Vec<Value> = Vec::new();
+    for br in branches {
+        let name = br.get("name").and_then(Value::as_str).unwrap_or("");
+        if name.is_empty() || active_heads.contains(name) {
+            continue;
+        }
+        let ts = br
+            .get("commit")
+            .and_then(|c| c.get("timestamp"))
+            .and_then(Value::as_str)
+            .unwrap_or("");
+        let Some(date_str) = ts.get(..10) else {
+            continue;
+        };
+        let Some(days) = parse_yyyy_mm_dd_days(date_str) else {
+            continue;
+        };
+        if days <= cutoff_days {
+            stale.push(json!({
+                "name": name,
+                "last_commit": ts,
+                "age_days": (today_days_utc().unwrap_or(days) - days),
+            }));
+        }
+    }
+    emit(client, &stale, |it| {
+        let name = it.get("name").and_then(Value::as_str).unwrap_or("?");
+        let age = it.get("age_days").and_then(Value::as_i64).unwrap_or(0);
+        format!("{name} ({age}d)")
+    })
+}
+
+// ───────────────────────── assignments ────────────────────────
+
+fn run_assignments(client: &Client, args: AssignmentsArgs) -> Result<()> {
+    let repo = client.repo();
+    let items = client.get_json_all(
+        &format!("/repos/{repo}/issues?type=all&state=open&limit={PAGE_LIMIT}"),
+        MAX_PAGES,
+    )?;
+    let mut by_user: BTreeMap<String, Vec<Value>> = BTreeMap::new();
+    for it in items {
+        let assignees: Vec<String> = it
+            .get("assignees")
+            .and_then(Value::as_array)
+            .map(|a| {
+                a.iter()
+                    .filter_map(|x| x.get("login").and_then(Value::as_str))
+                    .map(str::to_owned)
+                    .collect()
+            })
+            .unwrap_or_default();
+        if assignees.is_empty() {
+            continue;
+        }
+        let slim = trim_item(it);
+        for u in assignees {
+            if args.user.as_deref().is_some_and(|w| w != u) {
+                continue;
+            }
+            by_user.entry(u).or_default().push(slim.clone());
+        }
+    }
+
+    if client.json_mode() {
+        let out: Value = by_user
+            .into_iter()
+            .map(|(u, items)| {
+                (
+                    u,
+                    json!({
+                        "count": items.len(),
+                        "items": items,
+                    }),
+                )
+            })
+            .collect::<serde_json::Map<_, _>>()
+            .into();
+        print_json(&out)
+    } else {
+        for (u, items) in &by_user {
+            println!("{u}: {} items", items.len());
+            for it in items.iter().take(3) {
+                println!("  #{} [{}] {}", num(it), kind_label(it), title(it));
+            }
+            if items.len() > 3 {
+                println!("  ... (+{} more)", items.len() - 3);
+            }
+        }
+        Ok(())
+    }
+}
+
+// ───────────────────────── shared helpers ─────────────────────
+
+/// Strip a Forgejo issue/PR JSON down to the fields lint output cares
+/// about. Mirrors the trim pattern in `verbs/issue.rs`.
+fn trim_item(it: Value) -> Value {
+    json!({
+        "number": it.get("number"),
+        "title": it.get("title"),
+        "state": it.get("state"),
+        "url": it.get("html_url"),
+        // Forgejo's unified /issues endpoint always emits a
+        // `pull_request` key — `null` for plain issues, an object
+        // (with merged/url/etc.) for PRs. Treat any non-null as a PR.
+        "is_pr": it.get("pull_request").is_some_and(|v| !v.is_null()),
+        "assignees": it
+            .get("assignees")
+            .and_then(Value::as_array)
+            .map(|a| {
+                a.iter()
+                    .filter_map(|x| x.get("login").cloned())
+                    .collect::<Vec<_>>()
+            })
+            .unwrap_or_default(),
+    })
+}
+
+fn num(it: &Value) -> i64 {
+    it.get("number").and_then(Value::as_i64).unwrap_or(0)
+}
+
+fn title(it: &Value) -> &str {
+    it.get("title").and_then(Value::as_str).unwrap_or("")
+}
+
+fn kind_label(it: &Value) -> &'static str {
+    if it.get("is_pr").and_then(Value::as_bool).unwrap_or(false) {
+        "pr"
+    } else {
+        "issue"
+    }
+}
+
+/// Either pretty-print the JSON array (when --json) or fall back to a
+/// caller-supplied human one-liner per item.
+fn emit<F>(client: &Client, items: &[Value], fmt: F) -> Result<()>
+where
+    F: Fn(&Value) -> String,
+{
+    if client.json_mode() {
+        print_json(&Value::Array(items.to_vec()))
+    } else {
+        if items.is_empty() {
+            println!("(no matches)");
+        }
+        for it in items {
+            println!("{}", fmt(it));
+        }
+        Ok(())
+    }
+}
+
+// ─── tiny date helpers (avoid pulling in chrono/time for one verb) ───
+
+/// Days since 1970-01-01 in UTC for "today" (best-effort from system clock).
+fn today_days_utc() -> Result<i64> {
+    let secs = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .context("system clock before epoch")?
+        .as_secs();
+    // `as_secs()` returns u64; clamp into i64 (won't overflow until y2554).
+    Ok(i64::try_from(secs / 86_400).unwrap_or(i64::MAX))
+}
+
+/// Parse a `YYYY-MM-DD` (e.g. the first 10 chars of an RFC3339 stamp)
+/// into days-since-1970-01-01 (UTC midnight). Returns `None` on parse
+/// failure rather than panicking — lint output stays best-effort.
+fn parse_yyyy_mm_dd_days(stamp: &str) -> Option<i64> {
+    let bytes = stamp.as_bytes();
+    if bytes.len() < 10 || bytes[4] != b'-' || bytes[7] != b'-' {
+        return None;
+    }
+    let year: i32 = std::str::from_utf8(&bytes[0..4]).ok()?.parse().ok()?;
+    let month: u32 = std::str::from_utf8(&bytes[5..7]).ok()?.parse().ok()?;
+    let day: u32 = std::str::from_utf8(&bytes[8..10]).ok()?.parse().ok()?;
+    if !(1..=12).contains(&month) || !(1..=31).contains(&day) {
+        return None;
+    }
+    Some(days_from_civil(year, month, day))
+}
+
+/// Howard Hinnant's `days_from_civil`: proleptic Gregorian → days since
+/// 1970-01-01. Public-domain reference algorithm. Handles negative years.
+fn days_from_civil(year: i32, month: u32, day: u32) -> i64 {
+    let y = if month <= 2 { year - 1 } else { year };
+    let era = if y >= 0 { y } else { y - 399 } / 400;
+    let yoe = i64::from(y - era * 400); // [0, 399]
+    let m = i64::from(month);
+    let d = i64::from(day);
+    let doy = (153 * (if m > 2 { m - 3 } else { m + 9 }) + 2) / 5 + d - 1;
+    let doe = yoe * 365 + yoe / 4 - yoe / 100 + doy;
+    i64::from(era) * 146_097 + doe - 719_468
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn epoch_is_day_zero() {
+        assert_eq!(days_from_civil(1970, 1, 1), 0);
+    }
+
+    #[test]
+    fn known_dates() {
+        // Hinnant reference values
+        assert_eq!(days_from_civil(2000, 1, 1), 10_957);
+        assert_eq!(days_from_civil(2020, 2, 29), 18_321);
+    }
+
+    #[test]
+    fn parses_iso_prefix() {
+        assert_eq!(
+            parse_yyyy_mm_dd_days("2020-02-29T12:00:00+02:00"),
+            Some(18_321)
+        );
+    }
+
+    #[test]
+    fn rejects_bad_input() {
+        assert_eq!(parse_yyyy_mm_dd_days("not-a-date"), None);
+        assert_eq!(parse_yyyy_mm_dd_days("2020/02/29"), None);
+        assert_eq!(parse_yyyy_mm_dd_days("2020-13-01"), None);
+    }
+}
diff --git a/hive-forge/src/verbs/milestone.rs b/hive-forge/src/verbs/milestone.rs
new file mode 100644
index 00000000..5ce9000a
--- /dev/null
+++ b/hive-forge/src/verbs/milestone.rs
@@ -0,0 +1,91 @@
+//! `milestone list|create|close` — manage milestones. Default action:
+//! list.
+
+use anyhow::Result;
+use clap::{Args as ClapArgs, Subcommand};
+use serde_json::{Value, json};
+
+use crate::client::Client;
+use crate::verbs::print_json;
+
+#[derive(ClapArgs)]
+pub struct Args {
+    #[command(subcommand)]
+    action: Option<Action>,
+}
+
+#[derive(Subcommand)]
+enum Action {
+    /// List open milestones as JSON.
+    List,
+    /// Create a milestone, print {id,title}.
+    Create {
+        /// Milestone title.
+        #[arg(long)]
+        title: String,
+        /// Description.
+        #[arg(long)]
+        desc: Option<String>,
+        /// Due date YYYY-MM-DD.
+        #[arg(long)]
+        due: Option<String>,
+    },
+    /// Close a milestone by id.
+    Close {
+        /// Milestone id.
+        id: u64,
+    },
+}
+
+pub fn run(client: &Client, args: Args) -> Result<()> {
+    let repo = client.repo();
+    match args.action.unwrap_or(Action::List) {
+        Action::List => {
+            let v =
+                client.get_json(&format!("/repos/{repo}/milestones?state=open&limit=50"))?;
+            let trimmed: Vec<Value> = v
+                .as_array()
+                .map(|a| {
+                    a.iter()
+                        .map(|m| {
+                            json!({
+                                "id": m.get("id"),
+                                "title": m.get("title"),
+                                "open_issues": m.get("open_issues"),
+                                "closed_issues": m.get("closed_issues"),
+                                "due_on": m.get("due_on"),
+                                "description": m.get("description"),
+                            })
+                        })
+                        .collect()
+                })
+                .unwrap_or_default();
+            print_json(&Value::Array(trimmed))
+        }
+        Action::Create { title, desc, due } => {
+            let mut payload = json!({ "title": title });
+            if let Some(d) = desc.filter(|s| !s.is_empty()) {
+                payload["description"] = Value::String(d);
+            }
+            if let Some(d) = due.filter(|s| !s.is_empty()) {
+                payload["due_on"] = Value::String(format!("{d}T00:00:00Z"));
+            }
+            let resp = client.post_json(&format!("/repos/{repo}/milestones"), &payload)?;
+            print_json(&json!({
+                "id": resp.get("id"),
+                "title": resp.get("title"),
+            }))
+        }
+        Action::Close { id } => {
+            let resp = client.patch_json(
+                &format!("/repos/{repo}/milestones/{id}"),
+                &json!({ "state": "closed" }),
+            )?;
+            print_json(&json!({
+                "id": resp.get("id"),
+                "title": resp.get("title"),
+                "state": resp.get("state"),
+            }))
+        }
+    }
+}
diff --git a/hive-forge/src/verbs/mod.rs b/hive-forge/src/verbs/mod.rs
new file mode 100644
index 00000000..d8f0bcb0
--- /dev/null
+++ b/hive-forge/src/verbs/mod.rs
@@ -0,0 +1,37 @@
+//! Per-verb subcommand modules. Each module exposes a `Args` struct
+//! (clap-derived) and a `run` fn taking `(&Client, Args) -> Result<()>`.
+//! Splitting one verb per module keeps each handler small and avoids
+//! the bash script's monolithic `case` statement.
+
+pub mod assign;
+pub mod attach;
+pub mod branches;
+pub mod close;
+pub mod comment;
+pub mod comment_edit;
+pub mod comment_show;
+pub mod comments;
+pub mod diff;
+pub mod issue;
+pub mod issue_create;
+pub mod issue_edit;
+pub mod labels;
+pub mod lint;
+pub mod milestone;
+pub mod pr;
+pub mod pr_create;
+pub mod pr_reviews;
+pub mod subscription;
+pub mod tree_sha;
+pub mod view;
+
+use anyhow::Result;
+use serde_json::Value;
+
+/// Pretty-print a `serde_json` value to stdout with a trailing newline,
+/// matching the bash script's `| jq` output shape.
+pub(crate) fn print_json(v: &Value) -> Result<()> {
+    let s = serde_json::to_string_pretty(v)?;
+    println!("{s}");
+    Ok(())
+}
diff --git a/hive-forge/src/verbs/pr.rs b/hive-forge/src/verbs/pr.rs
new file mode 100644
index 00000000..a3e101af
--- /dev/null
+++ b/hive-forge/src/verbs/pr.rs
@@ -0,0 +1,30 @@
+//! `pr <number> [repo]` — print key fields of a PR as JSON.
+
+use anyhow::Result;
+use clap::Args as ClapArgs;
+use serde_json::json;
+
+use crate::client::Client;
+use crate::verbs::print_json;
+
+#[derive(ClapArgs)]
+pub struct Args {
+    /// PR number.
+    number: u64,
+}
+
+pub fn run(client: &Client, args: Args) -> Result<()> {
+    let repo = client.repo();
+    let v = client.get_json(&format!("/repos/{repo}/pulls/{}", args.number))?;
+    let trimmed = json!({
+        "number": v.get("number"),
+        "title": v.get("title"),
+        "state": v.get("state"),
+        "merged": v.get("merged"),
+        "user": v.get("user").and_then(|u| u.get("login")),
+        "head_sha": v.get("head").and_then(|h| h.get("sha")),
+        "head_branch": v.get("head").and_then(|h| h.get("label")),
+        "base_branch": v.get("base").and_then(|b| b.get("label")),
+    });
+    print_json(&trimmed)
+}
diff --git a/hive-forge/src/verbs/pr_create.rs b/hive-forge/src/verbs/pr_create.rs
new file mode 100644
index 00000000..2298fff7
--- /dev/null
+++ b/hive-forge/src/verbs/pr_create.rs
@@ -0,0 +1,49 @@
+//! `pr-create --title <t> --head <branch> [--base <b>] [body sources]
+//! [--draft] [repo]` — create a PR. Prints the PR URL.
+
+use anyhow::Result;
+use clap::Args as ClapArgs;
+use serde_json::{Value, json};
+
+use crate::body;
+use crate::client::Client;
+
+#[derive(ClapArgs)]
+pub struct Args {
+    /// PR title.
+    #[arg(long)]
+    title: String,
+    /// Head branch.
+    #[arg(long)]
+    head: String,
+    /// Base branch (default: main).
+    #[arg(long, default_value = "main")]
+    base: String,
+    /// Inline body text.
+    #[arg(long, conflicts_with = "body_file")]
+    body: Option<String>,
+    /// Read body from a file. `-` means stdin.
+    #[arg(long = "body-file")]
+    body_file: Option<String>,
+    /// Open as draft.
+    #[arg(long)]
+    draft: bool,
+}
+
+pub fn run(client: &Client, args: Args) -> Result<()> {
+    let body = body::resolve(args.body.as_deref(), args.body_file.as_deref())?.unwrap_or_default();
+    let repo = client.repo();
+    let payload = json!({
+        "title": args.title,
+        "head": args.head,
+        "base": args.base,
+        "body": body,
+        "draft": args.draft,
+        "allow_maintainer_edit": true,
+    });
+    let resp = client.post_json(&format!("/repos/{repo}/pulls"), &payload)?;
+    if let Some(url) = resp.get("html_url").and_then(Value::as_str) {
+        println!("{url}");
+    }
+    Ok(())
+}
diff --git a/hive-forge/src/verbs/pr_reviews.rs b/hive-forge/src/verbs/pr_reviews.rs
new file mode 100644
index 00000000..dbf95772
--- /dev/null
+++ b/hive-forge/src/verbs/pr_reviews.rs
@@ -0,0 +1,36 @@
+//! `pr-reviews <number> [repo]` — list PR reviews with id/state/user/body.
+
+use anyhow::Result;
+use clap::Args as ClapArgs;
+use serde_json::{Value, json};
+
+use crate::client::Client;
+use crate::verbs::print_json;
+
+#[derive(ClapArgs)]
+pub struct Args {
+    /// PR number.
+    number: u64,
+}
+
+pub fn run(client: &Client, args: Args) -> Result<()> {
+    let repo = client.repo();
+    let v = client.get_json(&format!("/repos/{repo}/pulls/{}/reviews", args.number))?;
+    let trimmed: Vec<Value> = v
+        .as_array()
+        .map(|a| {
+            a.iter()
+                .map(|r| {
+                    json!({
+                        "id": r.get("id"),
+                        "state": r.get("state"),
+                        "user": r.get("user").and_then(|u| u.get("login")),
+                        "body": r.get("body"),
+                        "comments_count": r.get("comments_count"),
+                    })
+                })
+                .collect()
+        })
+        .unwrap_or_default();
+    print_json(&Value::Array(trimmed))
+}
diff --git a/hive-forge/src/verbs/subscription.rs b/hive-forge/src/verbs/subscription.rs
new file mode 100644
index 00000000..8fc16d63
--- /dev/null
+++ b/hive-forge/src/verbs/subscription.rs
@@ -0,0 +1,47 @@
+//! `subscription [--watch|--ignore|--unwatch] [repo]` — get or set
+//! the current user's watch subscription for a repo.
+
+use anyhow::Result;
+use clap::Args as ClapArgs;
+use serde_json::{Value, json};
+
+use crate::client::Client;
+use crate::verbs::print_json;
+
+#[derive(ClapArgs)]
+pub struct Args {
+    /// Subscribe (watch the repo).
+    #[arg(long, group = "action")]
+    watch: bool,
+    /// Mute (mark ignored).
+    #[arg(long, group = "action")]
+    ignore: bool,
+    /// Unsubscribe (clear watch + ignore).
+    #[arg(long, group = "action")]
+    unwatch: bool,
+}
+
+pub fn run(client: &Client, args: Args) -> Result<()> {
+    let repo = client.repo();
+    if args.unwatch {
+        client.delete(&format!("/repos/{repo}/subscription"), None)?;
+        println!("unsubscribed");
+        return Ok(());
+    }
+    if args.watch || args.ignore {
+        let (subscribed, ignored) = if args.ignore { (false, true) } else { (true, false) };
+        let resp = client.post_json(
+            &format!("/repos/{repo}/subscription"),
+            &json!({ "subscribed": subscribed, "ignored": ignored }),
+        )?;
+        return print_json(&json!({
+            "subscribed": resp.get("subscribed"),
+            "ignored": resp.get("ignored"),
+        }));
+    }
+    let resp: Value = client.get_json(&format!("/repos/{repo}/subscription"))?;
+    print_json(&json!({
+        "subscribed": resp.get("subscribed"),
+        "ignored": resp.get("ignored"),
+    }))
+}
diff --git a/hive-forge/src/verbs/tree_sha.rs b/hive-forge/src/verbs/tree_sha.rs
new file mode 100644
index 00000000..e2599c9d
--- /dev/null
+++ b/hive-forge/src/verbs/tree_sha.rs
@@ -0,0 +1,38 @@
+//! `tree-sha <ref> [repo]` — print the tree SHA of the commit at a
+//! branch name or commit SHA.
+
+use anyhow::Result;
+use clap::Args as ClapArgs;
+use serde_json::Value;
+
+use crate::client::Client;
+
+#[derive(ClapArgs)]
+pub struct Args {
+    /// Branch name or commit SHA.
+    reference: String,
+}
+
+pub fn run(client: &Client, args: Args) -> Result<()> {
+    let repo = client.repo();
+    // Try branch first; the bash helper silently treats failure as
+    // "not a branch, use the reference as a commit sha directly".
+    let commit_sha = match client.get_json(&format!("/repos/{repo}/branches/{}", args.reference)) {
+        Ok(v) => v
+            .get("commit")
+            .and_then(|c| c.get("id"))
+            .and_then(Value::as_str)
+            .unwrap_or(&args.reference)
+            .to_owned(),
+        Err(_) => args.reference.clone(),
+    };
+    let commit = client.get_json(&format!("/repos/{repo}/git/commits/{commit_sha}"))?;
+    let sha = commit
+        .get("tree")
+        .and_then(|t| t.get("sha"))
+        .and_then(Value::as_str)
+        .or_else(|| commit.get("sha").and_then(Value::as_str))
+        .unwrap_or("");
+    println!("{sha}");
+    Ok(())
+}
diff --git a/hive-forge/src/verbs/view.rs b/hive-forge/src/verbs/view.rs
new file mode 100644
index 00000000..01494cdc
--- /dev/null
+++ b/hive-forge/src/verbs/view.rs
@@ -0,0 +1,60 @@
+//! `view <number> [repo]` — dump title + body + all comments as
+//! markdown.
+
+use anyhow::Result;
+use clap::Args as ClapArgs;
+use serde_json::Value;
+
+use crate::client::Client;
+
+#[derive(ClapArgs)]
+pub struct Args {
+    /// Issue or PR number.
+    number: u64,
+}
+
+pub fn run(client: &Client, args: Args) -> Result<()> {
+    let repo = client.repo();
+    let issue = client.get_json(&format!("/repos/{repo}/issues/{}", args.number))?;
+    let title = issue.get("title").and_then(Value::as_str).unwrap_or("");
+    let body = issue.get("body").and_then(Value::as_str).unwrap_or("");
+    let state = issue.get("state").and_then(Value::as_str).unwrap_or("?");
+    let user = issue
+        .get("user")
+        .and_then(|u| u.get("login"))
+        .and_then(Value::as_str)
+        .unwrap_or("?");
+    let kind = if issue.get("pull_request").is_some_and(|p| !p.is_null()) {
+        "PR"
+    } else {
+        "issue"
+    };
+    println!("# {kind} #{} [{state}] by {user}", args.number);
+    println!("{title}");
+    if !body.is_empty() {
+        println!();
+        println!("{body}");
+    }
+    let comments = client.get_json(&format!(
+        "/repos/{repo}/issues/{}/comments?limit=50",
+        args.number
+    ))?;
+    let arr = comments.as_array().cloned().unwrap_or_default();
+    if !arr.is_empty() {
+        println!();
+        println!("---");
+        println!("## Comments ({})", arr.len());
+        println!();
+        for c in &arr {
+            let cu = c
+                .get("user")
+                .and_then(|u| u.get("login"))
+                .and_then(Value::as_str)
+                .unwrap_or("?");
+            let cb = c.get("body").and_then(Value::as_str).unwrap_or("");
+            println!("**{cu}**: {cb}");
+            println!();
+        }
+    }
+    Ok(())
+}
diff --git a/hive-sh4re/Cargo.toml b/hive-sh4re/Cargo.toml
new file mode 100644
index 00000000..e4f7600c
--- /dev/null
+++ b/hive-sh4re/Cargo.toml
@@ -0,0 +1,10 @@
+[package]
+name = "hive-sh4re"
+edition.workspace = true
+version.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+serde.workspace = true
diff --git a/hive-sh4re/src/lib.rs b/hive-sh4re/src/lib.rs
new file mode 100644
index 00000000..8ee3e12c
--- /dev/null
+++ b/hive-sh4re/src/lib.rs
@@ -0,0 +1,1124 @@
+//! Wire types shared between `hive-c0re` and the in-container harness.
+
+use serde::{Deserialize, Serialize};
+
+// -----------------------------------------------------------------------------
+// Host admin socket — /run/hyperhive/host.sock
+// -----------------------------------------------------------------------------
+
+/// Requests on the host admin socket.
+///
+/// Wire format: one JSON object per line.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(tag = "cmd", rename_all = "snake_case")]
+pub enum HostRequest {
+    /// Create and start a sub-agent container directly (no approval). Use
+    /// this from privileged contexts (operator on the host); it bypasses the
+    /// approval queue intentionally so test scripts and one-off recoveries
+    /// don't need a separate approve step.
+    Spawn { name: String },
+    /// Submit a spawn request for the operator to approve. On approval the
+    /// host creates and starts the container with the default `agent.nix`
+    /// template. The dashboard's `◆ R3QU3ST SP4WN` button and the
+    /// `hive-c0re request-spawn` CLI both go through this. The
+    /// previously-mirrored manager-side `RequestSpawn` was removed
+    /// (#442) — managers now go through the two-step `request_init_config`
+    /// + `request_apply_commit` flow so the spawn captures the manager's
+    /// customised config.
+    RequestSpawn { name: String },
+    /// Stop a managed container (graceful).
+    Kill { name: String },
+    /// Tear down a sub-agent container: stop + remove + drop the systemd
+    /// drop-in, purge pending approvals. Persistent state (proposed/applied
+    /// repos, Claude credentials) is KEPT by default — recreating the agent
+    /// with the same name reuses prior config + login. With `purge=true`
+    /// the agent's `/var/lib/hyperhive/{agents,applied}/<name>/` trees are
+    /// also wiped (config history + creds + notes gone forever). Manager
+    /// not destroyable.
+    Destroy {
+        name: String,
+        #[serde(default)]
+        purge: bool,
+    },
+    /// Apply pending config to a managed container.
+    Rebuild { name: String },
+    /// List managed containers.
+    List,
+    /// List pending approval requests.
+    Pending,
+    /// Approve a pending request by id; the action runs immediately.
+    Approve { id: i64 },
+    /// Deny a pending request by id.
+    Deny { id: i64 },
+    /// Move an agent in the topology tree (#486). Pass `new_parent =
+    /// None` to promote the agent to root, or `Some(name)` to set a
+    /// new parent. Refuses cycles, unknown agents, and any attempt
+    /// to reparent the manager (which is structurally root).
+    /// Pure topology-json edit today; bind-mount work follows in #361.
+    SetParent {
+        child: String,
+        new_parent: Option<String>,
+    },
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct HostResponse {
+    pub ok: bool,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub agents: Option<Vec<String>>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub approvals: Option<Vec<Approval>>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Approval {
+    pub id: i64,
+    pub agent: String,
+    #[serde(default)]
+    pub kind: ApprovalKind,
+    /// For `ApplyCommit`: the git sha the manager submitted. For `Spawn`:
+    /// empty. Note that this is the manager's *claimed* ref — the
+    /// canonical, hive-c0re-vouched sha after the proposal fetch lives
+    /// in `fetched_sha`.
+    pub commit_ref: String,
+    /// The sha hive-c0re fetched from the proposed repo into applied at
+    /// submission time, then tagged `proposal/<id>`. Stable for the
+    /// lifetime of the approval — manager amends in proposed don't
+    /// change what gets built. Only set for `ApplyCommit` after the
+    /// successful fetch.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub fetched_sha: Option<String>,
+    pub requested_at: i64,
+    pub status: ApprovalStatus,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub resolved_at: Option<i64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub note: Option<String>,
+    /// Optional free-text description the manager attached at submission
+    /// time — shown on the dashboard approval card so the operator can
+    /// understand the change without opening the diff.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+}
+
+/// What action the approval, when granted, will trigger.
+#[derive(Debug, Clone, Copy, Default, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum ApprovalKind {
+    /// Apply a manager-proposed config commit (existing flow).
+    #[default]
+    ApplyCommit,
+    /// Create + start a new sub-agent container with the given name.
+    /// Used today by the host admin socket / dashboard "request spawn"
+    /// button; the manager-side `RequestSpawn` surface was removed in
+    /// favour of the two-step `InitConfig` → `ApplyCommit` flow (#442).
+    Spawn,
+    /// Initialise a new agent's proposed config repo so the manager can
+    /// customise it before submitting a `request_apply_commit`. On
+    /// approval hive-c0re seeds `proposed/<name>/` with the default
+    /// `agent.nix` template but does NOT create the container — that
+    /// requires a subsequent `ApplyCommit` approval pinning the
+    /// customised config sha.
+    InitConfig,
+    /// Run `nix flake update [inputs...]` on the meta flake and commit
+    /// the resulting lock changes. The `commit_ref` field stores the
+    /// JSON-encoded inputs array (`"[]"` = all inputs). Agent field is
+    /// set to `hm1nd` (the requesting manager).
+    UpdateMetaInputs,
+    /// Add a scheduled prompt (closes #444). On approval hive-c0re
+    /// inserts a row into `scheduled_prompts` with
+    /// `source = Approval { id }`; the worker fans the body out as
+    /// inbox messages to each target at the scheduled time, recurring
+    /// when `interval_seconds` is set. `commit_ref` stores the
+    /// JSON-encoded `SchedulePromptPayload` so the approval row carries
+    /// the full submission verbatim (target list, body, schedule).
+    SchedulePrompt,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum ApprovalStatus {
+    Pending,
+    Approved,
+    Denied,
+    Failed,
+    /// Manager withdrew the request before the operator acted on it
+    /// (closes #250). Distinct from `Denied` (operator decision) and
+    /// `Failed` (post-approval lifecycle error) so the dashboard can
+    /// chip / sort cancellations separately.
+    Cancelled,
+}
+
+/// Reminder activity statistics for an agent over a time window.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ReminderStats {
+    /// Total reminders scheduled in the window (`created_at` >= cutoff).
+    pub scheduled: u64,
+    /// Reminders that have been delivered in the window (`sent_at` IS NOT NULL).
+    pub delivered: u64,
+    /// Reminders still pending in the window (`sent_at` IS NULL).
+    pub pending: u64,
+}
+
+impl HostResponse {
+    #[must_use]
+    pub fn success() -> Self {
+        Self {
+            ok: true,
+            error: None,
+            agents: None,
+            approvals: None,
+        }
+    }
+
+    #[must_use]
+    pub fn error(message: impl Into<String>) -> Self {
+        Self {
+            ok: false,
+            error: Some(message.into()),
+            agents: None,
+            approvals: None,
+        }
+    }
+
+    #[must_use]
+    pub fn list(agents: Vec<String>) -> Self {
+        Self {
+            ok: true,
+            error: None,
+            agents: Some(agents),
+            approvals: None,
+        }
+    }
+
+    #[must_use]
+    pub fn pending(approvals: Vec<Approval>) -> Self {
+        Self {
+            ok: true,
+            error: None,
+            agents: None,
+            approvals: Some(approvals),
+        }
+    }
+}
+
+// -----------------------------------------------------------------------------
+// Per-agent socket — /run/hyperhive/agents/<name>/mcp.sock on the host,
+// bind-mounted into the container at /run/hive/mcp.sock.
+// -----------------------------------------------------------------------------
+
+/// A logical message between agents.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Message {
+    pub from: String,
+    pub to: String,
+    pub body: String,
+    /// Optional broker row-id of the message this is a reply to.
+    /// Stored in the DB and echoed back on `Recv` so the dashboard can
+    /// render conversation threads. `None` for messages that start a
+    /// new thread. Ignored if the referenced id is unknown or out of
+    /// retention — purely advisory.
+    pub in_reply_to: Option<i64>,
+}
+
+/// One row of a broker inbox query — what the dashboard renders in
+/// its operator-inbox section and what a per-agent web UI returns
+/// from a `Recent` request. Lives in `hive_sh4re` so it can travel
+/// over both the dashboard's `/api/state` and the agent socket
+/// without an internal-to-wire conversion.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct InboxRow {
+    pub id: i64,
+    pub from: String,
+    pub body: String,
+    pub at: i64,
+    /// Row-id of the message this is a reply to, if any.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub in_reply_to: Option<i64>,
+}
+
+/// One delivered message in a `Recv` response. The unified
+/// `Recv { max }` always returns a `Vec<DeliveredMessage>` — single
+/// pop = a one-element vec, batch = up to `max` elements, idle =
+/// empty. Each row carries the broker's id + redelivered flag so the
+/// harness can drive `AckTurn` and surface the "may already be
+/// handled" hint per-row.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DeliveredMessage {
+    pub from: String,
+    pub body: String,
+    /// Broker row id, mirrored from the `Delivery` struct. Opaque to
+    /// claude but tracked by the harness so the broker's in-memory
+    /// unacked list can be drained on `AckTurn`. Marked `default` for
+    /// wire backwards-compat — pre-feature peers parse to 0.
+    #[serde(default)]
+    pub id: i64,
+    /// `true` when this row was previously popped, never acked, and
+    /// resurfaced by `RequeueInflight`. The format helper prepends the
+    /// "may already be handled" hint to the rendered body so claude
+    /// sees the warning per-message in the batch.
+    #[serde(default)]
+    pub redelivered: bool,
+    /// Row-id of the message this is a reply to, if any.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub in_reply_to: Option<i64>,
+}
+
+/// Reminder timing: either relative (wait N seconds) or absolute (at unix
+/// timestamp).
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(tag = "timing_type", rename_all = "snake_case")]
+pub enum ReminderTiming {
+    /// Remind after this many seconds from now.
+    InSeconds { seconds: u64 },
+    /// Remind at this unix timestamp (seconds since epoch).
+    At { unix_timestamp: i64 },
+}
+
+/// One row in the response to `GetLooseEnds`. Tagged enum so new
+/// thread kinds (forge PRs, long-running approvals from a privileged
+/// bot, etc) can land later without breaking existing handlers. The
+/// caller (claude in the agent harness) is expected to render these
+/// as a short bulleted list — the per-row fields are all the context
+/// needed without a follow-up fetch.
+///
+/// All three variants are cancellable via `CancelLooseEnd` /
+/// `cancel_loose_end`. `Question` and `Reminder` can be cancelled
+/// from either surface (subject to ownership checks); `Approval`
+/// is manager-only since sub-agents can't submit approvals.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum LooseEnd {
+    /// A pending approval. For agent-flavour `GetLooseEnds` calls
+    /// this only surfaces when the agent itself is the manager
+    /// (sub-agents don't submit approvals). For manager-flavour calls
+    /// it lists every pending approval in the swarm. `agent` is the
+    /// affected agent (target of the spawn / config commit).
+    Approval {
+        id: i64,
+        agent: String,
+        commit_ref: String,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        description: Option<String>,
+        /// Wall-clock seconds since `requested_at`. Saturates at zero on
+        /// any clock anomaly (back-step etc).
+        age_seconds: u64,
+    },
+    /// An unanswered question. For agent-flavour calls: only threads
+    /// where the agent is `asker` OR `target`. For manager-flavour
+    /// calls: every unanswered question in the swarm. `target = None`
+    /// means the question is addressed to the operator (dashboard
+    /// path); `Some(agent)` is a peer-to-peer thread.
+    Question {
+        id: i64,
+        asker: String,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        target: Option<String>,
+        question: String,
+        /// Wall-clock seconds since `asked_at`. Saturates at zero.
+        age_seconds: u64,
+    },
+    /// A scheduled but un-delivered reminder. For agent-flavour calls:
+    /// only the agent's own reminders (where `owner == self`). For
+    /// manager-flavour calls: every pending reminder in the swarm.
+    /// `owner` is the agent who scheduled it; `due_at` is the absolute
+    /// unix timestamp the scheduler is targeting.
+    Reminder {
+        id: i64,
+        owner: String,
+        message: String,
+        due_at: i64,
+        /// Wall-clock seconds since the reminder was scheduled. Saturates
+        /// at zero on clock anomalies. (For time-until-fire, compute
+        /// `due_at - now` client-side from the wire timestamp.)
+        age_seconds: u64,
+    },
+}
+
+/// Kind discriminator for `CancelLooseEnd`. Maps to which underlying
+/// store the dispatcher reaches into (`OperatorQuestions` /
+/// `Broker::reminders` / `Approvals`). The `Approval` variant is
+/// manager-only — sub-agents can't submit approvals so they have
+/// nothing to withdraw (closes #250).
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum CancelLooseEndKind {
+    Question,
+    Reminder,
+    /// Withdraw a pending approval (manager surface only). The row
+    /// transitions to `ApprovalStatus::Cancelled` and an
+    /// `ApprovalResolved` event fires so the dashboard pulls the card
+    /// out of the pending pane.
+    Approval,
+}
+
+/// Requests on a per-agent socket. The agent's identity is the socket
+/// it came in on; `Send.from` is filled in by the server, not the client.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(tag = "cmd", rename_all = "snake_case")]
+pub enum AgentRequest {
+    /// Send a message to another agent.
+    Send {
+        to: String,
+        body: String,
+        /// Optional id of the message being replied to. Stored in the
+        /// broker DB and returned on `Recv` so the dashboard can render
+        /// threads. Ignored if the id is unknown or out of retention.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        in_reply_to: Option<i64>,
+    },
+    /// Pop pending messages from this agent's inbox. Always returns
+    /// a list (`Messages { messages }`) — empty when nothing's
+    /// pending. `max` caps the batch size (default 1 = single-message
+    /// behaviour, server-side cap 32). `wait_seconds` long-polls for
+    /// the first message; once one arrives (or one is already
+    /// pending), the call drains up to `max` in total before
+    /// returning. Same delivery + ack bookkeeping per row as before:
+    /// `delivered_at = NOW`, tracked on the per-recipient
+    /// `unacked_ids` list (the next `AckTurn` closes them out), and
+    /// each row carries `redelivered = true` if `RequeueInflight`
+    /// resurfaced it.
+    Recv {
+        #[serde(default)]
+        wait_seconds: Option<u64>,
+        /// Maximum number of messages to pop. None = 1 (single).
+        /// Server-side cap is 32; values above clamp silently.
+        #[serde(default)]
+        max: Option<u32>,
+    },
+    /// Non-mutating: how many pending messages are addressed to me?
+    /// Used by the harness to render a status line after each tool call.
+    Status,
+    /// Operator-injected message TO this agent (from this agent's own web
+    /// UI). Recipient is implicit — `from` is `"operator"`. Effectively the
+    /// per-agent equivalent of the old dashboard T4LK form, but scoped to
+    /// the agent whose page the operator is on.
+    OperatorMsg { body: String },
+    /// Wake-up event injected from inside the container — typically an
+    /// extra MCP server (matrix, scraper, webhook bridge) signalling
+    /// that external work has arrived for this agent. Recipient is
+    /// implicit (this agent); `from` is caller-chosen so the wake
+    /// prompt can label the source ("matrix: new message in
+    /// #general"). Identity = socket means anything that can connect
+    /// to `/run/hive/mcp.sock` is implicitly trusted to inject these,
+    /// which is fine: the bind-mount is restricted to the agent's
+    /// own container.
+    Wake { from: String, body: String },
+    /// Last `limit` messages addressed to this agent, newest-first.
+    /// Non-mutating — pulls from the broker without delivering. The
+    /// per-agent web UI uses this to render its own inbox section.
+    Recent { limit: u64 },
+    /// Surface a question to either the operator or another agent.
+    /// `to = None` (or `Some("operator")`) routes the question to the
+    /// dashboard's operator-question queue (legacy `AskOperator`
+    /// behaviour). `to = Some(<agent>)` routes it to that agent's
+    /// inbox as a `HelperEvent::QuestionAsked` so the recipient can
+    /// answer back via `AgentRequest::Answer` (or
+    /// `ManagerRequest::Answer`); the answer threads back to the asker
+    /// as a `HelperEvent::QuestionAnswered` event. Either way the
+    /// response shape is `QuestionQueued { id }` — the asker uses the
+    /// id to correlate the asynchronous answer event.
+    Ask {
+        question: String,
+        #[serde(default)]
+        options: Vec<String>,
+        #[serde(default)]
+        multi: bool,
+        #[serde(default)]
+        ttl_seconds: Option<u64>,
+        /// Recipient of the question. `None` or `Some("operator")` =
+        /// the human operator (dashboard); `Some(<agent_name>)` = a
+        /// peer agent (their inbox).
+        #[serde(default)]
+        to: Option<String>,
+    },
+    /// Answer a question previously routed to this agent via
+    /// `HelperEvent::QuestionAsked`. The caller is implicitly the
+    /// answerer; only the question's `target` agent (or the operator,
+    /// via the dashboard) is authorised. Wires through to
+    /// `HelperEvent::QuestionAnswered` in the asker's inbox.
+    Answer { id: i64, answer: String },
+    /// Schedule a reminder message to be delivered to this agent at a
+    /// future time. The reminder lands in the agent's inbox as an auto-sent
+    /// message from `"reminder"`. Use for agent follow-ups (e.g. check task
+    /// status, retry failed operation). Message length is limited; pass
+    /// `file_path` to store in a file and get a path-reference message
+    /// instead.
+    Remind {
+        message: String,
+        timing: ReminderTiming,
+        #[serde(default)]
+        file_path: Option<String>,
+    },
+    /// Loose-ends view: pending approvals + unanswered questions
+    /// pending against THIS agent. Approvals only surface if this
+    /// agent submitted them (which only ever happens for the
+    /// manager); questions surface where the agent is `asker` or
+    /// `target`. Cheap O(n) sweep server-side — no caching.
+    GetLooseEnds,
+    /// Count of this agent's pending (un-delivered) reminders. Used
+    /// by the harness's per-turn stats sink to snapshot "what was
+    /// queued at turn-end time" without paying for a full list.
+    CountPendingReminders,
+    /// Reminder statistics for this agent: counts of scheduled, delivered,
+    /// and pending reminders over a time window. Used by the stats page
+    /// to display reminder activity. `since_secs` filters to reminders
+    /// created in the last N seconds (0 = all reminders).
+    ReminderRollup {
+        /// Only count reminders created in the last N seconds from now.
+        /// Pass 0 to include all reminders.
+        #[serde(default)]
+        since_secs: u64,
+    },
+    /// Set a free-text status string visible on the dashboard. Persisted
+    /// to `{state_dir}/hyperhive-status` so it survives harness restarts.
+    /// Pass an empty string to clear the status.
+    SetStatus { text: String },
+    /// Fetch metadata for an agent: identity (name + role + hyperhive
+    /// rev) and current status. When `name` is `None` the caller's own
+    /// identity is returned (self-introspection — replaces the old
+    /// `Whoami` request). When `name` is `Some`, the target agent's
+    /// status fields are populated but `role`/`hyperhive_rev` reflect
+    /// the responding daemon's view (`role` is best-effort: `"manager"`
+    /// for the manager agent, `"agent"` for everyone else).
+    /// `status_text` / `status_set_at` are `None` when the target has
+    /// never set a status or the agent name is unknown.
+    GetAgentMeta {
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        name: Option<String>,
+    },
+    /// Cancel an open thread the agent owns: a `Question` they asked
+    /// (returns `[cancelled by <self>]` as the answer to the asker)
+    /// or a `Reminder` they scheduled (hard-deletes the row).
+    /// Authorisation on the sub-agent surface: caller must own the
+    /// row. The manager surface uses the same wire variant but
+    /// accepts any id.
+    CancelLooseEnd { kind: CancelLooseEndKind, id: i64 },
+    /// Mark every message popped by this agent since the last `AckTurn`
+    /// as fully handled. Fired by the harness after `TurnOutcome::Ok`
+    /// — claude doesn't see this surface, it's harness↔broker only.
+    /// On `TurnOutcome::Failed` the harness intentionally skips this
+    /// call, so the unacked rows stay in-flight in the DB and get
+    /// requeued by the next `RequeueInflight` on harness boot. Tracks
+    /// the popped-id list in-memory on the broker side; no payload
+    /// needed (the broker knows which ids it handed to this
+    /// recipient).
+    AckTurn,
+    /// Requeue every message the broker handed to this agent that
+    /// never got acked. Fired by the harness exactly once at boot,
+    /// before entering the serve loop — catches the
+    /// crashed-mid-turn / OOM-killed / container-restarted cases
+    /// where a previous harness session popped messages but never
+    /// drove them to a clean turn-end. Resets `delivered_at` on each
+    /// row back to NULL (so the next `Recv` pops it) and remembers
+    /// the id in a per-recipient in-memory set so the next `Recv`
+    /// can tag the message with `redelivered: true` (the harness
+    /// then prepends a "may already be handled" hint to the wake
+    /// prompt). Idempotent + cheap when there's nothing in flight.
+    RequeueInflight,
+}
+
+/// Responses on a per-agent socket.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum AgentResponse {
+    /// `Send` succeeded.
+    Ok,
+    /// Either `Send` failed or `Recv` errored.
+    Err { message: String },
+    /// `Recv` result: zero or more messages, FIFO-ordered, never
+    /// longer than the `max` the caller passed. Empty vec = nothing
+    /// pending (the "(empty)" path for the formatter). Per-row `id` +
+    /// `redelivered` carry the broker's row id (opaque to claude;
+    /// tracked by the harness for `AckTurn`) and the "previously
+    /// popped, not acked" flag — see `DeliveredMessage` for details.
+    Messages { messages: Vec<DeliveredMessage> },
+    /// `Status` result: how many pending messages are in this agent's inbox.
+    Status { unread: u64 },
+    /// `Recent` result: newest-first inbox rows.
+    Recent { rows: Vec<InboxRow> },
+    /// `Ask` result: the queued question id. The answer lands later
+    /// as `HelperEvent::QuestionAnswered` in this agent's inbox.
+    QuestionQueued { id: i64 },
+    /// `GetLooseEnds` result: list of loose ends pending against
+    /// this agent. Ordered newest-first within each kind.
+    LooseEnds { loose_ends: Vec<LooseEnd> },
+    /// `CountPendingReminders` result.
+    PendingRemindersCount { count: u64 },
+    /// `ReminderRollup` result: reminder activity stats for the agent.
+    ReminderRollup(ReminderStats),
+    /// `GetAgentMeta` result: identity + status metadata for an agent.
+    /// `role` is `"agent"` for sub-agents and `"manager"` for the
+    /// manager. `hyperhive_rev` is `None` only when the configured
+    /// flake URL has no canonical path. `running` reflects whether the
+    /// target's container is currently up (#432); when it's false,
+    /// `status_text` / `status_set_at` are intentionally cleared by the
+    /// host because the on-disk values are stale snapshots from before
+    /// the stop. `status_text` is the last value written via
+    /// `SetStatus`, or `None` when none has been set or the agent name
+    /// is unknown. `status_set_at` is a Unix timestamp (seconds since
+    /// epoch) of when the status was last written; `None` when no
+    /// status is set.
+    AgentMeta {
+        name: String,
+        role: String,
+        #[serde(default = "default_true")]
+        running: bool,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        hyperhive_rev: Option<String>,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        status_text: Option<String>,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        status_set_at: Option<i64>,
+    },
+}
+
+/// Serde default for the `running` field on legacy wire payloads that
+/// predate #432 — older harnesses never serialised it, and `true`
+/// matches the historical assumption (the host only knew how to ask
+/// about live containers).
+fn default_true() -> bool {
+    true
+}
+
+// -----------------------------------------------------------------------------
+// Manager socket — /run/hyperhive/manager/mcp.sock on the host, bind-mounted
+// into the manager container at /run/hive/mcp.sock.
+// -----------------------------------------------------------------------------
+
+/// Logical name the broker uses for the manager.
+pub const MANAGER_AGENT: &str = "manager";
+
+/// Logical name the broker uses for the human operator. Messages with
+/// `to = OPERATOR_RECIPIENT` accumulate in sqlite and surface on the
+/// dashboard's inbox view — they are never `recv`'d by an agent harness.
+pub const OPERATOR_RECIPIENT: &str = "operator";
+
+/// Sender hive-c0re uses for events it pushes into the manager's inbox.
+/// Manager harness recognises this and parses the body as a `HelperEvent`.
+pub const SYSTEM_SENDER: &str = "system";
+
+/// Out-of-band events the host-side daemon pushes to the manager's inbox.
+/// Serialised as JSON in `Message::body` (sender = `SYSTEM_SENDER`).
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(tag = "event", rename_all = "snake_case")]
+pub enum HelperEvent {
+    /// An approval was approved/denied/failed; if approved, the underlying
+    /// action (rebuild or spawn) has already run by the time this lands.
+    ApprovalResolved {
+        id: i64,
+        agent: String,
+        commit_ref: String,
+        status: ApprovalStatus,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        note: Option<String>,
+        /// Canonical sha hive-c0re fetched into applied at submission
+        /// time. `git show <sha>` against `/agents/<n>/applied.git`
+        /// inside the manager container yields the exact tree being
+        /// referenced.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        sha: Option<String>,
+        /// Terminal tag name in the applied repo for this approval —
+        /// `deployed/<id>`, `failed/<id>`, or `denied/<id>` (and
+        /// `approved/<id>` for the rare bare-approval case where
+        /// no underlying action runs).
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        tag: Option<String>,
+    },
+    /// A new container was spawned (post-approval or via the admin CLI
+    /// bypass path). `ok=false` means the spawn failed.
+    Spawned {
+        agent: String,
+        ok: bool,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        note: Option<String>,
+        /// Sha of the `deployed/0` commit seeded by hive-c0re on
+        /// first spawn (Some on success, None on failure).
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        sha: Option<String>,
+    },
+    /// A container was rebuilt (auto-update on flake rev change, or a
+    /// manual rebuild from CLI/dashboard).
+    Rebuilt {
+        agent: String,
+        ok: bool,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        note: Option<String>,
+        /// Sha that ended up at `deployed/<id>` on success, or the
+        /// proposal sha that just got tagged `failed/<id>` on
+        /// failure. None for the (rare) rebuild path that doesn't go
+        /// through an approval (e.g. `auto_update::rebuild_agent`
+        /// reapplying the existing main).
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        sha: Option<String>,
+        /// `deployed/<id>` or `failed/<id>` for approval-driven
+        /// rebuilds; None for auto-update / dashboard rebuilds that
+        /// don't change the deployed commit.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        tag: Option<String>,
+    },
+    /// A new agent's proposed config repo was initialised (post-`InitConfig`
+    /// approval). The manager can now edit `/agents/<agent>/config/agent.nix`,
+    /// commit the changes, and submit a `RequestApplyCommit` — which will
+    /// create the container on first deploy, then rebuild on every subsequent
+    /// deploy.
+    ConfigReady { agent: String },
+    /// A sub-agent's container was stopped (the systemd unit is down;
+    /// persistent state is unchanged).
+    Killed { agent: String },
+    /// A sub-agent's container was torn down (container removed; state
+    /// dirs preserved per `destroy` semantics).
+    Destroyed { agent: String },
+    /// A sub-agent's container has no claude session yet (first
+    /// spawn, or `--purge` wiped creds). Manager can't do anything
+    /// about it directly — login is interactive OAuth — but it
+    /// surfaces so the manager knows the agent is in partial-run
+    /// mode and can flag the operator.
+    NeedsLogin { agent: String },
+    /// An agent successfully completed claude login — the session
+    /// dir now contains creds. Transition fires once per login.
+    LoggedIn { agent: String },
+    /// An agent's recorded flake rev is stale relative to the
+    /// current hyperhive rev. The manager has the `update` tool to
+    /// trigger a rebuild without operator approval (it's a no-op
+    /// when nothing actually changed).
+    NeedsUpdate { agent: String },
+    /// Container exited without an operator-initiated stop. Fired by
+    /// the crash watcher when an agent's container transitions from
+    /// running → stopped and no `Stopping` / `Restarting` /
+    /// `Destroying` transient was set, so the operator (or the
+    /// manager) knows it crashed rather than was killed on purpose.
+    ContainerCrash {
+        agent: String,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        note: Option<String>,
+    },
+    /// A question queued via `Ask` was answered (by the operator via
+    /// the dashboard, or by another agent via `Answer`). `id` matches
+    /// the `QuestionQueued.id` returned to the asker; `question`
+    /// echoes the original prompt so the asker can stitch the answer
+    /// back to context across compactions; `answerer` is who answered
+    /// (`"operator"` or a peer agent name).
+    QuestionAnswered {
+        id: i64,
+        question: String,
+        answer: String,
+        answerer: String,
+    },
+    /// A peer (or the manager) asked this agent a question via
+    /// `Ask { to: Some(<this-agent>), ... }`. The recipient should
+    /// answer via `Answer { id, answer }` on their socket; the answer
+    /// will route back to the asker as a `QuestionAnswered` event.
+    /// `options` + `multi` mirror the original `Ask` args so the
+    /// answerer knows what shape of reply is expected.
+    QuestionAsked {
+        id: i64,
+        asker: String,
+        question: String,
+        #[serde(default)]
+        options: Vec<String>,
+        #[serde(default)]
+        multi: bool,
+    },
+}
+
+/// Requests on the manager socket. Manager has the agent surface (send/recv)
+/// plus privileged lifecycle verbs.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(tag = "cmd", rename_all = "snake_case")]
+pub enum ManagerRequest {
+    Send {
+        to: String,
+        body: String,
+        /// Optional id of the message being replied to. Mirror of
+        /// `AgentRequest::Send.in_reply_to`; see that doc.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        in_reply_to: Option<i64>,
+    },
+    /// Same shape as `AgentRequest::Recv` — caller-tunable
+    /// `wait_seconds` (capped at 60s server-side, default 30s when
+    /// None) for first-message long-poll, plus `max` (default 1, cap
+    /// 32) to drain up to N popped rows in one round-trip.
+    Recv {
+        #[serde(default)]
+        wait_seconds: Option<u64>,
+        #[serde(default)]
+        max: Option<u32>,
+    },
+    /// Non-mutating: pending message count, used to render a status line
+    /// after each MCP tool call (mirrors `AgentRequest::Status`).
+    Status,
+    /// Operator-injected message TO the manager (from the manager's own web
+    /// UI). Same shape as `AgentRequest::OperatorMsg`.
+    OperatorMsg {
+        body: String,
+    },
+    /// Last `limit` messages addressed to the manager, newest-first.
+    /// Non-mutating; mirror of `AgentRequest::Recent`.
+    Recent {
+        limit: u64,
+    },
+    /// Initialise a brand-new agent's proposed config repo and queue an
+    /// approval for the operator to review. On approval hive-c0re seeds
+    /// `/agents/<name>/config/` with the default `agent.nix` template,
+    /// giving the manager RW access so it can customise the config and
+    /// commit changes. After the `ConfigReady` event arrives, edit
+    /// `agent.nix`, commit, and call `request_apply_commit` — which
+    /// creates the container on the first deploy. Fails if a proposed
+    /// repo for this name already exists (use `request_apply_commit` to
+    /// update an existing agent's config).
+    RequestInitConfig {
+        name: String,
+        /// Optional description shown on the dashboard approval card.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        description: Option<String>,
+    },
+    /// Stop a sub-agent (graceful).
+    Kill {
+        name: String,
+    },
+    /// Start a previously-stopped sub-agent container.
+    Start {
+        name: String,
+    },
+    /// Restart a sub-agent container (stop + start).
+    Restart {
+        name: String,
+    },
+    /// Rebuild a sub-agent: re-applies the current hyperhive flake +
+    /// agent.nix, restarts the container. No approval required —
+    /// it's idempotent and the manager owns its own update cadence.
+    Update {
+        name: String,
+    },
+    /// Submit a config commit for the user to approve. `commit_ref` must
+    /// be a commit sha (7-40 hex chars, short or full) in the agent's
+    /// proposed config repo — a branch or tag name is rejected so the
+    /// approval pins an immutable commit. On approval the host applies
+    /// the change via `nixos-container update`.
+    RequestApplyCommit {
+        agent: String,
+        commit_ref: String,
+        /// Optional description shown on the dashboard approval card so the
+        /// operator knows what the change does without opening the diff.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        description: Option<String>,
+    },
+    /// Surface a question to either the operator or another agent.
+    /// Mirrors `AgentRequest::Ask` exactly — see that doc for the
+    /// routing semantics (operator = dashboard queue; agent = the
+    /// peer's inbox via `HelperEvent::QuestionAsked`).
+    ///
+    /// - `options` is advisory: empty = free-text only; non-empty = the
+    ///   dashboard renders the choices alongside a free-text fallback
+    ///   ("Other…") so the operator is never trapped.
+    /// - `multi=true` lets the operator pick multiple options (rendered
+    ///   as checkboxes). The answer is returned as a single string with
+    ///   selections joined by ", ".
+    /// - `ttl_seconds`: optional auto-cancel after that many seconds. On
+    ///   expiry the question is resolved with answer `[expired]` and the
+    ///   asker gets the usual `QuestionAnswered` event. None = wait
+    ///   forever for an answer (or manual cancel).
+    /// - `to`: recipient (None / `Some("operator")` = operator;
+    ///   `Some(<agent>)` = peer agent).
+    Ask {
+        question: String,
+        #[serde(default)]
+        options: Vec<String>,
+        #[serde(default)]
+        multi: bool,
+        #[serde(default)]
+        ttl_seconds: Option<u64>,
+        #[serde(default)]
+        to: Option<String>,
+    },
+    /// Answer a question previously routed to the manager via
+    /// `HelperEvent::QuestionAsked` (i.e. an agent asked the manager
+    /// for input). Mirror of `AgentRequest::Answer`.
+    Answer { id: i64, answer: String },
+    /// Fetch recent journal lines for a sub-agent container. `agent`
+    /// is the logical agent name; hive-c0re resolves it to the
+    /// machine name (`gui` → `h-gui`) and runs `journalctl -M
+    /// <machine> -n <lines> --no-pager`, returning the output as a
+    /// string. Useful for diagnosing MCP registration failures,
+    /// startup crashes, and harness errors.
+    ///
+    /// `lines` defaults to 50 when omitted.
+    GetLogs {
+        agent: String,
+        #[serde(default)]
+        lines: Option<u32>,
+    },
+    /// Mirror of `AgentRequest::Remind` on the manager surface — schedule
+    /// a reminder addressed to the manager itself. Same semantics: body
+    /// soft-caps at 4 KiB, oversize bodies auto-persist to
+    /// `/state/reminders/auto-<ts>.md` (the manager container's own state
+    /// mount) and the inbox sees a pointer.
+    Remind {
+        message: String,
+        timing: ReminderTiming,
+        #[serde(default)]
+        file_path: Option<String>,
+    },
+    /// Loose-ends view for the manager surface. The optional `agent`
+    /// field selects scope:
+    ///   - `None` — the manager's own loose ends: approvals it
+    ///     submitted + questions where it is asker/target + its own
+    ///     pending reminders. This is the default.
+    ///   - `Some("*")` — hive-wide: EVERY pending approval, unanswered
+    ///     question, and pending reminder across the swarm.
+    ///   - `Some("<name>")` — that specific agent's loose ends.
+    GetLooseEnds {
+        #[serde(default)]
+        agent: Option<String>,
+    },
+    /// Count of pending reminders. `agent` selects whose: `None` =
+    /// the manager's own, `Some("<name>")` = that agent's. Mirror of
+    /// `AgentRequest::CountPendingReminders` on the manager surface.
+    CountPendingReminders {
+        #[serde(default)]
+        agent: Option<String>,
+    },
+    /// Reminder statistics: counts of scheduled, delivered, and pending
+    /// reminders (manager-flavour). Mirror of `AgentRequest::ReminderRollup`.
+    ReminderRollup {
+        /// Only count reminders created in the last N seconds from now.
+        /// Pass 0 to include all reminders.
+        #[serde(default)]
+        since_secs: u64,
+        /// Whose reminders to roll up: `None` = the manager's own,
+        /// `Some("<name>")` = that agent's.
+        #[serde(default)]
+        agent: Option<String>,
+    },
+    /// Mirror of `AgentRequest::SetStatus` on the manager surface.
+    SetStatus { text: String },
+    /// Mirror of `AgentRequest::GetAgentMeta` on the manager surface.
+    /// `None` returns the manager's own identity (replaces the old
+    /// `Whoami` request).
+    GetAgentMeta {
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        name: Option<String>,
+    },
+    /// Cancel an open thread (question or reminder). Manager surface
+    /// can cancel any row (no owner check) — same dispatch as
+    /// `AgentRequest::CancelLooseEnd` but with privileged auth.
+    CancelLooseEnd { kind: CancelLooseEndKind, id: i64 },
+    /// Mirror of `AgentRequest::AckTurn` on the manager surface — fired
+    /// by the manager harness after `TurnOutcome::Ok` to close out
+    /// every message popped during the turn.
+    AckTurn,
+    /// Mirror of `AgentRequest::RequeueInflight` on the manager
+    /// surface — fired exactly once on manager harness boot.
+    RequeueInflight,
+    /// Mirror of `AgentRequest::Wake` on the manager surface. Used by
+    /// in-container background tasks (e.g. `forge_notify`) to push a
+    /// message into the manager's own broker inbox. `from` is caller-
+    /// chosen; `body` becomes the wake prompt body.
+    Wake { from: String, body: String },
+    /// Queue an approval to run `nix flake update [inputs...]` on the
+    /// meta flake. `inputs` is the list of named inputs to update
+    /// (e.g. `["bitburner-agent", "nixpkgs"]`). Pass an empty list to
+    /// update ALL inputs. On operator approval hive-c0re runs the lock
+    /// update and commits the result. The `UpdateMetaInputs` approval
+    /// resolves with `ApprovalResolved` in the manager inbox.
+    RequestUpdateMetaInputs {
+        #[serde(default)]
+        inputs: Vec<String>,
+        /// Optional description shown on the dashboard approval card.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        description: Option<String>,
+    },
+    /// Queue an approval to add a scheduled prompt (#444). The
+    /// requester (caller of this request) is recorded as the schedule
+    /// owner; on operator approval hive-c0re inserts the schedule and
+    /// the worker fans the body out at fire time. Even agent-self
+    /// schedules go through approval — the existing `remind` MCP tool
+    /// is the unapproved self-wake path.
+    RequestSchedulePrompt(SchedulePromptPayload),
+    /// Cancel a scheduled prompt (#444). `targets = None` cancels the
+    /// whole schedule; `Some(list)` cancels just those recipients,
+    /// auto-cancelling the parent when no active targets remain.
+    /// Authorization: manager can cancel its own schedules + any
+    /// sub-agent schedules (i.e. owner reachable via topology); the
+    /// operator surface bypasses this check.
+    CancelSchedule {
+        id: i64,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        targets: Option<Vec<String>>,
+    },
+    /// List every schedule in the queue. Manager-side this is
+    /// unfiltered — the dashboard does the topology-filter for the
+    /// per-agent view.
+    ListSchedules,
+    /// Fire a scheduled prompt out of band (#467). Runs the
+    /// per-target fan-out once immediately without touching
+    /// `next_fire_at_unix` on recurring schedules; one-shots are
+    /// consumed by the manual fire. Authorization mirrors
+    /// `CancelSchedule`: the manager can fire its own schedules
+    /// + any owned by a sub-agent in its subtree per topology.json;
+    /// the operator surface bypasses the check.
+    FireScheduleNow { id: i64 },
+    /// Edit an existing schedule's mutable fields (#474). Partial
+    /// PATCH semantics: `None` / missing JSON key = leave alone,
+    /// `Some(_)` = set. `interval_seconds` and `description` are
+    /// doubly-wrapped so `Some(None)` (set explicit null) can flip
+    /// a recurring schedule back to one-shot / clear the
+    /// description, while plain `None` keeps the current value.
+    /// `targets_add` / `targets_remove` mutate the recipient list
+    /// in the same transaction; re-adding a previously-cancelled
+    /// target drops the tombstone (replace-on-conflict). Refuses
+    /// cancelled rows. Authorization mirrors `CancelSchedule`.
+    EditSchedule {
+        id: i64,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        body: Option<String>,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        description: Option<Option<String>>,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        interval_seconds: Option<Option<u64>>,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        next_fire_at_unix: Option<i64>,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        targets_add: Option<Vec<String>>,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        targets_remove: Option<Vec<String>>,
+    },
+}
+
+/// Submission payload for `RequestSchedulePrompt`. Lives outside the
+/// enum so it can also serialize into the approval row's `commit_ref`
+/// (the dispatcher re-parses it on approve and inserts the schedule).
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct SchedulePromptPayload {
+    /// Names of recipient agents. Operator + `hm1nd` allowed.
+    pub targets: Vec<String>,
+    /// Message body delivered to each target's inbox at fire time.
+    /// Same size budget as `Send.body` — soft cap at the broker level.
+    pub body: String,
+    /// Absolute unix timestamp (seconds) for the FIRST fire. For
+    /// recurring schedules the worker then re-arms in
+    /// `interval_seconds` steps.
+    pub first_fire_at_unix: i64,
+    /// `None` = one-shot. `Some(n > 0)` = recurring every `n` seconds.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub interval_seconds: Option<u64>,
+    /// Optional description shown on the dashboard approval card AND
+    /// stored on the resulting schedule row for the operator's
+    /// "what is this?" reference later.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+}
+
+/// Schedule row shape on the wire — mirror of
+/// `scheduled_prompts::Schedule` but in the public crate so dashboard
+/// + agent surfaces can deserialize without depending on
+/// hive-c0re-internal types. Kept structurally identical to the
+/// in-process type; the conversion is field-by-field in
+/// `manager_server` / `dashboard`.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct WireSchedule {
+    pub id: i64,
+    pub owner: String,
+    pub body: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub interval_seconds: Option<u64>,
+    pub next_fire_at_unix: i64,
+    pub created_at_unix: i64,
+    pub source: WireScheduleSource,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub cancelled_at_unix: Option<i64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    pub targets: Vec<WireScheduleTarget>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum WireScheduleSource {
+    Operator,
+    Approval { id: i64 },
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct WireScheduleTarget {
+    pub target: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub cancelled_at_unix: Option<i64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub last_fired_at_unix: Option<i64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub last_result: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum ManagerResponse {
+    Ok,
+    Err {
+        message: String,
+    },
+    /// Mirror of `AgentResponse::Messages` on the manager surface.
+    /// Always-list shape: 0..=max popped rows, FIFO-ordered. Carries
+    /// per-row `id` + `redelivered` so the manager harness drives the
+    /// same ack + requeue-with-hint flow as a sub-agent.
+    Messages {
+        messages: Vec<DeliveredMessage>,
+    },
+    Status {
+        unread: u64,
+    },
+    /// Result of `Ask`: the queued question id. The actual answer
+    /// arrives later as a `HelperEvent::QuestionAnswered` in the
+    /// asker's inbox, so this returns immediately rather than blocking
+    /// the turn.
+    QuestionQueued {
+        id: i64,
+    },
+    /// `Recent` result: mirror of `AgentResponse::Recent`.
+    Recent {
+        rows: Vec<InboxRow>,
+    },
+    /// `GetLogs` result: journal lines for the requested container.
+    Logs {
+        content: String,
+    },
+    /// `ListSchedules` result (#444). Snapshot of every schedule
+    /// (active + cancelled-but-not-yet-reaped); the dashboard does the
+    /// per-agent topology filter on top.
+    Schedules {
+        schedules: Vec<WireSchedule>,
+    },
+    /// `GetLooseEnds` result: hive-wide loose ends (approvals +
+    /// unanswered questions). Same `LooseEnd` variants as the
+    /// agent surface; the manager's view is unfiltered.
+    LooseEnds {
+        loose_ends: Vec<LooseEnd>,
+    },
+    /// `CountPendingReminders` result.
+    PendingRemindersCount {
+        count: u64,
+    },
+    /// `ReminderRollup` result: reminder activity stats for the manager.
+    ReminderRollup(ReminderStats),
+    /// Mirror of `AgentResponse::AgentMeta` on the manager surface.
+    /// `role` is `"manager"` for the manager and `"agent"` for any
+    /// sub-agent looked up by name. `running` is false when the
+    /// target's container is stopped (#432) — in that case
+    /// `status_text` / `status_set_at` are cleared by the host so
+    /// stale pre-stop values don't leak through.
+    AgentMeta {
+        name: String,
+        role: String,
+        #[serde(default = "default_true")]
+        running: bool,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        hyperhive_rev: Option<String>,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        status_text: Option<String>,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        status_set_at: Option<i64>,
+    },
+}
diff --git a/homeConfigurations/muede/default.nix b/homeConfigurations/muede/default.nix
deleted file mode 100644
index 0c6f5631..00000000
--- a/homeConfigurations/muede/default.nix
+++ /dev/null
@@ -1,108 +0,0 @@
-{ pkgs, ... }:
-{
-  imports = [
-    # keep-sorted start
-    ./editorconfig.nix
-    ./element.nix
-    ./fonts.nix
-    ./fuzzel.nix
-    ./git.nix
-    ./gnome.nix
-    ./niri.nix
-    ./podman.nix
-    ./ssh.nix
-    ./starship.nix
-    ./swayidle.nix
-    #./swaylock.nix
-    #./swaync.nix
-    ./vscode.nix
-    # ./waybar.nix
-    # ./wlogout.nix
-    ./zsh.nix
-    # keep-sorted end
-  ];
-
-  config = {
-    my = {
-      # keep-sorted start
-      gnome-extensions.enable = true;
-      nano.enable = true;
-      templates.enable = true;
-      zsh.enable = true;
-      # keep-sorted end
-    };
-
-    programs = {
-      home-manager.enable = true;
-      fzf.enable = true;
-
-      direnv = {
-        enable = true;
-        nix-direnv.enable = true;
-        enableZshIntegration = true;
-      };
-
-      eza = {
-        enable = true;
-        git = true;
-        icons = "auto";
-        extraOptions = [
-          "--group-directories-first"
-          "--header"
-        ];
-      };
-
-      pay-respects = {
-        enable = true;
-        enableZshIntegration = true;
-      };
-
-      chromium.enable = true;
-      nova-shell = {
-        enable = true;
-        theme = {
-          fontSize = 14;
-        };
-        #modules.backgroundOverlay.enable = false;
-        #modules.screenCorners.enable = false;
-      };
-    };
-
-    home.packages = with pkgs; [
-      # keep-sorted start
-      arduino
-      arduino-cli
-      arduino-ide
-      btop
-      unstable.claude-code
-      dconf2nix
-      foliate
-      fractal
-      file
-      geary
-      gnome-terminal
-      gparted
-      icu
-      jetbrains-toolbox
-      kdiff3
-      keepassxc
-      lutris
-      nextcloud-client
-      onefetch
-      servicepoint-cli
-      servicepoint-simulator
-      telegram-desktop
-      thunderbird
-      vlc
-      wireguard-tools
-      wirelesstools
-      # keep-sorted end
-    ];
-
-    home.file = {
-      "idea.properties".text = "idea.filewatcher.executable.path = ${pkgs.fsnotifier}/bin/fsnotifier";
-    };
-
-    services.poweralertd.enable = true;
-  };
-}
diff --git a/homeConfigurations/muede/editorconfig.nix b/homeConfigurations/muede/editorconfig.nix
deleted file mode 100644
index 1ebffa88..00000000
--- a/homeConfigurations/muede/editorconfig.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-{
-  config.editorconfig = {
-    enable = true;
-    settings = {
-      "*" = {
-        charset = "utf-8";
-        end_of_line = "lf";
-        trim_trailing_whitespace = true;
-        insert_final_newline = true;
-        max_line_width = 120;
-        indent_style = "space";
-        indent_size = 4;
-      };
-      "*.nix" = {
-        indent_size = 2;
-      };
-    };
-  };
-}
diff --git a/homeConfigurations/muede/element.nix b/homeConfigurations/muede/element.nix
deleted file mode 100644
index e2a7474f..00000000
--- a/homeConfigurations/muede/element.nix
+++ /dev/null
@@ -1,187 +0,0 @@
-{
-  programs.element-desktop = {
-    enable = true;
-    settings = {
-      # https://github.com/element-hq/element-web/blob/develop/docs/config.md
-      # https://github.com/catppuccin/element
-      "show_labs_settings" = true;
-      "setting_defaults" = {
-        default_theme = "custom-Catppuccin Latte (Mauve)";
-        "custom_themes" = [
-          {
-            "name" = "Catppuccin Latte (Mauve)";
-            "is_dark" = false;
-            "colors" = {
-              "accent-color" = "#8839ef";
-              "primary-color" = "#8839ef";
-              "warning-color" = "#d20f39";
-              "alert" = "#df8e1d";
-              "sidebar-color" = "#dce0e8";
-              "roomlist-background-color" = "#e6e9ef";
-              "roomlist-text-color" = "#4c4f69";
-              "roomlist-text-secondary-color" = "#7c7f93";
-              "roomlist-highlights-color" = "#bcc0cc";
-              "roomlist-separator-color" = "#8c8fa1";
-              "timeline-background-color" = "#eff1f5";
-              "timeline-text-color" = "#4c4f69";
-              "secondary-content" = "#4c4f69";
-              "tertiary-content" = "#4c4f69";
-              "timeline-text-secondary-color" = "#6c6f85";
-              "timeline-highlights-color" = "#e6e9ef";
-              "reaction-row-button-selected-bg-color" = "#bcc0cc";
-              "menu-selected-color" = "#bcc0cc";
-              "focus-bg-color" = "#acb0be";
-              "room-highlight-color" = "#04a5e5";
-              "togglesw-off-color" = "#7c7f93";
-              "other-user-pill-bg-color" = "#04a5e5";
-              "username-colors" = [
-                "#8839ef"
-                "#e64553"
-                "#fe640b"
-                "#40a02b"
-                "#179299"
-                "#04a5e5"
-                "#209fb5"
-                "#7287fd"
-              ];
-              "avatar-background-colors" = [
-                "#1e66f5"
-                "#8839ef"
-                "#40a02b"
-              ];
-            };
-          }
-          {
-            "name" = "Catppuccin Frappé (Mauve)";
-            "is_dark" = true;
-            "colors" = {
-              "accent-color" = "#ca9ee6";
-              "primary-color" = "#ca9ee6";
-              "warning-color" = "#e78284";
-              "alert" = "#e5c890";
-              "sidebar-color" = "#232634";
-              "roomlist-background-color" = "#292c3c";
-              "roomlist-text-color" = "#c6d0f5";
-              "roomlist-text-secondary-color" = "#949cbb";
-              "roomlist-highlights-color" = "#51576d";
-              "roomlist-separator-color" = "#838ba7";
-              "timeline-background-color" = "#303446";
-              "timeline-text-color" = "#c6d0f5";
-              "secondary-content" = "#c6d0f5";
-              "tertiary-content" = "#c6d0f5";
-              "timeline-text-secondary-color" = "#a5adce";
-              "timeline-highlights-color" = "#292c3c";
-              "reaction-row-button-selected-bg-color" = "#51576d";
-              "menu-selected-color" = "#51576d";
-              "focus-bg-color" = "#626880";
-              "room-highlight-color" = "#99d1db";
-              "togglesw-off-color" = "#949cbb";
-              "other-user-pill-bg-color" = "#99d1db";
-              "username-colors" = [
-                "#ca9ee6"
-                "#ea999c"
-                "#ef9f76"
-                "#a6d189"
-                "#81c8be"
-                "#99d1db"
-                "#85c1dc"
-                "#babbf1"
-              ];
-              "avatar-background-colors" = [
-                "#8caaee"
-                "#ca9ee6"
-                "#a6d189"
-              ];
-            };
-          }
-          {
-            "name" = "Catppuccin Macchiato (Mauve)";
-            "is_dark" = true;
-            "colors" = {
-              "accent-color" = "#c6a0f6";
-              "primary-color" = "#c6a0f6";
-              "warning-color" = "#ed8796";
-              "alert" = "#eed49f";
-              "sidebar-color" = "#181926";
-              "roomlist-background-color" = "#1e2030";
-              "roomlist-text-color" = "#cad3f5";
-              "roomlist-text-secondary-color" = "#939ab7";
-              "roomlist-highlights-color" = "#494d64";
-              "roomlist-separator-color" = "#8087a2";
-              "timeline-background-color" = "#24273a";
-              "timeline-text-color" = "#cad3f5";
-              "secondary-content" = "#cad3f5";
-              "tertiary-content" = "#cad3f5";
-              "timeline-text-secondary-color" = "#a5adcb";
-              "timeline-highlights-color" = "#1e2030";
-              "reaction-row-button-selected-bg-color" = "#494d64";
-              "menu-selected-color" = "#494d64";
-              "focus-bg-color" = "#5b6078";
-              "room-highlight-color" = "#91d7e3";
-              "togglesw-off-color" = "#939ab7";
-              "other-user-pill-bg-color" = "#91d7e3";
-              "username-colors" = [
-                "#c6a0f6"
-                "#ee99a0"
-                "#f5a97f"
-                "#a6da95"
-                "#8bd5ca"
-                "#91d7e3"
-                "#7dc4e4"
-                "#b7bdf8"
-              ];
-              "avatar-background-colors" = [
-                "#8aadf4"
-                "#c6a0f6"
-                "#a6da95"
-              ];
-            };
-          }
-          {
-            "name" = "Catppuccin Mocha (Mauve)";
-            "is_dark" = true;
-            "colors" = {
-              "accent-color" = "#cba6f7";
-              "primary-color" = "#cba6f7";
-              "warning-color" = "#f38ba8";
-              "alert" = "#f9e2af";
-              "sidebar-color" = "#11111b";
-              "roomlist-background-color" = "#181825";
-              "roomlist-text-color" = "#cdd6f4";
-              "roomlist-text-secondary-color" = "#9399b2";
-              "roomlist-highlights-color" = "#45475a";
-              "roomlist-separator-color" = "#7f849c";
-              "timeline-background-color" = "#1e1e2e";
-              "timeline-text-color" = "#cdd6f4";
-              "secondary-content" = "#cdd6f4";
-              "tertiary-content" = "#cdd6f4";
-              "timeline-text-secondary-color" = "#a6adc8";
-              "timeline-highlights-color" = "#181825";
-              "reaction-row-button-selected-bg-color" = "#45475a";
-              "menu-selected-color" = "#45475a";
-              "focus-bg-color" = "#585b70";
-              "room-highlight-color" = "#89dceb";
-              "togglesw-off-color" = "#9399b2";
-              "other-user-pill-bg-color" = "#89dceb";
-              "username-colors" = [
-                "#cba6f7"
-                "#eba0ac"
-                "#fab387"
-                "#a6e3a1"
-                "#94e2d5"
-                "#89dceb"
-                "#74c7ec"
-                "#b4befe"
-              ];
-              "avatar-background-colors" = [
-                "#89b4fa"
-                "#cba6f7"
-                "#a6e3a1"
-              ];
-            };
-          }
-        ];
-      };
-    };
-  };
-}
diff --git a/homeConfigurations/muede/fonts.nix b/homeConfigurations/muede/fonts.nix
deleted file mode 100644
index 2d001a7a..00000000
--- a/homeConfigurations/muede/fonts.nix
+++ /dev/null
@@ -1,8 +0,0 @@
-{ pkgs, ... }:
-{
-  fonts.fontconfig.enable = true;
-  home.packages = with pkgs; [
-    roboto-mono
-    recursive
-  ];
-}
diff --git a/homeConfigurations/muede/fuzzel.nix b/homeConfigurations/muede/fuzzel.nix
deleted file mode 100644
index bf337080..00000000
--- a/homeConfigurations/muede/fuzzel.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ pkgs, lib, ... }:
-{
-  config.programs.fuzzel = {
-    enable = true;
-    settings = {
-      main = {
-        terminal = "${lib.getBin pkgs.gnome-console}/bin/kgx";
-        icon-theme = "Adwaita";
-        counter = true;
-        launch-prefix = "niri msg action spawn --";
-      };
-      border = {
-        radius = 30;
-        width = 3;
-      };
-    };
-  };
-}
diff --git a/homeConfigurations/muede/git.nix b/homeConfigurations/muede/git.nix
deleted file mode 100644
index 97c84779..00000000
--- a/homeConfigurations/muede/git.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{
-  programs = {
-    git = {
-      enable = true;
-      settings = {
-        user = {
-          name = "müde";
-          email = "git@darkest.space";
-        };
-
-        aliases = {
-          prettylog = "log --pretty=oneline --graph";
-          spring-clean = "!git branch --merged | xargs -n 1 -r git branch -d";
-        };
-
-        pull.ff = "only";
-        merge.tool = "kdiff3";
-        push.autoSetupRemote = "true";
-        credential.credentialStore = "cache";
-      };
-
-      ignores = [
-        ".direnv"
-        ".idea"
-        ".envrc"
-      ];
-    };
-
-    git-credential-oauth.enable = true;
-    gh = {
-      enable = true;
-      gitCredentialHelper.enable = true;
-    };
-  };
-}
diff --git a/homeConfigurations/muede/gnome.nix b/homeConfigurations/muede/gnome.nix
deleted file mode 100644
index ce5416ec..00000000
--- a/homeConfigurations/muede/gnome.nix
+++ /dev/null
@@ -1,33 +0,0 @@
-{ pkgs, lib, ... }:
-{
-  config = {
-    home.packages = with pkgs; [
-      gitg
-      meld
-      simple-scan
-      pinta
-      dconf-editor
-      impression # usb image writer
-      papers # pdf viewer
-      gnome-software # for flatpak apps
-      gnomeExtensions.solaar-extension
-      snapshot
-    ];
-
-    dconf.settings = {
-      "org/gnome/shell".enabled-extensions = [
-        "GPaste@gnome-shell-extensions.gnome.org"
-        "solaar-extension@sidevesh"
-      ];
-      "org/gnome/desktop/interface".color-scheme = "prefer-dark";
-      "org/gnome/desktop/wm/keybindings" = {
-        switch-windows = [ "<Alt>Tab" ];
-        switch-windows-backward = [ "<Shift><Alt>Tab" ];
-        switch-applications = [ "<Super>Tab" ];
-        switch-applications-backward = [ "<Shift><Super>Tab" ];
-      };
-      "org/gnome/desktop/session".idle-delay = lib.hm.gvariant.mkUint32 300;
-      "org/gnome/Connections".first-run = false;
-    };
-  };
-}
diff --git a/homeConfigurations/muede/niri.nix b/homeConfigurations/muede/niri.nix
deleted file mode 100644
index d2288998..00000000
--- a/homeConfigurations/muede/niri.nix
+++ /dev/null
@@ -1,413 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}:
-{
-  config = {
-    home.sessionVariables.NIXOS_OZONE_WL = "1";
-    home.packages = with pkgs; [
-      xwayland-satellite
-    ];
-
-    qt.style = {
-      package = pkgs.adwaita-qt;
-      name = "adwaita-dark";
-    };
-
-    services.wpaperd.enable = true;
-
-    programs.niri.settings = {
-      outputs = {
-        "BOE 0x0A3B Unknown" = {
-          scale = 1.0;
-          variable-refresh-rate = true;
-        };
-        "Dell Inc. DELL P2719H 39VHKS2" = {
-          scale = 1.0;
-        };
-        "LG Electronics LG ULTRAGEAR 106NTYT27386" = {
-          scale = 1.0;
-          variable-refresh-rate = true;
-        };
-      };
-
-      layout =
-        let
-          colors = config.lib.stylix.colors.withHashtag;
-          pink_light = colors.base0A;
-          pink_dark = colors.base0C;
-          blue_light = colors.base0B;
-          blue_dark = colors.base09;
-          gradient-common = {
-            angle = 90;
-            in' = "oklab";
-          };
-          gradient-active = gradient-common // {
-            from = pink_light;
-            to = blue_light;
-          };
-          gradient-inactive = gradient-common // {
-            from = pink_dark;
-            to = blue_dark;
-          };
-          gradient-urgent = gradient-common // {
-            from = pink_dark;
-            to = pink_light;
-          };
-          gap-size = 6;
-        in
-        {
-          background-color = "transparent";
-          gaps = gap-size;
-          border = {
-            enable = true;
-            width = gap-size / 2;
-            active.gradient = gradient-active;
-            inactive.gradient = gradient-inactive;
-            urgent.gradient = gradient-urgent;
-          };
-          focus-ring = {
-            enable = false;
-            active.gradient = gradient-active;
-            inactive.gradient = gradient-inactive;
-            urgent.gradient = gradient-urgent;
-          };
-          shadow = {
-            enable = false;
-            color = "white";
-            inactive-color = pink_dark;
-            draw-behind-window = true;
-            spread = 5;
-            softness = 10;
-            offset = {
-              x = 0;
-              y = 0;
-            };
-          };
-          insert-hint = {
-            enable = true;
-            display.color = pink_dark;
-          };
-          struts =
-            let
-              strut-inset = 4;
-            in
-            {
-              left = strut-inset;
-              right = strut-inset;
-              top = strut-inset;
-              bottom = strut-inset;
-            };
-          tab-indicator = {
-            place-within-column = true;
-            active.gradient = gradient-inactive;
-            inactive.gradient = gradient-inactive;
-            urgent.gradient = gradient-inactive;
-          };
-        };
-
-      cursor.theme = "Adwaita";
-
-      input = {
-        touchpad.tap = true;
-        keyboard = {
-          xkb = {
-            layout = "de";
-            options = "compose:caps";
-          };
-          numlock = true;
-        };
-      };
-
-      #prefer-no-csd = true;
-      hotkey-overlay.skip-at-startup = true;
-
-      window-rules = [
-        {
-          clip-to-geometry = true;
-          geometry-corner-radius =
-            let
-              radius = 15.;
-            in
-            {
-              top-left = radius;
-              bottom-left = radius;
-              top-right = radius;
-              bottom-right = radius;
-            };
-        }
-        {
-          matches = [
-            {
-              app-id = "steam";
-              title = "^notificationtoasts_\\d+_desktop$";
-            }
-          ];
-          default-floating-position = {
-            x = 10;
-            y = 10;
-            relative-to = "bottom-right";
-          };
-        }
-      ];
-
-      # defaults taken from https://github.com/sodiboo/niri-flake/issues/483
-      binds = {
-        # Keys consist of modifiers separated by + signs, followed by an XKB key name
-        # in the end. To find an XKB name for a particular key, you may use a program
-        # like wev.
-        #
-        # "Mod" is a special modifier equal to Super when running on a TTY, and to Alt
-        # when running as a winit window.
-        #
-        # Most actions that you can bind here can also be invoked programmatically with
-        # `niri msg action do-something`.
-
-        # Mod-Shift-/, which is usually the same as Mod-?,
-        # shows a list of important hotkeys.
-        "Mod+Shift+Numbersign".action.show-hotkey-overlay = { };
-
-        # Suggested binds for running programs: terminal, app launcher, screen locker.
-        "Mod+T".action.spawn = "${lib.getBin pkgs.gnome-console}/bin/kgx";
-        "Mod+D".action.spawn = "${lib.getBin config.programs.fuzzel.package}/bin/fuzzel";
-
-        # You can also use a shell. Do this if you need pipes, multiple commands, etc.
-        # Note: the entire command goes as a single argument in the end.
-        # Mod+T { spawn "bash" "-c" "notify-send hello && exec alacritty"; }
-
-        # Example volume keys mappings for PipeWire & WirePlumber.
-        # The allow-when-locked=true property makes them work even when the session is locked.
-        "XF86AudioRaiseVolume" = {
-          allow-when-locked = true;
-          action.spawn = [
-            "wpctl"
-            "set-volume"
-            "@DEFAULT_AUDIO_SINK@"
-            "0.1+"
-          ];
-        };
-        "XF86AudioLowerVolume" = {
-          allow-when-locked = true;
-          action.spawn = [
-            "wpctl"
-            "set-volume"
-            "@DEFAULT_AUDIO_SINK@"
-            "0.1-"
-          ];
-        };
-        "XF86AudioMute" = {
-          allow-when-locked = true;
-          action.spawn = [
-            "wpctl"
-            "set-mute"
-            "@DEFAULT_AUDIO_SINK@"
-            "toggle"
-          ];
-        };
-        "XF86AudioMicMute" = {
-          allow-when-locked = true;
-          action.spawn = [
-            "wpctl"
-            "set-mute"
-            "@DEFAULT_AUDIO_SOURCE@"
-            "toggle"
-          ];
-        };
-
-        "Mod+Q".action.close-window = { };
-
-        "Mod+Left".action.focus-column-left = { };
-        "Mod+Down".action.focus-window-down = { };
-        "Mod+Up".action.focus-window-up = { };
-        "Mod+Right".action.focus-column-right = { };
-
-        "Mod+Ctrl+Left".action.move-column-left = { };
-        "Mod+Ctrl+Down".action.move-window-down = { };
-        "Mod+Ctrl+Up".action.move-window-up = { };
-        "Mod+Ctrl+Right".action.move-column-right = { };
-
-        # Alternative commands that move across workspaces when reaching
-        # the first or last window in a column.
-        # Mod+J     { focus-window-or-workspace-down; }
-        # Mod+K     { focus-window-or-workspace-up; }
-        # Mod+Ctrl+J     { move-window-down-or-to-workspace-down; }
-        # Mod+Ctrl+K     { move-window-up-or-to-workspace-up; }
-
-        "Mod+Home".action.focus-column-first = { };
-        "Mod+End".action.focus-column-last = { };
-        "Mod+Ctrl+Home".action.move-column-to-first = { };
-        "Mod+Ctrl+End".action.move-column-to-last = { };
-
-        "Mod+Shift+Left".action.focus-monitor-left = { };
-        "Mod+Shift+Down".action.focus-monitor-down = { };
-        "Mod+Shift+Up".action.focus-monitor-up = { };
-        "Mod+Shift+Right".action.focus-monitor-right = { };
-
-        "Mod+Shift+Ctrl+Left".action.move-column-to-monitor-left = { };
-        "Mod+Shift+Ctrl+Down".action.move-column-to-monitor-down = { };
-        "Mod+Shift+Ctrl+Up".action.move-column-to-monitor-up = { };
-        "Mod+Shift+Ctrl+Right".action.move-column-to-monitor-right = { };
-
-        # Alternatively, there are commands to move just a single window:
-        # Mod+Shift+Ctrl+Left  { move-window-to-monitor-left; }
-        # ...
-
-        # And you can also move a whole workspace to another monitor:
-        # Mod+Shift+Ctrl+Left  { move-workspace-to-monitor-left; }
-        # ...
-
-        "Mod+Page_Down".action.focus-workspace-down = { };
-        "Mod+Page_Up".action.focus-workspace-up = { };
-        "Mod+U".action.focus-workspace-down = { };
-        "Mod+I".action.focus-workspace-up = { };
-        "Mod+Ctrl+Page_Down".action.move-column-to-workspace-down = { };
-        "Mod+Ctrl+Page_Up".action.move-column-to-workspace-up = { };
-        "Mod+Ctrl+U".action.move-column-to-workspace-down = { };
-        "Mod+Ctrl+I".action.move-column-to-workspace-up = { };
-
-        # Alternatively, there are commands to move just a single window:
-        # Mod+Ctrl+Page_Down { move-window-to-workspace-down; }
-        # ...
-
-        "Mod+Shift+Page_Down".action.move-workspace-down = { };
-        "Mod+Shift+Page_Up".action.move-workspace-up = { };
-        "Mod+Shift+U".action.move-workspace-down = { };
-        "Mod+Shift+I".action.move-workspace-up = { };
-
-        # You can bind mouse wheel scroll ticks using the following syntax.
-        # These binds will change direction based on the natural-scroll setting.
-        #
-        # To avoid scrolling through workspaces really fast, you can use
-        # the cooldown-ms property. The bind will be rate-limited to this value.
-        # You can set a cooldown on any bind, but it's most useful for the wheel.
-        "Mod+WheelScrollDown" = {
-          cooldown-ms = 150;
-          action.focus-workspace-down = { };
-        };
-        "Mod+WheelScrollUp" = {
-          cooldown-ms = 150;
-          action.focus-workspace-up = { };
-        };
-        "Mod+Ctrl+WheelScrollDown" = {
-          cooldown-ms = 150;
-          action.move-column-to-workspace-down = { };
-        };
-        "Mod+Ctrl+WheelScrollUp" = {
-          cooldown-ms = 150;
-          action.move-column-to-workspace-up = { };
-        };
-
-        "Mod+WheelScrollRight".action.focus-column-right = { };
-        "Mod+WheelScrollLeft".action.focus-column-left = { };
-        "Mod+Ctrl+WheelScrollRight".action.move-column-right = { };
-        "Mod+Ctrl+WheelScrollLeft".action.move-column-left = { };
-
-        # Usually scrolling up and down with Shift in applications results in
-        # horizontal scrolling; these binds replicate that.
-        "Mod+Shift+WheelScrollDown".action.focus-column-right = { };
-        "Mod+Shift+WheelScrollUp".action.focus-column-left = { };
-        "Mod+Ctrl+Shift+WheelScrollDown".action.move-column-right = { };
-        "Mod+Ctrl+Shift+WheelScrollUp".action.move-column-left = { };
-
-        # Similarly, you can bind touchpad scroll "ticks".
-        # Touchpad scrolling is continuous, so for these binds it is split into
-        # discrete intervals.
-        # These binds are also affected by touchpad's natural-scroll, so these
-        # example binds are "inverted", since we have natural-scroll enabled for
-        # touchpads by default.
-        # Mod+TouchpadScrollDown { spawn "wpctl" "set-volume" "@DEFAULT_AUDIO_SINK@" "0.02+"; }
-        # Mod+TouchpadScrollUp   { spawn "wpctl" "set-volume" "@DEFAULT_AUDIO_SINK@" "0.02-"; }
-
-        # You can refer to workspaces by index. However, keep in mind that
-        # niri is a dynamic workspace system, so these commands are kind of
-        # "best effort". Trying to refer to a workspace index bigger than
-        # the current workspace count will instead refer to the bottommost
-        # (empty) workspace.
-        #
-        # For example, with 2 workspaces + 1 empty, indices 3, 4, 5 and so on
-        # will all refer to the 3rd workspace.
-        "Mod+1".action.focus-workspace = 1;
-        "Mod+2".action.focus-workspace = 2;
-        "Mod+3".action.focus-workspace = 3;
-        "Mod+4".action.focus-workspace = 4;
-        "Mod+5".action.focus-workspace = 5;
-        "Mod+6".action.focus-workspace = 6;
-        "Mod+7".action.focus-workspace = 7;
-        "Mod+8".action.focus-workspace = 8;
-        "Mod+9".action.focus-workspace = 9;
-        "Mod+Ctrl+1".action.move-column-to-workspace = 1;
-        "Mod+Ctrl+2".action.move-column-to-workspace = 2;
-        "Mod+Ctrl+3".action.move-column-to-workspace = 3;
-        "Mod+Ctrl+4".action.move-column-to-workspace = 4;
-        "Mod+Ctrl+5".action.move-column-to-workspace = 5;
-        "Mod+Ctrl+6".action.move-column-to-workspace = 6;
-        "Mod+Ctrl+7".action.move-column-to-workspace = 7;
-        "Mod+Ctrl+8".action.move-column-to-workspace = 8;
-        "Mod+Ctrl+9".action.move-column-to-workspace = 9;
-
-        # Alternatively, there are commands to move just a single window:
-        # Mod+Ctrl+1 { move-window-to-workspace 1; }
-
-        # Switches focus between the current and the previous workspace.
-        # Mod+Tab { focus-workspace-previous; }
-
-        "Mod+Comma".action.consume-window-into-column = { };
-        "Mod+Period".action.expel-window-from-column = { };
-
-        # There are also commands that consume or expel a single window to the side.
-        # Mod+BracketLeft  { consume-or-expel-window-left; }
-        # Mod+BracketRight { consume-or-expel-window-right; }
-
-        "Mod+R".action.switch-preset-column-width = { };
-        "Mod+Shift+R".action.reset-window-height = { };
-        "Mod+F".action.maximize-column = { };
-        "Mod+Shift+F".action.fullscreen-window = { };
-        "Mod+C".action.center-column = { };
-
-        # Finer width adjustments.
-        # This command can also:
-        # * set width in pixels: "1000"
-        # * adjust width in pixels: "-5" or "+5"
-        # * set width as a percentage of screen width: "25%"
-        # * adjust width as a percentage of screen width: "-10%" or "+10%"
-        # Pixel sizes use logical, or scaled, pixels. I.e. on an output with scale 2.0,
-        # set-column-width "100" will make the column occupy 200 physical screen pixels.
-        "Mod+Minus".action.set-column-width = "-10%";
-        "Mod+Equal".action.set-column-width = "+10%";
-
-        # Finer height adjustments when in column with other windows.
-        "Mod+Shift+Minus".action.set-window-height = "-10%";
-        "Mod+Shift+Equal".action.set-window-height = "+10%";
-
-        # Actions to switch layouts.
-        # Note: if you uncomment these, make sure you do NOT have
-        # a matching layout switch hotkey configured in xkb options above.
-        # Having both at once on the same hotkey will break the switching,
-        # since it will switch twice upon pressing the hotkey (once by xkb, once by niri).
-        # Mod+Space       { switch-layout "next"; }
-        # Mod+Shift+Space { switch-layout "prev"; }
-
-        "Print".action.screenshot = { };
-        "Ctrl+Print".action.screenshot-screen = { };
-        "Alt+Print".action.screenshot-window = { };
-
-        # The quit action will show a confirmation dialog to avoid accidental exits.
-        "Mod+Shift+E".action.quit = { };
-
-        # Powers off the monitors. To turn them back on, do any input like
-        # moving the mouse or pressing any other key.
-        "Mod+Shift+P".action.power-off-monitors = { };
-
-        "Mod+W".action.toggle-column-tabbed-display = { };
-        "Mod+O".action.toggle-overview = { };
-
-        "Super+Alt+L" = {
-          action.spawn = "${pkgs.systemd}/bin/loginctl lock-session";
-          allow-when-locked = true;
-        };
-      };
-    };
-  };
-}
diff --git a/homeConfigurations/muede/podman.nix b/homeConfigurations/muede/podman.nix
deleted file mode 100644
index ea5b090e..00000000
--- a/homeConfigurations/muede/podman.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-  services.podman = {
-    settings = {
-      policy = {
-        default = [ { type = "reject"; } ];
-        transports = {
-          docker-daemon = {
-            "" = [ { type = "insecureAcceptAnything"; } ];
-          };
-          docker = {
-            "docker.io/library/debian" = [ { type = "insecureAcceptAnything"; } ];
-            "docker.io/library/rust" = [ { type = "insecureAcceptAnything"; } ];
-          };
-        };
-      };
-    };
-  };
-}
diff --git a/homeConfigurations/muede/ssh.nix b/homeConfigurations/muede/ssh.nix
deleted file mode 100644
index 8643fc95..00000000
--- a/homeConfigurations/muede/ssh.nix
+++ /dev/null
@@ -1,62 +0,0 @@
-{
-  config.programs.ssh = {
-    enable = true;
-    enableDefaultConfig = false;
-    matchBlocks = {
-      "vpn2" = {
-        host = "vpn2 hetzner-vpn2";
-        hostname = "2a01:4f8:c013:65dd::1";
-        user = "root";
-      };
-      "openwrt" = {
-        host = "openwrt openwrt.lan";
-        hostname = "openwrt.lan";
-        user = "root";
-      };
-      "openwrt-ts" = {
-        hostname = "openwrt.donkey-pentatonic.ts.net";
-        port = 2222;
-        user = "root";
-      };
-      "openwrt-j" = {
-        hostname = "openwrt.donkey-pentatonic.ts.net";
-        proxyJump = "vpn1";
-        port = 2222;
-        user = "root";
-      };
-      "pc2-power" = {
-        hostname = "openwrt.donkey-pentatonic.ts.net";
-        proxyJump = "vpn1";
-        port = 2222;
-        user = "pc2-power";
-      };
-      "avd-power" = {
-        # hostname = "2001:678:560:23:9833:63ff:fe2d:f477"
-        # hostname = "195.160.172.25";
-        hostname = "avd-jumphost.club.berlin.ccc.de";
-        user = "power";
-      };
-      "avd" = {
-        hostname = "avd.club.berlin.ccc.de";
-        user = "vinzenz";
-      };
-      "builder.berlin.ccc.de" = {
-        hostname = "195.160.172.36";
-        user = "root";
-      };
-      "cccb.zerforschen.plus" = {
-        hostname = "2a01:4f8:c013:cbdd::1";
-        user = "root";
-      };
-      "berlin.ccc.de" = {
-        hostname = "195.160.173.9";
-        user = "deploy";
-        port = 31337;
-      };
-      "forgejo-runner-1" = {
-        hostname = "forgejo-runner-1.dev.zerforschen.plus";
-        user = "root";
-      };
-    };
-  };
-}
diff --git a/homeConfigurations/muede/starship.nix b/homeConfigurations/muede/starship.nix
deleted file mode 100644
index 1550aac7..00000000
--- a/homeConfigurations/muede/starship.nix
+++ /dev/null
@@ -1,213 +0,0 @@
-{ lib, ... }:
-{
-  config.programs.starship = {
-    enable = true;
-    enableZshIntegration = true;
-    settings = {
-      "$schema" = "https://starship.rs/config-schema.json";
-
-      add_newline = true;
-      format =
-        "[](fg:color_r)[$username $os $hostname ($container )](bg:color_r fg:text_r)[ ](fg:color_r bg:color_g)"
-        + "[$directory ](bg:color_g fg:text_g)[ ](fg:color_g bg:color_b)"
-        + "([(\\[$git_state$git_branch$git_commit$git_status\\] )"
-        + "$all](bg:color_b fg:text_b))[](fg:color_b bg:color_y)"
-        + "([ $cmd_duration$status](bg:color_y fg:text_y))[](fg:color_y)"
-        + "$line_break$character ";
-
-      # TODO: replace with base16 theme
-      palette = lib.mkForce "color_me_surprised";
-      palettes.color_me_surprised = {
-        "color_r" = "#a30262";
-        "color_g" = "#d162a4";
-        "color_b" = "#5BCEFA";
-        "color_y" = "#4a6bb1";
-        "text_r" = "white";
-        "text_g" = "black";
-        "text_b" = "black";
-        "text_y" = "white";
-      };
-
-      username = {
-        format = "[$user]($style)";
-        style_user = "bg:color_r fg:text_r";
-        style_root = "bold bg:color_r fg:text_r";
-        show_always = true;
-      };
-      os = {
-        disabled = false;
-        format = "$symbol";
-      };
-      hostname = {
-        disabled = false;
-        ssh_only = false;
-        format = "$hostname";
-        ssh_symbol = "";
-        aliases = {
-          "muede-lpt2" = "lpt";
-          "muede-pc2" = "pc";
-        };
-      };
-      container = {
-        format = "\[$symbol$name\]";
-      };
-      directory = {
-        format = "$path[( $read_only)]($read_only_style)";
-        truncate_to_repo = true;
-        truncation_symbol = "…/";
-        read_only = "󰌾";
-        read_only_style = "fg:color_r bg:green";
-        home_symbol = "";
-        substitutions = {
-          "Documents" = "󰈙";
-          "Downloads" = "";
-          "Music" = "󰝚";
-          "Pictures" = "";
-          "Developer" = "󰲋";
-        };
-      };
-
-      git_state = {
-        style = "fg:text_b bg:color_b";
-      };
-      git_branch = {
-        style = "fg:text_b bg:color_b";
-        format = "[$symbol $branch(:$remote_branch) ]($style)";
-        symbol = "";
-      };
-      git_commit = {
-        format = "[$hash$tag ]($style)";
-        style = "fg:text_b bg:color_b";
-        tag_symbol = "";
-      };
-      git_status = {
-        format = "[$all_status$ahead_behind]($style)";
-        style = "fg:text_b bg:color_b";
-        ahead = "⇡$count";
-        behind = "⇣$count";
-        diverged = "⇕⇡$ahead_count⇣$behind_count";
-      };
-
-      package = {
-        symbol = "󰏗";
-        format = "$symbol$version ";
-        version_format = "$\{raw\}";
-      };
-      rust = {
-        symbol = "󱘗";
-        format = "$symbol$version ";
-        version_format = "$major.$minor";
-      };
-      nix_shell = {
-        symbol = "";
-        format = "$symbol( \($name\))";
-      };
-
-      status = {
-        disabled = false;
-        format = "[$symbol$status_common_meaning$status_signal_name$status_maybe_int]($style)";
-        map_symbol = true;
-        pipestatus = true;
-        style = "bg:color_y fg:text_y";
-      };
-      cmd_duration = {
-        format = "󱦟 $duration ";
-      };
-
-      character = {
-        success_symbol = "[](bold)";
-        error_symbol = "[✗](bold fg:color_r)";
-      };
-
-      # icons
-      c.symbol = "";
-      aws.symbol = " ";
-      buf.symbol = "";
-      bun.symbol = "";
-      cpp.symbol = "";
-      cmake.symbol = "";
-      conda.symbol = "";
-      crystal.symbol = "";
-      dart.symbol = "";
-      deno.symbol = "";
-      docker_context.symbol = "";
-      elixir.symbol = "";
-      elm.symbol = "";
-      fennel.symbol = "";
-      fossil_branch.symbol = "";
-      gcloud.symbol = " ";
-      golang.symbol = "";
-      guix_shell.symbol = "";
-      haskell.symbol = "";
-      haxe.symbol = "";
-      hg_branch.symbol = "";
-      java.symbol = "";
-      julia.symbol = "";
-      kotlin.symbol = "";
-      lua.symbol = "";
-      memory_usage.symbol = "󰍛";
-      meson.symbol = "󰔷";
-      nim.symbol = "󰆥";
-      nodejs.symbol = "";
-      ocaml.symbol = "";
-      os.symbols = {
-        Alpaquita = "";
-        Alpine = "";
-        AlmaLinux = "";
-        Amazon = "";
-        Android = "";
-        Arch = "";
-        Artix = "";
-        CachyOS = "";
-        CentOS = "";
-        Debian = "";
-        DragonFly = "";
-        Emscripten = "";
-        EndeavourOS = "";
-        Fedora = "";
-        FreeBSD = "";
-        Garuda = "󰛓";
-        Gentoo = "";
-        HardenedBSD = "󰞌";
-        Illumos = "󰈸";
-        Kali = "";
-        Linux = "";
-        Mabox = "";
-        Macos = "";
-        Manjaro = "";
-        Mariner = "";
-        MidnightBSD = "";
-        Mint = "";
-        NetBSD = "";
-        NixOS = "";
-        Nobara = "";
-        OpenBSD = "󰈺";
-        openSUSE = "";
-        OracleLinux = "󰌷";
-        Pop = "";
-        Raspbian = "";
-        Redhat = "";
-        RedHatEnterprise = "";
-        RockyLinux = "";
-        Redox = "󰀘";
-        Solus = "󰠳";
-        SUSE = "";
-        Ubuntu = "";
-        Unknown = "";
-        Void = "";
-        Windows = "󰍲";
-      };
-      perl.symbol = "";
-      php.symbol = "";
-      pijul_channel.symbol = "";
-      pixi.symbol = "󰏗";
-      python.symbol = "";
-      rlang.symbol = "󰟔";
-      ruby.symbol = "";
-      scala.symbol = "";
-      swift.symbol = "";
-      zig.symbol = "";
-      gradle.symbol = "";
-    };
-  };
-}
diff --git a/homeConfigurations/muede/swayidle.nix b/homeConfigurations/muede/swayidle.nix
deleted file mode 100644
index 73029e65..00000000
--- a/homeConfigurations/muede/swayidle.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{ pkgs, ... }:
-{
-  services.swayidle =
-    let
-      lock-command = "${pkgs.systemd}/bin/loginctl lock-session";
-    in
-    {
-      enable = true;
-      systemdTarget = "graphical-session.target";
-      timeouts = [
-        {
-          timeout = 30;
-          command = lock-command;
-        }
-        {
-          timeout = 60 * 10;
-          command = "${pkgs.systemd}/bin/systemctl suspend";
-        }
-      ];
-      events = [
-        {
-          event = "before-sleep";
-          command = "${pkgs.playerctl}/bin/playerctl pause; ${lock-command}";
-        }
-      ];
-    };
-}
diff --git a/homeConfigurations/muede/swaylock.nix b/homeConfigurations/muede/swaylock.nix
deleted file mode 100644
index f807135f..00000000
--- a/homeConfigurations/muede/swaylock.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-# based on https://codeberg.org/kiara/cfg/src/commit/b9c472acd78c9c08dfe8b6a643c5c82cc5828433/home-manager/kiara/swaylock.nix#
-{ pkgs, ... }:
-{
-  stylix.targets.swaylock = {
-    enable = true;
-    useWallpaper = true;
-  };
-
-  programs.swaylock = {
-    enable = true;
-    package = pkgs.swaylock-effects;
-    # https://github.com/jirutka/swaylock-effects/blob/master/swaylock.1.scd
-    settings = {
-      screenshot = false;
-      effect-blur = "9x9";
-      effect-vignette = "0.2:0.2";
-      fade-in = 0.5;
-      font-size = 75;
-      indicator-caps-lock = true;
-      clock = true;
-      indicator-radius = 400;
-      show-failed-attempts = true;
-      ignore-empty-password = true;
-      grace = 3.5;
-      indicator-thickness = 20;
-    };
-  };
-}
diff --git a/homeConfigurations/muede/swaync.nix b/homeConfigurations/muede/swaync.nix
deleted file mode 100644
index 113aac0d..00000000
--- a/homeConfigurations/muede/swaync.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{ pkgs, ... }:
-{
-  services.swaync = {
-    enable = true;
-    settings = {
-      "$schema" = "${pkgs.swaynotificationcenter}/etc/xdg/swaync/configSchema.json";
-
-      hide-on-clear = true;
-
-      positionX = "center";
-      fit-to-screen = false;
-      control-center-height = 750;
-
-      widgets = [
-        "mpris"
-        "volume"
-        "title"
-        "dnd"
-        "inhibitors"
-        "notifications"
-      ];
-
-      widget-config = {
-        mpris.autohide = true;
-      };
-    };
-  };
-}
diff --git a/homeConfigurations/muede/vscode.nix b/homeConfigurations/muede/vscode.nix
deleted file mode 100644
index b7e01ab3..00000000
--- a/homeConfigurations/muede/vscode.nix
+++ /dev/null
@@ -1,102 +0,0 @@
-{ pkgs, lib, ... }:
-{
-  config = {
-    home.sessionVariables = {
-      NIXOS_OZONE_WL = "1";
-      ELECTRON_OZONE_PLATFORM_HINT = "auto";
-    };
-    programs.vscode = {
-      enable = true;
-      package = pkgs.vscodium;
-      profiles.default = {
-        enableUpdateCheck = false;
-        extensions =
-          with pkgs.nix-vscode-extensions.open-vsx;
-          [
-            # keep-sorted start
-            catppuccin.catppuccin-vsc-icons
-            davidanson.vscode-markdownlint
-            editorconfig.editorconfig
-            jnoortheen.nix-ide
-            llvm-vs-code-extensions.vscode-clangd
-            mkhl.direnv
-            ms-python.python
-            muhammad-sammy.csharp
-            redhat.vscode-yaml
-            rust-lang.rust-analyzer
-            tamasfe.even-better-toml
-            yzhang.markdown-all-in-one
-            # keep-sorted end
-          ]
-          ++ (with pkgs.vscode-extensions; [
-            vadimcn.vscode-lldb
-            RoweWilsonFrederiskHolme.wikitext
-            ms-dotnettools.csharp
-          ]);
-        userSettings = {
-          "files.autoSave" = "afterDelay";
-          "files.autoSaveWhenNoErrors" = true;
-          "files.autoSaveWorkspaceFilesOnly" = true;
-          "files.exclude" = [
-            ".git"
-            ".direnv"
-          ];
-
-          "editor.fontLigatures" = true;
-          "editor.formatOnSave" = true;
-          "editor.formatOnSaveMode" = "modificationsIfAvailable";
-          "editor.minimap.autohide" = true;
-          "editor.mouseWheelZoom" = true;
-          "terminal.integrated.mouseWheelZoom" = true;
-
-          "workbench.startupEditor" = "readme";
-          "workbench.enableExperiments" = false;
-          "workbench.iconTheme" = "catppuchin-mocha";
-
-          "update.mode" = "none";
-          "extensions.autoUpdate" = false;
-          "extensions.autoCheckUpdates" = false;
-
-          "telemetry.telemetryLevel" = "off";
-          "redhat.telemetry.enabled" = false;
-
-          "git.autofetch" = true;
-          "git.path" = "${lib.getBin pkgs.git}/bin/git";
-          "diffEditor.diffAlgorithm" = "advanced";
-          "explorer.excludeGitIgnore" = false;
-          "markdown.extension.tableFormatter.normalizeIndentation" = true;
-          "markdown.extension.toc.orderedList" = false;
-
-          "rust-analyzer.checkOnSave.command" = "clippy";
-
-          "nix.formatterPath" = "${lib.getBin pkgs.nixfmt-tree}/bin/nixfmt-tree";
-          "nix.enableLanguageServer" = true;
-          "nix.serverPath" = "${lib.getBin pkgs.nil}/bin/nil";
-          "nix.serverSettings" = {
-            "nil" = {
-              "formatting" = {
-                "command" = [ "${lib.getBin pkgs.nixfmt-tree}/bin/nixfmt-tree" ];
-              };
-            };
-          };
-
-          "dotnetAcquisitionExtension.sharedExistingDotnetPath" =
-            "${lib.getBin pkgs.dotnetCorePackages.sdk_9_0}/bin/dotnet";
-
-          "\[makefile\]" = {
-            "editor.insertSpaces" = false;
-            "editor.detectIndentation" = false;
-          };
-
-          "\[nix\]" = {
-            "editor.formatOnSave" = false;
-          };
-
-          "\[css\]" = {
-            "editor.formatOnSave" = false;
-          };
-        };
-      };
-    };
-  };
-}
diff --git a/homeConfigurations/muede/waybar.css b/homeConfigurations/muede/waybar.css
deleted file mode 100644
index 0f1d38a3..00000000
--- a/homeConfigurations/muede/waybar.css
+++ /dev/null
@@ -1,330 +0,0 @@
-/* #region stylix overrides*/
-.modules-left #workspaces button,
-.modules-left #workspaces button.focused,
-.modules-left #workspaces button.active,
-.modules-center #workspaces button,
-.modules-center #workspaces button.focused,
-.modules-center #workspaces button.active,
-.modules-right #workspaces button,
-.modules-right #workspaces button.focused,
-.modules-right #workspaces button.active {
-  border-bottom: unset;
-}
-/* #endregion */
-
-* {
-  font-family: monospace;
-  font-size: 13px;
-}
-
-window#waybar {
-  transition-property: background-color;
-  transition-duration: 0.5s;
-  /* Gradient border spanning the entire waybar window */
-  border-bottom: 3px solid transparent;
-  background-clip: padding-box, border-box;
-  background-origin: padding-box, border-box;
-  background-image:
-    linear-gradient(135deg, @base00, @base01),
-    linear-gradient(135deg, @base0C, @base09);
-}
-
-/* Common pill styling for all widgets */
-#clock,
-#cpu,
-#memory,
-#disk,
-#temperature,
-#backlight,
-#network,
-#pulseaudio,
-#wireplumber,
-#custom-media,
-#mode,
-#scratchpad,
-#mpd,
-#custom-weather,
-#battery,
-#power-profiles-daemon,
-#idle_inhibitor,
-#custom-swaync,
-#bluetooth,
-#mpris,
-#upower,
-#workspaces,
-#window,
-#tray,
-#custom-wlogout,
-#privacy-item {
-  margin: 0px 4px 6px;
-  padding: 0px 8px;
-  background: linear-gradient(135deg, @base02, @base01);
-  border-radius: 15px;
-  border: 2px solid;
-  transition: all 0.3s ease;
-}
-
-/* special treatment for weird sized widgets */
-#custom-wlogout,
-#power-profiles-daemon,
-#idle_inhibitor {
-  padding: 0px 10px 0px 8px;
-}
-
-#workspaces {
-  padding-left: 0;
-  padding-right: 0;
-}
-
-/* Individual widget colors */
-#workspaces,
-#window,
-#tray {
-  border-color: @base0D;
-}
-
-#workspaces button {
-  padding: 0 6px;
-  background-color: transparent;
-  color: @base05;
-  border-radius: 15px;
-  border: none;
-  transition: all 0.3s ease;
-}
-
-#workspaces button:hover {
-  background: @base03;
-}
-
-#workspaces button.focused,
-#workspaces button.active {
-  background-color: @base03;
-  color: @base07;
-}
-
-#workspaces button.urgent {
-  background-color: @base08;
-  color: @base00;
-}
-
-#clock {
-  color: @base07;
-  border-color: @base0D;
-}
-
-#cpu {
-  color: @base09;
-  border-color: @base09;
-}
-
-#memory {
-  color: @base0E;
-  border-color: @base0E;
-}
-
-#disk {
-  color: @base0D;
-  border-color: @base0D;
-}
-
-#temperature {
-  color: @base08;
-  border-color: @base08;
-}
-
-#backlight {
-  color: @base0A;
-  border-color: @base0A;
-}
-
-#network {
-  color: @base0B;
-  border-color: @base0B;
-}
-
-#pulseaudio,
-#wireplumber {
-  color: @base0D;
-  border-color: @base0D;
-}
-
-#custom-media {
-  color: @base0E;
-  border-color: @base0E;
-}
-
-#mode {
-  color: @base05;
-  border-color: @base03;
-  box-shadow: inset 0 -3px @base05;
-}
-
-#mpd {
-  color: @base0E;
-  border-color: @base0E;
-}
-
-#custom-weather {
-  color: @base0B;
-  border-color: @base0B;
-}
-
-#battery,
-#power-profiles-daemon,
-#idle_inhibitor {
-  color: @base05;
-  border-color: @base03;
-}
-
-#custom-swaync {
-  color: @base0E;
-  border-color: @base0E;
-}
-
-#bluetooth {
-  color: @base0D;
-  border-color: @base0D;
-}
-
-#mpris {
-  color: @base0E;
-  border-color: @base0E;
-}
-
-#upower {
-  color: @base0B;
-  border-color: @base0B;
-}
-
-/* If workspaces is the leftmost module, omit left margin */
-.modules-left > widget:first-child > #workspaces {
-  margin-left: 0;
-}
-
-/* If workspaces is the rightmost module, omit right margin */
-.modules-right > widget:last-child > #workspaces {
-  margin-right: 0;
-}
-
-/* Battery states with colored glows */
-#battery.charging {
-  box-shadow: 0 0 6px rgba(168, 201, 255, 0.6);
-  border-color: @base0B;
-  color: @base0B;
-}
-
-#battery.warning:not(.charging) {
-  box-shadow: 0 0 6px rgba(209, 98, 164, 0.6);
-  border-color: @base0A;
-  color: @base0A;
-}
-
-@keyframes blink {
-  to {
-    background-color: #ffffff;
-    color: #000000;
-  }
-}
-
-#battery.critical:not(.charging) {
-  box-shadow: 0 0 6px rgba(243, 139, 168, 0.8);
-  border-color: @base08;
-  color: @base08;
-  animation-name: blink;
-  animation-duration: 0.5s;
-  /* Using steps() instead of linear as a timing function to limit cpu usage */
-  animation-timing-function: steps(12);
-  animation-iteration-count: infinite;
-  animation-direction: alternate;
-}
-
-/* Bluetooth connected state */
-#bluetooth.connected {
-  box-shadow: 0 0 6px rgba(137, 180, 250, 0.5);
-}
-
-/* Power profiles with state-appropriate glows */
-#power-profiles-daemon.performance {
-  box-shadow: 0 0 6px rgba(243, 139, 168, 0.6);
-  border-color: @base08;
-  color: @base08;
-}
-
-#power-profiles-daemon.balanced {
-  box-shadow: 0 0 6px rgba(137, 180, 250, 0.6);
-  border-color: @base0D;
-  color: @base0D;
-}
-
-#power-profiles-daemon.power-saver {
-  box-shadow: 0 0 6px rgba(168, 201, 255, 0.6);
-  border-color: @base0B;
-  color: @base0B;
-}
-
-/* Idle inhibitor with state glow */
-#idle_inhibitor.activated {
-  box-shadow: 0 0 6px rgba(137, 180, 250, 0.6);
-  border-color: @base0D;
-  color: @base0D;
-}
-
-/* MPD states with glows */
-#mpd.playing {
-  box-shadow: 0 0 6px rgba(168, 201, 255, 0.5);
-  border-color: @base0B;
-  color: @base0B;
-}
-
-#mpd.paused {
-  box-shadow: 0 0 6px rgba(203, 166, 247, 0.5);
-  border-color: @base0E;
-  color: @base0E;
-}
-
-#mpd.disconnected,
-#mpd.stopped {
-  color: @base04;
-}
-
-#tray > .passive {
-  -gtk-icon-effect: dim;
-}
-
-#tray > .needs-attention {
-  -gtk-icon-effect: highlight;
-  box-shadow: 0 0 6px rgba(243, 139, 168, 0.8);
-  border-color: @base08;
-}
-
-#privacy {
-  padding: 0;
-}
-
-#privacy-item.screenshare {
-  box-shadow: 0 0 6px rgba(209, 98, 164, 0.6);
-  border-color: @base0A;
-  color: @base0A;
-}
-
-#privacy-item.audio-in {
-  box-shadow: 0 0 6px rgba(168, 201, 255, 0.6);
-  border-color: @base0B;
-  color: @base0B;
-}
-
-#privacy-item.audio-out {
-  box-shadow: 0 0 6px rgba(137, 180, 250, 0.6);
-  border-color: @base0D;
-  color: @base0D;
-}
-
-/* Custom wlogout button */
-#custom-wlogout {
-  color: @base08;
-  border-color: @base08;
-}
-
-#custom-wlogout:hover {
-  box-shadow: 0 0 6px rgba(243, 139, 168, 0.5);
-}
diff --git a/homeConfigurations/muede/waybar.nix b/homeConfigurations/muede/waybar.nix
deleted file mode 100644
index 1f014e2f..00000000
--- a/homeConfigurations/muede/waybar.nix
+++ /dev/null
@@ -1,284 +0,0 @@
-{
-  pkgs,
-  lib,
-  config,
-  ...
-}:
-{
-  home.packages = with pkgs; [
-    playerctl
-  ];
-
-  programs.waybar = {
-    enable = true;
-    systemd = {
-      enable = true;
-      target = "graphical-session.target";
-    };
-    style = lib.mkAfter (builtins.readFile ./waybar.css);
-    settings = {
-      mainBar = {
-        layer = "top";
-        position = "top";
-        output = [
-          "eDP-1"
-          "HDMI-A-1"
-        ];
-        mode = "dock";
-        spacing = "8";
-        modules-left = [
-          "niri/workspaces"
-          "tray"
-          "niri/window"
-        ];
-        modules-center = [
-          "privacy"
-          "clock"
-          "custom/swaync"
-        ];
-        modules-right = [
-          "mpris"
-          "wireplumber"
-          "bluetooth"
-          "backlight"
-          "network"
-          "power-profiles-daemon"
-          "idle_inhibitor"
-          #"image"
-          "custom/weather"
-          "temperature"
-          "cpu"
-          "memory"
-          "disk"
-          # "battery"
-          "upower"
-          "custom/wlogout"
-        ];
-
-        "niri/workspaces" = {
-          format = "{icon}";
-        };
-        "niri/window" = {
-          separate-outputs = true;
-          icon = true;
-        };
-        network = {
-          #interface = "wlo1";
-          format = "{ifname}";
-          format-wifi = " {essid}";
-          format-ethernet = "󰈀";
-          format-linked = "󱘖";
-          format-disconnected = "󰣽";
-          tooltip-format = "{ifname} via {gwaddr}";
-          tooltip-format-wifi = "{essid} ({signalStrength}%)";
-          tooltip-format-ethernet = "{ifname} {ipaddr}/{cidr}";
-          tooltip-format-disconnected = "Disconnected";
-          max-length = 20;
-        };
-        clock = {
-          format = "{:%a, %d. %b  %H:%M}";
-          tooltip-format = "<tt><small>{calendar}</small></tt>";
-          calendar = {
-            mode = "month";
-            weeks-pos = "right";
-            on-scroll = 1;
-            on-click-right = "mode";
-            format = {
-              #months = "<span color='#ffead3'><b>{}</b></span>";
-              #days = "<span color='#ecc6d9'><b>{}</b></span>";
-              #weeks = "<span color='#99ffdd'><b>W{}</b></span>";
-              #weekdays = "<span color='#ffcc66'><b>{}</b></span>";
-              #weekdays = "<b>{}</b>";
-              today = "<span color='#0FBB0F'><b>{}</b></span>";
-            };
-          };
-          actions = {
-            on-click-right = "mode";
-            on-click-forward = "tz_up";
-            on-click-backward = "tz_down";
-            on-scroll-up = "shift_down";
-            on-scroll-down = "shift_up";
-          };
-        };
-        upower = {
-          icon-size = 14;
-        };
-        battery = {
-          format = "{icon} {capacity}%";
-          format-icons = [
-            "󰂎" # 0%
-            "󰁺" # 10%
-            "󰁻" # 20%
-            "󰁼" # 30%
-            "󰁽" # 40%
-            "󰁾" # 50%
-            "󰁿" # 60%
-            "󰂀" # 70%
-            "󰂁" # 80%
-            "󰂂" # 90%
-            "󱟢" # 100%
-          ];
-          states = {
-            warning = 25;
-            critical = 15;
-          };
-          events =
-            let
-              mkNotifySendCommand =
-                {
-                  summary,
-                  urgency ? null,
-                  body ? null,
-                  icon ? null,
-                  category ? null,
-                }:
-                let
-                  body-part = if body != null then "'${body}'" else "";
-                  urgency-part = if urgency != null then "--urgency ${urgency}" else "";
-                  icon-part = if icon != null then "--icon ${icon}" else "";
-                  category-part = if category != null then "--category ${category}" else "";
-                in
-                "${lib.getBin pkgs.libnotify}/bin/notify-send ${urgency-part} ${icon-part} ${category-part} '${summary}' ${body-part}";
-            in
-            {
-              on-discharging-warning = mkNotifySendCommand {
-                summary = "Low Battery";
-                icon = "battery-caution";
-                category = "device";
-              };
-              on-discharging-critical = mkNotifySendCommand {
-                urgency = "critical";
-                summary = "Very Low Battery";
-                body = "Connect to power <i>now</i>!";
-                icon = "battery-low";
-                category = "device";
-              };
-            };
-        };
-        backlight = {
-          device = "intel_backlight";
-          format = "{percent}%  ";
-          on-scroll-down = "light -U 1";
-          on-scroll-up = "light -A 1";
-        };
-        cpu = {
-          interval = 1;
-          format = " {usage:>2}%@{avg_frequency:>3.2f}";
-        };
-        disk = {
-          format = " {percentage_free}% {specific_total:>2.1f}";
-          unit = "TB";
-        };
-        "custom/wlogout" = {
-          format = "";
-          tooltip = false;
-          on-click = "wlogout";
-          min-width = 20;
-        };
-        idle_inhibitor = {
-          format = "{icon}";
-          format-icons = {
-            activated = "";
-            deactivated = "";
-          };
-        };
-        #image =
-        #  let
-        #    albumArtScript = pkgs.writeShellScriptBin "album-art.sh" ''
-        #      #!${pkgs.bash}/bin/bash
-        #      album_art=$(playerctl metadata mpris:artUrl)
-        #      if [[ -z $album_art ]]
-        #      then
-        #         exit
-        #      fi
-        #      curl -s "''${album_art}" --output "/tmp/cover.jpeg"
-        #      echo "/tmp/cover.jpeg"
-        #    '';
-        #  in
-        #  {
-        #    exec = "${albumArtScript}/bin/album-art.sh";
-        #    interval = 15;
-        #    on-click = "playerctl play-pause";
-        #  };
-        mpris = {
-          format = "{status_icon} {player}";
-          tooltip-format = "{player} ({status_icon} {status}) {dynamic}";
-          status-icons = {
-            playing = "";
-            paused = "󰏤";
-            stopped = "󰓛";
-          };
-        };
-        memory = {
-          format = " {}%";
-        };
-        power-profiles-daemon = {
-          format = "{icon}";
-          tooltip-format = "Power profile: {profile}\nDriver: {driver}";
-          tooltip = true;
-          format-icons = {
-            default = "";
-            performance = "";
-            balanced = "";
-            power-saver = "";
-          };
-        };
-        wireplumber = {
-          format = "{icon} {volume}%";
-          format-muted = "";
-          format-icons = [
-            ""
-            ""
-            ""
-          ];
-        };
-        temperature = {
-          format = " {temperatureC}°C";
-        };
-        tray = {
-          spacing = 4;
-          show-passive-items = true;
-        };
-        bluetooth = {
-          format = " {status}";
-          format-connected = " {device_alias}";
-          format-connected-battery = " {device_alias} {device_battery_percentage}%";
-          tooltip-format = "{controller_alias}\t{controller_address}\n\n{num_connections} connected";
-          tooltip-format-connected = "{controller_alias}\t{controller_address}\n\n{num_connections} connected\n\n{device_enumerate}";
-          tooltip-format-enumerate-connected = "{device_alias}\t{device_address}";
-          tooltip-format-enumerate-connected-battery = "{device_alias}\t{device_address}\t{device_battery_percentage}%";
-        };
-        "custom/swaync" =
-          let
-            swaync-client = "${lib.getBin config.services.swaync.package}/bin/swaync-client";
-          in
-          {
-            tooltip = true;
-            format = "{icon} {0}";
-            format-icons = {
-              notification = "󱅫";
-              none = "󰂜";
-              dnd-notification = "󰂠";
-              dnd-none = "󰪓";
-              inhibited-notification = "󰂛";
-              inhibited-none = "󰪑";
-              dnd-inhibited-notification = "󰂛";
-              dnd-inhibited-none = "󰪑";
-            };
-            return-type = "json";
-            exec = "${swaync-client} --subscribe-waybar";
-            on-click = "${swaync-client} --toggle-panel --skip-wait";
-            on-click-right = "${swaync-client} --toggle-dnd --skip-wait";
-            escape = true;
-          };
-        "custom/weather" = {
-          format = "{}";
-          tooltip = true;
-          interval = 3600;
-          exec = "${lib.getBin pkgs.wttrbar}/bin/wttrbar --nerd";
-          return-type = "json";
-        };
-      };
-    };
-  };
-}
diff --git a/homeConfigurations/muede/wlogout.nix b/homeConfigurations/muede/wlogout.nix
deleted file mode 100644
index bfd39f57..00000000
--- a/homeConfigurations/muede/wlogout.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  config.programs.wlogout = {
-    enable = true;
-    style = ''
-      * {
-        /*background-image: none;*/
-        box-shadow: none;
-      }
-
-      window {
-        background-color: rgba(30, 30, 46, 0.90);
-      }
-
-      button {
-        border-radius: 0;
-        border-color: #cba6f7;
-        text-decoration-color: #cdd6f4;
-        color: #cdd6f4;
-        background-color: #181825;
-        border-style: solid;
-        border-width: 1px;
-        background-repeat: no-repeat;
-        background-position: center;
-        background-size: 25%;
-      }
-
-      button:focus, button:active, button:hover {
-        /* 20% Overlay 2, 80% mantle */
-        background-color: rgb(48, 50, 66);
-        outline-style: none;
-      }
-    '';
-  };
-}
diff --git a/homeConfigurations/muede/zsh.nix b/homeConfigurations/muede/zsh.nix
deleted file mode 100644
index 16f00e1f..00000000
--- a/homeConfigurations/muede/zsh.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{ config, pkgs, ... }:
-{
-  config.programs.zsh = {
-    initContent = ''
-      export PATH=$PATH:$HOME/.cargo/bin
-
-      bindkey "^[[1;5C" forward-word
-      bindkey "^[[1;5D" backward-word
-    '';
-    enableCompletion = true;
-
-    shellAliases = {
-      myos-rebuild-boot = "sudo nixos-rebuild boot --flake .# --show-trace --log-format internal-json -v |& ${pkgs.nix-output-monitor}/bin/nom --json";
-      myos-rebuild-switch = "sudo nixos-rebuild switch --flake .# --show-trace --log-format internal-json -v |& ${pkgs.nix-output-monitor}/bin/nom --json";
-
-      s = "nix-shell -p";
-
-      my-direnvallow = "echo \"use nix\" > .envrc && direnv allow";
-      my-ip4 = "ip addr show | grep 192";
-      deadnix = "nix run github:astro/deadnix -- ";
-      statix = "nix run github:oppiliappan/statix -- ";
-    };
-
-    history = {
-      size = 10000;
-      path = "${config.xdg.dataHome}/zsh/history";
-      expireDuplicatesFirst = true;
-    };
-  };
-}
diff --git a/homeConfigurations/ronja/default.nix b/homeConfigurations/ronja/default.nix
deleted file mode 100644
index 4d5c5ee3..00000000
--- a/homeConfigurations/ronja/default.nix
+++ /dev/null
@@ -1,69 +0,0 @@
-{ config, pkgs, ... }:
-{
-  imports = [ ./vscode.nix ];
-  config = {
-    my = {
-      # keep-sorted start
-      nano.enable = true;
-      templates.enable = true;
-      zsh.enable = true;
-      # keep-sorted end
-    };
-
-    home.packages = with pkgs; [
-      ## Apps
-      telegram-desktop
-      kdiff3
-    ];
-
-    programs = {
-      home-manager.enable = true;
-
-      zsh = {
-        history = {
-          size = 10000;
-          path = "${config.xdg.dataHome}/zsh/history";
-          expireDuplicatesFirst = true;
-        };
-
-        oh-my-zsh = {
-          enable = true;
-          theme = "agnoster";
-          plugins = [
-            "git"
-            "sudo"
-            "systemadmin"
-          ];
-        };
-        shellAliases = {
-          myos-update = ''echo "Enter sudo password" && sudo nixos-rebuild boot --flake git+https://git.berlin.ccc.de/vinzenz/nixos-configuration.git --show-trace --log-format internal-json -v |& ${pkgs.nix-output-monitor}/bin/nom --json'';
-          myos-apply = ''echo "Enter sudo password" && sudo nixos-rebuild switch --flake .# --show-trace --log-format internal-json -v |& ${pkgs.nix-output-monitor}/bin/nom --json'';
-        };
-      };
-
-      git = {
-        userName = "Ronja Spiegelberg";
-        userEmail = "ronja.spiegelberg@gmail.com";
-
-        extraConfig = {
-          pull.ff = "only";
-          merge.tool = "kdiff3";
-        };
-      };
-
-      chromium = {
-        enable = true;
-        extensions = [
-          {
-            # ublock origin
-            id = "cjpalhdlnbpafiamejdnhcphjbkeiagm";
-          }
-          {
-            id = "dcpihecpambacapedldabdbpakmachpb";
-            updateUrl = "https://raw.githubusercontent.com/iamadamdev/bypass-paywalls-chrome/master/updates.xml";
-          }
-        ];
-      };
-    };
-  };
-}
diff --git a/homeConfigurations/ronja/vscode.nix b/homeConfigurations/ronja/vscode.nix
deleted file mode 100644
index 5226411e..00000000
--- a/homeConfigurations/ronja/vscode.nix
+++ /dev/null
@@ -1,67 +0,0 @@
-{ pkgs, lib, ... }:
-{
-  config = {
-    home.sessionVariables.NIXOS_OZONE_WL = "1";
-    programs.vscode = {
-      enable = true;
-      package = pkgs.vscodium;
-      profiles.default = {
-        enableUpdateCheck = false;
-        extensions = with pkgs.vscode-extensions; [
-          jnoortheen.nix-ide
-          ms-python.python
-          editorconfig.editorconfig
-          yzhang.markdown-all-in-one
-          redhat.vscode-yaml
-          pkief.material-icon-theme
-          rust-lang.rust-analyzer
-          tamasfe.even-better-toml
-          llvm-vs-code-extensions.vscode-clangd
-          mkhl.direnv
-          vadimcn.vscode-lldb
-          # ms-dotnettools.csharp
-          # ms-vscode-remote.remote-ssh
-        ];
-        userSettings = {
-          "files.autoSave" = "afterDelay";
-          "files.autoSaveWhenNoErrors" = true;
-          "files.autoSaveWorkspaceFilesOnly" = true;
-
-          "editor.fontLigatures" = true;
-          "editor.formatOnSave" = true;
-          "editor.formatOnSaveMode" = "modificationsIfAvailable";
-          "editor.minimap.autohide" = true;
-
-          "workbench.startupEditor" = "readme";
-          "workbench.enableExperiments" = false;
-          "workbench.iconTheme" = "material-icon-theme";
-
-          "update.mode" = "none";
-          "extensions.autoUpdate" = false;
-          "extensions.autoCheckUpdates" = false;
-
-          "telemetry.telemetryLevel" = "off";
-          "redhat.telemetry.enabled" = false;
-
-          "git.autofetch" = true;
-          "diffEditor.diffAlgorithm" = "advanced";
-          "explorer.excludeGitIgnore" = true;
-          "markdown.extension.tableFormatter.normalizeIndentation" = true;
-          "markdown.extension.toc.orderedList" = false;
-          "rust-analyzer.checkOnSave.command" = "clippy";
-
-          "nix.formatterPath" = "${lib.getBin pkgs.nixfmt-rfc-style}/bin/nixfmt";
-
-          "\[makefile\]" = {
-            "editor.insertSpaces" = false;
-            "editor.detectIndentation" = false;
-          };
-
-          "\[nix\]" = {
-            "editor.formatOnSave" = false;
-          };
-        };
-      };
-    };
-  };
-}
diff --git a/homeModules/gnome-extensions.nix b/homeModules/gnome-extensions.nix
deleted file mode 100644
index 20b3a703..00000000
--- a/homeModules/gnome-extensions.nix
+++ /dev/null
@@ -1,101 +0,0 @@
-{
-  lib,
-  pkgs,
-  osConfig,
-  config,
-  ...
-}:
-{
-  options.my.gnome-extensions =
-    let
-      mkDefaultEnabledOption =
-        name:
-        lib.mkOption {
-          default = true;
-          example = false;
-          description = "Whether to enable ${name}.";
-          type = lib.types.bool;
-        };
-    in
-    {
-      enable = lib.mkEnableOption "gnome extended options";
-      appindicator.enable = mkDefaultEnabledOption "appindicator";
-      caffeine.enable = mkDefaultEnabledOption "caffeine";
-      tailscale-qs.enable = lib.mkOption {
-        default = osConfig.services.tailscale.enable;
-        example = true;
-        description = "Whether to enable tailscale quick setting.";
-        type = lib.types.bool;
-      };
-      alphabetic-apps.enable = mkDefaultEnabledOption "alphabetic app grid";
-      clock-show-seconds = mkDefaultEnabledOption "clock seconds";
-      show-battery-percentage = mkDefaultEnabledOption "battery percentage";
-      enable-numlock = mkDefaultEnabledOption "num lock on login";
-      enable-systool-warning = lib.mkEnableOption "system configuration tool warning";
-      edge-tiling = mkDefaultEnabledOption "edge tiling";
-      dynamic-workspaces = mkDefaultEnabledOption "dynamic workspaces";
-      tap-to-click = mkDefaultEnabledOption "tap to click";
-      two-finger-scrolling = mkDefaultEnabledOption "two finger scrolling";
-    };
-
-  config =
-    let
-      cfg = config.my.gnome-extensions;
-    in
-    lib.mkIf cfg.enable (
-      lib.mkMerge [
-        {
-          dconf = {
-            enable = true;
-            settings = {
-              "org/gnome/shell" = {
-                disable-user-extensions = false;
-                disabled-extensions = [ ];
-                enabled-extensions = [ ];
-              };
-
-              "ca/desrt/dconf-editor".show-warning = cfg.enable-systool-warning;
-              "org/gnome/tweaks".show-extensions-notice = cfg.enable-systool-warning;
-              "org/gnome/mutter" = {
-                inherit (cfg) edge-tiling dynamic-workspaces;
-              };
-              "org/gnome/desktop/peripherals/touchpad" = {
-                inherit (cfg) tap-to-click;
-                two-finger-scrolling-enabled = cfg.two-finger-scrolling;
-              };
-              "org/gnome/desktop/interface" = {
-                inherit (cfg) clock-show-seconds show-battery-percentage;
-              };
-            };
-          };
-        }
-
-        (lib.mkIf cfg.tailscale-qs.enable {
-          home.packages = [ pkgs.gnomeExtensions.tailscale-qs ];
-          dconf.settings."org/gnome/shell".enabled-extensions = [ "tailscale@joaophi.github.com" ];
-        })
-
-        (lib.mkIf cfg.appindicator.enable {
-          home.packages = [ pkgs.gnomeExtensions.appindicator ];
-          dconf.settings."org/gnome/shell".enabled-extensions = [ "appindicatorsupport@rgcjonas.gmail.com" ];
-        })
-
-        (lib.mkIf cfg.caffeine.enable {
-          home.packages = [ pkgs.gnomeExtensions.caffeine ];
-          dconf.settings."org/gnome/shell".enabled-extensions = [ "caffeine@patapon.info" ];
-        })
-
-        (lib.mkIf cfg.alphabetic-apps.enable {
-          home.packages = [ pkgs.gnomeExtensions.alphabetical-app-grid ];
-          dconf.settings = {
-            "org/gnome/shell".enabled-extensions = [ "AlphabeticalAppGrid@stuarthayhurst" ];
-            "org/gnome/shell/extensions/alphabetical-app-grid".folder-order-position = "start";
-          };
-        })
-
-        (lib.mkIf cfg.enable-numlock {
-          dconf.settings."org/gnome/desktop/peripherals/keyboard".numlock-state = true;
-        })
-      ]
-    );
-}
diff --git a/homeModules/nano.nix b/homeModules/nano.nix
deleted file mode 100644
index 2293b997..00000000
--- a/homeModules/nano.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{ lib, config, ... }:
-{
-  options.my.nano.enable = lib.mkEnableOption "nano editor config";
-
-  config = lib.mkIf config.my.nano.enable {
-    home = {
-      sessionVariables.EDITOR = "nano";
-      file.".nanorc".text = ''
-        set linenumbers
-        set mouse
-      '';
-    };
-  };
-}
diff --git a/homeModules/tailscale.nix b/homeModules/tailscale.nix
deleted file mode 100644
index 686bf840..00000000
--- a/homeModules/tailscale.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-  lib,
-  config,
-  osConfig,
-  thisDevice,
-  ...
-}:
-{
-  options.my.tailscale.enable = lib.mkOption {
-    type = lib.types.bool;
-    default = (thisDevice.isDesktop or false) && osConfig.my.tailscale.enable;
-    description = "Whether to enable the Tailscale system tray applet. Defaults to true on desktops with Tailscale enabled.";
-  };
-
-  config = lib.mkIf config.my.tailscale.enable {
-    services.tailscale-systray.enable = true;
-  };
-}
diff --git a/homeModules/templates.nix b/homeModules/templates.nix
deleted file mode 100644
index e0a6df2c..00000000
--- a/homeModules/templates.nix
+++ /dev/null
@@ -1,17 +0,0 @@
-{ lib, config, ... }:
-{
-  options.my.templates.enable = lib.mkEnableOption "file templates";
-
-  config = lib.mkIf config.my.templates.enable {
-    home.file = {
-      "Templates/Empty file".text = "";
-      "Templates/Empty bash script".text = ''
-        #!/usr/bin/env bash
-        # abort on error, undefined variables
-        set -eu
-        # print commands before execution
-        set -x
-      '';
-    };
-  };
-}
diff --git a/homeModules/zsh-basics.nix b/homeModules/zsh-basics.nix
deleted file mode 100644
index 50e116aa..00000000
--- a/homeModules/zsh-basics.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ lib, config, ... }:
-{
-  options.my.zsh.enable = lib.mkEnableOption "zsh with basic settings";
-
-  config = lib.mkIf config.my.zsh.enable {
-    programs = {
-      command-not-found.enable = true;
-      dircolors.enable = true;
-
-      zsh = {
-        enable = true;
-        syntaxHighlighting.enable = true;
-        autosuggestion.enable = true;
-        enableVteIntegration = true;
-      };
-    };
-  };
-}
diff --git a/nix/forge-theme/theme-catppuccin-vibec0re.css b/nix/forge-theme/theme-catppuccin-vibec0re.css
new file mode 100644
index 00000000..11411861
--- /dev/null
+++ b/nix/forge-theme/theme-catppuccin-vibec0re.css
@@ -0,0 +1,304 @@
+/* Catppuccin Mocha × vibec0re — hyperhive forge theme
+   Palette: https://catppuccin.com/palette (Mocha)
+   Primary accent: Mauve #cba6f7 (mirrors hive-c0re dashboard --purple)
+   Syntax highlighting: Catppuccin Mocha chroma palette
+*/
+
+/* ── chroma syntax highlighting ──────────────────────────────────────── */
+.chroma .bp{color:#89b4fa}.chroma .c,.chroma .c1,.chroma .ch,.chroma .cm{color:#6c7086;font-style:italic}.chroma .cp{color:#a6e3a1}.chroma .cpf{color:#89b4fa}.chroma .cs{color:#cba6f7}.chroma .dl{color:#89b4fa}.chroma .gd{color:#f38ba8;background-color:#3b2335}.chroma .ge{color:#cdd6f4;font-style:italic}.chroma .gh{color:#fab387;font-weight:bold}.chroma .gi{color:#a6e3a1;background-color:#1e3320}.chroma .go{color:#6c7086}.chroma .gp{color:#cdd6f4}.chroma .gr{color:#f38ba8}.chroma .gs{color:#cdd6f4;font-weight:bold}.chroma .gt{color:#fab387}.chroma .gu{color:#a6e3a1;font-weight:bold}.chroma .il{color:#fab387}.chroma .k{color:#cba6f7}.chroma .kc{color:#89b4fa}.chroma .kd{color:#cba6f7}.chroma .kn{color:#94e2d5}.chroma .kp{color:#a6e3a1}.chroma .kr{color:#cba6f7}.chroma .kt{color:#89dceb}.chroma .m,.chroma .mb,.chroma .mf,.chroma .mh,.chroma .mi,.chroma .mo{color:#fab387}.chroma .n{color:#cdd6f4}.chroma .na,.chroma .nb{color:#89b4fa}.chroma .nc{color:#f9e2af}.chroma .nd{color:#a6e3a1}.chroma .ne{color:#fab387}.chroma .nf,.chroma .ni{color:#89b4fa}.chroma .nl{color:#cba6f7}.chroma .nn{color:#cdd6f4}.chroma .no{color:#fab387}.chroma .nt{color:#f38ba8}.chroma .nv{color:#cdd6f4}.chroma .nx{color:#cdd6f4}.chroma .o{color:#89dceb}.chroma .ow{color:#a6e3a1}.chroma .p{color:#bac2de}.chroma .s,.chroma .s1,.chroma .s2{color:#a6e3a1}.chroma .sa{color:#fab387}.chroma .sb{color:#a6e3a1}.chroma .sc{color:#a6e3a1}.chroma .sd{color:#6c7086;font-style:italic}.chroma .se{color:#f38ba8}.chroma .sh{color:#a6e3a1}.chroma .si{color:#94e2d5}.chroma .sr{color:#cba6f7}.chroma .ss{color:#f38ba8}.chroma .sx{color:#fab387}.chroma .vc,.chroma .vg,.chroma .vi{color:#89b4fa}.chroma .w{color:#585b70}
+
+/* ── dark-mode image visibility (same as gitea-dark) ─────────────────── */
+.markup [src$="#gh-light-mode-only"],.markup [src$="#light-mode-only"],.markup [href$="#gh-light-mode-only"],.markup [href$="#light-mode-only"]{display:none}
+.markup [src$="#gh-dark-mode-only"],.markup [src$="#dark-mode-only"],.markup [href$="#gh-dark-mode-only"],.markup [href$="#dark-mode-only"]{display:unset}
+
+/* ── Catppuccin Mocha palette → Forgejo CSS vars ─────────────────────── */
+:root {
+  --is-dark-theme: true;
+  color-scheme: dark;
+
+  /* Primary: Mauve #cba6f7 — matches hive-c0re dashboard --purple */
+  --color-primary:          #cba6f7;
+  --color-primary-contrast: #1e1e2e;
+  --color-primary-dark-1:   #d0aff8;
+  --color-primary-dark-2:   #d5b8f9;
+  --color-primary-dark-3:   #dac2fa;
+  --color-primary-dark-4:   #dfcbfb;
+  --color-primary-dark-5:   #ead9fc;
+  --color-primary-dark-6:   #f4effe;
+  --color-primary-dark-7:   #faf7ff;
+  --color-primary-light-1:  #b895e0;
+  --color-primary-light-2:  #a580c7;
+  --color-primary-light-3:  #9470b0;
+  --color-primary-light-4:  #7d5b9a;
+  --color-primary-light-5:  #4d3866;
+  --color-primary-light-6:  #2a1e42;
+  --color-primary-light-7:  #110d1e;
+  --color-primary-alpha-10: #cba6f719;
+  --color-primary-alpha-20: #cba6f733;
+  --color-primary-alpha-30: #cba6f74b;
+  --color-primary-alpha-40: #cba6f766;
+  --color-primary-alpha-50: #cba6f780;
+  --color-primary-alpha-60: #cba6f799;
+  --color-primary-alpha-70: #cba6f7b3;
+  --color-primary-alpha-80: #cba6f7cc;
+  --color-primary-alpha-90: #cba6f7e1;
+  --color-primary-hover:    var(--color-primary-dark-1);
+  --color-primary-active:   var(--color-primary-dark-2);
+
+  /* Secondary: Surface1 #45475a */
+  --color-secondary:          #45475a;
+  --color-secondary-dark-1:   #4e5069;
+  --color-secondary-dark-2:   #585b70;
+  --color-secondary-dark-3:   #6c7086;
+  --color-secondary-dark-4:   #7f849c;
+  --color-secondary-dark-5:   #9399b2;
+  --color-secondary-dark-6:   #a6adc8;
+  --color-secondary-dark-7:   #bac2de;
+  --color-secondary-dark-8:   #cdd6f4;
+  --color-secondary-dark-9:   #d3dcf6;
+  --color-secondary-dark-10:  #d8e1f8;
+  --color-secondary-dark-11:  #dde5f9;
+  --color-secondary-dark-12:  #e2eafa;
+  --color-secondary-dark-13:  #e7eefb;
+  --color-secondary-light-1:  #313244;
+  --color-secondary-light-2:  #292a3a;
+  --color-secondary-light-3:  #1e1e2e;
+  --color-secondary-light-4:  #181825;
+  --color-secondary-alpha-10: #45475a19;
+  --color-secondary-alpha-20: #45475a33;
+  --color-secondary-alpha-30: #45475a4b;
+  --color-secondary-alpha-40: #45475a66;
+  --color-secondary-alpha-50: #45475a80;
+  --color-secondary-alpha-60: #45475a99;
+  --color-secondary-alpha-70: #45475ab3;
+  --color-secondary-alpha-80: #45475acc;
+  --color-secondary-alpha-90: #45475ae1;
+  --color-secondary-hover:    var(--color-secondary-dark-3);
+  --color-secondary-active:   var(--color-secondary-dark-2);
+
+  /* Terminal / console: Crust/Mantle tones */
+  --color-console-fg:          #cdd6f4;
+  --color-console-fg-subtle:   #a6adc8;
+  --color-console-bg:          #11111b;
+  --color-console-border:      #313244;
+  --color-console-hover-bg:    #1e1e2e;
+  --color-console-active-bg:   #313244;
+  --color-console-menu-bg:     #181825;
+  --color-console-menu-border: #45475a;
+
+  /* Named accent colours → Catppuccin equivalents */
+  --color-red:          #f38ba8;
+  --color-orange:       #fab387;
+  --color-yellow:       #f9e2af;
+  --color-olive:        #a6e3a1;
+  --color-green:        #a6e3a1;
+  --color-teal:         #94e2d5;
+  --color-blue:         #89b4fa;
+  --color-violet:       #b4befe;
+  --color-purple:       #cba6f7;
+  --color-pink:         #f5c2e7;
+  --color-brown:        #fab387;
+  --color-black:        #11111b;
+  --color-red-light:    #eba0ac;
+  --color-orange-light: #fab387;
+  --color-yellow-light: #f9e2af;
+  --color-olive-light:  #a6e3a1;
+  --color-green-light:  #a6e3a1;
+  --color-teal-light:   #94e2d5;
+  --color-blue-light:   #89b4fa;
+  --color-violet-light: #b4befe;
+  --color-purple-light: #cba6f7;
+  --color-pink-light:   #f5c2e7;
+  --color-brown-light:  #fab387;
+  --color-black-light:  #313244;
+  --color-red-dark-1:   #f38ba8;
+  --color-orange-dark-1:#fab387;
+  --color-yellow-dark-1:#f9e2af;
+  --color-olive-dark-1: #a6e3a1;
+  --color-green-dark-1: #a6e3a1;
+  --color-teal-dark-1:  #94e2d5;
+  --color-blue-dark-1:  #74c7ec;
+  --color-violet-dark-1:#b4befe;
+  --color-purple-dark-1:#cba6f7;
+  --color-pink-dark-1:  #f5c2e7;
+  --color-brown-dark-1: #fab387;
+  --color-black-dark-1: #1e1e2e;
+  --color-red-dark-2:   #eb8da4;
+  --color-orange-dark-2:#f5aa80;
+  --color-yellow-dark-2:#f4daa8;
+  --color-olive-dark-2: #9fd99b;
+  --color-green-dark-2: #9fd99b;
+  --color-teal-dark-2:  #8dd9cd;
+  --color-blue-dark-2:  #6cbfe6;
+  --color-violet-dark-2:#aab4f8;
+  --color-purple-dark-2:#c29ef2;
+  --color-pink-dark-2:  #f0b9e2;
+  --color-brown-dark-2: #f0a378;
+  --color-black-dark-2: #181825;
+
+  /* ANSI terminal colours */
+  --color-ansi-black:          #11111b;
+  --color-ansi-red:            #f38ba8;
+  --color-ansi-green:          #a6e3a1;
+  --color-ansi-yellow:         #f9e2af;
+  --color-ansi-blue:           #89b4fa;
+  --color-ansi-magenta:        #f5c2e7;
+  --color-ansi-cyan:           #94e2d5;
+  --color-ansi-white:          var(--color-console-fg-subtle);
+  --color-ansi-bright-black:   #45475a;
+  --color-ansi-bright-red:     #f38ba8;
+  --color-ansi-bright-green:   #a6e3a1;
+  --color-ansi-bright-yellow:  #f9e2af;
+  --color-ansi-bright-blue:    #89b4fa;
+  --color-ansi-bright-magenta: #f5c2e7;
+  --color-ansi-bright-cyan:    #94e2d5;
+  --color-ansi-bright-white:   var(--color-console-fg);
+
+  --color-grey:       #45475a;
+  --color-grey-light: #7f849c;
+  --color-gold:       #f9e2af;
+  --color-white:      #cdd6f4;
+
+  /* Diff colours */
+  --color-diff-removed-word-bg:  #4b1c2c;
+  --color-diff-added-word-bg:    #1c3a2a;
+  --color-diff-removed-row-bg:   #3b1525;
+  --color-diff-moved-row-bg:     #3a3520;
+  --color-diff-added-row-bg:     #1a2e24;
+  --color-diff-removed-row-border:#6b3044;
+  --color-diff-moved-row-border: #b0a850;
+  --color-diff-added-row-border: #2d5040;
+  --color-diff-inactive:         #181825;
+
+  /* Feedback colours */
+  --color-error-border:    #f38ba8;
+  --color-error-bg:        #3b1525;
+  --color-error-bg-active: #4d1e30;
+  --color-error-bg-hover:  #44192b;
+  --color-error-text:      #f38ba8;
+  --color-success-border:  #a6e3a1;
+  --color-success-bg:      #1a2e24;
+  --color-success-text:    #a6e3a1;
+  --color-warning-border:  #f9e2af;
+  --color-warning-bg:      #2e2a1a;
+  --color-warning-text:    #f9e2af;
+  --color-info-border:     #89b4fa;
+  --color-info-bg:         #1a2040;
+  --color-info-text:       #89b4fa;
+
+  /* Badge colours */
+  --color-red-badge:            #f38ba8;
+  --color-red-badge-bg:         #f38ba81a;
+  --color-red-badge-hover-bg:   #f38ba84d;
+  --color-green-badge:          #a6e3a1;
+  --color-green-badge-bg:       #a6e3a11a;
+  --color-green-badge-hover-bg: #a6e3a14d;
+  --color-yellow-badge:         #f9e2af;
+  --color-yellow-badge-bg:      #f9e2af1a;
+  --color-yellow-badge-hover-bg:#f9e2af4d;
+  --color-orange-badge:         #fab387;
+  --color-orange-badge-bg:      #fab3871a;
+  --color-orange-badge-hover-bg:#fab3874d;
+
+  /* Layout */
+  --color-body:             #1e1e2e;
+  --color-box-header:       #181825;
+  --color-box-body:         #11111b;
+  --color-box-body-highlight: #1e1e2e;
+  --color-text-dark:        #cdd6f4;
+  --color-text:             #cdd6f4;
+  --color-text-light:       #bac2de;
+  --color-text-light-1:     #a6adc8;
+  --color-text-light-2:     #9399b2;
+  --color-text-light-3:     #7f849c;
+  --color-footer:           var(--color-nav-bg);
+  --color-timeline:         #45475a;
+  --color-input-text:       var(--color-text-dark);
+  --color-input-background: #11111b;
+  --color-input-toggle-background: #313244;
+  --color-input-border:     var(--color-secondary);
+  --color-input-border-hover: var(--color-secondary-dark-1);
+  --color-light:            #cba6f71a;
+  --color-light-mimic-enabled: rgba(0,0,0,calc(40/255*222/255/var(--opacity-disabled)));
+  --color-light-border:     #cba6f726;
+  --color-hover:            #cba6f714;
+  --color-active:           #313244;
+  --color-menu:             #181825;
+  --color-card:             #181825;
+  --fancy-card-bg:          #11111b;
+  --fancy-card-border:      #45475a;
+  --color-markup-table-row: #cba6f70d;
+  --color-markup-code-block: #cba6f710;
+  --color-markup-code-inline:#cba6f724;
+  --color-button:           #181825;
+  --color-code-bg:          #11111b;
+  --color-shadow:           #11111b80;
+  --color-secondary-bg:     #313244;
+  --color-expand-button:    #292a3a;
+  --color-placeholder-text: var(--color-text-light-3);
+  --color-editor-line-highlight: var(--color-primary-light-5);
+  --color-project-column-bg: var(--color-secondary-light-2);
+  --color-caret:            var(--color-text);
+  --color-reaction-bg:      #cba6f710;
+  --color-reaction-hover-bg: var(--color-primary-light-4);
+  --color-reaction-active-bg: var(--color-primary-light-5);
+  --color-tooltip-text:     #cdd6f4;
+  --color-tooltip-bg:       #11111bee;
+
+  /* Navigation */
+  --color-nav-bg:           #181825;
+  --color-nav-hover-bg:     var(--color-secondary-light-1);
+  --color-secondary-nav-bg: #1e1e2e;
+
+  /* Labels */
+  --color-label-text:       var(--color-text);
+  --color-label-bg:         #7f849c40;
+  --color-label-hover-bg:   #7f849c99;
+  --color-label-active-bg:  #7f849cff;
+
+  /* Accent */
+  --color-accent:           var(--color-primary-light-1);
+  --color-small-accent:     var(--color-primary-light-5);
+
+  /* Highlight / selection */
+  --color-highlight-fg:     #cba6f7;
+  --color-highlight-bg:     #4d38663a;
+  --color-overlay-backdrop: #11111bc0;
+  --color-selection-bg:     var(--color-primary-light-1);
+  --color-selection-fg:     #1e1e2e;
+
+  /* Misc */
+  --checkerboard-color-1:   #313244;
+  --checkerboard-color-2:   #1e1e2e;
+  --color-indicator-offline:    #6c7086;
+  --color-indicator-offline-20: #6c70861a;
+  --color-indicator-idle:       #a6e3a1;
+  --color-indicator-idle-20:    #a6e3a11a;
+  --color-indicator-active:     #89b4fa;
+  --color-indicator-active-20:  #89b4fa33;
+
+  accent-color: var(--color-accent);
+}
+
+/* ── vibec0re: glow accents on interactive elements ──────────────────── */
+.ui.primary.button,
+a.ui.primary.button,
+.ui.primary.buttons .button {
+  text-shadow: 0 0 8px rgba(203, 166, 247, 0.6);
+  box-shadow: 0 0 12px -2px rgba(203, 166, 247, 0.35);
+}
+.ui.primary.button:hover,
+.ui.primary.buttons .button:hover {
+  box-shadow: 0 0 18px -2px rgba(203, 166, 247, 0.55);
+}
+#navbar .item.active,
+#navbar .item:hover {
+  text-shadow: 0 0 6px rgba(203, 166, 247, 0.45);
+}
+.repository .file-view .lines-num {
+  background: #181825;
+  border-color: #313244;
+}
+a:not(.ui.button):not(.item) {
+  text-shadow: 0 0 3px rgba(137, 180, 250, 0.25);
+}
diff --git a/nix/frontend.nix b/nix/frontend.nix
new file mode 100644
index 00000000..cb2a8536
--- /dev/null
+++ b/nix/frontend.nix
@@ -0,0 +1,60 @@
+{
+  buildNpmPackage,
+  lib,
+  branding-svg,
+}:
+
+# Hermetic build of the npm-managed frontend workspaces (see
+# `frontend/README.md`). Consumes `frontend/package-lock.json` as the
+# source of truth for dependency versions; `npmDepsHash` pins the
+# vendor-tarball hash so a stale lockfile fails the build instead of
+# silently fetching different upstream tarballs.
+#
+# Output layout (`$out`) — two subdirectories, one per surface, that
+# the Rust binaries serve via `tower_http::ServeDir`:
+#
+#   $out/dashboard/   the hive-c0re dashboard SPA assets
+#       index.html app.js app.js.map dashboard.css favicon.svg
+#   $out/agent/       the per-agent default UI (layered with
+#                     hyperhive.frontend.extraFiles at activation time)
+#       index.html app.js stats.html stats.js agent.css screen.html
+#
+# The dashboard favicon lives outside the npm tree (`branding/hyperhive
+# .svg` at the repo root) — we copy it in during the install phase so
+# the served prefix has everything in one place.
+
+buildNpmPackage {
+  pname = "hyperhive-frontend";
+  version = "0.0.0";
+  src = ../frontend;
+
+  # Computed from `frontend/package-lock.json` via
+  #   prefetch-npm-deps frontend/package-lock.json
+  # Update whenever the lockfile changes. Recompute locally with the
+  # same command (`pkgs.prefetch-npm-deps`), or let the build fail
+  # and copy the actual hash from the error message.
+  npmDepsHash = "sha256-MHXxkZpe/5LAhpQ76ZK94znG2noTobthjUi6iNY8/K4=";
+
+  # `npm run build` recurses into all workspaces (`--workspaces
+  # --if-present`). The workspaces' build scripts each run their own
+  # `build.mjs` (esbuild).
+  npmBuildScript = "build";
+
+  # buildNpmPackage's default install phase copies the working dir into
+  # $out, which is overkill — we only want the dist trees. Hand-roll
+  # the install to keep $out tight.
+  dontNpmInstall = true;
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/dashboard $out/agent
+    cp -r packages/dashboard/dist/. $out/dashboard/
+    cp -r packages/agent/dist/. $out/agent/
+    cp ${branding-svg} $out/dashboard/favicon.svg
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Bundled browser-facing assets for the hyperhive dashboard and per-agent UI";
+    homepage = "https://git.berlin.ccc.de/vinzenz/hyperhive";
+  };
+}
diff --git a/nix/modules/hive-c0re.nix b/nix/modules/hive-c0re.nix
new file mode 100644
index 00000000..467a5f7e
--- /dev/null
+++ b/nix/modules/hive-c0re.nix
@@ -0,0 +1,190 @@
+{
+  hyperhivePackage,
+  hyperhiveFrontend,
+  hyperhiveFlake,
+  agentBaseToplevel,
+  managerToplevel,
+}:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.services.hive-c0re;
+in
+{
+  # The forge is part of the standard install — hive-c0re mirrors
+  # every agent's applied config repo into it. On by default; opt out
+  # with `hyperhive.forge.enable = false`.
+  imports = [ ./hive-forge.nix ];
+
+  options.services.hive-c0re = {
+    enable = lib.mkEnableOption "hive-c0re — hyperhive coordinator daemon";
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = hyperhivePackage pkgs.stdenv.hostPlatform.system;
+      defaultText = lib.literalExpression "hyperhive.packages.\${system}.default";
+      description = "Package that provides /bin/hive-c0re.";
+    };
+    frontend = lib.mkOption {
+      type = lib.types.package;
+      default = hyperhiveFrontend pkgs.stdenv.hostPlatform.system;
+      defaultText = lib.literalExpression "hyperhive.packages.\${system}.frontend";
+      description = ''
+        Bundled frontend dist (see `./nix/frontend.nix`). Output has
+        `dashboard/` and `agent/` subdirectories — hive-c0re serves
+        `dashboard/` via `tower_http::ServeDir` from the path passed
+        in `HIVE_STATIC_DIR`. Override to ship a custom dashboard SPA;
+        the JSON contract (`/api/state`, the SSE streams, the action
+        endpoints) is the source of truth for any replacement.
+      '';
+    };
+    hyperhiveFlake = lib.mkOption {
+      type = lib.types.str;
+      default = hyperhiveFlake;
+      defaultText = lib.literalMD "the flake's own store path";
+      description = ''
+        URL of the hyperhive flake (no fragment). Inlined into each
+        per-agent `flake.nix` at `inputs.hyperhive.url`. The per-agent
+        flake then pulls `hyperhive.nixosConfigurations.agent-base` to
+        build the container. Defaults to this flake's own store path —
+        only override if you want agents tracking a different ref.
+      '';
+    };
+    dashboardPort = lib.mkOption {
+      type = lib.types.port;
+      default = 7000;
+      description = "TCP port the hive-c0re dashboard listens on.";
+    };
+    operatorPronouns = lib.mkOption {
+      type = lib.types.str;
+      default = "she/her";
+      example = "they/them";
+      description = ''
+        Operator pronouns, free text. Threaded into every agent
+        container as the `HIVE_OPERATOR_PRONOUNS` env var; the
+        harness substitutes it into the agent / manager system
+        prompt at boot so claude refers to the operator naturally
+        in third person ("ask her", "tell them", etc.). Changes
+        propagate to running agents on the next `↻ R3BU1LD` —
+        forwards as a meta flake env-var bump, no per-agent
+        approval needed.
+      '';
+    };
+    preBuildAgentTemplates = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = ''
+        Pre-fetch the per-container system closures (agent-base +
+        manager toplevels) into the host's /nix/store as part of this
+        host's NixOS build, instead of letting the first agent spawn
+        do all the work. Closes #97.
+
+        Enabling this adds roughly the full nixpkgs runtime closure +
+        claude-code + the harness binary to your system closure size
+        (low single-digit GB), but the first `nixos-container start`
+        for any agent then completes in seconds instead of minutes
+        because nothing's left to fetch.
+
+        Off by default because the toplevels are pinned to
+        `x86_64-linux` (nixos-containers run native arch). Enabling
+        on an aarch64 host would force nix to build the x86 closure
+        via cross or a remote builder, which is rarely what you want.
+        Flip to `true` on an x86_64 host when you care more about
+        first-spawn latency than host store size — or just
+        `nix build ${hyperhiveFlake}#agent-base-toplevel` once
+        manually to warm the store.
+      '';
+    };
+    contextWindowTokens = lib.mkOption {
+      type = lib.types.attrsOf lib.types.int;
+      default = {
+        haiku = 200000;
+        sonnet = 1000000;
+        opus = 1000000;
+      };
+      example = {
+        haiku = 150000;
+        sonnet = 900000;
+      };
+      description = ''
+        Per-model context-window sizes in tokens. Each key is a
+        model-family short name matched case-insensitively as a
+        substring of the active model name at runtime (e.g. `"sonnet"`
+        matches `"claude-sonnet-4-5"`). The defaults cover the known
+        Anthropic families; add entries for new models or override
+        existing ones here to change the window for all agents at once.
+
+        Passed to `hive-c0re serve` as JSON and injected into every
+        container's harness service environment as
+        `HIVE_CONTEXT_WINDOW_TOKENS_<KEY_UPPER>`. Changes propagate
+        on the next `↻ R3BU1LD` — no per-agent approval needed.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [
+      cfg.package
+      pkgs.git
+    ];
+
+    # Pull the per-container toplevels into the host system closure
+    # (#97). `system.extraDependencies` adds paths to the system build
+    # without referencing them at runtime — nixos-rebuild fetches /
+    # builds them, they end up in /nix/store, and the first
+    # nixos-container update + start for an agent has nothing left to
+    # do. Gated because the closure is sizeable and pinned to x86_64.
+    system.extraDependencies = lib.optionals cfg.preBuildAgentTemplates [
+      agentBaseToplevel
+      managerToplevel
+    ];
+
+    # Dashboard + per-container web UIs share the host's network namespace and
+    # need their ports reachable. Dashboard: `cfg.dashboardPort` (default 7000).
+    # Manager: 8000. Sub-agents: 8100..8999 (deterministic hash; see
+    # `lifecycle::agent_web_port`).
+    networking.firewall.allowedTCPPorts = [
+      cfg.dashboardPort
+      8000
+    ];
+    networking.firewall.allowedTCPPortRanges = [
+      {
+        from = 8100;
+        to = 8999;
+      }
+    ];
+
+    systemd.services.hive-c0re = {
+      description = "hyperhive coordinator daemon";
+      wantedBy = [ "multi-user.target" ];
+      path = [
+        pkgs.git
+        "/run/current-system/sw"
+      ];
+      environment = {
+        HYPERHIVE_GIT = "${pkgs.git}/bin/git";
+        # Path to the dashboard static dist. The hive-c0re axum router
+        # serves this via `tower_http::ServeDir` for any path it doesn't
+        # match against an API/action route.
+        HIVE_STATIC_DIR = "${cfg.frontend}/dashboard";
+      } // lib.optionalAttrs config.hyperhive.forge.enable {
+        # Agents poll this URL for Forgejo notifications. Derived from
+        # hyperhive.forge.{domain,httpPort} so it tracks forge config changes.
+        HIVE_FORGE_URL = "http://${config.hyperhive.forge.domain}:${toString config.hyperhive.forge.httpPort}";
+      };
+      serviceConfig = {
+        ExecStart = "${cfg.package}/bin/hive-c0re --socket /run/hyperhive/host.sock serve --hyperhive-flake ${cfg.hyperhiveFlake} --dashboard-port ${toString cfg.dashboardPort} --operator-pronouns ${lib.escapeShellArg cfg.operatorPronouns} --context-window-tokens ${lib.escapeShellArg (builtins.toJSON cfg.contextWindowTokens)}";
+        Restart = "on-failure";
+        RestartSec = 2;
+        RuntimeDirectory = "hyperhive";
+        RuntimeDirectoryMode = "0750";
+        RuntimeDirectoryPreserve = "yes";
+        StateDirectory = "hyperhive";
+      };
+    };
+  };
+}
diff --git a/nix/modules/hive-forge.nix b/nix/modules/hive-forge.nix
new file mode 100644
index 00000000..fb83ff94
--- /dev/null
+++ b/nix/modules/hive-forge.nix
@@ -0,0 +1,248 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.hyperhive.forge;
+in
+{
+  # Private Forgejo for hyperhive agents, wrapped in a nixos-container
+  # so it doesn't fight any `services.forgejo` the operator already
+  # runs on the host. The container shares the host network namespace
+  # (`privateNetwork = false`) so agents reach the forge at
+  # `http://localhost:<httpPort>` without any extra plumbing —
+  # nixos-container is just here for state + systemd-unit isolation,
+  # not network isolation.
+  #
+  # Container name is `hive-forge` (not `h-*`), so hive-c0re's
+  # lifecycle scanner ignores it; the operator manages it via the
+  # standard `nixos-container` CLI.
+  #
+  # State lives at `/var/lib/nixos-containers/hive-forge/var/lib/forgejo/`
+  # and survives container restart / host reboot. To wipe, destroy the
+  # container.
+
+  options.hyperhive.forge = {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = ''
+        Run hive-forge — a private Forgejo (in a nixos-container) for
+        hyperhive agents. On by default: hive-c0re mirrors every
+        agent's applied config repo into the forge's `agent-configs`
+        org, so the forge is part of the standard install. Set
+        `hyperhive.forge.enable = false` to opt out.
+      '';
+    };
+
+    httpPort = lib.mkOption {
+      type = lib.types.port;
+      default = 3000;
+      description = ''
+        TCP port the forge serves HTTP on. Default 3000 sits outside
+        hyperhive's claimed ranges (dashboard 7000, manager 8000,
+        sub-agents 8100..8999). Change this if you already have
+        another forgejo bound to 3000.
+      '';
+    };
+
+    sshPort = lib.mkOption {
+      type = lib.types.port;
+      default = 2222;
+      description = ''
+        TCP port the forge's built-in SSH server listens on. Kept off
+        22 so it doesn't clash with the host's openssh. Agents push
+        with `ssh -p <sshPort> git@<domain>:<owner>/<repo>.git`.
+      '';
+    };
+
+    domain = lib.mkOption {
+      type = lib.types.str;
+      default = "localhost";
+      example = "forge.internal";
+      description = ''
+        Hostname used in repo clone URLs the forge advertises. The
+        container shares host netns so `localhost` works for any
+        agent on the same host; set a real hostname when you want
+        clones from outside the host to look canonical.
+      '';
+    };
+
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.forgejo;
+      defaultText = lib.literalExpression "pkgs.forgejo";
+      description = ''
+        Forgejo package to run inside the container. Defaults to
+        `pkgs.forgejo` (the latest release line) rather than the
+        nixpkgs-module default of `pkgs.forgejo-lts`, because LTS
+        lags far behind on schema and the DB easily ends up "newer
+        than the binary" if the operator ever ran a non-LTS forgejo
+        against the same state dir. Override to `pkgs.forgejo-lts`
+        if you actively want the slower release train.
+      '';
+    };
+
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = ''
+        Open `httpPort` + `sshPort` in the host firewall. Off when
+        the forge should only be reachable from inside the host.
+        (The container shares host netns, so this is the only
+        firewall layer that matters.)
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    containers.hive-forge = {
+      autoStart = true;
+      ephemeral = false;
+      # Share host netns — forgejo's HTTP / SSH listeners then look
+      # exactly like a host-side service, no port forwarding dance,
+      # and agent containers (which also share host netns) reach it
+      # via plain `localhost`.
+      privateNetwork = false;
+      config =
+        { pkgs, ... }:
+        let
+          # Build a custom static-root that is the standard forgejo data
+          # output with our theme CSS added. Using STATIC_ROOT_PATH instead
+          # of tmpfiles / bind-mounts means the theme is always present in
+          # the nix store — no separate hive-forge container rebuild needed,
+          # and no persistent-state directory involved.
+          staticRootWithTheme = pkgs.runCommand "forgejo-static-with-theme" { } ''
+            cp -r --no-preserve=mode,ownership ${cfg.package.data}/. $out/
+            mkdir -p $out/public/assets/css
+            cp ${../forge-theme/theme-catppuccin-vibec0re.css} \
+               $out/public/assets/css/theme-catppuccin-vibec0re.css
+            # Replace the default Forgejo logo + favicon with the hyperhive
+            # mark. Files in public/assets/img/ are served before built-ins.
+            mkdir -p $out/public/assets/img
+            cp ${../../branding/hyperhive.svg} $out/public/assets/img/logo.svg
+            cp ${../../branding/hyperhive.svg} $out/public/assets/img/favicon.svg
+            cp ${../../branding/hyperhive.png} $out/public/assets/img/logo.png
+            cp ${../../branding/hyperhive.png} $out/public/assets/img/favicon.png
+            cp ${../../branding/hyperhive.png} $out/public/assets/img/avatar_default.png
+          '';
+        in
+        {
+          system.stateVersion = "25.11";
+          services.forgejo = {
+            enable = true;
+            package = cfg.package;
+            database.type = "sqlite3";
+            lfs.enable = true;
+            settings = {
+              DEFAULT.APP_NAME = "HyperHive";
+              server = {
+                DOMAIN = cfg.domain;
+                ROOT_URL = "http://${cfg.domain}:${toString cfg.httpPort}/";
+                HTTP_PORT = cfg.httpPort;
+                START_SSH_SERVER = true;
+                SSH_PORT = cfg.sshPort;
+                SSH_LISTEN_PORT = cfg.sshPort;
+                BUILTIN_SSH_SERVER_USER = "git";
+                DISABLE_SSH = false;
+                # Point forgejo at our extended static root that includes
+                # the custom theme CSS baked straight into the nix store.
+                STATIC_ROOT_PATH = staticRootWithTheme;
+              };
+              # Registration off — operator seeds agent users via
+              # `nixos-container run hive-forge -- forgejo admin
+              # user create …`.
+              service = {
+                DISABLE_REGISTRATION = true;
+                REQUIRE_SIGNIN_VIEW = false;
+              };
+              repository = {
+                DEFAULT_BRANCH = "main";
+                DEFAULT_PRIVATE = "private";
+              };
+              # Repo migrations / pull-mirrors fetch from the source
+              # URL *inside* Forgejo. hyperhive code is synced from
+              # `localhost` (and the host LAN), which Forgejo's
+              # migration guard blocks by default ("cannot import from
+              # disallowed hosts"). Allow loopback + RFC-1918 sources
+              # so an in-hive mirror of the hyperhive repo works.
+              migrations.ALLOW_LOCALNETWORKS = true;
+              log.LEVEL = "Warn";
+              ui = {
+                DEFAULT_THEME = "catppuccin-vibec0re";
+                THEMES = "catppuccin-vibec0re,forgejo-auto,forgejo-light,forgejo-dark,gitea-auto,gitea-light,gitea-dark";
+              };
+              # Point forgejo at the GPG key generated by the
+              # forgejo-gpg-init oneshot below. "default" resolves to
+              # the first secret key found in GNUPGHOME. GNUPGHOME
+              # must be absolute and writeable by the forgejo user.
+              "repository.signing" = {
+                SIGNING_KEY = "default";
+                GNUPGHOME = "/var/lib/forgejo/.gnupg";
+              };
+              # F3 (federation) computes its data dir relative to the
+              # forgejo binary, which lands in the read-only nix
+              # store and crashes anything that touches the F3
+              # subsystem — including `forgejo admin user create`,
+              # which init-ses F3 even when ENABLED=false. Pin the
+              # path absolute alongside the disable so the init
+              # resolution succeeds before the flag is checked.
+              "F3" = {
+                ENABLED = false;
+                PATH = "/var/lib/forgejo/data/f3";
+              };
+            };
+          };
+          environment.systemPackages = [
+            pkgs.forgejo
+            pkgs.gnupg
+          ];
+
+          # Generate a GPG signing key for Forgejo on first boot so UI
+          # merges produce signed commits instead of erroring "no key to
+          # sign with". The key lives in forgejo's persistent state dir
+          # (/var/lib/forgejo/.gnupg) and survives container restarts.
+          # The stamp file prevents re-generation on subsequent boots.
+          # Service runs as the forgejo user so file ownership is correct.
+          systemd.services.forgejo-gpg-init = {
+            description = "generate GPG signing key for Forgejo (once)";
+            # Start before forgejo so the key is ready when forgejo reads
+            # repository.signing config on startup.
+            wantedBy = [ "forgejo.service" ];
+            before = [ "forgejo.service" ];
+            unitConfig.ConditionPathExists = "!/var/lib/forgejo/.gnupg/hive-key-init.stamp";
+            serviceConfig = {
+              Type = "oneshot";
+              RemainAfterExit = true;
+              User = "forgejo";
+              Group = "forgejo";
+            };
+            environment.GNUPGHOME = "/var/lib/forgejo/.gnupg";
+            path = [ pkgs.gnupg pkgs.coreutils ];
+            script = ''
+              mkdir -p "$GNUPGHOME"
+              chmod 700 "$GNUPGHOME"
+              gpg --batch --gen-key <<'EOF'
+%no-protection
+Key-Type: RSA
+Key-Length: 4096
+Name-Real: HyperHive Forge
+Name-Email: forgejo@hive
+Expire-Date: 0
+EOF
+              touch "$GNUPGHOME/hive-key-init.stamp"
+            '';
+          };
+        };
+    };
+
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = [
+        cfg.httpPort
+        cfg.sshPort
+      ];
+    };
+  };
+}
diff --git a/nix/packages/hive-forge-tools.nix b/nix/packages/hive-forge-tools.nix
new file mode 100644
index 00000000..e8c28f09
--- /dev/null
+++ b/nix/packages/hive-forge-tools.nix
@@ -0,0 +1,36 @@
+{ pkgs, lib }:
+# hive-forge — Forgejo CLI wrapper for hyperhive (closes #280).
+#
+# Previously a ~600-line bash script. Rewritten as a proper Rust
+# binary in `/hive-forge` so we get:
+#   - typed clap subcommands (`hive-forge <verb> --help` instead of
+#     reading the case statement),
+#   - one reqwest client with consistent error surfaces (no more
+#     `curl --fail-with-body` repeated per verb),
+#   - sane shell quoting (no more HEREDOC-eaten-by-positional traps
+#     like #379),
+#   - and a single test surface.
+#
+# This Nix file is now a thin extractor: it pulls just the
+# `hive-forge` binary out of the hyperhive workspace package so
+# agents that already imported this file via
+# `pkgs.callPackage ../packages/hive-forge-tools.nix { }` keep
+# working, getting only the verb they need on PATH (not the full
+# `hive-c0re` / `hive-ag3nt` / `hive-m1nd` surface).
+#
+# Requires the hyperhive overlay (see `flake.nix`'s `overlays.default`)
+# so `pkgs.hyperhive` resolves.
+let
+  _ = lib; # placeholder; kept so callers don't break when reading the args.
+in
+pkgs.runCommand "hive-forge"
+  {
+    meta = {
+      description = "Forgejo CLI wrapper for hyperhive (Rust)";
+      mainProgram = "hive-forge";
+    };
+  }
+  ''
+    mkdir -p $out/bin
+    ln -s ${pkgs.hyperhive}/bin/hive-forge $out/bin/hive-forge
+  ''
diff --git a/nix/templates/agent-base.nix b/nix/templates/agent-base.nix
new file mode 100644
index 00000000..ceae4f57
--- /dev/null
+++ b/nix/templates/agent-base.nix
@@ -0,0 +1,31 @@
+{ pkgs, config, ... }:
+{
+  imports = [ ./harness-base.nix ];
+
+  systemd.services.hive-ag3nt = {
+    description = "hive-ag3nt harness";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network.target" ];
+    # systemd units get a minimal PATH by default and don't inherit
+    # `environment.systemPackages`. Pointing at `/run/current-system/sw`
+    # gives the harness (and any tools claude shells out to via Bash)
+    # access to everything declared in `systemPackages` — including
+    # anything an agent adds to its own `agent.nix` — without having to
+    # touch the service definition.
+    path = [ "/run/current-system/sw" ];
+    environment = {
+      SHELL = "${pkgs.bashInteractive}/bin/bash";
+      # Path to the merged agent static dist. The harness serves this
+      # via `tower_http::ServeDir` for any request it doesn't route to
+      # an API endpoint. `mergedDist` is the agent-default dist with
+      # `hyperhive.frontend.extraFiles` layered on top — both come
+      # from harness-base.nix.
+      HIVE_STATIC_DIR = "${config.hyperhive.frontend.mergedDist}";
+    };
+    serviceConfig = {
+      ExecStart = "${pkgs.hyperhive}/bin/hive-ag3nt serve";
+      Restart = "on-failure";
+      RestartSec = 2;
+    };
+  };
+}
diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix
new file mode 100644
index 00000000..1ae8c3fa
--- /dev/null
+++ b/nix/templates/harness-base.nix
@@ -0,0 +1,785 @@
+{
+  pkgs,
+  lib,
+  config,
+  # Flake inputs routed through _module.args by the agent flake.nix.
+  # Default to {} so the module evaluates cleanly even when the agent
+  # flake doesn't set up the routing pattern (e.g. during standalone
+  # nixos-rebuild without a flake wrapper).
+  flakeInputs ? { },
+  ...
+}:
+{
+  # Shared scaffolding for any hyperhive harness container — both
+  # sub-agents (`agent-base.nix`) and the manager (`manager.nix`) extend
+  # this. The systemd service that actually runs the harness binary
+  # differs per role and lives in the child module.
+
+  # Optional feature modules. Each declares its own `hyperhive.*`
+  # option(s), default-off, so every agent has them available but
+  # only opts in from its own `agent.nix`.
+  imports = [ ./weston-vnc.nix ];
+
+  options.hyperhive.model = lib.mkOption {
+    type = lib.types.str;
+    default = "haiku";
+    example = "sonnet";
+    description = ''
+      Claude model for this agent. Sets the `HIVE_DEFAULT_MODEL`
+      environment variable; the harness applies it at boot and it takes
+      priority over any persisted runtime override. The operator can still
+      switch the model at runtime via the per-agent web UI — that choice
+      is tracked in the state dir for the current session but is reset by
+      any rebuild that changes this option.
+
+      Valid values are the short model names that `claude --model` accepts:
+      `"haiku"`, `"sonnet"`, `"opus"` (or any future identifier). Context
+      window sizes are looked up at runtime from the
+      `HIVE_CONTEXT_WINDOW_TOKENS_<KEY_UPPER>` env vars injected by the
+      meta flake; override sizes via `services.hive-c0re.contextWindowTokens`
+      on the host.
+    '';
+  };
+
+  options.hyperhive.allowedBashPatterns = lib.mkOption {
+    type = lib.types.listOf lib.types.str;
+    default = [ ];
+    example = [
+      "git *"
+      "ls *"
+      "cat /agents/*/state/*"
+    ];
+    description = ''
+      Shell command patterns auto-approved for the `Bash` built-in tool.
+      Empty list (the default) grants wholesale `Bash` approval —
+      claude can run any shell command without a prompt. Non-empty list
+      replaces `Bash` in `--allowedTools` with one `Bash(pattern)` entry
+      per item; only commands matching a pattern are auto-approved; all
+      others require confirmation (which in `--print` mode means they
+      will not run). Use to sandbox agents to a known-safe command
+      vocabulary.
+
+      Patterns use the same glob syntax claude accepts in `Bash(…)`:
+      `*` matches any string within a word, shell-style.
+    '';
+  };
+
+  options.hyperhive.allowedRecipients = lib.mkOption {
+    type = lib.types.listOf lib.types.str;
+    default = [ ];
+    example = [
+      "alice"
+      "manager"
+    ];
+    description = ''
+      Names this agent is allowed to `send` to via
+      `mcp__hyperhive__send`. Empty list (the default) means
+      unrestricted — the agent can message any peer, the
+      operator, or the manager. Non-empty list constrains the
+      surface: only the listed names + the manager (always
+      allowed) get through; anything else returns an error
+      string to claude without touching the broker. The
+      operator (`operator`) needs to be in the list if the
+      agent should be able to surface output on the
+      dashboard.
+
+      Useful for sandboxing untrusted sub-agents — set
+      `[ "manager" ]` to scope them to manager-only chatter.
+      The manager itself is always exempt; this option only
+      affects sub-agent `send`.
+    '';
+  };
+
+  options.hyperhive.extraMcpServers = lib.mkOption {
+    type = lib.types.attrsOf (
+      lib.types.submodule {
+        options = {
+          command = lib.mkOption {
+            type = lib.types.str;
+            description = "Absolute path to the MCP server binary. Use `\${pkgs.foo}/bin/foo` or `/run/current-system/sw/bin/foo`.";
+          };
+          args = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ ];
+            description = "Args passed to the MCP server binary.";
+          };
+          env = lib.mkOption {
+            type = lib.types.attrsOf lib.types.str;
+            default = { };
+            description = "Environment variables for the MCP server child process.";
+          };
+          allowedTools = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ "*" ];
+            example = [
+              "send_message"
+              "join_room"
+            ];
+            description = ''
+              Tool names this MCP server is auto-approved to call via
+              `--allowedTools`. Single entry `"*"` (the default) means
+              "every tool from this server" — convenient but trusting.
+              Tighten to a specific list when you only want a subset.
+              Names are bare (e.g. `send_message`); the harness prepends
+              `mcp__<server-key>__` at build time.
+            '';
+          };
+        };
+      }
+    );
+    default = { };
+    example = lib.literalExpression ''
+      {
+        matrix = {
+          command = "/run/current-system/sw/bin/mcp-matrix";
+          args = [ "--config" "/state/matrix.toml" ];
+          env.MATRIX_HOMESERVER = "https://matrix.example.org";
+          allowedTools = [ "send_message" "join_room" ];
+        };
+      }
+    '';
+    description = ''
+      Extra MCP servers claude sees alongside the hyperhive tool surface.
+      Keys are the server names (claude addresses tools as
+      `mcp__<key>__<tool>`). Rendered to `/etc/hyperhive/extra-mcp.json`
+      at activation time; the harness reads that file at boot and merges
+      it into `--mcp-config` + `--allowedTools`. Take effect on the
+      agent's next harness restart (no operator approval needed beyond
+      whatever brought the new agent.nix into deployed/*).
+    '';
+  };
+
+  options.hyperhive.frontend.dist = lib.mkOption {
+    type = lib.types.package;
+    default = pkgs.hyperhive-frontend;
+    defaultText = lib.literalExpression "pkgs.hyperhive-frontend";
+    description = ''
+      The shipped frontend dist (built by `nix/frontend.nix`). Output
+      layout: `dashboard/` (used by hive-c0re on the host) and
+      `agent/` (used here, layered with `extraFiles` below at
+      activation time). Override to ship a fully custom per-agent SPA;
+      the JSON contract (`/api/state`, `/events/stream`, the action
+      endpoints) is the source of truth for any replacement.
+    '';
+  };
+
+  options.hyperhive.frontend.mergedDist = lib.mkOption {
+    type = lib.types.package;
+    readOnly = true;
+    description = ''
+      Computed: the merged static tree consumed by the harness via
+      `HIVE_STATIC_DIR`. Composed at evaluation time by copying
+      `hyperhive.frontend.dist`'s `agent/` subdir as the base, then
+      layering each `extraFiles` entry on top. Read-only —
+      consumers (`agent-base.nix`, `manager.nix`) reference this in
+      their systemd service environment; do not set directly.
+    '';
+  };
+
+  options.hyperhive.frontend.extraFiles = lib.mkOption {
+    type = lib.types.attrsOf (
+      lib.types.submodule (
+        { name, ... }:
+        {
+          options = {
+            source = lib.mkOption {
+              type = lib.types.path;
+              description = ''
+                Source file or directory to layer over the default
+                agent dist. A path (relative to `agent.nix` or
+                absolute) — nix copies its contents into the merged
+                static tree.
+              '';
+            };
+            target = lib.mkOption {
+              # First char must be alphanumeric/underscore (rules out
+              # leading `/`, leading `.`, leading `-`); inner chars
+              # include `.` and `/` so nested layouts like
+              # `"games/bitburner"` work. This is the shape check —
+              # the `..`-segment traversal check is the assertion in
+              # `config.assertions` below (regex alone can't reject
+              # mid-path `..` segments without lookahead, which nix
+              # POSIX regex doesn't support).
+              type = lib.types.strMatching "^[A-Za-z0-9_][A-Za-z0-9_./-]*$";
+              default = name;
+              defaultText = lib.literalMD "the attribute name";
+              description = ''
+                Destination path within the merged static tree, used
+                as both the served URL prefix (`/<target>/...`) and
+                the on-disk layout in the merged derivation. Defaults
+                to the attribute name. Use forward slashes for
+                nested layouts (e.g. `"games/bitburner"`).
+
+                Constrained shape: must start with an alphanumeric or
+                `_`, and only contain alphanumerics, `_`, `.`, `/`,
+                `-`. `..` segments are separately rejected at config
+                eval time.
+              '';
+            };
+          };
+        }
+      )
+    );
+    default = { };
+    example = lib.literalExpression ''
+      {
+        bitburner = {
+          source = ./bitburner-dist;
+          # served at GET /bitburner/...
+        };
+      }
+    '';
+    description = ''
+      Per-agent additions layered on top of the default frontend
+      dist. Each entry copies its `source` into the served static
+      tree under `target`. Useful for shipping a self-contained
+      agent-specific surface alongside the standard agent UI (e.g.
+      the bitburner agent's game page at `/bitburner/`).
+
+      The default agent UI remains served at `/`; entries here only
+      add new routes and never replace the default. Overwrite
+      semantics are **hard-fail**: if `target` collides with an
+      existing file or directory in the default dist (or with a
+      prior entry's target), the `mergedDist` build aborts with
+      `refusing to overwrite existing path '<target>' in the
+      default dist`. To override a default file, fork the dist via
+      `hyperhive.frontend.dist` instead — `extraFiles` is for
+      pure additions.
+
+      `target` must be a relative path inside the static dir. An
+      assertion rejects leading `/` and `..` segments at config
+      eval time (string-concat-into-paths safety, even though
+      agent.nix goes through operator review before deploy).
+    '';
+  };
+
+  options.hyperhive.forge.url = lib.mkOption {
+    type = lib.types.str;
+    default = "http://localhost:3000";
+    example = "http://forge.internal:3000";
+    description = ''
+      Base URL of the hyperhive-managed Forgejo. Used at container
+      boot by a oneshot systemd unit that calls
+      `tea login add --url <this> --token "$(cat /state/forge-token)"`
+      so the agent's claude can shell out to `tea` without an extra
+      auth dance. No-op when `/state/forge-token` is missing (i.e.
+      hive-forge isn't running on the host).
+    '';
+  };
+
+  options.hyperhive.forge.keepSubscriptions = lib.mkOption {
+    type = lib.types.bool;
+    default = true;
+    description = ''
+      When true (the default), the forge notification poller will NOT
+      auto-unsubscribe from repo watches after delivering a
+      "subscribed"-reason notification. Sub-agents keep their broad
+      subscriptions so they stay informed about repos they contribute to.
+      Set to false for agents (e.g. the manager) that use reason-based
+      filtering and do not need firehose-level repo visibility — they will
+      auto-unsubscribe after receiving a watched-repo notification.
+    '';
+  };
+
+  options.hyperhive.forge.skipNotifyReasons = lib.mkOption {
+    type = lib.types.listOf lib.types.str;
+    default = [ ];
+    example = [
+      "subscribed"
+      "participating"
+    ];
+    description = ''
+      Forgejo notification `reason` values to suppress in the forge
+      notification poller. Notifications with these reasons are marked
+      read and silently dropped; all others — including notifications
+      with a null or unrecognised reason — are delivered.
+
+      Drop-list is safer than an allow-list: directed signals
+      (`review_requested`, `assigned`, `mention`) are never silently
+      missed even if Forgejo returns an unexpected reason string.
+
+      Empty list (the default) delivers all notifications. Set to
+      `[ "subscribed" "participating" ]` for agents like the manager
+      that want only direct mentions and reviews, not the full repo
+      firehose. Rendered to the `HIVE_FORGE_NOTIFY_SKIP_REASONS`
+      environment variable consumed by the harness poller at runtime.
+    '';
+  };
+
+  options.hyperhive.dashboardLinks = lib.mkOption {
+    type = lib.types.listOf (lib.types.submodule {
+      options = {
+        label = lib.mkOption {
+          type = lib.types.str;
+          description = "Display label for the link.";
+        };
+        icon = lib.mkOption {
+          type = lib.types.str;
+          default = "";
+          description = "Optional icon emoji or short glyph.";
+        };
+        url = lib.mkOption {
+          type = lib.types.str;
+          description = "Full URL (may include a different port, e.g. http://localhost:9001/stats).";
+        };
+      };
+    });
+    default = [ ];
+    example = lib.literalExpression ''
+      [
+        { label = "Stats"; icon = "📊"; url = "http://localhost:9001/stats"; }
+      ]
+    '';
+    description = ''
+      Extra navigation links surfaced on the hive-c0re dashboard card for
+      this agent. Declare any additional web UI pages the agent exposes —
+      stats pages, custom UIs, etc. hive-c0re reads the JSON file this
+      option produces at each container-view snapshot and attaches the
+      links to the agent card without any code changes.
+    '';
+  };
+
+  options.hyperhive.claudeMarketplaces = lib.mkOption {
+    type = lib.types.listOf lib.types.str;
+    default = [ "anthropics/claude-plugins-official" ];
+    example = [
+      "anthropics/claude-plugins-official"
+      "anthropics/claude-plugins-community"
+    ];
+    description = ''
+      Claude Code plugin marketplaces to add at harness boot. Each
+      entry is passed to `claude plugin marketplace add <source>`
+      (`owner/repo`, full git URL, or local path). Idempotent —
+      re-adding an existing marketplace is treated as success.
+      Required before `hyperhive.claudePlugins` entries that
+      reference a marketplace (e.g. `foo@claude-plugins-official`).
+      Rendered to `/etc/hyperhive/claude-marketplaces.json`.
+
+      Defaults to Anthropic's official marketplace; agents get it
+      out of the box without any per-agent.nix wiring.
+    '';
+  };
+
+  options.hyperhive.claudePlugins = lib.mkOption {
+    type = lib.types.listOf lib.types.str;
+    default = [ ];
+    example = [
+      "formatter@my-marketplace"
+      "thinking-tools@anthropics"
+    ];
+    description = ''
+      Claude Code plugins to install at harness boot. Each entry is
+      passed verbatim to `claude plugin install <spec>` once per
+      container start, before the turn loop opens. `claude plugin
+      install` is expected to be idempotent, so reinstalling on every
+      boot is cheap. Failures log a warning but do not abort boot — a
+      missing plugin is preferable to a non-serving agent. Rendered to
+      `/etc/hyperhive/claude-plugins.json`; the harness reads it via
+      `plugins::install_configured`.
+    '';
+  };
+
+  options.hyperhive.claudePluginsAutoUpdate = lib.mkOption {
+    type = lib.types.bool;
+    default = false;
+    description = ''
+      When true, the harness runs `claude plugin marketplace update`
+      before installing plugins at boot, pulling the latest index from
+      all configured marketplaces. Disabled by default — most agents
+      want pinned plugin versions and the network round-trip adds to
+      boot time. Enable for agents that should always install the latest
+      available version of their plugins.
+    '';
+  };
+
+  options.hyperhive.icon = lib.mkOption {
+    type = lib.types.nullOr lib.types.path;
+    default = null;
+    example = lib.literalExpression "./icon.svg";
+    description = ''
+      Path to an SVG file used as this agent's icon — shown on the
+      dashboard and the per-agent web UI (header + favicon). Commit
+      the SVG into the agent's config repo next to `agent.nix` and
+      reference it as a relative path (`./icon.svg`).
+
+      When null (the default) the agent falls back to the shared
+      hyperhive logo. The harness serves the icon (configured or
+      default) at `GET /icon` on the per-agent web port.
+    '';
+  };
+
+  options.hyperhive.autoCompact = lib.mkOption {
+    type = lib.types.bool;
+    default = true;
+    description = ''
+      Enable proactive watermark-based compaction. When `true` (the
+      default) the harness automatically runs a notes-checkpoint turn
+      followed by `/compact` once the context window crosses 75% of
+      the model's limit, keeping later turns from hitting the hard
+      overflow path. Set to `false` to disable proactive compaction
+      entirely (`HIVE_COMPACT_WATERMARK_TOKENS=0`); the reactive path
+      (compact-on-overflow when the session is already past the limit)
+      still applies.
+
+      Disable for agents that run large-context models (sonnet/opus)
+      where the heuristic fires too early and discards useful history
+      before the session is actually close to the limit.
+    '';
+  };
+
+  config = {
+    assertions = [
+      # Guard the inputs-routed-as-output pattern: the agent flake.nix is
+      # expected to set `_module.args.flakeInputs = builtins.removeAttrs inputs ["self"]`.
+      # If `self` leaks into flakeInputs the agent gets a spurious attrset
+      # entry that can shadow real inputs and is almost certainly a bug.
+      # Guard with `or {}` so standalone evaluation stays clean when
+      # flakeInputs is absent from _module.args.
+      {
+        assertion = !(builtins.hasAttr "self" (config._module.args.flakeInputs or { }));
+        message = ''
+          hyperhive: `flakeInputs` must not contain "self".
+          In your agent flake.nix, use:
+            _module.args.flakeInputs = builtins.removeAttrs inputs [ "self" ];
+        '';
+      }
+      # hyperhive.model must be a non-empty string — an empty value causes
+      # the harness to pass an invalid model flag to claude.
+      {
+        assertion = config.hyperhive.model != "";
+        message = "hyperhive.model must not be empty (set it to e.g. \"haiku\" or \"sonnet\")";
+      }
+      # hyperhive.forge.url must look like an HTTP URL when non-default.
+      {
+        assertion =
+          config.hyperhive.forge.url == ""
+          || lib.hasPrefix "http://" config.hyperhive.forge.url
+          || lib.hasPrefix "https://" config.hyperhive.forge.url;
+        message = "hyperhive.forge.url must be an http:// or https:// URL (got: \"${config.hyperhive.forge.url}\")";
+      }
+      # hyperhive.icon must reference an SVG file when set.
+      {
+        assertion =
+          config.hyperhive.icon == null
+          || lib.hasSuffix ".svg" (toString config.hyperhive.icon);
+        message = "hyperhive.icon must point to an .svg file";
+      }
+      # hyperhive.frontend.extraFiles[*].target is concatenated into
+      # $out during the mergedDist build. The option's strMatching
+      # type already rejects leading `/`, leading `.`, and the
+      # weirder characters; this assertion catches mid-path `..`
+      # segments (e.g. `foo/../etc/passwd`) that the type's regex
+      # can't easily express without lookahead. agent.nix is
+      # operator-reviewed, so this is belt-and-braces — but it's the
+      # kind of mistake that's easy to make and hard to spot.
+      {
+        assertion = lib.all (
+          entry: !(builtins.any (seg: seg == "..") (lib.splitString "/" entry.target))
+        ) (lib.attrValues config.hyperhive.frontend.extraFiles);
+        message = ''
+          hyperhive.frontend.extraFiles: `target` must not contain
+          `..` path segments.
+        '';
+      }
+    ];
+
+    environment.etc."hyperhive/extra-mcp.json".text = builtins.toJSON config.hyperhive.extraMcpServers;
+
+    # Operator-set per-agent icon (hyperhive.icon). When configured, the
+    # SVG lands at /etc/hyperhive/icon.svg; the harness serves it at
+    # GET /icon, falling back to the bundled hyperhive logo when absent.
+    environment.etc."hyperhive/icon.svg" =
+      lib.mkIf (config.hyperhive.icon != null) { source = config.hyperhive.icon; };
+
+    environment.etc."hyperhive/bash-allow.json".text =
+      builtins.toJSON config.hyperhive.allowedBashPatterns;
+
+    environment.etc."hyperhive/send-allow.json".text =
+      builtins.toJSON config.hyperhive.allowedRecipients;
+
+    environment.etc."hyperhive/claude-plugins.json".text =
+      builtins.toJSON config.hyperhive.claudePlugins;
+
+    environment.etc."hyperhive/claude-marketplaces.json".text =
+      builtins.toJSON config.hyperhive.claudeMarketplaces;
+
+    environment.etc."hyperhive/claude-plugins-auto-update.json".text =
+      builtins.toJSON config.hyperhive.claudePluginsAutoUpdate;
+
+    # Merged frontend static tree. Base = `${frontend.dist}/agent/`,
+    # then each `extraFiles` entry is laid on top at its `target`
+    # path. The runCommand derivation aborts on overwrite so a
+    # filename collision with the default dist surfaces as a build
+    # failure rather than a silent override (operator gets a clear
+    # nix error rather than a confusing 404 / silent dist swap).
+    hyperhive.frontend.mergedDist = pkgs.runCommand "hyperhive-agent-frontend-merged" { } (
+      ''
+        mkdir -p $out
+        cp -r ${config.hyperhive.frontend.dist}/agent/. $out/
+        chmod -R u+w $out
+      ''
+      + lib.concatMapStrings (entry: ''
+        mkdir -p $(dirname $out/${entry.target})
+        if [ -e $out/${entry.target} ]; then
+          echo "hyperhive.frontend.extraFiles: refusing to overwrite existing path '${entry.target}' in the default dist" >&2
+          exit 1
+        fi
+        cp -r ${entry.source} $out/${entry.target}
+      '') (lib.attrValues config.hyperhive.frontend.extraFiles)
+    );
+
+    # HIVE_DEFAULT_MODEL seeds the initial model selection when no persisted
+    # model choice exists in the state dir. SHELL must be set so claude's
+    # Bash tool finds a POSIX shell.
+    # HIVE_CONTEXT_WINDOW_TOKENS_* are injected by the meta flake from the
+    # host-level `services.hive-c0re.contextWindowTokens` option — not set here.
+    environment.variables = {
+      HIVE_DEFAULT_MODEL = config.hyperhive.model;
+      SHELL = "${pkgs.bashInteractive}/bin/bash";
+    } // lib.optionalAttrs (!config.hyperhive.autoCompact) {
+      # Zero watermark disables proactive compaction; the reactive path
+      # (compact-on-overflow) still fires when the session is truly full.
+      HIVE_COMPACT_WATERMARK_TOKENS = "0";
+    } // lib.optionalAttrs config.hyperhive.forge.keepSubscriptions {
+      HIVE_FORGE_KEEP_SUBSCRIPTIONS = "1";
+    } // lib.optionalAttrs (config.hyperhive.forge.skipNotifyReasons != [ ]) {
+      HIVE_FORGE_NOTIFY_SKIP_REASONS = lib.concatStringsSep "," config.hyperhive.forge.skipNotifyReasons;
+    };
+
+    boot.isNspawnContainer = true;
+
+    # Every agent gets flakes + the modern `nix` CLI out of the box.
+    # Equivalent to passing `--extra-experimental-features 'nix-command
+    # flakes'` on every invocation. Agents shell out to `nix build` /
+    # `nix flake` constantly (devshells, ad-hoc evals, fetching their
+    # own MCP-server flakes); without this they hit the "experimental
+    # feature not enabled" wall on the first try.
+    nix.settings.experimental-features = [
+      "nix-command"
+      "flakes"
+    ];
+
+    # Containers bind-mount the host's nix-daemon socket. The host daemon
+    # may be configured with remote builders or strict sandbox settings
+    # (sandbox-fallback = false) that make local `nix build` invocations
+    # fail inside the container. Enable sandbox-fallback so builds that
+    # can't set up the sandbox (no user-namespaces in nspawn) fall back
+    # to unsandboxed local builds rather than failing outright.
+    # mkForce overrides the nixpkgs nix module which sets this to false
+    # at normal priority -- without it agents get a conflicting definition
+    # error on rebuild. Security implications: see docs/security.md.
+    nix.settings.sandbox-fallback = lib.mkForce true;
+
+    # `claude-code` is unfree. Each per-agent container's nixosConfiguration
+    # evaluates its own `nixpkgs` instance, so the operator's host-level
+    # `nixpkgs.config.allowUnfreePredicate` does not propagate into here —
+    # we have to allow it inside the container's config as well.
+    nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (pkgs.lib.getName pkg) [ "claude-code" ];
+
+    environment.systemPackages = with pkgs; [
+      hyperhive
+      claude-code
+      bashInteractive
+      coreutils-full
+      # procps for pkill — used by the web UI's /api/cancel to SIGINT the
+      # in-flight claude turn.
+      procps
+      # tea: gitea/forgejo CLI client. Configured at boot by the
+      # tea-login oneshot below if /state/forge-token is present, so
+      # claude can `tea repos create`, `tea pulls create`, etc.
+      tea
+      # jq: JSON processing in shell — useful for parsing API responses,
+      # forge REST calls, sqlite output, etc.
+      jq
+      # curl: HTTP client for forge REST API and other web requests.
+      curl
+      # hive-forge <verb>: CLI wrapping common Forgejo REST API operations
+      # (view, pr, issue, comment, assign, close, labels, branches, etc.)
+      (pkgs.callPackage ../packages/hive-forge-tools.nix { })
+    ];
+
+    # One-shot: write tea's config.yml from the seeded forge token so
+    # the agent can use `tea` without interactive prompts. Runs on
+    # every boot so a rotated token (hive-c0re remints on each agent
+    # rebuild) is always reflected. *Always* exits 0 — never fail a
+    # NixOS switch-to-configuration over a missing/temperamental forge.
+    systemd.services.tea-login = {
+      description = "configure tea CLI from hive-forge token (best-effort)";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "local-fs.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+      };
+      path = [
+        pkgs.curl
+        pkgs.python3
+        pkgs.coreutils
+      ];
+      script = ''
+                # No `set -e`: any subshell failure must not propagate.
+                # A failed unit aborts `nixos-container update` which blocks rebuilds.
+                FORGE_URL=${lib.escapeShellArg config.hyperhive.forge.url}
+                # Manager bind-mounts state at /state; sub-agents at
+                # /agents/<name>/state. Glob both — each container only sees
+                # its own mount, so there is exactly one hit (or zero when
+                # the forge hasn't been seeded yet).
+                TOKEN_FILE=""
+                for f in /state/forge-token /agents/*/state/forge-token; do
+                  if [ -f "$f" ]; then
+                    TOKEN_FILE="$f"
+                    break
+                  fi
+                done
+                if [ -z "$TOKEN_FILE" ]; then
+                  echo "tea-login: no forge-token found; skipping"
+                  exit 0
+                fi
+                TOKEN=$(cat "$TOKEN_FILE")
+                # Resolve the agent username from the forge API.
+                USER=$(curl -sf --max-time 5 \
+                  -H "Authorization: token $TOKEN" \
+                  "$FORGE_URL/api/v1/user" \
+                  | python3 -c 'import sys,json; print(json.load(sys.stdin).get("login",""))' \
+                  2>/dev/null || true)
+                if [ -z "$USER" ]; then
+                  echo "tea-login: could not resolve username from forge API; skipping"
+                  exit 0
+                fi
+                # tea reads config from ~/.config/tea/config.yml (for root: /root/.config/tea/config.yml).
+                # Write it directly so we control default:true and always
+                # refresh a rotated token — no 'tea login add' interactive dance.
+                # $HOME is unset in systemd service context (causing writes to
+                # /.config/). Hardcode /root — always correct for NixOS containers
+                # where the harness runs as root.
+                CONFIG="/root/.config/tea/config.yml"
+                mkdir -p "$(dirname "$CONFIG")" || true
+                cat > "$CONFIG" << EOF
+        logins:
+            - name: forge
+              url: $FORGE_URL
+              token: $TOKEN
+              default: true
+              ssh_host: ""
+              ssh_key: ""
+              insecure: false
+              ssh_agent: false
+              user: $USER
+        preferences:
+            editor: false
+            flag_defaults:
+                remote: ""
+        EOF
+                echo "tea-login: configured for $FORGE_URL as $USER"
+      '';
+    };
+
+    # One-shot: upload the agent's configured icon to its Forgejo user avatar
+    # so the icon shows up on commits / PRs / issue comments in the forge.
+    # Only runs when `/etc/hyperhive/icon.svg` is present (set via
+    # `hyperhive.icon`). No-op when the forge is unreachable or the icon
+    # is not set. *Always* exits 0.
+    systemd.services.forge-avatar-sync = {
+      description = "sync agent icon to Forgejo user avatar (best-effort)";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "tea-login.service" ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+      };
+      path = [
+        pkgs.curl
+        pkgs.coreutils
+        pkgs.jq
+        pkgs.librsvg
+      ];
+      script = ''
+        ICON=/etc/hyperhive/icon.svg
+        if [ ! -f "$ICON" ]; then
+          echo "forge-avatar-sync: no icon configured; skipping"
+          exit 0
+        fi
+        FORGE_URL=${lib.escapeShellArg config.hyperhive.forge.url}
+        TOKEN_FILE=""
+        for f in /state/forge-token /agents/*/state/forge-token; do
+          if [ -f "$f" ]; then
+            TOKEN_FILE="$f"
+            break
+          fi
+        done
+        if [ -z "$TOKEN_FILE" ]; then
+          echo "forge-avatar-sync: no forge-token found; skipping"
+          exit 0
+        fi
+        TOKEN=$(cat "$TOKEN_FILE")
+        # Rasterize SVG → PNG (Forgejo's Go image library can't decode SVG).
+        PNG=$(mktemp --suffix=.png)
+        if ! rsvg-convert -f png -w 512 -h 512 "$ICON" -o "$PNG" 2>/dev/null; then
+          echo "forge-avatar-sync: rsvg-convert failed; skipping"
+          rm -f "$PNG"
+          exit 0
+        fi
+        IMAGE=$(base64 -w 0 < "$PNG")
+        rm -f "$PNG"
+        # Forgejo POST /user/avatar expects {"image":"<base64>"} — just the
+        # raw base64 string, NOT a data URI (data:image/png;base64,...).
+        # Use jq to build the payload so the large base64 value is safely quoted.
+        PAYLOAD=$(jq -n --arg img "$IMAGE" '{image:$img}')
+        RESP=$(curl -sf --max-time 10 \
+          -X POST "$FORGE_URL/api/v1/user/avatar" \
+          -H "Authorization: token $TOKEN" \
+          -H "Content-Type: application/json" \
+          -d "$PAYLOAD" \
+          -w "\n%{http_code}" 2>/dev/null || true)
+        CODE=$(printf '%s' "$RESP" | tail -1)
+        if [ "$CODE" = "204" ] || [ "$CODE" = "200" ]; then
+          echo "forge-avatar-sync: avatar uploaded (HTTP $CODE)"
+        else
+          echo "forge-avatar-sync: upload returned HTTP $CODE — skipping (non-fatal)"
+        fi
+      '';
+    };
+
+    # Write declared dashboardLinks to the state dir so hive-c0re can read
+    # them without accessing the container's /etc/ from the host.
+    # Runs every boot; idempotent (overwrite). Always exits 0.
+    systemd.services.hive-dashboard-links = lib.mkIf (config.hyperhive.dashboardLinks != [ ]) {
+      description = "write declarative dashboardLinks to agent state dir";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+      };
+      environment.LINKS_JSON = builtins.toJSON config.hyperhive.dashboardLinks;
+      script = ''
+        # Sub-agents have their state dir bind-mounted at /agents/<name>/state.
+        # Use a glob — exactly one match per container at runtime.
+        STATE_DIR=$(echo /agents/*/state)
+        if [ ! -d "$STATE_DIR" ]; then
+          echo "hive-dashboard-links: no state dir found at /agents/*/state; skipping"
+          exit 0
+        fi
+        printf '%s' "$LINKS_JSON" > "$STATE_DIR/hyperhive-dashboard-links.json"
+        echo "hive-dashboard-links: wrote $(printf '%s' "$LINKS_JSON" | wc -c) bytes to $STATE_DIR/hyperhive-dashboard-links.json"
+      '';
+    };
+
+    # Git is needed by claude's Bash tool (for the agent <-> manager config
+    # request flow) and by hive-c0re's own setup_applied / setup_proposed.
+    # The per-agent `applied/<name>/flake.nix` overrides `user.name` and
+    # `user.email` with the agent's identity — values here are `mkDefault`
+    # so the per-agent override wins without needing `mkForce`.
+    programs.git = {
+      enable = true;
+      config = {
+        user = {
+          name = lib.mkDefault "hyperhive";
+          email = lib.mkDefault "hyperhive@local";
+        };
+        init.defaultBranch = lib.mkDefault "main";
+      };
+    };
+
+    system.stateVersion = "25.11";
+  };
+}
diff --git a/nix/templates/manager.nix b/nix/templates/manager.nix
new file mode 100644
index 00000000..51cc38f7
--- /dev/null
+++ b/nix/templates/manager.nix
@@ -0,0 +1,43 @@
+{ pkgs, config, ... }:
+{
+  imports = [ ./harness-base.nix ];
+
+  # Manager auto-unsubscribes from repo watches and skips the subscription/
+  # participation firehose — only direct mentions, reviews, and assignments
+  # land in the inbox. Sub-agents default to keepSubscriptions=true and
+  # skipNotifyReasons=[].
+  hyperhive.forge.keepSubscriptions = false;
+  hyperhive.forge.skipNotifyReasons = [
+    "subscribed"
+    "participating"
+  ];
+
+  # HIVE_PORT/HIVE_LABEL/gitconfig are also injected by the generated
+  # `applied/hm1nd/flake.nix` (see `lifecycle::setup_applied`); the values
+  # here are the base config so the container stays sensible if anyone
+  # ever evaluates `nixosConfigurations.manager` standalone.
+  systemd.services.hive-m1nd = {
+    description = "hive-m1nd manager harness";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network.target" ];
+    environment = {
+      HIVE_PORT = "8000";
+      HIVE_LABEL = "hm1nd";
+      SHELL = "${pkgs.bashInteractive}/bin/bash";
+      # Manager runs the same hive-m1nd harness binary that serves
+      # the per-agent web UI; point it at the merged agent static dist
+      # (same shape as for sub-agents).
+      HIVE_STATIC_DIR = "${config.hyperhive.frontend.mergedDist}";
+    };
+    # See note in agent-base.nix — `/run/current-system/sw` makes the
+    # harness service PATH track `environment.systemPackages` so anything
+    # an agent adds to its own `agent.nix` is visible without editing the
+    # service definition.
+    path = [ "/run/current-system/sw" ];
+    serviceConfig = {
+      ExecStart = "${pkgs.hyperhive}/bin/hive-m1nd serve";
+      Restart = "on-failure";
+      RestartSec = 2;
+    };
+  };
+}
diff --git a/nix/templates/weston-vnc.nix b/nix/templates/weston-vnc.nix
new file mode 100644
index 00000000..07739242
--- /dev/null
+++ b/nix/templates/weston-vnc.nix
@@ -0,0 +1,157 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+{
+  # Optional Weston (the reference Wayland compositor) with the VNC
+  # backend, surfaced as a per-agent hyperhive option. An agent turns
+  # it on from its own `agent.nix`:
+  #
+  #   hyperhive.gui.enable = true;
+  #
+  # Imported by `harness-base.nix`, so every sub-agent + the manager
+  # has the option available; only those that flip it on get the
+  # service. This is a flat per-agent option (evaluated inside that
+  # agent's own container build) — NOT a `hyperhive.agents.<name>.*`
+  # registry, which can't work: each agent is its own
+  # nixosConfiguration and has no cross-agent view.
+  #
+  # VNC port selection: a deterministic FNV-1a hash of the agent name
+  # (derived from the container hostname at runtime) maps into the
+  # range [15900, 16799], mirroring lifecycle::agent_web_port. The
+  # computed port is written to `/etc/hyperhive/gui.json` at service
+  # start; the harness (issue #51) reads that file to know where to
+  # relay WebSocket connections.
+  #
+  # Note: weston's VNC backend does not expose a CLI bind-address flag
+  # (unlike the RDP backend's `--address`), so VNC listens on all
+  # interfaces. The harness WebSocket relay (issue #51) connects only
+  # via 127.0.0.1, and the host firewall should block external access
+  # to the VNC port range. A future weston.ini `[vnc] address=` can
+  # restrict this once upstream supports it.
+
+  options.hyperhive.gui.enable = lib.mkOption {
+    type = lib.types.bool;
+    default = false;
+    description = ''
+      Run Weston with the VNC backend as a systemd service, for
+      in-browser GUI access via the harness WebSocket relay (see
+      issue #51). Renders in software (pixman) — no GPU, DRM,
+      or VT access, so no extra container capabilities are needed.
+
+      The VNC port is deterministic: FNV-1a hash of the agent name
+      (taken from the container hostname) mapped into [15900, 16799].
+      The port and auth mode are written to `/etc/hyperhive/gui.json`
+      at service start so the harness can relay connections.
+
+      The unit is deliberately built so enabling it can NEVER abort
+      the agent's `nixos-container update`: `Type = "simple"` (so
+      `switch-to-configuration` doesn't block on weston readiness)
+      and the ExecStart script always tries to exec weston after
+      setup — a misconfigured weston degrades to a restart loop
+      visible in `journalctl`, it does not block the rebuild. (Same
+      reasoning as the `tea-login` unit in `harness-base.nix`.)
+    '';
+  };
+
+  config = lib.mkIf config.hyperhive.gui.enable {
+    # neatvnc 0.9 always calls the PAM auth callback (weston_authenticate_user)
+    # for Apple-DH (type 30), regardless of weston.ini auth-method=none.
+    # pam_permit.so makes the PAM service accept any credentials so the
+    # browser's empty Apple-DH credentials always pass.
+    #
+    # The service name is "weston-remote-access" — that is the literal string
+    # passed to pam_start() inside libweston (libweston/auth.c). Using "weston"
+    # instead silently falls back to the system default and rejects auth.
+    security.pam.services."weston-remote-access".text = ''
+      auth     sufficient pam_permit.so
+      account  sufficient pam_permit.so
+      session  sufficient pam_permit.so
+    '';
+
+    systemd.services.weston = {
+      description = "Weston Wayland compositor (VNC backend)";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        # `simple`, not `notify`: switch-to-configuration must not
+        # wait on weston signalling readiness (same reasoning as the
+        # `tea-login` unit in harness-base.nix).
+        Type = "simple";
+        # Creates /var/lib/weston (0700 root) at start.
+        StateDirectory = "weston";
+        Environment = "XDG_RUNTIME_DIR=/run/user/0";
+        # Wrapper script: computes the deterministic VNC port, writes
+        # /etc/hyperhive/gui.json for the harness (issue #51), then
+        # execs weston. Using `exec` keeps the PID stable so systemd
+        # tracks the weston process correctly under Type=simple.
+        # Any failure before the exec triggers Restart=on-failure
+        # (graceful degradation) rather than blocking the rebuild.
+        ExecStart = pkgs.writeShellScript "weston-vnc" ''
+          mkdir -p /run/user/0 && chmod 700 /run/user/0 || true
+
+          # --- Compute deterministic VNC port via FNV-1a ---
+          # Agent name = container hostname with leading "h-" stripped,
+          # mirroring lifecycle::agent_web_port in hive-c0re/src/lifecycle.rs.
+          # Read from /etc/hostname (always present in NixOS containers)
+          # to avoid a dependency on the `hostname` binary (which lives in
+          # pkgs.inetutils, not pkgs.coreutils).
+          # VNC_PORT_BASE=15900, VNC_PORT_RANGE=900 → [15900, 16799].
+          RAW_HOST=$(${pkgs.coreutils}/bin/cat /etc/hostname)
+          AGENT_NAME=$(${pkgs.coreutils}/bin/printf '%s' "$RAW_HOST" \
+            | ${pkgs.gnused}/bin/sed 's/^h-//')
+          hash=2166136261
+          for byte in $(${pkgs.coreutils}/bin/printf '%s' "$AGENT_NAME" \
+              | ${pkgs.coreutils}/bin/od -An -tu1 \
+              | ${pkgs.coreutils}/bin/tr -s ' \n' ' '); do
+            [ -n "$byte" ] || continue
+            hash=$(( ((hash ^ byte) * 16777619) & 4294967295 ))
+          done
+          VNC_PORT=$((15900 + hash % 900))
+
+          # --- Write gui.json marker ---
+          # The harness reads this at startup (issue #51) to know the
+          # VNC port and auth mode for the WebSocket relay.
+          ${pkgs.coreutils}/bin/mkdir -p /etc/hyperhive
+          ${pkgs.coreutils}/bin/printf '{"vnc_port":%d,"auth":"none"}\n' \
+            "$VNC_PORT" > /etc/hyperhive/gui.json || true
+
+          # neatvnc ≥ 0.9 advertises RSA-AES and Apple-DH security types
+          # when auth is compiled in. The browser client handles Apple-DH
+          # (type 30) with empty credentials.
+          #
+          # weston.ini [vnc] auth-method=none: weston uses an always-accept
+          # auth callback instead of PAM. Without this, weston defaults to
+          # PAM authentication which rejects empty credentials (SecurityResult=1).
+          #
+          # --disable-transport-layer-security prevents the VeNCrypt TLS
+          # wrapper; plain auth types (incl. type 30) are advertised directly.
+          # [core] idle-time=0 disables weston's idle timeout (default
+          # 300s). Without it the VNC desktop fades to black after 5 min
+          # idle and desktop-shell shows its click-to-unlock lock screen
+          # — useless for an agent desktop viewed over /screen (issue
+          # #180). idle-time=0 → the idle timer is updated with a 0ms
+          # delay, which wl_event_source_timer_update treats as "disarm",
+          # so the compositor never goes idle and never locks.
+          WESTON_INI=$(${pkgs.coreutils}/bin/mktemp /tmp/weston-XXXXXX.ini)
+          ${pkgs.coreutils}/bin/printf '[core]\nidle-time=0\n\n[vnc]\nauth-method=none\n' > "$WESTON_INI"
+
+          exec ${pkgs.weston}/bin/weston \
+            --config="$WESTON_INI" \
+            --backend=vnc-backend.so \
+            --renderer=pixman \
+            --port="$VNC_PORT" \
+            --disable-transport-layer-security
+        '';
+        Restart = "on-failure";
+        RestartSec = "5s";
+      };
+    };
+
+    # weston on the agent's interactive PATH too, so claude can run
+    # Wayland clients / `weston-info` against the compositor.
+    environment.systemPackages = [ pkgs.weston ];
+  };
+}
diff --git a/nixosConfigurations.nix b/nixosConfigurations.nix
deleted file mode 100644
index 60822839..00000000
--- a/nixosConfigurations.nix
+++ /dev/null
@@ -1,127 +0,0 @@
-{
-  inputs,
-  lib,
-}:
-let
-  allDevices = import ./devices.nix { inherit (inputs) self; };
-  inherit (inputs)
-    self
-    home-manager
-    lanzaboote
-    nova-shell
-    servicepoint-cli
-    servicepoint-simulator
-    servicepoint-tanks
-    stylix
-    zerforschen-plus
-    ;
-  forDevice = f: lib.mapAttrs (device: value: f (value // { inherit device; })) allDevices;
-in
-forDevice (
-  {
-    device,
-    system,
-    isDesktop ? false,
-    home-manager-users ? { },
-    nixosSystem ? inputs.nixpkgs.lib.nixosSystem,
-    ...
-  }@thisDevice:
-  let
-    specialArgs = inputs // {
-      inherit
-        device
-        home-manager-users
-        allDevices
-        thisDevice
-        ;
-    };
-  in
-  nixosSystem {
-    inherit specialArgs;
-    modules = [
-      ./nixosConfigurations/${device}
-      self.nixosModules.default
-
-      # keep-sorted start
-      home-manager.nixosModules.home-manager
-      lanzaboote.nixosModules.lanzaboote
-      stylix.nixosModules.stylix
-      zerforschen-plus.nixosModules.default
-      # keep-sorted end
-
-      # Base config
-      {
-        nixpkgs.hostPlatform = lib.mkDefault system;
-        networking.hostName = device;
-        system = {
-          stateVersion = "22.11";
-          autoUpgrade.flake = "git+https://git.berlin.ccc.de/vinzenz/nixos-configuration.git";
-        };
-        nix.settings.experimental-features = [
-          "nix-command"
-          "flakes"
-        ];
-        documentation = {
-          info.enable = false;
-          doc.enable = false;
-        };
-
-        time.timeZone = lib.mkDefault "Etc/UTC";
-
-        my = {
-          # keep-sorted start
-          autoupdate.enable = true;
-          distributedBuilds.enable = true;
-          extraCaches.enable = true;
-          git.enable = true;
-          globalinstalls.enable = true;
-          lixIsNix.enable = true;
-          openssh.enable = true;
-          overlays.unstable.enable = true;
-          # prometheusNode.enable = true;
-          systemdBoot.enable = true;
-          tailscale.enable = true;
-          # keep-sorted end
-
-          # keep-sorted start
-          enDe.enable = isDesktop;
-          firmwareUpdates.enable = isDesktop;
-          gnome.enable = isDesktop;
-          kdeconnect.enable = isDesktop;
-          modernDesktop.enable = isDesktop;
-          nixLd.enable = isDesktop;
-          overlays.vscodeExtensions.enable = isDesktop;
-          quietBoot.enable = isDesktop;
-          stylix.enable = isDesktop;
-          # keep-sorted end
-        };
-      }
-    ]
-    ++ lib.optionals isDesktop [
-      inputs.niri.nixosModules.niri
-      nova-shell.nixosModules.default
-      servicepoint-cli.nixosModules.default
-      servicepoint-simulator.nixosModules.default
-      servicepoint-tanks.nixosModules.default
-
-      # Desktop config
-      {
-        home-manager = {
-          extraSpecialArgs = specialArgs;
-          useGlobalPkgs = true;
-          useUserPackages = true;
-          users = home-manager-users;
-          sharedModules = [ { home.stateVersion = "22.11"; } ] ++ builtins.attrValues self.homeModules;
-        };
-
-        time.timeZone = "Europe/Berlin";
-
-        # on desktops, keep the device useable interactively during expensive builds
-        nix = {
-          daemonCPUSchedPolicy = "idle";
-          daemonIOSchedClass = "idle";
-        };
-      }
-    ];
-  }
-)
diff --git a/nixosConfigurations/aur0ra-installer/default.nix b/nixosConfigurations/aur0ra-installer/default.nix
deleted file mode 100644
index b6c1e1a1..00000000
--- a/nixosConfigurations/aur0ra-installer/default.nix
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  nixos-images,
-  config,
-  lib,
-  modulesPath,
-  ...
-}:
-{
-  imports = [
-    ../aur0ra
-    # nixos-images.nixosModules.sdimage-installer
-  ];
-  disabledModules = [
-    # disable the sd-image module that nixos-images uses
-    # (modulesPath + "/installer/sd-card/sd-image-aarch64-installer.nix")
-  ];
-}
diff --git a/nixosConfigurations/aur0ra/default.nix b/nixosConfigurations/aur0ra/default.nix
deleted file mode 100644
index 20aa8c34..00000000
--- a/nixosConfigurations/aur0ra/default.nix
+++ /dev/null
@@ -1,56 +0,0 @@
-{ lib, ... }:
-{
-  imports = [
-    ./hardware.nix
-    ./nice-looking-console.nix
-  ];
-
-  users.users.ruth = {
-    # initialPassword = "setup";
-    isNormalUser = true;
-    extraGroups = [
-      "wheel"
-      "networkmanager"
-      "video"
-    ];
-    # Allow the graphical user to login without password
-    initialHashedPassword = "";
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDNpLDmctyqGpow/ElQvdhY4BLBPS/sigDJ1QEcC7wC lpt2-roaming"
-    ];
-  };
-  nix.settings.trusted-users = [ "ruth" ];
-
-  # Don't require sudo/root to `reboot` or `poweroff`.
-  security.polkit.enable = true;
-
-  # Allow passwordless sudo from nixos user
-  security.sudo = {
-    enable = true;
-    wheelNeedsPassword = false;
-  };
-
-  services.openssh.enable = true;
-
-  # https://github.com/nvmd/nixos-raspberrypi-demo/blob/c521600570f0365ae9c846af4b023049b80ae331/modules/server-networking.nix
-
-  networking.firewall.logRefusedConnections = lib.mkDefault false;
-
-  # Use networkd instead of the pile of shell scripts
-  # NOTE: SK: is it safe to combine with NetworkManager on desktops?
-  networking.useNetworkd = lib.mkDefault true;
-
-  # The notion of "online" is a broken concept
-  # https://github.com/systemd/systemd/blob/e1b45a756f71deac8c1aa9a008bd0dab47f64777/NEWS#L13
-  # https://github.com/NixOS/nixpkgs/issues/247608
-  systemd.services.NetworkManager-wait-online.enable = false;
-  systemd.network.wait-online.enable = false;
-
-  # Do not take down the network for too long when upgrading,
-  # This also prevents failures of services that are restarted instead of stopped.
-  # It will use `systemctl restart` rather than stopping it with `systemctl stop`
-  # followed by a delayed `systemctl start`.
-  systemd.services.systemd-networkd.stopIfChanged = false;
-  # Services that are only restarted might be not able to resolve when resolved is stopped before
-  systemd.services.systemd-resolved.stopIfChanged = false;
-}
diff --git a/nixosConfigurations/aur0ra/hardware.nix b/nixosConfigurations/aur0ra/hardware.nix
deleted file mode 100644
index 8642f799..00000000
--- a/nixosConfigurations/aur0ra/hardware.nix
+++ /dev/null
@@ -1,62 +0,0 @@
-{ nixos-raspberrypi, lib, ... }:
-{
-  imports = with nixos-raspberrypi.nixosModules; [
-    raspberry-pi-5.base
-    raspberry-pi-5.bluetooth
-    raspberry-pi-5.page-size-16k
-    raspberry-pi-5.display-vc4
-  ];
-
-  # No one got time for xz compression.
-  #isoImage.squashfsCompression = "zstd";
-
-  boot.loader.raspberry-pi.bootloader = "kernel";
-
-  my.systemdBoot.enable = lib.mkForce false;
-
-  /*
-    fileSystems = {
-      "/boot/firmware" = {
-        # TODO
-        device = "/dev/disk/by-uuid/2175-794E";
-        fsType = "vfat";
-        options = [
-          "noatime"
-          "noauto"
-          "x-systemd.automount"
-          "x-systemd.idle-timeout=1min"
-        ];
-      };
-      "/" = {
-        # TODO
-        device = "/dev/disk/by-uuid/44444444-4444-4444-8888-888888888888";
-        fsType = "ext4";
-        options = [ "noatime" ];
-      };
-    };
-  */
-
-  hardware.raspberry-pi.config = {
-    all = {
-      # [all] conditional filter, https://www.raspberrypi.com/documentation/computers/config_txt.html#conditional-filters
-      # Base DTB parameters
-      # https://github.com/raspberrypi/linux/blob/a1d3defcca200077e1e382fe049ca613d16efd2b/arch/arm/boot/dts/overlays/README#L132
-      base-dt-params = {
-
-        # https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#enable-pcie
-        pciex1 = {
-          enable = true;
-          value = "on";
-        };
-        # PCIe Gen 3.0
-        # https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#pcie-gen-3-0
-        pciex1_gen = {
-          enable = true;
-          value = "3";
-        };
-
-      };
-
-    };
-  };
-}
diff --git a/nixosConfigurations/aur0ra/nice-looking-console.nix b/nixosConfigurations/aur0ra/nice-looking-console.nix
deleted file mode 100644
index 847bfc2c..00000000
--- a/nixosConfigurations/aur0ra/nice-looking-console.nix
+++ /dev/null
@@ -1,32 +0,0 @@
-# re-borrowed from https://github.com/nvmd/nixos-raspberrypi-demo/blob/main/modules/nice-looking-console.nix
-{ lib, pkgs, ... }:
-{
-  # The following have been borrowed from:
-  # https://github.com/nix-community/nixos-images/blob/b733f0680a42cc01d6ad53896fb5ca40a66d5e79/nix/image-installer/module.nix#L84
-
-  console.earlySetup = true;
-  # ter-u22n is probably too big
-  console.font = lib.mkDefault "${pkgs.terminus_font}/share/consolefonts/ter-u16n.psf.gz";
-
-  # Make colored console output more readable
-  # for example, `ip addr`s (blues are too dark by default)
-  # Tango theme: https://yayachiken.net/en/posts/tango-colors-in-terminal/
-  console.colors = lib.mkDefault [
-    "000000"
-    "CC0000"
-    "4E9A06"
-    "C4A000"
-    "3465A4"
-    "75507B"
-    "06989A"
-    "D3D7CF"
-    "555753"
-    "EF2929"
-    "8AE234"
-    "FCE94F"
-    "739FCF"
-    "AD7FA8"
-    "34E2E2"
-    "EEEEEC"
-  ];
-}
diff --git a/nixosConfigurations/damocles-lab/default.nix b/nixosConfigurations/damocles-lab/default.nix
deleted file mode 100644
index 705e31a8..00000000
--- a/nixosConfigurations/damocles-lab/default.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-{ pkgs, ... }:
-{
-  imports = [ ../damocles/claude-container.nix ];
-
-  services.openssh = {
-    enable = true;
-    ports = [ 2222 ];
-    # Path written into sshd_config as a string — not read at eval time.
-    # Key can be rotated without a rebuild.
-    authorizedKeysFiles = [ "/persist/damocles-ssh/id_ed25519.pub" ];
-  };
-
-  environment.systemPackages = with pkgs; [
-
-  ];
-}
diff --git a/nixosConfigurations/damocles/android-dev.nix b/nixosConfigurations/damocles/android-dev.nix
deleted file mode 100644
index f484e6a7..00000000
--- a/nixosConfigurations/damocles/android-dev.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{ pkgs, ... }:
-let
-  androidComposition = pkgs.androidenv.composeAndroidPackages {
-    buildToolsVersions = [ "36.1.0" ];
-    platformVersions = [ "35" ];
-    includeNDK = false;
-    includeEmulator = false;
-    includeSystemImages = false;
-  };
-  androidSdk = androidComposition.androidsdk;
-in
-{
-  nixpkgs.config.android_sdk.accept_license = true;
-
-  my.allowedUnfreePackages = [
-    "android-sdk-cmdline-tools"
-    "android-sdk-platform-tools"
-    "android-sdk-tools"
-    "android-sdk-build-tools"
-    "android-sdk-platforms"
-
-    # wtf
-    "platform-tools"
-    "tools"
-    "build-tools"
-    "cmdline-tools"
-    "platforms"
-    "cmake" # android sdk repackage
-  ];
-
-  environment.systemPackages = with pkgs; [
-    androidSdk
-    gradle
-    kotlin
-    jdk21
-  ];
-
-  environment.variables = {
-    ANDROID_HOME = "${androidSdk}/libexec/android-sdk";
-    ANDROID_SDK_ROOT = "${androidSdk}/libexec/android-sdk";
-    JAVA_HOME = "${pkgs.jdk21}";
-  };
-}
diff --git a/nixosConfigurations/damocles/claude-container.nix b/nixosConfigurations/damocles/claude-container.nix
deleted file mode 100644
index a91c6618..00000000
--- a/nixosConfigurations/damocles/claude-container.nix
+++ /dev/null
@@ -1,47 +0,0 @@
-{
-  pkgs,
-  lib,
-  ...
-}:
-{
-
-  my = {
-    allowedUnfreePackages = [ "claude-code" ];
-    overlays.unstable.enable = true;
-  };
-
-  environment.systemPackages = with pkgs; [
-    unstable.claude-code
-    git
-    python3
-    coreutils-full
-    gawk
-    gnugrep
-    curl
-    bintools
-    file
-  ];
-
-  boot.isContainer = true;
-
-  programs.nix-ld = {
-    enable = true;
-    libraries = with pkgs; [
-      stdenv.cc.cc.lib
-      zlib
-    ];
-  };
-
-  # Container shares host network namespace (privateNetwork = false), so the
-  # host's tailscale already covers this. Running a second tailscaled in the
-  # same netns fights over routing and breaks connectivity after sleep/wake.
-  services.tailscale.enable = lib.mkForce false;
-  networking.firewall.checkReversePath = lib.mkForce "strict";
-
-  users.users.muede = {
-    isNormalUser = true;
-    extraGroups = [ "wheel" ];
-  };
-
-  security.sudo.wheelNeedsPassword = false;
-}
diff --git a/nixosConfigurations/damocles/default.nix b/nixosConfigurations/damocles/default.nix
deleted file mode 100644
index a511d472..00000000
--- a/nixosConfigurations/damocles/default.nix
+++ /dev/null
@@ -1,15 +0,0 @@
-{ pkgs, ... }:
-{
-  imports = [
-    ./android-dev.nix
-    ./claude-container.nix
-  ];
-
-  environment.systemPackages = with pkgs; [
-    cargo
-    rustc
-    clippy
-    gh
-    buildPackages.stdenv.cc
-  ];
-}
diff --git a/nixosConfigurations/epimetheus/default.nix b/nixosConfigurations/epimetheus/default.nix
deleted file mode 100644
index 19b62193..00000000
--- a/nixosConfigurations/epimetheus/default.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ modulesPath, ... }:
-{
-  imports = [ (modulesPath + "/virtualisation/proxmox-lxc.nix") ];
-
-  config = {
-    my.pxvirtGuest.enable = true;
-
-    proxmoxLXC = {
-      manageNetwork = false;
-      privileged = false;
-    };
-  };
-}
diff --git a/nixosConfigurations/forgejo-runner-1/default.nix b/nixosConfigurations/forgejo-runner-1/default.nix
deleted file mode 100644
index 88cc281a..00000000
--- a/nixosConfigurations/forgejo-runner-1/default.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ ... }:
-{
-  imports = [
-    ./hardware.nix
-    ./forgejo-runner.nix
-  ];
-
-  config = {
-    my.podman.enable = true;
-
-    # uncomment for build check on non arm system (requires --impure)
-    # nixpkgs.buildPlatform = builtins.currentSystem;
-    users.users = {
-      root.openssh.authorizedKeys.keys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCJUpbpB3KEKVoKWsKoar9J4RNah8gmQoSH6jQEw5dY pixel-JuiceSSH"
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO1CRn4yYTL4XUdCebE8Z4ZeuMujBjorTdWifg911EOv pc2 home roaming"
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDNpLDmctyqGpow/ElQvdhY4BLBPS/sigDJ1QEcC7wC lpt2-roaming"
-      ];
-    };
-  };
-}
diff --git a/nixosConfigurations/forgejo-runner-1/forgejo-runner.nix b/nixosConfigurations/forgejo-runner-1/forgejo-runner.nix
deleted file mode 100644
index df9fb2b7..00000000
--- a/nixosConfigurations/forgejo-runner-1/forgejo-runner.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{ pkgs, ... }:
-{
-  config = {
-    environment.systemPackages = with pkgs; [
-      forgejo-runner
-    ];
-
-    # https://wiki.nixos.org/wiki/Forgejo
-
-    services.gitea-actions-runner = {
-      package = pkgs.forgejo-runner;
-      instances.default = {
-        enable = true;
-        name = "cccb";
-        url = "https://git.berlin.ccc.de";
-        # Obtaining the path to the runner token file may differ
-        # tokenFile should be in format TOKEN=<secret>, since it's EnvironmentFile for systemd
-        tokenFile = "/etc/forgejo-runner/registration_token";
-        labels = [
-          "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:rust-24.04"
-          "ubuntu-24.04:docker://ghcr.io/catthehacker/ubuntu:rust-24.04"
-        ];
-        settings = {
-          container.network = "bridge";
-        };
-      };
-    };
-  };
-}
diff --git a/nixosConfigurations/forgejo-runner-1/hardware.nix b/nixosConfigurations/forgejo-runner-1/hardware.nix
deleted file mode 100644
index 9786ed63..00000000
--- a/nixosConfigurations/forgejo-runner-1/hardware.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{ modulesPath, ... }:
-{
-  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
-
-  config = {
-    my.hetznerVm = {
-      enable = true;
-      rootUuid = "47bc77ff-12e1-4d39-bb5c-fb100ccd3aab";
-      bootUuid = "05F2-8F9A";
-      swapUuid = "bbd18a70-b0bb-4e1a-b45b-3c1f8ecc0c10";
-      ipv6Address = "2a01:4f8:c013:a524::1/64";
-    };
-  };
-}
diff --git a/nixosConfigurations/hetzner-vpn2/default.nix b/nixosConfigurations/hetzner-vpn2/default.nix
deleted file mode 100644
index b12cecd5..00000000
--- a/nixosConfigurations/hetzner-vpn2/default.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-  imports = [
-    ./hardware.nix
-    ./nginx.nix
-  ];
-
-  config = {
-    # uncomment for build check on non arm system (requires --impure)
-    # nixpkgs.buildPlatform = builtins.currentSystem;
-
-    users.users.root.openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICdYqY3Y1/f1bsAi5Qfyr/UWuX9ixu96IeAlhoQaJkbf"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCJUpbpB3KEKVoKWsKoar9J4RNah8gmQoSH6jQEw5dY pixel-JuiceSSH"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO1CRn4yYTL4XUdCebE8Z4ZeuMujBjorTdWifg911EOv pc2 home roaming"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDNpLDmctyqGpow/ElQvdhY4BLBPS/sigDJ1QEcC7wC lpt2-roaming"
-    ];
-  };
-}
diff --git a/nixosConfigurations/hetzner-vpn2/hardware.nix b/nixosConfigurations/hetzner-vpn2/hardware.nix
deleted file mode 100644
index 6c9f3151..00000000
--- a/nixosConfigurations/hetzner-vpn2/hardware.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{ modulesPath, ... }:
-{
-  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
-
-  config = {
-    my.hetznerVm = {
-      enable = true;
-      rootUuid = "3263489d-9819-433c-b198-9d2e732a94e4";
-      bootUuid = "6C25-6BDC";
-      swapUuid = "e147721d-86b5-40d7-a231-c6ea391c563d";
-      ipv6Address = "2a01:4f8:c013:65dd::1/64";
-    };
-  };
-}
diff --git a/nixosConfigurations/hetzner-vpn2/nginx.nix b/nixosConfigurations/hetzner-vpn2/nginx.nix
deleted file mode 100644
index aa399aa8..00000000
--- a/nixosConfigurations/hetzner-vpn2/nginx.nix
+++ /dev/null
@@ -1,62 +0,0 @@
-{ pkgs, ... }:
-let
-  blog-domain-socket = "/run/nginx/blog.sock";
-  anubis-domain-socket = "/run/anubis/anubis-main/anubis.sock";
-  anubis-metrics-socket = "/run/anubis/anubis-main/anubis-metrics.sock";
-in
-{
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "acme@zerforschen.plus";
-  };
-
-  systemd.services = {
-    nginx.serviceConfig.SupplementaryGroups = [ "anubis" ];
-    anubis-main.serviceConfig.SupplementaryGroups = [ "nginx" ];
-  };
-
-  services = {
-    nginx = {
-      enable = true;
-      recommendedProxySettings = true;
-      recommendedTlsSettings = true;
-      recommendedGzipSettings = true;
-      recommendedOptimisation = true;
-
-      virtualHosts = {
-        "zerforschen.plus" = {
-          addSSL = true;
-          enableACME = true;
-          locations = {
-            "/_metrics".proxyPass = "http://unix:" + anubis-metrics-socket + ":/metrics";
-            "/".proxyPass = "http://unix:" + anubis-domain-socket;
-          };
-        };
-
-        "blog-in-anubis" = {
-          root = pkgs.zerforschen-plus-content;
-          listen = [
-            {
-              addr = "unix:" + blog-domain-socket;
-            }
-          ];
-        };
-      };
-    };
-
-    anubis.instances.main = {
-      enable = true;
-      settings = {
-        BIND = anubis-domain-socket;
-        TARGET = "unix://" + blog-domain-socket;
-        METRICS_BIND = anubis-metrics-socket;
-      };
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-    5201
-  ];
-}
diff --git a/nixosConfigurations/hyperforge/default.nix b/nixosConfigurations/hyperforge/default.nix
deleted file mode 100644
index 693a7a89..00000000
--- a/nixosConfigurations/hyperforge/default.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-  imports = [
-    ./hardware.nix
-    ./forgejo.nix
-    ./nginx.nix
-  ];
-
-  config = {
-    # uncomment for build check on non arm system (requires --impure)
-    # nixpkgs.buildPlatform = builtins.currentSystem;
-
-    users.users.root.openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCJUpbpB3KEKVoKWsKoar9J4RNah8gmQoSH6jQEw5dY pixel-JuiceSSH"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO1CRn4yYTL4XUdCebE8Z4ZeuMujBjorTdWifg911EOv pc2 home roaming"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDNpLDmctyqGpow/ElQvdhY4BLBPS/sigDJ1QEcC7wC lpt2-roaming"
-    ];
-  };
-}
diff --git a/nixosConfigurations/hyperforge/forgejo.nix b/nixosConfigurations/hyperforge/forgejo.nix
deleted file mode 100644
index 51b86b3d..00000000
--- a/nixosConfigurations/hyperforge/forgejo.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{ config, lib, ... }:
-let
-  srv = config.services.forgejo.settings.server;
-in
-{
-  services.forgejo = {
-    enable = true;
-    database.type = "sqlite3";
-    lfs.enable = true;
-
-    settings = {
-      server = {
-        DOMAIN = "forge.darkest.space";
-        ROOT_URL = "https://${srv.DOMAIN}/";
-        HTTP_PORT = 3000;
-        SSH_PORT = lib.head config.services.openssh.ports;
-      };
-      service.DISABLE_REGISTRATION = true;
-      session.COOKIE_SECURE = true;
-    };
-  };
-
-  services.openssh.enable = true;
-}
diff --git a/nixosConfigurations/hyperforge/hardware.nix b/nixosConfigurations/hyperforge/hardware.nix
deleted file mode 100644
index a196adb8..00000000
--- a/nixosConfigurations/hyperforge/hardware.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{ modulesPath, ... }:
-{
-  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
-
-  config = {
-    my.hetznerVm = {
-      enable = true;
-      rootUuid = "73dfcfd2-3a61-4b05-8440-d57072b89eda";
-      bootUuid = "E9C2-D85B";
-      swapUuid = "737140f2-c2fd-4af9-9974-f05642f8d90e";
-      ipv6Address = "2a01:4f8:c013:cbdd::1/64";
-    };
-  };
-}
diff --git a/nixosConfigurations/hyperforge/nginx.nix b/nixosConfigurations/hyperforge/nginx.nix
deleted file mode 100644
index 2faf8d94..00000000
--- a/nixosConfigurations/hyperforge/nginx.nix
+++ /dev/null
@@ -1,32 +0,0 @@
-{ config, ... }:
-let
-  srv = config.services.forgejo.settings.server;
-in
-{
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "acme@darkest.space";
-  };
-
-  services.nginx = {
-    enable = true;
-    recommendedProxySettings = true;
-    recommendedTlsSettings = true;
-    recommendedGzipSettings = true;
-    recommendedOptimisation = true;
-
-    virtualHosts.${srv.DOMAIN} = {
-      enableACME = true;
-      forceSSL = true;
-      extraConfig = ''
-        client_max_body_size 512M;
-      '';
-      locations."/".proxyPass = "http://127.0.0.1:${toString srv.HTTP_PORT}";
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-  ];
-}
diff --git a/nixosConfigurations/muede-lpt2/containers.nix b/nixosConfigurations/muede-lpt2/containers.nix
deleted file mode 100644
index 7033b52e..00000000
--- a/nixosConfigurations/muede-lpt2/containers.nix
+++ /dev/null
@@ -1,57 +0,0 @@
-{ self, ... }:
-{
-  config = {
-    boot.enableContainers = true;
-    virtualisation.containers.enable = true;
-
-    containers.damocles = {
-      autoStart = false;
-      privateNetwork = false;
-      path = self.nixosConfigurations.damocles.config.system.build.toplevel;
-      bindMounts."/etc/nix/distributed-build-key" = {
-        hostPath = "/etc/nix/distributed-build-key";
-        isReadOnly = true;
-      };
-      bindMounts."/persist/damocles-ssh" = {
-        hostPath = "/persist/damocles-ssh";
-        isReadOnly = true;
-      };
-      bindMounts."/persist/damocles-lab" = {
-        hostPath = "/persist/damocles-lab";
-        isReadOnly = false;
-      };
-    };
-
-    containers.damocles-lab = {
-      autoStart = false;
-      privateNetwork = false;
-      path = self.nixosConfigurations.damocles-lab.config.system.build.toplevel;
-      bindMounts."/etc/nix/distributed-build-key" = {
-        hostPath = "/etc/nix/distributed-build-key";
-        isReadOnly = true;
-      };
-      bindMounts."/workspace" = {
-        hostPath = "/persist/damocles-lab";
-        isReadOnly = false;
-      };
-      bindMounts."/persist/damocles-ssh" = {
-        hostPath = "/persist/damocles-ssh";
-        isReadOnly = true;
-      };
-    };
-
-    # Global DefaultTimeoutStopSec is 10s (modern-desktop.nix), which kills systemd-nspawn
-    # before it finishes halting, leaving cgroups busy and breaking restarts.
-    systemd.services."container@damocles".serviceConfig = {
-      TimeoutStopSec = "60s";
-      # After a SIGKILL of nspawn, the kernel needs a moment to reap its cgroups.
-      # Without this, the immediate restart attempt fails with "Device or resource busy".
-      RestartSec = "5s";
-    };
-
-    systemd.services."container@damocles-lab".serviceConfig = {
-      TimeoutStopSec = "60s";
-      RestartSec = "5s";
-    };
-  };
-}
diff --git a/nixosConfigurations/muede-lpt2/default.nix b/nixosConfigurations/muede-lpt2/default.nix
deleted file mode 100644
index 367a7df5..00000000
--- a/nixosConfigurations/muede-lpt2/default.nix
+++ /dev/null
@@ -1,70 +0,0 @@
-{ self, ... }:
-{
-  imports = [
-    ./containers.nix
-    ./hardware.nix
-    ./hyperhive.nix
-  ];
-
-  config = {
-    my = {
-      # keep-sorted start
-      intelGraphics.enable = true;
-      muedeDesktopSettings.enable = true;
-      podman.enable = true;
-      secureBoot.enable = true;
-      steam.enable = true;
-      users.muede.enable = true;
-      wineGaming.enable = true;
-      # keep-sorted end
-    };
-
-    nix.settings.extra-platforms = [
-      "aarch64-linux"
-      "i686-linux"
-    ];
-
-    services.xserver.xkb = {
-      # Configure keymap in X11
-      layout = "de";
-      variant = "";
-    };
-
-    # Configure console keymap
-    console.keyMap = "de";
-
-    users.users.muede.openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCJUpbpB3KEKVoKWsKoar9J4RNah8gmQoSH6jQEw5dY pixel-JuiceSSH"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO1CRn4yYTL4XUdCebE8Z4ZeuMujBjorTdWifg911EOv pc2 home roaming"
-    ];
-
-    programs = {
-      adb.enable = true;
-      light = {
-        enable = true;
-        brightnessKeys = {
-          enable = true;
-          step = 5;
-        };
-      };
-    };
-
-    networking.firewall.allowedTCPPorts = [
-      8776
-      1337
-    ];
-
-    services.servicepoint-tanks = {
-      enable = false;
-      urls = [
-        "http://localhost:5666"
-        "http://localhost:5667"
-      ];
-    };
-    nixpkgs.config.permittedInsecurePackages = [
-      "mbedtls-2.28.10"
-    ];
-
-    boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
-  };
-}
diff --git a/nixosConfigurations/muede-lpt2/hardware.nix b/nixosConfigurations/muede-lpt2/hardware.nix
deleted file mode 100644
index 175a168e..00000000
--- a/nixosConfigurations/muede-lpt2/hardware.nix
+++ /dev/null
@@ -1,56 +0,0 @@
-{ pkgs, lib, ... }:
-{
-  # intel cpu
-  boot.kernelModules = [
-    "kvm-intel"
-    "xe"
-  ];
-
-  networking = {
-    networkmanager.enable = true;
-    useDHCP = lib.mkDefault true;
-  };
-
-  boot = {
-    kernelPackages = pkgs.linuxPackages_zen;
-    supportedFilesystems = [ "btrfs" ];
-    initrd = {
-      supportedFilesystems = [ "btrfs" ];
-      availableKernelModules = [
-        "xhci_pci"
-        "thunderbolt"
-        "nvme"
-      ];
-      luks.devices = {
-        "luks-2c654ff2-3c42-48d3-a1e3-9545679afaa3" = {
-          device = "/dev/disk/by-uuid/2c654ff2-3c42-48d3-a1e3-9545679afaa3";
-        };
-      };
-    };
-  };
-
-  fileSystems = {
-    "/" = {
-      device = "/dev/disk/by-uuid/e4dad0c8-26a1-45e9-bbd9-48565eb6574e";
-      fsType = "btrfs";
-      options = [ "subvol=@" ];
-    };
-
-    "/boot" = {
-      device = "/dev/disk/by-uuid/E2B7-2BC1";
-      fsType = "vfat";
-    };
-  };
-
-  swapDevices = [
-    {
-      device = "/var/lib/swapfile";
-      size = 32 * 1024;
-    }
-  ];
-
-  services.thermald.enable = true;
-  services.hardware.bolt.enable = true; # thunderbolt security
-
-  hardware.bluetooth.enable = true;
-}
diff --git a/nixosConfigurations/muede-lpt2/hyperhive.nix b/nixosConfigurations/muede-lpt2/hyperhive.nix
deleted file mode 100644
index cb41f904..00000000
--- a/nixosConfigurations/muede-lpt2/hyperhive.nix
+++ /dev/null
@@ -1,9 +0,0 @@
-{ hyperhive, ... }:
-{
-  imports = [
-    hyperhive.nixosModules.hive-c0re
-    hyperhive.nixosModules.hive-forge
-  ];
-
-  config.services.hive-c0re.enable = true;
-}
diff --git a/nixosConfigurations/muede-pc2/default.nix b/nixosConfigurations/muede-pc2/default.nix
deleted file mode 100644
index 42f77b3d..00000000
--- a/nixosConfigurations/muede-pc2/default.nix
+++ /dev/null
@@ -1,50 +0,0 @@
-{ pkgs, ... }:
-{
-  imports = [
-    ./hardware.nix
-    #    ./vscode-server.nix
-    #    ./hass.nix
-  ];
-
-  config = {
-    my = {
-      # keep-sorted start
-      amdGraphics.enable = true;
-      muedeDesktopSettings.enable = true;
-      podman.enable = true;
-      secureBoot.enable = true;
-      steam.enable = true;
-      users.muede.enable = true;
-      wineGaming.enable = true;
-      # keep-sorted end
-    };
-
-    boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
-    nix.settings.extra-platforms = [
-      "aarch64-linux"
-      "i686-linux"
-    ];
-
-    services.xserver.xkb = {
-      # Configure keymap in X11
-      layout = "de";
-      variant = "";
-    };
-
-    # Configure console keymap
-    console.keyMap = "de";
-
-    users.users.muede.openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrY6tcgnoC/xbgL7vxSjddEY9MBxRXe9n2cAHt88/TT home roaming"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCJUpbpB3KEKVoKWsKoar9J4RNah8gmQoSH6jQEw5dY pixel-JuiceSSH"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDNpLDmctyqGpow/ElQvdhY4BLBPS/sigDJ1QEcC7wC lpt2-roaming"
-    ];
-
-    environment.systemPackages = with pkgs; [ lact ];
-
-    networking.firewall.allowedUDPPorts = [
-      # Factorio
-      34197
-    ];
-  };
-}
diff --git a/nixosConfigurations/muede-pc2/fstab.nix b/nixosConfigurations/muede-pc2/fstab.nix
deleted file mode 100644
index fbacbc86..00000000
--- a/nixosConfigurations/muede-pc2/fstab.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{
-  "/" = {
-    device = "/dev/disk/by-uuid/0e9c983a-e733-447e-8181-f41d6670c4b8";
-    fsType = "btrfs";
-    options = [ "subvol=@" ];
-  };
-
-  "/home" = {
-    device = "/dev/disk/by-uuid/0e9c983a-e733-447e-8181-f41d6670c4b8";
-    fsType = "btrfs";
-    options = [ "subvol=@home" ];
-  };
-
-  "/games" = {
-    device = "/dev/disk/by-uuid/0e9c983a-e733-447e-8181-f41d6670c4b8";
-    fsType = "btrfs";
-    options = [ "subvol=@games" ];
-  };
-
-  "/boot" = {
-    device = "/dev/disk/by-uuid/AF67-8F16";
-    fsType = "vfat";
-  };
-
-  #"/mnt/nixos_btrfs_root" = {
-  #  # subvolume with id 5 is always the root volume
-  #  # this is convenient for managing the flat subvolume hierarchy
-  #  device = "/dev/disk/by-uuid/0e9c983a-e733-447e-8181-f41d6670c4b8";
-  #  fsType = "btrfs";
-  #  options = [ "subvolid=5" ];
-  #};
-
-  "/mnt/ssd2" = {
-    device = "/dev/disk/by-uuid/6b2a647d-c68e-4c07-85bf-c9bfc5db7e8a";
-    fsType = "ext4";
-  };
-}
diff --git a/nixosConfigurations/muede-pc2/hardware.nix b/nixosConfigurations/muede-pc2/hardware.nix
deleted file mode 100644
index 9e875c35..00000000
--- a/nixosConfigurations/muede-pc2/hardware.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{ pkgs, lib, ... }:
-{
-  # amd cpu
-  boot.kernelModules = [ "kvm-amd" ];
-
-  boot = {
-    initrd.availableKernelModules = [
-      "nvme"
-      "xhci_pci"
-      "ahci"
-      "usbhid"
-      "sd_mod"
-    ]; # "usb_storage"
-    kernelPackages = pkgs.linuxPackages_zen;
-    supportedFilesystems = [ "btrfs" ];
-    initrd.supportedFilesystems = [ "btrfs" ];
-    loader.efi.efiSysMountPoint = "/boot";
-  };
-
-  fileSystems = import ./fstab.nix;
-  swapDevices = [ ];
-
-  networking = {
-    networkmanager.enable = true;
-    useDHCP = lib.mkDefault true;
-    interfaces.eno1.wakeOnLan.enable = true;
-  };
-
-  hardware.bluetooth.enable = true;
-}
diff --git a/nixosConfigurations/muede-pc2/hass.nix b/nixosConfigurations/muede-pc2/hass.nix
deleted file mode 100644
index 187cc30f..00000000
--- a/nixosConfigurations/muede-pc2/hass.nix
+++ /dev/null
@@ -1,62 +0,0 @@
-{ pkgs, ... }:
-let
-  hass-image = "ghcr.io/home-assistant/home-assistant:stable";
-  hass-service = "podman-homeassistant";
-in
-{
-  virtualisation.oci-containers = {
-    backend = "podman";
-    containers.homeassistant = {
-      image = hass-image;
-      hostname = "hass.lan";
-      serviceName = hass-service;
-      volumes = [ "home-assistant:/config" ];
-      environment.TZ = "Europe/Berlin";
-      extraOptions = [ "--network=host" ];
-    };
-  };
-
-  systemd = {
-    timers.update-hass = {
-      timerConfig = {
-        Unit = "update-hass.service";
-        OnCalendar = "Sun 02:00";
-      };
-      wantedBy = [ "timers.target" ];
-    };
-
-    services.update-hass = {
-      serviceConfig = {
-        Type = "oneshot";
-        ExecStart = pkgs.writeShellScriptBin "update-hass" ''
-          podman pull ${hass-image};
-          systemctl restart ${hass-service};
-        '';
-      };
-    };
-  };
-
-  services = {
-    mosquitto = {
-      enable = true;
-    };
-
-    nginx = {
-      enable = true;
-
-      recommendedProxySettings = true;
-      recommendedTlsSettings = true;
-      recommendedGzipSettings = true;
-      recommendedOptimisation = true;
-
-      # TODO: add ssl
-      # TODO: add pam auth
-
-      virtualHosts."hass.lan" = {
-        locations."/" = {
-          proxyPass = "localhost:8123";
-        };
-      };
-    };
-  };
-}
diff --git a/nixosConfigurations/muede-pc2/vscode-server.nix b/nixosConfigurations/muede-pc2/vscode-server.nix
deleted file mode 100644
index 7c38e32e..00000000
--- a/nixosConfigurations/muede-pc2/vscode-server.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ pkgs, ... }:
-{
-  services.openvscode-server = {
-    enable = false;
-    package = pkgs.unstable.openvscode-server;
-    telemetryLevel = "off";
-    port = 8542;
-    host = "127.0.0.1";
-    withoutConnectionToken = true;
-    extraPackages = with pkgs; [
-      nodejs
-      git
-      gh
-      direnv
-    ];
-  };
-
-  networking.firewall.allowedTCPPorts = [
-    8542
-    8543
-    8544
-    80
-    1313
-    5201
-  ];
-}
diff --git a/nixosConfigurations/ronja-pc/default.nix b/nixosConfigurations/ronja-pc/default.nix
deleted file mode 100644
index 2a56407d..00000000
--- a/nixosConfigurations/ronja-pc/default.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{ pkgs, ... }:
-{
-  imports = [
-    ./hardware.nix
-  ];
-
-  config = {
-    my = {
-      # keep-sorted start
-      muedeDesktopSettings.enable = true;
-      steam.enable = true;
-      users.ronja.enable = true;
-      wineGaming.enable = true;
-      # keep-sorted end
-    };
-
-    # Configure keymap in X11
-    services.xserver.xkb = {
-      layout = "de";
-      variant = "";
-    };
-
-    # Configure console keymap
-    console.keyMap = "de";
-
-    environment.systemPackages = with pkgs; [
-      #  vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
-      #  wget
-    ];
-
-    # Open ports in the firewall.
-    # networking.firewall.allowedTCPPorts = [ ... ];
-    # networking.firewall.allowedUDPPorts = [ ... ];};
-  };
-}
diff --git a/nixosConfigurations/ronja-pc/hardware.nix b/nixosConfigurations/ronja-pc/hardware.nix
deleted file mode 100644
index e6ad854f..00000000
--- a/nixosConfigurations/ronja-pc/hardware.nix
+++ /dev/null
@@ -1,48 +0,0 @@
-{ lib, ... }:
-{
-  boot = {
-    supportedFilesystems = [ "btrfs" ];
-    initrd.supportedFilesystems = [ "btrfs" ];
-    kernelModules = [ "kvm-intel" ];
-    extraModulePackages = [ ];
-    initrd = {
-      availableKernelModules = [
-        "xhci_pci"
-        "ahci"
-        "nvme"
-        "usbhid"
-        "usb_storage"
-        "sd_mod"
-      ];
-      kernelModules = [ ];
-    };
-  };
-
-  fileSystems = {
-    "/" = {
-      device = "/dev/disk/by-uuid/27eccf93-a79f-4fcb-8588-ec55d913508f";
-      fsType = "btrfs";
-      options = [ "subvol=@" ];
-    };
-
-    "/boot" = {
-      device = "/dev/disk/by-uuid/85D4-43FC";
-      fsType = "vfat";
-      options = [
-        "fmask=0077"
-        "dmask=0077"
-      ];
-    };
-  };
-
-  swapDevices = [
-    { device = "/dev/disk/by-uuid/bf9d19fb-499b-4bfb-b67d-131fa5bf8259"; }
-  ];
-
-  hardware.bluetooth.enable = true;
-
-  networking = {
-    networkmanager.enable = true;
-    useDHCP = lib.mkDefault true;
-  };
-}
diff --git a/nixosModules/allowed-unfree-list.nix b/nixosModules/allowed-unfree-list.nix
deleted file mode 100644
index 2aee96f7..00000000
--- a/nixosModules/allowed-unfree-list.nix
+++ /dev/null
@@ -1,17 +0,0 @@
-{ lib, config, ... }:
-{
-  options.my.allowedUnfreePackages = lib.mkOption {
-    type = lib.types.listOf lib.types.str;
-    default = [ ];
-    example = [ "steam" ];
-  };
-
-  config = {
-    nixpkgs.config = {
-      # https://github.com/NixOS/nixpkgs/issues/197325#issuecomment-1579420085
-      allowUnfreePredicate = lib.mkDefault (
-        pkg: builtins.elem (lib.getName pkg) config.my.allowedUnfreePackages
-      );
-    };
-  };
-}
diff --git a/nixosModules/amd-graphics.nix b/nixosModules/amd-graphics.nix
deleted file mode 100644
index 1baeb24f..00000000
--- a/nixosModules/amd-graphics.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options.my.amdGraphics.enable = lib.mkEnableOption "AMD graphics drivers";
-
-  config = lib.mkIf config.my.amdGraphics.enable {
-    boot.kernelModules = [ "amdgpu" ];
-    services.xserver.videoDrivers = [ "amdgpu" ];
-
-    hardware = {
-      graphics.enable = true;
-      amdgpu = {
-        opencl.enable = true;
-        overdrive.enable = true;
-      };
-    };
-
-    environment.systemPackages = with pkgs; [ nvtopPackages.amd ];
-  };
-}
diff --git a/nixosModules/autoupdate.nix b/nixosModules/autoupdate.nix
deleted file mode 100644
index 028cfd7d..00000000
--- a/nixosModules/autoupdate.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ lib, config, ... }:
-{
-  options.my.autoupdate.enable = lib.mkEnableOption "automatic Nix GC and system upgrades";
-
-  config = lib.mkIf config.my.autoupdate.enable {
-    nix = {
-      optimise.automatic = true;
-      gc = {
-        automatic = true;
-        dates = "daily";
-        options = "--delete-older-than 7d";
-      };
-    };
-
-    system.autoUpgrade = {
-      enable = true;
-      dates = "daily";
-      # do not forget to set `flake` when using this module!
-    };
-  };
-}
diff --git a/nixosModules/distributed-builds.nix b/nixosModules/distributed-builds.nix
deleted file mode 100644
index e0f0e123..00000000
--- a/nixosModules/distributed-builds.nix
+++ /dev/null
@@ -1,155 +0,0 @@
-{
-  config,
-  lib,
-  allDevices,
-  thisDevice,
-  ...
-}:
-let
-  clientSshKeyPath = "/etc/nix/distributed-build-key";
-  buildUser = "remotebuild";
-
-  # Collect all per-device public keys that have been registered.
-  allClientPublicKeys = lib.pipe allDevices [
-    (lib.filterAttrs (_: v: (v.distributedBuilds or { }) ? clientPublicKey))
-    (lib.mapAttrsToList (_: v: v.distributedBuilds.clientPublicKey))
-  ];
-
-  isClient = (thisDevice.distributedBuilds or { }) ? clientPublicKey;
-
-  buildServerDevices = lib.filterAttrs (
-    _: v: (v.distributedBuilds or { }).isBuilder or false
-  ) allDevices;
-
-  sshHostname = m: m.publicFqdn or m.hostName;
-
-  buildServerKnownHosts = lib.pipe buildServerDevices [
-    (lib.filterAttrs (_: v: v.distributedBuilds ? hostPublicKey))
-    (lib.mapAttrs (
-      name: v: {
-        publicKey = v.distributedBuilds.hostPublicKey;
-        hostNames = [ (v.publicFqdn or name) ];
-      }
-    ))
-  ];
-
-  remoteBuildServerDevices = builtins.filter (m: m.hostName != config.networking.hostName) (
-    lib.mapAttrsToList (name: v: v // { hostName = name; }) buildServerDevices
-  );
-
-  buildMachines = map (
-    m:
-    {
-      hostName = sshHostname m;
-      systems = [ m.system ];
-      sshUser = buildUser;
-      sshKey = clientSshKeyPath;
-      protocol = "ssh-ng";
-    }
-    // lib.optionalAttrs (m.distributedBuilds ? speedFactor) {
-      speedFactor = m.distributedBuilds.speedFactor;
-    }
-    // {
-      supportedFeatures = [
-        "nixos-test"
-        "big-parallel"
-        "kvm"
-        "benchmark"
-      ];
-    }
-  ) remoteBuildServerDevices;
-in
-{
-  options.my.distributedBuilds.enable = lib.mkEnableOption "distributed Nix builds";
-
-  config = lib.mkIf config.my.distributedBuilds.enable (
-    lib.mkMerge [
-
-      # All machines
-      {
-        assertions =
-          lib.mapAttrsToList (name: v: {
-            assertion = v.distributedBuilds ? hostPublicKey && v.distributedBuilds ? storeSigningPublicKey;
-            message = "devices.${name}: isBuilder = true requires distributedBuilds.hostPublicKey and distributedBuilds.storeSigningPublicKey";
-          }) buildServerDevices
-          ++ lib.mapAttrsToList (name: v: {
-            assertion = lib.hasPrefix "ssh-" v.distributedBuilds.clientPublicKey;
-            message = "devices.${name}: distributedBuilds.clientPublicKey must start with 'ssh-'";
-          }) (lib.filterAttrs (_: v: (v.distributedBuilds or { }) ? clientPublicKey) allDevices)
-          ++ lib.mapAttrsToList (name: v: {
-            assertion = builtins.match ".+:.+" v.distributedBuilds.storeSigningPublicKey != null;
-            message = "devices.${name}: distributedBuilds.storeSigningPublicKey must be in '<name>:<base64>' format";
-          }) (lib.filterAttrs (_: v: (v.distributedBuilds or { }) ? storeSigningPublicKey) allDevices);
-
-        nix.settings = {
-          fallback = true;
-          connect-timeout = 5;
-          trusted-public-keys = lib.pipe buildServerDevices [
-            (lib.mapAttrsToList (_: v: v.distributedBuilds.storeSigningPublicKey or null))
-            (builtins.filter (k: k != null))
-          ];
-          max-jobs = (thisDevice.distributedBuilds or { }).maxJobs or "auto";
-          cores = 0;
-          min-free = 10 * 1024 * 1024;
-          max-free = 200 * 1024 * 1024;
-        };
-        systemd.services.nix-daemon.serviceConfig = {
-          MemoryAccounting = true;
-          MemoryMax = "90%";
-          OOMScoreAdjust = 500;
-        };
-      }
-
-      # Server: accept incoming build connections
-      (lib.mkIf (thisDevice.distributedBuilds.isBuilder or false) {
-        users.users.${buildUser} = {
-          isSystemUser = true;
-          group = buildUser;
-          useDefaultShell = true;
-          openssh.authorizedKeys.keys = map (
-            k: ''command="nix daemon --stdio",restrict ${k}''
-          ) allClientPublicKeys;
-        };
-        users.groups.${buildUser} = { };
-        nix.settings = {
-          trusted-users = [ buildUser ];
-          secret-key-files = [ "/etc/nix/signing-key.sec" ];
-        };
-      })
-
-      # Client: connect to build servers for building and substitution
-      (lib.mkIf isClient {
-        programs.ssh = {
-          knownHosts = buildServerKnownHosts;
-          extraConfig = lib.concatStringsSep "\n" (
-            lib.mapAttrsToList (
-              name: v:
-              let
-                names = lib.unique [
-                  name
-                  (v.publicFqdn or name)
-                ];
-              in
-              ''
-                Match originalhost ${lib.concatStringsSep "," names} user ${buildUser}
-                  IdentityFile ${clientSshKeyPath}
-                  IdentitiesOnly yes
-              ''
-            ) buildServerDevices
-          );
-        };
-        nix = {
-          distributedBuilds = buildMachines != [ ];
-          buildMachines = buildMachines;
-          settings = {
-            builders-use-substitutes = true;
-            substituters = map (m: "ssh-ng://${buildUser}@${sshHostname m}") (
-              builtins.filter (m: m.distributedBuilds ? storeSigningPublicKey) remoteBuildServerDevices
-            );
-          };
-        };
-      })
-
-    ]
-  );
-}
diff --git a/nixosModules/en-de.nix b/nixosModules/en-de.nix
deleted file mode 100644
index 4a35b28f..00000000
--- a/nixosModules/en-de.nix
+++ /dev/null
@@ -1,40 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options.my.enDe.enable = lib.mkEnableOption "English/German locale and language packs";
-
-  config = lib.mkIf config.my.enDe.enable {
-    i18n = {
-      defaultLocale = "en_US.UTF-8";
-      extraLocales = [
-        "de_DE.UTF-8/UTF-8"
-      ];
-      extraLocaleSettings = {
-        LC_ADDRESS = "de_DE.UTF-8";
-        LC_IDENTIFICATION = "de_DE.UTF-8";
-        LC_MEASUREMENT = "de_DE.UTF-8";
-        LC_MONETARY = "de_DE.UTF-8";
-        LC_NAME = "de_DE.UTF-8";
-        LC_NUMERIC = "de_DE.UTF-8";
-        LC_PAPER = "de_DE.UTF-8";
-        LC_TELEPHONE = "de_DE.UTF-8";
-        LC_TIME = "de_DE.UTF-8";
-      };
-    };
-
-    programs.firefox.languagePacks = [
-      "en-US"
-      "de"
-    ];
-
-    environment.systemPackages = [
-      pkgs.hunspell
-      pkgs.hunspellDicts.de-de
-      pkgs.hunspellDicts.en-us
-    ];
-  };
-}
diff --git a/nixosModules/extra-caches.nix b/nixosModules/extra-caches.nix
deleted file mode 100644
index 6a727551..00000000
--- a/nixosModules/extra-caches.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{ lib, config, ... }:
-{
-  options.my.extraCaches.enable = lib.mkEnableOption "extra Nix binary caches";
-
-  config = lib.mkIf config.my.extraCaches.enable {
-    nix.settings = {
-      substituters = [
-        # keep-sorted start
-        "https://cache.lix.systems"
-        "https://cache.nixos.org/"
-        "https://niri.cachix.org"
-        "https://nix-community.cachix.org"
-        "https://nixos-raspberrypi.cachix.org"
-        # keep-sorted end
-      ];
-      trusted-public-keys = [
-        # keep-sorted start
-        "cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o="
-        "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
-        "niri.cachix.org-1:Wv0OmO7PsuocRKzfDoJ3mulSl7Z6oezYhGhR+3W2964="
-        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-        "nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI="
-        # keep-sorted end
-      ];
-    };
-  };
-}
diff --git a/nixosModules/firmware-updates.nix b/nixosModules/firmware-updates.nix
deleted file mode 100644
index 61b2ff83..00000000
--- a/nixosModules/firmware-updates.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-{ lib, config, ... }:
-{
-  options.my.firmwareUpdates.enable = lib.mkEnableOption "firmware updates and microcode";
-
-  config = lib.mkIf config.my.firmwareUpdates.enable {
-    hardware = {
-      enableRedistributableFirmware = true;
-      cpu = {
-        amd.updateMicrocode = true;
-        intel.updateMicrocode = true;
-      };
-    };
-
-    services.fwupd.enable = true;
-  };
-}
diff --git a/nixosModules/git.nix b/nixosModules/git.nix
deleted file mode 100644
index ffe5c785..00000000
--- a/nixosModules/git.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options.my.git.enable = lib.mkEnableOption "git with credential helper";
-
-  config = lib.mkIf config.my.git.enable {
-    environment.systemPackages = [ pkgs.git-credential-oauth ];
-
-    programs.git = {
-      enable = true;
-      config = {
-        init.defaultBranch = "main";
-        credential = {
-          helper = "oauth";
-          credentialStore = "cache";
-        };
-      };
-    };
-  };
-}
diff --git a/nixosModules/globalinstalls.nix b/nixosModules/globalinstalls.nix
deleted file mode 100644
index 6c914c7e..00000000
--- a/nixosModules/globalinstalls.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options.my.globalinstalls.enable = lib.mkEnableOption "global system packages and tools";
-
-  config = lib.mkIf config.my.globalinstalls.enable {
-    environment.systemPackages = with pkgs; [
-      ncdu
-      glances
-      lsof
-      dig
-      screen
-      tldr
-      nix-output-monitor
-    ];
-
-    programs = {
-      zsh.enable = true;
-      htop.enable = true;
-      iotop.enable = true;
-      nano = {
-        enable = true;
-        syntaxHighlight = true;
-      };
-    };
-  };
-}
diff --git a/nixosModules/gnome.nix b/nixosModules/gnome.nix
deleted file mode 100644
index fd195e89..00000000
--- a/nixosModules/gnome.nix
+++ /dev/null
@@ -1,65 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options.my.gnome = {
-    enable = lib.mkEnableOption "GNOME desktop environment";
-    keep-default-apps = lib.mkEnableOption "keep gnome default apps";
-  };
-
-  config = lib.mkIf config.my.gnome.enable (
-    lib.mkMerge [
-      {
-        services = {
-          xserver.excludePackages = [ pkgs.xterm ];
-
-          # Enable the GNOME Desktop Environment.
-          displayManager.gdm.enable = true;
-          desktopManager.gnome = {
-            enable = true;
-            extraGSettingsOverridePackages = [ pkgs.mutter ];
-            extraGSettingsOverrides = ''
-              [org.gnome.mutter]
-              experimental-features=['scale-monitor-framebuffer']
-            '';
-          };
-
-          gnome = {
-            tinysparql.enable = false;
-            localsearch.enable = false;
-            sushi.enable = true;
-          };
-        };
-
-        programs = {
-          dconf.enable = true;
-          gpaste.enable = true;
-        };
-      }
-      (lib.mkIf (!config.my.gnome.keep-default-apps) {
-        environment.gnome.excludePackages = with pkgs; [
-          cheese # photo booth
-          epiphany # web browser
-          evince # document viewer
-          geary # email client
-          gnome-maps
-          gnome-weather
-          gnome-tour
-          sysprof
-          orca # screen reader
-          gnome-weather
-          gnome-backgrounds
-          gnome-user-docs
-          yelp # help app
-          gnome-music
-          totem # video player
-          snapshot # camera
-          baobab # disk usage
-        ];
-      })
-    ]
-  );
-}
diff --git a/nixosModules/hetzner-vm.nix b/nixosModules/hetzner-vm.nix
deleted file mode 100644
index d59b4ad9..00000000
--- a/nixosModules/hetzner-vm.nix
+++ /dev/null
@@ -1,86 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-let
-  cfg = config.my.hetznerVm;
-in
-{
-  options.my.hetznerVm = {
-    enable = lib.mkEnableOption "Hetzner Cloud aarch64 qemu-guest defaults";
-
-    rootUuid = lib.mkOption {
-      type = lib.types.str;
-      description = "UUID of the root ext4 filesystem.";
-    };
-    bootUuid = lib.mkOption {
-      type = lib.types.str;
-      description = "UUID of the FAT /boot partition.";
-    };
-    swapUuid = lib.mkOption {
-      type = lib.types.str;
-      description = "UUID of the swap device.";
-    };
-    ipv6Address = lib.mkOption {
-      type = lib.types.str;
-      description = "Static IPv6 address (with /prefix) assigned to enp1s0.";
-      example = "2a01:4f8:c013:cbdd::1/64";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    boot = {
-      tmp.cleanOnBoot = true;
-      kernelParams = [ "console=tty" ];
-      loader = {
-        systemd-boot.enable = true;
-        efi.canTouchEfiVariables = true;
-      };
-      initrd = {
-        availableKernelModules = [
-          "xhci_pci"
-          "virtio_scsi"
-          "sr_mod"
-          "virtio_gpu"
-        ];
-        kernelModules = [ ];
-      };
-    };
-
-    fileSystems = {
-      "/" = {
-        device = "/dev/disk/by-uuid/${cfg.rootUuid}";
-        fsType = "ext4";
-      };
-      "/boot" = {
-        device = "/dev/disk/by-uuid/${cfg.bootUuid}";
-        fsType = "vfat";
-        options = [
-          "fmask=0077"
-          "dmask=0077"
-        ];
-      };
-    };
-
-    swapDevices = [
-      { device = "/dev/disk/by-uuid/${cfg.swapUuid}"; }
-    ];
-
-    networking.useNetworkd = true;
-    systemd.network = {
-      enable = true;
-      networks."10-wan" = {
-        matchConfig.Name = "enp1s0";
-        networkConfig.DHCP = "ipv4";
-        address = [ cfg.ipv6Address ];
-        routes = [
-          { Gateway = "fe80::1"; }
-        ];
-      };
-    };
-
-    services.tailscale.useRoutingFeatures = "both";
-    system.autoUpgrade.allowReboot = true;
-  };
-}
diff --git a/nixosModules/intel-graphics.nix b/nixosModules/intel-graphics.nix
deleted file mode 100644
index 619af5ad..00000000
--- a/nixosModules/intel-graphics.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options.my.intelGraphics.enable = lib.mkEnableOption "Intel graphics drivers";
-
-  config = lib.mkIf config.my.intelGraphics.enable {
-    hardware.graphics = {
-      extraPackages = with pkgs; [
-        intel-media-driver
-        intel-vaapi-driver
-        intel-ocl
-        intel-compute-runtime
-        vpl-gpu-rt
-      ];
-      extraPackages32 = with pkgs.driversi686Linux; [
-        intel-vaapi-driver
-        intel-media-driver
-      ];
-    };
-    environment.systemPackages = with pkgs; [ nvtopPackages.intel ];
-    my.allowedUnfreePackages = [ "intel-ocl" ];
-  };
-}
diff --git a/nixosModules/kdeconnect.nix b/nixosModules/kdeconnect.nix
deleted file mode 100644
index bc809c95..00000000
--- a/nixosModules/kdeconnect.nix
+++ /dev/null
@@ -1,57 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options.my.kdeconnect.enable = lib.mkEnableOption "KDE Connect / GSConnect";
-
-  config = lib.mkIf config.my.kdeconnect.enable (
-    lib.mkMerge [
-      {
-        networking.firewall =
-          let
-            kdeconnect-range = {
-              from = 1714;
-              to = 1764;
-            };
-          in
-          {
-            allowedTCPPortRanges = [ kdeconnect-range ];
-            allowedUDPPortRanges = [ kdeconnect-range ];
-          };
-
-        programs.kdeconnect.enable = true;
-        home-manager.sharedModules = [
-          {
-            services.kdeconnect = {
-              enable = true;
-              # this still shows up in gnome session starting with 25.05
-              # indicator = true;
-            };
-          }
-        ];
-      }
-
-      (lib.mkIf config.services.desktopManager.gnome.enable {
-        # replace kdeconnect with gsconnect
-        programs.kdeconnect.package = pkgs.gnomeExtensions.gsconnect;
-
-        home-manager.sharedModules = [
-          (
-            { pkgs, ... }:
-            {
-              home.packages = [ pkgs.gnomeExtensions.gsconnect ];
-              # enable gsconnect extension
-              dconf.settings = {
-                "org/gnome/shell".enabled-extensions = [ "gsconnect@andyholmes.github.io" ];
-                "org/gnome/shell/extensions/gsconnect".enabled = true;
-              };
-            }
-          )
-        ];
-      })
-    ]
-  );
-}
diff --git a/nixosModules/latex.nix b/nixosModules/latex.nix
deleted file mode 100644
index ce5483d8..00000000
--- a/nixosModules/latex.nix
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options.my.latex.enable = lib.mkEnableOption "LaTeX (texliveFull + TeXstudio)";
-
-  config = lib.mkIf config.my.latex.enable {
-    environment.systemPackages = with pkgs; [
-      fontconfig
-      texliveFull
-      texstudio
-    ];
-  };
-}
diff --git a/nixosModules/lix-is-nix.nix b/nixosModules/lix-is-nix.nix
deleted file mode 100644
index 2bb071e0..00000000
--- a/nixosModules/lix-is-nix.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options.my.lixIsNix.enable = lib.mkEnableOption "Lix as the Nix implementation";
-
-  config = lib.mkIf config.my.lixIsNix.enable {
-    nixpkgs.overlays = [
-      (_: prev: {
-        inherit (prev.lixPackageSets.stable)
-          nixpkgs-review
-          nix-eval-jobs
-          nix-fast-build
-          colmena
-          ;
-      })
-    ];
-
-    nix.package = pkgs.lixPackageSets.latest.lix;
-  };
-}
diff --git a/nixosModules/modern-desktop.nix b/nixosModules/modern-desktop.nix
deleted file mode 100644
index 7a10531a..00000000
--- a/nixosModules/modern-desktop.nix
+++ /dev/null
@@ -1,52 +0,0 @@
-{ lib, config, ... }:
-{
-  options.my.modernDesktop.enable = lib.mkEnableOption "modern desktop base (pipewire, flatpak, earlyoom)";
-
-  config = lib.mkIf config.my.modernDesktop.enable {
-    services = {
-      xserver.enable = true;
-      libinput.enable = true;
-      flatpak.enable = true;
-      fstrim.enable = true;
-      earlyoom = {
-        enable = true;
-        freeMemThreshold = 5;
-      };
-    };
-
-    # Enable sound with pipewire.
-    security.rtkit.enable = true;
-    services = {
-      pulseaudio.enable = false;
-      pipewire = {
-        enable = true;
-        alsa.enable = true;
-        alsa.support32Bit = true;
-        pulse.enable = true;
-        #jack.enable = true;
-      };
-    };
-
-    systemd = {
-      # save some boot time because nothing actually requires network connectivity
-      services.NetworkManager-wait-online.enable = false;
-
-      # prevent stuck units from preventing shutdown (default is 120s)
-      settings.Manager.DefaultTimeoutStopSec = "10s";
-    };
-
-    programs = {
-      xwayland.enable = true;
-
-      appimage = {
-        enable = true;
-        binfmt = true;
-      };
-    };
-
-    system.autoUpgrade = {
-      allowReboot = false;
-      operation = "boot";
-    };
-  };
-}
diff --git a/nixosModules/muede-desktop-settings.nix b/nixosModules/muede-desktop-settings.nix
deleted file mode 100644
index 980af137..00000000
--- a/nixosModules/muede-desktop-settings.nix
+++ /dev/null
@@ -1,33 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options.my.muedeDesktopSettings.enable = lib.mkEnableOption "muede desktop settings (Firefox, Logitech, RDP)";
-
-  config = lib.mkIf config.my.muedeDesktopSettings.enable {
-    my.overlays.niri.enable = true;
-    programs.niri.enable = true;
-
-    programs.firefox.enable = true;
-
-    environment.systemPackages = with pkgs; [
-      lm_sensors
-      libreoffice-qt6
-      usbutils
-    ];
-
-    fonts.enableDefaultPackages = true;
-
-    hardware.logitech.wireless = {
-      enable = true;
-      enableGraphical = true;
-    };
-
-    # RDP connections
-    services.gnome.gnome-remote-desktop.enable = true;
-    networking.firewall.allowedTCPPorts = [ 3389 ];
-  };
-}
diff --git a/nixosModules/nix-ld.nix b/nixosModules/nix-ld.nix
deleted file mode 100644
index ac7ae7b2..00000000
--- a/nixosModules/nix-ld.nix
+++ /dev/null
@@ -1,32 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options.my.nixLd.enable = lib.mkEnableOption "nix-ld for running unpatched dynamic binaries";
-
-  config = lib.mkIf config.my.nixLd.enable {
-    programs.nix-ld = {
-      enable = true;
-      libraries = with pkgs; [
-        stdenv.cc.cc
-        zlib
-        zstd
-        curl
-        openssl
-        attr
-        libssh
-        bzip2
-        libxml2
-        acl
-        libsodium
-        util-linux
-        xz
-        systemd
-        icu
-      ];
-    };
-  };
-}
diff --git a/nixosModules/nixpkgs-overlays.nix b/nixosModules/nixpkgs-overlays.nix
deleted file mode 100644
index 7a657b1a..00000000
--- a/nixosModules/nixpkgs-overlays.nix
+++ /dev/null
@@ -1,33 +0,0 @@
-{
-  lib,
-  config,
-  self,
-  ...
-}:
-{
-  options.my.overlays = {
-    enableAll = lib.mkEnableOption "all nixpkgs overlays";
-  }
-  // lib.mapAttrs (_: _: {
-    enable = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-    };
-  }) self.overlays;
-
-  config = lib.mkMerge (
-    [
-      {
-        my.overlays = lib.mapAttrs (_: _: {
-          enable = lib.mkDefault config.my.overlays.enableAll;
-        }) self.overlays;
-      }
-    ]
-    ++ lib.mapAttrsToList (
-      name: overlay:
-      lib.mkIf config.my.overlays.${name}.enable {
-        nixpkgs.overlays = [ overlay ];
-      }
-    ) self.overlays
-  );
-}
diff --git a/nixosModules/openssh.nix b/nixosModules/openssh.nix
deleted file mode 100644
index 92eb5f65..00000000
--- a/nixosModules/openssh.nix
+++ /dev/null
@@ -1,52 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  thisDevice,
-  ...
-}:
-{
-  options.my.openssh.enable = lib.mkEnableOption "OpenSSH server";
-
-  config = lib.mkIf config.my.openssh.enable {
-    services.openssh = {
-      enable = true;
-      openFirewall = true;
-      settings = {
-        PermitRootLogin = "prohibit-password";
-        PasswordAuthentication = false;
-        KbdInteractiveAuthentication = false;
-      };
-    };
-
-    # On desktops, hold a systemd sleep inhibitor while SSH connections are active
-    security.pam.services.sshd.rules.session.ssh-inhibit = lib.mkIf (thisDevice.isDesktop or false) {
-      order = 10000;
-      control = "optional";
-      modulePath = "${pkgs.pam}/lib/security/pam_exec.so";
-      args = [
-        "quiet"
-        "${pkgs.writeShellScript "ssh-inhibit-pam" ''
-          PIDFILE="/run/ssh-inhibitor-''${PPID}.pid"
-          case "''${PAM_TYPE:-}" in
-            open_session)
-              ${pkgs.systemd}/bin/systemd-inhibit \
-                --what=sleep \
-                --who=sshd \
-                --why="SSH session active" \
-                --mode=block \
-                sleep infinity &
-              echo $! > "$PIDFILE"
-              ;;
-            close_session)
-              if [ -f "$PIDFILE" ]; then
-                kill "$(cat "$PIDFILE")" 2>/dev/null || true
-                rm -f "$PIDFILE"
-              fi
-              ;;
-          esac
-        ''}"
-      ];
-    };
-  };
-}
diff --git a/nixosModules/podman.nix b/nixosModules/podman.nix
deleted file mode 100644
index b9622420..00000000
--- a/nixosModules/podman.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-{ lib, config, ... }:
-{
-  options.my.podman.enable = lib.mkEnableOption "Podman container runtime";
-
-  config = lib.mkIf config.my.podman.enable {
-    virtualisation = {
-      containers.enable = true;
-      podman = {
-        enable = true;
-        dockerCompat = true;
-        dockerSocket.enable = true;
-        autoPrune.enable = true;
-      };
-    };
-  };
-}
diff --git a/nixosModules/printing.nix b/nixosModules/printing.nix
deleted file mode 100644
index 48c41aed..00000000
--- a/nixosModules/printing.nix
+++ /dev/null
@@ -1,17 +0,0 @@
-{ lib, config, ... }:
-{
-  options.my.printing.enable = lib.mkEnableOption "printing (CUPS + Avahi)";
-
-  config = lib.mkIf config.my.printing.enable {
-    services = {
-      # Enable CUPS to print documents.
-      printing.enable = true;
-
-      avahi = {
-        enable = true; # runs the Avahi daemon
-        nssmdns4 = true; # enables the mDNS NSS plug-in
-        openFirewall = true; # opens the firewall for UDP port 5353
-      };
-    };
-  };
-}
diff --git a/nixosModules/prometheus-node.nix b/nixosModules/prometheus-node.nix
deleted file mode 100644
index f5e02fcd..00000000
--- a/nixosModules/prometheus-node.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{ lib, config, ... }:
-{
-  options.my.prometheusNode.enable = lib.mkEnableOption "Prometheus node exporter";
-
-  config = lib.mkIf config.my.prometheusNode.enable {
-    services.prometheus.exporters = {
-      node = {
-        enable = true;
-        openFirewall = true;
-        port = 9190;
-        enabledCollectors = [
-          # keep-sorted start
-          "cgroups"
-          "interrupts"
-          "softirqs"
-          "swap"
-          "systemd"
-          "tcpstat"
-          "wifi"
-          # keep-sorted end
-        ];
-      };
-    };
-  };
-}
diff --git a/nixosModules/pxvirt-guest.nix b/nixosModules/pxvirt-guest.nix
deleted file mode 100644
index a70266a5..00000000
--- a/nixosModules/pxvirt-guest.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-{
-  options.my.pxvirtGuest.enable = lib.mkEnableOption "Proxmox LXC guest configuration";
-
-  config = lib.mkIf config.my.pxvirtGuest.enable {
-    # Let Proxmox host handle fstrim
-    services.fstrim.enable = false;
-
-    # TODO is this needed
-    # Cache DNS lookups to improve performance
-    services.resolved.extraConfig = ''
-      Cache=true
-      CacheFromLocalhost=true
-    '';
-
-    boot.loader.systemd-boot.enable = lib.mkForce false;
-  };
-}
diff --git a/nixosModules/quiet-boot.nix b/nixosModules/quiet-boot.nix
deleted file mode 100644
index 84bae5fe..00000000
--- a/nixosModules/quiet-boot.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options.my.quietBoot.enable = lib.mkEnableOption "quiet boot with Plymouth splash";
-
-  config = lib.mkIf config.my.quietBoot.enable {
-    boot = {
-      kernelParams = [
-        "quiet"
-        "udev.log_level=3"
-        "udev.log_priority=3"
-        "rd.systemd.show_status=auto"
-      ];
-      consoleLogLevel = 0;
-      initrd = {
-        verbose = false;
-        systemd.enable = true; # required fpr graphical LUKS prompt
-      };
-      plymouth = {
-        enable = true;
-        theme = "catppuccin-mocha";
-        themePackages = [
-          (pkgs.catppuccin-plymouth.override {
-            variant = "mocha";
-          })
-        ];
-      };
-    };
-  };
-}
diff --git a/nixosModules/secure-boot.nix b/nixosModules/secure-boot.nix
deleted file mode 100644
index 948d1c48..00000000
--- a/nixosModules/secure-boot.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options.my.secureBoot.enable = lib.mkEnableOption "Secure Boot via lanzaboote";
-
-  config = lib.mkIf config.my.secureBoot.enable {
-    # https://github.com/nix-community/lanzaboote/blob/70be03ab23d0988224e152f5b52e2fbf44a6d8ee/docs/QUICK_START.md
-    # To enroll:
-    # 1. sudo sbctl create-keys
-    # 2. enable this module, rebuild
-    # 3. Put Secure Boot in Setup mode
-    # 4. sudo sbctl verify
-    # 5. sudo sbctl enroll-keys --microsoft
-    # 6, reboot
-    # 7. sudo sbctl status
-
-    environment.systemPackages = [
-      # For debugging and troubleshooting Secure Boot.
-      pkgs.sbctl
-    ];
-
-    # Lanzaboote currently replaces the systemd-boot module.
-    # This setting is usually set to true in configuration.nix
-    # generated at installation time. So we force it to false
-    # for now.
-    boot.loader.systemd-boot.enable = lib.mkForce false;
-
-    boot.lanzaboote = {
-      enable = true;
-      pkiBundle = "/var/lib/sbctl";
-    };
-  };
-}
diff --git a/nixosModules/steam.nix b/nixosModules/steam.nix
deleted file mode 100644
index 3a4f25a4..00000000
--- a/nixosModules/steam.nix
+++ /dev/null
@@ -1,50 +0,0 @@
-{ lib, config, ... }:
-{
-  options.my.steam.enable = lib.mkEnableOption "Steam gaming platform";
-
-  config = lib.mkIf config.my.steam.enable {
-    hardware.steam-hardware.enable = true;
-
-    programs = {
-      steam = {
-        enable = true;
-        remotePlay.openFirewall = true;
-        dedicatedServer.openFirewall = true;
-        localNetworkGameTransfers.openFirewall = true;
-        gamescopeSession.enable = false;
-      };
-      gamemode.enable = true;
-    };
-
-    # steam network transfer
-    networking.firewall = {
-      allowedUDPPorts = [ 3478 ];
-      allowedTCPPorts = [ 24070 ];
-
-      allowedTCPPortRanges = [
-        {
-          from = 27015;
-          to = 27050;
-        }
-      ];
-
-      allowedUDPPortRanges = [
-        {
-          from = 4379;
-          to = 4380;
-        }
-        {
-          from = 27000;
-          to = 27100;
-        }
-      ];
-    };
-
-    my.allowedUnfreePackages = [
-      "steam"
-      "steam-original"
-      "steam-run"
-      "steam-unwrapped"
-    ];
-  };
-}
diff --git a/nixosModules/stylix.nix b/nixosModules/stylix.nix
deleted file mode 100644
index 4b30dc74..00000000
--- a/nixosModules/stylix.nix
+++ /dev/null
@@ -1,95 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options.my.stylix.enable = lib.mkEnableOption "Stylix theming (Catppuccin Mocha)";
-
-  config = lib.mkIf config.my.stylix.enable {
-    stylix = {
-      enable = true;
-      base16Scheme = "${pkgs.base16-schemes}/share/themes/catppuccin-mocha.yaml";
-      override = {
-        scheme = "Catppuccin Mocha Pride";
-
-        base09 = "#6f9dff";
-        base0A = "#d162a4";
-        base0B = "#a8c9ff";
-        base0C = "#a30262";
-
-        # pink_light = "#d162a4";
-        # pink_dark = "#a30262";
-        # blue_light = "#5BCEFA";
-        # blue_dark = "#4a6bb1";
-
-        # original values
-        # base00: "#1e1e2e" # base -
-        # base01: "#181825" # mantle
-        # base02: "#313244" # surface0
-        # base03: "#45475a" # surface1
-        # base04: "#585b70" # surface2
-        # base05: "#cdd6f4" # text
-        # base06: "#f5e0dc" # rosewater
-        # base07: "#b4befe" # lavender
-        # base08: "#f38ba8" # red
-        # base09: "#fab387" # peach
-        # base0A: "#f9e2af" # yellow
-        # base0B: "#a6e3a1" # green
-        # base0C: "#94e2d5" # teal
-        # base0D: "#89b4fa" # blue
-        # base0E: "#cba6f7" # mauve
-        # base0F: "#f2cdcd" # flamingo
-
-        # https://github.com/chriskempson/base16/blob/main/styling.md
-        # base00 - Default Background
-        # base01 - Lighter Background (Used for status bars, line number and folding marks)
-        # base02 - Selection Background
-        # base03 - Comments, Invisibles, Line Highlighting
-        # base04 - Dark Foreground (Used for status bars)
-        # base05 - Default Foreground, Caret, Delimiters, Operators
-        # base06 - Light Foreground (Not often used)
-        # base07 - Light Background (Not often used)
-        # base08 - Variables, XML Tags, Markup Link Text, Markup Lists, Diff Deleted
-        # base09 - Integers, Boolean, Constants, XML Attributes, Markup Link Url
-        # base0A - Classes, Markup Bold, Search Text Background
-        # base0B - Strings, Inherited Class, Markup Code, Diff Inserted
-        # base0C - Support, Regular Expressions, Escape Characters, Markup Quotes
-        # base0D - Functions, Methods, Attribute IDs, Headings
-        # base0E - Keywords, Storage, Selector, Markup Italic, Diff Changed
-        # base0F - Deprecated, Opening/Closing Embedded Language Tags, e.g. <?php ?>
-      };
-      image = config.lib.stylix.pixel "base00";
-      polarity = "dark";
-      targets = {
-        gnome.enable = false;
-        gtk.enable = false;
-        gtksourceview.enable = false;
-        fontconfig.enable = true;
-        plymouth.enable = false;
-      };
-      fonts = {
-        sansSerif = {
-          name = "Inter Nerd Font";
-          package = pkgs.inter-nerdfont;
-        };
-        monospace = {
-          name = "FiraCode Nerd Font Mono";
-          package = pkgs.nerd-fonts.fira-code;
-        };
-      };
-      icons = {
-        enable = true;
-        dark = "Adwaita";
-        light = "Adwaita";
-        package = pkgs.adwaita-icon-theme;
-      };
-      cursor = {
-        name = "Adwaita";
-        size = 16;
-        package = pkgs.adwaita-icon-theme;
-      };
-    };
-  };
-}
diff --git a/nixosModules/systemd-boot.nix b/nixosModules/systemd-boot.nix
deleted file mode 100644
index e44f9dca..00000000
--- a/nixosModules/systemd-boot.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-{ lib, config, ... }:
-{
-  options.my.systemdBoot.enable = lib.mkEnableOption "systemd-boot bootloader";
-
-  config = lib.mkIf config.my.systemdBoot.enable {
-    boot.loader = {
-      timeout = 3;
-      efi.canTouchEfiVariables = true;
-      systemd-boot = {
-        enable = true;
-        editor = false; # do not allow changing kernel parameters
-        consoleMode = "max";
-      };
-    };
-  };
-}
diff --git a/nixosModules/tailscale.nix b/nixosModules/tailscale.nix
deleted file mode 100644
index 55295f93..00000000
--- a/nixosModules/tailscale.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ lib, config, ... }:
-{
-  options.my.tailscale.enable = lib.mkEnableOption "Tailscale VPN";
-
-  config = lib.mkIf config.my.tailscale.enable {
-    services.tailscale = {
-      enable = true;
-      openFirewall = true;
-    };
-
-    networking.firewall.checkReversePath = "loose";
-  };
-}
diff --git a/nixosModules/user-muede.nix b/nixosModules/user-muede.nix
deleted file mode 100644
index 078cb964..00000000
--- a/nixosModules/user-muede.nix
+++ /dev/null
@@ -1,46 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options.my.users.muede.enable = lib.mkEnableOption "muede user account";
-
-  config = lib.mkIf config.my.users.muede.enable {
-    users.users.muede = {
-      isNormalUser = true;
-      uid = 1000;
-      name = "muede";
-      description = "müde";
-      extraGroups = [
-        "networkmanager"
-        "wheel"
-        "games"
-        "dialout"
-        "podman"
-        "nginx"
-        "adbusers"
-        "kvm"
-        "input"
-        "video"
-      ];
-      shell = pkgs.zsh;
-      autoSubUidGidRange = true;
-    };
-
-    nix.settings.trusted-users = [ "muede" ];
-
-    my.allowedUnfreePackages = [
-      "rider"
-      "pycharm-professional"
-      "jetbrains-toolbox"
-
-      "anydesk"
-
-      "vscode-extension-ms-dotnettools-csharp"
-
-      "claude-code"
-    ];
-  };
-}
diff --git a/nixosModules/user-ronja.nix b/nixosModules/user-ronja.nix
deleted file mode 100644
index 46319eb5..00000000
--- a/nixosModules/user-ronja.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options.my.users.ronja.enable = lib.mkEnableOption "ronja user account";
-
-  config = lib.mkIf config.my.users.ronja.enable {
-    users.users.ronja = {
-      isNormalUser = true;
-      name = "ronja";
-      description = "Ronja";
-      home = "/home/ronja";
-      extraGroups = [
-        "networkmanager"
-        "wheel"
-        "games"
-        "podman"
-        "openvscode-server"
-      ];
-      shell = pkgs.zsh;
-    };
-
-    nix.settings.trusted-users = [ "ronja" ];
-  };
-}
diff --git a/nixosModules/wine-gaming.nix b/nixosModules/wine-gaming.nix
deleted file mode 100644
index 58b0099c..00000000
--- a/nixosModules/wine-gaming.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-{
-  options.my.wineGaming.enable = lib.mkEnableOption "Wine gaming (DXVK, MangoHud, xpadneo)";
-
-  config = lib.mkIf config.my.wineGaming.enable {
-    hardware = {
-      graphics = {
-        enable32Bit = true;
-        extraPackages = with pkgs; [ mangohud ];
-        extraPackages32 = with pkgs; [ mangohud ];
-      };
-
-      xpadneo.enable = true;
-    };
-
-    environment.systemPackages = with pkgs; [
-      wineWowPackages.stagingFull
-      wineWowPackages.fonts
-      winetricks
-      dxvk
-      mangohud
-      vulkan-tools
-      mesa-demos
-    ];
-  };
-}
diff --git a/scripts/forge-create-token.sh b/scripts/forge-create-token.sh
new file mode 100755
index 00000000..4e46a8db
--- /dev/null
+++ b/scripts/forge-create-token.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Mint a Forgejo access token for an existing user.
+#
+# Usage: forge-create-token.sh <username> [--name <label>] [--scopes <csv>]
+#
+# Defaults:
+#   --name   = local-<timestamp>
+#   --scopes = all
+#
+# Prints the token to stdout — feed it to `forge-login.sh` or paste
+# into tea / .netrc. Forgejo only shows the token once, so capture it.
+set -euo pipefail
+
+if [ $# -lt 1 ]; then
+  echo "usage: $0 <username> [--name <label>] [--scopes <csv>]" >&2
+  exit 2
+fi
+
+username="$1"; shift
+name="local-$(date +%s)"
+scopes="all"
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --name)   name="$2"; shift 2 ;;
+    --scopes) scopes="$2"; shift 2 ;;
+    *) echo "unknown arg: $1" >&2; exit 2 ;;
+  esac
+done
+
+sudo nixos-container run hive-forge -- runuser -u forgejo -- \
+  forgejo --work-path /var/lib/forgejo admin user generate-access-token \
+    --username "$username" \
+    --token-name "$name" \
+    --scopes "$scopes"
diff --git a/scripts/forge-create-user.sh b/scripts/forge-create-user.sh
new file mode 100755
index 00000000..827f6fad
--- /dev/null
+++ b/scripts/forge-create-user.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Create a Forgejo user in the hive-forge container.
+#
+# Usage: forge-create-user.sh <username> [--admin] [--email <addr>] [--password <pw>]
+#
+# Defaults: --random-password, --must-change-password=false, email = <user>@hive.local.
+# Requires: sudo, the hive-forge nixos-container running.
+set -euo pipefail
+
+if [ $# -lt 1 ]; then
+  echo "usage: $0 <username> [--admin] [--email <addr>] [--password <pw>]" >&2
+  exit 2
+fi
+
+username="$1"; shift
+email="${username}@hive.local"
+admin=()
+password_args=(--random-password)
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --admin)    admin=(--admin); shift ;;
+    --email)    email="$2"; shift 2 ;;
+    --password) password_args=(--password "$2"); shift 2 ;;
+    *) echo "unknown arg: $1" >&2; exit 2 ;;
+  esac
+done
+
+sudo nixos-container run hive-forge -- runuser -u forgejo -- \
+  forgejo --work-path /var/lib/forgejo admin user create \
+    --username "$username" \
+    --email "$email" \
+    --must-change-password=false \
+    "${password_args[@]}" \
+    "${admin[@]}"
diff --git a/scripts/forge-login.sh b/scripts/forge-login.sh
new file mode 100755
index 00000000..9c603036
--- /dev/null
+++ b/scripts/forge-login.sh
@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+# Configure the current shell user's git + tea for the hive-forge.
+#
+# Sets:
+#   - git config --global user.name / user.email
+#   - tea login (if `tea` is on PATH)
+#   - ~/.netrc entry so `git clone http://...` works without prompting
+#
+# Usage: forge-login.sh <username> [--email <addr>] [--url <forge-url>]
+#
+# Prompts for an access token on stdin (paste-and-enter). Generate
+# one first with `forge-create-token.sh <username>` or in the web UI
+# under Settings → Applications → Generate New Token.
+set -euo pipefail
+
+if [ $# -lt 1 ]; then
+  echo "usage: $0 <username> [--email <addr>] [--url <forge-url>]" >&2
+  exit 2
+fi
+
+username="$1"; shift
+email="${username}@hive.local"
+forge_url="http://localhost:3000"
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --email) email="$2"; shift 2 ;;
+    --url)   forge_url="$2"; shift 2 ;;
+    *) echo "unknown arg: $1" >&2; exit 2 ;;
+  esac
+done
+
+# Extract host:port for netrc.
+host=$(printf '%s' "$forge_url" | sed -E 's|^https?://||; s|/.*$||; s|:.*$||')
+
+read -r -s -p "forgejo access token for $username (input hidden): " token
+echo
+if [ -z "$token" ]; then
+  echo "no token entered; aborting" >&2
+  exit 1
+fi
+
+if git config --global user.name "$username" 2>/dev/null \
+  && git config --global user.email "$email" 2>/dev/null; then
+  echo "git config: $username <$email>"
+else
+  cat <<EOF
+git config: --global write failed (read-only ~/.config/git/config?
+  home-manager / nix-managed setup). add this to your home-manager:
+
+  programs.git = {
+    enable = true;
+    userName = "$username";
+    userEmail = "$email";
+  };
+EOF
+fi
+
+# netrc entry — git uses this for HTTP basic auth. 0600 because it
+# contains the plaintext token.
+netrc="$HOME/.netrc"
+touch "$netrc"
+chmod 600 "$netrc"
+if grep -q "^machine $host" "$netrc" 2>/dev/null; then
+  # Remove the old block (machine line + the two following lines).
+  sed -i.bak "/^machine $host\$/,+2d" "$netrc"
+fi
+cat >>"$netrc" <<EOF
+machine $host
+login $username
+password $token
+EOF
+echo "netrc: wrote $host entry"
+
+if command -v tea >/dev/null 2>&1; then
+  mkdir -p "$HOME/.config/tea"
+  # tea refuses to add a login with a name that already exists; drop
+  # it first so re-running this script is idempotent.
+  tea login delete forge 2>/dev/null || true
+  tea login add --name forge --url "$forge_url" --token "$token"
+  echo "tea: configured 'forge' login"
+else
+  echo "tea: not on PATH — install pkgs.tea if you want the CLI"
+fi
diff --git a/scripts/forge-migrate.sh b/scripts/forge-migrate.sh
new file mode 100755
index 00000000..bbdc5baf
--- /dev/null
+++ b/scripts/forge-migrate.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# Run pending Forgejo DB migrations + restart the daemon.
+#
+# Use after upgrading the forgejo package, or when a CLI command
+# errors with "table X has no column named Y" (schema lag).
+set -euo pipefail
+
+sudo nixos-container run hive-forge -- runuser -u forgejo -- \
+  forgejo --work-path /var/lib/forgejo migrate
+
+sudo nixos-container run hive-forge -- systemctl restart forgejo
+echo "forge: migrated + restarted"