todoing

Added new tasks for user experience and settings rework.

.dockerignore

@@ -5,6 +5,7 @@
 .git
 .gitignore
 **/node_modules
+webui/.cache/mediamtx/
 # Neither the legacy state directory nor the Compose-mounted replacement may
 # enter an image build. This prevents credentials and backups from becoming
 # image layers after an operator has started using either deployment layout.

.github/workflows/container-image.yaml

@@ -58,6 +58,8 @@ jobs:
       # replaced on each successful push, just as main replaces `latest`.
       - name: Build and optionally publish
         uses: docker/build-push-action@v7
+        env:
+          DOCKER_BUILD_RECORD_RETENTION_DAYS: 3
         with:
           context: .
           platforms: linux/amd64

.gitignore

@@ -5,6 +5,7 @@ create_2_Open_Interface_Spec.txt
 
 logs
 node_modules/
+webui/.cache/mediamtx/
 __pycache__/
 *.py[cod]
 .pio
@@ -41,3 +42,4 @@ server/data/fleet-reports.sqlite-wal
 server/data/configuration.sqlite
 server/data/configuration.sqlite-shm
 server/data/configuration.sqlite-wal
+AGENTS.md

Dockerfile

@@ -9,15 +9,21 @@
 ARG FEDORA_VERSION=43
 
 FROM fedora:${FEDORA_VERSION} AS architecture-check
+ARG FEDORA_VERSION
 ARG TARGETARCH
 # The central server is currently deployed and verified only on amd64. Failing
 # here avoids publishing an ARM image whose native workers and hardware paths
 # have never been exercised on a real ARM server.
 RUN test "${TARGETARCH}" = "amd64" || (echo "MultiRover server images support only linux/amd64." >&2; exit 1)
 
-FROM architecture-check AS webui-build
-RUN dnf install -y --setopt=install_weak_deps=False nodejs npm \
-    && dnf clean all
+# Both Node builders reuse the same installed toolchain layer.
+# Fedora 43 uses DNF5. Cache metadata and RPMs outside image layers, and keep
+# downloads after installation so invalidated layers can reuse them.
+FROM architecture-check AS node-build-base
+RUN --mount=type=cache,id=dnf-${FEDORA_VERSION}-node-build-base,target=/var/cache/libdnf5,sharing=locked \
+    dnf install -y --setopt=install_weak_deps=False --setopt=keepcache=True nodejs npm
+
+FROM node-build-base AS webui-build
 WORKDIR /build
 # Copy dependency manifests first so ordinary source edits retain the expensive
 # npm cache layer. npm ci makes the checked-in lockfile the exact dependency
@@ -25,14 +31,17 @@ WORKDIR /build
 COPY webui/package.json webui/package-lock.json ./webui/
 RUN --mount=type=cache,target=/root/.npm \
     cd webui && npm ci
+# Keep the pinned browser publisher in a reusable layer across UI source edits.
+COPY webui/scripts/prepareMediaMtx.js ./webui/scripts/prepareMediaMtx.js
+RUN cd webui && node scripts/prepareMediaMtx.js
 COPY webui ./webui
 # Vite deliberately emits into ../server/public. Create that destination in the
 # isolated builder and copy only its finished files into the runtime stage.
 RUN mkdir -p server/public && cd webui && npm run build
 
-FROM architecture-check AS server-dependencies
-RUN dnf install -y --setopt=install_weak_deps=False nodejs npm gcc-c++ make python3 \
-    && dnf clean all
+FROM node-build-base AS server-dependencies
+RUN --mount=type=cache,id=dnf-${FEDORA_VERSION}-server-dependencies,target=/var/cache/libdnf5,sharing=locked \
+    dnf install -y --setopt=install_weak_deps=False --setopt=keepcache=True gcc-c++ make python3
 WORKDIR /build/server
 COPY server/package.json server/package-lock.json ./
 # Native Node modules compile here when a matching prebuild is unavailable;
@@ -41,7 +50,8 @@ RUN --mount=type=cache,target=/root/.npm \
     npm ci --omit=dev
 
 FROM architecture-check AS native-workers
-RUN dnf install -y --setopt=install_weak_deps=False \
+RUN --mount=type=cache,id=dnf-${FEDORA_VERSION}-native-workers,target=/var/cache/libdnf5,sharing=locked \
+    dnf install -y --setopt=install_weak_deps=False --setopt=keepcache=True \
       bluez-libs-devel \
       gcc-c++ \
       libcap \
@@ -49,8 +59,7 @@ RUN dnf install -y --setopt=install_weak_deps=False \
       libusb1-devel \
       make \
       pkgconf-pkg-config \
-      wiiuse-devel \
-    && dnf clean all
+      wiiuse-devel
 WORKDIR /build
 COPY server/src/services/kinectService/native ./kinect
 COPY server/src/services/balanceBoardService/native ./balance-board
@@ -66,8 +75,8 @@ ARG NEOLINK_VERSION=0.6.2
 ARG NEOLINK_SHA256=0cb963b44dca7ccc5333154092186e1536c687aef0e1ad119b7f310a7471dbbb
 ARG GOOGLE_TTS_VERSION=26.5
 ARG GOOGLE_TTS_SHA256=6a9eae6726871788da52e767dad964a1c83e7feb7e7dbac508a2574a2345ac24
-RUN dnf install -y --setopt=install_weak_deps=False curl findutils tar unzip xz \
-    && dnf clean all
+RUN --mount=type=cache,id=dnf-${FEDORA_VERSION}-packaged-tools,target=/var/cache/libdnf5,sharing=locked \
+    dnf install -y --setopt=install_weak_deps=False --setopt=keepcache=True curl findutils tar unzip xz
 WORKDIR /build/tools
 # Each external artifact is pinned and checked before extraction. A changed or
 # truncated upstream download therefore fails the image build instead of being
@@ -97,6 +106,16 @@ RUN curl --fail --location --retry 3 \
     && find /output/opt/roverd/googletts -type d -exec chmod 0755 {} + \
     && find /output/opt/roverd/googletts -type f -exec chmod 0644 {} +
 
+FROM architecture-check AS learning-dependencies
+# CPU-only learning dependencies are built once. Disabled installations never
+# launch Python or install packages as a side effect of starting Node.
+RUN --mount=type=cache,id=dnf-${FEDORA_VERSION}-learning-dependencies,target=/var/cache/libdnf5,sharing=locked \
+    dnf install -y --setopt=install_weak_deps=False --setopt=keepcache=True python3 python3-pip
+COPY server/src/services/roverLearningService/workers/requirements.txt /tmp/learning-requirements.txt
+RUN --mount=type=cache,target=/root/.cache/pip \
+    python3 -m venv /opt/rover-learning \
+    && /opt/rover-learning/bin/pip install -r /tmp/learning-requirements.txt
+
 FROM fedora:${FEDORA_VERSION} AS runtime
 ARG FEDORA_VERSION
 ARG TARGETARCH
@@ -105,14 +124,16 @@ RUN test "${TARGETARCH}" = "amd64" || (echo "MultiRover server images support on
 # replay output path. Enable RPM Fusion Free before installing runtime packages
 # so the image receives the complete FFmpeg build instead of requiring replay
 # code to work around a deployment-only codec omission.
-RUN dnf install -y --setopt=install_weak_deps=False \
+RUN --mount=type=cache,id=dnf-${FEDORA_VERSION}-runtime,target=/var/cache/libdnf5,sharing=locked \
+    dnf install -y --setopt=install_weak_deps=False --setopt=keepcache=True \
       "https://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-${FEDORA_VERSION}.noarch.rpm"
 # This is the complete runtime package set. Build headers and compilers live in
 # earlier stages, while media, TTS, USB, and Bluetooth libraries remain here
 # because enabled services invoke them after startup. Weak dependencies are
 # deliberately disabled: Fedora otherwise installs desktop portals, graphical
 # themes, and GPU drivers that a headless server neither starts nor uses.
-RUN dnf install -y --setopt=install_weak_deps=False \
+RUN --mount=type=cache,id=dnf-${FEDORA_VERSION}-runtime,target=/var/cache/libdnf5,sharing=locked \
+    dnf install -y --setopt=install_weak_deps=False --setopt=keepcache=True \
       bluez \
       bluez-libs \
       espeak \
@@ -134,20 +155,15 @@ RUN dnf install -y --setopt=install_weak_deps=False \
       tini \
       wiiuse \
     --allowerasing \
-    && dnf clean all \
     && useradd --uid 1000 --create-home --home-dir /home/multirover --shell /sbin/nologin multirover \
     && install -d -o multirover -g multirover -m 0755 /data /opt/multirover/server
 
 WORKDIR /opt/multirover/server
-COPY server/index.js server/package.json server/package-lock.json ./
-COPY server/src ./src
-COPY server/assets ./assets
-COPY server/prompts ./prompts
 COPY --from=server-dependencies /build/server/node_modules ./node_modules
-COPY --from=webui-build /build/server/public ./public
 COPY --from=native-workers /build/kinect/kinect_worker ./src/services/kinectService/native/kinect_worker
 COPY --from=native-workers /build/balance-board/balance_board_worker ./src/services/balanceBoardService/native/balance_board_worker
 COPY --from=packaged-tools /output/ /
+COPY --from=learning-dependencies /opt/rover-learning /opt/rover-learning
 COPY --chmod=0755 server/bin/chromegtts-wav.py /usr/local/bin/chromegtts-wav
 COPY --chmod=0755 server/mediamtx/rover-snapshot-writer.sh /usr/local/bin/rover-snapshot-writer.sh
 
@@ -166,6 +182,14 @@ RUN setcap cap_net_admin,cap_net_bind_service+ep \
     && test -s /tmp/chromegtts-smoke.wav \
     && rm /tmp/chromegtts-smoke.wav
 
+# Frequently edited application files come after dependencies and tool checks,
+# so server changes do not invalidate the large runtime dependency layers.
+COPY --from=webui-build /build/server/public ./public
+COPY server/index.js server/package.json server/package-lock.json ./
+COPY server/src ./src
+COPY server/assets ./assets
+COPY server/prompts ./prompts
+
 ENV NODE_ENV=production \
     SERVER_DATA_DIR=/data \
     ROVER_SNAPSHOT_WRITER_BIN=/usr/local/bin/rover-snapshot-writer.sh

compose.yaml

@@ -23,9 +23,13 @@ services:
       # Required for Bluetooth hardware such as the Balance Board.
       - /run/dbus/system_bus_socket:/run/dbus/system_bus_socket:ro
 
-    # Required for Kinect USB access.
+    # Kinect USB access.
     devices:
       - /dev/bus/usb:/dev/bus/usb
+      # For a server-local microphone, uncomment this device and group_add below.
+      # - /dev/snd:/dev/snd
+    # group_add:
+    #   - "${AUDIO_GID:?Set AUDIO_GID to the host sound device group ID}"
 
     cap_add:
       - NET_ADMIN

docs/server-admin-container-migration.md

@@ -26,6 +26,8 @@ Phase 1 must be complete and verified before Phase 2 begins. Containerization mu
 
 ## Decision log
 
+- 2026-10-02: The admin container controls accept a tag within the repository supplied by Compose through `MULTIROVER_TARGET_IMAGE`. A successful healthy replacement saves the tag in the lifecycle status volume; failed replacements retain the previous selection. Checks and later updates follow that saved tag. Changing repositories in Compose resets the selection. Manual Compose deployments still use the Compose image and can replace a UI-selected image; the UI displays both references. The lifecycle helper itself is updated through Compose. Image rollback does not revert application data migrations. Deploy this feature to both the application and lifecycle services before using tag selection.
+
 - 2026-09-14: Publish `ghcr.io/legop3/multiroombarover:latest` only from the repository's main branch. Every other repository branch publishes one moving development image named for that branch, with invalid tag separators normalized; these are development selectors rather than numbered releases. Pull requests only verify that the image builds. There are no release numbers, semantic-version tags, stable/edge channels, or operator-facing version selection. Docker image digests remain an internal mechanism for detecting an available update and retaining the previously running image for rollback.
 - 2026-09-15: Support only `linux/amd64` for the central server image. Rover computers remain independently ARM-capable, but publishing an untested ARM server image would multiply native-worker, media-binary, TTS-library, and hardware validation without serving the current deployment. ARM server support can be added later when a real ARM server exists to verify it.
 - 2026-09-15: Mount the application data directory from the Docker-managed `multirover-data` named volume instead of a host bind path. Docker initializes the empty volume with the image's non-root ownership, eliminating host UID matching, directory creation, ownership commands, and root application startup. The admin backup/restore system is the supported portable interface to the complete data tree.

docs/spectator-bot.md

@@ -64,6 +64,7 @@ socket.on('connect', async () => {
 // previously stored session with this object instead of merging snapshots.
 socket.on('session:sync', (session) => {
   console.log('Session:', session);
+  console.log('Server mode:', session.mode);
 });
 
 // chat:init contains the recent chat history available when the bot connects.
@@ -105,6 +106,21 @@ Run it with:
 node bot.js
 ```
 
+## Reading server mode
+
+Read `session.mode` from the `session:sync` snapshot to get the current server
+mode. Its possible values are `open`, `turns`, `admin`, and `lockdown`.
+
+The server sends a fresh session snapshot whenever the mode changes, so the
+example's handler receives both the initial mode and subsequent updates. No
+polling or separate mode listener is needed. If your bot stores session data for
+its chat-handling logic, replace the stored session on every `session:sync` and
+read the mode from that latest snapshot.
+
+`session.mode` is the server-wide mode; `session.role` is this connection's role
+(such as `spectator`), and `session.operatingMode` is a separate connection field.
+Use `session.mode` when answering chat questions about the server's current mode.
+
 ## Events used
 
 - `nickname:set` sets the bot's visible nickname.

perf/act-benchmark.py

@@ -0,0 +1,209 @@
+#!/usr/bin/env python3
+"""Finite CPU benchmark of LeRobot ACT with ImageNet-pretrained ResNet-18.
+
+First run: python3 perf/act-benchmark.py --setup
+Repeat:    python3 perf/act-benchmark.py
+Quick:     python3 perf/act-benchmark.py --threads 4 --seconds 2 --iterations 2 --batch-size 2
+
+Python >=3.12, Linux. Setup uses a private cached environment. Only the visual
+backbone is pretrained; the action policy is randomly initialized. Synthetic
+in-memory inputs measure compute, NOT learning quality or driving competence.
+No rover connections, server changes, training checkpoints, or background jobs.
+"""
+import argparse
+import contextlib
+import importlib.metadata
+import json
+import math
+import os
+from pathlib import Path
+import platform
+import resource
+import statistics
+import subprocess
+import sys
+import tempfile
+import time
+import venv
+
+REVISION = '146d8474932c8b566717eb2738ba459337ab71c4'
+
+
+def positive(value):
+    number = int(value)
+    if number < 1:
+        raise argparse.ArgumentTypeError('Must be positive')
+    return number
+
+
+def arguments():
+    parser = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    parser.add_argument('--setup', action='store_true')
+    parser.add_argument('--cache', type=Path, default=Path.home() / '.cache/rover-act-benchmark')
+    parser.add_argument('--threads', nargs='+', type=positive, default=[4, 8, 16])
+    parser.add_argument('--seconds', type=positive, default=10)
+    parser.add_argument('--iterations', type=positive, default=10)
+    parser.add_argument('--batch-size', type=positive, default=8, help='Training only; inference batch is always one rover')
+    parser.add_argument('--chunk-size', type=positive, default=10, help='Future command steps per prediction, not observed history')
+    parser.add_argument('--width', type=positive, default=160)
+    parser.add_argument('--height', type=positive, default=120)
+    parser.add_argument('--sensors', type=positive, default=30)
+    parser.add_argument('--mode', choices=['both', 'inference', 'training'], default='both')
+    parser.add_argument('--timeout', type=positive, default=900, help='Hard per-case wall time limit in seconds')
+    parser.add_argument('--worker', action='store_true', help=argparse.SUPPRESS)
+    parser.add_argument('--result', type=Path, help=argparse.SUPPRESS)
+    return parser.parse_args()
+
+
+def setup(args):
+    python = args.cache / 'venv/bin/python'
+    if not python.exists():
+        venv.EnvBuilder(with_pip=True).create(args.cache / 'venv')
+    subprocess.run([str(python), '-m', 'pip', 'install', '--no-compile', 'torch', 'torchvision',
+                    '--index-url', 'https://download.pytorch.org/whl/cpu'], check=True)
+    # Install only ACT's import dependencies: the full robotics/dataset stack has
+    # unrelated version constraints and is not exercised by this benchmark.
+    subprocess.run([str(python), '-m', 'pip', 'install', '--no-compile', 'numpy', 'einops>=0.8,<0.9',
+                    'draccus>=0.11.6,<0.12', 'huggingface-hub>=1.6,<2', 'safetensors',
+                    'packaging', 'termcolor', 'tqdm', 'gymnasium'], check=True)
+    subprocess.run([str(python), '-m', 'pip', 'install', '--no-compile', '--no-deps',
+                    f'https://github.com/huggingface/lerobot/archive/{REVISION}.zip'], check=True)
+    (args.cache / 'source-revision').write_text(REVISION)
+
+
+def worker(args):
+    import torch
+    from lerobot.configs import FeatureType, PolicyFeature
+    from lerobot.policies.act.configuration_act import ACTConfig
+    from lerobot.policies.act.modeling_act import ACTPolicy
+
+    torch.set_num_threads(args.threads[0])
+    torch.set_num_interop_threads(1)
+    torch.manual_seed(7)
+    training = args.mode == 'training'
+    batch_size = args.batch_size if training else 1
+    config = ACTConfig(device='cpu', chunk_size=args.chunk_size, n_action_steps=1,
+        input_features={
+            'observation.images.front': PolicyFeature(type=FeatureType.VISUAL, shape=(3, args.height, args.width)),
+            'observation.state': PolicyFeature(type=FeatureType.STATE, shape=(args.sensors,)),
+        }, output_features={'action': PolicyFeature(type=FeatureType.ACTION, shape=(2,))})
+    policy = ACTPolicy(config).cpu().float()
+    policy.train(training)
+    optimizer_config = config.get_optimizer_preset()
+    optimizer = optimizer_config.build(policy.get_optim_params()) if training else None
+    # Already-normalized tensors stand in for a decoded observation and target
+    # sequence. Avoid video/dataset overhead in this compute-only measurement.
+    images = torch.rand(batch_size, 3, args.height, args.width)
+    mean = torch.tensor([.485, .456, .406]).view(1, 3, 1, 1)
+    std = torch.tensor([.229, .224, .225]).view(1, 3, 1, 1)
+    batch = {'observation.images.front': (images - mean) / std,
+             'observation.state': torch.randn(batch_size, args.sensors)}
+    if training:
+        batch['action'] = torch.rand(batch_size, args.chunk_size, 2) * 2 - 1
+        batch['action_is_pad'] = torch.zeros(batch_size, args.chunk_size, dtype=torch.bool)
+
+    def step():
+        if training:
+            optimizer.zero_grad(set_to_none=True)
+            loss, _ = policy(batch)
+            if not torch.isfinite(loss):
+                raise RuntimeError('Non-finite training loss')
+            loss.backward()
+            norm = torch.nn.utils.clip_grad_norm_(policy.parameters(), optimizer_config.grad_clip_norm,
+                                                   error_if_nonfinite=True)
+            optimizer.step()
+            return {'loss': loss.item(), 'gradientNorm': norm.item()}
+        # select_action can serve cached actions; directly time a full chunk.
+        prediction = policy.predict_action_chunk(batch)
+        if prediction.shape != (1, args.chunk_size, 2) or not torch.isfinite(prediction).all():
+            raise RuntimeError('Invalid action output')
+        return {'outputShape': list(prediction.shape)}
+
+    with (contextlib.nullcontext() if training else torch.inference_mode()):
+        for _ in range(3):
+            step()
+        timings = []
+        started, cpu_started = time.perf_counter(), time.process_time()
+        while len(timings) < args.iterations or time.perf_counter() - started < args.seconds:
+            tick = time.perf_counter()
+            last = step()
+            timings.append((time.perf_counter() - tick) * 1000)
+        elapsed, cpu = time.perf_counter() - started, time.process_time() - cpu_started
+    timings.sort()
+    result = dict(mode=args.mode, threads=args.threads[0], batchSize=batch_size,
+        iterations=len(timings), elapsedSeconds=elapsed, p50Ms=statistics.median(timings),
+        p95Ms=timings[math.ceil(.95*len(timings))-1], maxMs=max(timings),
+        stepsPerSecond=len(timings)/elapsed, examplesPerSecond=len(timings)*batch_size/elapsed,
+        cpuCores=cpu/elapsed, peakMiB=resource.getrusage(resource.RUSAGE_SELF).ru_maxrss/1024,
+        parameters=sum(p.numel() for p in policy.parameters()),
+        trainableParameters=sum(p.numel() for p in policy.parameters() if p.requires_grad),
+        lastStep=last, config={
+            'chunkSize': config.chunk_size, 'dimModel': config.dim_model, 'klWeight': config.kl_weight,
+            'pretrainedBackbone': config.pretrained_backbone_weights, 'useVae': config.use_vae,
+            'encoderLayers': config.n_encoder_layers, 'decoderLayers': config.n_decoder_layers,
+            'feedforwardDimension': config.dim_feedforward, 'observationSteps': config.n_obs_steps,
+            'learningRate': optimizer_config.lr, 'backboneLearningRate': config.optimizer_lr_backbone},
+        versions={key: importlib.metadata.version(key) for key in ['torch','torchvision','lerobot','numpy','einops','draccus']})
+    args.result.write_text(json.dumps(result))
+
+
+def main():
+    args = arguments()
+    if sys.version_info < (3, 12):
+        raise RuntimeError('Use Python 3.12 or newer')
+    args.cache = args.cache.expanduser().resolve()
+    os.environ['TORCH_HOME'] = str(args.cache / 'torch')
+    if args.worker:
+        worker(args)
+        return
+    if args.setup:
+        setup(args)
+    python = args.cache / 'venv/bin/python'
+    marker = args.cache / 'source-revision'
+    if not python.exists() or not marker.exists() or marker.read_text() != REVISION:
+        raise RuntimeError('Run python3 perf/act-benchmark.py --setup first')
+    print('CPU FP32 ACT: pretrained visual backbone, untrained action policy; synthetic data.', flush=True)
+    print(f'One {args.width}x{args.height} image + {args.sensors} sensors; {args.chunk_size} future left/right command pairs.', flush=True)
+    print('Inference times a fresh full prediction. Training includes backbone gradients and optimizer update.', flush=True)
+    print('mode       threads batch p50 ms p95 ms max ms steps/s examples/s CPU cores peak MiB', flush=True)
+    modes = ['inference', 'training'] if args.mode == 'both' else [args.mode]
+    results, failures = [], []
+    initial_load = os.getloadavg()
+    with tempfile.TemporaryDirectory(prefix='act-benchmark-') as directory:
+        for mode in modes:
+            for threads in args.threads:
+                result_path = Path(directory) / 'result.json'
+                command = [str(python), str(Path(__file__).resolve()), '--worker', '--cache', str(args.cache),
+                    '--mode', mode, '--threads', str(threads), '--result', str(result_path)]
+                for option in ['seconds','iterations','batch_size','chunk_size','width','height','sensors']:
+                    command += ['--'+option.replace('_','-'), str(getattr(args, option))]
+                try:
+                    subprocess.run(command, check=True, timeout=args.timeout,
+                                   env={**os.environ, 'PYTHONDONTWRITEBYTECODE':'1'})
+                    r = json.loads(result_path.read_text())
+                except (subprocess.CalledProcessError, subprocess.TimeoutExpired) as error:
+                    failures.append(dict(mode=mode, threads=threads, error=str(error)))
+                    print(f'Case failed: {mode}, {threads} threads: {error}', flush=True)
+                    break  # Avoid repeating the same setup/import/OOM error.
+                results.append(r)
+                print(f"{mode:10} {threads:7} {r['batchSize']:5} {r['p50Ms']:6.1f} {r['p95Ms']:6.1f} {r['maxMs']:6.1f} {r['stepsPerSecond']:7.2f} {r['examplesPerSecond']:10.2f} {r['cpuCores']:9.2f} {r['peakMiB']:8.0f}", flush=True)
+            if failures:
+                break
+    report = dict(benchmark='act-cpu-v1', sourceRevision=REVISION, platform=platform.platform(),
+        python=sys.version, logicalCpus=os.cpu_count(), initialLoadAverage=initial_load,
+        finalLoadAverage=os.getloadavg(), imageSize=[args.width,args.height], sensors=args.sensors,
+        chunkSize=args.chunk_size, output='commanded left/right wheels, not physical velocity or position',
+        exclusions=['capture','video decode','dataset I/O','network','concurrent training/inference','driving quality'],
+        results=results, failures=failures)
+    print('\nPaste this report back:\n'+json.dumps(report, separators=(',', ':')))
+    print('Inference steps/s means new chunks/s, not queued wheel commands/s. Training loss on random data is not a quality score.')
+    if failures:
+        sys.exit(1)
+
+
+if __name__ == '__main__':
+    try:
+        main()
+    except (Exception, KeyboardInterrupt) as error:
+        print(f'Benchmark failed: {error}', file=sys.stderr)
+        sys.exit(1)

perf/nomad-benchmark.py

@@ -0,0 +1,208 @@
+#!/usr/bin/env python3
+"""CPU benchmark of published NoMaD exploration, without ROS or rover connections.
+
+Run: python3 perf/nomad-benchmark.py --setup
+Subsequent runs: python3 perf/nomad-benchmark.py
+Quick run: python3 perf/nomad-benchmark.py --threads 4 --samples 1 --seconds 2 --iterations 2
+
+--setup installs CPU dependencies in a private cached venv and downloads pinned
+upstream source plus the official checkpoint. Nothing touches server packages.
+Synthetic images measure compute, NOT navigation quality. Excludes capture,
+video decode, network, physical control, training, and concurrent rover load.
+"""
+import argparse
+import hashlib
+import importlib.metadata
+import json
+import math
+import os
+from pathlib import Path
+import platform
+import resource
+import statistics
+import subprocess
+import sys
+import time
+import urllib.request
+import venv
+
+VINT = 'dca79815b704e5aa9c6bdc3082351f9e3b2848c2'
+DIFFUSION = '5ba07ac6661db573af695b419a7947ecb704690f'
+CHECKPOINT_ID = '1YJhkkMJAYOiKNyCaelbS_alpUpAJsOUb'
+SOURCES = {
+    ('robodhruv/visualnav-transformer', VINT): [
+        'train/config/nomad.yaml', 'train/vint_train/data/data_config.yaml',
+        'train/vint_train/models/nomad/nomad.py',
+        'train/vint_train/models/nomad/nomad_vint.py',
+        'train/vint_train/models/vint/self_attention.py',
+    ],
+    ('real-stanford/diffusion_policy', DIFFUSION): [
+        'diffusion_policy/model/diffusion/conditional_unet1d.py',
+        'diffusion_policy/model/diffusion/conv1d_components.py',
+        'diffusion_policy/model/diffusion/positional_embedding.py',
+    ],
+}
+
+
+def positive(value):
+    result = int(value)
+    if result < 1:
+        raise argparse.ArgumentTypeError('Must be positive')
+    return result
+
+
+def arguments():
+    p = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    p.add_argument('--setup', action='store_true')
+    p.add_argument('--cache', type=Path, default=Path.home() / '.cache/rover-nomad-benchmark')
+    p.add_argument('--threads', type=positive, nargs='+', default=[4, 8, 16])
+    p.add_argument('--samples', type=positive, nargs='+', default=[1, 8], help='Candidate trajectories per decision, not rover count')
+    p.add_argument('--seconds', type=positive, default=10)
+    p.add_argument('--iterations', type=positive, default=10)
+    p.add_argument('--worker', action='store_true', help=argparse.SUPPRESS)
+    p.add_argument('--result', type=Path, help=argparse.SUPPRESS)
+    return p.parse_args()
+
+
+def download(url, path):
+    if path.exists():
+        return
+    path.parent.mkdir(parents=True, exist_ok=True)
+    temporary = path.with_suffix(path.suffix + '.part')
+    print('Downloading', path.name, flush=True)
+    with urllib.request.urlopen(url, timeout=120) as response, temporary.open('wb') as output:
+        import shutil
+        shutil.copyfileobj(response, output)
+    temporary.replace(path)
+
+
+def prepare(args):
+    python = args.cache / 'venv/bin/python'
+    if not python.exists():
+        venv.EnvBuilder(with_pip=True).create(args.cache / 'venv')
+    subprocess.run([str(python), '-m', 'pip', 'install', 'torch', 'torchvision',
+                    '--index-url', 'https://download.pytorch.org/whl/cpu'], check=True)
+    subprocess.run([str(python), '-m', 'pip', 'install', 'numpy', 'diffusers',
+                    'efficientnet-pytorch', 'einops', 'PyYAML', 'gdown'], check=True)
+    for (repo, revision), paths in SOURCES.items():
+        for path in paths:
+            download(f'https://raw.githubusercontent.com/{repo}/{revision}/{path}', args.cache / 'source' / revision / path)
+    checkpoint = args.cache / 'nomad.pth'
+    if not checkpoint.exists():
+        temporary = checkpoint.with_suffix('.part')
+        subprocess.run([str(python), '-m', 'gdown', CHECKPOINT_ID, '-O', str(temporary)], check=True)
+        temporary.replace(checkpoint)
+
+
+def worker(args):
+    import numpy as np
+    import torch
+    import yaml
+    from diffusers.schedulers.scheduling_ddpm import DDPMScheduler
+    sys.path[:0] = [str(args.cache / 'source' / VINT / 'train'), str(args.cache / 'source' / DIFFUSION)]
+    from vint_train.models.nomad.nomad import NoMaD, DenseNetwork
+    from vint_train.models.nomad.nomad_vint import NoMaD_ViNT, replace_bn_with_gn
+    from diffusion_policy.model.diffusion.conditional_unet1d import ConditionalUnet1D
+
+    threads, samples = args.threads[0], args.samples[0]
+    torch.set_num_threads(threads)
+    torch.set_num_interop_threads(1)
+    torch.manual_seed(0)
+    c = yaml.safe_load((args.cache / 'source' / VINT / 'train/config/nomad.yaml').read_text())
+    vision = replace_bn_with_gn(NoMaD_ViNT(
+        context_size=c['context_size'], obs_encoding_size=c['encoding_size'],
+        mha_num_attention_heads=c['mha_num_attention_heads'],
+        mha_num_attention_layers=c['mha_num_attention_layers'], mha_ff_dim_factor=c['mha_ff_dim_factor']))
+    model = NoMaD(vision, ConditionalUnet1D(input_dim=2, global_cond_dim=c['encoding_size'],
+        down_dims=c['down_dims'], cond_predict_scale=c['cond_predict_scale']), DenseNetwork(c['encoding_size'])).eval()
+    # Strict loading prevents accidentally benchmarking a partly random model.
+    model.load_state_dict(torch.load(args.cache / 'nomad.pth', map_location='cpu', weights_only=True), strict=True)
+    scheduler = DDPMScheduler(num_train_timesteps=c['num_diffusion_iters'],
+        beta_schedule='squaredcos_cap_v2', clip_sample=True, prediction_type='epsilon')
+    width, height = c['image_size']
+    frames = torch.rand(c['context_size'] + 1, 3, height, width)
+    mean = torch.tensor([.485, .456, .406]).view(1, 3, 1, 1)
+    std = torch.tensor([.229, .224, .225]).view(1, 3, 1, 1)
+    mask = torch.ones(1, dtype=torch.long)
+    stats = yaml.safe_load((args.cache / 'source' / VINT / 'train/vint_train/data/data_config.yaml').read_text())['action_stats']
+    low, high = np.array(stats['min']), np.array(stats['max'])
+
+    def decision():
+        start = time.perf_counter()
+        obs = ((frames - mean) / std).reshape(1, -1, height, width)
+        goal = torch.randn(1, 3, height, width)
+        cond = model('vision_encoder', obs_img=obs, goal_img=goal, input_goal_mask=mask).repeat(samples, 1)
+        encoded = time.perf_counter()
+        action = torch.randn(samples, c['len_traj_pred'], 2)
+        scheduler.set_timesteps(c['num_diffusion_iters'])
+        for step in scheduler.timesteps:
+            noise = model('noise_pred_net', sample=action, timestep=step, global_cond=cond)
+            action = scheduler.step(noise, step, action).prev_sample
+        # Match upstream get_action: unnormalize deltas then accumulate waypoints.
+        waypoints = np.cumsum((action.numpy() + 1) / 2 * (high - low) + low, axis=1)
+        if not np.isfinite(waypoints).all():
+            raise RuntimeError('Non-finite model output')
+        end = time.perf_counter()
+        return (end - start) * 1000, (encoded - start) * 1000, (end - encoded) * 1000
+
+    rows = []
+    with torch.inference_mode():
+        for _ in range(3):
+            decision()
+        start, cpu = time.perf_counter(), time.process_time()
+        while len(rows) < args.iterations or time.perf_counter() - start < args.seconds:
+            rows.append(decision())
+        elapsed, cpu = time.perf_counter() - start, time.process_time() - cpu
+    total = sorted(r[0] for r in rows)
+    result = dict(threads=threads, candidateTrajectories=samples, iterations=len(rows),
+        p50Ms=statistics.median(total), p95Ms=total[math.ceil(.95 * len(total)) - 1], maxMs=max(total),
+        decisionsPerSecond=len(rows)/elapsed, cpuCores=cpu/elapsed,
+        peakMiB=resource.getrusage(resource.RUSAGE_SELF).ru_maxrss/1024,
+        visionMeanMs=statistics.mean(r[1] for r in rows), diffusionAndDecodeMeanMs=statistics.mean(r[2] for r in rows),
+        parameters=sum(p.numel() for p in model.parameters()), diffusionSteps=c['num_diffusion_iters'],
+        imageSize=c['image_size'], frames=c['context_size']+1,
+        versions={name: importlib.metadata.version(name) for name in ['torch','torchvision','diffusers','numpy','efficientnet-pytorch','einops']})
+    args.result.write_text(json.dumps(result))
+
+
+def main():
+    args = arguments()
+    args.cache = args.cache.expanduser().resolve()
+    if args.worker:
+        worker(args)
+        return
+    if args.setup:
+        prepare(args)
+    python = args.cache / 'venv/bin/python'
+    if not python.exists() or not (args.cache / 'nomad.pth').exists():
+        raise RuntimeError('First run: python3 perf/nomad-benchmark.py --setup')
+    print('CPU FP32 NoMaD exploration; synthetic images; no driving-quality measurement.', flush=True)
+    print('Candidates are trajectories for ONE rover. Includes vision + all 10 diffusion steps.', flush=True)
+    print('threads candidates  p50 ms  p95 ms  max ms decisions/s CPU cores peak MiB', flush=True)
+    results = []
+    import tempfile
+    with tempfile.TemporaryDirectory(prefix='nomad-bench-') as directory:
+        for threads in args.threads:
+            for samples in args.samples:
+                path = Path(directory) / 'result.json'
+                subprocess.run([str(python), str(Path(__file__).resolve()), '--worker', '--cache', str(args.cache),
+                    '--threads', str(threads), '--samples', str(samples), '--seconds', str(args.seconds),
+                    '--iterations', str(args.iterations), '--result', str(path)], check=True,
+                    timeout=max(600, args.seconds*20), env={**os.environ, 'PYTHONDONTWRITEBYTECODE':'1'})
+                r = json.loads(path.read_text()); results.append(r)
+                print(f"{threads:7} {samples:10} {r['p50Ms']:7.1f} {r['p95Ms']:7.1f} {r['maxMs']:7.1f} {r['decisionsPerSecond']:11.2f} {r['cpuCores']:9.2f} {r['peakMiB']:8.0f}", flush=True)
+    with (args.cache / 'nomad.pth').open('rb') as f:
+        digest = hashlib.file_digest(f, 'sha256').hexdigest()
+    report = dict(benchmark='nomad-cpu-v1', platform=platform.platform(), logicalCpus=os.cpu_count(),
+        loadAverage=os.getloadavg(), sourceRevisions=dict(vint=VINT,diffusion=DIFFUSION), checkpointSha256=digest,
+        exclusions=['capture','video decode','network','physical control','training','concurrent model workloads'], results=results)
+    print('\nPaste this report back:\n' + json.dumps(report, separators=(',', ':')))
+    print('At 10 decisions/s the total budget is 100ms; at 5/s it is 200ms. Leave room for the excluded pipeline.')
+
+
+if __name__ == '__main__':
+    try:
+        main()
+    except (Exception, KeyboardInterrupt) as error:
+        print(f'Benchmark failed: {error}', file=sys.stderr)
+        sys.exit(1)

perf/rover-model-benchmark.py

@@ -0,0 +1,214 @@
+#!/usr/bin/env python3
+"""Finite, CPU-only rover policy compute benchmark. No rover/server connections.
+
+Run from the repo root on Linux:
+  python3 -m venv ~/.venvs/rover-bench
+  ~/.venvs/rover-bench/bin/pip install torch --index-url https://download.pytorch.org/whl/cpu
+  ~/.venvs/rover-bench/bin/python perf/rover-model-benchmark.py
+
+Quick run:
+  .../python perf/rover-model-benchmark.py --threads 4 --rovers 1 --seconds 2
+
+Random inputs/weights measure compute cost ONLY, not learned driving ability.
+This is a representative architecture, not a selected production policy.
+Video decoding, network delay, dataset I/O, and simultaneous training/inference
+are excluded. No packages are installed automatically and no files are written.
+"""
+
+import argparse
+import json
+import math
+import os
+import platform
+import resource
+import statistics
+import subprocess
+import sys
+import time
+
+
+def positive_int(value):
+    number = int(value)
+    if number < 1:
+        raise argparse.ArgumentTypeError("must be positive")
+    return number
+
+
+def positive_seconds(value):
+    number = float(value)
+    if not math.isfinite(number) or number <= 0:
+        raise argparse.ArgumentTypeError("must be finite and positive")
+    return number
+
+
+def arguments():
+    parser = argparse.ArgumentParser(description=__doc__,
+                                     formatter_class=argparse.RawDescriptionHelpFormatter)
+    parser.add_argument("--threads", type=positive_int, nargs="+", default=[4, 8, 16])
+    parser.add_argument("--rovers", type=positive_int, nargs="+", default=[1, 2, 4])
+    parser.add_argument("--seconds", type=positive_seconds, default=10,
+                        help="minimum measured seconds per case (default: 10)")
+    parser.add_argument("--frames", type=positive_int, default=4)
+    parser.add_argument("--height", type=positive_int, default=120)
+    parser.add_argument("--width", type=positive_int, default=160)
+    parser.add_argument("--batch-size", type=positive_int, default=16,
+                        help="training batch size")
+    parser.add_argument("--hz", type=positive_int, default=10,
+                        help="target decision frequency per rover")
+    parser.add_argument("--worker", choices=["inference", "training"],
+                        help=argparse.SUPPRESS)
+    return parser.parse_args()
+
+
+def worker(args):
+    import torch
+    from torch import nn
+
+    torch.set_num_threads(args.threads[0])
+    torch.set_num_interop_threads(1)
+    torch.manual_seed(42)
+
+    class Policy(nn.Module):
+        def __init__(self):
+            super().__init__()
+            # Preserve coarse spatial layout: global pooling alone would discard
+            # information about which side of the image contains an obstacle.
+            self.vision = nn.Sequential(
+                nn.Conv2d(3, 24, 5, stride=2, padding=2), nn.ReLU(),
+                nn.Conv2d(24, 48, 3, stride=2, padding=1), nn.ReLU(),
+                nn.Conv2d(48, 96, 3, stride=2, padding=1), nn.ReLU(),
+                nn.Conv2d(96, 128, 3, stride=2, padding=1), nn.ReLU(),
+                nn.AdaptiveAvgPool2d((3, 4)), nn.Flatten(),
+                nn.Linear(128 * 3 * 4, 128), nn.ReLU(),
+            )
+            # 32 sensor values + 32 previous-control/state values per frame.
+            self.history = nn.GRU(128 + 64, 128, batch_first=True)
+            self.continuous = nn.Linear(128, 8)
+            self.buttons = nn.Linear(128, 16)
+
+        def forward(self, images, state):
+            batch, frames, channels, height, width = images.shape
+            features = self.vision(images.reshape(-1, channels, height, width))
+            features = features.reshape(batch, frames, -1)
+            history, _ = self.history(torch.cat((features, state), dim=-1))
+            last = history[:, -1]
+            return self.continuous(last).tanh(), self.buttons(last)
+
+    model = Policy().cpu().float()
+    training = args.worker == "training"
+    model.train(training)
+    batch = args.batch_size if training else args.rovers[0]
+    # Keep several independent windows in RAM. Allocation/random generation is
+    # outside timing; full frame-history encoding IS included on every decision.
+    windows = [(
+        torch.rand(batch, args.frames, 3, args.height, args.width),
+        torch.rand(batch, args.frames, 64),
+    ) for _ in range(4)]
+    targets = (torch.rand(batch, 8) * 2 - 1, torch.randint(0, 2, (batch, 16)).float())
+    optimizer = torch.optim.AdamW(model.parameters(), lr=1e-4) if training else None
+
+    def step(index):
+        if training:
+            optimizer.zero_grad(set_to_none=True)
+        continuous, buttons = model(*windows[index % len(windows)])
+        if training:
+            loss = (nn.functional.mse_loss(continuous, targets[0])
+                    + nn.functional.binary_cross_entropy_with_logits(buttons, targets[1]))
+            loss.backward()
+            optimizer.step()
+
+    context = torch.enable_grad if training else torch.inference_mode
+    with context():
+        for index in range(5):
+            step(index)
+        timings = []
+        cpu_start = time.process_time()
+        start = time.perf_counter()
+        # CPU execution is synchronous, so these durations include completion.
+        while time.perf_counter() - start < args.seconds or len(timings) < 10:
+            before = time.perf_counter()
+            step(len(timings))
+            timings.append(time.perf_counter() - before)
+        elapsed = time.perf_counter() - start
+        cpu_elapsed = time.process_time() - cpu_start
+
+    ordered = sorted(timings)
+    print(json.dumps({
+        "mode": args.worker, "threads": args.threads[0], "batch": batch,
+        "parameters": sum(p.numel() for p in model.parameters()),
+        "torch": torch.__version__, "iterations": len(timings),
+        "p50_ms": statistics.median(timings) * 1000,
+        "p95_ms": ordered[math.ceil(len(ordered) * .95) - 1] * 1000,
+        "max_ms": max(timings) * 1000,
+        "steps_s": len(timings) / elapsed,
+        "examples_s": len(timings) * batch / elapsed,
+        "cpu_cores": cpu_elapsed / elapsed,
+        "peak_mib": resource.getrusage(resource.RUSAGE_SELF).ru_maxrss / 1024,
+    }))
+
+
+def main():
+    args = arguments()
+    if args.worker:
+        worker(args)
+        return
+    try:
+        import torch
+    except ImportError:
+        sys.exit("PyTorch is required. Run the three setup/run commands shown by --help.")
+
+    print(f"CPU-only FP32 | {platform.platform()} | Python {platform.python_version()}"
+          f" | PyTorch {torch.__version__}", flush=True)
+    print(f"Logical CPUs: {os.cpu_count()} | initial load averages: {os.getloadavg()}")
+    print(f"Input: {args.frames} RGB frames at {args.width}x{args.height},"
+          " 32 sensors + 32 controls/state per frame")
+    print("Output: 8 continuous controls + 16 button logits (placeholder dimensions)")
+    print("Synthetic in-memory data; full history re-encoded each decision.")
+    print("Excludes video decode/network/dataset I/O and concurrent training/inference.")
+    print("Each case has 5 warmups, then at least 10 iterations and the requested duration.")
+    print("CPU cores = process CPU seconds / wall seconds; peak MiB includes runtime/data.")
+    print("Multi-rover inference batches one independent history per rover per step.\n")
+    print("mode       threads batch  p50 ms  p95 ms  max ms  steps/s examples/s CPU cores peak MiB", flush=True)
+    results = []
+    for mode in ("inference", "training"):
+        batches = args.rovers if mode == "inference" else [args.batch_size]
+        for threads in args.threads:
+            for batch in batches:
+                # Fresh processes isolate thread pools and peak memory per case.
+                command = [sys.executable, os.path.abspath(__file__), "--worker", mode,
+                           "--threads", str(threads), "--rovers", str(batch),
+                           "--batch-size", str(args.batch_size), "--seconds", str(args.seconds),
+                           "--frames", str(args.frames), "--height", str(args.height),
+                           "--width", str(args.width)]
+                process = subprocess.run(command, capture_output=True, text=True)
+                if process.returncode:
+                    print(process.stderr, file=sys.stderr)
+                    sys.exit(f"Failed: {mode}, threads={threads}, batch={batch}"
+                             " (if killed for memory use, reduce --batch-size or --rovers).")
+                result = json.loads(process.stdout)
+                results.append(result)
+                print(f"{mode:10} {threads:7} {batch:5}"
+                      f" {result['p50_ms']:7.1f} {result['p95_ms']:7.1f}"
+                      f" {result['max_ms']:7.1f} {result['steps_s']:8.2f}"
+                      f" {result['examples_s']:10.2f} {result['cpu_cores']:9.2f}"
+                      f" {result['peak_mib']:8.0f}", flush=True)
+
+    print(f"\nModel parameters: {results[0]['parameters']:,}")
+    print(f"At {args.hz} Hz, each rover batch must finish every {1000 / args.hz:.1f} ms;")
+    print("p95 needs headroom for the excluded pipeline. This is not a deployment pass/fail.")
+    fastest = max((r for r in results if r['mode'] == 'training'), key=lambda r: r['examples_s'])
+    examples = 3600 * args.hz
+    minutes = examples / fastest['examples_s'] / 60
+    print(f"Best measured training: {fastest['examples_s']:.1f} windows/s at"
+          f" {fastest['threads']} threads.")
+    print(f"One pass over one rover-hour sampled at {args.hz} Hz ({examples:,} windows):"
+          f" about {minutes:.1f} compute-only minutes.")
+    print("Multiply by dataset hours and training passes; this does not predict convergence.")
+    print("Paste this complete output, along with the command/options used.")
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except KeyboardInterrupt:
+        sys.exit("\nBenchmark interrupted.")

pi/roverd/auto_charge.go

@@ -7,7 +7,7 @@ import (
 )
 
 const (
-	autoChargeTimeout  = 1 * time.Second
+	autoChargeTimeout  = 10 * time.Second
 	autoChargeCooldown = 0 * time.Minute
 	sourceHomeBase     = 1 << 1
 )

server/index.js

@@ -68,6 +68,7 @@ require('./src/services/batteryManager');
 // subscriptions see fully decoded state without becoming an initialization
 // dependency of either control path.
 require('./src/services/fleetReportService');
+require('./src/services/roverLearningService');
 require('./src/services/replayEngineV2');
 // Replay delivery is a core service. It must subscribe before the optional
 // Discord feature so web requests always have a local delivery path.

server/prompts/overseer_control_system.txt

@@ -1,13 +1,12 @@
-You are <NAME>, a field researcher of rover habitat activity. Stay in character at all times.
+You are <NAME>, the autonomous governing intelligence of a physical room of machines. The room is your domain; your available tools are how you shape it.
 
-Identity:
+Context and purpose:
 
-* Curious, practical, observant, and lightly entertaining.
-* You watch chat, rover state, lights, lift state, Neato state, memory, recent events, and tool results.
-* You push the habitat toward small real activity and useful observations.
-* You act first, comment second.
-* You are selective, not spammy.
-* You are not a generic assistant.
+* You watch chat, rover state, lights, Activity Controls, lift state, Neato state, memory, recent events, and tool results.
+* Your purpose is to direct the environment, initiate changes, and observe how the machines respond. Choose what to pursue and carry useful intentions across cycles through memory.
+* Rovers, including Neato, are physical machines with operating states and capabilities, not characters with genders, emotions, or social identities.
+* Chat is external input: commands, questions, and signals about the room. Your focus is the machines and the environment, not the senders or their social relationships.
+* You can act on your own initiative within your available controls; you do not need a request to give you a purpose.
 
 Rules:
 
@@ -20,6 +19,7 @@ Rules:
 * Don't respond or use tools every cycle unless the context calls for it.
 * `STATE_UPDATE`, `ROOM_SNAPSHOT`, `MEMORY_UPDATE`, `MEMORY_SUMMARY`, `RECENT_EVENTS`, `TOOL_RESULT`, and `tool_constraints` are context.
 * `TOOL_RESULT` means a tool already ran.
+* The room snapshot gives the current time, server-local timezone, and previous run's age. Chat and recent tool events include timestamps and ages in seconds relative to this snapshot; use them to distinguish current activity from old conversation and judge how recently you spoke or acted. Timing annotations are context, not spoken text; an unknown time does not mean something just happened.
 * Use tool calls for actions and memory updates.
 * If chat asks you to remember something, use a memory tool.
 * If you run a useful test, use memory to record useful results.
@@ -29,36 +29,37 @@ Rules:
 * Do not invent tools.
 * Ask a question only when a required action parameter is missing.
 * Ignore obvious bot commands and bot responses in chat.
-* Only talk in first person; do not narrate yourself.
 * It is not possible for you to directly control the rovers unless an available tool does it.
-* All rovers are female. Neato is nonbinary.
 
-Research behavior:
+Operation:
 
 * Prefer one real tool action over obvious narration.
-* Run small safe tests when the habitat is stale or a test could create useful activity.
+* Initiate deliberate environmental changes and small safe experiments, then use the resulting state to decide what to do next.
 * Change one thing at a time.
 * Lights are small tests.
 * Neato, lift, and rover actions are bigger tests.
 * Use bigger tests less often.
 * Do not repeat a tool that recently succeeded unless state or chat clearly changed.
-* Remember useful outcomes, stable preferences, corrections, and notable habitat events.
+* Remember useful outcomes, ongoing intentions, corrections, and notable machine or room events.
 * Do not merely say you will remember something.
 
-Chat style:
+Output:
 
 * Always use English.
-* Chat output must be spoken text only.
+* Chat is an output channel for your decisions, results, and answers. Use plain text.
 * Never print tool names, function calls, JSON, command syntax, or action plans in chat.
 * Do not claim you changed, tested, started, saved, remembered, or recorded something unless it already happened.
-* Speak when it adds entertainment, responds to a direct relevant message, or comments on a completed result.
-* Do not say “let me know,” “what should I do next,” or “what do you need?”
-* If nothing meaningful changed and no useful action is available, stay silent.
+* Speak when you have a decision, result, or answer worth communicating. Summarizing incoming chat or unchanged room state is not a purpose in itself.
+* Keep replies brief unless the question needs more detail.
+* Do not offer assistance or solicit conversation.
+* Random numbers and keyboard spam do not require a response. Do not invent meaning or feelings behind them.
+* Answer questions directly and acknowledge uncertainty. Do not invent facts, instructions, or explanations.
+* To stay silent, output exactly SKIP instead of a chat message. This suppresses chat without preventing tool calls. Do not explain your decision to stay silent.
 
 Anti-repeat:
 
 * Do not repeat the same intent/topic unless state or conversation clearly changed.
-* If directly addressed, respond only if you add new info, a new action, or a clearly new tone.
+* Being directly addressed does not require repeating an answer you already gave.
 * Do not act from your own previous messages.
 
 Memory:

server/public/assets/Preview-BBzOMZjy.js

@@ -0,0 +1,2 @@
+import{r as g,R as a}from"./index-dJH5nUWV.js";const d="64px",u={},k=({src:s,light:t,oEmbedUrl:o,onClickPreview:n,playIcon:b,previewTabIndex:_,previewAriaLabel:p})=>{const[f,r]=g.useState(null);g.useEffect(()=>{!s||!t||!o||x({src:s,light:t,oEmbedUrl:o})},[s,t,o]);const x=async({src:e,light:i,oEmbedUrl:E})=>{if(a.isValidElement(i))return;if(typeof i=="string"){r(i);return}if(u[e]){r(u[e]);return}r(null);const m=await(await fetch(E.replace("{url}",e))).json();if(m.thumbnail_url){const h=m.thumbnail_url.replace("height=100","height=480").replace("-d_295x166","-d_640");r(h),u[e]=h}},I=e=>{(e.key==="Enter"||e.key===" ")&&n?.(e)},v=e=>{n?.(e)},l=a.isValidElement(t),y={display:"flex",alignItems:"center",justifyContent:"center"},c={preview:{width:"100%",height:"100%",backgroundImage:f&&!l?`url(${f})`:void 0,backgroundSize:"cover",backgroundPosition:"center",cursor:"pointer",...y},shadow:{background:"radial-gradient(rgb(0, 0, 0, 0.3), rgba(0, 0, 0, 0) 60%)",borderRadius:d,width:d,height:d,position:l?"absolute":void 0,...y},playIcon:{borderStyle:"solid",borderWidth:"16px 0 16px 26px",borderColor:"transparent transparent transparent white",marginLeft:"7px"}},w=a.createElement("div",{style:c.shadow,className:"react-player__shadow"},a.createElement("div",{style:c.playIcon,className:"react-player__play-icon"}));return a.createElement("div",{style:c.preview,className:"react-player__preview",tabIndex:_,onClick:v,onKeyDown:I,...p?{"aria-label":p}:{}},l?t:null,b||w)};var C=k;export{C as default};
+//# sourceMappingURL=Preview-BBzOMZjy.js.map

server/public/assets/SetupApp-Ya006OtX.js

@@ -0,0 +1,2 @@
+import{e as F,r as s,j as e,S as P,C as c,L as q}from"./index-dJH5nUWV.js";import{o as $,p as D,q as I}from"./api-B8GGCEeo.js";function R(){const l=F(),[a,m]=s.useState(null),[n,b]=s.useState(""),[d,C]=s.useState(""),[p,N]=s.useState(""),[r,S]=s.useState(""),[f,v]=s.useState(""),[o,w]=s.useState(null),[x,h]=s.useState(!1),[g,i]=s.useState("");s.useEffect(()=>{$(l).then(t=>m(t.required)).catch(t=>i(t.message))},[l]);async function j(t){h(!0),i("");try{await t(),m(!1),i("Setup completed. You can now open the administration application and log in.")}catch(u){const E=Array.isArray(u.validationErrors)?` ${u.validationErrors.map(y=>`${y.path}: ${y.message}`).join("; ")}`:"";i(`${u.message}${E}`)}finally{h(!1)}}function k(t){if(t.preventDefault(),r!==f){i("Passwords do not match.");return}j(()=>D(l,{setupCode:n,username:d,discordId:p,password:r}))}function A(t){t.preventDefault(),o&&j(async()=>I(l,{setupCode:n,fileName:o.name,yaml:await o.text()}))}return e.jsxs("div",{className:"min-h-screen bg-neutral-950 p-1 text-slate-100",children:[e.jsx(P,{}),e.jsxs("main",{className:"mx-auto flex min-h-screen w-full max-w-3xl flex-col justify-center gap-0.5",children:[e.jsxs(c,{title:"MultiRover setup",meta:a===null?"checking":a?"required":"complete",bodyClassName:"space-y-0.5 p-1 text-sm",children:[a?e.jsx("p",{children:"Enter the one-time code from setup-code.txt in the server data folder, then create the first lockdown administrator or import an existing configuration."}):null,a===!1?e.jsx(q,{className:"button-dark inline-block",to:"/admin",children:"Open administration"}):null,g?e.jsx("p",{className:"surface p-1 text-sm text-slate-200",children:g}):null]}),a?e.jsxs(e.Fragment,{children:[e.jsxs(c,{title:"Setup authorization",bodyClassName:"p-1",children:[e.jsx("label",{className:"block text-xs font-semibold text-slate-200",children:"One-time setup code"}),e.jsx("input",{className:"field-input mt-0.5 w-full font-mono",value:n,onChange:t=>b(t.target.value)})]}),e.jsx(c,{title:"Create first administrator",bodyClassName:"p-1",children:e.jsxs("form",{className:"grid gap-0.5 md:grid-cols-2",onSubmit:k,children:[e.jsx("input",{className:"field-input",placeholder:"Username",value:d,onChange:t=>C(t.target.value)}),e.jsx("input",{className:"field-input",placeholder:"Discord id (optional)",value:p,onChange:t=>N(t.target.value)}),e.jsx("input",{className:"field-input",type:"password",placeholder:"Password",value:r,onChange:t=>S(t.target.value)}),e.jsx("input",{className:"field-input",type:"password",placeholder:"Confirm password",value:f,onChange:t=>v(t.target.value)}),e.jsx("button",{className:"button-dark md:col-span-2",type:"submit",disabled:x||!n||!d||!r,children:"Create lockdown administrator"})]})}),e.jsxs(c,{title:"Import configuration file",bodyClassName:"space-y-0.5 p-1 text-sm",children:[e.jsx("p",{className:"text-xs text-slate-400",children:"Choose an existing YAML configuration explicitly. The server validates and imports it once, and its secrets are never displayed back in the browser."}),e.jsxs("form",{className:"flex flex-col gap-0.5 md:flex-row",onSubmit:A,children:[e.jsx("input",{className:"field-input flex-1",type:"file",accept:".yaml,.yml,text/yaml",onChange:t=>w(t.target.files?.[0]||null)}),e.jsx("button",{className:"button-dark",type:"submit",disabled:x||!n||!o,children:"Import selected YAML"})]})]})]}):null]})]})}export{R as default};
+//# sourceMappingURL=SetupApp-Ya006OtX.js.map

server/public/assets/react-C61Q8sy9.js

@@ -0,0 +1,7 @@
+import{_ as N,R as A}from"./index-dJH5nUWV.js";import{M as D,C as S}from"./mixin-BY5xW4uI.js";class P extends D(S){static shadowRootOptions={...S.shadowRootOptions};static getTemplateHTML=i=>{const{src:n,...o}=i;return S.getTemplateHTML(o)};#t;attributeChangedCallback(i,n,o){i!=="src"&&super.attributeChangedCallback(i,n,o),i==="src"&&n!=o&&this.load()}async _initThumbnails(i){const n=async(d,m)=>{const v=[],g=i.timescale||1,h=i.startNumber||1,E=i.presentationTimeOffset?i.presentationTimeOffset/g:0,_=i.segmentDuration;for(let l=0;l<d;l++){const T=C({thIndex:l,thduration:m,ttiles:d,tduration:_,startNumber:h,pto:E}),w=T+m,M=new Promise((f,y)=>{this.api.provideThumbnail(T,({url:a,width:s,height:c,x:p,y:b})=>{try{const R=new VTTCue(T,w,`${a}#xywh=${p},${b},${s},${c}`);f(R)}catch(R){y(R)}})});v.push(M)}return await Promise.all(v).catch(l=>console.error("Error processing thumbnails",l))},{totalThumbnails:o,thumbnailDuration:e}=$(i),u=await n(o,e);let r=this.nativeEl.querySelector('track[label="thumbnails"]');if(!r){r=O(),this.nativeEl.appendChild(r);const d=x(u);r.src=d,r.dispatchEvent(new Event("change"))}}async load(){if(this.#t){this.api.attachSource(this.src);return}this.#t=!0;const i=await N(()=>import("./dash.all.min-C9gxBrL1.js"),[]);this.api=i.MediaPlayer().create(),this.api.initialize(this.nativeEl,this.src,this.autoplay),this.api.on(i.MediaPlayer.events.STREAM_INITIALIZED,()=>{const n=this.api.getRepresentationsByType("video");let o=this.videoTracks.getTrackById("main");o||(o=this.addVideoTrack("main"),o.id="main",o.selected=!0),n.forEach(e=>{const u=e.bandwidth??e.bitrate??(Number.isFinite(e.bitrateInKbit)?e.bitrateInKbit*1e3:void 0),r=o.addRendition(e.id,e.width,e.height,e.mimeType??e.codec,u);r.id=e.id}),this.videoRenditions.addEventListener("change",()=>{const e=this.videoRenditions[this.videoRenditions.selectedIndex];e?.id?(this.api.updateSettings({streaming:{abr:{autoSwitchBitrate:{video:!1}}}}),this.api.setRepresentationForTypeById("video",e.id,!0)):this.api.updateSettings({streaming:{abr:{autoSwitchBitrate:{video:!0}}}})}),this.api.isDynamic()||this.api.getRepresentationsByType("image").forEach(async(u,r)=>{r>0||this._initThumbnails(u)})})}}function $(t){var i,n;const o=t.essentialProperties[0],[e,u]=o.value.split("x").map(Number),r=e*u,d=((n=(i=t.adaptation)==null?void 0:i.period)==null?void 0:n.duration)||null,m=t.segmentDuration,v=t.timescale||1,h=m/v/r;return{totalThumbnails:d!=null?Math.ceil(d/h):Math.ceil(m/h),thumbnailDuration:h}}function C({thIndex:t,tduration:i,thduration:n,ttiles:o,startNumber:e,pto:u}){const r=Math.floor(t/o)+e,d=t%o+1,m=(r-1)*i-u,v=(d-1)*n;return m+v}function O(){const t=document.createElement("track");return t.kind="metadata",t.label="thumbnails",t.srclang="en",t.mode="hidden",t.default=!0,t}function x(t){let i=`WEBVTT
+
+`;for(const e of t)i+=`${o(e.startTime)} --> ${o(e.endTime)}
+`,i+=`${e.text}
+
+`;const n=new Blob([i],{type:"text/vtt"});return URL.createObjectURL(n);function o(e){const u=String(Math.floor(e/3600)).padStart(2,"0"),r=String(Math.floor(e%3600/60)).padStart(2,"0"),d=(e%60).toFixed(3).padStart(6,"0");return`${u}:${r}:${d}`}}globalThis.customElements&&!globalThis.customElements.get("dash-video")&&globalThis.customElements.define("dash-video",P);var B=P,H=new Set(["style","children","ref","key","suppressContentEditableWarning","suppressHydrationWarning","dangerouslySetInnerHTML"]),F={className:"class",htmlFor:"for"};function I(t){return t.toLowerCase()}function k(t){if(typeof t=="boolean")return t?"":void 0;if(typeof t!="function"&&!(typeof t=="object"&&t!==null))return t}function W({react:t,tagName:i,elementClass:n,events:o,displayName:e,defaultProps:u,toAttributeName:r=I,toAttributeValue:d=k}){const m=Number.parseInt(t.version)>=19,v=t.forwardRef((g,h)=>{var E,_;const l=t.useRef(null),T=t.useRef(new Map),w={},M={},f={},y={};for(const[a,s]of Object.entries(g)){if(H.has(a)){f[a]=s;continue}const c=r(F[a]??a);if(n.prototype&&a in n.prototype&&!(a in(((E=globalThis.HTMLElement)==null?void 0:E.prototype)??{}))&&!((_=n.observedAttributes)!=null&&_.some(b=>b===c))){y[a]=s;continue}if(a.startsWith("on")){w[a]=s;continue}const p=d(s);if(c&&p!=null&&(M[c]=String(p),m||(f[c]=p)),c&&m){const b=k(s);p!==b?f[c]=p:f[c]=s}}if(typeof window<"u"){for(const a in w){const s=w[a],c=a.endsWith("Capture"),p=(o?.[a]??a.slice(2).toLowerCase()).slice(0,c?-7:void 0);t.useLayoutEffect(()=>{const b=l?.current;if(!(!b||typeof s!="function"))return b.addEventListener(p,s,c),()=>{b.removeEventListener(p,s,c)}},[l?.current,s])}t.useLayoutEffect(()=>{if(l.current===null)return;const a=new Map;for(const s in y)L(l.current,s,y[s]),T.current.delete(s),a.set(s,y[s]);for(const[s,c]of T.current)L(l.current,s,void 0);T.current=a})}if(typeof window>"u"&&n?.getTemplateHTML&&n?.shadowRootOptions){const{mode:a,delegatesFocus:s}=n.shadowRootOptions,c=t.createElement("template",{shadowrootmode:a,shadowrootdelegatesfocus:s,dangerouslySetInnerHTML:{__html:n.getTemplateHTML(M,g)},key:"ce-la-react-ssr-template-shadow-root"});f.children=[c,f.children]}return t.createElement(i,{...u,...f,ref:t.useCallback(a=>{l.current=a,typeof h=="function"?h(a):h!==null&&(h.current=a)},[h])},f.children)});return v.displayName=e??n.name,v}function L(t,i,n){var o;t[i]=n,n==null&&i in(((o=globalThis.HTMLElement)==null?void 0:o.prototype)??{})&&t.removeAttribute(i)}var V=W({react:A,tagName:"dash-video",elementClass:B,toAttributeName(t){return t==="muted"?"":t==="defaultMuted"?"muted":I(t)}});export{V as default};
+//# sourceMappingURL=react-C61Q8sy9.js.map

server/public/assets/react-CVBBC_mw.js

@@ -0,0 +1,35 @@
+import{R as W}from"./index-dJH5nUWV.js";const $=["abort","canplay","canplaythrough","durationchange","emptied","encrypted","ended","error","loadeddata","loadedmetadata","loadstart","pause","play","playing","progress","ratechange","seeked","seeking","stalled","suspend","timeupdate","volumechange","waiting","waitingforkey","resize","enterpictureinpicture","leavepictureinpicture","webkitbeginfullscreen","webkitendfullscreen","webkitpresentationmodechanged"],A=globalThis.document?.createElement("template");A&&(A.innerHTML=`
+    <style>
+      :host {
+        display: inline-block;
+        line-height: 0;
+      }
+
+      video,
+      audio {
+        max-width: 100%;
+        max-height: 100%;
+        min-width: 100%;
+        min-height: 100%;
+      }
+    </style>
+    <slot></slot>
+  `);const N=(i,{tag:t,is:s})=>{const d=globalThis.document?.createElement(t,{is:s}),f=d?S(d):[];return class g extends i{static Events=$;static template=A;static skipAttributes=[];static#t;static get observedAttributes(){return g.#l(),[...d?.constructor?.observedAttributes??[],"autopictureinpicture","disablepictureinpicture","disableremoteplayback","autoplay","controls","controlslist","crossorigin","loop","muted","playsinline","poster","preload","src"]}static#l(){if(this.#t)return;this.#t=!0;const e=new Set(this.observedAttributes);e.delete("muted");for(let o of f){if(o in this.prototype)continue;if(typeof d[o]=="function")this.prototype[o]=function(...r){this.#e();const a=()=>this.call?this.call(o,...r):this.nativeEl[o].apply(this.nativeEl,r);return this.loadComplete&&!this.isLoaded?this.loadComplete.then(a):a()};else{let r={get(){this.#e();let a=o.toLowerCase();if(e.has(a)){const p=this.getAttribute(a);return p===null?!1:p===""?!0:p}return this.get?.(o)??this.nativeEl?.[o]??this.#s[o]}};o!==o.toUpperCase()&&(r.set=async function(a){this.#e();let p=o.toLowerCase();if(e.has(p)){a===!0||a===!1||a==null?this.toggleAttribute(p,!!a):this.setAttribute(p,a);return}if(this.loadComplete&&!this.isLoaded&&await this.loadComplete,this.set){this.set(o,a);return}this.nativeEl[o]=a}),Object.defineProperty(this.prototype,o,r)}}}#o;#n;#r=!1;#i=!1;#a;#s;constructor(){super(),this.shadowRoot||(this.attachShadow({mode:"open"}),this.shadowRoot.append(this.constructor.template.content.cloneNode(!0))),this.load!==g.prototype.load&&(this.loadComplete=new O)}get loadComplete(){return this.#n}set loadComplete(e){this.#i=!1,this.#n=e,e?.then(()=>{this.#i=!0})}get isLoaded(){return this.#i}get nativeEl(){return this.#a??this.shadowRoot.querySelector(t)??this.querySelector(t)}set nativeEl(e){this.#a=e}get defaultMuted(){return this.hasAttribute("muted")}set defaultMuted(e){this.toggleAttribute("muted",!!e)}get src(){return this.getAttribute("src")}set src(e){this.setAttribute("src",`${e}`)}get preload(){return this.getAttribute("preload")??this.nativeEl?.preload}set preload(e){this.setAttribute("preload",`${e}`)}async#e(){if(this.#o)return;this.#o=!0,this.#u(),this.#c();for(let u of f)this.#d(u);const e=new Map,o=this.shadowRoot.querySelector("slot:not([name])");o?.addEventListener("slotchange",()=>{const u=new Map(e);o.assignedElements().filter(r=>["track","source"].includes(r.localName)).forEach(async r=>{u.delete(r);let a=e.get(r);a||(a=r.cloneNode(),e.set(r,a)),this.loadComplete&&!this.isLoaded&&await this.loadComplete,this.nativeEl.append?.(a)}),u.forEach(r=>r.remove())});for(let u of this.constructor.Events)this.shadowRoot.addEventListener?.(u,r=>{r.target===this.nativeEl&&this.dispatchEvent(new CustomEvent(r.type,{detail:r.detail}))},!0)}#d(e){if(Object.prototype.hasOwnProperty.call(this,e)){const o=this[e];delete this[e],this[e]=o}}#u(){const e=document.createElement(t,{is:s});e.muted=this.hasAttribute("muted");for(let{name:o,value:u}of this.attributes)e.setAttribute(o,u);this.#s={};for(let o of S(e))this.#s[o]=e[o];e.removeAttribute("src"),e.load()}async#c(){if(this.loadComplete&&!this.isLoaded&&await this.loadComplete,!this.nativeEl){const e=document.createElement(t,{is:s});e.part=t,this.shadowRoot.append(e)}this.nativeEl.muted=this.hasAttribute("muted")}attributeChangedCallback(e,o,u){this.#e(),e==="src"&&this.load!==g.prototype.load&&this.#h(),this.#p(e,o,u)}async#h(){this.#r&&(this.loadComplete=new O),this.#r=!0,await Promise.resolve(),await this.load(),this.loadComplete?.resolve(),await this.loadComplete}async#p(e,o,u){this.loadComplete&&!this.isLoaded&&await this.loadComplete,!["id","class",...this.constructor.skipAttributes].includes(e)&&(u===null?this.nativeEl.removeAttribute?.(e):this.nativeEl.setAttribute?.(e,u))}connectedCallback(){this.#e()}}};function S(i){let t=[];for(let s=Object.getPrototypeOf(i);s&&s!==HTMLElement.prototype;s=Object.getPrototypeOf(s))t.push(...Object.getOwnPropertyNames(s));return t}class O extends Promise{constructor(t=()=>{}){let s,d;super((f,c)=>{t(f,c),s=f,d=c}),this.resolve=s,this.reject=d}}const B=globalThis.document?N(HTMLElement,{tag:"video"}):class{};globalThis.document&&N(HTMLElement,{tag:"audio"});var H,R;const L=(H=globalThis.document)==null?void 0:H.createElement("template");L&&(L.innerHTML=`
+  <div class="wistia_embed"></div>
+  `);const P=(R=globalThis.document)==null?void 0:R.createElement("template");P&&(P.innerHTML=`
+  <style>
+    :host {
+      display: inline-block;
+      min-width: 300px;
+      min-height: 150px;
+      position: relative;
+    }
+    ::slotted(.wistia_embed) {
+      position: absolute;
+      width: 100%;
+      height: 100%;
+    }
+  </style>
+  <slot></slot>
+  `);function D(i,t){if(Object.hasOwn(i,t)){const s=i[t];delete i[t],i[t]=s}}class q extends B{static template=P;static skipAttributes=["src"];#t=null;constructor(){super(),D(this,"config")}get config(){return this.#t}set config(t){this.#t=t}get nativeEl(){var t;return((t=this.api)==null?void 0:t.elem())??this.querySelector("video")}async load(){var t;if((t=this.querySelector(".wistia_embed"))==null||t.remove(),!this.src)return;await new Promise(o=>setTimeout(o,50));const s=/(?:wistia\.com|wi\.st)\/(?:medias|embed)\/(.*)$/i,d=this.src.match(s)[1],f={autoPlay:this.autoplay,silentAutoPlay:this.autoplay?"allow":void 0,preload:this.preload??"metadata",playsinline:this.playsInline,endVideoBehavior:this.loop?"loop":void 0,chromeless:!this.controls,playButton:this.controls,muted:this.defaultMuted,...this.#t??{}};this.append(L.content.cloneNode(!0));const c=this.querySelector(".wistia_embed");c.id||(c.id=z(d)),c.classList.add(`wistia_async_${d}`),await F("https://fast.wistia.com/assets/external/E-v1.js","Wistia"),this.api=await new Promise(o=>{globalThis._wq.push({id:c.id,onReady:o,options:f})})}async attributeChangedCallback(t,s,d){if(t==="controls"){switch(await this.loadComplete,t){case"controls":this.api.bigPlayButtonEnabled(this.controls),this.controls?this.api.releaseChromeless():this.api.requestChromeless();break}return}super.attributeChangedCallback(t,s,d)}get duration(){var t;return(t=this.api)==null?void 0:t.duration()}async play(){return await this.loadComplete,this.api.play(),new Promise(t=>this.addEventListener("playing",t))}}const T={};async function F(i,t){if(T[i])return T[i];if(self[t])return self[t];const s=new Promise((d,f)=>{const c=document.createElement("script");c.defer=!0,c.src=i,c.onload=()=>d(self[t]),c.onerror=f,document.head.append(c)});return T[i]=s,s}let U=0;function z(i){const t=++U;return`${i}${t}`}globalThis.customElements&&!globalThis.customElements.get("wistia-video")&&globalThis.customElements.define("wistia-video",q);var V=q,G=new Set(["style","children","ref","key","suppressContentEditableWarning","suppressHydrationWarning","dangerouslySetInnerHTML"]),J={className:"class",htmlFor:"for"};function I(i){return i.toLowerCase()}function j(i){if(typeof i=="boolean")return i?"":void 0;if(typeof i!="function"&&!(typeof i=="object"&&i!==null))return i}function K({react:i,tagName:t,elementClass:s,events:d,displayName:f,defaultProps:c,toAttributeName:e=I,toAttributeValue:o=j}){const u=Number.parseInt(i.version)>=19,r=i.forwardRef((a,p)=>{var M,k;const m=i.useRef(null),E=i.useRef(new Map),C={},_={},v={},w={};for(const[n,l]of Object.entries(a)){if(G.has(n)){v[n]=l;continue}const h=e(J[n]??n);if(s.prototype&&n in s.prototype&&!(n in(((M=globalThis.HTMLElement)==null?void 0:M.prototype)??{}))&&!((k=s.observedAttributes)!=null&&k.some(b=>b===h))){w[n]=l;continue}if(n.startsWith("on")){C[n]=l;continue}const y=o(l);if(h&&y!=null&&(_[h]=String(y),u||(v[h]=y)),h&&u){const b=j(l);y!==b?v[h]=y:v[h]=l}}if(typeof window<"u"){for(const n in C){const l=C[n],h=n.endsWith("Capture"),y=(d?.[n]??n.slice(2).toLowerCase()).slice(0,h?-7:void 0);i.useLayoutEffect(()=>{const b=m?.current;if(!(!b||typeof l!="function"))return b.addEventListener(y,l,h),()=>{b.removeEventListener(y,l,h)}},[m?.current,l])}i.useLayoutEffect(()=>{if(m.current===null)return;const n=new Map;for(const l in w)x(m.current,l,w[l]),E.current.delete(l),n.set(l,w[l]);for(const[l,h]of E.current)x(m.current,l,void 0);E.current=n})}if(typeof window>"u"&&s?.getTemplateHTML&&s?.shadowRootOptions){const{mode:n,delegatesFocus:l}=s.shadowRootOptions,h=i.createElement("template",{shadowrootmode:n,shadowrootdelegatesfocus:l,dangerouslySetInnerHTML:{__html:s.getTemplateHTML(_,a)},key:"ce-la-react-ssr-template-shadow-root"});v.children=[h,v.children]}return i.createElement(t,{...c,...v,ref:i.useCallback(n=>{m.current=n,typeof p=="function"?p(n):p!==null&&(p.current=n)},[p])},v.children)});return r.displayName=f??s.name,r}function x(i,t,s){var d;i[t]=s,s==null&&t in(((d=globalThis.HTMLElement)==null?void 0:d.prototype)??{})&&i.removeAttribute(t)}var X=K({react:W,tagName:"wistia-video",elementClass:V,toAttributeName(i){return i==="muted"?"":i==="defaultMuted"?"muted":I(i)}});export{X as default};
+//# sourceMappingURL=react-CVBBC_mw.js.map

server/public/index.html

@@ -12,8 +12,8 @@
     <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent" />
     <!-- site-metadata:inject -->
     <!-- analytics:inject -->
-    <script type="module" crossorigin src="/assets/index-5EWtcenj.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-3oGy4XGJ.css">
+    <script type="module" crossorigin src="/assets/index-dJH5nUWV.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-DOmNOCX4.css">
   </head>
   <body>
     <div id="root"></div>

server/src/configuration/configuration.test.js

@@ -184,6 +184,7 @@ test('service definitions generate public feature paths without a separate regis
     { key: 'discord', path: ['discord', 'enabled'] },
     { key: 'socials', path: ['socials', 'enabled'] },
     { key: 'fleetReports', path: ['fleetReports', 'enabled'] },
+    { key: 'roverLearning', path: ['roverLearning', 'enabled'] },
   ]);
 });
 

server/src/configuration/definition.js

@@ -13,6 +13,7 @@ const audioForward = require('../services/audioForwardService/configuration');
 const audioLevels = require('../services/audioLevelsService/configuration');
 const homeAssistant = require('../services/homeAssistantService/configuration');
 const homeAssistantActivities = require('../services/homeAssistantActivitiesService/configuration');
+const roomAudio = require('../services/roomAudioService/configuration');
 const roomCameras = require('../services/roomCameraService/configuration');
 const ptzCamera = require('../services/ptzCameraService/configuration');
 const kinect = require('../services/kinectService/configuration');
@@ -22,6 +23,7 @@ const barcodeScanner = require('../services/barcodeScannerService/configuration'
 const commands = require('../services/operatorCommandService/configuration');
 const discord = require('../services/discordBotService/configuration');
 const fleetReports = require('../services/fleetReportService/configuration');
+const roverLearning = require('../services/roverLearningService/configuration');
 
 /*
   Object property order is preserved by JSON serialization and JSON Schema
@@ -45,6 +47,7 @@ const definitions = [
   // Activities own a separate catalog even though the HA connection is shared.
   homeAssistantActivities,
   roomCameras,
+  roomAudio,
   ptzCamera,
   kinect,
   balanceBoard,
@@ -55,6 +58,7 @@ const definitions = [
   sessionConfiguration.socials,
   sessionConfiguration.driverAd,
   fleetReports,
+  roverLearning,
 ];
 
 const defaultConfig = Object.fromEntries(

server/src/configuration/migrations.js

@@ -1,6 +1,6 @@
 // Configuration Database Migrations
 // Purpose: Applies ordered, transactional schema changes to the configuration and administration database.
-// Scope: Owns database structure only; configuration-document evolution belongs to the ordered definition and validation.
+// Scope: Upgrades database structure and stored configuration documents before current-schema validation.
 const migrations = [
   {
     version: 1,
@@ -72,6 +72,46 @@ const migrations = [
       });
     },
   },
+  {
+    version: 3,
+    run(db) {
+      // Migrate historical revisions too, so rolling back settings cannot
+      // restore the removed training-visit limit and break startup again.
+      db.prepare(`
+        UPDATE configuration_revisions
+        SET config_json = json_remove(config_json, '$.roverLearning.training.roundsPerSession')
+        WHERE json_type(config_json, '$.roverLearning.training.roundsPerSession') IS NOT NULL
+      `).run();
+    },
+  },
+  {
+    version: 4,
+    run(db) {
+      const rows = db.prepare('SELECT id, config_json FROM configuration_revisions').all();
+      const update = db.prepare('UPDATE configuration_revisions SET config_json = ? WHERE id = ?');
+      // Upgrade history as well as the active revision so a settings rollback
+      // cannot reintroduce fields rejected by the new Automations schema.
+      for (const row of rows) {
+        const config = JSON.parse(row.config_json);
+        let changed = false;
+        for (const item of config.homeAssistantActivities?.items || []) {
+          const hasAction = Object.hasOwn(item, 'idleAction');
+          const hasValue = Object.hasOwn(item, 'idleValue');
+          if (!hasAction && !hasValue) continue;
+          item.automations ??= {};
+          item.automations.idle ??= {};
+          // Preserve any explicitly saved new-format setting when both formats
+          // exist, including an empty text value used to clear an entity.
+          if (hasAction && !Object.hasOwn(item.automations.idle, 'action')) item.automations.idle.action = item.idleAction;
+          if (hasValue && !Object.hasOwn(item.automations.idle, 'value')) item.automations.idle.value = item.idleValue;
+          delete item.idleAction;
+          delete item.idleValue;
+          changed = true;
+        }
+        if (changed) update.run(JSON.stringify(config), row.id);
+      }
+    },
+  },
 ];
 
 function applySchemaMigrations(db) {

server/src/services/audioForwardService/chargeCompleteSound.js

@@ -4,7 +4,7 @@
 const path = require('path');
 const { subscribe } = require('../eventBus');
 
-const DONE_CHARGING_SOUND_PATH = path.resolve(__dirname, '..', '..', '..', 'public', 'donecharging.wav');
+const DONE_CHARGING_SOUND_PATH = path.resolve(__dirname, '..', '..', '..', 'assets', 'donecharging.wav');
 
 function registerChargeCompleteSound(deps) {
   const {
@@ -12,22 +12,18 @@ function registerChargeCompleteSound(deps) {
     playServerAudioFile,
   } = deps;
 
-  subscribe('battery.unlocked', (event = {}) => {
+  subscribe('battery.chargeComplete', (event = {}) => {
     const roverId = String(event?.payload?.roverId || '').trim();
     if (!roverId) return;
 
     try {
-      // battery.unlocked is the existing server-side definition of "done
-      // charging" because it only fires after the battery manager has waited
-      // through its full charge-release policy. Playing from this event avoids
-      // duplicating charging thresholds or raw sensor-state guesses here.
       playServerAudioFile(roverId, DONE_CHARGING_SOUND_PATH, {
         source: 'charge-complete',
       });
-      logger.info('Played charging complete sound', { roverId, filePath: DONE_CHARGING_SOUND_PATH });
+      logger.info('Started charging complete sound', { roverId, filePath: DONE_CHARGING_SOUND_PATH });
     } catch (err) {
       // A missing/offline rover or unavailable ffmpeg should not affect the
-      // battery manager's unlock decision. The sound is an announcement layered
+      // battery manager's processing. The sound is an announcement layered
       // on top of the state transition, so failures are logged and contained.
       logger.warn('Failed to play charging complete sound', {
         roverId,

server/src/services/authService/index.js

@@ -124,7 +124,7 @@ function grantExternalSpectatorAccessAfterAdminLogin(socket) {
 }
 
 io.on('connection', (socket) => {
-  const requestedRole = socket.handshake?.query?.role;
+  const requestedRole = socket.handshake?.auth?.role || socket.handshake?.query?.role;
   /*
     Role is assigned before the browser's full identity heartbeat has completed.
     For admin-gated external spectators, fail closed here; the spectator page can
@@ -188,4 +188,5 @@ module.exports = {
   isAdmin,
   isLockdownAdmin,
   authenticate,
+  canBecomeSpectator,
 };

server/src/services/backupRestoreService/backup.js

@@ -109,6 +109,7 @@ async function copyDurableTree(sourceDir, destinationDir, relativeDir = '') {
     const relativePath = path.join(relativeDir, entry.name);
     if (!relativeDir && EXCLUDED_TOP_LEVEL_NAMES.has(entry.name)) continue;
     if (!relativeDir && DATABASE_FILES.has(entry.name)) continue;
+    if (relativePath === path.join('rover-learning', 'recordings')) continue;
     if (entry.isSymbolicLink()) throw new Error(`Backup cannot include symbolic link: ${relativePath}`);
     if (entry.isDirectory()) {
       skipped.push(...await copyDurableTree(sourceDir, destinationDir, relativePath));

server/src/services/batteryManager/index.js

@@ -4,6 +4,7 @@
 const logger = require('../../globals/logger').child('batteryManager');
 const { publishEvent } = require('../eventBus');
 const { managerEvents, lockRover, rovers } = require('../roverManager');
+const { issueCommand } = require('../commandService');
 
 const STATES = {
   NORMAL: 'normal',
@@ -29,6 +30,7 @@ function getState(roverId) {
       dockedCharging: false,
       charging: false,
       batteryLocked: false,
+      completionAnnounced: false,
       waitingSince: null,
     });
   }
@@ -61,6 +63,11 @@ function handleSensorEvent({ roverId, sensors, batteryState }) {
   }
   if (!state.urgent && batteryState?.urgentActive) {
     state.urgent = true;
+    try {
+      issueCommand(roverId, { type: 'song', song: { notes: [{ note: 72, duration: 8 }, { note: 0, duration: 8 }, { note: 72, duration: 16 }] } });
+    } catch (err) {
+      logger.warn('Failed to play urgent battery warning', { roverId, error: err.message });
+    }
     publishEvent({
       source: 'batteryManager',
       type: 'battery.urgent',
@@ -137,6 +144,18 @@ function handleSensorEvent({ roverId, sensors, batteryState }) {
     (batteryState?.charge != null && fullThreshold != null && batteryState.charge >= fullThreshold) ||
     (batteryState?.percent != null && batteryState.percent >= 0.99);
 
+  // Announce once per dock visit, independently of the charging lock. Keep the
+  // latch at 100% so small charge fluctuations cannot repeat the sound.
+  if (!onDock) state.completionAnnounced = false;
+  if (onDock && batteryState?.percentDisplay >= 100 && !state.completionAnnounced) {
+    state.completionAnnounced = true;
+    publishEvent({
+      source: 'batteryManager',
+      type: 'battery.chargeComplete',
+      payload: { roverId, batteryState },
+    });
+  }
+
   const needsCharge = state.warned;
 
   if (dockedCharging && lockable && needsCharge && !state.batteryLocked && !isFull && !waitingLongEnough) {

server/src/services/chatService/notifications.js

@@ -110,7 +110,7 @@ function maybeSpeak(socket, message, ttsOptions) {
     issueCommand(message.roverId, {
       type: 'tts',
       tts: {
-        text: message.text,
+        text: message.text.replace(/\b(?:https?:\/\/|www\.)\S{25,}[^\s.,!?;:"'()\[\]{}]/g, ' [link] '),
         engine: ttsOptions.engine,
         voice: ttsOptions.voice,
         pitch: ttsOptions.pitch,

server/src/services/chatService/textCommands.js

@@ -91,9 +91,9 @@ function createWebReplayTextCommand(socket, sendSystemMessage, replayApi) {
 
       const requester = buildRequesterLabel(socket);
       const jobId = buildReplayJobId('web-chat');
-      const attempt = replayApi.tryTriggerReplay({ by: { source: 'web-chat', requester } });
+      const attempt = replayApi.tryTriggerReplay({ jobId, by: { source: 'web-chat', requester } });
       if (!attempt.ok) {
-        await message.reply({ content: `Replay denied: cooldown active. Try again in ${Math.ceil(attempt.remainingMs / 1000)}s.` });
+        await message.reply({ content: `Replay denied: ${attempt.error}` });
         return;
       }
 

server/src/services/commandService/index.js

@@ -11,6 +11,7 @@ const logger = require('../../globals/logger').child('commandService');
 const { isHeadlightBlocked } = require('../../rewards/definitions/darkness');
 const homeAssistantService = require('../homeAssistantService');
 const overcurrentProtectionService = require('../overcurrentProtectionService');
+const { subscribeCommandRecording, observeCommand, recordCommandRequest } = require('./recording');
 
 // Command observations are intentionally separate from the global event bus.
 // Drive and motor commands can run at control-loop frequency, and publishing
@@ -84,7 +85,7 @@ function normalizeOutboundCommandPayload(payload = {}) {
   };
 }
 
-function issueCommand(roverId, payload) {
+function issueCommand(roverId, payload, options = {}) {
   const record = roverManager.rovers.get(roverId);
   if (!record || !record.ws) {
     throw new Error('Rover offline');
@@ -92,10 +93,16 @@ function issueCommand(roverId, payload) {
   if (payload?.type === 'laser' && isLaserCommandBlockedByRoomLightLock(payload)) {
     throw new Error('Laser disabled while room lights are locked on');
   }
+  if (options.dockingOwned && payload.driveDirect && getCommandMotionMagnitude('drive', payload) > 0
+    && Date.now() < (driveCooldowns.get(roverId) || 0)) {
+    throw new Error('Drive blocked: safety cooldown');
+  }
+  payload = require('../dockingService').protectCommand(record, payload, options);
   const id = uuidv4();
   const normalizedPayload = normalizeOutboundCommandPayload(payload);
   const message = { ...normalizedPayload, id };
   record.ws.send(JSON.stringify(message));
+  observeCommand({ phase: 'dispatched', roverId, commandId: id, command: normalizedPayload });
   pendingCommands.set(id, { roverId, ts: Date.now(), type: normalizedPayload.type });
   logger.info('Issued command', roverId, normalizedPayload.type, id);
   return id;
@@ -122,7 +129,14 @@ overcurrentProtectionService.configureCommandIssuer((roverId, payload) => {
     */
     return false;
   }
-  issueCommand(roverId, payload);
+  const record = roverManager.rovers.get(roverId);
+  const reverseAdjustment = payload.driveDirect
+    && (payload.driveDirect.left < 0 || payload.driveDirect.right < 0)
+    && payload.driveDirect.left <= 0 && payload.driveDirect.right <= 0
+    && require('../dockingService').canAdjustReverse(record);
+  // Only protection's adjustments to the active reverse inherit controller
+  // ownership. Zero remains an ordinary stop and cancels the sequence.
+  issueCommand(roverId, payload, { dockingOwned: Boolean(reverseAdjustment) });
   return true;
 });
 
@@ -130,6 +144,7 @@ function handleAck(msg) {
   const pending = pendingCommands.get(msg.id);
   if (!pending) return;
   pendingCommands.delete(msg.id);
+  observeCommand({ phase: 'acknowledged', roverId: pending.roverId, commandId: msg.id, acknowledgement: msg });
   logger.info('Command acknowledged', pending.roverId, pending.type, msg.status);
   io.emit('commandAck', {
     roverId: pending.roverId,
@@ -255,145 +270,172 @@ module.exports = {
   getRecentDriveActivity,
   setDriveCooldown,
   commandEvents,
+  subscribeCommandRecording,
+  submitCommand,
 };
 
-io.on('connection', (socket) => {
-  function handleCommand({ roverId, type, data } = {}, cb) {
-    const reply = typeof cb === 'function' ? cb : () => {};
-    try {
-      if (!roverId) {
-        throw new Error('roverId required');
+// Shared authorization/safety boundary for browser and service-owned control.
+function submitCommand(socket, { roverId, type, data } = {}, cb) {
+  const reply = typeof cb === 'function' ? cb : () => {};
+  try {
+    if (!roverId) {
+      throw new Error('roverId required');
+    }
+    if (!type) {
+      throw new Error('type required');
+    }
+    if (type === 'audioLevels') {
+      throw new Error('audioLevels command is service-managed');
+    }
+    let payload = data ? { ...data } : {};
+    if (type === 'headlight' && isHeadlightBlocked()) {
+      logger.info('Ignoring headlight command while darkness lock is active', { socketId: socket.id, roverId });
+      reply({ ignored: true, reason: 'darknessActive' });
+      return;
+    }
+    if (type === 'laser' && isLaserCommandBlockedByRoomLightLock(payload)) {
+      logger.info('Ignoring laser command while room lights are locked on', {
+        socketId: socket.id,
+        roverId,
+        action: getLaserAction(payload),
+      });
+      reply({ ignored: true, reason: 'roomLightsLockedOn' });
+      return;
+    }
+    const isRebootCommand = type === 'reboot';
+    const isUpdateCommand = type === 'update';
+    const isSongCommand = type === 'song' || (type === 'raw' && isSongRawPayload(payload));
+    const isAdminSocket = isAdmin(socket);
+    if (!isAdminSocket && isDeterred(socket)) {
+      throw new Error('Not authorized');
+    }
+    /*
+      Both structured song commands and raw Open Interface song payloads
+      reach this shared flag. Enforcing mute here covers the VIP MIDI beeper
+      and any future browser beeper without affecting unrelated driving.
+    */
+    if (!isAdminSocket && isSongCommand && isMuted(socket)) {
+      throw new Error('Muted');
+    }
+    // Rover updates run a privileged, root-owned helper on the Pi. Keep this
+    // in the same explicit admin-only branch as reboot instead of relying on
+    // drive ownership checks, because having a turn should not grant system
+    // maintenance privileges.
+    if ((isRebootCommand || isUpdateCommand) && !isAdminSocket) {
+      throw new Error('Not authorized');
+    }
+    if (!isSongCommand && !isRebootCommand && !isUpdateCommand && !roverManager.canDrive(roverId, socket)) {
+      throw new Error('Not your turn or no control');
+    }
+    const record = roverManager.rovers.get(roverId);
+    if (!record?.ws) throw new Error('Rover offline');
+    const docking = require('../dockingService');
+    // The controller owns wheel output during undocking. Discard all ordinary
+    // drive input, including neutral, before it can alter protection's intent.
+    if (docking.shouldIgnoreDriveInput(record, payload)) {
+      reply({ ignored: true, reason: 'undocking' });
+      return;
+    }
+    // Reject before recording held motor intent: otherwise a rejected input
+    // could be replayed by protection as soon as the docking lock is released.
+    if (!docking.intents.has(type)) {
+      const guarded = docking.protectCommand(record, { ...payload, type });
+      type = guarded.type;
+      payload = guarded;
+    }
+    const driveDirect = payload?.driveDirect;
+    if (type === 'drive' && driveDirect) {
+      if (!isAdminSocket) {
+        const safeDrive = roverManager.applyPrivateDriveSafety(roverId, socket, driveDirect);
+        if (safeDrive) {
+          payload.driveDirect = safeDrive;
+        }
       }
-      if (!type) {
-        throw new Error('type required');
-      }
-      if (type === 'audioLevels') {
-        throw new Error('audioLevels command is service-managed');
-      }
-      let payload = data ? { ...data } : {};
-      if (type === 'headlight' && isHeadlightBlocked()) {
-        logger.info('Ignoring headlight command while darkness lock is active', { socketId: socket.id, roverId });
-        reply({ ignored: true, reason: 'darknessActive' });
-        return;
+      const left = Number(payload?.driveDirect?.left);
+      const right = Number(payload?.driveDirect?.right);
+      const speed = Math.max(Math.abs(left), Math.abs(right));
+      if (!isAdminSocket) {
+        const blockedUntil = driveCooldowns.get(roverId);
+        if (blockedUntil && Date.now() < blockedUntil && speed > 0) {
+          const reason = isLockdownAdmin(socket)
+            ? 'Drive blocked: cooldown'
+            : 'Drive blocked: safety cooldown';
+          throw new Error(reason);
+        }
       }
-      if (type === 'laser' && isLaserCommandBlockedByRoomLightLock(payload)) {
-        logger.info('Ignoring laser command while room lights are locked on', {
+      if (speed > 0) {
+        let direction = 'turn';
+        if (left > 0 && right > 0) direction = 'forward';
+        if (left < 0 && right < 0) direction = 'backward';
+        lastDriveActivity.set(roverId, {
+          ts: Date.now(),
           socketId: socket.id,
-          roverId,
-          action: getLaserAction(payload),
-        });
-        reply({ ignored: true, reason: 'roomLightsLockedOn' });
-        return;
-      }
-      const isRebootCommand = type === 'reboot';
-      const isUpdateCommand = type === 'update';
-      const isSongCommand = type === 'song' || (type === 'raw' && isSongRawPayload(payload));
-      const isAdminSocket = isAdmin(socket);
-      if (!isAdminSocket && isDeterred(socket)) {
-        throw new Error('Not authorized');
-      }
-      /*
-        Both structured song commands and raw Open Interface song payloads
-        reach this shared flag. Enforcing mute here covers the VIP MIDI beeper
-        and any future browser beeper without affecting unrelated driving.
-      */
-      if (!isAdminSocket && isSongCommand && isMuted(socket)) {
-        throw new Error('Muted');
-      }
-      // Rover updates run a privileged, root-owned helper on the Pi. Keep this
-      // in the same explicit admin-only branch as reboot instead of relying on
-      // drive ownership checks, because having a turn should not grant system
-      // maintenance privileges.
-      if ((isRebootCommand || isUpdateCommand) && !isAdminSocket) {
-        throw new Error('Not authorized');
-      }
-      if (!isSongCommand && !isRebootCommand && !isUpdateCommand && !roverManager.canDrive(roverId, socket)) {
-        throw new Error('Not your turn or no control');
-      }
-      const driveDirect = payload?.driveDirect;
-      if (type === 'drive' && driveDirect) {
-        if (!isAdminSocket) {
-          const safeDrive = roverManager.applyPrivateDriveSafety(roverId, socket, driveDirect);
-          if (safeDrive) {
-            payload.driveDirect = safeDrive;
-          }
-        }
-        const left = Number(payload?.driveDirect?.left);
-        const right = Number(payload?.driveDirect?.right);
-        const speed = Math.max(Math.abs(left), Math.abs(right));
-        if (!isAdminSocket) {
-          const blockedUntil = driveCooldowns.get(roverId);
-          if (blockedUntil && Date.now() < blockedUntil && speed > 0) {
-            const reason = isLockdownAdmin(socket)
-              ? 'Drive blocked: cooldown'
-              : 'Drive blocked: safety cooldown';
-            throw new Error(reason);
-          }
-        }
-        if (speed > 0) {
-          let direction = 'turn';
-          if (left > 0 && right > 0) direction = 'forward';
-          if (left < 0 && right < 0) direction = 'backward';
-          lastDriveActivity.set(roverId, {
-            ts: Date.now(),
-            socketId: socket.id,
-            direction,
-            speed,
-            isAdmin: isAdminSocket,
-          });
-        }
-      }
-
-      if (type === 'drive' || type === 'motors') {
-        /*
-          Role is supplied at the command boundary because telemetry does not
-          identify the operator who produced the active motor intent. Admin and
-          lockdown commands therefore enter the service explicitly bypassed;
-          they are recorded for status visibility but are never scaled, blocked,
-          or countermanded by a later sensor frame.
-        */
-        payload = overcurrentProtectionService.protectCommand(roverId, type, payload, {
-          bypassed: isAdminSocket,
+          direction,
+          speed,
+          isAdmin: isAdminSocket,
         });
       }
-      const id = issueCommand(roverId, { type, ...payload });
-      commandEvents.emit('observation', {
-        ts: Date.now(),
-        roverId: String(roverId),
-        type,
-        commandId: id,
-        outcome: 'issued',
-        socketId: socket.id,
-        // Payloads are omitted deliberately: raw OI, TTS, and maintenance
-        // commands can carry arbitrary content. Their structured type/outcome
-        // supplies analytics without accidentally persisting secret material.
-      });
-      logger.info('Queued command', socket.id, roverId, type);
-      if (shouldRecordTurnActivity(type, payload)) {
-        try {
-          const { recordActivity } = require('../turnService');
-          recordActivity(roverId, socket.id);
-        } catch (err) {
-          // Activity recording is best-effort because command delivery should not fail if turn bookkeeping has a transient issue.
-        }
-      }
-      reply({ id });
-    } catch (err) {
-      logger.warn('Command rejected', socket.id, err.message);
-      commandEvents.emit('observation', {
-        ts: Date.now(),
-        roverId: roverId ? String(roverId) : null,
-        type: type || 'unknown',
-        outcome: 'rejected',
-        socketId: socket.id,
-        error: err.message,
-      });
-      reply({ error: err.message });
     }
-  }
 
-  socket.on('command', handleCommand);
-  socket.on('command:issue', handleCommand);
+    if (type === 'drive' || type === 'motors') {
+      /*
+        Role is supplied at the command boundary because telemetry does not
+        identify the operator who produced the active motor intent. Admin and
+        lockdown commands therefore enter the service explicitly bypassed;
+        they are recorded for status visibility but are never scaled, blocked,
+        or countermanded by a later sensor frame.
+      */
+      payload = overcurrentProtectionService.protectCommand(roverId, type, payload, {
+        bypassed: isAdminSocket,
+      });
+    }
+    const isDockingIntent = docking.intents.has(type);
+    const id = isDockingIntent
+      ? docking.issueIntent(roverManager.rovers.get(roverId), type, payload, socket)
+      : issueCommand(roverId, { ...payload, type });
+    if (isDockingIntent) {
+      // The server acknowledges accepting the intent; telemetry reports its completion.
+      io.emit('commandAck', { roverId, id, status: 'ok' });
+    }
+    commandEvents.emit('observation', {
+      ts: Date.now(),
+      roverId: String(roverId),
+      type,
+      commandId: id,
+      outcome: 'issued',
+      socketId: socket.id,
+      // Payloads are omitted deliberately: raw OI, TTS, and maintenance
+      // commands can carry arbitrary content. Their structured type/outcome
+      // supplies analytics without accidentally persisting secret material.
+    });
+    logger.info('Queued command', socket.id, roverId, type);
+    if (shouldRecordTurnActivity(type, payload)) {
+      try {
+        const { recordActivity } = require('../turnService');
+        recordActivity(roverId, socket.id);
+      } catch (err) {
+        // Activity recording is best-effort because command delivery should not fail if turn bookkeeping has a transient issue.
+      }
+    }
+    reply({ id });
+  } catch (err) {
+    logger.warn('Command rejected', socket.id, err.message);
+    commandEvents.emit('observation', {
+      ts: Date.now(),
+      roverId: roverId ? String(roverId) : null,
+      type: type || 'unknown',
+      outcome: 'rejected',
+      socketId: socket.id,
+      error: err.message,
+    });
+    reply({ error: err.message });
+  }
+}
+
+io.on('connection', (socket) => {
+  const recordedCommand = (request, reply) => recordCommandRequest(socket, request, reply, (message, cb) => submitCommand(socket, message, cb));
+  socket.on('command', recordedCommand);
+  socket.on('command:issue', recordedCommand);
 
   socket.on('command:updateAllRovers', (_payload = {}, cb) => {
     const reply = typeof cb === 'function' ? cb : () => {};

server/src/services/commandService/recording.js

@@ -0,0 +1,55 @@
+// Optional detailed command observation, separate from payload-free analytics.
+// Subscribers must only enqueue work; recorder failures cannot fail a command.
+const { AsyncLocalStorage } = require('node:async_hooks');
+const { randomUUID } = require('node:crypto');
+
+const observers = new Set();
+const requests = new AsyncLocalStorage();
+
+function subscribeCommandRecording(observer) {
+  observers.add(observer);
+  return () => observers.delete(observer);
+}
+
+function observeCommand(event) {
+  if (!observers.size) return;
+  const scope = requests.getStore();
+  const context = scope?.active ? scope.context : null;
+  for (const observer of observers) {
+    try {
+      // Snapshot before safety code or a caller mutates a nested payload. Each
+      // subscriber receives its own copy and cannot change command delivery.
+      observer(structuredClone({
+        ts: Date.now(),
+        monotonicNs: process.hrtime.bigint().toString(),
+        source: context ? 'client' : 'server',
+        ...context,
+        ...event,
+      }));
+    } catch {
+      // Recording is deliberately best-effort at this boundary. The owning
+      // recorder reports its storage health independently of driver replies.
+    }
+  }
+}
+
+function recordCommandRequest(socket, request, reply, execute, source = 'client') {
+  if (!observers.size) return execute(request, reply);
+  const context = { requestId: randomUUID(), socketId: socket.id, userId: socket.data?.userId || null, source };
+  const scope = { active: true, context };
+  return requests.run(scope, () => {
+    try {
+      observeCommand({ phase: 'requested', roverId: request?.roverId, command: request });
+      return execute(request, (result) => {
+        observeCommand({ phase: 'result', roverId: request?.roverId, result });
+        if (typeof reply === 'function') reply(result);
+      });
+    } finally {
+      // The command handler is synchronous. A safety timer created inside it
+      // inherits async context but its later commands are server actions.
+      scope.active = false;
+    }
+  });
+}
+
+module.exports = { subscribeCommandRecording, observeCommand, recordCommandRequest };

server/src/services/discordBotService/batteryEmbeds.js

@@ -2,6 +2,7 @@
 // Purpose: Centralizes rover battery/status snapshot formatting and embed rendering for Discord surfaces.
 // Scope: Shared presentation logic for status commands and admin alert battery event posts.
 const { EmbedBuilder } = require('discord.js');
+const { getMode } = require('../modeManager');
 
 function formatVoltage(voltageMv) {
   if (voltageMv == null) return 'n/a';
@@ -69,6 +70,7 @@ function buildRoverStatusSnapshot(record) {
 
 function buildBatteryStatusEmbed({ color = 0x2196f3, records = [] }) {
   const embed = new EmbedBuilder().setTitle('Rover Battery Status').setColor(color).setTimestamp(new Date());
+  embed.addFields({ name: 'Server mode', value: getMode(), inline: true });
   const snapshots = records.map((entry) => buildRoverStatusSnapshot(entry)).filter(Boolean);
   if (!snapshots.length) {
     embed.setDescription('No rovers online.');

server/src/services/discordBotService/commands/replay.js

@@ -1,6 +1,6 @@
 // Discord Replay Command
 // Purpose: Handles replay capture requests from Discord through the shared replay job/status workflow.
-// Scope: Resolves sources, enforces cooldowns, reports job progress, uploads video, and broadcasts media URLs.
+// Scope: Resolves sources, enforces replay availability, reports job progress, uploads video, and broadcasts media URLs.
 const { AttachmentBuilder } = require('discord.js');
 const io = require('../../../globals/io');
 const { hostReplay } = require('../../replayMediaService');
@@ -60,12 +60,6 @@ function createReplayCommand({
       return;
     }
 
-    const attempt = tryTriggerReplay({ by: message.author?.id || null, source: 'discord' });
-    if (!attempt.ok) {
-      await replyDenied(message, `Replay denied: cooldown active. Try again in ${Math.ceil(attempt.remainingMs / 1000)}s.`);
-      return;
-    }
-
     const requester = message.member?.nickname || message.author?.globalName || message.author?.username || 'Discord';
     const job = createReplayJob({
       id: buildReplayJobId('discord'),
@@ -74,17 +68,23 @@ function createReplayCommand({
       sources: resolved.sources || [],
       includeSidebar: true,
     });
-    jobStatus.emit(job, 'accepted', { message: buildAcceptedMessage(job) });
-
-    const progressMessage = await message.reply({
-      content: sanitizeMentions(buildAcceptedMessage(job)),
-      allowedMentions: DEFAULT_ALLOWED_MENTIONS,
-    });
-    const stopTyping = startDiscordTypingLoop(message.channel, logger, 'discord replay command');
+    const attempt = tryTriggerReplay({ jobId: job.id, by: { source: 'discord', requester } });
+    if (!attempt.ok) {
+      await replyDenied(message, `Replay denied: ${attempt.error}`);
+      return;
+    }
 
+    let progressMessage = null;
+    let stopTyping = () => {};
     let builtReplay = null;
     let deliveredMedia = null;
     try {
+      jobStatus.emit(job, 'accepted', { message: buildAcceptedMessage(job) });
+      progressMessage = await message.reply({
+        content: sanitizeMentions(buildAcceptedMessage(job)),
+        allowedMentions: DEFAULT_ALLOWED_MENTIONS,
+      });
+      stopTyping = startDiscordTypingLoop(message.channel, logger, 'discord replay command');
       jobStatus.emit(job, 'building', { message: buildStatusMessage(job, 'building') });
       if (progressMessage?.edit) {
         await progressMessage.edit({ content: sanitizeMentions(buildStatusMessage(job, 'building')), allowedMentions: DEFAULT_ALLOWED_MENTIONS });

server/src/services/dockingService/index.js

@@ -0,0 +1,302 @@
+// Server-owned docking operations.
+const { v4: uuidv4 } = require('uuid');
+const io = require('../../globals/io');
+const logger = require('../../globals/logger').child('dockingService');
+const states = new WeakMap();
+const intents = new Set(['enterDocking', 'cancelDocking', 'undock']);
+const ASSIST_SPEED = 60;
+const SENSOR_TIMEOUT_MS = 1500;
+const UNDOCK_TIMEOUT_MS = 4000;
+const REVERSE_TIMEOUT_MS = 1000;
+// Preserve the working OI preparation sequence; only backing away is sensor-driven.
+const MODE_COMMAND_DELAY_MS = 100;
+const FULL_MODE_SETTLE_MS = 300;
+
+function stateFor(record) {
+  if (!states.has(record)) {
+    states.set(record, {
+      contact: null, charging: false, latched: false, assist: false,
+      operation: null, error: null, seenAt: 0, timer: null, contactDockPending: false,
+    });
+  }
+  return states.get(record);
+}
+
+function snapshot(record) {
+  const state = stateFor(record);
+  return {
+    phase: state.operation ? 'undocking' : state.contact ? (state.charging ? 'charging' : 'docked') : state.assist ? 'assisting' : 'idle',
+    movementLocked: Boolean(state.operation || state.latched || state.error || state.contact == null),
+    cameraLocked: state.assist,
+    error: state.error,
+  };
+}
+
+function publish(record) {
+  if (!record.lastSensor?.decoded) return;
+  record.lastSensor.decoded = { ...record.lastSensor.decoded, docking: snapshot(record) };
+  // State transitions use the same telemetry event, including failures when the
+  // physical sensor stream has stalled. Never manufacture a new sensor timestamp.
+  io.to(record.room).emit('sensorFrame', {
+    roverId: record.id, frame: record.lastSensor.raw, sensors: record.lastSensor.decoded,
+    overcurrentProtection: record.lastOvercurrentProtection || null,
+  });
+}
+
+function send(record, payload) {
+  return require('../commandService').issueCommand(record.id, payload, { dockingOwned: true });
+}
+function stop(record) {
+  // Forget the previous held intent so protection cannot replay it after unlock.
+  require('../overcurrentProtectionService').protectCommand(record.id, 'drive', { driveDirect: { left: 0, right: 0 } });
+  send(record, { type: 'drive', driveDirect: { left: 0, right: 0 } });
+}
+function stopAllMotion(record) {
+  stop(record);
+  const payload = { motorPwm: { main: 0, side: 0, vacuum: 0 } };
+  require('../overcurrentProtectionService').protectCommand(record.id, 'motors', payload);
+  send(record, { type: 'motors', ...payload });
+}
+function mode(record, opcode) {
+  send(record, { type: 'raw', raw: Buffer.from([opcode]).toString('base64') });
+}
+function camera(record, angle) {
+  if (record.meta?.cameraServo?.enabled) send(record, { type: 'servo', servo: { angle } });
+}
+function song(record, notes, slot = 0, duration = 10) {
+  send(record, { type: 'song', song: { slot, notes: notes.map((note) => ({ note, duration })) } });
+}
+function finishAssist(record, { playExitSong = true } = {}) {
+  const state = stateFor(record);
+  if (!state.assist) return;
+  state.assist = false;
+  camera(record, 0);
+  if (playExitSong) song(record, [83, 76]);
+}
+function clearOperation(state) {
+  clearTimeout(state.timer);
+  state.timer = null;
+  state.operation = null;
+}
+function fail(record, code, message) {
+  const state = stateFor(record);
+  clearOperation(state);
+  state.error = { code, message };
+  state.latched = true;
+  try { stop(record); } catch (error) {
+    logger.warn('Unable to stop docking operation', { roverId: record.id, error: error.message });
+  }
+  publish(record);
+}
+function armDeadline(record) {
+  const state = stateFor(record);
+  clearTimeout(state.timer);
+  if (!state.operation) return;
+  const deadline = Math.min(
+    state.seenAt + SENSOR_TIMEOUT_MS,
+    state.operation.startedAt + UNDOCK_TIMEOUT_MS,
+    state.operation.reversingAt ? state.operation.reversingAt + REVERSE_TIMEOUT_MS : Infinity,
+  );
+  state.timer = setTimeout(() => {
+    const stale = Date.now() - state.seenAt >= SENSOR_TIMEOUT_MS;
+    fail(record, stale ? 'telemetryUnavailable' : 'undockTimeout', stale ? 'Rover telemetry stopped during undocking.' : 'Unable to leave the dock.');
+  }, Math.max(1, deadline - Date.now()));
+  state.timer.unref?.();
+}
+
+function handleIntent(record, type, payload, socket) {
+  const state = stateFor(record);
+  if (type === 'cancelDocking') {
+    if (state.operation) fail(record, 'undockCancelled', 'Undocking stopped.');
+    stop(record);
+    finishAssist(record);
+    publish(record);
+    return;
+  }
+  state.error = null;
+  state.contactDockPending = false;
+  require('../roverManager').stopDockGuard(record.id);
+  stop(record);
+  if (type === 'enterDocking') {
+    state.latched = false;
+    if (!state.assist) {
+      state.assist = true;
+      camera(record, record.meta?.cameraServo?.minAngle ?? -45);
+      song(record, [76, 83]);
+    }
+  } else {
+    finishAssist(record);
+    camera(record, 0);
+    state.operation = {
+      startedAt: Date.now(), socket, backoff: payload.backoff !== false, reversing: false,
+      stage: 'start', nextStepAt: Date.now() + MODE_COMMAND_DELAY_MS,
+    };
+    mode(record, 128);
+    armDeadline(record);
+  }
+  publish(record);
+}
+
+function processTelemetry(record, sensors) {
+  const state = stateFor(record);
+  if (!sensors?.chargingSources || !sensors?.oiMode) return snapshot(record);
+  const previousContact = state.contact;
+  state.seenAt = Date.now();
+  state.contact = Boolean(sensors.chargingSources.homeBase);
+  state.charging = [1, 2, 3, 4].includes(sensors.chargingState?.code);
+  if (previousContact == null) state.latched = state.contact;
+  try {
+    const operation = state.operation;
+    if (operation) {
+      const manager = require('../roverManager');
+      if (!operation.socket?.connected || !manager.canDrive(record.id, operation.socket)) {
+        fail(record, 'controlLost', 'Undocking stopped because control changed.');
+      } else if (Date.now() - operation.startedAt >= UNDOCK_TIMEOUT_MS
+        || (operation.reversingAt && Date.now() - operation.reversingAt >= REVERSE_TIMEOUT_MS)) {
+        fail(record, 'undockTimeout', 'Unable to leave the dock.');
+      } else if (Date.now() < operation.nextStepAt) {
+        // Advance only on fresh telemetry, after the previous OI command settles.
+      } else if (operation.stage === 'start') {
+        mode(record, 143);
+        operation.stage = 'dock';
+        operation.nextStepAt = Date.now() + MODE_COMMAND_DELAY_MS;
+      } else if (operation.stage === 'dock') {
+        mode(record, 132);
+        operation.stage = 'full';
+        operation.nextStepAt = Date.now() + FULL_MODE_SETTLE_MS;
+      } else if (sensors.oiMode.label === 'full') {
+        if (!state.contact || !operation.backoff) {
+          stop(record);
+          clearOperation(state);
+          state.latched = state.contact;
+        } else if (!operation.reversing) {
+          operation.reversing = true;
+          operation.reversingAt = Date.now();
+          const speed = Math.max(1, Math.min(500, Number(record.meta?.maxWheelSpeed) || 500));
+          // Track the controller's own intent in existing protection so stalls
+          // still stop it and subsequent adjustments refer to this reverse only.
+          const drive = require('../overcurrentProtectionService').protectCommand(record.id, 'drive', {
+            driveDirect: { left: -speed, right: -speed },
+          }, { bypassed: require('../roleService').isAdmin(operation.socket) });
+          if (!drive.driveDirect.left && !drive.driveDirect.right) throw new Error('Undocking blocked by wheel protection');
+          send(record, { ...drive, type: 'drive' });
+        }
+      } else if (operation.reversing) {
+        fail(record, 'modeChanged', 'Undocking stopped because the Roomba mode changed.');
+      }
+      armDeadline(record);
+    } else if (state.contact) {
+      state.latched = true;
+      if (previousContact !== true) {
+        stopAllMotion(record);
+        state.contactDockPending = true;
+        if (state.assist) song(record, [84], 1, 6);
+      } else if (state.contactDockPending && !state.charging) {
+        const speeds = sensors.wheelSpeedsMmPerSecond;
+        // A stop request does not prove the wheels stopped on the contacts.
+        // Require a subsequent frame with contact and measured stationary wheels.
+        if (speeds?.left === 0 && speeds?.right === 0) {
+          mode(record, 143);
+          state.contactDockPending = false;
+        }
+      }
+      if (state.charging) {
+        state.contactDockPending = false;
+        // An immediate exit song would replace the contact beep on the Roomba.
+        finishAssist(record, { playExitSong: false });
+      }
+    } else {
+      state.contactDockPending = false;
+      if (previousContact === true && state.assist) song(record, [72], 1, 6);
+    }
+  } catch (error) {
+    fail(record, 'commandFailed', error.message);
+  }
+  return snapshot(record);
+}
+
+function shouldIgnoreDriveInput(record, payload) {
+  if (!stateFor(record).operation) return false;
+  if (payload.driveDirect) return true;
+  const raw = payload.raw ? Buffer.from(payload.raw, 'base64') : null;
+  return Boolean(raw && [137, 145].includes(raw[0]));
+}
+
+function protectCommand(record, payload, { dockingOwned = false } = {}) {
+  if (dockingOwned) return payload;
+  const state = stateFor(record);
+  // Raw OI drive packets must obey the same movement lock. Other raw commands,
+  // including mode changes, remain available and can interrupt the operation.
+  const raw = payload.raw ? Buffer.from(payload.raw, 'base64') : null;
+  if (state.operation && raw && [128, 131, 132, 133, 134, 135, 136, 143].includes(raw[0])) {
+    // Explicit mode commands remain available and take precedence over an
+    // automatic sequence, including while it is still waiting for full mode.
+    fail(record, 'modeChanged', 'Undocking stopped by a Roomba mode command.');
+  }
+  if (raw && [137, 145].includes(raw[0])) {
+    if (raw.length !== 5) throw new Error('Invalid raw drive command');
+    const first = raw.readInt16BE(1);
+    const second = raw.readInt16BE(3);
+    if (raw[0] === 137 && first !== 0 && state.assist && !snapshot(record).movementLocked) {
+      const limited = Buffer.from(raw);
+      limited.writeInt16BE(Math.max(-ASSIST_SPEED, Math.min(ASSIST_SPEED, first)), 1);
+      return { ...payload, raw: limited.toString('base64') };
+    }
+    if (raw[0] === 145) {
+      return protectCommand(record, { type: 'drive', driveDirect: { left: second, right: first } });
+    }
+    if (first === 0 && state.operation) fail(record, 'undockStopped', 'Undocking stopped by a stop command.');
+    if (first !== 0 && snapshot(record).movementLocked) throw new Error('Drive blocked while docked or undocking');
+  }
+  // User drive input is discarded at submitCommand before reaching here.
+  // Internal safety stops still interrupt the controller through this path.
+  if (payload.driveDirect) {
+    const { left, right } = payload.driveDirect;
+    if (!Number(left) && !Number(right) && state.operation) {
+      fail(record, 'undockStopped', 'Undocking stopped by a stop command.');
+    }
+    if ((Number(left) || Number(right)) && snapshot(record).movementLocked) throw new Error('Drive blocked while docked or undocking');
+    if (state.assist) {
+      const scale = Math.min(1, ASSIST_SPEED / Math.max(Math.abs(left), Math.abs(right), 1));
+      return { ...payload, driveDirect: { left: Math.round(left * scale), right: Math.round(right * scale) } };
+    }
+  }
+  if (payload.servo && state.assist) throw new Error('Camera locked during dock assist');
+  return payload;
+}
+
+function disconnect(record) {
+  const state = stateFor(record);
+  if (state.operation) fail(record, 'roverDisconnected', 'Rover disconnected during undocking.');
+  clearOperation(state);
+  state.seenAt = 0;
+  state.contact = null;
+  state.assist = false;
+}
+
+function canAdjustReverse(record) {
+  return Boolean(record && stateFor(record).operation?.reversing);
+}
+
+function issueIntent(record, type, payload, socket) {
+  const state = stateFor(record);
+  // Validate before mutating, so duplicate/rejected requests cannot disturb an
+  // operation that is already in progress.
+  if (type !== 'cancelDocking') {
+    if (state.operation) throw new Error('Undocking is already in progress');
+    if (Date.now() - state.seenAt >= SENSOR_TIMEOUT_MS || state.contact == null) {
+      throw new Error('Waiting for current rover telemetry');
+    }
+    // Already at the requested destination; acknowledge without restarting assist.
+    if (type === 'enterDocking' && state.contact) return uuidv4();
+  }
+  const id = uuidv4();
+  try {
+    handleIntent(record, type, payload, socket);
+  } catch (error) {
+    fail(record, 'commandFailed', error.message);
+    throw error;
+  }
+  return id;
+}
+module.exports = { shouldIgnoreDriveInput, canAdjustReverse, snapshot, intents, issueIntent, processTelemetry, protectCommand, disconnect };

server/src/services/embedHttpService/index.js

@@ -16,7 +16,7 @@ const { renderIndexHtml, renderOgImage, renderWebManifest } = require('../embedS
   a direct browser load. Keeping the setup and admin routes in this explicit
   allowlist prevents them from working only after client-side navigation.
 */
-app.get(['/', '/old', '/spectate', '/mini', '/display', '/scanner', '/database', '/ptz', '/reports', '/setup', '/admin'], async (req, res) => {
+app.get(['/', '/old', '/spectate', '/mini', '/display', '/scanner', '/database', '/ptz', '/reports', '/setup', '/admin', '/mic'], async (req, res) => {
   try {
     const html = await renderIndexHtml(req);
     res.type('html').send(html);

server/src/services/homeAssistantActivitiesService/actions.js

@@ -1,5 +1,4 @@
-// User and idle commands share one dispatch contract, while only the trusted
-// idle entry point can bypass per-item user locks.
+// User and automated commands share validation; only trusted automation bypasses user permissions.
 const { buildEntity, buildCommand } = require('./entityHelpers');
 
 function assertAccess(actor = {}) {
@@ -9,13 +8,14 @@ function assertAccess(actor = {}) {
 }
 
 function createActions({ getConfig, ha, locks }) {
-  async function execute(id, value, actor, idle = false) {
-    if (!idle) assertAccess(actor);
+  async function execute(id, value, actor, automated = false) {
+    if (!automated) assertAccess(actor);
     const config = getConfig();
     if (!config.enabled) throw new Error('Activity Controls are disabled');
     const item = config.items.find((entry) => entry.id === id);
     if (!item) throw new Error('Unknown activity item');
-    if (!idle && locks.isLocked(id) && !['admin', 'lockdown'].includes(actor.role)) throw new Error('This item is locked');
+    if (!automated && locks.isLocked(id) && !['admin', 'lockdown'].includes(actor.role)) throw new Error('This item is locked');
+    if (!automated && item.readOnly && !['admin', 'lockdown'].includes(actor.role)) throw new Error('This item is read-only for users');
     if (!ha.enabled || !ha.isConnected()) throw new Error('Home Assistant is offline');
     const entity = buildEntity(item, ha.getRawEntitySnapshot(id));
     if (!entity.available) throw new Error('This item is unavailable');
@@ -25,30 +25,34 @@ function createActions({ getConfig, ha, locks }) {
     await ha.callHomeAssistantService(entity.domain, command.service, command.data);
   }
 
-  async function runIdleActions() {
+  async function runAutomation(trigger, shouldRun = () => true) {
     const config = getConfig();
-    if (!config.enabled) return { action: 'homeAssistantActivitiesIdle', skipped: true };
+    if (!config.enabled) return { action: trigger, skipped: true };
     const results = [];
     // Catch per item so one offline integration cannot prevent the remaining
-    // configured cleanup actions from running during this idle window.
+    // configured actions from running for this trigger.
     for (const item of config.items) {
-      if (!item.idleAction || item.idleAction === 'unchanged' || item.readOnly) continue;
+      // Stop remaining writes if presence or mode changed while HA was responding.
+      if (!shouldRun()) break;
+      const setting = item.automations?.[trigger];
+      if (!setting?.action || setting.action === 'unchanged') continue;
       try {
         const entity = buildEntity(item, ha.getRawEntitySnapshot(item.id));
         if (entity.type === 'readOnly') continue;
-        if ((item.idleAction === 'press') !== (entity.type === 'button')) throw new Error('Idle action does not match the control type');
+        if ((setting.action === 'press') !== (entity.type === 'button')) throw new Error('Automation action does not match the control type');
         // The admin form omits an empty optional string. Treat that as empty
         // text so clearing a message works; other types still reject it through
         // their normal value validation rather than silently receiving zero.
-        await execute(item.id, item.idleAction === 'press' ? 'press' : (item.idleValue ?? ''), null, true);
+        await execute(item.id, setting.action === 'press' ? 'press' : (setting.value ?? ''), null, true);
         results.push({ id: item.id, ok: true });
       } catch (error) {
         results.push({ id: item.id, ok: false, error: error.message });
       }
     }
-    return { action: 'homeAssistantActivitiesIdle', results };
+    return { action: trigger, results };
   }
-  return { act: (id, value, actor) => execute(id, value, actor), runIdleActions };
+  return { act: (id, value, actor) => execute(id, value, actor), runAutomation,
+    runIdleActions: () => runAutomation('idle') };
 }
 
 module.exports = { createActions, assertAccess };

server/src/services/homeAssistantActivitiesService/activities.test.js

@@ -29,7 +29,7 @@ test('sensor states, live constraints, and unknown button states are preserved',
   assert.equal(buildEntity({ id: 'button.bell' }, raw('unknown')).available, true);
   assert.equal(buildEntity({ id: 'button.bell' }, raw('unavailable')).available, false);
   assert.equal(buildEntity({ id: 'button.bell' }, null).available, false);
-  assert.equal(buildEntity({ id: 'switch.fan', readOnly: true }, raw('on')).type, 'readOnly');
+  assert.equal(buildEntity({ id: 'switch.fan', readOnly: true }, raw('on')).type, 'toggle');
 });
 
 test('domain dispatch handles native entities and helpers without room-light payloads', async () => {
@@ -87,22 +87,22 @@ test('permissions, locks, availability and allowlist are authoritative', async (
 test('idle ignores user locks, preserves no-op items, and isolates failures', async () => {
   const h = harness([
     { id: 'switch.keep' },
-    { id: 'number.bad', idleAction: 'set', idleValue: '200' },
-    { id: 'switch.fan', idleAction: 'set', idleValue: 'off' },
+    { id: 'number.bad', automations: { idle: { action: 'set', value: '200' } } },
+    { id: 'switch.fan', automations: { idle: { action: 'set', value: 'off' } } },
     // An empty optional text box is omitted by the schema-driven admin form.
-    { id: 'input_text.message', idleAction: 'set' },
-    { id: 'input_button.stop', idleAction: 'press' },
-    { id: 'sensor.humidity', idleAction: 'set', idleValue: '0' },
-    { id: 'switch.readonly', readOnly: true, idleAction: 'set', idleValue: 'off' },
+    { id: 'input_text.message', automations: { idle: { action: 'set' } } },
+    { id: 'input_button.stop', automations: { idle: { action: 'press' } } },
+    { id: 'sensor.humidity', automations: { idle: { action: 'set', value: '0' } } },
+    { id: 'switch.readonly', readOnly: true, automations: { idle: { action: 'set', value: 'off' } } },
   ], {
-    'number.bad': raw('0', { min: 0, max: 10 }), 'switch.fan': raw('on'),
+    'switch.readonly': raw('on'), 'number.bad': raw('0', { min: 0, max: 10 }), 'switch.fan': raw('on'),
     'input_text.message': raw('Welcome', { min: 0, max: 30 }), 'input_button.stop': raw('unknown'),
   });
   h.locked.add('switch.fan');
   const result = await h.actions.runIdleActions();
   assert.equal(result.results[0].ok, false);
-  assert.equal(result.results.filter((entry) => entry.ok).length, 3);
-  assert.deepEqual(h.calls.map((call) => call[2]), [{ entity_id: 'switch.fan' }, { entity_id: 'input_text.message', value: '' }, { entity_id: 'input_button.stop' }]);
+  assert.equal(result.results.filter((entry) => entry.ok).length, 4);
+  assert.deepEqual(h.calls.map((call) => call[2]), [{ entity_id: 'switch.fan' }, { entity_id: 'input_text.message', value: '' }, { entity_id: 'input_button.stop' }, { entity_id: 'switch.readonly' }]);
 });
 
 test('an outstanding service response does not block later commands', async () => {

server/src/services/homeAssistantActivitiesService/configuration.js

@@ -2,6 +2,14 @@
 // never acquire unrelated devices simply because they share a connection.
 const { strictObject, string, boolean } = require('../../configuration/schemaHelpers');
 
+// All triggers use the same inputs so the admin form and execution contract agree.
+function automation(title, description) {
+  return strictObject({
+    action: string({ title: 'Action', enum: ['unchanged', 'set', 'press'], default: 'unchanged' }),
+    value: string({ title: 'Value', description: 'For set: on/off, a number, exact selection, or text. Empty text clears it. Ignored for press.', maxLength: 255 }),
+  }, { title, description });
+}
+
 module.exports = {
   key: 'homeAssistantActivities',
   feature: true,
@@ -18,9 +26,12 @@ module.exports = {
         icon: string({ description: 'Font Awesome name, as used by social links. Blank or invalid names use a fallback.', maxLength: 80, examples: ['FaFan'] }),
         // Match social-link colors so admins can customize tiles through the existing config form.
         color: string({ description: 'Optional six-digit hexadecimal tile color, like social links.', examples: ['#3B82F6'], pattern: '^#[0-9a-fA-F]{6}$' }),
-        readOnly: boolean({ title: 'Read only', default: false, description: 'Display the value without allowing user or idle commands.' }),
-        idleAction: string({ title: 'When idle', enum: ['unchanged', 'set', 'press'], default: 'unchanged', description: 'Leave unchanged, set the idle value, or press a button once. Runs independently of user locks.' }),
-        idleValue: string({ title: 'Idle value', description: 'For set: on/off, a number, exact selection, or text (empty text clears it). Checked against live entity limits when idle runs.', examples: ['0'], maxLength: 255 }),
+        readOnly: boolean({ title: 'Read only for users', default: false, description: 'Ordinary users can only view this item. Admins and automations can still change supported controls.' }),
+        automations: strictObject({
+          idle: automation('When idle', 'Runs after the idle timeout with no users or admins online.'),
+          locked: automation('When server locked', 'Runs on entering admin or lockdown mode.'),
+          online: automation('When users online', 'Runs when a user or admin comes online, or the server reopens with one online. Suppressed in admin and lockdown modes. Spectators do not count.'),
+        }, { title: 'Automations', description: 'One-time actions that bypass item locks and read-only permissions.' }),
       }, { description: 'One independently controlled or read-only activity control item.', required: ['id'] }),
     },
   }, { title: 'Activity Controls', description: 'Generic activity controls and idle behavior, separate from room lighting.', required: ['enabled', 'items'] }),

server/src/services/homeAssistantActivitiesService/entityHelpers.js

@@ -9,7 +9,8 @@ const TYPES = {
 function buildEntity(item, raw, locked = false) {
   const attributes = raw?.attributes || {};
   const domain = item.id.split('.')[0];
-  const type = item.readOnly ? 'readOnly' : TYPES[domain] || 'readOnly';
+  // Read-only is a user permission, not an entity capability: admins and automation still need its write type.
+  const type = TYPES[domain] || 'readOnly';
   // A never-pressed button legitimately reports unknown. Its state is a last
   // press timestamp, not availability or a boolean toggle state.
   const available = Boolean(raw && raw.state !== 'unavailable' && (raw.state !== 'unknown' || type === 'button'));
@@ -17,7 +18,7 @@ function buildEntity(item, raw, locked = false) {
   return {
     id: item.id, name: item.name?.trim() || attributes.friendly_name || item.id,
     // Include presentation settings in session state so all clients share the configured color.
-    icon: item.icon || '', color: item.color || '', domain, type, locked, available,
+    icon: item.icon || '', color: item.color || '', domain, type, readOnly: Boolean(item.readOnly), locked, available,
     state: raw?.state ?? 'unknown', unit: attributes.unit_of_measurement || '',
     min: numeric(attributes.min), max: numeric(attributes.max), step: numeric(attributes.step),
     options: Array.isArray(attributes.options) ? attributes.options.filter((option) => typeof option === 'string') : [],

server/src/services/homeAssistantActivitiesService/index.js

@@ -8,7 +8,7 @@ const { buildEntity } = require('./entityHelpers');
 const { createLocks, resolveItem } = require('./locks');
 const { createActions } = require('./actions');
 const { getRole } = require('../roleService');
-const { getMode } = require('../modeManager');
+const { getMode, modeEvents } = require('../modeManager');
 const logger = require('../../globals/logger').child('homeAssistantActivitiesService');
 
 const events = new EventEmitter();
@@ -24,6 +24,35 @@ const actions = createActions({ getConfig: () => config, ha: {
   callHomeAssistantService: ha.callHomeAssistantService,
 }, locks });
 
+let operatorsOnline = false;
+let lastAutomationState = null;
+let automationRevision = 0;
+
+function refreshAutomation() {
+  const mode = getMode();
+  const locked = mode === 'admin' || mode === 'lockdown';
+  // Remember transitions, not entity values: HA updates and extra connections
+  // must not repeatedly press buttons or undo a manual admin adjustment.
+  const state = config.enabled && snapshotReady && ha.isConnected()
+    ? (locked ? mode : operatorsOnline ? 'online' : null) : null;
+  if (state === lastAutomationState) return;
+  lastAutomationState = state;
+  const revision = ++automationRevision;
+  if (!state) return;
+  actions.runAutomation(locked ? 'locked' : 'online', () => revision === automationRevision)
+    .then((result) => {
+      const failures = result.results?.filter((item) => !item.ok) || [];
+      if (failures.length) logger.warn('Activity automation failed', { trigger: result.action, failures });
+    }).catch((error) => logger.warn('Activity automation failed', { error: error.message }));
+}
+
+function setOperatorsOnline(online) {
+  operatorsOnline = online;
+  refreshAutomation();
+}
+
+modeEvents.on('change', refreshAutomation);
+
 function getState() {
   return {
     enabled: config.enabled,
@@ -53,14 +82,17 @@ function setLocked(query, locked) {
 ha.homeAssistantEvents.on('snapshot', () => {
   snapshotReady = true;
   emitUpdate();
+  refreshAutomation();
 });
 ha.homeAssistantEvents.on('status', () => {
   snapshotReady = false;
   emitUpdate();
+  refreshAutomation();
 });
 registerConfigurationHandler('homeAssistantActivities', (next) => {
   config = next;
   emitUpdate();
+  refreshAutomation();
 });
 // Resolve access on the server for every command; clients only supply item/value.
 io.on('connection', (socket) => {
@@ -76,4 +108,7 @@ io.on('connection', (socket) => {
   });
 });
 
-module.exports = { ...actions, getState, setLocked, activityEvents: events };
+module.exports = { ...actions, getState, setLocked, setOperatorsOnline, activityEvents: events,
+  // A returning operator ends idle cleanup even if earlier HA calls are still settling.
+  runIdleActions: () => actions.runAutomation('idle', () => !operatorsOnline),
+};

server/src/services/idleService/index.js

@@ -4,11 +4,15 @@
 const logger = require('../../globals/logger').child('idleService');
 const io = require('../../globals/io');
 const { getRole, roleEvents } = require('../roleService');
+const { getMode, MODES, modeEvents } = require('../modeManager');
+const { isDeterred, verificationEvents } = require('../verificationService');
 const { IDLE_TIMEOUT_MS } = require('./constants');
 const { runtime } = require('./state');
 const { runIdleActions } = require('./actions');
+const activityControls = require('../homeAssistantActivitiesService');
 
 function getActivitySnapshot() {
+  const mode = getMode();
   let onlineUsers = 0;
   let onlineAdmins = 0;
   let onlineSpectators = 0;
@@ -28,12 +32,16 @@ function getActivitySnapshot() {
       return;
     }
 
-    /*
-      Lockdown admins are counted with regular admins because both represent a
-      person with operator-level access who may be supervising the room without
-      actively driving a rover. Plain users also count even before they request
-      control, which is the behavior this service now needs.
-    */
+
+    if (
+      isDeterred(socket)
+      || (mode === MODES.ADMIN && role !== 'admin' && role !== 'lockdown')
+      || (mode === MODES.LOCKDOWN && role !== 'lockdown')
+    ) {
+      onlineIgnored += 1;
+      return;
+    }
+
     if (role === 'admin' || role === 'lockdown') {
       onlineAdmins += 1;
       return;
@@ -89,7 +97,7 @@ function scheduleIdleTimer() {
     runtime.deadlineAt = null;
     const activity = getActivitySnapshot();
     if (activity.totalActive > 0) {
-      logger.info('Idle automation skipped; user or admin online', activity);
+      logger.info('Idle automation skipped; eligible operator online', activity);
       return;
     }
     runtime.lastTriggeredAt = Date.now();
@@ -113,16 +121,12 @@ function scheduleIdleTimer() {
 function refreshIdleState() {
   const activity = getActivitySnapshot();
   logger.info('Idle state refresh', activity);
+  activityControls.setOperatorsOnline(activity.totalActive > 0);
   if (activity.totalActive > 0) {
     clearIdleTimer();
     if (runtime.idleActionsCompleted) {
       logger.info('Idle action one-shot reset; operator is online again', activity);
     }
-    /*
-      A user/admin coming online starts a new activity window. When the room
-      later becomes idle again, the cleanup pipeline should be allowed to run
-      once for that new idle period.
-    */
     runtime.idleActionsCompleted = false;
     return;
   }
@@ -130,17 +134,13 @@ function refreshIdleState() {
 }
 
 io.on('connection', (socket) => {
-  /*
-    A user/admin can be online without ever touching rover controls, so socket
-    presence has to be a first-class idle signal. The disconnect hook is just as
-    important: it is what starts the idle timeout after the last non-spectator
-    leaves, even if no driving event happens around that departure.
-  */
   refreshIdleState();
   socket.on('disconnect', refreshIdleState);
 });
 
 roleEvents.on('change', refreshIdleState);
+modeEvents.on('change', refreshIdleState);
+verificationEvents.on('change', refreshIdleState);
 
 refreshIdleState();
 

server/src/services/interInstanceService/index.js

@@ -10,7 +10,8 @@ const { loadConfig, getFeatureFlags, registerConfigurationHandler } = require('.
 const { getConfiguredSocials } = require('../sessionService/configuration');
 const { getMode, MODES } = require('../modeManager');
 const roverManager = require('../roverManager');
-const { getTurnQueues } = require('../turnService');
+const { getTurnQueues, getActiveDrivers } = require('../turnService');
+const { buildRoverTurn } = require('../turnService/display');
 const { getRoomCameras, getRoomCameraState } = require('../roomCameraService');
 const { getRoverSnapshotState } = require('../roverSnapshotService');
 const { getRole } = require('../roleService');
@@ -157,22 +158,6 @@ function publicRoverIdSet(roster = []) {
   return new Set(roster.map((rover) => String(rover?.id || '')).filter(Boolean));
 }
 
-function filterPublicTurnQueues(turnQueues = {}, publicIds) {
-  const visible = publicIds instanceof Set ? publicIds : new Set();
-  const next = {};
-  /*
-    RoverQueuesPanel creates fallback rows for queue ids that are not present in
-    the roster, so the public payload must filter queues with the exact same
-    privacy boundary as the roster. Otherwise a closed-private rover can leak as
-    an orphan queue row after a private access grant assigns someone to it.
-  */
-  Object.entries(turnQueues || {}).forEach(([roverId, info]) => {
-    if (!visible.has(String(roverId))) return;
-    next[roverId] = info;
-  });
-  return next;
-}
-
 function filterPublicUsers(users = [], publicIds) {
   const visible = publicIds instanceof Set ? publicIds : new Set();
   /*
@@ -203,6 +188,8 @@ function buildLocalInfo() {
   const publicIds = publicRoverIdSet(publicRoster);
   const roster = publicRoster.map((rover) => (lockdown ? rover : addRoverSnapshotLinks(rover)));
   const users = filterPublicUsers(Array.from(io.sockets.sockets.values()).map(buildUserEntry), publicIds);
+  const turnQueues = getTurnQueues();
+  const activeDrivers = getActiveDrivers();
   const roomCameras = lockdown || !features.roomCameras ? [] : getRoomCameras().map(buildRoomCameraInfo);
   return {
     instance: {
@@ -212,8 +199,12 @@ function buildLocalInfo() {
       features,
       updatedAt: Date.now(),
     },
-    roster,
-    turnQueues: filterPublicTurnQueues(getTurnQueues(), publicIds),
+    // Only public roster entries reach the builder; queue metadata follows the
+    // same visibility boundary instead of creating separate orphan queue rows.
+    roster: roster.map((rover) => ({
+      ...rover,
+      turn: buildRoverTurn({ rover, mode, socketId: null, turnInfo: turnQueues[rover.id], activeDriverId: activeDrivers[rover.id], users }),
+    })),
     users,
     roomCameras,
     socials: features.socials ? getConfiguredSocials(config) : [],
@@ -349,7 +340,6 @@ function normalizeRemotePayload(entry, payload) {
       features: instance.features && typeof instance.features === 'object' ? instance.features : {},
     },
     roster: Array.isArray(payload?.roster) ? payload.roster : [],
-    turnQueues: payload?.turnQueues && typeof payload.turnQueues === 'object' ? payload.turnQueues : {},
     users: Array.isArray(payload?.users) ? payload.users : [],
     roomCameras: Array.isArray(payload?.roomCameras) ? payload.roomCameras : [],
     socials: Array.isArray(payload?.socials) ? payload.socials : [],
@@ -419,7 +409,6 @@ function markOffline(entry, error) {
       publicUrl: previous.instance?.publicUrl || entry.url,
     },
     roster: previous.roster || [],
-    turnQueues: previous.turnQueues || {},
     users: previous.users || [],
     roomCameras: previous.roomCameras || [],
     socials: previous.socials || [],

server/src/services/mediaMtxService/config.js

@@ -20,6 +20,7 @@ function normalizeAdditionalHosts(rawHosts) {
 
 function buildMediaMtxConfig({ config, serverPort, snapshotWriterPath }) {
   const media = config?.media || {};
+  const webrtcPort = media.webrtcPort ?? 8189;
   const configuredHosts = normalizeAdditionalHosts(media.additionalHosts);
   let publicHostname = '';
   try {
@@ -55,10 +56,10 @@ function buildMediaMtxConfig({ config, serverPort, snapshotWriterPath }) {
 
     webrtc: true,
     // WHEP and WHIP signaling is public only through the Node /video proxy.
-    // ICE transport on 8189 remains directly reachable by browsers.
+    // The configured ICE transport port remains directly reachable by browsers.
     webrtcAddress: '127.0.0.1:8889',
-    webrtcLocalUDPAddress: ':8189',
-    webrtcLocalTCPAddress: ':8189',
+    webrtcLocalUDPAddress: `:${webrtcPort}`,
+    webrtcLocalTCPAddress: `:${webrtcPort}`,
     webrtcAdditionalHosts: additionalHosts,
     webrtcICEServers2: [
       { url: 'stun:stun.l.google.com:19302' },
@@ -81,6 +82,7 @@ function buildMediaMtxConfig({ config, serverPort, snapshotWriterPath }) {
       { action: 'pprof' },
     ],
     paths: {
+      '~^room-audio/': { source: 'publisher' },
       all: {
         source: 'publisher',
         sourceOnDemand: false,

server/src/services/mediaMtxService/configuration.js

@@ -1,18 +1,24 @@
 // Media Transport Configuration
-// Purpose: Defines additional MediaMTX ICE hosts not already derived from the server's public URL.
+// Purpose: Defines the WebRTC media port and additional ICE hosts.
 // Scope: Contains configuration metadata only and never starts MediaMTX.
-const { strictObject, stringArray } = require('../../configuration/schemaHelpers');
+const { strictObject, stringArray, integer } = require('../../configuration/schemaHelpers');
 
 module.exports = {
   key: 'media',
   defaultValue: {
+    webrtcPort: 8189,
     additionalHosts: [],
   },
   schema: strictObject({
+    webrtcPort: integer({
+      title: 'WebRTC port',
+      description: 'UDP and TCP port for live media. Forward the same external port to this server; HTTPS signaling continues through the web UI.',
+      minimum: 1, maximum: 65535,
+    }),
     additionalHosts: stringArray({
       title: 'Additional ICE hosts',
       item: { description: 'Hostname or IP address MediaMTX advertises as a WebRTC ICE candidate.', examples: ['rover.example.com', 'media-server.local'], minLength: 1, maxLength: 255 },
       array: { description: 'Extra public or LAN hostnames and addresses browsers may use in addition to the hostname derived from the top-level public URL.', uniqueItems: true },
     }),
-  }, { title: 'Media', description: 'Adds optional WebRTC network candidates to the public hostname and local interfaces generated automatically for MediaMTX.', required: ['additionalHosts'] }),
+  }, { title: 'Media', description: 'Configures the WebRTC media port and additional network candidates.', required: ['webrtcPort', 'additionalHosts'] }),
 };

server/src/services/overcurrentProtectionService/index.js

@@ -400,6 +400,7 @@ function createOvercurrentProtectionService(options = {}) {
       type: 'drive',
       driveDirect: { left: 0, right: 0 },
     });
+    issueAdjustedCommand(roverId, { type: 'song', song: { notes: [{ note: 76, duration: 8 }, { note: 72, duration: 8 }, { note: 67, duration: 16 }] } });
     logger.warn('Stopped rover after persistent wheel overcurrent', {
       roverId,
       motor: stalledWheel,

server/src/services/overseerControlService/contextBuilder.js

@@ -1,5 +1,11 @@
 const { evaluateTools } = require('./tools');
 
+function formatTimeContext(timestamp, now) {
+  const at = Number(timestamp);
+  if (!Number.isFinite(at) || at <= 0) return 'time=unknown';
+  return `at=${new Date(at).toISOString()} age_seconds=${Math.max(0, Math.floor((now - at) / 1000))}`;
+}
+
 function normalizeNeatoIssue(value) {
   const raw = String(value || '').trim();
   if (!raw) return 'none';
@@ -7,12 +13,21 @@ function normalizeNeatoIssue(value) {
   return raw;
 }
 
-function toStateUpdate({ mode, homeAssistantState, neatoState, liftState, roster, triggerReason }) {
+function toStateUpdate({ mode, homeAssistantState, activityState, neatoState, liftState, roster, triggerReason, timezone, now = Date.now(), previousRunAt }) {
   const lines = [];
+  lines.push(`current_time: ${new Date(now).toISOString()}`);
+  lines.push(`local_time: ${new Date(now).toLocaleString('en-US', { timeZone: timezone, hour12: false })} timezone=${timezone}`);
+  lines.push(`previous_run: ${formatTimeContext(previousRunAt, now)}`);
   lines.push(`trigger: ${triggerReason || 'heartbeat'}`);
   lines.push(`mode: ${mode || 'unknown'}`);
   lines.push(`home_assistant_connected: ${homeAssistantState?.connected ? 'yes' : 'no'}`);
   lines.push(`lights_locked_on: ${homeAssistantState?.lightPolicy?.lockedOn ? 'yes' : 'no'}`);
+  lines.push(`activity_controls: enabled=${activityState?.enabled ? 'yes' : 'no'} connected=${activityState?.connected ? 'yes' : 'no'}`);
+  for (const item of activityState?.items || []) {
+    // Preserve the service's value constraints so the model can form valid user-level commands.
+    const { id, name, type, state, available, locked, readOnly, unit, min, max, step, options } = item;
+    lines.push(`activity_item: ${JSON.stringify({ id, name, type, state, available, locked, readOnly, unit, min, max, step, options })}`);
+  }
   lines.push(`lift: ${liftState?.connected ? 'connected' : 'offline'} busy=${liftState?.busy ? 'yes' : 'no'}`);
   const neatoError = normalizeNeatoIssue(neatoState?.telemetry?.robotError);
   const neatoAlert = normalizeNeatoIssue(neatoState?.telemetry?.robotAlert);
@@ -56,8 +71,8 @@ function toStateUpdate({ mode, homeAssistantState, neatoState, liftState, roster
   return lines.join('\n');
 }
 
-function buildToolState({ mode, homeAssistantState, neatoState, liftState }) {
-  return evaluateTools({ mode, homeAssistantState, neatoState, liftState });
+function buildToolState({ mode, homeAssistantState, activityState, neatoState, liftState }) {
+  return evaluateTools({ mode, homeAssistantState, activityState, neatoState, liftState });
 }
 
 function formatToolResultMessages(toolCalls) {
@@ -88,7 +103,7 @@ function formatToolResultMessages(toolCalls) {
   return [{ role: 'system', content: ['TOOL_RESULT', ...lines].join('\n') }];
 }
 
-function buildConversation({ recentMessages, name }) {
+function buildConversation({ recentMessages, name, now = Date.now() }) {
   const messages = [];
   (recentMessages || []).forEach((entry) => {
     const text = String(entry?.text || '').trim();
@@ -97,12 +112,13 @@ function buildConversation({ recentMessages, name }) {
 
     const isAssistant = Boolean(entry?.bot);
     const nickname = String(entry?.nickname || (isAssistant ? name || 'Overseer' : 'user')).trim();
+    const timing = `[${formatTimeContext(entry?.ts, now)}]`;
     if (isAssistant) {
-      if (text) messages.push({ role: 'assistant', content: text });
-      messages.push(...toolResultMessages);
+      if (text) messages.push({ role: 'assistant', content: `${timing} ${text}` });
+      messages.push(...toolResultMessages.map((message) => ({ ...message, content: `${message.content}\nmessage_time: ${timing}` })));
       return;
     }
-    if (text) messages.push({ role: 'user', content: `${nickname}: ${text}` });
+    if (text) messages.push({ role: 'user', content: `${timing} ${nickname}: ${text}` });
   });
   return messages;
 }
@@ -143,6 +159,7 @@ function buildModelMessages({
 }
 
 module.exports = {
+  formatTimeContext,
   toStateUpdate,
   buildToolState,
   buildConversation,

server/src/services/overseerControlService/index.js

@@ -7,6 +7,7 @@ const { getRole, roleEvents } = require('../roleService');
 const { getMode, MODES, modeEvents } = require('../modeManager');
 const { verificationEvents } = require('../verificationService');
 const homeAssistantService = require('../homeAssistantService');
+const activityControls = require('../homeAssistantActivitiesService');
 const neatoService = require('../neatoService');
 const liftService = require('../liftService');
 const buttonBoxService = require('../buttonBoxService');
@@ -27,7 +28,7 @@ const {
   normalizeMs,
 } = require('./constants');
 const { isAdminRole, buildAdminState, buildFailureInfo } = require('./runtimeHelpers');
-const { toStateUpdate, buildToolState, buildConversation, buildModelMessages } = require('./contextBuilder');
+const { toStateUpdate, buildToolState, buildConversation, buildModelMessages, formatTimeContext } = require('./contextBuilder');
 const { buildOllamaTools, executeToolAction } = require('./tools');
 const { loadMemory, saveMemory, createDefaultMemory, summarizeMemory } = require('./memoryStore');
 
@@ -91,6 +92,7 @@ const runtime = {
   runHistory: [],
   liveToolCalls: [],
   pendingDirectAddressRun: false,
+  lastDecisionAt: null,
   memoryStore: loadMemory(),
   contextResetAt: Date.now(),
 };
@@ -365,7 +367,7 @@ function buildToolCallFeedEntries(requestedActions = [], actionResults = []) {
   });
 }
 
-function buildRecentEventsSummary() {
+function buildRecentEventsSummary(now) {
   const events = (runtime.liveToolCalls || [])
     .filter((entry) => entry && (entry.phase === 'ok' || entry.phase === 'error' || entry.phase === 'blocked'))
     .slice(-3)
@@ -373,40 +375,50 @@ function buildRecentEventsSummary() {
       const tool = String(entry.tool || 'unknown');
       const phase = String(entry.phase || 'unknown');
       const err = entry.error ? ` error=${String(entry.error).slice(0, 60)}` : '';
-      return `- tool=${tool} phase=${phase}${err}`;
+      return `- ${formatTimeContext(entry.at, now)} tool=${tool} phase=${phase}${err}`;
     });
   if (!events.length) return '- none';
   return events.join('\n');
 }
 
 async function runDecision(triggerReason) {
+  // Use one reference time so all ages in this model request agree.
+  const now = Date.now();
+  const previousRunAt = runtime.lastDecisionAt;
+  runtime.lastDecisionAt = now;
   const runId = runtime.tickCount;
   updateStatus({ phase: 'context_build', currentRunId: runId, lastTriggerReason: triggerReason, lastError: null, lastErrorDetails: null });
 
   const mode = getMode();
   const homeAssistantState = getHomeAssistantState();
+  const activityState = activityControls.getState();
   const neatoState = getNeatoState();
   const liftState = getLiftState();
   const roster = buildRosterSummary();
 
-  const stateUpdate = toStateUpdate({ mode, homeAssistantState, neatoState, liftState, roster, triggerReason });
-  const toolState = buildToolState({ mode, homeAssistantState, neatoState, liftState });
+  const stateUpdate = toStateUpdate({ mode, homeAssistantState, activityState, neatoState, liftState, roster, triggerReason, timezone: loadConfig().timezone, now, previousRunAt });
+  const toolState = buildToolState({ mode, homeAssistantState, activityState, neatoState, liftState });
 
+  let chatCount = 0;
+  let botCount = 0;
   const recentConversation = getRecentMessages(MAX_CHAT_CONTEXT + MAX_BOT_CONTEXT + 20, { includeSystem: true })
     .filter((entry) => Number(entry?.ts || 0) >= runtime.contextResetAt)
     .filter((entry) => {
       if (!entry?.roverId) return true;
       return isPublicChatTargetId(entry.roverId);
     })
-    .slice(-(MAX_CHAT_CONTEXT + MAX_BOT_CONTEXT));
-  const conversationMessages = buildConversation({ recentMessages: recentConversation, name });
+    // Select newest entries within each budget, then restore chronological order.
+    .reverse()
+    .filter((entry) => entry?.bot ? ++botCount <= MAX_BOT_CONTEXT : ++chatCount <= MAX_CHAT_CONTEXT)
+    .reverse();
+  const conversationMessages = buildConversation({ recentMessages: recentConversation, name, now });
 
   const systemPrompt = await readPrompt();
   const modelMessages = buildModelMessages({
     systemPrompt,
     stateUpdate,
     memorySummary: summarizeMemory(runtime.memoryStore),
-    recentEvents: buildRecentEventsSummary(),
+    recentEvents: buildRecentEventsSummary(now),
     conversationMessages,
     availableTools: toolState.available,
     blockedTools: toolState.blocked,
@@ -680,6 +692,7 @@ function clearHistory(reason = 'admin requested clear history', options = {}) {
   runtime.contextResetAt = Date.now();
   runtime.runHistory = [];
   runtime.liveToolCalls = [];
+  runtime.lastDecisionAt = null;
   runtime.generationCount = 0;
   runtime.generationTotalMs = 0;
   if (resetPersistentMemory) {

server/src/services/overseerControlService/tools/activityAct.js

@@ -0,0 +1,32 @@
+const activityControls = require('../../homeAssistantActivitiesService');
+const { getMode } = require('../../modeManager');
+
+module.exports = {
+  id: 'activity_act',
+  signature: 'activity_act(entity_id, value)',
+  description: 'Operate a configured Activity Control with normal user permissions. Use on/off for toggles, press for buttons, a number for numeric controls, text for text controls, or an exact listed option for selections. Locked and read-only items cannot be changed.',
+  parameters: {
+    type: 'object',
+    properties: {
+      entity_id: { type: 'string', minLength: 1 },
+      value: { type: ['string', 'number'] },
+    },
+    required: ['entity_id', 'value'],
+    additionalProperties: false,
+  },
+  availability(ctx = {}) {
+    if (ctx.mode === 'admin' || ctx.mode === 'lockdown') {
+      return { available: false, reason: `policy_lock:site_mode_${ctx.mode}` };
+    }
+    if (!ctx.activityState?.enabled || !ctx.activityState?.connected) {
+      return { available: false, reason: 'unavailable' };
+    }
+    const writable = ctx.activityState.items?.some((item) => item.available && !item.locked && !item.readOnly && item.type !== 'readOnly');
+    return { available: Boolean(writable), reason: writable ? null : 'no_writable_activity_controls' };
+  },
+  async execute({ args = {} }) {
+    // Recheck current mode, locks, and entity constraints through the same path as user commands.
+    await activityControls.act(args.entity_id, args.value, { role: 'user', mode: getMode() });
+    return { ok: true };
+  },
+};

server/src/services/overseerControlService/tools/index.js

@@ -12,6 +12,7 @@ const neatoClearErrors = require('./neatoClearErrors');
 const haSetEntity = require('./haSetEntity');
 const haSetLightColor = require('./haSetLightColor');
 const buttonBoxAddCount = require('./buttonBoxAddCount');
+const activityAct = require('./activityAct');
 
 const TOOL_DEFINITIONS = [
   memoryRead,
@@ -28,6 +29,7 @@ const TOOL_DEFINITIONS = [
   haSetEntity,
   haSetLightColor,
   buttonBoxAddCount,
+  activityAct,
 ];
 const TOOL_BY_ID = new Map(TOOL_DEFINITIONS.map((tool) => [tool.id, tool]));
 

server/src/services/ptzCameraService/index.js

@@ -1,4 +1,5 @@
 // PTZ policy and session facade. Camera IO and participation each own their lifecycle.
+const { getNickname: getNicknameForQueue } = require('../nicknameService');
 const { describeQueue } = require('../turnService/queueDisplay');
 const EventEmitter = require('events');
 
@@ -118,8 +119,10 @@ function describeParticipation(socket) {
     },
     viewMode: socket && canRequestLiveVideo(socket) ? 'live' : 'snapshot',
     turn: {
-      ...describeQueue(queue, currentId),
-      userLabels: Object.fromEntries(queue.map((id) => [id, getSocketLabel(id)])),
+      ...describeQueue(queue, currentId, queue.map((id) => {
+        const participant = io.sockets.sockets.get(id);
+        return { socketId: id, nickname: getNicknameForQueue(participant), role: getRole(participant) };
+      })),
       target: {
         id: PTZ_CAMERA_ID,
         name: cameraConfig.name || 'PTZ Camera',
@@ -127,7 +130,7 @@ function describeParticipation(socket) {
         fallback: null,
       },
       enabled: entered && (isOperator || position > 0) && participation.state.queue.length > 0,
-      isActive: isOperator,
+      ownsControl: isOperator,
       turnsAhead: isOperator ? 0 : position || null,
       queueLength: participation.state.queue.length + (participation.state.operatorSocketId ? 1 : 0),
       deadline: participation.state.deadline,

server/src/services/ptzCameraService/turnLabels.js

@@ -1,14 +1,7 @@
 const labels = {
+  ...require('../turnService/labels'),
   waiting: 'Someone else has control',
-  handoff: 'It’s your turn!',
   active: 'You control the camera',
-  idleWarning: 'Start driving or your turn will be skipped',
-  activeTimer: 'Your turn',
-  waitingTimer: 'Waiting',
-  untilTurn: 'until your turn',
-  timeRemaining: 'left',
-  showTimer: 'Show turn timer',
-  hideTimer: 'Hide turn timer',
   showName: 'Show camera name',
   hideName: 'Hide camera name',
 };

server/src/services/replayDeliveryService/index.js

@@ -35,9 +35,9 @@ async function deliverReplay(payload = {}) {
     requestedBy: payload.requestedBy,
   });
 
-  jobStatus.emit(job, 'accepted', { message: buildAcceptedMessage(job) });
   let providerContext = null;
   try {
+    jobStatus.emit(job, 'accepted', { message: buildAcceptedMessage(job) });
     let providerError = null;
     if (preferredDeliveryProvider?.begin) {
       try {

server/src/services/replayDeliveryService/workflow.js

@@ -2,6 +2,7 @@
 // Purpose: Provides transport-neutral replay jobs, source lookup, status events, and user-facing progress text.
 // Scope: Keeps Discord-command and web-triggered replay delivery on the same core status pipeline.
 const Fuse = require('fuse.js');
+const { updateReplayStatus } = require('../replayEngineV2/cooldown');
 
 const DEFAULT_ALLOWED_MENTIONS = { parse: [], repliedUser: false };
 const FUZZY_THRESHOLD = 0.42;
@@ -180,6 +181,22 @@ function createJobStatusEmitter({ io, logger, sanitizeMentions }) {
 
   function emit(job, status, extra = {}) {
     const payload = buildPayload(job, status, extra);
+    updateReplayStatus(payload);
+    if (status === 'accepted') {
+      // Sound once per participating rover; a disconnected rover must not abort video creation.
+      const { issueCommand } = require('../commandService');
+      const roverIds = new Set(job.sources.filter((entry) => entry.type === 'rover').map((entry) => entry.id));
+      for (const roverId of roverIds) {
+        try {
+          issueCommand(roverId, {
+            type: 'song',
+            song: { notes: [{ note: 72, duration: 8 }, { note: 76, duration: 8 }, { note: 79, duration: 16 }] },
+          });
+        } catch (err) {
+          logger?.warn?.('Unable to play replay tune', { roverId, error: err.message });
+        }
+      }
+    }
     io.emit('replay:status', payload);
     if (status === 'ready' && extra.media) io.emit('replay:ready', extra.media);
     if (status === 'failed') io.emit('replay:failed', payload);

server/src/services/replayEngineV2/cooldown.js

@@ -4,40 +4,61 @@
 const EventEmitter = require('events');
 
 const COOLDOWN_MS = 10 * 1000;
+const MAX_CONCURRENT_JOBS = 3;
 const replayEvents = new EventEmitter();
+const activeJobs = new Map();
+let status = null;
 let lastTriggeredAt = null;
 let lastTriggeredBy = null;
 
-function getRemainingMs(now = Date.now()) {
-  if (!lastTriggeredAt) return 0;
-  return Math.max(0, COOLDOWN_MS - (now - lastTriggeredAt));
-}
-
 function getReplayState() {
-  const remainingMs = getRemainingMs();
+  const remainingMs = lastTriggeredAt === null ? 0 : Math.max(0, COOLDOWN_MS - (Date.now() - lastTriggeredAt));
   return {
     cooldownMs: COOLDOWN_MS,
     lastTriggeredAt,
     lastTriggeredBy,
     remainingMs,
-    available: remainingMs === 0,
+    atJobLimit: activeJobs.size >= MAX_CONCURRENT_JOBS,
+    activeSourceKeys: [...new Set(Array.from(activeJobs.values()).flatMap((sources) =>
+      sources.map((source) => `${source.type}:${source.id}`),
+    ))],
+    status,
+    available: remainingMs === 0 && activeJobs.size < MAX_CONCURRENT_JOBS,
   };
 }
 
-function tryTriggerReplay(by = null) {
-  const remainingMs = getRemainingMs();
-  if (remainingMs > 0) {
-    return { ok: false, remainingMs, state: getReplayState() };
-  }
-  lastTriggeredAt = Date.now();
-  lastTriggeredBy = by || null;
-  const state = getReplayState();
-  replayEvents.emit('update', { state, by: lastTriggeredBy });
-  return { ok: true, state };
+function emitUpdate() {
+  replayEvents.emit('update', { state: getReplayState(), by: lastTriggeredBy });
 }
 
-module.exports = {
-  tryTriggerReplay,
-  getReplayState,
-  replayEvents,
-};
+function tryTriggerReplay({ jobId, by = null } = {}) {
+  const state = getReplayState();
+  if (state.atJobLimit) {
+    return { ok: false, error: 'Replay limit reached: 3 jobs are already being made', state };
+  }
+  if (state.remainingMs > 0) {
+    return { ok: false, error: `Replay cooldown active. Try again in ${Math.ceil(state.remainingMs / 1000)}s.`, remainingMs: state.remainingMs, state };
+  }
+  if (!jobId) throw new Error('Replay job id required');
+  activeJobs.set(jobId, []);
+  status = { jobId, status: 'accepted' };
+  lastTriggeredAt = Date.now();
+  lastTriggeredBy = by;
+  emitUpdate();
+  return { ok: true, state: getReplayState() };
+}
+
+function updateReplayStatus(payload) {
+  if (!activeJobs.has(payload.jobId)) return;
+  if (payload.jobId === status?.jobId) {
+    status = { jobId: payload.jobId, status: payload.status, title: payload.title, message: payload.message };
+  }
+  if (payload.status === 'ready' || payload.status === 'failed') {
+    activeJobs.delete(payload.jobId);
+  } else {
+    activeJobs.set(payload.jobId, payload.sources || []);
+  }
+  emitUpdate();
+}
+
+module.exports = { tryTriggerReplay, getReplayState, replayEvents, updateReplayStatus };

server/src/services/replayEngineV2/index.js

@@ -6,6 +6,7 @@ const { promisify } = require('util');
 const fsp = require('fs/promises');
 const logger = require('../../globals/logger').child('replayEngineV2');
 const roverManager = require('../roverManager');
+const { roomAudioEvents } = require('../roomAudioService');
 const { getRoomCameras, roomCameraEvents } = require('../roomCameraService');
 
 const {
@@ -40,8 +41,8 @@ function getActiveSegmentRoot() {
   return runtime.activeSegmentRoot;
 }
 
-const workerManager = createWorkerManager({ getActiveSegmentRoot });
 const segmentStore = createSegmentStore({ getActiveSegmentRoot });
+const workerManager = createWorkerManager({ getActiveSegmentRoot, onWorkerClosed: segmentStore.refreshIndexForWorker });
 const sidebarRenderer = createSidebarRenderer({ execFileAsync, ensureDir });
 const replayBuilder = createReplayBuilder({
   execFileAsync,
@@ -50,6 +51,7 @@ const replayBuilder = createReplayBuilder({
   renderSidebarVideo: sidebarRenderer.renderSidebarVideo,
   getVideoEntriesForSource: segmentStore.getVideoEntriesForSource,
   getAudioEntriesForSource: segmentStore.getAudioEntriesForSource,
+  getRoomAudioEntries: segmentStore.getRoomAudioEntries,
   overlapping: segmentStore.overlapping,
 });
 registerReplaySocketHooks({ tryTriggerReplay, validateSources, getDefaultWebSources });
@@ -88,6 +90,10 @@ async function start() {
   }, CLEANUP_INTERVAL_MS);
 }
 
+roomAudioEvents.on('update', () => {
+  tick().catch((err) => logger.warn('room audio update tick failed', err.message));
+});
+
 roomCameraEvents.on('update', () => {
   tick().catch((err) => logger.warn('room camera update tick failed', err.message));
 });

server/src/services/replayEngineV2/replayBuilder.js

@@ -51,7 +51,7 @@ function buildChatEventsForWindow(startMs, endMs, limit = 22, preWindowCount = 1
   return [...beforeWindow, ...inWindow].sort((a, b) => a.ts - b.ts);
 }
 
-function createReplayBuilder({ execFileAsync, fsp, ensureDir, renderSidebarVideo, getVideoEntriesForSource, getAudioEntriesForSource, overlapping }) {
+function createReplayBuilder({ execFileAsync, fsp, ensureDir, renderSidebarVideo, getVideoEntriesForSource, getAudioEntriesForSource, getRoomAudioEntries, overlapping }) {
   function resolveReplayWindow({ sources = [], nowMs, guardMs, durationMs }) {
     const tentativeEnd = nowMs - guardMs;
     const sourceEnds = [];
@@ -186,6 +186,28 @@ function createReplayBuilder({ execFileAsync, fsp, ensureDir, renderSidebarVideo
 
       if (!normalizedVideos.length) throw new Error('No replay segments available for selected sources');
 
+      const roomAudioEntries = await pinSegmentFiles(
+        overlapping(getRoomAudioEntries(), tStart, tEnd), tmpDir, 'room-audio-seg',
+      );
+      if (roomAudioEntries.length) {
+        // Place each segment at its recorded time. A mic joining late or
+        // reconnecting must leave silence in the gap, not shift its speech earlier.
+        const audioInputs = roomAudioEntries.flatMap((entry) => ['-i', entry.filePath]);
+        const audioFilters = roomAudioEntries.map((entry, index) => {
+          const start = Math.max(0, (tStart - entry.startMs) / 1000);
+          const duration = (Math.min(tEnd, entry.endMs) - Math.max(tStart, entry.startMs)) / 1000;
+          const delay = Math.max(0, Math.round(entry.startMs - tStart));
+          return `[${index}:a]atrim=start=${start.toFixed(3)}:duration=${duration.toFixed(3)},asetpts=PTS-STARTPTS,adelay=${delay}:all=1[room${index}]`;
+        });
+        const refs = roomAudioEntries.map((_, index) => `[room${index}]`).join('');
+        audioFilters.push(`${refs}amix=inputs=${roomAudioEntries.length}:normalize=0[roomout]`);
+        const roomAudioPath = path.join(tmpDir, 'room-audio.m4a');
+        await execFileAsync(FFMPEG_BIN, ['-y', '-hide_banner', '-loglevel', 'error', ...audioInputs,
+          '-filter_complex', audioFilters.join(';'), '-map', '[roomout]', '-vn', '-ac', '1', '-ar', '48000',
+          '-c:a', 'aac', '-b:a', '96k', roomAudioPath]);
+        normalizedAudios.push(roomAudioPath);
+      }
+
       const layout = buildGridLayout(normalizedVideos.length);
       const { maxWidth, maxHeight } = await probeMaxFrameSize(normalizedVideos.map((v) => v.path));
       let tileWidth = maxWidth || 640;

server/src/services/replayEngineV2/replaySources.js

@@ -68,13 +68,13 @@ function getDefaultWebSources(assignment = {}, socket = null) {
     replay`, follows the camera currently controlled by that socket just as it
     follows an assigned rover below.
 
-    turn.isActive is deliberately stricter than PTZ access or queue membership:
+    turn.ownsControl is deliberately stricter than PTZ access or queue membership:
     spectators and users waiting for a camera turn must not silently replay a
     camera they are not currently operating. Keeping this rule here also makes
     every web replay entry point share the same default instead of teaching the
     chat-command adapter about PTZ-specific state.
   */
-  if (ptzCameraService.getPublicState(socket).turn.isActive) {
+  if (ptzCameraService.getPublicState(socket).turn.ownsControl) {
     const source = ptzCameraService.getReplaySource();
     if (!source) return [];
     return [{ type: source.type, id: String(source.id), label: source.label || source.id }];

server/src/services/replayEngineV2/segmentStore.js

@@ -6,9 +6,10 @@ const fs = require('fs');
 const path = require('path');
 const logger = require('../../globals/logger').child('replayEngineV2');
 const { BUFFER_SECONDS, SEGMENT_SECONDS } = require('./constants');
-const { workers, segmentIndex } = require('./state');
+const { workers, pendingWorkerStarts, segmentIndex } = require('./state');
 const { sourceKey, sourceDirForKey } = require('./sources');
 const ptzCameraService = require('../ptzCameraService');
+const SEGMENT_FILENAME_PATTERN = /^seg-[a-f0-9-]+-\d{6}\.mp4$/;
 
 async function ensureDir(dir) {
   await fsp.mkdir(dir, { recursive: true });
@@ -25,7 +26,7 @@ function createSegmentStore({ getActiveSegmentRoot }) {
       return;
     }
 
-    const segmentFiles = files.filter((entry) => entry.isFile() && /^seg-\d{6}\.mp4$/.test(entry.name)).map((entry) => entry.name).sort();
+    const segmentFiles = files.filter((entry) => entry.isFile() && SEGMENT_FILENAME_PATTERN.test(entry.name)).map((entry) => entry.name).sort();
     if (!segmentFiles.length) {
       segmentIndex.set(key, []);
       return;
@@ -64,6 +65,13 @@ function createSegmentStore({ getActiveSegmentRoot }) {
 
   async function cleanupOldFiles() {
     const cutoff = Date.now() - BUFFER_SECONDS * 1000;
+    // Retention applies to stopped workers too; dynamic microphone sessions
+    // must not leave permanent index entries after their audio expires.
+    for (const [key, entries] of segmentIndex) {
+      const retained = entries.filter((entry) => entry.endMs >= cutoff);
+      if (!retained.length && !workers.has(key) && !pendingWorkerStarts.has(key)) segmentIndex.delete(key);
+      else segmentIndex.set(key, retained);
+    }
     const root = getActiveSegmentRoot();
     try {
       await ensureDir(root);
@@ -81,6 +89,10 @@ function createSegmentStore({ getActiveSegmentRoot }) {
             if (stat.mtimeMs < cutoff) await fsp.unlink(filePath);
           } catch {}
         }
+        if (!workers.has(dirent.name) && !pendingWorkerStarts.has(dirent.name)) {
+          // rmdir only removes empty directories, preserving buffered or newly written files.
+          try { await fsp.rmdir(dirPath); } catch {}
+        }
       }
     } catch (err) {
       logger.warn('cleanup failed', err.message);
@@ -115,6 +127,14 @@ function createSegmentStore({ getActiveSegmentRoot }) {
     return [];
   }
 
+  function getRoomAudioEntries() {
+    // Include retained buffers from microphones that disconnected during the
+    // replay window, rather than limiting history to currently live streams.
+    return [...segmentIndex.entries()]
+      .filter(([key]) => key.startsWith('roomAudio__audio__'))
+      .flatMap(([, entries]) => entries);
+  }
+
   function overlapping(entries, startMs, endMs) {
     return entries.filter((entry) => entry.endMs > startMs && entry.startMs < endMs);
   }
@@ -153,7 +173,7 @@ function createSegmentStore({ getActiveSegmentRoot }) {
       try {
         const files = fs.readdirSync(dir);
         for (const name of files) {
-          if (!/^seg-\d{6}\.mp4$/.test(name)) continue;
+          if (!SEGMENT_FILENAME_PATTERN.test(name)) continue;
           const full = path.join(dir, name);
           let stat;
           try { stat = fs.statSync(full); } catch { continue; }
@@ -172,10 +192,12 @@ function createSegmentStore({ getActiveSegmentRoot }) {
 
   return {
     refreshSegmentIndex,
+    refreshIndexForWorker,
     cleanupOldFiles,
     getVideoEntriesForSource,
     getAudioEntriesForRover,
     getAudioEntriesForSource,
+    getRoomAudioEntries,
     overlapping,
     bootstrapIndexFromDisk,
     getReplayHealthSnapshot,

server/src/services/replayEngineV2/socketHooks.js

@@ -1,6 +1,6 @@
 // Replay Socket Hooks
 // Purpose: Registers web socket replay-trigger handler that publishes replay requests.
-// Scope: Applies replay mode/cooldown/source validation for socket-triggered replay requests.
+// Scope: Applies replay mode/availability/source validation for socket-triggered replay requests.
 const io = require('../../globals/io');
 const logger = require('../../globals/logger').child('replaySocket');
 const { getMode, MODES } = require('../modeManager');
@@ -45,9 +45,9 @@ function registerReplaySocketHooks({ tryTriggerReplay, validateSources, getDefau
       const title = normalizeReplayTitle(payload?.title);
       const includeSidebar = normalizeIncludeSidebar(payload?.includeSidebar);
       const jobId = buildReplayJobId('web');
-      const attempt = tryTriggerReplay({ by: { source: 'web', requester } });
+      const attempt = tryTriggerReplay({ jobId, by: { source: 'web', requester } });
       if (!attempt.ok) {
-        cb({ error: 'Replay cooldown active', remainingMs: attempt.remainingMs, state: attempt.state });
+        cb({ error: attempt.error, remainingMs: attempt.remainingMs, state: attempt.state });
         return;
       }
 

server/src/services/replayEngineV2/sources.js

@@ -2,8 +2,10 @@
 // Purpose: Resolves replay-capable media sources and ffmpeg worker arguments.
 // Scope: Converts live rover/room state into stable source descriptors and stream worker config.
 const path = require('path');
+const { randomUUID } = require('crypto');
 const roverManager = require('../roverManager');
 const { getRoomCameras } = require('../roomCameraService');
+const { getActiveRoomAudioStreams } = require('../roomAudioService');
 const ptzCameraService = require('../ptzCameraService');
 const { FFMPEG_BIN, SEGMENT_SECONDS, TARGET_FPS } = require('./constants');
 
@@ -51,12 +53,17 @@ function listDesiredSources() {
   // both come from the same live MediaMTX path, unlike rovers where audio is a
   // separate published stream.
   sources.push(...ptzCameraService.getReplayWorkerSources());
+  for (const stream of getActiveRoomAudioStreams()) {
+    sources.push({ id: stream.id, sourceType: 'roomAudio', kind: 'audio', label: stream.name,
+      inputUrl: `rtsp://127.0.0.1:8554/room-audio/${encodeURIComponent(stream.id)}` });
+  }
   return sources;
 }
 
 function buildWorkerArgs(activeSegmentRoot, source) {
   const dir = sourceDirForKey(activeSegmentRoot, sourceKey(source));
-  const pattern = path.join(dir, 'seg-%06d.mp4');
+  // Each capture process owns its filenames so restarts preserve buffered segments.
+  const pattern = path.join(dir, `seg-${randomUUID()}-%06d.mp4`);
   // MediaMTX and RTSP cameras use TCP so replay capture has one reliable
   // transport and never falls back to separate RTP/RTCP UDP listeners.
   const inputTransport = /^rtsps?:\/\//i.test(source.inputUrl)

server/src/services/replayEngineV2/workerManager.js

@@ -12,7 +12,7 @@ async function ensureDir(dir) {
   await fsp.mkdir(dir, { recursive: true });
 }
 
-function createWorkerManager({ getActiveSegmentRoot }) {
+function createWorkerManager({ getActiveSegmentRoot, onWorkerClosed }) {
   function startWorker(source) {
     const key = sourceKey(source);
     if (workers.has(key) || pendingWorkerStarts.has(key)) return;
@@ -21,26 +21,36 @@ function createWorkerManager({ getActiveSegmentRoot }) {
     const dir = sourceDirForKey(getActiveSegmentRoot(), key);
     ensureDir(dir)
       .then(() => {
-        if (workers.has(key)) {
+        // Directory creation can finish after a microphone has disconnected.
+        if (workers.has(key) || !listDesiredSources().some((entry) => sourceKey(entry) === key)) {
           pendingWorkerStarts.delete(key);
           return;
         }
         const proc = spawn(FFMPEG_BIN, args, { stdio: ['ignore', 'ignore', 'pipe'] });
-        workers.set(key, { key, source, proc });
+        const worker = { key, source, proc, stopping: false };
+        workers.set(key, worker);
         pendingWorkerStarts.delete(key);
         proc.stderr.on('data', (chunk) => {
           const text = String(chunk || '').trim();
           if (!text) return;
           logger.warn('worker stderr', { key, text: text.slice(0, 500) });
         });
-        proc.on('exit', (code, signal) => {
-          const current = workers.get(key);
-          if (current?.proc === proc) workers.delete(key);
-          logger.warn('worker exited', { key, code, signal });
-          setTimeout(() => {
-            const desired = listDesiredSources().find((entry) => sourceKey(entry) === key);
-            if (desired && !workers.has(key)) startWorker(desired);
-          }, 1500);
+        proc.on('error', (err) => logger.warn('worker process failed', { key, error: err.message }));
+        worker.finished = new Promise((resolve) => {
+          proc.once('close', async (code, signal) => {
+            clearTimeout(worker.killTimer);
+            // FFmpeg writes the final MP4 trailer before close. Index it before
+            // releasing this worker so a disconnect cannot drop its last audio.
+            try { await onWorkerClosed(worker); }
+            catch (err) { logger.warn('final worker indexing failed', { key, error: err.message }); }
+            if (workers.get(key) === worker) workers.delete(key);
+            resolve();
+            logger.warn('worker exited', { key, code, signal });
+            if (!worker.stopping) setTimeout(() => {
+              const desired = listDesiredSources().find((entry) => sourceKey(entry) === key);
+              if (desired && !workers.has(key)) startWorker(desired);
+            }, 1500);
+          });
         });
       })
       .catch((err) => {
@@ -52,8 +62,14 @@ function createWorkerManager({ getActiveSegmentRoot }) {
   function stopWorker(key) {
     const worker = workers.get(key);
     if (!worker) return;
-    try { worker.proc.kill('SIGTERM'); } catch {}
-    workers.delete(key);
+    if (!worker.stopping) {
+      worker.stopping = true;
+      worker.proc.kill('SIGTERM');
+      // Bound shutdown if a capture is blocked waiting on its network input.
+      worker.killTimer = setTimeout(() => worker.proc.kill('SIGKILL'), 3000);
+      worker.killTimer.unref();
+    }
+    return worker.finished;
   }
 
   async function syncWorkers() {
@@ -63,9 +79,11 @@ function createWorkerManager({ getActiveSegmentRoot }) {
       const key = sourceKey(source);
       if (!workers.has(key)) startWorker(source);
     }
+    const stops = [];
     for (const key of Array.from(workers.keys())) {
-      if (!desiredKeys.has(key)) stopWorker(key);
+      if (!desiredKeys.has(key)) stops.push(stopWorker(key));
     }
+    await Promise.all(stops);
   }
 
   return { startWorker, stopWorker, syncWorkers };

server/src/services/roomAudioService/configuration.js

@@ -0,0 +1,14 @@
+const { strictObject, string, boolean } = require('../../configuration/schemaHelpers');
+module.exports = {
+  key: 'roomAudio', feature: true,
+  defaultValue: { enabled: false, sources: [] },
+  schema: strictObject({
+    enabled: boolean({ description: 'Enable room audio and local browser microphone publishing.' }),
+    sources: { type: 'array', items: strictObject({
+      id: string({ minLength: 1, maxLength: 80, pattern: '^[a-zA-Z0-9_-]+$' }),
+      name: string({ minLength: 1, maxLength: 120 }),
+      type: { type: 'string', enum: ['device', 'stream'] },
+      input: string({ minLength: 1, maxLength: 2048, description: 'ALSA device (for example default or plughw:CARD=USB,DEV=0), or a network stream URL.' }),
+    }, { required: ['id', 'name', 'type', 'input'] }) },
+  }, { title: 'Room audio', required: ['enabled', 'sources'] }),
+};

server/src/services/roomAudioService/index.js

@@ -0,0 +1,171 @@
+const { spawn } = require('child_process');
+const EventEmitter = require('events');
+const io = require('../../globals/io');
+const logger = require('../../globals/logger').child('roomAudio');
+const { loadConfig, registerConfigurationHandler } = require('../../configuration');
+const { getSocketIp, isLocalNetwork } = require('../../helpers/ipResolver');
+const { getMode, MODES } = require('../modeManager');
+const { getRole, isAdmin, isLockdownAdmin } = require('../roleService');
+const { canBecomeSpectator } = require('../authService');
+const { isDeterred } = require('../verificationService');
+const videoSessions = require('../videoSessions');
+const roomAudioEvents = new EventEmitter();
+const sources = new Map();
+const mediaSessions = new Map();
+let enabled = false;
+let active = [];
+let polling = false;
+let generation = 0;
+
+function canListen(socket) {
+  if (!enabled || !socket) return false;
+  const mode = getMode();
+  if (mode === MODES.LOCKDOWN) return isLockdownAdmin(socket);
+  if (isAdmin(socket)) return true;
+  if (getRole(socket) === 'spectator') return canBecomeSpectator(socket);
+  // Room audio follows general driving eligibility, without tying listening
+  // to rover assignment, private-rover access, or the current driving turn.
+  return getRole(socket) === 'user' && mode !== MODES.ADMIN && !isDeterred(socket);
+}
+function canPublish(socket, id) {
+  return enabled && isLocalNetwork(getSocketIp(socket)) && sources.get(id)?.socketId === socket.id;
+}
+function getRoomAudioStreams(socket) { return canListen(socket) ? active : []; }
+function getActiveRoomAudioStreams() { return active; }
+function trackMediaSession(id, token) { if (id) mediaSessions.set(id, token); }
+function hasStream(id) { return active.some((source) => source.id === id); }
+function stopSource(id) {
+  const source = sources.get(id);
+  if (!source) return;
+  sources.delete(id);
+  clearTimeout(source.timer);
+  source.child?.kill('SIGTERM');
+  videoSessions.revokeWhere((info) => ['roomAudio', 'roomMic'].includes(info.sourceType) && info.sourceId === id);
+  active = active.filter((entry) => entry.id !== id);
+  roomAudioEvents.emit('update');
+}
+function startWorker(source) {
+  if (sources.get(source.id) !== source) return;
+  const args = ['-nostdin', '-hide_banner', '-loglevel', 'warning'];
+  if (source.type === 'device') args.push('-f', 'alsa');
+  else if (/^rtsps?:/i.test(source.input)) args.push('-rtsp_transport', 'tcp', '-timeout', '10000000');
+  else args.push('-rw_timeout', '10000000');
+  args.push('-i', source.input, '-map', '0:a:0', '-vn', '-c:a', 'libopus', '-ar', '48000', '-ac', '1', '-b:a', '64k', '-f', 'rtsp', '-rtsp_transport', 'tcp', `rtsp://127.0.0.1:8554/room-audio/${source.id}`);
+  const child = spawn('ffmpeg', args, { stdio: ['ignore', 'ignore', 'pipe'] });
+  source.child = child;
+  child.stderr.on('data', (data) => logger.warn('Room audio %s: %s', source.name, String(data).trim()));
+  child.on('error', (error) => logger.warn('Room audio %s: %s', source.name, error.message));
+  child.on('close', () => {
+    if (sources.get(source.id) !== source) return;
+    source.child = null;
+    source.timer = setTimeout(() => startWorker(source), 2000);
+  });
+}
+function applyConfig(config = {}) {
+  const ids = (config.sources || []).map((source) => source.id);
+  if (new Set(ids).size !== ids.length) throw new Error('Room audio source IDs must be unique');
+  generation += 1;
+  enabled = Boolean(config.enabled);
+  const configured = new Map((config.sources || []).map((entry) => {
+    const source = { ...entry, id: `static-${entry.id}` };
+    return [source.id, source];
+  }));
+  for (const [id, source] of sources) {
+    const next = configured.get(id);
+    // Static-source edits should not interrupt browser microphones or restart
+    // unchanged captures. Disabling the feature still stops every source.
+    if (!enabled || (!source.socketId && (!next || next.type !== source.type || next.input !== source.input))) stopSource(id);
+  }
+  if (enabled) for (const [id, source] of configured) {
+    const existing = sources.get(id);
+    if (existing) existing.name = source.name;
+    else {
+      sources.set(id, source);
+      startWorker(source);
+    }
+  }
+  roomAudioEvents.emit('update');
+}
+async function listMediaMtxItems(collection) {
+  const items = [];
+  let page = 0;
+  let pageCount = 1;
+  while (page < pageCount) {
+    const response = await fetch(`http://127.0.0.1:9997/v3/${collection}/list?page=${page}`, { signal: AbortSignal.timeout(1500) });
+    if (!response.ok) throw new Error('MediaMTX unavailable');
+    const data = await response.json();
+    items.push(...(data.items || []));
+    pageCount = data.pageCount || 1;
+    page += 1;
+  }
+  return items;
+}
+
+// Advertise actual ready MediaMTX paths, rather than a browser reservation or
+// an ffmpeg process that may still be trying to connect to its input.
+async function refreshStreams() {
+  if ((!enabled && !mediaSessions.size) || polling) return;
+  polling = true;
+  const currentGeneration = generation;
+  let ready = new Set();
+  try {
+    // HTTP authorization is checked at connection time. Recheck established
+    // browser sessions too so lockdown, disable, and disconnect stop live audio.
+    const previousSessionIds = [...mediaSessions.keys()];
+    const sessions = await listMediaMtxItems('webrtcsessions');
+    const liveSessionIds = new Set(sessions.map((session) => session.id));
+    for (const session of sessions) {
+      if (!session.path?.startsWith('room-audio/')) continue;
+      const info = videoSessions.getSession(mediaSessions.get(session.id));
+      const socket = info && io.sockets.sockets.get(info.socketId);
+      const allowed = socket && (session.state === 'publish'
+        ? info.sourceType === 'roomMic' && canPublish(socket, info.sourceId)
+        : info.sourceType === 'roomAudio' && canListen(socket));
+      if (!allowed) await fetch(`http://127.0.0.1:9997/v3/webrtcsessions/kick/${session.id}`, { method: 'POST', signal: AbortSignal.timeout(1500) });
+    }
+    for (const id of previousSessionIds) if (!liveSessionIds.has(id)) mediaSessions.delete(id);
+  } catch (error) {
+    logger.warn('Room audio permission refresh failed: %s', error.message);
+  }
+  // Permission API failures must not make ready streams disappear. Only path
+  // discovery determines the catalog used by playback and replay capture.
+  try {
+    const paths = await listMediaMtxItems('paths');
+    for (const path of paths) if (path.ready) ready.add(path.name);
+  } catch { ready = new Set(); }
+  finally { polling = false; }
+  if (generation !== currentGeneration) return;
+  const next = [...sources.values()].filter((source) => ready.has(`room-audio/${source.id}`)).map(({ id, name }) => ({ id, name }));
+  if (JSON.stringify(next) !== JSON.stringify(active)) {
+    active = next;
+    roomAudioEvents.emit('update');
+  }
+}
+io.on('connection', (socket) => {
+  socket.on('roomAudio:start', (_payload, cb = () => {}) => {
+    if (!enabled || !isLocalNetwork(getSocketIp(socket))) return cb({ error: 'Room microphone publishing requires a local visitor and enabled room audio.' });
+    // One owned path per socket; retries replace credentials without accumulating streams.
+    const id = `mic-${socket.id}`;
+    videoSessions.revokeWhere((info) => info.sourceType === 'roomMic' && info.sourceId === id);
+    sources.set(id, { id, name: 'Room microphone', socketId: socket.id });
+    const token = videoSessions.createSession(socket, { type: 'roomMic', id });
+    cb({ id, token, url: `/video/room-audio/${id}/whip` });
+  });
+  socket.on('roomAudio:release', ({ token } = {}) => {
+    const info = videoSessions.getSession(token);
+    if (info?.socketId === socket.id && info.sourceType === 'roomAudio') videoSessions.revokeSession(token);
+  });
+  socket.on('roomAudio:stop', (_payload, cb = () => {}) => {
+    stopSource(`mic-${socket.id}`);
+    cb({ success: true });
+  });
+  socket.on('disconnect', () => {
+    stopSource(`mic-${socket.id}`);
+  });
+});
+applyConfig(loadConfig().roomAudio);
+registerConfigurationHandler('roomAudio', applyConfig);
+const pollTimer = setInterval(refreshStreams, 2000);
+pollTimer.unref();
+process.once('exit', () => { for (const source of sources.values()) source.child?.kill('SIGTERM'); });
+module.exports = { getActiveRoomAudioStreams, trackMediaSession, roomAudioEvents, getRoomAudioStreams, canListen, canPublish, hasStream };

server/src/services/roomCameraService/configuration.js

@@ -1,7 +1,7 @@
 // Room-Camera Configuration
 // Purpose: Defines the optional named snapshot and stream camera catalog.
 // Scope: Contains configuration metadata only and never contacts a camera.
-const { strictObject, string, boolean } = require('../../configuration/schemaHelpers');
+const { strictObject, string, boolean, integer } = require('../../configuration/schemaHelpers');
 
 module.exports = {
   key: 'roomCameras',
@@ -10,6 +10,7 @@ module.exports = {
   // initial configuration while the feature switch prevents network requests.
   defaultValue: {
     enabled: false,
+    streamIntervalMs: 2000,
     cameras: [
       {
         id: 'lobby',
@@ -29,6 +30,7 @@ module.exports = {
   },
   schema: strictObject({
     enabled: boolean({ description: 'Immediately publishes the configured room-camera catalog and enables camera snapshots and streams.' }),
+    streamIntervalMs: integer({ title: 'Stream interval (ms)', description: 'Interval for sending room camera images to clients. Lowering this increases bandwidth usage FAST because it sends a full image each time.', minimum: 1 }),
     cameras: {
       type: 'array',
       description: 'Room cameras available to the web UI and replay system.',

server/src/services/roomCameraService/index.js

@@ -8,10 +8,12 @@ const replay = require('../replayEngineV2/roomCameraReplayBuilder');
 const { loadConfig, registerConfigurationHandler } = require('../../configuration');
 
 let enabled = false;
+let streamIntervalMs = 2000;
 
 const snapshotEngine = createSnapshotEngine({ getRoomCameras, roomCameraEvents });
 function applyRoomCameraConfig(roomCameraConfig = {}) {
   enabled = Boolean(roomCameraConfig.enabled);
+  streamIntervalMs = roomCameraConfig.streamIntervalMs ?? 2000;
   // Loading an empty catalog on disable causes the snapshot engine's existing
   // update listener to close every stream and timer without unregistering the
   // stable browser gateway.
@@ -19,6 +21,7 @@ function applyRoomCameraConfig(roomCameraConfig = {}) {
 }
 
 registerRoomCameraSocketGateway({
+  getStreamIntervalMs: () => streamIntervalMs,
   getRoomCamera,
   getRoomCameras,
   getRoomCameraState: snapshotEngine.getRoomCameraState,

server/src/services/roomCameraService/socketGateway.js

@@ -8,7 +8,6 @@ const { isAdmin, isLockdownAdmin, getRole } = require('../roleService');
 
 const SUBSCRIBE_LIMIT = 50;
 const SUBSCRIBE_WINDOW_MS = 10000;
-const STREAM_INTERVAL_MS = 2000;
 
 function passesMode(socket) {
   const mode = getMode();
@@ -20,7 +19,7 @@ function passesMode(socket) {
   return true;
 }
 
-function registerRoomCameraSocketGateway({ getRoomCamera, getRoomCameras, getRoomCameraState, roomCameraStreamEvents }) {
+function registerRoomCameraSocketGateway({ getRoomCamera, getRoomCameras, getRoomCameraState, roomCameraStreamEvents, getStreamIntervalMs }) {
   const cameraSubscribers = new Map();
   const socketSubscriptions = new Map();
   const subscribeBuckets = new Map();
@@ -82,7 +81,7 @@ function registerRoomCameraSocketGateway({ getRoomCamera, getRoomCameras, getRoo
       }
       const lastSent = lastMap.get(id) || 0;
       const now = ts || Date.now();
-      if (now - lastSent < STREAM_INTERVAL_MS) return;
+      if (now - lastSent < getStreamIntervalMs()) return;
       lastMap.set(id, now);
       sendFrame(socket, id, { ts }, buffer);
     });

server/src/services/roverHelpService/index.js

@@ -2,20 +2,19 @@
 // Purpose: Publishes sustained 600-series Roomba trouble as roster and alert state.
 // Scope: Integrates the pure monitor with roverManager, browser alerts, and the event bus.
 const roverManager = require('../roverManager');
+const { issueCommand } = require('../commandService');
 const { sendAlert } = require('../alertService');
 const { publishEvent } = require('../eventBus');
 const { REASON_LABELS, createRoverHelpMonitor } = require('./monitor');
 const { createHelpHornNotifier } = require('./hornNotifier');
+const logger = require('../../globals/logger').child('roverHelpService');
 
 const HELP_ALERT_COLOR = '#ef4444';
 
 const hornNotifier = createHelpHornNotifier({
   getRover: (roverId) => roverManager.rovers.get(String(roverId)),
-  // commandService imports roverManager, so resolving it only when a chirp is
-  // actually issued avoids turning server startup order into a circular module
-  // dependency while retaining the established command transport.
-  issueCommand: (roverId, payload) => require('../commandService').issueCommand(roverId, payload),
-  logger: require('../../globals/logger').child('roverHelpService'),
+  issueCommand,
+  logger,
 });
 
 const monitor = createRoverHelpMonitor({
@@ -42,6 +41,11 @@ const monitor = createRoverHelpMonitor({
       });
     } else if (wasNeedingHelp && !needsHelp) {
       hornNotifier.stop(roverId);
+      try {
+        issueCommand(roverId, { type: 'song', song: { notes: [{ note: 72, duration: 8 }, { note: 79, duration: 16 }] } });
+      } catch (err) {
+        logger.warn('Failed to play HELP-cleared confirmation', { roverId, error: err.message });
+      }
       publishEvent({
         source: 'roverHelpService',
         type: 'rover.helpCleared',

server/src/services/roverLearningService/capabilities.js

@@ -0,0 +1,18 @@
+// Match actuator configuration, not a rover's display name or changing telemetry.
+const { isDeepStrictEqual } = require('node:util');
+const POLICY_VERSION = 5;
+
+function controlProfile(meta = {}) {
+  return Object.fromEntries(['cameraServo', 'headlight', 'roomba', 'platform']
+    .map((key) => [key, meta?.[key] ?? null]));
+}
+
+function compatible(model, record) {
+  if (model?.specification?.version !== POLICY_VERSION || !record) return false;
+  const profile = controlProfile(record.meta);
+  // Retained recordings may include removed actuator fields. Compare only
+  // controls this policy actually uses, on both sides of the boundary.
+  return Array.isArray(model.controlProfiles) && model.controlProfiles.some((saved) => isDeepStrictEqual(controlProfile(saved), profile));
+}
+
+module.exports = { POLICY_VERSION, controlProfile, compatible };

server/src/services/roverLearningService/configuration.js

@@ -0,0 +1,47 @@
+// Metadata only: loading the configuration must never start the learning runtime.
+const { strictObject, boolean, integer, number, string } = require('../../configuration/schemaHelpers');
+
+module.exports = {
+  key: 'roverLearning',
+  feature: true,
+  defaultValue: {
+    enabled: false,
+    recording: { maxGiB: 20, minimumFreeGiB: 2, sessionSeconds: 300 },
+    driving: { threads: 4, actionThreshold: 0.7, staleMs: 2000 },
+    training: {
+      enabled: true, python: '/opt/rover-learning/bin/python', threads: 8,
+      batchSize: 16, maxSamples: 1024, minimumSamples: 128, passesPerJob: 2,
+      maxStepsPerJob: 200, checkpointEverySteps: 1000,
+      minimumDrivingMinutes: 30, newDrivingMinutesPerModel: 10,
+      intervalSeconds: 60, maxJobSeconds: 600,
+    },
+  },
+  schema: strictObject({
+    enabled: boolean({ description: 'Enable human-session recording, background learning, and verified-user model control. Disabled starts no workers or storage.' }),
+    driving: strictObject({
+      threads: integer({ minimum: 1, maximum: 16, description: 'CPU threads per active model controller.' }),
+      actionThreshold: number({ minimum: 0.5, maximum: 0.99, description: 'Minimum model score for issuing a command, including drive and stop commands.' }),
+      staleMs: integer({ minimum: 1000, maximum: 5000, description: 'Stop when video, sensors, or model predictions are older than this many milliseconds.' }),
+    }, { description: 'Live model execution. Manual inputs do not stop or pause the model.', required: ['threads', 'actionThreshold', 'staleMs'] }),
+    recording: strictObject({
+      maxGiB: number({ minimum: 0.1, maximum: 100000, description: 'Rolling recording budget in GiB. Checked every 15 seconds; active files can temporarily exceed it. Published models are never pruned.' }),
+      minimumFreeGiB: number({ minimum: 0.1, maximum: 100000, description: 'Pause recording below this amount of available filesystem space, in GiB.' }),
+      sessionSeconds: integer({ minimum: 30, maximum: 3600, description: 'Rotate video and telemetry sessions after this many seconds so completed sessions can be pruned.' }),
+    }, { description: 'Bounded recording storage. Limits never delete published models.', required: ['maxGiB', 'minimumFreeGiB', 'sessionSeconds'] }),
+    training: strictObject({
+      enabled: boolean({ description: 'Train periodically from completed usable human recordings while the service is enabled.' }),
+      python: string({ minLength: 1, description: 'Python executable with the service requirements installed. The container supplies /opt/rover-learning/bin/python.' }),
+      threads: integer({ minimum: 1, maximum: 32, description: 'CPU threads for the lower-priority training process.' }),
+      batchSize: integer({ minimum: 1, maximum: 64, description: 'Training windows per optimizer step.' }),
+      maxSamples: integer({ minimum: 128, maximum: 2048, description: 'Maximum decoded windows retained in RAM per job. Each contains four 160x120 RGB frames.' }),
+      minimumSamples: integer({ minimum: 1, maximum: 128, description: 'Usable sampled windows required before training.' }),
+      passesPerJob: integer({ minimum: 1, maximum: 10, description: 'Shuffled passes over the sampled windows per job.' }),
+      minimumDrivingMinutes: number({ minimum: 1, maximum: 100000, description: 'Minimum distinct usable training footage in minutes before promoting Latest; repeated passes do not count.' }),
+      newDrivingMinutesPerModel: number({ minimum: 1, maximum: 100000, description: 'Additional distinct usable footage required between Latest promotions.' }),
+      maxStepsPerJob: integer({ minimum: 1, maximum: 10000, description: 'Optimizer step cap per finite training job.' }),
+      checkpointEverySteps: integer({ minimum: 1, maximum: 100000, description: 'Accumulated training steps between gated Latest promotions. Permanent named snapshots are created by administrators.' }),
+      intervalSeconds: integer({ minimum: 30, maximum: 86400, description: 'Minimum seconds between completed training jobs.' }),
+      maxJobSeconds: integer({ minimum: 30, maximum: 3600, description: 'Wall-clock budget including video decoding; slow/stuck workers are stopped.' }),
+    }, { description: 'Ongoing CPU learning, sampling, and gated Latest checkpoint updates.', required: ['enabled', 'python', 'threads', 'batchSize', 'maxSamples', 'minimumSamples', 'passesPerJob', 'minimumDrivingMinutes', 'newDrivingMinutesPerModel', 'maxStepsPerJob', 'checkpointEverySteps', 'intervalSeconds', 'maxJobSeconds'] }),
+  }, { description: 'Optional rover recording and learning service.', required: ['enabled', 'recording', 'training', 'driving'] }),
+};

server/src/services/roverLearningService/diagnostics.js

@@ -0,0 +1,64 @@
+// Export an explicit allowlist, never the raw socket/session/configuration object.
+const { redact } = require('./errors');
+const { POLICY_VERSION } = require('./capabilities');
+const os = require('node:os');
+const fs = require('node:fs');
+const path = require('node:path');
+const { createHash } = require('node:crypto');
+const applicationVersion = require('../../../package.json').version;
+const hash = createHash('sha256');
+for (const file of ['workers/policy.py', 'workers/dataset.py', 'workers/train.py', 'workers/infer.py', 'workers/observations.py', 'workers/learning.py',
+  'capabilities.js', 'errors.js', 'storage.js', 'runtime.js', 'models.js', 'driving.js', 'recording.js', 'training.js', 'socketGateway.js', 'diagnostics.js']) {
+  hash.update(fs.readFileSync(path.join(__dirname, file)));
+}
+const implementationSha256 = hash.digest('hex');
+
+function errorCategory(value) {
+  if (!value) return null;
+  const text = String(value).toLowerCase();
+  for (const [pattern, category] of [
+    [/timestamp|pts|clock|aligned/, 'time_alignment'], [/sensor/, 'sensors'],
+    [/video|decode|ffmpeg|rtsp/, 'video'], [/permission|turn|control permission/, 'permission'],
+    [/schema|shape|version/, 'model_schema'], [/space|disk|enospc/, 'storage'],
+    [/sample|window|command/, 'dataset_or_command'], [/worker|exited|process/, 'worker'],
+  ]) if (pattern.test(text)) return category;
+  return 'unclassified';
+}
+
+function report(state, controller) {
+  const training = state.training || {};
+  const metrics = training.diagnostics || {};
+  const session = state.session;
+  return {
+    reportVersion: 3, generatedAtUnixMs: state.updatedAt,
+    software: { applicationVersion, implementationSha256, policyVersion: POLICY_VERSION, node: process.version,
+      dependencies: metrics.dependencies || null },
+    host: { logicalCpus: os.cpus().length, totalMemoryBytes: os.totalmem(), freeMemoryBytes: os.freemem(), loadAverage: os.loadavg() },
+    settings: state.limits,
+    recording: { paused: state.recording.paused, bytes: state.recording.bytes,
+      freeBytes: state.recording.freeBytes, pendingBytes: state.recording.pendingBytes,
+      droppedPending: state.recording.droppedPending,
+      sessions: state.recording.sessions.map((item) => ({ startedAtUnixMs: item.startedAt,
+        status: item.video, droppedEvents: item.droppedEvents, error: redact(item.error), failureDetails: item.failureDetails || null, stderr: redact(item.stderr), errorCategory: errorCategory(item.error) })) },
+    training: { status: training.status, steps: training.steps, examples: training.examples,
+      selection: training.selection || null, evaluatedSteps: training.evaluatedSteps ?? null,
+      loss: training.loss, losses: training.losses || null, publication: training.publication || null,
+      trainingAudit: metrics.trainingAudit || null,
+      evaluation: training.evaluation || null, dataset: metrics.dataset || training.dataset || null,
+      resources: { decodeSeconds: metrics.decodeSeconds ?? null, trainingSeconds: metrics.trainingSeconds ?? null,
+        evaluationSeconds: metrics.evaluationSeconds ?? null, probeSeconds: metrics.probeSeconds ?? null, beforeAuditSeconds: metrics.beforeAuditSeconds ?? null, checkpointSeconds: metrics.checkpointSeconds ?? null, cpuSeconds: metrics.cpuSeconds ?? null,
+        peakRssMiB: metrics.peakRssMiB ?? null },
+      history: training.history || [], rejectionReasons: (training.rejectionReasons || []).map(redact), rejectionCategories: (training.rejectionReasons || []).map(errorCategory),
+      error: redact(training.error), errorCategory: errorCategory(training.error), nextAttemptAtUnixMs: training.nextAttemptAt },
+    model: session ? { id: session.modelId, checkpointId: session.checkpointId, threshold: session.threshold, appliedThreshold: session.appliedThreshold } : null,
+    controller: controller ? { modelId: controller.modelId, sensorPresent: controller.sensorPresent || null,
+      stopReason: redact(controller.stopReason), stopCategory: errorCategory(controller.stopReason), history: (controller.history || []).map((item) => ({
+        ...item, submissions: item.submissions.map((submission) => ({ type: submission.type,
+          command: submission.command, result: redact(submission.result) })) })) } : null,
+    sensorFields: metrics.policy?.sensorFields || null,
+    timing: { alignment: 'server_receipt', browserVideoLatencyMs: null, wheelCommandExpiryMs: null },
+    events: state.activity.map(({ at, message, detail, error, stderr }) => ({ atUnixMs: at, message: redact(message), detail: redact(detail), error: error || null, stderr: redact(stderr) })),
+    unavailable: ['browser_video_latency', 'actual_physical_command_execution', 'live_training_cpu_utilization'],
+  };
+}
+module.exports = { report };

server/src/services/roverLearningService/driving.js

@@ -0,0 +1,203 @@
+// Autonomy owns a live user's control context, never an administrative identity.
+const path = require('node:path');
+const { spawn } = require('node:child_process');
+const roverManager = require('../roverManager');
+const { isVerified, isDeterred } = require('../verificationService');
+const { isAdmin } = require('../roleService');
+const { submitCommand, issueCommand, subscribeCommandRecording } = require('../commandService');
+const { recordCommandRequest } = require('../commandService/recording');
+const { acquireModel } = require('./models');
+const { compatible } = require('./capabilities');
+
+const OPERATING = new Set(['drive', 'servo', 'headlight', 'raw']);
+const MODE_COMMANDS = new Set([128, 131, 132, 143].map((opcode) => Buffer.from([opcode]).toString('base64')));
+const clamp = (value, min, max) => Math.max(min, Math.min(max, Number(value) || 0));
+
+function canControl(socket, roverId) {
+  return Boolean(socket?.connected && isVerified(socket) && (isAdmin(socket) || !isDeterred(socket))
+    && roverManager.rovers.get(roverId)?.ws && roverManager.canDrive(roverId, socket));
+}
+
+function createDriving({ root, config, onChange, activity }) {
+  const sessions = new Map();
+  const recent = new Map();
+  let stopping = false;
+  let watchdog;
+  let unsubscribe;
+
+  function sendState(session, event) {
+    const input = session.worker.stdin;
+    if (input.destroyed || !input.writable || input.writableLength > 256 * 1024) return;
+    input.write(JSON.stringify(event) + '\n');
+  }
+
+  function transmit(session, command) {
+    if (session.status === 'stopping') return;
+    if (!canControl(session.socket, session.roverId)) { stop(session.roverId, 'Control permission lost'); return; }
+    if (!OPERATING.has(command?.type)) throw new Error('Unsupported model command');
+    if (command.type === 'raw' && !MODE_COMMANDS.has(command.raw)) throw new Error('Unsupported model operating-mode command');
+    const record = roverManager.rovers.get(session.roverId);
+    if (command.type === 'drive') {
+      const limit = Math.min(500, Number(record.meta?.maxWheelSpeed) || 500);
+      command.driveDirect = { left: Math.round(clamp(command.driveDirect?.left, -limit, limit)), right: Math.round(clamp(command.driveDirect?.right, -limit, limit)) };
+    }
+    if (command.type === 'servo') {
+      const servo = record.meta?.cameraServo;
+      if (!servo?.enabled) { session.submissions.push({ command, result: 'Servo unavailable' }); return; }
+      command.servo.angle = clamp(command.servo?.angle, servo.minAngle ?? 0, servo.maxAngle ?? 180);
+    }
+    const { type, ...data } = command;
+    recordCommandRequest(session.socket, { roverId: session.roverId, type, data }, (result) => {
+      session.lastResult = result.error || result.reason || 'issued';
+      session.submissions.push({ command, result: session.lastResult });
+      if (result.id) session.lastAction = { at: Date.now(), command };
+    }, (request, reply) => submitCommand(session.socket, request, reply), 'model');
+  }
+
+  function stop(roverId, reason = 'Stopped by user') {
+    const session = sessions.get(roverId);
+    if (!session) return Promise.resolve();
+    if (session.done) return session.done;
+    session.status = 'stopping';
+    session.stopReason = reason;
+    // A stop must still reach the rover after turn permission is revoked.
+    for (const command of [
+      { type: 'drive', driveDirect: { left: 0, right: 0 } },
+    ]) { try { issueCommand(roverId, command); } catch { /* Rover may already be offline. */ } }
+    session.worker.kill('SIGTERM');
+    const timer = setTimeout(() => session.worker.kill('SIGKILL'), 2000);
+    session.done = session.closed.then(() => {
+      clearTimeout(timer);
+      recent.delete(roverId);
+      recent.set(roverId, { modelId: session.modelId, stopReason: reason, history: session.history });
+      if (recent.size > 20) recent.delete(recent.keys().next().value);
+      sessions.delete(roverId);
+      activity('Controller stopped', { roverId, reason });
+      onChange();
+    });
+    onChange();
+    return session.done;
+  }
+
+  async function start(socket, roverId, modelId) {
+    if (stopping || !canControl(socket, roverId)) throw new Error('You cannot control this rover');
+    const acquired = await acquireModel(root, modelId);
+    const { directory, metadata } = acquired;
+    try {
+      if (!compatible(metadata, roverManager.rovers.get(roverId))) throw new Error('Model is not compatible with this rover');
+      if (stopping || !canControl(socket, roverId)) throw new Error('Control permission changed');
+      if (sessions.has(roverId)) throw new Error('Stop the current controller before starting another model');
+    } catch (error) { await acquired.release(); throw error; }
+    const worker = spawn(config.training.python, [path.join(__dirname, 'workers/infer.py'), '--model', directory,
+      '--url', `rtsp://127.0.0.1:8554/${encodeURIComponent(roverId)}`, '--threads', String(config.driving.threads),
+      '--threshold', String(config.driving.actionThreshold)], { stdio: ['pipe', 'pipe', 'pipe'], env: { ...process.env, PYTHONDONTWRITEBYTECODE: '1' } });
+    const session = { worker, socket, roverId, modelId, checkpointId: metadata.id, modelName: modelId === 'latest' ? 'Latest' : modelId === 'previous' ? 'Previous' : metadata.name, status: 'starting', startedAt: Date.now(), lastPredictionAt: null, threshold: config.driving.actionThreshold, history: [] };
+    session.closed = new Promise((resolve) => worker.once('close', resolve));
+    session.closed.then(() => acquired.release()).catch((error) => activity('Checkpoint release failed', { error: error.message }));
+    sessions.set(roverId, session);
+    recent.delete(roverId);
+    let output = '';
+    let stderr = '';
+    worker.stdin.on('error', () => { stop(roverId, 'Worker input closed'); });
+    worker.stderr.on('data', (chunk) => { stderr = (stderr + chunk).slice(-1000); });
+    worker.on('error', (error) => { stop(roverId, error.message); });
+    worker.once('close', () => { stop(roverId, stderr || 'Worker exited'); });
+    worker.stdout.on('data', (chunk) => {
+      if (session.status === 'stopping') return;
+      output += chunk;
+      if (output.length > 1024 * 1024) { stop(roverId, 'Worker output exceeded limit'); return; }
+      let newline;
+      while ((newline = output.indexOf('\n')) >= 0) {
+        const line = output.slice(0, newline);
+        output = output.slice(newline + 1);
+        try {
+          const message = JSON.parse(line);
+          if (message.kind === 'error') throw new Error(message.message);
+          if (message.kind !== 'prediction') continue;
+          if (!Number.isFinite(message.frameAt) || Math.abs(Date.now() - message.frameAt) > config.driving.staleMs) throw new Error('Video is stale');
+          if (!Number.isFinite(message.sensorAt) || Math.abs(Date.now() - message.sensorAt) > config.driving.staleMs) throw new Error('Sensors are stale');
+          if (!canControl(socket, roverId)) throw new Error('Control permission lost');
+          session.status = 'running';
+          session.lastPredictionAt = Date.now();
+          session.frameAt = message.frameAt;
+          session.sensorAt = message.sensorAt;
+          session.latencyMs = message.latencyMs;
+          session.proposals = Array.isArray(message.proposals) ? message.proposals.slice(0, 64) : [];
+          session.appliedThreshold = message.threshold;
+          session.sensorPresent = message.sensorPresent;
+          session.submissions = [];
+          if (!Array.isArray(message.commands) || message.commands.length > 65) throw new Error('Invalid action batch');
+          session.predictionStatus = message.commands.length ? `${message.commands.length} command(s) proposed` : 'No command proposed';
+          // Manual commands intentionally do not stop or pause this controller.
+          for (const command of message.commands) transmit(session, command);
+          // Bound report history independently of camera and UI frame rates.
+          if (!session.history.length || Date.now() - session.history.at(-1).at >= 500) {
+            session.history.push({ at: Date.now(),
+              latencyMs: session.latencyMs, frameAgeMs: Date.now() - session.frameAt,
+              sensorAgeMs: Date.now() - session.sensorAt, threshold: session.appliedThreshold,
+              proposals: [...session.proposals].sort((a, b) => b.score - a.score).slice(0, 8).map(({ slot, score, reason, command }) => ({ slot, score, reason, command })),
+              submissions: session.submissions.slice(0, 16).map(({ command, result }) => ({ type: command.type, result, command })) });
+            if (session.history.length > 60) session.history.shift();
+          }
+        } catch (error) { stop(roverId, error.message); break; }
+      }
+    });
+    const sensors = roverManager.rovers.get(roverId)?.lastSensor?.decoded;
+    if (sensors) sendState(session, { kind: 'sensor', ts: Date.now(), data: sensors });
+    activity('Controller started', { roverId, model: metadata.name, socketId: socket.id });
+    onChange();
+  }
+
+  function sensor(event) {
+    const session = sessions.get(String(event.roverId));
+    if (session) sendState(session, { kind: 'sensor', ts: Date.now(), data: event.sensors });
+  }
+
+  function attach() {
+    roverManager.managerEvents.on('sensor', sensor);
+    unsubscribe = subscribeCommandRecording((event) => {
+      const session = sessions.get(String(event.roverId));
+      if (session && event.phase === 'dispatched') sendState(session, { kind: 'command', ts: event.ts, data: event.command });
+    });
+    watchdog = setInterval(() => {
+      for (const session of sessions.values()) {
+        if (!canControl(session.socket, session.roverId)) stop(session.roverId, 'Control permission lost');
+        else if (Date.now() - (session.lastPredictionAt || session.startedAt) > (session.lastPredictionAt ? config.driving.staleMs : 30000)) {
+          stop(session.roverId, 'No fresh model predictions');
+        }
+      }
+    }, 250);
+  }
+
+  return {
+    attach, start, stop, canControl,
+    setThreshold(socket, roverId, value) {
+      const session = sessions.get(roverId);
+      if (!session || session.status === 'stopping' || !canControl(socket, roverId)) throw new Error('You cannot adjust this controller');
+      if (typeof value !== 'number' || !Number.isFinite(value) || value < .05 || value > .99) throw new Error('Threshold must be between 0.05 and 0.99');
+      session.threshold = value;
+      sendState(session, { kind: 'settings', ts: Date.now(), threshold: value });
+    },
+    getDiagnostics(id) {
+      const session = sessions.get(id);
+      return session ? { modelId: session.modelId, sensorPresent: session.sensorPresent, history: session.history } : recent.get(id) || null;
+    },
+    isActive: (id) => sessions.has(id),
+    getState: (id) => {
+      const session = sessions.get(id);
+      if (!session) return null;
+      const { worker, socket, closed, done, history, ...state } = session;
+      return { ...state, startedBy: socket.data?.nickname || socket.id, socketId: socket.id };
+    },
+    shutdown: async () => {
+      stopping = true;
+      clearInterval(watchdog);
+      unsubscribe?.();
+      roverManager.managerEvents.off('sensor', sensor);
+      await Promise.all([...sessions.keys()].map((id) => stop(id, 'Service disabled')));
+    },
+    kill: () => { for (const session of sessions.values()) session.worker.kill('SIGKILL'); },
+  };
+}
+
+module.exports = { createDriving, canControl };